/cracklib-2.8.19/lib/fascist.c

# · C · 886 lines · 764 code · 92 blank · 30 comment · 76 complexity · 0a39ca007af600b9333a39663515b8c2 MD5 · raw file 

    

  1. /*
    2. 

  2.  * This program is copyright Alec Muffett 1993, portions copyright other authors.
    3. 

  3.  * The authors disclaim all responsibility or liability with respect to it's usage
    4. 

  4.  * or its effect upon hardware or computer systems.
    5. 

  5.  */
    6. 

  6. 

  7. #include "config.h"
    8. 

  8. #include <sys/types.h>
    9. 

  9. #include <errno.h>
    10. 

  10. #include <limits.h>
    11. 

  11. #include <pwd.h>
    12. 

  12. #include <stdlib.h>
    13. 

  13. #include <string.h>
    14. 

  14. #ifdef HAVE_UNISTD_H
    15. 

  15. #include <unistd.h>
    16. 

  16. #endif
    17. 

  17. 

  18. #if defined(HAVE_INTTYPES_H)
    19. 

  19. #include <inttypes.h>
    20. 

  20. #else
    21. 

  21. #if defined(HAVE_STDINT_H)
    22. 

  22. #include <stdint.h>
    23. 

  23. #else
    24. 

  24. typedef unsigned int uint32_t;
    25. 

  25. typedef unsigned short uint16_t;
    26. 

  26. #endif
    27. 

  27. #endif
    28. 

  28. 

  29. #include "packer.h"
    30. 

  30. 

  31. #define ISSKIP(x) (isspace(x) || ispunct(x))
    32. 

  32. 

  33. #define MINDIFF 5
    34. 

  34. #define MINLEN 6
    35. 

  35. 

  36. #undef DEBUG
    37. 

  37. #undef DEBUG2
    38. 

  38. 

  39. extern char *Reverse(char *buf);
    40. 

  40. extern char *Lowercase(char *buf);
    41. 

  41. 

  42. static char *r_destructors[] = {
    43. 

  43.     ":",                        /* noop - must do this to test raw word. */
    44. 

  44. 

  45. #ifdef DEBUG2
    46. 

  46.     (char *) 0,
    47. 

  47. #endif
    48. 

  48. 

  49.     "[",                        /* trimming leading/trailing junk */
    50. 

  50.     "]",
    51. 

  51.     "[[",
    52. 

  52.     "]]",
    53. 

  53.     "[[[",
    54. 

  54.     "]]]",
    55. 

  55. 

  56.     "/?p@?p",                   /* purging out punctuation/symbols/junk */
    57. 

  57.     "/?s@?s",
    58. 

  58.     "/?X@?X",
    59. 

  59. 

  60.     /* attempt reverse engineering of password strings */
    61. 

  61. 

  62.     "/$s$s",
    63. 

  63.     "/$s$s/0s0o",
    64. 

  64.     "/$s$s/0s0o/2s2a",
    65. 

  65.     "/$s$s/0s0o/2s2a/3s3e",
    66. 

  66.     "/$s$s/0s0o/2s2a/3s3e/5s5s",
    67. 

  67.     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1i",
    68. 

  68.     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1l",
    69. 

  69.     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1i/4s4a",
    70. 

  70.     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1i/4s4h",
    71. 

  71.     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1l/4s4a",
    72. 

  72.     "/$s$s/0s0o/2s2a/3s3e/5s5s/1s1l/4s4h",
    73. 

  73.     "/$s$s/0s0o/2s2a/3s3e/5s5s/4s4a",
    74. 

  74.     "/$s$s/0s0o/2s2a/3s3e/5s5s/4s4h",
    75. 

  75.     "/$s$s/0s0o/2s2a/3s3e/5s5s/4s4a",
    76. 

  76.     "/$s$s/0s0o/2s2a/3s3e/5s5s/4s4h",
    77. 

  77.     "/$s$s/0s0o/2s2a/3s3e/1s1i",
    78. 

  78.     "/$s$s/0s0o/2s2a/3s3e/1s1l",
    79. 

  79.     "/$s$s/0s0o/2s2a/3s3e/1s1i/4s4a",
    80. 

  80.     "/$s$s/0s0o/2s2a/3s3e/1s1i/4s4h",
    81. 

  81.     "/$s$s/0s0o/2s2a/3s3e/1s1l/4s4a",
    82. 

  82.     "/$s$s/0s0o/2s2a/3s3e/1s1l/4s4h",
    83. 

  83.     "/$s$s/0s0o/2s2a/3s3e/4s4a",
    84. 

  84.     "/$s$s/0s0o/2s2a/3s3e/4s4h",
    85. 

  85.     "/$s$s/0s0o/2s2a/3s3e/4s4a",
    86. 

  86.     "/$s$s/0s0o/2s2a/3s3e/4s4h",
    87. 

  87.     "/$s$s/0s0o/2s2a/5s5s",
    88. 

  88.     "/$s$s/0s0o/2s2a/5s5s/1s1i",
    89. 

  89.     "/$s$s/0s0o/2s2a/5s5s/1s1l",
    90. 

  90.     "/$s$s/0s0o/2s2a/5s5s/1s1i/4s4a",
    91. 

  91.     "/$s$s/0s0o/2s2a/5s5s/1s1i/4s4h",
    92. 

  92.     "/$s$s/0s0o/2s2a/5s5s/1s1l/4s4a",
    93. 

  93.     "/$s$s/0s0o/2s2a/5s5s/1s1l/4s4h",
    94. 

  94.     "/$s$s/0s0o/2s2a/5s5s/4s4a",
    95. 

  95.     "/$s$s/0s0o/2s2a/5s5s/4s4h",
    96. 

  96.     "/$s$s/0s0o/2s2a/5s5s/4s4a",
    97. 

  97.     "/$s$s/0s0o/2s2a/5s5s/4s4h",
    98. 

  98.     "/$s$s/0s0o/2s2a/1s1i",
    99. 

  99.     "/$s$s/0s0o/2s2a/1s1l",
    100. 

  100.     "/$s$s/0s0o/2s2a/1s1i/4s4a",
    101. 

  101.     "/$s$s/0s0o/2s2a/1s1i/4s4h",
    102. 

  102.     "/$s$s/0s0o/2s2a/1s1l/4s4a",
    103. 

  103.     "/$s$s/0s0o/2s2a/1s1l/4s4h",
    104. 

  104.     "/$s$s/0s0o/2s2a/4s4a",
    105. 

  105.     "/$s$s/0s0o/2s2a/4s4h",
    106. 

  106.     "/$s$s/0s0o/2s2a/4s4a",
    107. 

  107.     "/$s$s/0s0o/2s2a/4s4h",
    108. 

  108.     "/$s$s/0s0o/3s3e",
    109. 

  109.     "/$s$s/0s0o/3s3e/5s5s",
    110. 

  110.     "/$s$s/0s0o/3s3e/5s5s/1s1i",
    111. 

  111.     "/$s$s/0s0o/3s3e/5s5s/1s1l",
    112. 

  112.     "/$s$s/0s0o/3s3e/5s5s/1s1i/4s4a",
    113. 

  113.     "/$s$s/0s0o/3s3e/5s5s/1s1i/4s4h",
    114. 

  114.     "/$s$s/0s0o/3s3e/5s5s/1s1l/4s4a",
    115. 

  115.     "/$s$s/0s0o/3s3e/5s5s/1s1l/4s4h",
    116. 

  116.     "/$s$s/0s0o/3s3e/5s5s/4s4a",
    117. 

  117.     "/$s$s/0s0o/3s3e/5s5s/4s4h",
    118. 

  118.     "/$s$s/0s0o/3s3e/5s5s/4s4a",
    119. 

  119.     "/$s$s/0s0o/3s3e/5s5s/4s4h",
    120. 

  120.     "/$s$s/0s0o/3s3e/1s1i",
    121. 

  121.     "/$s$s/0s0o/3s3e/1s1l",
    122. 

  122.     "/$s$s/0s0o/3s3e/1s1i/4s4a",
    123. 

  123.     "/$s$s/0s0o/3s3e/1s1i/4s4h",
    124. 

  124.     "/$s$s/0s0o/3s3e/1s1l/4s4a",
    125. 

  125.     "/$s$s/0s0o/3s3e/1s1l/4s4h",
    126. 

  126.     "/$s$s/0s0o/3s3e/4s4a",
    127. 

  127.     "/$s$s/0s0o/3s3e/4s4h",
    128. 

  128.     "/$s$s/0s0o/3s3e/4s4a",
    129. 

  129.     "/$s$s/0s0o/3s3e/4s4h",
    130. 

  130.     "/$s$s/0s0o/5s5s",
    131. 

  131.     "/$s$s/0s0o/5s5s/1s1i",
    132. 

  132.     "/$s$s/0s0o/5s5s/1s1l",
    133. 

  133.     "/$s$s/0s0o/5s5s/1s1i/4s4a",
    134. 

  134.     "/$s$s/0s0o/5s5s/1s1i/4s4h",
    135. 

  135.     "/$s$s/0s0o/5s5s/1s1l/4s4a",
    136. 

  136.     "/$s$s/0s0o/5s5s/1s1l/4s4h",
    137. 

  137.     "/$s$s/0s0o/5s5s/4s4a",
    138. 

  138.     "/$s$s/0s0o/5s5s/4s4h",
    139. 

  139.     "/$s$s/0s0o/5s5s/4s4a",
    140. 

  140.     "/$s$s/0s0o/5s5s/4s4h",
    141. 

  141.     "/$s$s/0s0o/1s1i",
    142. 

  142.     "/$s$s/0s0o/1s1l",
    143. 

  143.     "/$s$s/0s0o/1s1i/4s4a",
    144. 

  144.     "/$s$s/0s0o/1s1i/4s4h",
    145. 

  145.     "/$s$s/0s0o/1s1l/4s4a",
    146. 

  146.     "/$s$s/0s0o/1s1l/4s4h",
    147. 

  147.     "/$s$s/0s0o/4s4a",
    148. 

  148.     "/$s$s/0s0o/4s4h",
    149. 

  149.     "/$s$s/0s0o/4s4a",
    150. 

  150.     "/$s$s/0s0o/4s4h",
    151. 

  151.     "/$s$s/2s2a",
    152. 

  152.     "/$s$s/2s2a/3s3e",
    153. 

  153.     "/$s$s/2s2a/3s3e/5s5s",
    154. 

  154.     "/$s$s/2s2a/3s3e/5s5s/1s1i",
    155. 

  155.     "/$s$s/2s2a/3s3e/5s5s/1s1l",
    156. 

  156.     "/$s$s/2s2a/3s3e/5s5s/1s1i/4s4a",
    157. 

  157.     "/$s$s/2s2a/3s3e/5s5s/1s1i/4s4h",
    158. 

  158.     "/$s$s/2s2a/3s3e/5s5s/1s1l/4s4a",
    159. 

  159.     "/$s$s/2s2a/3s3e/5s5s/1s1l/4s4h",
    160. 

  160.     "/$s$s/2s2a/3s3e/5s5s/4s4a",
    161. 

  161.     "/$s$s/2s2a/3s3e/5s5s/4s4h",
    162. 

  162.     "/$s$s/2s2a/3s3e/5s5s/4s4a",
    163. 

  163.     "/$s$s/2s2a/3s3e/5s5s/4s4h",
    164. 

  164.     "/$s$s/2s2a/3s3e/1s1i",
    165. 

  165.     "/$s$s/2s2a/3s3e/1s1l",
    166. 

  166.     "/$s$s/2s2a/3s3e/1s1i/4s4a",
    167. 

  167.     "/$s$s/2s2a/3s3e/1s1i/4s4h",
    168. 

  168.     "/$s$s/2s2a/3s3e/1s1l/4s4a",
    169. 

  169.     "/$s$s/2s2a/3s3e/1s1l/4s4h",
    170. 

  170.     "/$s$s/2s2a/3s3e/4s4a",
    171. 

  171.     "/$s$s/2s2a/3s3e/4s4h",
    172. 

  172.     "/$s$s/2s2a/3s3e/4s4a",
    173. 

  173.     "/$s$s/2s2a/3s3e/4s4h",
    174. 

  174.     "/$s$s/2s2a/5s5s",
    175. 

  175.     "/$s$s/2s2a/5s5s/1s1i",
    176. 

  176.     "/$s$s/2s2a/5s5s/1s1l",
    177. 

  177.     "/$s$s/2s2a/5s5s/1s1i/4s4a",
    178. 

  178.     "/$s$s/2s2a/5s5s/1s1i/4s4h",
    179. 

  179.     "/$s$s/2s2a/5s5s/1s1l/4s4a",
    180. 

  180.     "/$s$s/2s2a/5s5s/1s1l/4s4h",
    181. 

  181.     "/$s$s/2s2a/5s5s/4s4a",
    182. 

  182.     "/$s$s/2s2a/5s5s/4s4h",
    183. 

  183.     "/$s$s/2s2a/5s5s/4s4a",
    184. 

  184.     "/$s$s/2s2a/5s5s/4s4h",
    185. 

  185.     "/$s$s/2s2a/1s1i",
    186. 

  186.     "/$s$s/2s2a/1s1l",
    187. 

  187.     "/$s$s/2s2a/1s1i/4s4a",
    188. 

  188.     "/$s$s/2s2a/1s1i/4s4h",
    189. 

  189.     "/$s$s/2s2a/1s1l/4s4a",
    190. 

  190.     "/$s$s/2s2a/1s1l/4s4h",
    191. 

  191.     "/$s$s/2s2a/4s4a",
    192. 

  192.     "/$s$s/2s2a/4s4h",
    193. 

  193.     "/$s$s/2s2a/4s4a",
    194. 

  194.     "/$s$s/2s2a/4s4h",
    195. 

  195.     "/$s$s/3s3e",
    196. 

  196.     "/$s$s/3s3e/5s5s",
    197. 

  197.     "/$s$s/3s3e/5s5s/1s1i",
    198. 

  198.     "/$s$s/3s3e/5s5s/1s1l",
    199. 

  199.     "/$s$s/3s3e/5s5s/1s1i/4s4a",
    200. 

  200.     "/$s$s/3s3e/5s5s/1s1i/4s4h",
    201. 

  201.     "/$s$s/3s3e/5s5s/1s1l/4s4a",
    202. 

  202.     "/$s$s/3s3e/5s5s/1s1l/4s4h",
    203. 

  203.     "/$s$s/3s3e/5s5s/4s4a",
    204. 

  204.     "/$s$s/3s3e/5s5s/4s4h",
    205. 

  205.     "/$s$s/3s3e/5s5s/4s4a",
    206. 

  206.     "/$s$s/3s3e/5s5s/4s4h",
    207. 

  207.     "/$s$s/3s3e/1s1i",
    208. 

  208.     "/$s$s/3s3e/1s1l",
    209. 

  209.     "/$s$s/3s3e/1s1i/4s4a",
    210. 

  210.     "/$s$s/3s3e/1s1i/4s4h",
    211. 

  211.     "/$s$s/3s3e/1s1l/4s4a",
    212. 

  212.     "/$s$s/3s3e/1s1l/4s4h",
    213. 

  213.     "/$s$s/3s3e/4s4a",
    214. 

  214.     "/$s$s/3s3e/4s4h",
    215. 

  215.     "/$s$s/3s3e/4s4a",
    216. 

  216.     "/$s$s/3s3e/4s4h",
    217. 

  217.     "/$s$s/5s5s",
    218. 

  218.     "/$s$s/5s5s/1s1i",
    219. 

  219.     "/$s$s/5s5s/1s1l",
    220. 

  220.     "/$s$s/5s5s/1s1i/4s4a",
    221. 

  221.     "/$s$s/5s5s/1s1i/4s4h",
    222. 

  222.     "/$s$s/5s5s/1s1l/4s4a",
    223. 

  223.     "/$s$s/5s5s/1s1l/4s4h",
    224. 

  224.     "/$s$s/5s5s/4s4a",
    225. 

  225.     "/$s$s/5s5s/4s4h",
    226. 

  226.     "/$s$s/5s5s/4s4a",
    227. 

  227.     "/$s$s/5s5s/4s4h",
    228. 

  228.     "/$s$s/1s1i",
    229. 

  229.     "/$s$s/1s1l",
    230. 

  230.     "/$s$s/1s1i/4s4a",
    231. 

  231.     "/$s$s/1s1i/4s4h",
    232. 

  232.     "/$s$s/1s1l/4s4a",
    233. 

  233.     "/$s$s/1s1l/4s4h",
    234. 

  234.     "/$s$s/4s4a",
    235. 

  235.     "/$s$s/4s4h",
    236. 

  236.     "/$s$s/4s4a",
    237. 

  237.     "/$s$s/4s4h",
    238. 

  238.     "/0s0o",
    239. 

  239.     "/0s0o/2s2a",
    240. 

  240.     "/0s0o/2s2a/3s3e",
    241. 

  241.     "/0s0o/2s2a/3s3e/5s5s",
    242. 

  242.     "/0s0o/2s2a/3s3e/5s5s/1s1i",
    243. 

  243.     "/0s0o/2s2a/3s3e/5s5s/1s1l",
    244. 

  244.     "/0s0o/2s2a/3s3e/5s5s/1s1i/4s4a",
    245. 

  245.     "/0s0o/2s2a/3s3e/5s5s/1s1i/4s4h",
    246. 

  246.     "/0s0o/2s2a/3s3e/5s5s/1s1l/4s4a",
    247. 

  247.     "/0s0o/2s2a/3s3e/5s5s/1s1l/4s4h",
    248. 

  248.     "/0s0o/2s2a/3s3e/5s5s/4s4a",
    249. 

  249.     "/0s0o/2s2a/3s3e/5s5s/4s4h",
    250. 

  250.     "/0s0o/2s2a/3s3e/5s5s/4s4a",
    251. 

  251.     "/0s0o/2s2a/3s3e/5s5s/4s4h",
    252. 

  252.     "/0s0o/2s2a/3s3e/1s1i",
    253. 

  253.     "/0s0o/2s2a/3s3e/1s1l",
    254. 

  254.     "/0s0o/2s2a/3s3e/1s1i/4s4a",
    255. 

  255.     "/0s0o/2s2a/3s3e/1s1i/4s4h",
    256. 

  256.     "/0s0o/2s2a/3s3e/1s1l/4s4a",
    257. 

  257.     "/0s0o/2s2a/3s3e/1s1l/4s4h",
    258. 

  258.     "/0s0o/2s2a/3s3e/4s4a",
    259. 

  259.     "/0s0o/2s2a/3s3e/4s4h",
    260. 

  260.     "/0s0o/2s2a/3s3e/4s4a",
    261. 

  261.     "/0s0o/2s2a/3s3e/4s4h",
    262. 

  262.     "/0s0o/2s2a/5s5s",
    263. 

  263.     "/0s0o/2s2a/5s5s/1s1i",
    264. 

  264.     "/0s0o/2s2a/5s5s/1s1l",
    265. 

  265.     "/0s0o/2s2a/5s5s/1s1i/4s4a",
    266. 

  266.     "/0s0o/2s2a/5s5s/1s1i/4s4h",
    267. 

  267.     "/0s0o/2s2a/5s5s/1s1l/4s4a",
    268. 

  268.     "/0s0o/2s2a/5s5s/1s1l/4s4h",
    269. 

  269.     "/0s0o/2s2a/5s5s/4s4a",
    270. 

  270.     "/0s0o/2s2a/5s5s/4s4h",
    271. 

  271.     "/0s0o/2s2a/5s5s/4s4a",
    272. 

  272.     "/0s0o/2s2a/5s5s/4s4h",
    273. 

  273.     "/0s0o/2s2a/1s1i",
    274. 

  274.     "/0s0o/2s2a/1s1l",
    275. 

  275.     "/0s0o/2s2a/1s1i/4s4a",
    276. 

  276.     "/0s0o/2s2a/1s1i/4s4h",
    277. 

  277.     "/0s0o/2s2a/1s1l/4s4a",
    278. 

  278.     "/0s0o/2s2a/1s1l/4s4h",
    279. 

  279.     "/0s0o/2s2a/4s4a",
    280. 

  280.     "/0s0o/2s2a/4s4h",
    281. 

  281.     "/0s0o/2s2a/4s4a",
    282. 

  282.     "/0s0o/2s2a/4s4h",
    283. 

  283.     "/0s0o/3s3e",
    284. 

  284.     "/0s0o/3s3e/5s5s",
    285. 

  285.     "/0s0o/3s3e/5s5s/1s1i",
    286. 

  286.     "/0s0o/3s3e/5s5s/1s1l",
    287. 

  287.     "/0s0o/3s3e/5s5s/1s1i/4s4a",
    288. 

  288.     "/0s0o/3s3e/5s5s/1s1i/4s4h",
    289. 

  289.     "/0s0o/3s3e/5s5s/1s1l/4s4a",
    290. 

  290.     "/0s0o/3s3e/5s5s/1s1l/4s4h",
    291. 

  291.     "/0s0o/3s3e/5s5s/4s4a",
    292. 

  292.     "/0s0o/3s3e/5s5s/4s4h",
    293. 

  293.     "/0s0o/3s3e/5s5s/4s4a",
    294. 

  294.     "/0s0o/3s3e/5s5s/4s4h",
    295. 

  295.     "/0s0o/3s3e/1s1i",
    296. 

  296.     "/0s0o/3s3e/1s1l",
    297. 

  297.     "/0s0o/3s3e/1s1i/4s4a",
    298. 

  298.     "/0s0o/3s3e/1s1i/4s4h",
    299. 

  299.     "/0s0o/3s3e/1s1l/4s4a",
    300. 

  300.     "/0s0o/3s3e/1s1l/4s4h",
    301. 

  301.     "/0s0o/3s3e/4s4a",
    302. 

  302.     "/0s0o/3s3e/4s4h",
    303. 

  303.     "/0s0o/3s3e/4s4a",
    304. 

  304.     "/0s0o/3s3e/4s4h",
    305. 

  305.     "/0s0o/5s5s",
    306. 

  306.     "/0s0o/5s5s/1s1i",
    307. 

  307.     "/0s0o/5s5s/1s1l",
    308. 

  308.     "/0s0o/5s5s/1s1i/4s4a",
    309. 

  309.     "/0s0o/5s5s/1s1i/4s4h",
    310. 

  310.     "/0s0o/5s5s/1s1l/4s4a",
    311. 

  311.     "/0s0o/5s5s/1s1l/4s4h",
    312. 

  312.     "/0s0o/5s5s/4s4a",
    313. 

  313.     "/0s0o/5s5s/4s4h",
    314. 

  314.     "/0s0o/5s5s/4s4a",
    315. 

  315.     "/0s0o/5s5s/4s4h",
    316. 

  316.     "/0s0o/1s1i",
    317. 

  317.     "/0s0o/1s1l",
    318. 

  318.     "/0s0o/1s1i/4s4a",
    319. 

  319.     "/0s0o/1s1i/4s4h",
    320. 

  320.     "/0s0o/1s1l/4s4a",
    321. 

  321.     "/0s0o/1s1l/4s4h",
    322. 

  322.     "/0s0o/4s4a",
    323. 

  323.     "/0s0o/4s4h",
    324. 

  324.     "/0s0o/4s4a",
    325. 

  325.     "/0s0o/4s4h",
    326. 

  326.     "/2s2a",
    327. 

  327.     "/2s2a/3s3e",
    328. 

  328.     "/2s2a/3s3e/5s5s",
    329. 

  329.     "/2s2a/3s3e/5s5s/1s1i",
    330. 

  330.     "/2s2a/3s3e/5s5s/1s1l",
    331. 

  331.     "/2s2a/3s3e/5s5s/1s1i/4s4a",
    332. 

  332.     "/2s2a/3s3e/5s5s/1s1i/4s4h",
    333. 

  333.     "/2s2a/3s3e/5s5s/1s1l/4s4a",
    334. 

  334.     "/2s2a/3s3e/5s5s/1s1l/4s4h",
    335. 

  335.     "/2s2a/3s3e/5s5s/4s4a",
    336. 

  336.     "/2s2a/3s3e/5s5s/4s4h",
    337. 

  337.     "/2s2a/3s3e/5s5s/4s4a",
    338. 

  338.     "/2s2a/3s3e/5s5s/4s4h",
    339. 

  339.     "/2s2a/3s3e/1s1i",
    340. 

  340.     "/2s2a/3s3e/1s1l",
    341. 

  341.     "/2s2a/3s3e/1s1i/4s4a",
    342. 

  342.     "/2s2a/3s3e/1s1i/4s4h",
    343. 

  343.     "/2s2a/3s3e/1s1l/4s4a",
    344. 

  344.     "/2s2a/3s3e/1s1l/4s4h",
    345. 

  345.     "/2s2a/3s3e/4s4a",
    346. 

  346.     "/2s2a/3s3e/4s4h",
    347. 

  347.     "/2s2a/3s3e/4s4a",
    348. 

  348.     "/2s2a/3s3e/4s4h",
    349. 

  349.     "/2s2a/5s5s",
    350. 

  350.     "/2s2a/5s5s/1s1i",
    351. 

  351.     "/2s2a/5s5s/1s1l",
    352. 

  352.     "/2s2a/5s5s/1s1i/4s4a",
    353. 

  353.     "/2s2a/5s5s/1s1i/4s4h",
    354. 

  354.     "/2s2a/5s5s/1s1l/4s4a",
    355. 

  355.     "/2s2a/5s5s/1s1l/4s4h",
    356. 

  356.     "/2s2a/5s5s/4s4a",
    357. 

  357.     "/2s2a/5s5s/4s4h",
    358. 

  358.     "/2s2a/5s5s/4s4a",
    359. 

  359.     "/2s2a/5s5s/4s4h",
    360. 

  360.     "/2s2a/1s1i",
    361. 

  361.     "/2s2a/1s1l",
    362. 

  362.     "/2s2a/1s1i/4s4a",
    363. 

  363.     "/2s2a/1s1i/4s4h",
    364. 

  364.     "/2s2a/1s1l/4s4a",
    365. 

  365.     "/2s2a/1s1l/4s4h",
    366. 

  366.     "/2s2a/4s4a",
    367. 

  367.     "/2s2a/4s4h",
    368. 

  368.     "/2s2a/4s4a",
    369. 

  369.     "/2s2a/4s4h",
    370. 

  370.     "/3s3e",
    371. 

  371.     "/3s3e/5s5s",
    372. 

  372.     "/3s3e/5s5s/1s1i",
    373. 

  373.     "/3s3e/5s5s/1s1l",
    374. 

  374.     "/3s3e/5s5s/1s1i/4s4a",
    375. 

  375.     "/3s3e/5s5s/1s1i/4s4h",
    376. 

  376.     "/3s3e/5s5s/1s1l/4s4a",
    377. 

  377.     "/3s3e/5s5s/1s1l/4s4h",
    378. 

  378.     "/3s3e/5s5s/4s4a",
    379. 

  379.     "/3s3e/5s5s/4s4h",
    380. 

  380.     "/3s3e/5s5s/4s4a",
    381. 

  381.     "/3s3e/5s5s/4s4h",
    382. 

  382.     "/3s3e/1s1i",
    383. 

  383.     "/3s3e/1s1l",
    384. 

  384.     "/3s3e/1s1i/4s4a",
    385. 

  385.     "/3s3e/1s1i/4s4h",
    386. 

  386.     "/3s3e/1s1l/4s4a",
    387. 

  387.     "/3s3e/1s1l/4s4h",
    388. 

  388.     "/3s3e/4s4a",
    389. 

  389.     "/3s3e/4s4h",
    390. 

  390.     "/3s3e/4s4a",
    391. 

  391.     "/3s3e/4s4h",
    392. 

  392.     "/5s5s",
    393. 

  393.     "/5s5s/1s1i",
    394. 

  394.     "/5s5s/1s1l",
    395. 

  395.     "/5s5s/1s1i/4s4a",
    396. 

  396.     "/5s5s/1s1i/4s4h",
    397. 

  397.     "/5s5s/1s1l/4s4a",
    398. 

  398.     "/5s5s/1s1l/4s4h",
    399. 

  399.     "/5s5s/4s4a",
    400. 

  400.     "/5s5s/4s4h",
    401. 

  401.     "/5s5s/4s4a",
    402. 

  402.     "/5s5s/4s4h",
    403. 

  403.     "/1s1i",
    404. 

  404.     "/1s1l",
    405. 

  405.     "/1s1i/4s4a",
    406. 

  406.     "/1s1i/4s4h",
    407. 

  407.     "/1s1l/4s4a",
    408. 

  408.     "/1s1l/4s4h",
    409. 

  409.     "/4s4a",
    410. 

  410.     "/4s4h",
    411. 

  411.     "/4s4a",
    412. 

  412.     "/4s4h",
    413. 

  413. 

  414.     /* done */
    415. 

  415.     (char *) 0
    416. 

  416. };
    417. 

  417. 

  418. static char *r_constructors[] = {
    419. 

  419.     ":",
    420. 

  420. 

  421. #ifdef DEBUG2
    422. 

  422.     (char *) 0,
    423. 

  423. #endif
    424. 

  424. 

  425.     "r",
    426. 

  426.     "d",
    427. 

  427.     "f",
    428. 

  428.     "dr",
    429. 

  429.     "fr",
    430. 

  430.     "rf",
    431. 

  431.     (char *) 0
    432. 

  432. };
    433. 

  433. 

  434. int
    435. 

  435. GTry(rawtext, password)
    436. 

  436.     char *rawtext;
    437. 

  437.     char *password;
    438. 

  438. {
    439. 

  439.     int i;
    440. 

  440.     int len;
    441. 

  441.     char *mp;
    442. 

  442. 

  443.     /* use destructors to turn password into rawtext */
    444. 

  444.     /* note use of Reverse() to save duplicating all rules */
    445. 

  445. 

  446.     len = strlen(password);
    447. 

  447. 

  448.     for (i = 0; r_destructors[i]; i++)
    449. 

  449.     {
    450. 

  450. 	if (!(mp = Mangle(password, r_destructors[i])))
    451. 

  451. 	{
    452. 

  452. 	    continue;
    453. 

  453. 	}
    454. 

  454. 

  455. #ifdef DEBUG
    456. 

  456. 	printf("%-16s = %-16s (destruct %s)\n", mp, rawtext, r_destructors[i]);
    457. 

  457. #endif
    458. 

  458. 

  459. 	if (!strncmp(mp, rawtext, len))
    460. 

  460. 	{
    461. 

  461. 	    return (1);
    462. 

  462. 	}
    463. 

  463. 

  464. #ifdef DEBUG
    465. 

  465. 	printf("%-16s = %-16s (destruct %s reversed)\n", Reverse(mp), rawtext, r_destructors[i]);
    466. 

  466. #endif
    467. 

  467. 

  468. 	if (!strncmp(Reverse(mp), rawtext, len))
    469. 

  469. 	{
    470. 

  470. 	    return (1);
    471. 

  471. 	}
    472. 

  472.     }
    473. 

  473. 

  474.     for (i = 0; r_constructors[i]; i++)
    475. 

  475.     {
    476. 

  476. 	if (!(mp = Mangle(rawtext, r_constructors[i])))
    477. 

  477. 	{
    478. 

  478. 	    continue;
    479. 

  479. 	}
    480. 

  480. 

  481. #ifdef DEBUG
    482. 

  482. 	printf("%-16s = %-16s (construct %s)\n", mp, password, r_constructors[i]);
    483. 

  483. #endif
    484. 

  484. 

  485. 	if (!strncmp(mp, password, len))
    486. 

  486. 	{
    487. 

  487. 	    return (1);
    488. 

  488. 	}
    489. 

  489.     }
    490. 

  490. 

  491.     return (0);
    492. 

  492. }
    493. 

  493. 

  494. char *
    495. 

  495. FascistGecos(password, uid)
    496. 

  496.     char *password;
    497. 

  497.     int uid;
    498. 

  498. {
    499. 

  499.     int i;
    500. 

  500.     int j;
    501. 

  501.     int wc;
    502. 

  502.     char *ptr;
    503. 

  503.     int gwords;
    504. 

  504.     struct passwd *pwp, passwd;
    505. 

  505.     char gbuffer[STRINGSIZE];
    506. 

  506.     char tbuffer[STRINGSIZE];
    507. 

  507.     char *sbuffer = NULL;
    508. 

  508. #ifdef HAVE_GETPWUID_R
    509. 

  509.     size_t sbufferlen = LINE_MAX;
    510. 

  510. #endif
    511. 

  511.     char *uwords[STRINGSIZE];
    512. 

  512.     char longbuffer[STRINGSIZE * 2];
    513. 

  513. 

  514. #ifdef HAVE_GETPWUID_R
    515. 

  515.     sbuffer = malloc(sbufferlen);
    516. 

  516.     if (sbuffer == NULL)
    517. 

  517.     {
    518. 

  518.         return ("memory allocation error");
    519. 

  519.     }
    520. 

  520.     while ((i = getpwuid_r(uid, &passwd, sbuffer, sbufferlen, &pwp)) != 0)
    521. 

  521.     {
    522. 

  522.         if (i == ERANGE)
    523. 

  523.         {
    524. 

  524.             free(sbuffer);
    525. 

  525. 

  526. 	    sbufferlen += LINE_MAX;
    527. 

  527.             sbuffer = malloc(sbufferlen);
    528. 

  528. 

  529.             if (sbuffer == NULL)
    530. 

  530.             {
    531. 

  531.                 return ("memory allocation error");
    532. 

  532.             }
    533. 

  533.         } else {
    534. 

  534.             pwp = NULL;
    535. 

  535.             break;
    536. 

  536.         }
    537. 

  537.     }
    538. 

  538. #else
    539. 

  539.     /* Non-reentrant, but no choice since no _r routine */
    540. 

  540.     pwp = getpwuid(uid);
    541. 

  541. #endif
    542. 

  542. 

  543.     if (pwp == NULL)
    544. 

  544.     {
    545. 

  545. 	if (sbuffer)
    546. 

  546. 	{
    547. 

  547. 		free(sbuffer);
    548. 

  548. 		sbuffer = NULL;
    549. 

  549. 	}
    550. 

  550. 	return _("you are not registered in the password file");
    551. 

  551.     }
    552. 

  552. 

  553.     /* lets get really paranoid and assume a dangerously long gecos entry */
    554. 

  554. 

  555.     strncpy(tbuffer, pwp->pw_name, STRINGSIZE);
    556. 

  556.     tbuffer[STRINGSIZE-1] = '\0';
    557. 

  557.     if (GTry(tbuffer, password))
    558. 

  558.     {
    559. 

  559. 	if (sbuffer)
    560. 

  560. 	{
    561. 

  561. 		free(sbuffer);
    562. 

  562. 		sbuffer = NULL;
    563. 

  563. 	}
    564. 

  564. 	return _("it is based on your username");
    565. 

  565.     }
    566. 

  566. 

  567.     /* it never used to be that you got passwd strings > 1024 chars, but now... */
    568. 

  568. 

  569.     strncpy(tbuffer, pwp->pw_gecos, STRINGSIZE);
    570. 

  570.     tbuffer[STRINGSIZE-1] = '\0';
    571. 

  571.     strcpy(gbuffer, Lowercase(tbuffer));
    572. 

  572. 

  573.     wc = 0;
    574. 

  574.     ptr = gbuffer;
    575. 

  575.     gwords = 0;
    576. 

  576.     uwords[0] = (char *)0;
    577. 

  577. 

  578.     while (*ptr)
    579. 

  579.     {
    580. 

  580. 	while (*ptr && ISSKIP(*ptr))
    581. 

  581. 	{
    582. 

  582. 	    ptr++;
    583. 

  583. 	}
    584. 

  584. 

  585. 	if (ptr != gbuffer)
    586. 

  586. 	{
    587. 

  587. 	    ptr[-1] = '\0';
    588. 

  588. 	}
    589. 

  589. 

  590. 	gwords++;
    591. 

  591. 	uwords[wc++] = ptr;
    592. 

  592. 

  593. 	if (wc == STRINGSIZE)
    594. 

  594. 	{
    595. 

  595. 	    uwords[--wc] = (char *) 0;  /* to hell with it */
    596. 

  596. 	    break;
    597. 

  597. 	} else
    598. 

  598. 	{
    599. 

  599. 	    uwords[wc] = (char *) 0;
    600. 

  600. 	}
    601. 

  601. 

  602. 	while (*ptr && !ISSKIP(*ptr))
    603. 

  603. 	{
    604. 

  604. 	    ptr++;
    605. 

  605. 	}
    606. 

  606. 

  607. 	if (*ptr)
    608. 

  608. 	{
    609. 

  609. 	    *(ptr++) = '\0';
    610. 

  610. 	}
    611. 

  611.     }
    612. 

  612. 

  613. #ifdef DEBUG
    614. 

  614.     for (i = 0; uwords[i]; i++)
    615. 

  615.     {
    616. 

  616. 	printf("gecosword %s\n", uwords[i]);
    617. 

  617.     }
    618. 

  618. #endif
    619. 

  619. 

  620.     for (i = 0; uwords[i]; i++)
    621. 

  621.     {
    622. 

  622. 	if (GTry(uwords[i], password))
    623. 

  623. 	{
    624. 

  624. 	    if (sbuffer)
    625. 

  625. 	    {
    626. 

  626. 	    	free(sbuffer);
    627. 

  627. 		sbuffer = NULL;
    628. 

  628. 	    }
    629. 

  629. 	    return _("it is based upon your password entry");
    630. 

  630. 	}
    631. 

  631.     }
    632. 

  632. 

  633.     /* since uwords are taken from gbuffer, no uword can be longer than gbuffer */
    634. 

  634. 

  635.     for (j = 1; (j < gwords) && uwords[j]; j++)
    636. 

  636.     {
    637. 

  637. 	for (i = 0; i < j; i++)
    638. 

  638. 	{
    639. 

  639. 	    strcpy(longbuffer, uwords[i]);
    640. 

  640. 	    strcat(longbuffer, uwords[j]);
    641. 

  641. 

  642. 	    if (GTry(longbuffer, password))
    643. 

  643. 	    {
    644. 

  644. 	        if (sbuffer)
    645. 

  645. 	        {
    646. 

  646. 	       	    free(sbuffer);
    647. 

  647. 		    sbuffer = NULL;
    648. 

  648. 	        }
    649. 

  649. 		return _("it is derived from your password entry");
    650. 

  650. 	    }
    651. 

  651. 

  652. 	    strcpy(longbuffer, uwords[j]);
    653. 

  653. 	    strcat(longbuffer, uwords[i]);
    654. 

  654. 

  655. 	    if (GTry(longbuffer, password))
    656. 

  656. 	    {
    657. 

  657. 	        if (sbuffer)
    658. 

  658. 	        {
    659. 

  659. 	       	    free(sbuffer);
    660. 

  660. 		    sbuffer = NULL;
    661. 

  661. 	        }
    662. 

  662. 		return _("it's derived from your password entry");
    663. 

  663. 	    }
    664. 

  664. 

  665. 	    longbuffer[0] = uwords[i][0];
    666. 

  666. 	    longbuffer[1] = '\0';
    667. 

  667. 	    strcat(longbuffer, uwords[j]);
    668. 

  668. 

  669. 	    if (GTry(longbuffer, password))
    670. 

  670. 	    {
    671. 

  671. 	        if (sbuffer)
    672. 

  672. 	        {
    673. 

  673. 	       	    free(sbuffer);
    674. 

  674. 		    sbuffer = NULL;
    675. 

  675. 	        }
    676. 

  676. 		return _("it is derivable from your password entry");
    677. 

  677. 	    }
    678. 

  678. 

  679. 	    longbuffer[0] = uwords[j][0];
    680. 

  680. 	    longbuffer[1] = '\0';
    681. 

  681. 	    strcat(longbuffer, uwords[i]);
    682. 

  682. 

  683. 	    if (GTry(longbuffer, password))
    684. 

  684. 	    {
    685. 

  685. 	        if (sbuffer)
    686. 

  686. 	        {
    687. 

  687. 	       	    free(sbuffer);
    688. 

  688. 		    sbuffer = NULL;
    689. 

  689. 	        }
    690. 

  690. 		return _("it's derivable from your password entry");
    691. 

  691. 	    }
    692. 

  692. 	}
    693. 

  693.     }
    694. 

  694. 

  695.     if (sbuffer)
    696. 

  696.     {
    697. 

  697.         free(sbuffer);
    698. 

  698.         sbuffer = NULL;
    699. 

  699.     }
    700. 

  700. 

  701.     return ((char *) 0);
    702. 

  702. }
    703. 

  703. 

  704. char *
    705. 

  705. FascistLook(pwp, instring)
    706. 

  706.     PWDICT *pwp;
    707. 

  707.     char *instring;
    708. 

  708. {
    709. 

  709.     int i,maxrepeat;
    710. 

  710.     char *ptr;
    711. 

  711.     char *jptr;
    712. 

  712.     char junk[STRINGSIZE];
    713. 

  713.     char *password;
    714. 

  714.     char rpassword[STRINGSIZE];
    715. 

  715.     uint32_t notfound;
    716. 

  716. 

  717.     notfound = PW_WORDS(pwp);
    718. 

  718.     /* already truncated if from FascistCheck() */
    719. 

  719.     /* but pretend it wasn't ... */
    720. 

  720.     strncpy(rpassword, instring, TRUNCSTRINGSIZE);
    721. 

  721.     rpassword[TRUNCSTRINGSIZE - 1] = '\0';
    722. 

  722.     password = rpassword;
    723. 

  723. 

  724.     if (strlen(password) < 4)
    725. 

  725.     {
    726. 

  726. 	return _("it is WAY too short");
    727. 

  727.     }
    728. 

  728. 

  729.     if (strlen(password) < MINLEN)
    730. 

  730.     {
    731. 

  731. 	return _("it is too short");
    732. 

  732.     }
    733. 

  733. 

  734.     jptr = junk;
    735. 

  735.     *jptr = '\0';
    736. 

  736. 

  737.     for (i = 0; i < STRINGSIZE && password[i]; i++)
    738. 

  738.     {
    739. 

  739. 	if (!strchr(junk, password[i]))
    740. 

  740. 	{
    741. 

  741. 	    *(jptr++) = password[i];
    742. 

  742. 	    *jptr = '\0';
    743. 

  743. 	}
    744. 

  744.     }
    745. 

  745. 

  746.     if (strlen(junk) < MINDIFF)
    747. 

  747.     {
    748. 

  748. 	return _("it does not contain enough DIFFERENT characters");
    749. 

  749.     }
    750. 

  750. 

  751.     strcpy(password, (char *)Lowercase(password));
    752. 

  752. 

  753.     Trim(password);
    754. 

  754. 

  755.     while (*password && isspace(*password))
    756. 

  756.     {
    757. 

  757. 	password++;
    758. 

  758.     }
    759. 

  759. 

  760.     if (!*password)
    761. 

  761.     {
    762. 

  762. 	return _("it is all whitespace");
    763. 

  763.     }
    764. 

  764. 

  765.     i = 0;
    766. 

  766.     ptr = password;
    767. 

  767.     while (ptr[0] && ptr[1])
    768. 

  768.     {
    769. 

  769. 	if ((ptr[1] == (ptr[0] + 1)) || (ptr[1] == (ptr[0] - 1)))
    770. 

  770. 	{
    771. 

  771. 	    i++;
    772. 

  772. 	}
    773. 

  773. 	ptr++;
    774. 

  774.     }
    775. 

  775. 

  776.     /*  Change by Ben Karsin from ITS at University of Hawaii at Manoa.  Static MAXSTEP 
    777. 

  777.         would generate many false positives for long passwords. */
    778. 

  778.     maxrepeat = 3+(0.09*strlen(password));
    779. 

  779.     if (i > maxrepeat)
    780. 

  780.     {
    781. 

  781. 	return _("it is too simplistic/systematic");
    782. 

  782.     }
    783. 

  783. 

  784.     if (PMatch("aadddddda", password))  /* smirk */
    785. 

  785.     {
    786. 

  786. 	return _("it looks like a National Insurance number.");
    787. 

  787.     }
    788. 

  788. 

  789.     if ((ptr = FascistGecos(password, getuid())))
    790. 

  790.     {
    791. 

  791. 	return (ptr);
    792. 

  792.     }
    793. 

  793. 

  794.     /* it should be safe to use Mangle with its reliance on STRINGSIZE
    795. 

  795.        since password cannot be longer than TRUNCSTRINGSIZE;
    796. 

  796.        nonetheless this is not an elegant solution */
    797. 

  797. 

  798.     for (i = 0; r_destructors[i]; i++)
    799. 

  799.     {
    800. 

  800. 	char *a;
    801. 

  801. 

  802. 	if (!(a = Mangle(password, r_destructors[i])))
    803. 

  803. 	{
    804. 

  804. 	    continue;
    805. 

  805. 	}
    806. 

  806. 

  807. #ifdef DEBUG
    808. 

  808. 	printf("%-16s (dict)\n", a);
    809. 

  809. #endif
    810. 

  810. 

  811. 	if (FindPW(pwp, a) != notfound)
    812. 

  812. 	{
    813. 

  813. 	    return _("it is based on a dictionary word");
    814. 

  814. 	}
    815. 

  815.     }
    816. 

  816. 

  817.     strcpy(password, (char *)Reverse(password));
    818. 

  818. 

  819.     for (i = 0; r_destructors[i]; i++)
    820. 

  820.     {
    821. 

  821. 	char *a;
    822. 

  822. 

  823. 	if (!(a = Mangle(password, r_destructors[i])))
    824. 

  824. 	{
    825. 

  825. 	    continue;
    826. 

  826. 	}
    827. 

  827. #ifdef DEBUG
    828. 

  828. 	printf("%-16s (reversed dict)\n", a);
    829. 

  829. #endif
    830. 

  830. 	if (FindPW(pwp, a) != notfound)
    831. 

  831. 	{
    832. 

  832. 	    return _("it is based on a (reversed) dictionary word");
    833. 

  833. 	}
    834. 

  834.     }
    835. 

  835. 

  836.     return ((char *) 0);
    837. 

  837. }
    838. 

  838. 

  839. const char *
    840. 

  840. FascistCheck(password, path)
    841. 

  841.     const char *password;
    842. 

  842.     const char *path;
    843. 

  843. {
    844. 

  844.     PWDICT *pwp;
    845. 

  845.     char pwtrunced[STRINGSIZE];
    846. 

  846.     char *res;
    847. 

  847. 

  848.     /* If passed null for the path, use a compiled-in default */
    849. 

  849.     if ( ! path )
    850. 

  850.     {
    851. 

  851. 	path = DEFAULT_CRACKLIB_DICT;
    852. 

  852.     }
    853. 

  853. 

  854.     /* security problem: assume we may have been given a really long
    855. 

  855.        password (buffer attack) and so truncate it to a workable size;
    856. 

  856.        try to define workable size as something from which we cannot
    857. 

  857.        extend a buffer beyond its limits in the rest of the code */
    858. 

  858. 

  859.     strncpy(pwtrunced, password, TRUNCSTRINGSIZE);
    860. 

  860.     pwtrunced[TRUNCSTRINGSIZE - 1] = '\0'; /* enforce */
    861. 

  861. 

  862.     /* perhaps someone should put something here to check if password
    863. 

  863.        is really long and syslog() a message denoting buffer attacks?  */
    864. 

  864. 

  865.     if (!(pwp = PWOpen(path, "r")))
    866. 

  866.     {
    867. 

  867.         /* shouldn't perror in a library or exit */
    868. 

  868. 	/* but should we return a "bad password" or "good password" if this error occurs */
    869. 

  869. 	perror("PWOpen");
    870. 

  870. 	exit(-1);
    871. 

  871.     }
    872. 

  872. 

  873.     /* sure seems like we should close the database, since we're only likely to check one password */
    874. 

  874.     res = FascistLook(pwp, pwtrunced);
    875. 

  875. 

  876.     PWClose(pwp);
    877. 

  877.     pwp = (PWDICT *)0;
    878. 

  878. 

  879.     return res;
    880. 

  880. }
    881. 

  881. 

  882. const char *
    883. 

  883. GetDefaultCracklibDict()
    884. 

  884. {
    885. 

  885.     return DEFAULT_CRACKLIB_DICT;
    886. 

  886. }
    887.