65e14b458
Denis Vlasenko
2007-06-08
Subject
login: ask passwords even for wrong usernames.
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
libbb/correct_password.c+8 -3
| @@ -31,9 +31,10 @@ | |
| #include "libbb.h" | |
| /* Ask the user for a password. | |
| - | Return 1 if the user gives the correct password for entry PW, |
| - | 0 if not. Return 1 without asking for a password if run by UID 0 |
| - | or if PW has an empty password. */ |
| + | * Return 1 if the user gives the correct password for entry PW, |
| + | * 0 if not. Return 1 without asking if PW has an empty password. |
| + | * |
| + | * NULL pw means "just fake it for login with bad username" */ |
| int correct_password(const struct passwd *pw) | |
| { | |
| @@ -46,6 +47,9 @@ int correct_password(const struct passwd *pw) | |
| char buffer[256]; | |
| #endif | |
| + | correct = "aa"; /* fake salt. crypt() can choke otherwise */ |
| + | if (!pw) |
| + | goto fake_it; /* "aa" will never match */ |
| correct = pw->pw_passwd; | |
| #if ENABLE_FEATURE_SHADOWPASSWDS | |
| if (LONE_CHAR(pw->pw_passwd, 'x') || LONE_CHAR(pw->pw_passwd, '*')) { | |
| @@ -59,6 +63,7 @@ int correct_password(const struct passwd *pw) | |
| if (!correct || correct[0] == '\0') | |
| return 1; | |
| + | fake_it: |
| unencrypted = bb_askpass(0, "Password: "); | |
| if (!unencrypted) { | |
| return 0; | |
loginutils/login.c+3 -4
| @@ -276,8 +276,8 @@ int login_main(int argc, char **argv) | |
| pw = getpwnam(username); | |
| if (!pw) { | |
| - | safe_strncpy(username, "UNKNOWN", sizeof(username)); |
| - | goto auth_failed; |
| + | strcpy(username, "UNKNOWN"); |
| + | goto fake_it; |
| } | |
| if (pw->pw_passwd[0] == '!' || pw->pw_passwd[0] == '*') | |
| @@ -292,11 +292,10 @@ int login_main(int argc, char **argv) | |
| /* Don't check the password if password entry is empty (!) */ | |
| if (!pw->pw_passwd[0]) | |
| break; | |
| - | |
| + | fake_it: |
| /* authorization takes place here */ | |
| if (correct_password(pw)) | |
| break; | |
| - | |
| auth_failed: | |
| opt &= ~LOGIN_OPT_f; | |
| bb_do_delay(FAIL_DELAY); | |