src/modules/m_spanningtree/hmac.cpp

   1 /*       +------------------------------------+
   2  *       | Inspire Internet Relay Chat Daemon |
   3  *       +------------------------------------+
   4  *
   5  *  InspIRCd: (C) 2002-2008 InspIRCd Development Team
   6  * See: http://www.inspircd.org/wiki/index.php/Credits
   7  *
   8  * This program is free but copyrighted software; see
   9  *            the file COPYING for details.
  10  *
  11  * ---------------------------------------------------
  12  */
  13
  14 #include "inspircd.h"
  15 #include "commands/cmd_whois.h"
  16 #include "commands/cmd_stats.h"
  17 #include "socket.h"
  18 #include "wildcard.h"
  19 #include "xline.h"
  20 #include "transport.h"
  21 #include "m_hash.h"
  22 #include "socketengine.h"
  23
  24 #include "m_spanningtree/main.h"
  25 #include "m_spanningtree/utils.h"
  26 #include "m_spanningtree/treeserver.h"
  27 #include "m_spanningtree/link.h"
  28 #include "m_spanningtree/treesocket.h"
  29 #include "m_spanningtree/resolvers.h"
  30 #include "m_spanningtree/handshaketimer.h"
  31
  32 /* $ModDep: m_spanningtree/timesynctimer.h m_spanningtree/resolvers.h m_spanningtree/main.h m_spanningtree/utils.h m_spanningtree/treeserver.h m_spanningtree/link.h m_spanningtree/treesocket.h m_hash.h */
  33
  34 const std::string& TreeSocket::GetOurChallenge()
  35 {
  36         return this->ourchallenge;
  37 }
  38
  39 void TreeSocket::SetOurChallenge(const std::string &c)
  40 {
  41         this->ourchallenge = c;
  42 }
  43
  44 const std::string& TreeSocket::GetTheirChallenge()
  45 {
  46         return this->theirchallenge;
  47 }
  48
  49 void TreeSocket::SetTheirChallenge(const std::string &c)
  50 {
  51         this->theirchallenge = c;
  52 }
  53
  54 std::string TreeSocket::MakePass(const std::string &password, const std::string &challenge)
  55 {
  56         /* This is a simple (maybe a bit hacky?) HMAC algorithm, thanks to jilles for
  57          * suggesting the use of HMAC to secure the password against various attacks.
  58          *
  59          * Note: If m_sha256.so is not loaded, we MUST fall back to plaintext with no
  60          *       HMAC challenge/response.
  61          */
  62         Module* sha256 = Instance->Modules->Find("m_sha256.so");
  63         if (Utils->ChallengeResponse && sha256 && !challenge.empty())
  64         {
  65                 /* XXX: This is how HMAC is supposed to be done:
  66                  *
  67                  * sha256( (pass xor 0x5c) + sha256((pass xor 0x36) + m) )
  68                  *
  69                  * Note that we are encoding the hex hash, not the binary
  70                  * output of the hash which is slightly different to standard.
  71                  *
  72                  * Don't ask me why its always 0x5c and 0x36... it just is.
  73                  */
  74                 std::string hmac1, hmac2;
  75
  76                 for (size_t n = 0; n < password.length(); n++)
  77                 {
  78                         hmac1 += static_cast<char>(password[n] ^ 0x5C);
  79                         hmac2 += static_cast<char>(password[n] ^ 0x36);
  80                 }
  81
  82                 hmac2 += challenge;
  83                 HashResetRequest(Utils->Creator, sha256).Send();
  84                 hmac2 = HashSumRequest(Utils->Creator, sha256, hmac2).Send();
  85
  86                 HashResetRequest(Utils->Creator, sha256).Send();
  87                 std::string hmac = hmac1 + hmac2;
  88                 hmac = HashSumRequest(Utils->Creator, sha256, hmac).Send();
  89
  90                 return "HMAC-SHA256:"+ hmac;
  91         }
  92         else if (!challenge.empty() && !sha256)
  93                 Instance->Logs->Log("m_spanningtree",DEFAULT,"Not authenticating to server using SHA256/HMAC because we don't have m_sha256 loaded!");
  94
  95         return password;
  96 }
  97
  98 std::string TreeSocket::RandString(unsigned int ilength)
  99 {
 100         char* randombuf = new char[ilength+1];
 101         std::string out;
 102 #ifdef WINDOWS
 103         int f = -1;
 104 #else
 105         int f = open("/dev/urandom", O_RDONLY, 0);
 106 #endif
 107
 108         if (f >= 0)
 109         {
 110 #ifndef WINDOWS
 111                 read(f, randombuf, ilength);
 112                 close(f);
 113 #endif
 114         }
 115         else
 116         {
 117                 for (unsigned int i = 0; i < ilength; i++)
 118                         randombuf[i] = rand();
 119         }
 120
 121         for (unsigned int i = 0; i < ilength; i++)
 122         {
 123                 char randchar = static_cast<char>((randombuf[i] & 0x7F) | 0x21);
 124                 out += (randchar == '=' ? '_' : randchar);
 125         }
 126
 127         delete[] randombuf;
 128         return out;
 129 }
 130
 131 bool TreeSocket::ComparePass(const std::string &ours, const std::string &theirs)
 132 {
 133         if ((!strncmp(ours.c_str(), "HMAC-SHA256:", 12)) || (!strncmp(theirs.c_str(), "HMAC-SHA256:", 12)))
 134         {
 135                 /* One or both of us specified hmac sha256, but we don't have sha256 module loaded!
 136                  * We can't allow this password as valid.
 137                   */
 138                 if (!Instance->Modules->Find("m_sha256.so") || !Utils->ChallengeResponse)
 139                         return false;
 140                 else
 141                         /* Straight string compare of hashes */
 142                         return ours == theirs;
 143         }
 144         else
 145                 /* Straight string compare of plaintext */
 146                 return ours == theirs;
 147 }