Re: [9front] Password confirmation in auth/wrkey

[Jacob Moody <moody@posixcafe.org>]

On 8/23/23 17:42, Jacob Moody wrote:
> On 8/23/23 17:10, Vadim Kotov wrote:
>> Hey folks,
>>
>> I was wondering if there is a reason there is no password confirmation prompt when writing to nvram using auth/wrkey?
>>
>> Cheers,
>> Vadím 
> 
> 
> I see no real reason other then that no one has bothered.
> Looking at the code it calls in libauthsrv, you could get away with
> just calling readcons() a second time and making sure they match.
> 

Tested this out. I asked around on the grid and the general consensus
was in favor.

diff 483ff27f9d5067fd597dae09161d07a3857293b6 uncommitted
--- a//sys/src/libauthsrv/readnvram.c
+++ b//sys/src/libauthsrv/readnvram.c
@@ -247,6 +247,7 @@
 	if((flag&(NVwrite|NVwritemem)) || (err && (flag&NVwriteonerr))){
 		if (!(flag&NVwritemem)) {
 			char pass[PASSWDLEN];
+			char pass2[PASSWDLEN];
 			Authkey k;

 			if(ask("authid", safe->authid, sizeof safe->authid, 0))
@@ -255,12 +256,20 @@
 				goto Out;
 			if(ask("secstore key", safe->config, sizeof safe->config, 1))
 				goto Out;
+Again:
 			if(ask("password", pass, sizeof pass, 1))
 				goto Out;
+			if(ask("confirm password", pass2, sizeof pass2, 1))
+				goto Out;
+			if(memcmp(pass, pass2, sizeof pass) != 0){
+				fprint(2, "password mismatch\n");
+				goto Again;
+			}
 			if((dodes = readcons("enable legacy p9sk1", "no", 0)) == nil)
 				goto Out;
 			passtokey(&k, pass);
 			memset(pass, 0, sizeof pass);
+			memset(pass2, 0, sizeof pass2);
 			if(dodes[0] == 'y' || dodes[0] == 'Y')
 				memmove(safe->machkey, k.des, DESKEYLEN);
 			else