Remove VF_COMMON from mode-provider modules (no longer needed due to better CAPAB...

[user/henk/code/inspircd.git] / src / modules / m_spanningtree / hmac.cpp

diff --git a/src/modules/m_spanningtree/hmac.cpp b/src/modules/m_spanningtree/hmac.cpp
index ad35a585f4a1294ffd008a165f7032a18f155301..172883f3f01c1d8a155b90c1adca89b201206310 100644 (file)
--- a/src/modules/m_spanningtree/hmac.cpp
+++ b/src/modules/m_spanningtree/hmac.cpp
@@ -2,7 +2,7 @@
  *       | Inspire Internet Relay Chat Daemon |
  *       +------------------------------------+
  *
- *  InspIRCd: (C) 2002-2009 InspIRCd Development Team
+ *  InspIRCd: (C) 2002-2010 InspIRCd Development Team
  * See: http://wiki.inspircd.org/Credits
  *
  * This program is free but copyrighted software; see
@@ -29,22 +29,22 @@
 
 const std::string& TreeSocket::GetOurChallenge()
 {
-       return this->ourchallenge;
+       return capab->ourchallenge;
 }
 
 void TreeSocket::SetOurChallenge(const std::string &c)
 {
-       this->ourchallenge = c;
+       capab->ourchallenge = c;
 }
 
 const std::string& TreeSocket::GetTheirChallenge()
 {
-       return this->theirchallenge;
+       return capab->theirchallenge;
 }
 
 void TreeSocket::SetTheirChallenge(const std::string &c)
 {
-       this->theirchallenge = c;
+       capab->theirchallenge = c;
 }
 
 std::string TreeSocket::MakePass(const std::string &password, const std::string &challenge)
@@ -55,16 +55,13 @@ std::string TreeSocket::MakePass(const std::string &password, const std::string
         * Note: If m_sha256.so is not loaded, we MUST fall back to plaintext with no
         *       HMAC challenge/response.
         */
-       Module* sha256 = ServerInstance->Modules->Find("m_sha256.so");
+       HashProvider* sha256 = ServerInstance->Modules->FindDataService<HashProvider>("hash/sha256");
        if (Utils->ChallengeResponse && sha256 && !challenge.empty())
        {
-               /* XXX: This is how HMAC is supposed to be done:
+               /* This is how HMAC is supposed to be done:
                 *
                 * sha256( (pass xor 0x5c) + sha256((pass xor 0x36) + m) )
                 *
-                * Note that we are encoding the hex hash, not the binary
-                * output of the hash which is slightly different to standard.
-                *
                 * 5c and 36 were chosen as part of the HMAC standard, because they
                 * flip the bits in a way likely to strengthen the function.
                 */
@@ -72,17 +69,28 @@ std::string TreeSocket::MakePass(const std::string &password, const std::string
 
                for (size_t n = 0; n < password.length(); n++)
                {
-                       hmac1 += static_cast<char>(password[n] ^ 0x5C);
-                       hmac2 += static_cast<char>(password[n] ^ 0x36);
+                       hmac1.push_back(static_cast<char>(password[n] ^ 0x5C));
+                       hmac2.push_back(static_cast<char>(password[n] ^ 0x36));
                }
 
-               hmac2 += challenge;
-               hmac2 = HashRequest(Utils->Creator, sha256, hmac2).result;
+               if (proto_version >= 1202)
+               {
+                       hmac2.append(challenge);
+                       std::string hmac = sha256->hexsum(hmac1 + sha256->sum(hmac2));
+
+                       return "AUTH:" + hmac;
+               }
+               else
+               {
+                       // version 1.2 used a weaker HMAC, using hex output in the intermediate step
+                       hmac2.append(challenge);
+                       hmac2 = sha256->hexsum(hmac2);
                
-               std::string hmac = hmac1 + hmac2;
-               hmac = HashRequest(Utils->Creator, sha256, hmac).result;
+                       std::string hmac = hmac1 + hmac2;
+                       hmac = sha256->hexsum(hmac);
 
-               return "HMAC-SHA256:"+ hmac;
+                       return "HMAC-SHA256:"+ hmac;
+               }
        }
        else if (!challenge.empty() && !sha256)
                ServerInstance->Logs->Log("m_spanningtree",DEFAULT,"Not authenticating to server using SHA256/HMAC because we don't have m_sha256 loaded!");
@@ -122,39 +130,48 @@ std::string TreeSocket::RandString(unsigned int ilength)
 
 bool TreeSocket::ComparePass(const Link& link, const std::string &theirs)
 {
-       this->auth_fingerprint = !link.Fingerprint.empty();
-       this->auth_challenge = !ourchallenge.empty() && !theirchallenge.empty();
+       capab->auth_fingerprint = !link.Fingerprint.empty();
+       capab->auth_challenge = !capab->ourchallenge.empty() && !capab->theirchallenge.empty();
 
        std::string fp;
        if (GetIOHook())
        {
-               SSLCertificateRequest req(this, Utils->Creator);
+               SocketCertificateRequest req(this, Utils->Creator, GetIOHook());
                if (req.cert)
                {
                        fp = req.cert->GetFingerprint();
-                       ServerInstance->Logs->Log("m_spanningtree", DEFAULT, std::string("Server SSL fingerprint ") + fp);
                }
        }
 
-       if (auth_fingerprint)
+       if (capab->auth_challenge)
+       {
+               std::string our_hmac = MakePass(link.RecvPass, capab->ourchallenge);
+
+               /* Straight string compare of hashes */
+               if (our_hmac != theirs)
+                       return false;
+       }
+       else
+       {
+               /* Straight string compare of plaintext */
+               if (link.RecvPass != theirs)
+                       return false;
+       }
+
+       if (capab->auth_fingerprint)
        {
                /* Require fingerprint to exist and match */
                if (link.Fingerprint != fp)
                {
                        ServerInstance->SNO->WriteToSnoMask('l',"Invalid SSL fingerprint on link %s: need '%s' got '%s'", 
                                link.Name.c_str(), link.Fingerprint.c_str(), fp.c_str());
+                       SendError("Provided invalid SSL fingerprint " + fp + " - expected " + link.Fingerprint);
                        return false;
                }
        }
-
-       if (auth_challenge)
+       else if (!fp.empty())
        {
-               std::string our_hmac = MakePass(link.RecvPass, ourchallenge);
-
-               /* Straight string compare of hashes */
-               return our_hmac == theirs;
+               ServerInstance->SNO->WriteToSnoMask('l', "SSL fingerprint for link %s is %s", link.Name.c_str(), fp.c_str());
        }
-
-       /* Straight string compare of plaintext */
-       return link.RecvPass == theirs;
+       return true;
 }