From f565403d8877db723aeda791d284172671b93013 Mon Sep 17 00:00:00 2001 From: Arden97 Date: Tue, 6 Oct 2026 17:39:45 +0200 Subject: [PATCH 1/2] adding yescrypt support for OVAL 5.11 --- .../oval/5.11.1/unix-definitions-schema.xsd | 5 ++ .../unix-system-characteristics-schema.xsd | 5 ++ .../oval/5.11.2/unix-definitions-schema.xsd | 5 ++ .../unix-system-characteristics-schema.xsd | 5 ++ .../oval/5.11.3/unix-definitions-schema.xsd | 5 ++ .../unix-system-characteristics-schema.xsd | 5 ++ schemas/oval/5.11/unix-definitions-schema.xsd | 5 ++ .../unix-system-characteristics-schema.xsd | 5 ++ src/OVAL/probes/unix/shadow_probe.c | 18 ++++ tests/probes/shadow/CMakeLists.txt | 1 + .../shadow/test_probes_shadow_yescrypt.sh | 69 +++++++++++++++ .../shadow/test_probes_shadow_yescrypt.shadow | 17 ++++ .../shadow/test_probes_shadow_yescrypt.xml | 85 +++++++++++++++++++ 13 files changed, 230 insertions(+) create mode 100755 tests/probes/shadow/test_probes_shadow_yescrypt.sh create mode 100644 tests/probes/shadow/test_probes_shadow_yescrypt.shadow create mode 100644 tests/probes/shadow/test_probes_shadow_yescrypt.xml diff --git a/schemas/oval/5.11.1/unix-definitions-schema.xsd b/schemas/oval/5.11.1/unix-definitions-schema.xsd index eb8e499653..fceef6cf78 100644 --- a/schemas/oval/5.11.1/unix-definitions-schema.xsd +++ b/schemas/oval/5.11.1/unix-definitions-schema.xsd @@ -3253,6 +3253,11 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The SHA-512 method corresponds to the $6$ prefix. + + + The yescrypt method corresponds to the $y$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd b/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd index c3acbef4f3..693f3be4b7 100644 --- a/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd +++ b/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd @@ -1774,6 +1774,11 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The SHA-512 method corresponds to the $6$ prefix. + + + The yescrypt method corresponds to the $y$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11.2/unix-definitions-schema.xsd b/schemas/oval/5.11.2/unix-definitions-schema.xsd index efd67210cc..ac6b1c7dc2 100644 --- a/schemas/oval/5.11.2/unix-definitions-schema.xsd +++ b/schemas/oval/5.11.2/unix-definitions-schema.xsd @@ -3287,6 +3287,11 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The SHA-512 method corresponds to the $6$ prefix. + + + The yescrypt method corresponds to the $y$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd b/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd index 200225e150..5f016d802c 100644 --- a/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd +++ b/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd @@ -1808,6 +1808,11 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The SHA-512 method corresponds to the $6$ prefix. + + + The yescrypt method corresponds to the $y$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11.3/unix-definitions-schema.xsd b/schemas/oval/5.11.3/unix-definitions-schema.xsd index c91406e1f6..a52bf10105 100644 --- a/schemas/oval/5.11.3/unix-definitions-schema.xsd +++ b/schemas/oval/5.11.3/unix-definitions-schema.xsd @@ -3287,6 +3287,11 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The SHA-512 method corresponds to the $6$ prefix. + + + The yescrypt method corresponds to the $y$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd b/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd index 069f2c8d45..cec5037c0b 100644 --- a/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd +++ b/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd @@ -1808,6 +1808,11 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The SHA-512 method corresponds to the $6$ prefix. + + + The yescrypt method corresponds to the $y$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11/unix-definitions-schema.xsd b/schemas/oval/5.11/unix-definitions-schema.xsd index 3f80c37d05..bcd57b32c0 100644 --- a/schemas/oval/5.11/unix-definitions-schema.xsd +++ b/schemas/oval/5.11/unix-definitions-schema.xsd @@ -3066,6 +3066,11 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The SHA-512 method corresponds to the $6$ prefix. + + + The yescrypt method corresponds to the $y$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11/unix-system-characteristics-schema.xsd b/schemas/oval/5.11/unix-system-characteristics-schema.xsd index 8d0de76c59..14f5660eaf 100644 --- a/schemas/oval/5.11/unix-system-characteristics-schema.xsd +++ b/schemas/oval/5.11/unix-system-characteristics-schema.xsd @@ -1581,6 +1581,11 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The SHA-512 method corresponds to the $6$ prefix. + + + The yescrypt method corresponds to the $y$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/src/OVAL/probes/unix/shadow_probe.c b/src/OVAL/probes/unix/shadow_probe.c index a57991ccba..28bc6977ac 100644 --- a/src/OVAL/probes/unix/shadow_probe.c +++ b/src/OVAL/probes/unix/shadow_probe.c @@ -97,6 +97,17 @@ static SEXP_t *parse_enc_mth(const char *pwd) { char *mth_str; + if (pwd == NULL) + goto fail; + + while (*pwd == '!') + pwd++; + + if (*pwd == '\0' || + *pwd == '*' || + strcmp(pwd, "x") == 0) + goto fail; + switch (*pwd) { case '_': return SEXP_string_newf("BSDi"); @@ -121,6 +132,13 @@ static SEXP_t *parse_enc_mth(const char *pwd) mth_str = "SHA-512"; pwd++; break; + case 'y': + if (oval_schema_version_cmp(over, + OVAL_SCHEMA_VERSION(5.11)) < 0) + goto fail; + mth_str = "yescrypt"; + pwd++; + break; default: if (strncmp(pwd, "md5", 3)) goto fail; diff --git a/tests/probes/shadow/CMakeLists.txt b/tests/probes/shadow/CMakeLists.txt index c461ce7dbc..e25a374861 100644 --- a/tests/probes/shadow/CMakeLists.txt +++ b/tests/probes/shadow/CMakeLists.txt @@ -1,4 +1,5 @@ if(ENABLE_PROBES_UNIX) add_oscap_test("test_probes_shadow.sh") add_oscap_test("test_probes_shadow_offline.sh") + add_oscap_test("test_probes_shadow_yescrypt.sh" LABELS unix linux_only) endif() diff --git a/tests/probes/shadow/test_probes_shadow_yescrypt.sh b/tests/probes/shadow/test_probes_shadow_yescrypt.sh new file mode 100755 index 0000000000..92c3e11348 --- /dev/null +++ b/tests/probes/shadow/test_probes_shadow_yescrypt.sh @@ -0,0 +1,69 @@ +#!/usr/bin/env bash + +. "$builddir/tests/test_common.sh" + +set -e -o pipefail + +tmpdir="" +trap 'if [[ $tmpdir ]]; then rm -rf "$tmpdir"; fi' EXIT + +function test_probes_shadow_yescrypt { + probecheck "shadow" || return 255 + [[ $(uname) == Linux ]] || return 255 + + tmpdir=$(make_temp_dir /tmp "test_shadow_yescrypt") + mkdir -p "$tmpdir/etc" + cp "$srcdir/test_probes_shadow_yescrypt.shadow" "$tmpdir/etc/shadow" + set_offline_chroot_dir "$tmpdir" + + local definition="$tmpdir/definitions.xml" + local result="$tmpdir/results.xml" + local items='//*[local-name()="shadow_item"]' + local yescrypt_items="$items[*[local-name()='username' and starts-with(., 'yescrypt_')]]" + local hashless_items="$items[*[local-name()='username' and starts-with(., 'hashless_')]]" + local schema_version + + for schema_version in 5.8 5.9 5.10 5.10.1 5.11 5.11.1 5.11.2 5.11.3; do + sed "s/SCHEMA_VERSION_PLACEHOLDER/$schema_version/" \ + "$srcdir/test_probes_shadow_yescrypt.xml" > "$definition" + local yescrypt_count=4 + case $schema_version in + 5.8|5.9|5.10|5.10.1) + xsed -i '/yescrypt "$definition" + xsed -i '//d' "$definition" + $OSCAP oval eval --results "$result" "$definition" + $OSCAP oval validate --results "$result" + verify_results "def" "$definition" "$result" 1 + verify_results "tst" "$definition" "$result" 5 + assert_exists 17 "$items" + assert_exists 0 "$items/*[local-name()='encrypt_method']" + + set_offline_chroot_dir "" +} + +test_init +test_run "test_probes_shadow_yescrypt" test_probes_shadow_yescrypt +test_exit diff --git a/tests/probes/shadow/test_probes_shadow_yescrypt.shadow b/tests/probes/shadow/test_probes_shadow_yescrypt.shadow new file mode 100644 index 0000000000..e00e2c30d6 --- /dev/null +++ b/tests/probes/shadow/test_probes_shadow_yescrypt.shadow @@ -0,0 +1,17 @@ +yescrypt_plain:$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +yescrypt_locked:!$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +yescrypt_double_locked:!!$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +yescrypt_marker:$y$:19000:0:99999:7::: +sha512:$6$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +des_plain:xZgNEJwSoPraQ:19000:0:99999:7::: +des_locked:!xZgNEJwSoPraQ:19000:0:99999:7::: +invalid_identifier:$yx$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +invalid_delimiter:$y:19000:0:99999:7::: +hashless_disabled:*:19000:0:99999:7::: +hashless_locked_disabled:!*:19000:0:99999:7::: +hashless_locked:!:19000:0:99999:7::: +hashless_double_locked:!!:19000:0:99999:7::: +hashless_empty::19000:0:99999:7::: +hashless_star_prefix:*$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +hashless_placeholder:x:19000:0:99999:7::: +hashless_locked_placeholder:!x:19000:0:99999:7::: diff --git a/tests/probes/shadow/test_probes_shadow_yescrypt.xml b/tests/probes/shadow/test_probes_shadow_yescrypt.xml new file mode 100644 index 0000000000..baf870e5f9 --- /dev/null +++ b/tests/probes/shadow/test_probes_shadow_yescrypt.xml @@ -0,0 +1,85 @@ + + + + shadow yescrypt regression test + 1.0 + SCHEMA_VERSION_PLACEHOLDER + 2026-10-05T00:00:00Z + + + + + Shadow password hashing methods are detected correctly + Recognize yescrypt, including locked hashes and stripped markers, while preserving existing methods and rejecting invalid identifiers. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ^yescrypt_ + + + sha512 + + + ^invalid_ + + + ^hashless_ + + + ^des_ + + + + + ^yescrypt_ + yescrypt + + + sha512 + SHA-512 + + + ^invalid_ + + + ^hashless_ + + + ^des_ + DES + + + From 515a0ec7fd36942e002d7a6f26945dabdb3ce8e5 Mon Sep 17 00:00:00 2001 From: Arden97 Date: Thu, 8 Oct 2026 11:50:56 +0200 Subject: [PATCH 2/2] adding support for other yescrypt-based encryption methods (cherry picked from commit 5695a6e0db43504b00d7f2fe29d4bc36fdb32194) --- .../oval/5.11.1/unix-definitions-schema.xsd | 15 +++++++ .../unix-system-characteristics-schema.xsd | 15 +++++++ .../oval/5.11.2/unix-definitions-schema.xsd | 15 +++++++ .../unix-system-characteristics-schema.xsd | 15 +++++++ .../oval/5.11.3/unix-definitions-schema.xsd | 15 +++++++ .../unix-system-characteristics-schema.xsd | 15 +++++++ schemas/oval/5.11/unix-definitions-schema.xsd | 15 +++++++ .../unix-system-characteristics-schema.xsd | 15 +++++++ src/OVAL/probes/unix/shadow_probe.c | 29 +++++++++++-- .../shadow/test_probes_shadow_yescrypt.sh | 42 ++++++++++++------- .../shadow/test_probes_shadow_yescrypt.shadow | 19 +++++++++ .../shadow/test_probes_shadow_yescrypt.xml | 40 +++++++++++++++++- 12 files changed, 229 insertions(+), 21 deletions(-) diff --git a/schemas/oval/5.11.1/unix-definitions-schema.xsd b/schemas/oval/5.11.1/unix-definitions-schema.xsd index fceef6cf78..d08f404f04 100644 --- a/schemas/oval/5.11.1/unix-definitions-schema.xsd +++ b/schemas/oval/5.11.1/unix-definitions-schema.xsd @@ -3258,6 +3258,21 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The yescrypt method corresponds to the $y$ prefix. + + + The gost-yescrypt method corresponds to the $gy$ prefix. + + + + + The sm3-yescrypt method corresponds to the $sm3y$ prefix. + + + + + The scrypt method corresponds to the $7$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd b/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd index 693f3be4b7..da895b3c60 100644 --- a/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd +++ b/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd @@ -1779,6 +1779,21 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The yescrypt method corresponds to the $y$ prefix. + + + The gost-yescrypt method corresponds to the $gy$ prefix. + + + + + The sm3-yescrypt method corresponds to the $sm3y$ prefix. + + + + + The scrypt method corresponds to the $7$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11.2/unix-definitions-schema.xsd b/schemas/oval/5.11.2/unix-definitions-schema.xsd index ac6b1c7dc2..11a98d02ea 100644 --- a/schemas/oval/5.11.2/unix-definitions-schema.xsd +++ b/schemas/oval/5.11.2/unix-definitions-schema.xsd @@ -3292,6 +3292,21 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The yescrypt method corresponds to the $y$ prefix. + + + The gost-yescrypt method corresponds to the $gy$ prefix. + + + + + The sm3-yescrypt method corresponds to the $sm3y$ prefix. + + + + + The scrypt method corresponds to the $7$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd b/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd index 5f016d802c..eac092149c 100644 --- a/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd +++ b/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd @@ -1813,6 +1813,21 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The yescrypt method corresponds to the $y$ prefix. + + + The gost-yescrypt method corresponds to the $gy$ prefix. + + + + + The sm3-yescrypt method corresponds to the $sm3y$ prefix. + + + + + The scrypt method corresponds to the $7$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11.3/unix-definitions-schema.xsd b/schemas/oval/5.11.3/unix-definitions-schema.xsd index a52bf10105..48bc37c561 100644 --- a/schemas/oval/5.11.3/unix-definitions-schema.xsd +++ b/schemas/oval/5.11.3/unix-definitions-schema.xsd @@ -3292,6 +3292,21 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The yescrypt method corresponds to the $y$ prefix. + + + The gost-yescrypt method corresponds to the $gy$ prefix. + + + + + The sm3-yescrypt method corresponds to the $sm3y$ prefix. + + + + + The scrypt method corresponds to the $7$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd b/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd index cec5037c0b..679a216cce 100644 --- a/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd +++ b/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd @@ -1813,6 +1813,21 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The yescrypt method corresponds to the $y$ prefix. + + + The gost-yescrypt method corresponds to the $gy$ prefix. + + + + + The sm3-yescrypt method corresponds to the $sm3y$ prefix. + + + + + The scrypt method corresponds to the $7$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11/unix-definitions-schema.xsd b/schemas/oval/5.11/unix-definitions-schema.xsd index bcd57b32c0..bd45c22883 100644 --- a/schemas/oval/5.11/unix-definitions-schema.xsd +++ b/schemas/oval/5.11/unix-definitions-schema.xsd @@ -3071,6 +3071,21 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The yescrypt method corresponds to the $y$ prefix. + + + The gost-yescrypt method corresponds to the $gy$ prefix. + + + + + The sm3-yescrypt method corresponds to the $sm3y$ prefix. + + + + + The scrypt method corresponds to the $7$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/schemas/oval/5.11/unix-system-characteristics-schema.xsd b/schemas/oval/5.11/unix-system-characteristics-schema.xsd index 14f5660eaf..2d0d8300b0 100644 --- a/schemas/oval/5.11/unix-system-characteristics-schema.xsd +++ b/schemas/oval/5.11/unix-system-characteristics-schema.xsd @@ -1586,6 +1586,21 @@ ACTIVE_DEAD_GATEWAY_DETECTION                                 The yescrypt method corresponds to the $y$ prefix. + + + The gost-yescrypt method corresponds to the $gy$ prefix. + + + + + The sm3-yescrypt method corresponds to the $sm3y$ prefix. + + + + + The scrypt method corresponds to the $7$ prefix. + + The empty string value is permitted here to allow for empty elements associated with variable references. diff --git a/src/OVAL/probes/unix/shadow_probe.c b/src/OVAL/probes/unix/shadow_probe.c index 28bc6977ac..7e40c65219 100644 --- a/src/OVAL/probes/unix/shadow_probe.c +++ b/src/OVAL/probes/unix/shadow_probe.c @@ -52,6 +52,7 @@ #include #include #include +#include #include "_seap.h" #include "probe-api.h" @@ -96,6 +97,7 @@ struct result_info { static SEXP_t *parse_enc_mth(const char *pwd) { char *mth_str; + bool yescrypt_mth = false; if (pwd == NULL) goto fail; @@ -132,11 +134,28 @@ static SEXP_t *parse_enc_mth(const char *pwd) mth_str = "SHA-512"; pwd++; break; - case 'y': - if (oval_schema_version_cmp(over, - OVAL_SCHEMA_VERSION(5.11)) < 0) + case '7': + mth_str = "scrypt"; + yescrypt_mth = true; + pwd++; + break; + case 'g': + if (strncmp(pwd, "gy", 2)) + goto fail; + mth_str = "gost-yescrypt"; + yescrypt_mth = true; + pwd += 2; + break; + case 's': + if (strncmp(pwd, "sm3y", 4)) goto fail; + mth_str = "sm3-yescrypt"; + yescrypt_mth = true; + pwd += 4; + break; + case 'y': mth_str = "yescrypt"; + yescrypt_mth = true; pwd++; break; default: @@ -149,6 +168,10 @@ static SEXP_t *parse_enc_mth(const char *pwd) if (*pwd != '$') goto fail; + if (yescrypt_mth && oval_schema_version_cmp(over, + OVAL_SCHEMA_VERSION(5.11)) < 0) + goto fail; + return SEXP_string_newf("%s", mth_str); default: return SEXP_string_newf("DES"); diff --git a/tests/probes/shadow/test_probes_shadow_yescrypt.sh b/tests/probes/shadow/test_probes_shadow_yescrypt.sh index 92c3e11348..2d0e61371a 100755 --- a/tests/probes/shadow/test_probes_shadow_yescrypt.sh +++ b/tests/probes/shadow/test_probes_shadow_yescrypt.sh @@ -5,13 +5,13 @@ set -e -o pipefail tmpdir="" -trap 'if [[ $tmpdir ]]; then rm -rf "$tmpdir"; fi' EXIT function test_probes_shadow_yescrypt { probecheck "shadow" || return 255 [[ $(uname) == Linux ]] || return 255 tmpdir=$(make_temp_dir /tmp "test_shadow_yescrypt") + trap 'rm -rf "$tmpdir"' EXIT mkdir -p "$tmpdir/etc" cp "$srcdir/test_probes_shadow_yescrypt.shadow" "$tmpdir/etc/shadow" set_offline_chroot_dir "$tmpdir" @@ -19,33 +19,44 @@ function test_probes_shadow_yescrypt { local definition="$tmpdir/definitions.xml" local result="$tmpdir/results.xml" local items='//*[local-name()="shadow_item"]' - local yescrypt_items="$items[*[local-name()='username' and starts-with(., 'yescrypt_')]]" + local invalid_items="$items[*[local-name()='username' and starts-with(., 'invalid_')]]" local hashless_items="$items[*[local-name()='username' and starts-with(., 'hashless_')]]" local schema_version for schema_version in 5.8 5.9 5.10 5.10.1 5.11 5.11.1 5.11.2 5.11.3; do sed "s/SCHEMA_VERSION_PLACEHOLDER/$schema_version/" \ "$srcdir/test_probes_shadow_yescrypt.xml" > "$definition" - local yescrypt_count=4 + local modern_count case $schema_version in 5.8|5.9|5.10|5.10.1) - xsed -i '/yescrypt&2 + return 1 ;; esac - $OSCAP oval validate --definitions "$definition" $OSCAP oval eval --results "$result" "$definition" - $OSCAP oval validate --results "$result" verify_results "def" "$definition" "$result" 1 - verify_results "tst" "$definition" "$result" 5 - assert_exists 17 "$items" - assert_exists 4 "$yescrypt_items" - assert_exists "$yescrypt_count" "$yescrypt_items/*[local-name()='encrypt_method']" - assert_exists "$yescrypt_count" "$items/*[local-name()='encrypt_method' and text()='yescrypt']" + verify_results "tst" "$definition" "$result" 8 + assert_exists 36 "$items" + local method method_items + for method in yescrypt gost-yescrypt sm3-yescrypt scrypt; do + method_items="$items[starts-with(*[local-name()='username'], '${method}_')]" + assert_exists 4 "$method_items" + assert_exists "$modern_count" "$method_items/*[local-name()='encrypt_method']" + assert_exists "$modern_count" \ + "$method_items/*[local-name()='encrypt_method' and text()='$method']" + done assert_exists 1 "$items/*[local-name()='encrypt_method' and text()='SHA-512']" assert_exists 2 "$items/*[local-name()='encrypt_method' and text()='DES']" - assert_exists 0 "$items[*[local-name()='username' and starts-with(text(), 'invalid_')]]/*[local-name()='encrypt_method']" + assert_exists 9 "$invalid_items" + assert_exists 0 "$invalid_items/*[local-name()='encrypt_method']" assert_exists 8 "$hashless_items" assert_exists 0 "$hashless_items/*[local-name()='encrypt_method']" done @@ -55,10 +66,9 @@ function test_probes_shadow_yescrypt { "$srcdir/test_probes_shadow_yescrypt.xml" > "$definition" xsed -i '//d' "$definition" $OSCAP oval eval --results "$result" "$definition" - $OSCAP oval validate --results "$result" verify_results "def" "$definition" "$result" 1 - verify_results "tst" "$definition" "$result" 5 - assert_exists 17 "$items" + verify_results "tst" "$definition" "$result" 8 + assert_exists 36 "$items" assert_exists 0 "$items/*[local-name()='encrypt_method']" set_offline_chroot_dir "" diff --git a/tests/probes/shadow/test_probes_shadow_yescrypt.shadow b/tests/probes/shadow/test_probes_shadow_yescrypt.shadow index e00e2c30d6..1ed65b76f0 100644 --- a/tests/probes/shadow/test_probes_shadow_yescrypt.shadow +++ b/tests/probes/shadow/test_probes_shadow_yescrypt.shadow @@ -2,11 +2,30 @@ yescrypt_plain:$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNO yescrypt_locked:!$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: yescrypt_double_locked:!!$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: yescrypt_marker:$y$:19000:0:99999:7::: +gost-yescrypt_plain:$gy$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +gost-yescrypt_locked:!$gy$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +gost-yescrypt_double_locked:!!$gy$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +gost-yescrypt_marker:$gy$:19000:0:99999:7::: +sm3-yescrypt_plain:$sm3y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +sm3-yescrypt_locked:!$sm3y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +sm3-yescrypt_double_locked:!!$sm3y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +sm3-yescrypt_marker:$sm3y$:19000:0:99999:7::: +scrypt_plain:$7$C6..../....abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +scrypt_locked:!$7$C6..../....abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +scrypt_double_locked:!!$7$C6..../....abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +scrypt_marker:$7$:19000:0:99999:7::: sha512:$6$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: des_plain:xZgNEJwSoPraQ:19000:0:99999:7::: des_locked:!xZgNEJwSoPraQ:19000:0:99999:7::: invalid_identifier:$yx$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: invalid_delimiter:$y:19000:0:99999:7::: +invalid_gost_identifier:$gyx$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +invalid_gost_delimiter:$gy:19000:0:99999:7::: +invalid_sm3_identifier:$sm3yx$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +invalid_sm3_delimiter:$sm3y:19000:0:99999:7::: +invalid_sm3_alias:$smy$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +invalid_scrypt_identifier:$7x$C6..../....abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7::: +invalid_scrypt_delimiter:$7:19000:0:99999:7::: hashless_disabled:*:19000:0:99999:7::: hashless_locked_disabled:!*:19000:0:99999:7::: hashless_locked:!:19000:0:99999:7::: diff --git a/tests/probes/shadow/test_probes_shadow_yescrypt.xml b/tests/probes/shadow/test_probes_shadow_yescrypt.xml index baf870e5f9..866d1abf00 100644 --- a/tests/probes/shadow/test_probes_shadow_yescrypt.xml +++ b/tests/probes/shadow/test_probes_shadow_yescrypt.xml @@ -12,7 +12,7 @@ Shadow password hashing methods are detected correctly - Recognize yescrypt, including locked hashes and stripped markers, while preserving existing methods and rejecting invalid identifiers. + Recognize yescrypt, GOST-yescrypt, SM3-yescrypt, and scrypt, including locked hashes and stripped markers, while preserving existing methods and rejecting invalid identifiers. @@ -20,6 +20,9 @@ + + + @@ -44,6 +47,18 @@ + + + + + + + + + + + + @@ -61,11 +76,20 @@ ^des_ + + ^gost-yescrypt_ + + + ^sm3-yescrypt_ + + + ^scrypt_ + ^yescrypt_ - yescrypt + yescrypt sha512 @@ -81,5 +105,17 @@ ^des_ DES + + ^gost-yescrypt_ + gost-yescrypt + + + ^sm3-yescrypt_ + sm3-yescrypt + + + ^scrypt_ + scrypt +