various cleanups; ok millert

8 files changed, 314 insertions, 363 deletions

diff --git a/usr.bin/passwd/krb5_passwd.c b/usr.bin/passwd/krb5_passwd.c
index 7894f11d28a..c5d8f7fa3ce 100644
--- a/usr.bin/passwd/krb5_passwd.c
+++ b/usr.bin/passwd/krb5_passwd.c
@@ -1,34 +1,34 @@
 /*
  * Copyright (c) 1997-2000 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden). 
- * All rights reserved. 
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
  *
- * Redistribution and use in source and binary forms, with or without 
- * modification, are permitted provided that the following conditions 
- * are met: 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
  *
- * 1. Redistributions of source code must retain the above copyright 
- *    notice, this list of conditions and the following disclaimer. 
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
  *
- * 2. Redistributions in binary form must reproduce the above copyright 
- *    notice, this list of conditions and the following disclaimer in the 
- *    documentation and/or other materials provided with the distribution. 
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * 3. Neither the name of the Institute nor the names of its contributors 
- *    may be used to endorse or promote products derived from this software 
- *    without specific prior written permission. 
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
  *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
- * SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
 #include <stdio.h>
@@ -57,74 +57,66 @@
 int
 krb5_passwd (int argc, char **argv)
 {
-    krb5_error_code ret;
-    krb5_context context;
-    krb5_principal principal;
-    krb5_get_init_creds_opt opt;
-    krb5_creds cred;
-    int result_code;
-    krb5_data result_code_string, result_string;
-    char pwbuf[BUFSIZ];
+	krb5_data result_code_string, result_string;
+	krb5_get_init_creds_opt opt;
+	krb5_principal principal;
+	krb5_context context;
+	krb5_error_code ret;
+	char pwbuf[BUFSIZ];
+	krb5_creds cred;
+	int result_code;
 
-    krb5_get_init_creds_opt_init (&opt);
-    
-    krb5_get_init_creds_opt_set_tkt_life (&opt, 300);
-    krb5_get_init_creds_opt_set_forwardable (&opt, FALSE);
-    krb5_get_init_creds_opt_set_proxiable (&opt, FALSE);
+	krb5_get_init_creds_opt_init (&opt);
 
-    ret = krb5_init_context (&context);
-    if (ret)
-	errx (1, "krb5_init_context failed: %d", ret);
-  
-    if(argv[0]) {
-	ret = krb5_parse_name (context, argv[0], &principal);
+	krb5_get_init_creds_opt_set_tkt_life (&opt, 300);
+	krb5_get_init_creds_opt_set_forwardable (&opt, FALSE);
+	krb5_get_init_creds_opt_set_proxiable (&opt, FALSE);
+
+	ret = krb5_init_context(&context);
 	if (ret)
-	    krb5_err (context, 1, ret, "krb5_parse_name");
-    } else
-	principal = NULL;
+		errx(1, "krb5_init_context failed: %d", ret);
 
-    ret = krb5_get_init_creds_password (context,
-					&cred,
-					principal,
-					NULL,
-					krb5_prompter_posix,
-					NULL,
-					0,
-					"kadmin/changepw",
-					&opt);
-    switch (ret) {
-    case 0:
-	break;
-    case KRB5_LIBOS_PWDINTR :
-	return 1;
-    case KRB5KRB_AP_ERR_BAD_INTEGRITY :
-    case KRB5KRB_AP_ERR_MODIFIED :
-	krb5_errx(context, 1, "Password incorrect");
-	break;
-    default:
-	krb5_err(context, 1, ret, "krb5_get_init_creds");
-    }
+	if (argv[0]) {
+		ret = krb5_parse_name(context, argv[0], &principal);
+	if (ret)
+		krb5_err(context, 1, ret, "krb5_parse_name");
+	} else
+		principal = NULL;
 
-    krb5_data_zero (&result_code_string);
-    krb5_data_zero (&result_string);
+	ret = krb5_get_init_creds_password (context, &cred,
+	    principal, NULL, krb5_prompter_posix, NULL, 0,
+	    "kadmin/changepw", &opt);
+	switch (ret) {
+	case 0:
+		break;
+	case KRB5_LIBOS_PWDINTR :
+		return 1;
+	case KRB5KRB_AP_ERR_BAD_INTEGRITY :
+	case KRB5KRB_AP_ERR_MODIFIED :
+		krb5_errx(context, 1, "Password incorrect");
+		break;
+	default:
+		krb5_err(context, 1, ret, "krb5_get_init_creds");
+	}
 
-    if(des_read_pw_string (pwbuf, sizeof(pwbuf), "New password: ", 1) != 0)
-	return 1;
+	krb5_data_zero(&result_code_string);
+	krb5_data_zero(&result_string);
 
-    ret = krb5_change_password (context, &cred, pwbuf,
-				&result_code,
-				&result_code_string,
-				&result_string);
-    if (ret)
-	krb5_err (context, 1, ret, "krb5_change_password");
+	if (des_read_pw_string(pwbuf, sizeof(pwbuf), "New password: ", 1) != 0)
+		return 1;
 
-    printf ("Reply from server: %.*s\n", (int)result_string.length,
+	ret = krb5_change_password (context, &cred, pwbuf, &result_code,
+	    &result_code_string, &result_string);
+	if (ret)
+		krb5_err(context, 1, ret, "krb5_change_password");
+
+	printf("Reply from server: %.*s\n", (int)result_string.length,
 	    (char *)result_string.data);
 
-    krb5_data_free (&result_code_string);
-    krb5_data_free (&result_string);
-    
-    krb5_free_creds_contents (context, &cred);
-    krb5_free_context (context);
-    return result_code;
+	krb5_data_free(&result_code_string);
+	krb5_data_free(&result_string);
+
+	krb5_free_creds_contents(context, &cred);
+	krb5_free_context(context);
+	return result_code;
 }
diff --git a/usr.bin/passwd/krb_passwd.c b/usr.bin/passwd/krb_passwd.c
index ac97717c746..6869d9b27c6 100644
--- a/usr.bin/passwd/krb_passwd.c
+++ b/usr.bin/passwd/krb_passwd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: krb_passwd.c,v 1.15 2002/06/12 06:07:16 mpech Exp $	*/
+/*	$OpenBSD: krb_passwd.c,v 1.16 2002/06/28 22:28:17 deraadt Exp $	*/
 /* $KTH: kpasswd.c,v 1.25 1997/05/02 14:28:51 assar Exp $ */
 
 /*
@@ -13,7 +13,7 @@
  *
  */
 
-/* 
+/*
  *  Copyright (C) 1989 by the Massachusetts Institute of Technology
  *
  *  Export of this software from the United States of America is assumed
@@ -64,139 +64,130 @@ char realm[REALM_SZ];
 
 extern void usage(int value);
 extern int get_pw_new_pwd(char *pword, int pwlen, krb_principal *pr,
-	    int print_realm);
+    int print_realm);
 
 int
 krb_passwd(int argc, char **argv)
 {
-    krb_principal principal;
-    krb_principal default_principal;
-    int realm_given = 0;	/* True if realm was give on cmdline */
-    int use_default = 1;	/* True if we should use default name */
-    int status;			/* return code */
-    char pword[MAX_KPW_LEN];
-    int c;
-    char tktstring[MAXPATHLEN];
-
-    seteuid(getuid());
-    
-    memset (&principal, 0, sizeof(principal));
-    memset (&default_principal, 0, sizeof(default_principal));
-    
-    krb_get_default_principal (default_principal.name,
-			       default_principal.instance,
-			       default_principal.realm);
-
-    while ((c = getopt(argc, argv, "u:n:i:r:h")) != -1) {
-	switch (c) {
-	case 'u':
-	    status = krb_parse_name (optarg, &principal);
-	    if (status != KSUCCESS)
-		errx (2, "%s", krb_get_err_text(status));
-	    if (principal.realm[0])
-		realm_given++;
-	    else if (krb_get_lrealm(principal.realm, 1) != KSUCCESS)
-		errx (1, "Could not find default realm!");
-	    break;
-	case 'n':
-	    if (k_isname(optarg))
-		strncpy(principal.name, optarg, sizeof(principal.name) - 1);
-	    else {
-		warnx("Bad name: %s", optarg);
-		usage(1);
-	    }
-	    break;
-	case 'i':
-	    if (k_isinst(optarg))
-		strncpy(principal.instance,
-			optarg,
-			sizeof(principal.instance) - 1);
-	    else {
-		warnx("Bad instance: %s", optarg);
-		usage(1);
-	    }
-	    break;
-	case 'r':
-	    if (k_isrealm(optarg)) {
-		strncpy(principal.realm, optarg, sizeof(principal.realm) - 1);
-		realm_given++; 
-	    } else {
-		warnx("Bad realm: %s", optarg);
-		usage(1);
-	    }
-	    break;
-	case 'h':
-	    usage(0);
-	    break;
-	default:
-	    usage(1);
-	    break;
+	char pword[MAX_KPW_LEN], tktstring[MAXPATHLEN];
+	krb_principal default_principal;
+	krb_principal principal;
+	int realm_given = 0;	/* True if realm was give on cmdline */
+	int use_default = 1;	/* True if we should use default name */
+	int status;		/* return code */
+	int c;
+
+	seteuid(getuid());
+
+	memset(&principal, 0, sizeof(principal));
+	memset(&default_principal, 0, sizeof(default_principal));
+
+	krb_get_default_principal(default_principal.name,
+	    default_principal.instance, default_principal.realm);
+
+	while ((c = getopt(argc, argv, "u:n:i:r:h")) != -1) {
+		switch (c) {
+		case 'u':
+			status = krb_parse_name (optarg, &principal);
+			if (status != KSUCCESS)
+				errx(2, "%s", krb_get_err_text(status));
+			if (principal.realm[0])
+				realm_given++;
+			else if (krb_get_lrealm(principal.realm, 1) != KSUCCESS)
+				errx(1, "Could not find default realm!");
+			break;
+		case 'n':
+			if (k_isname(optarg))
+				strlcpy(principal.name, optarg,
+				    sizeof(principal.name));
+			else {
+				warnx("Bad name: %s", optarg);
+				usage(1);
+			}
+			break;
+		case 'i':
+			if (k_isinst(optarg))
+				strlcpy(principal.instance, optarg,
+				    sizeof(principal.instance));
+			else {
+				warnx("Bad instance: %s", optarg);
+				usage(1);
+			}
+			break;
+		case 'r':
+			if (k_isrealm(optarg)) {
+				strlcpy(principal.realm, optarg,
+				    sizeof(principal.realm));
+				realm_given++;
+			} else {
+				warnx("Bad realm: %s", optarg);
+				usage(1);
+			}
+			break;
+		case 'h':
+			usage(0);
+			break;
+		default:
+			usage(1);
+			break;
+		}
+		use_default = 0;
+	}
+	if (optind < argc) {
+		use_default = 0;
+		status = krb_parse_name(argv[optind], &principal);
+		if (status != KSUCCESS)
+			errx(1, "%s", krb_get_err_text (status));
 	}
-	use_default = 0;
-    }
-    if (optind < argc) {
-	use_default = 0;
-	status = krb_parse_name (argv[optind], &principal);
-	if(status != KSUCCESS)
-	    errx (1, "%s", krb_get_err_text (status));
-    }
-
-    if (use_default) {
-	strncpy(principal.name, default_principal.name, ANAME_SZ - 1);
-	principal.name[ANAME_SZ - 1] = '\0';
-	strncpy(principal.instance, default_principal.instance, INST_SZ - 1);
-	principal.instance[INST_SZ - 1] = '\0';
-	strncpy(principal.realm, default_principal.realm, REALM_SZ - 1);
-	principal.realm[REALM_SZ - 1] = '\0';
-    } else {
-	if (!principal.name[0]) {
-	    strncpy(principal.name, default_principal.name, ANAME_SZ - 1);
-	    principal.name[ANAME_SZ - 1] = '\0';
+
+	if (use_default) {
+		strlcpy(principal.name, default_principal.name, ANAME_SZ);
+		strlcpy(principal.instance, default_principal.instance, INST_SZ);
+		strlcpy(principal.realm, default_principal.realm, REALM_SZ);
+	} else {
+		if (!principal.name[0])
+			strlcpy(principal.name, default_principal.name, ANAME_SZ);
+		if (!principal.realm[0])
+			strlcpy(principal.realm, default_principal.realm, REALM_SZ);
 	}
-	if (!principal.realm[0]) {
-	    strncpy(principal.realm, default_principal.realm, REALM_SZ - 1);
-	    principal.realm[REALM_SZ - 1] = '\0';
+
+	snprintf(tktstring, sizeof(tktstring), "%s_cpw_%ld",
+	    TKT_ROOT, (long)getpid());
+	krb_set_tkt_string(tktstring);
+
+	if (get_pw_new_pwd(pword, sizeof(pword), &principal, realm_given)) {
+		dest_tkt();
+		exit(1);
+	}
+
+	status = kadm_init_link (PWSERV_NAME, KRB_MASTER, principal.realm);
+	if (status != KADM_SUCCESS)
+		com_err(argv[0], status, "while initializing");
+	else {
+		des_cblock newkey;
+		char *pw_msg; /* message from server */
+
+		des_string_to_key(pword, &newkey);
+		status = kadm_change_pw_plain((unsigned char*)&newkey, pword, &pw_msg);
+		memset(newkey, 0, sizeof(newkey));
+
+		if (status == KADM_INSECURE_PW)
+			warnx("Insecure password: %s", pw_msg);
+		else if (status != KADM_SUCCESS)
+			com_err(argv[0], status, " attempting to change password.");
 	}
-    }
-
-    snprintf(tktstring, sizeof(tktstring),
-	     "%s_cpw_%ld", TKT_ROOT, (long)getpid());
-    krb_set_tkt_string(tktstring);
-    
-    if (get_pw_new_pwd(pword, sizeof(pword), &principal,
-		       realm_given)) {
-	dest_tkt ();
-	exit(1);
-    }
-    
-    status = kadm_init_link (PWSERV_NAME, KRB_MASTER, principal.realm);
-    if (status != KADM_SUCCESS) 
-	com_err(argv[0], status, "while initializing");
-    else {
-	des_cblock newkey;
-	char *pw_msg; /* message from server */
-
-	des_string_to_key(pword, &newkey);
-	status = kadm_change_pw_plain((unsigned char*)&newkey, pword, &pw_msg);
-	memset(newkey, 0, sizeof(newkey));
-      
-	if (status == KADM_INSECURE_PW)
-	    warnx ("Insecure password: %s", pw_msg);
-	else if (status != KADM_SUCCESS)
-	    com_err(argv[0], status, " attempting to change password.");
-    }
-    memset(pword, 0, sizeof(pword));
-
-    if (status != KADM_SUCCESS)
-	fprintf(stderr,"Password NOT changed.\n");
-    else
-	printf("Password changed.\n");
-
-    dest_tkt();
-    if (status)
-	return 2;
-    else 
-	return 0;
+	memset(pword, 0, sizeof(pword));
+
+	if (status != KADM_SUCCESS)
+		fprintf(stderr,"Password NOT changed.\n");
+	else
+		printf("Password changed.\n");
+
+	dest_tkt();
+	if (status)
+		return 2;
+	else
+		return 0;
 }
 
 #endif /* KERBEROS */
diff --git a/usr.bin/passwd/local_passwd.c b/usr.bin/passwd/local_passwd.c
index 970cc44279e..91cce7339fc 100644
--- a/usr.bin/passwd/local_passwd.c
+++ b/usr.bin/passwd/local_passwd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: local_passwd.c,v 1.25 2002/02/16 21:27:50 millert Exp $	*/
+/*	$OpenBSD: local_passwd.c,v 1.26 2002/06/28 22:28:17 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 1990 The Regents of the University of California.
@@ -35,7 +35,7 @@
 
 #ifndef lint
 /*static const char sccsid[] = "from: @(#)local_passwd.c	5.5 (Berkeley) 5/6/91";*/
-static const char rcsid[] = "$OpenBSD: local_passwd.c,v 1.25 2002/02/16 21:27:50 millert Exp $";
+static const char rcsid[] = "$OpenBSD: local_passwd.c,v 1.26 2002/06/28 22:28:17 deraadt Exp $";
 #endif /* not lint */
 
 #include <sys/types.h>
@@ -62,9 +62,7 @@ char *getnewpasswd(struct passwd *, login_cap_t *, int);
 void kbintr(int);
 
 int
-local_passwd(uname, authenticated)
-	char *uname;
-	int authenticated;
+local_passwd(char *uname, int authenticated)
 {
 	struct passwd *pw;
 	login_cap_t *lc;
@@ -143,10 +141,7 @@ local_passwd(uname, authenticated)
 }
 
 char *
-getnewpasswd(pw, lc, authenticated)
-	struct passwd *pw;
-	login_cap_t *lc;
-	int authenticated;
+getnewpasswd(struct passwd *pw, login_cap_t *lc, int authenticated)
 {
 	char *p;
 	int tries, pwd_tries;
@@ -165,7 +160,7 @@ getnewpasswd(pw, lc, authenticated)
 			pw_error(NULL, 1, 1);
 		}
 	}
-	
+
 	pwd_tries = pwd_gettries(pw, lc);
 
 	for (buf[0] = '\0', tries = 0;;) {
@@ -178,7 +173,7 @@ getnewpasswd(pw, lc, authenticated)
 			printf("That password collides with a system feature. Choose another.\n");
 			continue;
 		}
-		
+
 		if ((tries++ < pwd_tries || pwd_tries == 0) 
 		    && pwd_check(pw, lc, p) == 0)
 			continue;
@@ -198,8 +193,7 @@ getnewpasswd(pw, lc, authenticated)
 }
 
 void
-kbintr(signo)
-	int signo;
+kbintr(int signo)
 {
 	char msg[] = "\nPassword unchanged.\n";
 	struct iovec iv[5];
diff --git a/usr.bin/passwd/new_pwd.c b/usr.bin/passwd/new_pwd.c
index cca00e38cec..c83bc0059e6 100644
--- a/usr.bin/passwd/new_pwd.c
+++ b/usr.bin/passwd/new_pwd.c
@@ -1,31 +1,31 @@
-/* $OpenBSD: new_pwd.c,v 1.4 2001/01/29 01:58:14 niklas Exp $ */
+/* $OpenBSD: new_pwd.c,v 1.5 2002/06/28 22:28:17 deraadt Exp $ */
 /* $KTH: new_pwd.c,v 1.11 1997/05/02 14:28:54 assar Exp $ */
 
 /*
  * Copyright (c) 1995, 1996, 1997 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden).
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
- * 
+ *
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 
+ *
  * 3. All advertising materials mentioning features or use of this software
  *    must display the following acknowledgement:
  *      This product includes software developed by the Kungliga Tekniska
  *      Högskolan and its contributors.
- * 
+ *
  * 4. Neither the name of the Institute nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -65,10 +65,10 @@ check_pw (char *pword)
 
 	if (strlen(pword) == 0)
 		return "Null passwords are not allowed - Please enter a longer password.";
-    
+
 	if (strlen(pword) < MIN_KPW_LEN)
 		return "Password is to short - Please enter a longer password.";
-    
+
 	if (strcmp(pword, "s/key") == 0)
 		return "That password collides with a system feature. Choose another.\n";
 
@@ -92,13 +92,13 @@ get_pw_new_pwd(char *pword, int pwlen, krb_principal *pr, int print_realm)
 	int status;
 	char *expl;
 	char *q;
-    
+
 	/*
 	 * We don't care about failure; this is to determine whether or
-	 * not to print the realm in the prompt for a new password. 
+	 * not to print the realm in the prompt for a new password.
 	 */
 	krb_get_lrealm(local_realm, 1);
-    
+
 	if (strcmp(local_realm, pr->realm))
 		print_realm++;
 	krb_unparse_name_r(pr, p);
@@ -111,7 +111,7 @@ get_pw_new_pwd(char *pword, int pwlen, krb_principal *pr, int print_realm)
 		return -1;
 	}
 
-	status = krb_get_pw_in_tkt(pr->name, pr->instance, pr->realm, 
+	status = krb_get_pw_in_tkt(pr->name, pr->instance, pr->realm,
 	    PWSERV_NAME, KADM_SINST, 1, pword);
 	if (status != KSUCCESS) {
 		if (status == INTK_BADPW) {
@@ -123,6 +123,7 @@ get_pw_new_pwd(char *pword, int pwlen, krb_principal *pr, int print_realm)
 			return -1;
 		}
 	}
+
 	memset(pword, 0, pwlen);
 
 	do {
diff --git a/usr.bin/passwd/passwd.c b/usr.bin/passwd/passwd.c
index edf181c181c..40c2fef5697 100644
--- a/usr.bin/passwd/passwd.c
+++ b/usr.bin/passwd/passwd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: passwd.c,v 1.14 2002/05/10 06:52:03 hugh Exp $	*/
+/*	$OpenBSD: passwd.c,v 1.15 2002/06/28 22:28:17 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1988 The Regents of the University of California.
@@ -41,7 +41,7 @@ char copyright[] =
 
 #ifndef lint
 /*static const char sccsid[] = "from: @(#)passwd.c	5.5 (Berkeley) 7/6/91";*/
-static const char rcsid[] = "$OpenBSD: passwd.c,v 1.14 2002/05/10 06:52:03 hugh Exp $";
+static const char rcsid[] = "$OpenBSD: passwd.c,v 1.15 2002/06/28 22:28:17 deraadt Exp $";
 #endif /* not lint */
 
 #include <stdio.h>
@@ -66,26 +66,23 @@ int use_yp;
 int force_yp;
 #endif
 
-
 extern int local_passwd(char *, int);
 extern int yp_passwd(char *);
 extern int krb_passwd(int, char **);
 extern int krb5_passwd(int, char **);
 extern int _yp_check(char **);
-void usage(int value);
-
+void usage(int retval);
 
 int
-main(argc, argv)
-	int argc;
-	char **argv;
+main(int argc, char **argv)
 {
 	extern int optind;
-	int ch;
 	char *username;
+	int ch;
 #ifdef	YP
 	int status = 0;
 #endif
+
 #if defined(KERBEROS) || defined(KERBEROS5)
 	extern char realm[];
 
@@ -116,10 +113,10 @@ main(argc, argv)
 		case 'K':
 #ifdef KRB5
 			/* Skip programname and '-K' option */
-			argc-=2;
-			argv+=2;
+			argc -= 2;
+			argv += 2;
 			exit(krb5_passwd(argc, argv));
-#else			
+#else
 			errx(1, "KerberosV support not enabled");
 			break;
 #endif
@@ -149,19 +146,19 @@ main(argc, argv)
 		fprintf(stderr, "passwd: who are you ??\n");
 		exit(1);
 	}
-	
-	switch(argc) {
+
+	switch (argc) {
 	case 0:
 		break;
 	case 1:
 #if defined(KERBEROS) || defined(KERBEROS5)
-	    if (use_kerberos && strcmp(argv[0], username)) {
-		(void)fprintf(stderr, "passwd: %s\n\t%s\n%s\n",
-			      "to change another user's Kerberos password, do",
-			      "\"passwd -k -u <user>\";",
-			      "to change a user's local passwd, use \"passwd -l <user>\"");
-		exit(1);
-	    }
+		if (use_kerberos && strcmp(argv[0], username)) {
+			(void)fprintf(stderr, "passwd: %s\n\t%s\n%s\n",
+			    "to change another user's Kerberos password, do",
+			    "\"passwd -k -u <user>\";",
+			    "to change a user's local passwd, use \"passwd -l <user>\"");
+			exit(1);
+		}
 #endif
 		username = argv[0];
 		break;
@@ -170,8 +167,8 @@ main(argc, argv)
 	}
 
 #if defined(KERBEROS) || defined(KERBEROS5)
-        if (use_kerberos)
-                exit(krb_passwd(argc, argv));
+	if (use_kerberos)
+		exit(krb_passwd(argc, argv));
 #endif
 
 #ifdef	YP
@@ -183,9 +180,9 @@ main(argc, argv)
 }
 
 void
-usage(retval)
-	int retval;
+usage(int retval)
 {
-	fprintf(stderr, "usage: passwd [-l] [-y] [-k [-n name] [-i instance] [-r realm] [-u username[.instance][@realm]] [user]\n");
+	fprintf(stderr, "usage: passwd [-l] [-y] [-k [-n name] [-i instance] "
+	    "[-r realm] [-u username[.instance][@realm]] [user]\n");
 	exit(retval);
 }
diff --git a/usr.bin/passwd/pwd_check.c b/usr.bin/passwd/pwd_check.c
index ed7a21deebe..317996dca6c 100644
--- a/usr.bin/passwd/pwd_check.c
+++ b/usr.bin/passwd/pwd_check.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pwd_check.c,v 1.5 2002/05/27 21:12:54 itojun Exp $	*/
+/*	$OpenBSD: pwd_check.c,v 1.6 2002/06/28 22:28:17 deraadt Exp $	*/
 /*
  * Copyright 2000 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -54,7 +54,7 @@ struct pattern {
 
 struct pattern patterns[] = {
 	{
-		"^[0-9]*$", 
+		"^[0-9]*$",
 		REG_EXTENDED|REG_NOSUB,
 		"Please don't use all-digit passwords."
 	},
@@ -87,7 +87,7 @@ pwd_check(struct passwd *pwd, login_cap_t *lc, char *password)
 	int i, res, min_len;
 	char *cp, option[LINE_MAX];
 	int pipefds[2];
-	
+
 	min_len = (int) login_getcapnum(lc, "minpasswordlen", 6, 6);
 	if (min_len > 0 && strlen(password) < min_len) {
 		printf("Please enter a longer password.\n");
@@ -123,17 +123,15 @@ pwd_check(struct passwd *pwd, login_cap_t *lc, char *password)
 
 			grp = getgrgid(pwd->pw_gid);
 			if (grp != NULL) {
-				snprintf(grpkey, LINE_MAX-1, ":%s",
+				snprintf(grpkey, LINE_MAX, ":%s",
 				    grp->gr_name);
-				grpkey[LINE_MAX-1] = 0;
 				pw_getconf(option, LINE_MAX, grpkey,
 				    "pwdcheck");
 			}
 			if (grp != NULL && *option == 0 &&
 			    strchr(pwd->pw_name, '.') == NULL) {
-				snprintf(grpkey, LINE_MAX-1, ".%s",
+				snprintf(grpkey, LINE_MAX, ".%s",
 				    grp->gr_name);
-				grpkey[LINE_MAX-1] = 0;
 				pw_getconf(option, LINE_MAX, grpkey,
 				    "pwdcheck");
 			}
@@ -142,7 +140,7 @@ pwd_check(struct passwd *pwd, login_cap_t *lc, char *password)
 				    "pwdcheck");
 		}
 	}
-	
+
 	/* If no checker is specified, we accept the password */
 	if (*option == 0)
 		return (1);
@@ -155,7 +153,7 @@ pwd_check(struct passwd *pwd, login_cap_t *lc, char *password)
 	res = fork();
 	if (res == 0) {
 		char *argp[] = { "sh", "-c", NULL, NULL};
-		
+
 		/* Drop privileges */
 		seteuid(getuid());
 		setuid(getuid());
@@ -186,15 +184,18 @@ pwd_check(struct passwd *pwd, login_cap_t *lc, char *password)
 		return (1);
 
  out:
-	printf("Please use a different password.\nUnusual capitalization, control characters or digits are suggested.\n");
+	printf("Please use a different password. Unusual capitalization,\n");
+	printf("control characters, or digits are suggested.\n");
 	return (0);
 }
 
-int pwd_gettries( struct passwd *pwd, login_cap_t *lc )
+int
+pwd_gettries( struct passwd *pwd, login_cap_t *lc )
 {
 	char option[LINE_MAX];
-	char *ep = option; 
+	char *ep = option;
 	quad_t ntries;
+	long lval;
 
 	/*
 	 * Check login.conf, falling back onto the deprecated passwd.conf
@@ -202,7 +203,7 @@ int pwd_gettries( struct passwd *pwd, login_cap_t *lc )
 	if ((ntries = login_getcapnum(lc, "passwordtries", -1, -1)) != -1) {
 		if (ntries > INT_MAX || ntries < 0) {
 			fprintf(stderr,
-			    "Warning: pwdtries out of range in /etc/login.conf");   
+			    "Warning: pwdtries out of range in /etc/login.conf");
 			goto out;
 		}
 		return((int)ntries);
@@ -217,42 +218,37 @@ int pwd_gettries( struct passwd *pwd, login_cap_t *lc )
 
 		grp = getgrgid(pwd->pw_gid);
 		if (grp != NULL) {
-			snprintf(grpkey, LINE_MAX-1, ":%s", grp->gr_name);
-			grpkey[LINE_MAX-1] = 0;
+			snprintf(grpkey, LINE_MAX, ":%s", grp->gr_name);
 			pw_getconf(option, LINE_MAX, grpkey, "pwdtries");
 		}
 		if (grp != NULL && *option == 0 &&
 		    strchr(pwd->pw_name, '.') == NULL) {
-			snprintf(grpkey, LINE_MAX-1, ".%s", grp->gr_name);
-			grpkey[LINE_MAX-1] = 0;
+			snprintf(grpkey, LINE_MAX, ".%s", grp->gr_name);
 			pw_getconf(option, LINE_MAX, grpkey, "pwdtries");
 		}
 		if (*option == 0)
 			pw_getconf(option, LINE_MAX, "default", "pwdtries");
 	}
-	
+
 	if (*option == 0)
 		goto out;
-	else {
-		long lval;
-		errno = 0;
-		lval = strtol(option, &ep, 10);
-		if (option[0] == '\0' || *ep != '\0') {
-			fprintf(stderr, 
-				"Warning: Bad pwdtries line in /etc/passwd.conf");   
-			goto out;
-		}
-		if ((errno == ERANGE && (lval == LONG_MAX
-					 || lval == LONG_MIN)) ||
-		    (lval > INT_MAX || lval < 0)) {
-			fprintf(stderr, 
-				"Warning: pwdtries out of range in /etc/passwd.conf");   
-			goto out;
-		}
-		return((int) lval);
+
+	errno = 0;
+	lval = strtol(option, &ep, 10);
+	if (option[0] == '\0' || *ep != '\0') {
+		fprintf(stderr,
+		    "Warning: Bad pwdtries line in /etc/passwd.conf");
+		goto out;
 	}
+	if ((errno == ERANGE && (lval == LONG_MAX || lval == LONG_MIN)) ||
+	    (lval > INT_MAX || lval < 0)) {
+		fprintf(stderr,
+		    "Warning: pwdtries out of range in /etc/passwd.conf");
+		goto out;
+	}
+	return((int) lval);
 
-	/* If no amount of tries is specified, return a default of 
+	/* If no amount of tries is specified, return a default of
 	 * 3, meaning that after 3 attempts where the user is foiled
 	 * by the password checks, it will no longer be checked and
 	 * they can set it to whatever they like.
@@ -260,5 +256,3 @@ int pwd_gettries( struct passwd *pwd, login_cap_t *lc )
 	out:
 		return (3);
 }
-  
-
diff --git a/usr.bin/passwd/pwd_gensalt.c b/usr.bin/passwd/pwd_gensalt.c
index 63d40a960db..ade7cbfe66c 100644
--- a/usr.bin/passwd/pwd_gensalt.c
+++ b/usr.bin/passwd/pwd_gensalt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pwd_gensalt.c,v 1.13 2002/05/27 21:12:54 itojun Exp $ */
+/* $OpenBSD: pwd_gensalt.c,v 1.14 2002/06/28 22:28:17 deraadt Exp $ */
 /*
  * Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de>
  * All rights reserved.
@@ -41,29 +41,23 @@
 #include <time.h>
 #include <login_cap.h>
 
-void to64(char *, int32_t, int n);
+void	to64(char *, int32_t, int n);
+char	*bcrypt_gensalt(u_int8_t);
 
 int
-pwd_gensalt(salt, max, pwd, lc, type)
-	char   *salt;
-	int     max;
-	struct passwd *pwd;
-	login_cap_t *lc;
-	char    type;
+pwd_gensalt(char *salt, int saltlen, struct passwd *pwd, login_cap_t *lc, char type)
 {
-	char   *bcrypt_gensalt(u_int8_t);
-	char    option[LINE_MAX];
-	char   *next, *now;
-	char   *cipher;
+	char	option[LINE_MAX], *next, *now, *cipher;
+
 	*salt = '\0';
 
 	switch (type) {
 	case 'y':
-	        cipher = "ypcipher";
+		cipher = "ypcipher";
 		break;
 	case 'l':
 	default:
-	        cipher = "localcipher";
+		cipher = "localcipher";
 		break;
 	}
 
@@ -84,16 +78,14 @@ pwd_gensalt(salt, max, pwd, lc, type)
 
 			grp = getgrgid(pwd->pw_gid);
 			if (grp != NULL) {
-				snprintf(grpkey, LINE_MAX-1, ":%s",
+				snprintf(grpkey, LINE_MAX, ":%s",
 				    grp->gr_name);
-				grpkey[LINE_MAX-1] = 0;
 				pw_getconf(option, LINE_MAX, grpkey, cipher);
 			}
 			if (grp != NULL && *option == 0 &&
 			    strchr(pwd->pw_name, '.') == NULL) {
-				snprintf(grpkey, LINE_MAX-1, ".%s",
+				snprintf(grpkey, LINE_MAX, ".%s",
 				    grp->gr_name);
-				grpkey[LINE_MAX-1] = 0;
 				pw_getconf(option, LINE_MAX, grpkey, cipher);
 			}
 			if (*option == 0)
@@ -104,38 +96,40 @@ pwd_gensalt(salt, max, pwd, lc, type)
 	next = option;
 	now = strsep(&next, ",");
 	if (!strcmp(now, "old")) {
-		if (max < 3)
+		if (saltlen < 3)
 			return 0;
 		to64(&salt[0], arc4random(), 2);
 		salt[2] = '\0';
 	} else if (!strcmp(now, "newsalt")) {
 		u_int32_t rounds = atol(next);
-		if (max < 10)
+
+		if (saltlen < 10)
 			return 0;
 		/* Check rounds, 24 bit is max */
 		if (rounds < 7250)
 			rounds = 7250;
 		else if (rounds > 0xffffff)
-		        rounds = 0xffffff;
+			rounds = 0xffffff;
 		salt[0] = _PASSWORD_EFMT1;
 		to64(&salt[1], (u_int32_t) rounds, 4);
 		to64(&salt[5], arc4random(), 4);
 		salt[9] = '\0';
 	} else if (!strcmp(now, "md5")) {
-		if (max < 13)  /* $1$8salt$\0 */
+		if (saltlen < 13)	/* $1$8salt$\0 */
 			return 0;
-		strcpy(salt, "$1$");
+
+		strlcpy(salt, "$1$", saltlen);
 		to64(&salt[3], arc4random(), 4);
 		to64(&salt[7], arc4random(), 4);
 		strcpy(&salt[11], "$");
 	} else if (!strcmp(now, "blowfish")) {
-		int     rounds = atoi(next);
+		int rounds = atoi(next);
+
 		if (rounds < 4)
 			rounds = 4;
-		strncpy(salt, bcrypt_gensalt(rounds), max - 1);
-		salt[max - 1] = 0;
+		strlcpy(salt, bcrypt_gensalt(rounds), saltlen);
 	} else {
-		strcpy(salt, ":");
+		strlcpy(salt, ":", saltlen);
 		warnx("Unkown option %s.", now);
 	}
 	return 1;
@@ -145,10 +139,7 @@ static unsigned char itoa64[] =	 /* 0 ... 63 => ascii - 64 */
 	"./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 
 void
-to64(s, v, n)
-	char *s;
-	int32_t v;
-	int n;
+to64(char *s, int32_t v, int n)
 {
 	while (--n >= 0) {
 		*s++ = itoa64[v&0x3f];
diff --git a/usr.bin/passwd/yp_passwd.c b/usr.bin/passwd/yp_passwd.c
index aad7ac8e8c9..08a90c8b0fc 100644
--- a/usr.bin/passwd/yp_passwd.c
+++ b/usr.bin/passwd/yp_passwd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: yp_passwd.c,v 1.22 2002/06/04 00:09:08 deraadt Exp $	*/
+/*	$OpenBSD: yp_passwd.c,v 1.23 2002/06/28 22:28:17 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1988 The Regents of the University of California.
@@ -34,7 +34,7 @@
  */
 #ifndef lint
 /*static const char sccsid[] = "from: @(#)yp_passwd.c	1.0 2/2/93";*/
-static const char rcsid[] = "$OpenBSD: yp_passwd.c,v 1.22 2002/06/04 00:09:08 deraadt Exp $";
+static const char rcsid[] = "$OpenBSD: yp_passwd.c,v 1.23 2002/06/28 22:28:17 deraadt Exp $";
 #endif /* not lint */
 
 #ifdef	YP
@@ -66,15 +66,13 @@ extern int	pwd_check(struct passwd *, login_cap_t *, char *);
 extern int	pwd_gettries(struct passwd *, login_cap_t *);
 extern void	kbintr(int);
 
-char	       *ypgetnewpasswd(struct passwd *, login_cap_t *, char **);
-struct passwd  *ypgetpwnam(char *);
+char		*ypgetnewpasswd(struct passwd *, login_cap_t *, char **);
+struct passwd	*ypgetpwnam(char *);
 
 char *domain;
 
 static int
-pw_error(name, err, eval)
-	char *name;
-	int err, eval;
+pw_error(char *name, int err, int eval)
 {
 	if (err) {
 		if (name)
@@ -88,17 +86,16 @@ pw_error(name, err, eval)
 }
 
 int
-yp_passwd(username)
-	char *username;
+yp_passwd(char *username)
 {
-	char *master;
-	int r, rpcport, status;
-	uid_t uid;
 	struct yppasswd yppasswd;
+	int r, rpcport, status;
 	struct passwd *pw;
 	struct timeval tv;
-	CLIENT *client;
 	login_cap_t *lc;
+	CLIENT *client;
+	char *master;
+	uid_t uid;
 
 	/*
 	 * Get local domain
@@ -159,7 +156,7 @@ yp_passwd(username)
 
 	/* tell rpc.yppasswdd */
 	yppasswd.newpw.pw_name	= pw->pw_name;
-	yppasswd.newpw.pw_uid 	= pw->pw_uid;
+	yppasswd.newpw.pw_uid	= pw->pw_uid;
 	yppasswd.newpw.pw_gid	= pw->pw_gid;
 	yppasswd.newpw.pw_gecos = pw->pw_gecos;
 	yppasswd.newpw.pw_dir	= pw->pw_dir;
@@ -191,16 +188,13 @@ yp_passwd(username)
 }
 
 char *
-ypgetnewpasswd(pw, lc, old_pass)
-	struct passwd *pw;
-	login_cap_t *lc;
-	char **old_pass;
+ypgetnewpasswd(struct passwd *pw, login_cap_t *lc, char **old_pass)
 {
 	static char buf[_PASSWORD_LEN+1];
-	char *p;
-	int tries, pwd_tries;
 	char salt[_PASSWORD_LEN];
 	sig_t saveint, savequit;
+	int tries, pwd_tries;
+	char *p;
 
 	saveint = signal(SIGINT, kbintr);
 	savequit = signal(SIGQUIT, kbintr);
@@ -238,13 +232,12 @@ ypgetnewpasswd(pw, lc, old_pass)
 		if ((tries++ < pwd_tries || pwd_tries == 0)
 		    && pwd_check(pw, lc, p) == 0)
 			continue;
-		strncpy(buf, p, sizeof buf-1);
-		buf[sizeof buf-1] = '\0';
+		strlcpy(buf, p, sizeof buf);
 		if (!strcmp(buf, getpass("Retype new password:")))
 			break;
 		(void)printf("Mismatch; try again, EOF to quit.\n");
 	}
-	if(!pwd_gensalt(salt, _PASSWORD_LEN, pw, lc, 'y')) {
+	if (!pwd_gensalt(salt, _PASSWORD_LEN, pw, lc, 'y')) {
 		(void)printf("Couldn't generate salt.\n");
 		pw_error(NULL, 0, 0);
 	}
@@ -283,7 +276,7 @@ interpret(struct passwd *pwent, char *line)
 	pwent->pw_class = "";
 
 	/* line without colon separators is no good, so ignore it */
-	if(!strchr(p, ':'))
+	if (!strchr(p, ':'))
 		return (NULL);
 
 	pwent->pw_name = p;
@@ -308,16 +301,15 @@ interpret(struct passwd *pwent, char *line)
 static char *__yplin;
 
 struct passwd *
-ypgetpwnam(nam)
-	char *nam;
+ypgetpwnam(char *nam)
 {
 	static struct passwd pwent;
-	char *val;
 	int reason, vallen;
+	char *val;
 
 	reason = yp_match(domain, "passwd.byname", nam, strlen(nam),
 	    &val, &vallen);
-	switch(reason) {
+	switch (reason) {
 	case 0:
 		break;
 	default:
@@ -330,8 +322,7 @@ ypgetpwnam(nam)
 	__yplin = (char *)malloc(vallen + 1);
 	if (__yplin == NULL)
 		pw_error(NULL, 1, 1);
-	strncpy(__yplin, val, vallen);
-	__yplin[vallen] = '\0';
+	strlcpy(__yplin, val, vallen + 1);
 	free(val);
 
 	return (interpret(&pwent, __yplin));