Add yescrypt support for pw_hash function

[teluq-pbrideau]

Summary

Add support for yescrypt hashing algorithm in the pw_hash function.

Additional Context

The underlying OS must support yescrypt. For exemple, it does not work on RockyLinux 8, because libxcrypt does not support it, but it does work in RockyLinux 9.

Related Issues (if any)

#1445

Checklist

• 🟢 Spec tests.
• 🟢 Acceptance tests.
• Manually verified. (For example puppet apply)

[teluq-pbrideau]

I deployed this change in my environment, had no problem in development, but now I observe crash of the puppetserver once in a while in a test environment when I execute an agent with this new hash function yescrypt, but not everytime, and only on this environment, everything run fine in the pre-production environment with the same function usage... Puppetserver restart without notice and journalctl -u puppetserver have this log:

puppetserver[32714]: #
puppetserver[32714]: # A fatal error has been detected by the Java Runtime Environment:
puppetserver[32714]: #
puppetserver[32714]: #  SIGSEGV (0xb) at pc=0x00007f2ecc59e83c, pid=32714, tid=2720104
puppetserver[32714]: #
puppetserver[32714]: # JRE version: OpenJDK Runtime Environment (Red_Hat-17.0.17.0.10-1) (17.0.17+10) (build 17.0.17+10-LTS)
puppetserver[32714]: # Java VM: OpenJDK 64-Bit Server VM (Red_Hat-17.0.17.0.10-1) (17.0.17+10-LTS, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
puppetserver[32714]: # Problematic frame:
puppetserver[32714]: # C  [libcrypt.so.1+0x1383c]
puppetserver[32714]: #
puppetserver[32714]: # Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h" (or dumping to //core.32714)
puppetserver[32714]: #
puppetserver[32714]: # An error report file with more information is saved as:
puppetserver[32714]: # /var/log/puppetlabs/puppetserver/puppetserver_err_pid32714.log
puppetserver[32714]: #
puppetserver[32714]: # If you would like to submit a bug report, please visit:
puppetserver[32714]: #   https://access.redhat.com/support/cases/
puppetserver[32714]: # The crash happened outside the Java Virtual Machine in native code.
puppetserver[32714]: # See problematic frame for where to report the bug.
puppetserver[32714]: #

Not sure what the problem is, but it is clearly not ready for production use!

[teluq-pbrideau]

OK, problem was not with the function, but with what I was passing to the function. I was within an epp template, and was unwraping the Sensitive variable before passing to the pw_hash function:

pw_hash($password.unwrap,'yescrypt',"j9T$${stdlib::fqdn_rand_string(24,'',$username)}")

No problem since removing the unwrap:

pw_hash($password,'yescrypt',"j9T$${stdlib::fqdn_rand_string(24,'',$username)}")

I haven’t tested, but I suspect this is also a problem with other hash algorithms.

[jdelzor]

Hi,
Tested on my environment and it works fine.

Thanks for your job :⁠-⁠)