From f30b1a519771ac49e2b03640e742fdb0a246bd81 Mon Sep 17 00:00:00 2001 From: salmonik Date: Thu, 29 Oct 2026 22:22:27 +0100 Subject: v2.4.0: key stored credentials by certificate fingerprint --- src/bin/client/connection.rs | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) (limited to 'src/bin/client/connection.rs') diff --git a/src/bin/client/connection.rs b/src/bin/client/connection.rs index 44cfea9..ec5642c 100644 --- a/src/bin/client/connection.rs +++ b/src/bin/client/connection.rs @@ -56,10 +56,10 @@ pub fn connect( // TOFU: persist the fingerprint on first contact. if !unsafe_mode { - if let Some(fp) = observed { + if let Some(fp) = observed.as_deref() { if database::get_fingerprint(conn, addr).is_none() { - database::save_fingerprint(conn, addr, &fp)?; - for line in first_contact_lines(addr, &fp) { + database::save_fingerprint(conn, addr, fp)?; + for line in first_contact_lines(addr, fp) { println!("{}", line); } } @@ -80,21 +80,25 @@ pub fn connect( elapsed.as_secs_f64() * 1000.0 ); - if let Some((username, password)) = database::get_credentials(conn, addr) { - let auth_msg = format!("AUTH {} {}", username, password); - tls.write_line(&auth_msg)?; - let mut auth_response = String::new(); - tls.read_line(&mut auth_response)?; - if auth_response.trim().starts_with("OK") { - println!("Authenticated as {}", username); - Ok((tls, Some(username))) - } else { + // Credentials are stored per server identity, so any address presenting + // this certificate key can log in with the same stored account. + let identity = observed + .clone() + .or_else(|| database::get_fingerprint(conn, addr)); + if let Some(identity) = identity { + if let Some((username, password)) = database::get_credentials(conn, &identity) { + let auth_msg = format!("AUTH {} {}", username, password); + tls.write_line(&auth_msg)?; + let mut auth_response = String::new(); + tls.read_line(&mut auth_response)?; + if auth_response.trim().starts_with("OK") { + println!("Authenticated as {}", username); + return Ok((tls, Some(username))); + } println!("Authentication failed: {}", auth_response.trim()); - Ok((tls, None)) } - } else { - Ok((tls, None)) } + Ok((tls, None)) } /// Wrapper so TLS handshake failures surface as errors with their message -- cgit v1.2.3