src/modules/m_spanningtree/hmac.cpp

   1 /*       +------------------------------------+
   2  *       | Inspire Internet Relay Chat Daemon |
   3  *       +------------------------------------+
   4  *
   5  *  InspIRCd: (C) 2002-2008 InspIRCd Development Team
   6  * See: http://www.inspircd.org/wiki/index.php/Credits
   7  *
   8  * This program is free but copyrighted software; see
   9  *            the file COPYING for details.
  10  *
  11  * ---------------------------------------------------
  12  */
  13
  14 #include "inspircd.h"
  15 #include "commands/cmd_whois.h"
  16 #include "commands/cmd_stats.h"
  17 #include "socket.h"
  18 #include "xline.h"
  19 #include "transport.h"
  20 #include "m_hash.h"
  21 #include "socketengine.h"
  22
  23 #include "m_spanningtree/main.h"
  24 #include "m_spanningtree/utils.h"
  25 #include "m_spanningtree/treeserver.h"
  26 #include "m_spanningtree/link.h"
  27 #include "m_spanningtree/treesocket.h"
  28 #include "m_spanningtree/resolvers.h"
  29 #include "m_spanningtree/handshaketimer.h"
  30
  31 /* $ModDep: m_spanningtree/resolvers.h m_spanningtree/main.h m_spanningtree/utils.h m_spanningtree/treeserver.h m_spanningtree/link.h m_spanningtree/treesocket.h m_hash.h */
  32
  33 const std::string& TreeSocket::GetOurChallenge()
  34 {
  35         return this->ourchallenge;
  36 }
  37
  38 void TreeSocket::SetOurChallenge(const std::string &c)
  39 {
  40         this->ourchallenge = c;
  41 }
  42
  43 const std::string& TreeSocket::GetTheirChallenge()
  44 {
  45         return this->theirchallenge;
  46 }
  47
  48 void TreeSocket::SetTheirChallenge(const std::string &c)
  49 {
  50         this->theirchallenge = c;
  51 }
  52
  53 std::string TreeSocket::MakePass(const std::string &password, const std::string &challenge)
  54 {
  55         /* This is a simple (maybe a bit hacky?) HMAC algorithm, thanks to jilles for
  56          * suggesting the use of HMAC to secure the password against various attacks.
  57          *
  58          * Note: If m_sha256.so is not loaded, we MUST fall back to plaintext with no
  59          *       HMAC challenge/response.
  60          */
  61         Module* sha256 = Instance->Modules->Find("m_sha256.so");
  62         if (Utils->ChallengeResponse && sha256 && !challenge.empty())
  63         {
  64                 /* XXX: This is how HMAC is supposed to be done:
  65                  *
  66                  * sha256( (pass xor 0x5c) + sha256((pass xor 0x36) + m) )
  67                  *
  68                  * Note that we are encoding the hex hash, not the binary
  69                  * output of the hash which is slightly different to standard.
  70                  *
  71                  * Don't ask me why its always 0x5c and 0x36... it just is.
  72                  */
  73                 std::string hmac1, hmac2;
  74
  75                 for (size_t n = 0; n < password.length(); n++)
  76                 {
  77                         hmac1 += static_cast<char>(password[n] ^ 0x5C);
  78                         hmac2 += static_cast<char>(password[n] ^ 0x36);
  79                 }
  80
  81                 hmac2 += challenge;
  82                 HashResetRequest(Utils->Creator, sha256).Send();
  83                 hmac2 = HashSumRequest(Utils->Creator, sha256, hmac2).Send();
  84
  85                 HashResetRequest(Utils->Creator, sha256).Send();
  86                 std::string hmac = hmac1 + hmac2;
  87                 hmac = HashSumRequest(Utils->Creator, sha256, hmac).Send();
  88
  89                 return "HMAC-SHA256:"+ hmac;
  90         }
  91         else if (!challenge.empty() && !sha256)
  92                 Instance->Logs->Log("m_spanningtree",DEFAULT,"Not authenticating to server using SHA256/HMAC because we don't have m_sha256 loaded!");
  93
  94         return password;
  95 }
  96
  97 std::string TreeSocket::RandString(unsigned int ilength)
  98 {
  99         char* randombuf = new char[ilength+1];
 100         std::string out;
 101 #ifdef WINDOWS
 102         int f = -1;
 103 #else
 104         int f = open("/dev/urandom", O_RDONLY, 0);
 105 #endif
 106
 107         if (f >= 0)
 108         {
 109 #ifndef WINDOWS
 110                 if (read(f, randombuf, ilength) < 1)
 111                         Instance->Logs->Log("m_spanningtree", DEFAULT, "There are crack smoking monkeys in your kernel (in other words, nonblocking /dev/urandom blocked.)");
 112                 close(f);
 113 #endif
 114         }
 115         else
 116         {
 117                 for (unsigned int i = 0; i < ilength; i++)
 118                         randombuf[i] = rand();
 119         }
 120
 121         for (unsigned int i = 0; i < ilength; i++)
 122         {
 123                 char randchar = static_cast<char>((randombuf[i] & 0x7F) | 0x21);
 124                 out += (randchar == '=' ? '_' : randchar);
 125         }
 126
 127         delete[] randombuf;
 128         return out;
 129 }
 130
 131 bool TreeSocket::ComparePass(const std::string &ours, const std::string &theirs)
 132 {
 133         if ((!strncmp(ours.c_str(), "HMAC-SHA256:", 12)) || (!strncmp(theirs.c_str(), "HMAC-SHA256:", 12)))
 134         {
 135                 /* One or both of us specified hmac sha256, but we don't have sha256 module loaded!
 136                  * We can't allow this password as valid.
 137                   */
 138                 if (!Instance->Modules->Find("m_sha256.so") || !Utils->ChallengeResponse)
 139                         return false;
 140                 else
 141                         /* Straight string compare of hashes */
 142                         return ours == theirs;
 143         }
 144         else
 145                 /* Straight string compare of plaintext */
 146                 return ours == theirs;
 147 }