fix fake password salt generation for bcrypt hashes

When an invalid user is being considered for non-PAM password authentication,
sshd will generate a fake passwd/salt to hide timing differences in crypt(3)
or similar. To do this, it uses the salt algorithm from the first valid
account in the password database, but the approach we were using failed to
correctly match bcrypt hashes. So, if the password database only contained
bcrypt hashes, then the timing difference between a valid and invalid user
would again be visible.

Anthropic ANT-2026-7T6M8N4X

openbsd-compat/xcrypt.c

@@ -84,6 +84,13 @@ pick_salt(void)
 			continue;
 		if (passwd[0] == '$' && (p = strrchr(passwd+1, '$')) != NULL) {
 			typelen = p - passwd + 1;
+			/*
+			 * bcrypt ($2*$NN$) has no '$' between its 22 character
+			 * salt and the hash, so keep the salt too or crypt(3)
+			 * will reject the setting without doing any work.
+			 */
+			if (passwd[1] == '2' && strlen(p + 1) >= 22)
+				typelen += 1 + 22;
 			strlcpy(salt, passwd, MINIMUM(typelen, sizeof(salt)));
 			explicit_bzero(passwd, strlen(passwd));
 			goto out;