pam_modules/authtok_check/authtok_check.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2001, 2011, Oracle and/or its affiliates. All rights reserved.
 */

#include <sys/types.h>
#include <sys/varargs.h>
#include <sys/param.h>
#include <sys/sysmacros.h>
#include <stdio.h>
#include <stdlib.h>
#include <deflt.h>
#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <security/pam_impl.h>
#include <string.h>
#include <ctype.h>
#include <unistd.h>
#include <syslog.h>
#include <libintl.h>
#include <errno.h>
#include <pwd.h>
#include "packer.h"

#include <passwdutil.h>

#define PWADMIN "/etc/default/passwd"

#define MINLENGTH   6
#define MINDIFF     3
#define MINALPHA    2
#define MINNONALPHA 1

mutex_t dictlock = DEFAULTMUTEX;

/*
 * We implement:
 *  PASSLENGTH (int)    minimum password length
 *  NAMECHECK (yes/no)  perform comparison of password and loginname
 *  MINDIFF (int)       minimum number of character-positions in which
 *              the old and the new password should differ.
 *  MINALPHA (int)      minimum number of Alpha characters
 *  MINUPPER (int)      minimum number of upper-case characters
 *  MINLOWER (int)      minimum number of lower-case characters
 *  MAXREPEATS (int)    maximum number of consecutively repeating chars
 *  WHITESPACE (yes/no) Are whitespaces allowed?
 *
 * Furthermore, these two mutualy exclusive groups of options are allowed:
 *
 *  MINNONALPHA (int)   minimum number of characters from the
 *              character classes [ punct, space, digit ]
 *              if WHITESPACE == NO, whitespaces don't count.
 * and
 *  MINSPECIAL (int)    minimum number of punctuation characters.
 *              if WHITESPACE != NO, whitespace is seen as
 *              a "special" character.
 *  MINDIGIT (int)      minimum number of digits
 *
 * specifying options from both groups results in an error to syslog and
 * failure to change the password.
 *
 * NOTE:
 *  HISTORY is implemented at the repository level (passwdutil).
 */

/*
 * default password-strength-values, compiled-in or stored in PWADMIN
 * are kept in here
 */
struct pwdefaults {
    boolean_t server_policy;    /* server policy flag from pam.conf */
    uint_t minlength;   /* minimum password length */
    uint_t maxlength;   /* maximum (significant) length */
    boolean_t do_namecheck; /* check password against user's gecos */
    char db_location[MAXPATHLEN]; /* location of the generated database */
    boolean_t do_dictcheck; /* perform dictionary lookup */
    char *dicts;        /* list of dictionaries configured */
    uint_t mindiff;     /* old and new should differ by this much */
    uint_t minalpha;    /* minimum alpha characters required */
    uint_t minupper;    /* minimum uppercase characters required */
    uint_t minlower;    /* minimum lowercase characters required */
    uint_t minnonalpha;     /* minimum special (non alpha) required */
    uint_t maxrepeat;   /* maximum number of repeating chars allowed */
    uint_t minspecial;  /* punctuation characters */
    uint_t mindigit;    /* minimum number of digits required */
    boolean_t whitespace;   /* is whitespace allowed in a password */
};


/*PRINTFLIKE3*/
void
error(pam_handle_t *pamh, int flags, char *fmt, ...)
{
    va_list ap;
    char msg[1][PAM_MAX_MSG_SIZE];

    va_start(ap, fmt);
    (void) vsnprintf(msg[0], sizeof (msg[0]), fmt, ap);
    va_end(ap);
    if ((flags & PAM_SILENT) == 0)
        (void) __pam_display_msg(pamh, PAM_ERROR_MSG, 1, msg, NULL);
}

int
defread_int(char *name, uint_t *ip, void *defp)
{
    char *q;
    int r = 0;
    if ((q = defread_r(name, defp)) != NULL) {
        if (!isdigit(*q)) {
            syslog(LOG_ERR, "pam_authtok_check: %s contains "
                "non-integer value for %s: %s. "
                "Using default instead.", PWADMIN, name, q);
        } else {
            *ip = atoi(q);
            r = 1;
        }
    }
    return (r);
}

/*
 * fill in static defaults, and augment with settings from PWADMIN
 * get system defaults with regard to maximum password length
 */
int
get_passwd_defaults(pam_handle_t *pamh, char *user, struct pwdefaults *p)
{
    char *q;
    boolean_t minnonalpha_defined = B_FALSE;
    pwu_repository_t *pwu_rep;
    struct pam_repository *pam_rep;
    attrlist attr[2];
    int result;
    char *progname;
    void    *defp;

    (void) pam_get_item(pamh, PAM_SERVICE, (void **)&progname);

    /* Module defaults */
    p->minlength = MINLENGTH;
    p->do_namecheck = B_TRUE;
    p->do_dictcheck = B_FALSE;
    p->dicts = NULL;
    p->mindiff = MINDIFF;
    p->minalpha = MINALPHA;
    p->minnonalpha = MINNONALPHA;
    p->minupper = 0;    /* not configured by default */
    p->minlower = 0;    /* not configured by default */
    p->maxrepeat = 0;   /* not configured by default */

    p->minspecial = 0;
    p->mindigit = 0;
    p->whitespace = B_TRUE;

    if ((defp = defopen_r(PWADMIN)) == NULL)
        return (PAM_SUCCESS);

    (void) defread_int("PASSLENGTH=", &p->minlength, defp);

    if ((q = defread_r("NAMECHECK=", defp)) != NULL &&
        strcasecmp(q, "NO") == 0)
        p->do_namecheck = B_FALSE;

    if ((q = defread_r("DICTIONLIST=", defp)) != NULL) {
        if ((p->dicts = strdup(q)) == NULL) {
            syslog(LOG_ERR, "pam_authtok_check: out of memory");
            defclose_r(defp);
            return (PAM_BUF_ERR);

        }
        p->do_dictcheck = B_TRUE;
    } else {
        p->dicts = NULL;
    }

    if ((q = defread_r("DICTIONDBDIR=", defp)) != NULL) {
        if (strlcpy(p->db_location, q, sizeof (p->db_location)) >=
            sizeof (p->db_location)) {
            syslog(LOG_ERR, "pam_authtok_check: value for "
                "DICTIONDBDIR too large.");
            defclose_r(defp);
            return (PAM_SYSTEM_ERR);
        }
        p->do_dictcheck = B_TRUE;
    } else {
        (void) strlcpy(p->db_location, CRACK_DIR,
            sizeof (p->db_location));
    }

    (void) defread_int("MINDIFF=", &p->mindiff, defp);
    (void) defread_int("MINALPHA=", &p->minalpha, defp);
    (void) defread_int("MINUPPER=", &p->minupper, defp);
    (void) defread_int("MINLOWER=", &p->minlower, defp);
    if (defread_int("MINNONALPHA=", &p->minnonalpha, defp))
        minnonalpha_defined = B_TRUE;
    (void) defread_int("MAXREPEATS=", &p->maxrepeat, defp);

    if (defread_int("MINSPECIAL=", &p->minspecial, defp)) {
        if (minnonalpha_defined) {
            syslog(LOG_ERR, "pam_authtok_check: %s contains "
                "definition for MINNONALPHA and for MINSPECIAL. "
                "These options are mutually exclusive.", PWADMIN);
            defclose_r(defp);
            return (PAM_SYSTEM_ERR);
        }
        p->minnonalpha = 0;
    }

    if (defread_int("MINDIGIT=", &p->mindigit, defp)) {
        if (minnonalpha_defined) {
            syslog(LOG_ERR, "pam_authtok_check: %s contains "
                "definition for MINNONALPHA and for MINDIGIT. "
                "These options are mutually exclusive.", PWADMIN);
            defclose_r(defp);
            return (PAM_SYSTEM_ERR);
        }
        p->minnonalpha = 0;
    }

    if ((q = defread_r("WHITESPACE=", defp)) != NULL)
        p->whitespace =
            (strcasecmp(q, "no") == 0 || strcmp(q, "0") == 0)
            ? B_FALSE : B_TRUE;

    defclose_r(defp);

    /*
     * Determine the number of significant characters in a password
     *
     * we find out where the user information came from (which repository),
     * and which password-crypt-algorithm is to be used (based on the
     * old password, or the system default).
     *
     * If the user comes from a repository other than FILES/NIS
     * the module-flag "server_policy" means that we don't perform
     * any checks on the user, but let the repository decide instead.
     */

    (void) pam_get_item(pamh, PAM_REPOSITORY, (void **)&pam_rep);
    if (pam_rep != NULL) {
        if ((pwu_rep = calloc(1, sizeof (*pwu_rep))) == NULL)
            return (PAM_BUF_ERR);
        pwu_rep->type = pam_rep->type;
        pwu_rep->scope = pam_rep->scope;
        pwu_rep->scope_len = pam_rep->scope_len;
    } else {
        pwu_rep = PWU_DEFAULT_REP;
    }

    attr[0].type = ATTR_PASSWD; attr[0].next = &attr[1];
    attr[1].type = ATTR_REP_NAME; attr[1].next = NULL;
    result = __get_authtoken_attr(user, pwu_rep, attr);
    if (pwu_rep != PWU_DEFAULT_REP)
        free(pwu_rep);

    if (result != PWU_SUCCESS) {
        /*
         * In the unlikely event that we can't obtain any info about
         * the users password, we assume the most strict scenario.
         */
        p->maxlength = _PASS_MAX_XPG;
    } else {
        char *oldpw = attr[0].data.val_s;
        char *repository = attr[1].data.val_s;
        if ((strcmp(repository, "files") == 0 ||
            strcmp(repository, "nis") == 0) ||
            p->server_policy == B_FALSE) {
            char *salt;
            /*
             * We currently need to supply this dummy to
             * crypt_gensalt(). This will change RSN.
             */
            struct passwd dummy;

            dummy.pw_name = user;

            salt = crypt_gensalt(oldpw, &dummy);
            if (salt && *salt == '$')
                p->maxlength = _PASS_MAX;
            else
                p->maxlength = _PASS_MAX_XPG;

            free(salt);

            p->server_policy = B_FALSE; /* we perform checks */
        } else {
            /* not files or nis AND server_policy is set */
            p->maxlength = _PASS_MAX;
        }
        free(attr[0].data.val_s);
        free(attr[1].data.val_s);
    }

    /* sanity check of the configured parameters */
    if (p->minlength < p->mindigit + p->minspecial + p->minnonalpha +
        p->minalpha) {
        syslog(LOG_ERR, "%s: pam_authtok_check: Defined minimum "
            "password length (PASSLENGTH=%d) is less then minimum "
            "characters in the various classes (%d)", progname,
            p->minlength,
            p->mindigit + p->minspecial + p->minnonalpha + p->minalpha);
        p->minlength = p->mindigit + p->minspecial + p->minnonalpha +
            p->minalpha;
        syslog(LOG_ERR, "%s: pam_authtok_check: effective "
            "PASSLENGTH set to %d.", progname, p->minlength);
        /* this won't lead to failure */
    }

    if (p->maxlength < p->minlength) {
        syslog(LOG_ERR, "%s: pam_authtok_check: The configured "
            "minimum password length (PASSLENGTH=%d) is larger than "
            "the number of significant characters the current "
            "encryption algorithm uses. See policy.conf(4) for "
            "alternative password encryption algorithms.",
            progname, p->minlength);
        /* this won't lead to failure */
    }

    return (PAM_SUCCESS);
}

/*
 * free_passwd_defaults(struct pwdefaults *p)
 *
 * free space occupied by the defaults read from PWADMIN
 */
void
free_passwd_defaults(struct pwdefaults *p)
{
    if (p && p->dicts)
        free(p->dicts);
}

/*
 * check_circular():
 * This function return 1 if string "t" is a circular shift of
 * string "s", else it returns 0. -1 is returned on failure.
 * We also check to see if string "t" is a reversed-circular shift
 * of string "s", i.e. "ABCDE" vs. "DCBAE".
 */
static int
check_circular(s, t)
    char *s, *t;
{
    char c, *p, *o, *r, *buff, *ubuff, *pubuff;
    unsigned int i, j, k, l, m;
    size_t len;
    int ret = 0;

    i = strlen(s);
    l = strlen(t);
    if (i != l)
        return (0);
    len = i + 1;

    buff = malloc(len);
    ubuff = malloc(len);
    pubuff = malloc(len);

    if (buff == NULL || ubuff == NULL || pubuff == NULL) {
        free(buff);
        free(ubuff);
        free(pubuff);
        syslog(LOG_ERR, "pam_authtok_check: out of memory.");
        return (-1);
    }

    m = 2;
    o = &ubuff[0];
    for (p = s; c = *p++; *o++ = c)
        if (islower(c))
            c = toupper(c);
    *o = '\0';
    o = &pubuff[0];
    for (p = t; c = *p++; *o++ = c)
        if (islower(c))
            c = toupper(c);

    *o = '\0';

    p = &ubuff[0];
    while (m--) {
        for (k = 0; k  <  i; k++) {
            c = *p++;
            o = p;
            l = i;
            r = &buff[0];
            while (--l)
                *r++ = *o++;
            *r++ = c;
            *r = '\0';
            p = &buff[0];
            if (strcmp(p, pubuff) == 0) {
                ret = 1;
                goto out;
            }
        }
        p = p + i;
        r = &ubuff[0];
        j = i;
        while (j--)
            *--p = *r++;    /* reverse test-string for m==0 pass */
    }
out:
    (void) memset(buff, 0, len);
    (void) memset(ubuff, 0, len);
    (void) memset(pubuff, 0, len);
    free(buff);
    free(ubuff);
    free(pubuff);
    return (ret);
}


/*
 * count the different character classes present in the password.
 */
int
check_composition(char *pw, struct pwdefaults *pwdef, pam_handle_t *pamh,
    int flags)
{
    uint_t alpha_cnt = 0;
    uint_t upper_cnt = 0;
    uint_t lower_cnt = 0;
    uint_t special_cnt = 0;
    uint_t whitespace_cnt = 0;
    uint_t digit_cnt = 0;
    uint_t maxrepeat = 0;
    uint_t repeat = 1;
    int ret = 0;
    char *progname;
    char errmsg[256];
    char lastc = '\0';
    uint_t significant = pwdef->maxlength;
    char *w;

    (void) pam_get_item(pamh, PAM_SERVICE, (void **)&progname);

    /* go over the password gathering statistics */
    for (w = pw; significant != 0 && *w != '\0'; w++, significant--) {
        if (isalpha(*w)) {
            alpha_cnt++;
            if (isupper(*w)) {
                upper_cnt++;
            } else {
                lower_cnt++;
            }
        } else if (isspace(*w))
            whitespace_cnt++;
        else if (isdigit(*w))
            digit_cnt++;
        else
            special_cnt++;
        if (*w == lastc) {
            if (++repeat > maxrepeat)
                maxrepeat = repeat;
        } else {
            repeat = 1;
        }
        lastc = *w;
    }

    /*
     * If we only consider part of the password (the first maxlength
     * characters) we give a modified error message. Otherwise, a
     * user entering FooBar1234 with PASSLENGTH=6, MINDIGIT=4, while
     * we're using the default UNIX crypt (8 chars significant),
     * would not understand what's going on when he's told that
     * "The password should contain at least 4 digits"...
     * Instead, we now well him
     * "The first 8 characters of the password should contain at least
     *  4 digits."
     */
    if (pwdef->maxlength < strlen(pw))
        /*
         * TRANSLATION_NOTE
         * - Make sure the % and %% come over intact
         * - The last %%s will be replaced by strings like
         *  "alphabetic character(s)"
         *  "numeric or special character(s)"
         *  "special character(s)"
         *  "digit(s)"
         *  "uppercase alpha character(s)"
         *  "lowercase alpha character(s)"
         *   So the final string written to the user might become
         * "passwd: The first 8 characters of the password must contain
         *   at least 4 uppercase alpha characters(s)"
         */
        (void) snprintf(errmsg, sizeof (errmsg), dgettext(TEXT_DOMAIN,
            "%s: The first %d characters of the password must "
            "contain at least %%d %%s."), progname, pwdef->maxlength);
    else
        /*
         * TRANSLATION_NOTE
         * - Make sure the % and %% come over intact
         * - The last %%s will be replaced by strings like
         *  "alphabetic character(s)"
         *  "numeric or special character(s)"
         *  "special character(s)"
         *  "digit(s)"
         *  "uppercase alpha character(s)"
         *  "lowercase alpha character(s)"
         *   So the final string written to the user might become
         * "passwd: The password must contain at least 4 uppercase
         *   alpha characters(s)"
         */
        (void) snprintf(errmsg, sizeof (errmsg), dgettext(TEXT_DOMAIN,
            "%s: The password must contain at least %%d %%s."),
            progname);

    /* Check for whitespace first since it influences special counts */
    if (whitespace_cnt > 0 && pwdef->whitespace == B_FALSE) {
        error(pamh, flags, dgettext(TEXT_DOMAIN,
            "%s: Whitespace characters are not allowed."), progname);
        ret = 1;
        goto out;
    }

    /*
     * Once we get here, whitespace_cnt is either 0, or whitespaces are
     * to be treated a special characters.
     */

    if (alpha_cnt < pwdef->minalpha) {
        error(pamh, flags, errmsg, pwdef->minalpha,
            dgettext(TEXT_DOMAIN, "alphabetic character(s)"));
        ret = 1;
        goto out;
    }

    if (pwdef->minnonalpha > 0) {
        /* specials are defined by MINNONALPHA */
        /* nonalpha = special+whitespace+digit */
        if ((special_cnt + whitespace_cnt + digit_cnt) <
            pwdef->minnonalpha) {
            error(pamh, flags, errmsg, pwdef->minnonalpha,
                dgettext(TEXT_DOMAIN,
                "numeric or special character(s)"));
            ret = 1;
            goto out;
        }
    } else {
        /* specials are defined by MINSPECIAL and/or MINDIGIT */
        if ((special_cnt + whitespace_cnt) < pwdef->minspecial) {
            error(pamh, flags, errmsg, pwdef->minspecial,
                dgettext(TEXT_DOMAIN, "special character(s)"));
            ret = 1;
            goto out;
        }
        if (digit_cnt < pwdef->mindigit) {
            error(pamh, flags, errmsg, pwdef->mindigit,
                dgettext(TEXT_DOMAIN, "digit(s)"));
            ret = 1;
            goto out;
        }
    }

    if (upper_cnt < pwdef->minupper) {
        error(pamh, flags, errmsg, pwdef->minupper,
            dgettext(TEXT_DOMAIN, "uppercase alpha character(s)"));
        ret = 1;
        goto out;
    }
    if (lower_cnt < pwdef->minlower) {
        error(pamh, flags, errmsg, pwdef->minlower,
            dgettext(TEXT_DOMAIN, "lowercase alpha character(s)"));
        ret = 1;
        goto out;
    }

    if (pwdef->maxrepeat > 0 && maxrepeat > pwdef->maxrepeat) {
        error(pamh, flags, dgettext(TEXT_DOMAIN,
            "%s: Too many consecutively repeating characters. "
            "Maximum allowed is %d."), progname, pwdef->maxrepeat);
        ret = 1;
    }
out:
    return (ret);
}

/*
 * make sure that old and new password differ by at least 'mindiff'
 * positions. Return 0 if OK, 1 otherwise
 */
int
check_diff(char *pw, char *opw, struct pwdefaults *pwdef, pam_handle_t *pamh,
    int flags)
{
    size_t pwlen, opwlen, max;
    unsigned int diff;  /* difference between old and new */

    if (opw == NULL)
        opw = "";

    max = pwdef->maxlength;
    pwlen = MIN(strlen(pw), max);
    opwlen = MIN(strlen(opw), max);

    if (pwlen > opwlen)
        diff = pwlen - opwlen;
    else
        diff = opwlen - pwlen;

    while (*opw != '\0' && *pw != '\0' && max-- != 0) {
        if (*opw != *pw)
            diff++;
        opw++;
        pw++;
    }

    if (diff  < pwdef->mindiff) {
        char *progname;

        (void) pam_get_item(pamh, PAM_SERVICE, (void **)&progname);

        error(pamh, flags, dgettext(TEXT_DOMAIN,
            "%s: The first %d characters of the old and new passwords "
            "must differ by at least %d positions."), progname,
            pwdef->maxlength, pwdef->mindiff);
        return (1);
    }

    return (0);
}

/*
 * check to see if password is in one way or another based on a
 * dictionary word. Returns 0 if password is OK, 1 if it is based
 * on a dictionary word and hence should be rejected.
 */
int
check_dictionary(char *pw, struct pwdefaults *pwdef, pam_handle_t *pamh,
    int flags)
{
    int crack_ret;
    int ret;
    char *progname;

    (void) pam_get_item(pamh, PAM_SERVICE, (void **)&progname);

    /* dictionary check isn't MT-safe */
    (void) mutex_lock(&dictlock);

    if (pwdef->dicts &&
        make_dict_database(pwdef->dicts, pwdef->db_location) != 0) {
        (void) mutex_unlock(&dictlock);
        syslog(LOG_ERR, "pam_authtok_check:pam_sm_chauthtok: "
            "Dictionary database not present.");
        error(pamh, flags, dgettext(TEXT_DOMAIN,
            "%s: password dictionary missing."), progname);
        return (PAM_SYSTEM_ERR);
    }

    crack_ret = DictCheck(pw, pwdef->db_location);

    (void) mutex_unlock(&dictlock);

    switch (crack_ret) {
    case DATABASE_OPEN_FAIL:
        syslog(LOG_ERR, "pam_authtok_check:pam_sm_chauthtok: "
            "dictionary database open failure: %s", strerror(errno));
        error(pamh, flags, dgettext(TEXT_DOMAIN,
            "%s: failed to open dictionary database."), progname);
        ret = PAM_SYSTEM_ERR;
        break;
    case DICTIONARY_WORD:
        error(pamh, flags, dgettext(TEXT_DOMAIN,
            "%s: password is based on a dictionary word."), progname);
        ret = PAM_AUTHTOK_ERR;
        break;
    case REVERSE_DICTIONARY_WORD:
        error(pamh, flags, dgettext(TEXT_DOMAIN,
            "%s: password is based on a reversed dictionary word."),
            progname);
        ret = PAM_AUTHTOK_ERR;
        break;
    default:
        ret = PAM_SUCCESS;
        break;
    }
    return (ret);
}

int
pam_sm_chauthtok(pam_handle_t *pamh, int flags, int argc, const char **argv)
{
    int debug = 0;
    int retcode = 0;
    int force_check = 0;
    int     i;
    size_t  pwlen;
    char    *usrname;
    char    *pwbuf, *opwbuf;
    pwu_repository_t *pwu_rep = PWU_DEFAULT_REP;
    pam_repository_t *pwd_rep = NULL;
    struct pwdefaults pwdef;
    char *progname;

    /* needs to be set before option processing */
    pwdef.server_policy = B_FALSE;

    for (i = 0; i < argc; i++) {
        if (strcmp(argv[i], "debug") == 0)
            debug = 1;
        if (strcmp(argv[i], "force_check") == 0)
            force_check = 1;
        if (strcmp(argv[i], "server_policy") == 0)
            pwdef.server_policy = B_TRUE;
    }

    if (debug)
        syslog(LOG_AUTH | LOG_DEBUG,
            "pam_authtok_check: pam_sm_chauthok called(%x) "
            "force_check = %d", flags, force_check);

    if ((flags & PAM_PRELIM_CHECK) == 0)
        return (PAM_IGNORE);

    (void) pam_get_item(pamh, PAM_SERVICE, (void **)&progname);
    (void) pam_get_item(pamh, PAM_USER, (void **)&usrname);
    if (usrname == NULL || *usrname == '\0') {
        syslog(LOG_ERR, "pam_authtok_check: username name is empty");
        return (PAM_USER_UNKNOWN);
    }

    (void) pam_get_item(pamh, PAM_AUTHTOK, (void **)&pwbuf);
    (void) pam_get_item(pamh, PAM_OLDAUTHTOK, (void **)&opwbuf);
    if (pwbuf == NULL)
        return (PAM_AUTHTOK_ERR);

    /* none of these checks holds if caller say so */
    if ((flags & PAM_NO_AUTHTOK_CHECK) != 0 && force_check == 0)
        return (PAM_SUCCESS);

    /* read system-defaults */
    retcode = get_passwd_defaults(pamh, usrname, &pwdef);
    if (retcode != PAM_SUCCESS)
        return (retcode);

    if (debug) {
        syslog(LOG_AUTH | LOG_DEBUG,
            "pam_authtok_check: MAXLENGTH= %d, server_policy = %s",
            pwdef.maxlength, pwdef.server_policy ? "true" : "false");
        syslog(LOG_AUTH | LOG_DEBUG,
            "pam_authtok_check: PASSLENGTH= %d", pwdef.minlength);
        syslog(LOG_AUTH | LOG_DEBUG, "pam_authtok_check: NAMECHECK=%s",
            pwdef.do_namecheck == B_TRUE ? "Yes" : "No");
        syslog(LOG_AUTH | LOG_DEBUG,
            "pam_authtok_check: do_dictcheck = %s\n",
            pwdef.do_dictcheck ? "true" : "false");
        if (pwdef.do_dictcheck) {
            syslog(LOG_AUTH | LOG_DEBUG,
                "pam_authtok_check: DICTIONLIST=%s",
                (pwdef.dicts != NULL) ? pwdef.dicts : "<not set>");
            syslog(LOG_AUTH | LOG_DEBUG,
                "pam_authtok_check: DICTIONDBDIR=%s",
                pwdef.db_location);
        }
        syslog(LOG_AUTH | LOG_DEBUG, "pam_authtok_check: MINDIFF=%d",
            pwdef.mindiff);
        syslog(LOG_AUTH | LOG_DEBUG,
            "pam_authtok_check: MINALPHA=%d, MINNONALPHA=%d",
            pwdef.minalpha, pwdef.minnonalpha);
        syslog(LOG_AUTH | LOG_DEBUG,
            "pam_authtok_check: MINSPECIAL=%d, MINDIGIT=%d",
            pwdef.minspecial, pwdef.mindigit);
        syslog(LOG_AUTH | LOG_DEBUG, "pam_authtok_check: WHITESPACE=%s",
            pwdef.whitespace ? "YES" : "NO");
        syslog(LOG_AUTH | LOG_DEBUG,
            "pam_authtok_check: MINUPPER=%d, MINLOWER=%d",
            pwdef.minupper, pwdef.minlower);
        syslog(LOG_AUTH | LOG_DEBUG, "pam_authtok_check: MAXREPEATS=%d",
            pwdef.maxrepeat);
    }

    /*
     * If server policy is still true (might be changed from the
     * value specified in /etc/pam.conf by get_passwd_defaults()),
     * we return ignore and let the server do all the checks.
     */
    if (pwdef.server_policy == B_TRUE) {
        free_passwd_defaults(&pwdef);
        return (PAM_IGNORE);
    }

    /*
     * XXX: JV: we can't really make any assumption on the length of
     *  the password that will be used by the crypto algorithm.
     *  for UNIX-style encryption, minalpha=5,minnonalpha=5 might
     *  be impossible, but not for MD5 style hashes... what to do?
     *
     *  since we don't know what alg. will be used, we operate on
     *  the password as entered, so we don't sanity check anything
     *  for now.
     */

    /*
     * Make sure new password is long enough
     */
    pwlen = strlen(pwbuf);

    if (pwlen < pwdef.minlength) {
        error(pamh, flags, dgettext(TEXT_DOMAIN,
            "%s: Password too short - must be at least %d "
            "characters."), progname, pwdef.minlength);
        free_passwd_defaults(&pwdef);
        return (PAM_AUTHTOK_ERR);
    }

    /* Make sure the password doesn't equal--a shift of--the username */
    if (pwdef.do_namecheck) {
        switch (check_circular(usrname, pwbuf)) {
        case 1:
            error(pamh, flags, dgettext(TEXT_DOMAIN,
                "%s: Password cannot be circular shift of "
                "logonid."), progname);
            free_passwd_defaults(&pwdef);
            return (PAM_AUTHTOK_ERR);
        case -1:
            free_passwd_defaults(&pwdef);
            return (PAM_BUF_ERR);
        default:
            break;
        }
    }

    /* Check if new password is in history list. */
    (void) pam_get_item(pamh, PAM_REPOSITORY, (void **)&pwd_rep);
    if (pwd_rep != NULL) {
        if ((pwu_rep = calloc(1, sizeof (*pwu_rep))) == NULL)
            return (PAM_BUF_ERR);
        pwu_rep->type = pwd_rep->type;
        pwu_rep->scope = pwd_rep->scope;
        pwu_rep->scope_len = pwd_rep->scope_len;
    }

    if (__check_history(usrname, pwbuf, pwu_rep) == PWU_SUCCESS) {
        /* password found in history */
        error(pamh, flags, dgettext(TEXT_DOMAIN,
            "%s: Password in history list."), progname);
        if (pwu_rep != PWU_DEFAULT_REP)
            free(pwu_rep);
        free_passwd_defaults(&pwdef);
        return (PAM_AUTHTOK_ERR);
    }

    if (pwu_rep != PWU_DEFAULT_REP)
        free(pwu_rep);

    /* check MINALPHA, MINLOWER, etc. */
    if (check_composition(pwbuf, &pwdef, pamh, flags) != 0) {
        free_passwd_defaults(&pwdef);
        return (PAM_AUTHTOK_ERR);
    }

    /* make sure the old and new password are not too much alike */
    if (check_diff(pwbuf, opwbuf, &pwdef, pamh, flags) != 0) {
        free_passwd_defaults(&pwdef);
        return (PAM_AUTHTOK_ERR);
    }

    /* dictionary check */
    if (pwdef.do_dictcheck) {
        retcode = check_dictionary(pwbuf, &pwdef, pamh, flags);
        if (retcode != PAM_SUCCESS) {
            free_passwd_defaults(&pwdef);
            return (retcode);
        }
    }

    free_passwd_defaults(&pwdef);
    /* password has passed all tests: it's strong enough */
    return (PAM_SUCCESS);
}