From 9af4f67df75acd2fdb984ca65ee34d5a74e2faa1 Mon Sep 17 00:00:00 2001
From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Mon, 1 Jul 2013 13:58:53 +0200
Subject: [PATCH] Corrected plain passwd authentication to read group name when
 needed.

---
 src/plain.c | 92 ++++++++++++++++++++++++++++++++++-------------------
 1 file changed, 59 insertions(+), 33 deletions(-)

diff --git a/src/plain.c b/src/plain.c
index 63562077..ebdb5b77 100644
--- a/src/plain.c
+++ b/src/plain.c
@@ -25,41 +25,18 @@
 #include <vpn.h>
 #include <plain.h>
 
+#define MAX_CPASS_SIZE 128
+
 struct plain_ctx_st {
 	char username[MAX_USERNAME_SIZE];
+	char cpass[MAX_CPASS_SIZE]; /* crypt() passwd */
 	char groupname[MAX_GROUPNAME_SIZE];
-	const char* passwd;
+	const char* passwd; /* password file */
 };
 
-static int plain_auth_init(void** ctx, const char* username, const char* ip, void* additional)
-{
-struct plain_ctx_st* pctx;
-
-	pctx = malloc(sizeof(*pctx));
-	if (pctx == NULL)
-		return ERR_AUTH_FAIL;
-	
-	snprintf(pctx->username, sizeof(pctx->username), "%s", username);
-	pctx->groupname[0] = 0;
-	pctx->passwd = additional;
-	
-	*ctx = pctx;
-	
-	return 0;
-}
-
-static int plain_auth_group(void* ctx, char *groupname, int groupname_size)
-{
-struct plain_ctx_st* pctx = ctx;
-
-	snprintf(groupname, groupname_size, "%s", pctx->groupname);
-	
-	return 0;
-}
-
 /* Returns 0 if the user is successfully authenticated, and sets the appropriate group name.
  */
-static int plain_auth_pass(void* ctx, const char* pass, unsigned pass_len)
+static int read_auth_pass(void* ctx)
 {
 struct plain_ctx_st* pctx = ctx;
 unsigned groupname_size;
@@ -75,7 +52,7 @@ int ret;
 		syslog(LOG_AUTH, "error in plain authentication; cannot open: %s", pctx->passwd);
 		return -1;
 	}
-	
+
 	while((ll=getline(&line, &len, fp)) > 0) {
 		if (ll <= 2)
 			continue;
@@ -96,22 +73,71 @@ int ret;
 					pctx->groupname[0] = 0;
 
 				p = strtok(NULL, ":");
-				if (p != NULL && strcmp(crypt(pass, p), p) == 0) {
+				if (p != NULL) {
+					snprintf(pctx->cpass, sizeof(pctx->cpass), "%s", p);
 					ret = 0;
 					goto exit;
-				}
+                                }
 			}
 		}
 	}
 	
-	ret = -1;
-	syslog(LOG_AUTH, "error in plain authentication; error in user '%s'", pctx->username);
+	/* always succeed */
+	ret = 0;
 exit:
 	fclose(fp);
 	free(line);
 	return ret;
 }
 
+static int plain_auth_init(void** ctx, const char* username, const char* ip, void* additional)
+{
+struct plain_ctx_st* pctx;
+int ret;
+
+	pctx = malloc(sizeof(*pctx));
+	if (pctx == NULL)
+		return ERR_AUTH_FAIL;
+	
+	snprintf(pctx->username, sizeof(pctx->username), "%s", username);
+	pctx->groupname[0] = 0;
+	pctx->cpass[0] = 0;
+	pctx->passwd = additional;
+
+	ret = read_auth_pass(pctx);
+	if (ret < 0) {
+		free(pctx);
+		return ERR_AUTH_FAIL;
+        }
+	
+	*ctx = pctx;
+	
+	return 0;
+}
+
+static int plain_auth_group(void* ctx, char *groupname, int groupname_size)
+{
+struct plain_ctx_st* pctx = ctx;
+
+	snprintf(groupname, groupname_size, "%s", pctx->groupname);
+	
+	return 0;
+}
+
+/* Returns 0 if the user is successfully authenticated, and sets the appropriate group name.
+ */
+static int plain_auth_pass(void* ctx, const char* pass, unsigned pass_len)
+{
+struct plain_ctx_st* pctx = ctx;
+
+	if (pctx->cpass[0] != 0 && strcmp(crypt(pass, pctx->cpass), pctx->cpass) == 0)
+		return 0;
+        else {
+		syslog(LOG_AUTH, "error in plain authentication; error in user '%s'", pctx->username);
+		return ERR_AUTH_FAIL;
+        }
+}
+
 static int plain_auth_msg(void* ctx, char* msg, size_t msg_size)
 {
 	snprintf(msg, msg_size, "%s", "Please enter your password");