Ota hashed password (esp8266#2292)

me-no-dev · igrr · commit e83f30a78d3c · 2016-07-18T19:28:56.000+08:00
* Add option to give ArduinoOTA a hashed value of the password

hashed password can be safely stored on flash

* Switch to separate method to accept the hash

* Calculate the hash of plain passwords at setup

* missed line

* Remove underscores from local variable
diff --git a/libraries/ArduinoOTA/ArduinoOTA.cpp b/libraries/ArduinoOTA/ArduinoOTA.cpp
@@ -82,6 +82,16 @@ String ArduinoOTAClass::getHostname() {
 }
 
 void ArduinoOTAClass::setPassword(const char * password) {
+  if (!_initialized && !_password.length() && password) {
+    MD5Builder passmd5;
+    passmd5.begin();
+    passmd5.add(password);
+    passmd5.calculate();
+    _password = passmd5.toString();
+  }
+}
+
+void ArduinoOTAClass::setPasswordHash(const char * password) {
   if (!_initialized && !_password.length() && password) {
     _password = password;
   }
@@ -206,13 +216,7 @@ void ArduinoOTAClass::_onRx(){
       return;
     }
 
-    MD5Builder _passmd5;
-    _passmd5.begin();
-    _passmd5.add(_password);
-    _passmd5.calculate();
-    String passmd5 = _passmd5.toString();
-
-    String challenge = passmd5 + ":" + String(_nonce) + ":" + cnonce;
+    String challenge = _password + ":" + String(_nonce) + ":" + cnonce;
     MD5Builder _challengemd5;
     _challengemd5.begin();
     _challengemd5.add(challenge);
diff --git a/libraries/ArduinoOTA/ArduinoOTA.h b/libraries/ArduinoOTA/ArduinoOTA.h
@@ -34,6 +34,7 @@ class ArduinoOTAClass
     void setHostname(const char *hostname);
     String getHostname();
     void setPassword(const char *password);
+    void setPasswordHash(const char *password);
     void onStart(THandlerFunction fn);
     void onEnd(THandlerFunction fn);
     void onError(THandlerFunction_Error fn);
diff --git a/libraries/ArduinoOTA/examples/BasicOTA/BasicOTA.ino b/libraries/ArduinoOTA/examples/BasicOTA/BasicOTA.ino
@@ -24,7 +24,11 @@ void setup() {
   // ArduinoOTA.setHostname("myesp8266");
 
   // No authentication by default
-  // ArduinoOTA.setPassword((const char *)"123");
+  // ArduinoOTA.setPassword("admin");
+
+  // Password can be set with it's md5 value as well
+  // MD5(admin) = 21232f297a57a5a743894a0e4a801fc3
+  // ArduinoOTA.setPasswordHash("21232f297a57a5a743894a0e4a801fc3");
 
   ArduinoOTA.onStart([]() {
     String type;
