Support static-challenge "concat" option #701
Conversation
Static challenge response and password are optionally concatenated and submitted instead of using the SCRV1 protocol. The code is activated in the next commit. Signed-off-by: Selva Nair <[email protected]>
Parse the flag in SC:<flag>,TEXT directive for static-challenge, and enable the option to concatenate password and response if indicated in flag. Signed-off-by: Selva Nair <[email protected]>
| SetDlgItemTextW(hwndDlg, ID_EDT_AUTH_PASS, password); | ||
| /* erase potentially secret contents in the response text box */ | ||
| memset(password, L'x', wcslen(password)); | ||
| SetDlgItemTextW(hwndDlg, ID_EDT_AUTH_CHALLENGE, password); |
There was a problem hiding this comment.
not sure I understand this code here - the GetDlgItemTextW() seems clear to me ("if we have CONCAT, read the text field from the window and put it after the existing content in password = concat).
What I'm unclear on is the SetDlgItemTextW() part - so we put the concatenated password into the
ID_EDT_AUTH_PASS field of the window, and a full set of x (of length password+challenge) into the ID_EDT_AUTH_CHALLENGE field?
There was a problem hiding this comment.
I guess that's because later in ManagementCommandFromInput() we get the value of password+auth_challenge from ID_EDT_AUTH_PASS field - so we need that field to contain those concatenated values. And we do erase the content in ID_EDT_AUTH_CHALLENGE because ManagementCommandFromInput() does it only for ID_EDT_AUTH_PASS.
There was a problem hiding this comment.
Yes, as lev said. This allows one to reuse the password submission code by re-writing the password filed with password+OTP. A less "hacky" way would be to add a new function "ManagementComamndFromTwoInputs()" duplicating most of "ManagementCommandFromInput()"
There was a problem hiding this comment.
Yeah, thanks. I only half-understood this - I saw "ok, it's appending the CR to the password, to be used later down" and then totally overlooked that password[] is actually x-ed out right after :-) - makes sense.
LGTM.
|
I didn't test it but the code looks reasonable. Let's get all build checks passed. |
No description provided.