[Freeciv-Dev] (PR#10074) auth database issues

["Mike Kaufman" <kaufman@xxxxxxxxxxxxxxxxxxxxxx>]

<URL: http://rt.freeciv.org/Ticket/Display.html?id=10074 >

here's a patch that adds a userdb_check_password() function
it's needed because the database might (will) encrypt passwords and the
server won't know about it. The one issue here is that the (possibly
encrypted) password is stored in pconn->server.password which currently has
a length of MAX_LEN_NAME (32 bytes) This is pretty small. For MD5, the
digest is 32 bytes which is ok, but SHA1 is 40 bytes, bad. I suggest
increasing the array to 512 bytes.

-mike

Index: server/connecthand.c
===================================================================
RCS file: /home/freeciv/CVS/freeciv/server/connecthand.c,v
retrieving revision 1.25
diff -u -r1.25 connecthand.c
--- server/connecthand.c        10 Sep 2004 21:20:53 -0000      1.25
+++ server/connecthand.c        12 Sep 2004 19:13:49 -0000
@@ -415,7 +415,7 @@
 
     establish_new_connection(pconn);
   } else if (pconn->server.status == AS_REQUESTING_OLD_PASS) { 
-    if (strncmp(pconn->server.password, password, MAX_LEN_NAME) == 0) {
+    if (userdb_check_password(pconn, password, strlen(password))) {
       pconn->server.status = AS_ESTABLISHED;
       establish_new_connection(pconn);
     } else {
Index: server/userdb/user_db.c
===================================================================
RCS file: /home/freeciv/CVS/freeciv/server/userdb/user_db.c,v
retrieving revision 1.3
diff -u -r1.3 user_db.c
--- server/userdb/user_db.c     28 Nov 2003 17:37:23 -0000      1.3
+++ server/userdb/user_db.c     12 Sep 2004 19:13:49 -0000
@@ -60,6 +60,16 @@
 }
 
 /**************************************************************************
+  check if the password matches that given in pconn->server.password.
+  if so, return 1, else return 0
+***************************************************************************/
+int userdb_check_password(struct connection *pconn, 
+                         const char *password, int len)
+{
+  return (strncmp(pconn->server.password, password, len) == 0) ? 1 : 0;
+}
+
+/**************************************************************************
  Loads a user from the database.
 **************************************************************************/
 enum userdb_status user_db_load(struct connection *pconn)
Index: server/userdb/user_db.h
===================================================================
RCS file: /home/freeciv/CVS/freeciv/server/userdb/user_db.h,v
retrieving revision 1.2
diff -u -r1.2 user_db.h
--- server/userdb/user_db.h     12 Sep 2003 02:31:40 -0000      1.2
+++ server/userdb/user_db.h     12 Sep 2004 19:13:49 -0000
@@ -29,6 +29,8 @@
   USER_DB_NOT_FOUND
 };
 
+int userdb_check_password(struct connection *pconn,
+                         const char *password, int len);
 enum userdb_status user_db_load(struct connection *pconn);
 enum userdb_status user_db_save(struct connection *pconn);