*/
#include "inspircd.h"
-#include "commands/cmd_whois.h"
-#include "commands/cmd_stats.h"
#include "socket.h"
#include "xline.h"
-#include "../transport.h"
#include "../m_hash.h"
+#include "../ssl.h"
#include "socketengine.h"
#include "main.h"
#include "link.h"
#include "treesocket.h"
#include "resolvers.h"
-#include "handshaketimer.h"
/* $ModDep: m_spanningtree/resolvers.h m_spanningtree/main.h m_spanningtree/utils.h m_spanningtree/treeserver.h m_spanningtree/link.h m_spanningtree/treesocket.h m_hash.h */
}
hmac2 += challenge;
- HashResetRequest(Utils->Creator, sha256).Send();
- hmac2 = HashSumRequest(Utils->Creator, sha256, hmac2).Send();
-
- HashResetRequest(Utils->Creator, sha256).Send();
+ hmac2 = HashRequest(Utils->Creator, sha256, hmac2).hex();
+
std::string hmac = hmac1 + hmac2;
- hmac = HashSumRequest(Utils->Creator, sha256, hmac).Send();
+ hmac = HashRequest(Utils->Creator, sha256, hmac).hex();
return "HMAC-SHA256:"+ hmac;
}
if (f >= 0)
{
- if (read(f, randombuf, ilength) < ilength)
+ if (read(f, randombuf, ilength) < (int)ilength)
ServerInstance->Logs->Log("m_spanningtree", DEFAULT, "Entropy source has gone predictable (did not return enough data)");
close(f);
}
this->auth_fingerprint = !link.Fingerprint.empty();
this->auth_challenge = !ourchallenge.empty() && !theirchallenge.empty();
- const char* fp = NULL;
- if (GetHook())
- fp = BufferedSocketFingerprintRequest(this, Utils->Creator, GetHook()).Send();
-
- if (fp)
- ServerInstance->Logs->Log("m_spanningtree", DEFAULT, std::string("Server SSL fingerprint ") + fp);
-
- if (auth_fingerprint)
+ std::string fp;
+ if (GetIOHook())
{
- /* Require fingerprint to exist and match */
- if (!fp || link.Fingerprint != std::string(fp))
- return false;
+ SSLCertificateRequest req(this, Utils->Creator);
+ if (req.cert)
+ {
+ fp = req.cert->GetFingerprint();
+ }
}
if (auth_challenge)
std::string our_hmac = MakePass(link.RecvPass, ourchallenge);
/* Straight string compare of hashes */
- return our_hmac == theirs;
+ if (our_hmac != theirs)
+ return false;
+ }
+ else
+ {
+ /* Straight string compare of plaintext */
+ if (link.RecvPass != theirs)
+ return false;
}
- /* Straight string compare of plaintext */
- return link.RecvPass == theirs;
+ if (auth_fingerprint)
+ {
+ /* Require fingerprint to exist and match */
+ if (link.Fingerprint != fp)
+ {
+ ServerInstance->SNO->WriteToSnoMask('l',"Invalid SSL fingerprint on link %s: need '%s' got '%s'",
+ link.Name.c_str(), link.Fingerprint.c_str(), fp.c_str());
+ SendError("Provided invalid SSL fingerprint " + fp + " - expected " + link.Fingerprint);
+ return false;
+ }
+ }
+ else if (!fp.empty())
+ {
+ ServerInstance->SNO->WriteToSnoMask('l', "SSL fingerprint for link %s is %s", link.Name.c_str(), fp.c_str());
+ }
+ return true;
}