Skip to content

fix md5 authentication, remove guava deps #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix md5 authentication, remove guava deps #90

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/main/java/au/com/southsky/jfreesane/SanePasswordEncoder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ static String derivePassword(String salt, String password) {
try {
MessageDigest md = MessageDigest.getInstance("MD5");
md.update(StandardCharsets.ISO_8859_1.encode(salt));
md.update(StandardCharsets.ISO_8859_1.encode(CharBuffer.wrap(password)));
md.update(password.getBytes(StandardCharsets.ISO_8859_1));
return encodeAsHex(md.digest());
} catch (NoSuchAlgorithmException ex) {
// This is not expected, so convert to RuntimeException
Expand Down
28 changes: 10 additions & 18 deletions src/main/java/au/com/southsky/jfreesane/SaneSession.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ public final class SaneSession implements Closeable {

private static final int READ_BUFFER_SIZE = 1 << 20; // 1mb
private static final int DEFAULT_PORT = 6566;
private static final String MD5_PREFIX = "$MD5$";

private final Socket socket;
private final SaneOutputStream outputStream;
Expand Down Expand Up @@ -408,8 +409,7 @@ boolean authorize(String resource) throws IOException {
outputStream.write(SaneRpcCode.SANE_NET_AUTHORIZE);
outputStream.write(resource);
outputStream.write(passwordProvider.getUsername(resource));
// TODO(sjamesr): resource is not currently used, see writePassword.
writePassword(/* resource, */ passwordProvider.getPassword(resource));
writePassword(resource, passwordProvider.getPassword(resource));
outputStream.flush();

// Read dummy reply and discard (according to the spec, it is unused).
Expand All @@ -423,25 +423,17 @@ boolean authorize(String resource) throws IOException {
/**
* Write password to outputstream depending on resource provided by saned.
*/
private void writePassword(/* String resource ,*/ String password) throws IOException {
outputStream.write(password);

// The code below always prints passwords in the clear, because Splitter.on takes
// a separator string, not a regular expression. We can't fix it now due to a bug
// in old versions of saned, which Linux distributions like Ubuntu still ship.
// TODO(sjamesr): revive this code when Ubuntu gets a new sane-backends release,
// see https://bugs.launchpad.net/ubuntu/+source/sane-backends/+bug/1858051.
// TODO(sjamesr): when reviving, remove Guava dependency.
/*
List<String> resourceParts = Splitter.on("\\$MD5\\$").splitToList(resource);
if (resourceParts.size() == 1) {
private void writePassword(String resource, String password) throws IOException {
int markerIdx = resource.indexOf(MD5_PREFIX);
if (markerIdx > -1) {
outputStream.write(
MD5_PREFIX
+ SanePasswordEncoder.derivePassword(
resource.substring(markerIdx + MD5_PREFIX.length()), password));
} else {
// Write in clean
outputStream.write(password);
} else {
outputStream.write(
"$MD5$" + SanePasswordEncoder.derivePassword(resourceParts.get(1), password));
}
*/
}

SaneOutputStream getOutputStream() {
Expand Down