Changeset 33228 in vbox for trunk/src/VBox/HostServices/auth

Timestamp:

Oct 19, 2010 1:12:31 PM (14 years ago)

Author:

vboxsync

Message:

VBoxAuthSimple now requires SHA-256 hashes, no more cleartext passwords

File:

• trunk/src/VBox/HostServices/auth/simple/VBoxAuthSimple.cpp (modified) (4 diffs)

trunk/src/VBox/HostServices/auth/simple/VBoxAuthSimple.cpp

@@ -24 +24 @@
 #include <iprt/cdefs.h>
 #include <iprt/uuid.h>
+#include <iprt/sha.h>
 
 #include <VBox/VRDPAuth.h>
@@ -85 +86 @@
         user = (char*)szUser;
 
-    dprintf("VRDPAuth: uuid: %s, user: %s, szPassword: %s\n", uuid, user, szPassword);
-
-#if 0
-    /* this is crude stuff, but let's keep it there as a sample */
-    if (getenv("VBOX_VRDP_AUTH_USER") && getenv("VBOX_VRDP_AUTH_PASSWORD"))
-    {
-
-        if (   !strcmp(getenv("VBOX_VRDP_AUTH_USER"), user)
-            && !strcmp(getenv("VBOX_VRDP_AUTH_PASSWORD"), szPassword))
-        {
-            result = VRDPAuthAccessGranted;
-        }
-    }
-#endif
+    dprintf("VBoxAuth: uuid: %s, user: %s, szPassword: %s\n", uuid, user, szPassword);
 
     ComPtr<IVirtualBox> virtualBox;
@@ -106 +94 @@
     if (SUCCEEDED(rc))
     {
-        Bstr key = BstrFmt("VRDPAuthSimple/users/%s", user);
+        Bstr key = BstrFmt("VBoxAuthSimple/users/%s", user);
         Bstr password;
 
@@ -120 +108 @@
             virtualBox->GetExtraData(key.raw(), password.asOutParam());
 
-        /* we compare the password or check for special NULL marker */
-        if (   (!password.isEmpty() && (password == szPassword))
-            || ((password == "[NULL]") && (!szPassword || (*szPassword == '\0'))))
+        if (!password.isEmpty())
         {
-            result = VRDPAuthAccessGranted;
+            /* calculate hash */
+            uint8_t abDigest[RTSHA256_HASH_SIZE];
+            RTSha256(szPassword, strlen(szPassword), abDigest);
+            char pszDigest[RTSHA256_STRING_LEN + 1];
+            RTSha256ToString(abDigest, pszDigest, sizeof(pszDigest));
+                        
+            if (password == pszDigest)
+                result = VRDPAuthAccessGranted;
         }
     }