/* This is a simple (maybe a bit hacky?) HMAC algorithm, thanks to jilles for
* suggesting the use of HMAC to secure the password against various attacks.
*
- * Note: If m_sha256.so is not loaded, we MUST fall back to plaintext with no
+ * Note: If an sha256 provider is not available, we MUST fall back to plaintext with no
* HMAC challenge/response.
*/
HashProvider* sha256 = ServerInstance->Modules->FindDataService<HashProvider>("hash/sha256");
- if (Utils->ChallengeResponse && sha256 && !challenge.empty())
+ if (sha256 && !challenge.empty())
return "AUTH:" + BinToBase64(sha256->hmac(password, challenge));
if (!challenge.empty() && !sha256)
- ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Not authenticating to server using SHA256/HMAC because we don't have m_sha256 loaded!");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Not authenticating to server using SHA256/HMAC because we don't have an SHA256 provider (e.g. m_sha256) loaded!");
return password;
}
capab->auth_fingerprint = !link.Fingerprint.empty();
capab->auth_challenge = !capab->ourchallenge.empty() && !capab->theirchallenge.empty();
- if (capab->auth_challenge)
- {
- std::string our_hmac = MakePass(link.RecvPass, capab->ourchallenge);
-
- /* Straight string compare of hashes */
- if (our_hmac != theirs)
- return false;
- }
- else
- {
- /* Straight string compare of plaintext */
- if (link.RecvPass != theirs)
- return false;
- }
-
std::string fp = SSLClientCert::GetFingerprint(this);
if (capab->auth_fingerprint)
{
ServerInstance->SNO->WriteToSnoMask('l', "SSL fingerprint for link %s is \"%s\". "
"You can improve security by specifying this in <link:fingerprint>.", link.Name.c_str(), fp.c_str());
}
+
+ if (capab->auth_challenge)
+ {
+ std::string our_hmac = MakePass(link.RecvPass, capab->ourchallenge);
+
+ /* Straight string compare of hashes */
+ if (our_hmac != theirs)
+ return false;
+ }
+ else
+ {
+ /* Straight string compare of plaintext */
+ if (link.RecvPass != theirs)
+ return false;
+ }
return true;
}