Fix error message on OPTCOMMON mismatch

[user/henk/code/inspircd.git] / src / modules / m_spanningtree / hmac.cpp

diff --git a/src/modules/m_spanningtree/hmac.cpp b/src/modules/m_spanningtree/hmac.cpp
index b5a5fa2284ef133a1af6b6dc891bf947a546a13d..c08ac15226969799eced1b63f81070455de00296 100644 (file)
--- a/src/modules/m_spanningtree/hmac.cpp
+++ b/src/modules/m_spanningtree/hmac.cpp
@@ -2,7 +2,7 @@
  *       | Inspire Internet Relay Chat Daemon |
  *       +------------------------------------+
  *
- *  InspIRCd: (C) 2002-2009 InspIRCd Development Team
+ *  InspIRCd: (C) 2002-2010 InspIRCd Development Team
  * See: http://wiki.inspircd.org/Credits
  *
  * This program is free but copyrighted software; see
@@ -25,26 +25,24 @@
 #include "treesocket.h"
 #include "resolvers.h"
 
-/* $ModDep: m_spanningtree/resolvers.h m_spanningtree/main.h m_spanningtree/utils.h m_spanningtree/treeserver.h m_spanningtree/link.h m_spanningtree/treesocket.h m_hash.h */
-
 const std::string& TreeSocket::GetOurChallenge()
 {
-       return this->ourchallenge;
+       return capab->ourchallenge;
 }
 
 void TreeSocket::SetOurChallenge(const std::string &c)
 {
-       this->ourchallenge = c;
+       capab->ourchallenge = c;
 }
 
 const std::string& TreeSocket::GetTheirChallenge()
 {
-       return this->theirchallenge;
+       return capab->theirchallenge;
 }
 
 void TreeSocket::SetTheirChallenge(const std::string &c)
 {
-       this->theirchallenge = c;
+       capab->theirchallenge = c;
 }
 
 std::string TreeSocket::MakePass(const std::string &password, const std::string &challenge)
@@ -55,16 +53,13 @@ std::string TreeSocket::MakePass(const std::string &password, const std::string
         * Note: If m_sha256.so is not loaded, we MUST fall back to plaintext with no
         *       HMAC challenge/response.
         */
-       Module* sha256 = ServerInstance->Modules->Find("m_sha256.so");
+       HashProvider* sha256 = ServerInstance->Modules->FindDataService<HashProvider>("hash/sha256");
        if (Utils->ChallengeResponse && sha256 && !challenge.empty())
        {
-               /* XXX: This is how HMAC is supposed to be done:
+               /* This is how HMAC is supposed to be done:
                 *
                 * sha256( (pass xor 0x5c) + sha256((pass xor 0x36) + m) )
                 *
-                * Note that we are encoding the hex hash, not the binary
-                * output of the hash which is slightly different to standard.
-                *
                 * 5c and 36 were chosen as part of the HMAC standard, because they
                 * flip the bits in a way likely to strengthen the function.
                 */
@@ -72,17 +67,28 @@ std::string TreeSocket::MakePass(const std::string &password, const std::string
 
                for (size_t n = 0; n < password.length(); n++)
                {
-                       hmac1 += static_cast<char>(password[n] ^ 0x5C);
-                       hmac2 += static_cast<char>(password[n] ^ 0x36);
+                       hmac1.push_back(static_cast<char>(password[n] ^ 0x5C));
+                       hmac2.push_back(static_cast<char>(password[n] ^ 0x36));
                }
 
-               hmac2 += challenge;
-               hmac2 = HashRequest(Utils->Creator, sha256, hmac2).hex();
+               if (proto_version >= 1202)
+               {
+                       hmac2.append(challenge);
+                       std::string hmac = sha256->hexsum(hmac1 + sha256->sum(hmac2));
+
+                       return "AUTH:" + hmac;
+               }
+               else
+               {
+                       // version 1.2 used a weaker HMAC, using hex output in the intermediate step
+                       hmac2.append(challenge);
+                       hmac2 = sha256->hexsum(hmac2);
                
-               std::string hmac = hmac1 + hmac2;
-               hmac = HashRequest(Utils->Creator, sha256, hmac).hex();
+                       std::string hmac = hmac1 + hmac2;
+                       hmac = sha256->hexsum(hmac);
 
-               return "HMAC-SHA256:"+ hmac;
+                       return "HMAC-SHA256:"+ hmac;
+               }
        }
        else if (!challenge.empty() && !sha256)
                ServerInstance->Logs->Log("m_spanningtree",DEFAULT,"Not authenticating to server using SHA256/HMAC because we don't have m_sha256 loaded!");
@@ -122,22 +128,22 @@ std::string TreeSocket::RandString(unsigned int ilength)
 
 bool TreeSocket::ComparePass(const Link& link, const std::string &theirs)
 {
-       this->auth_fingerprint = !link.Fingerprint.empty();
-       this->auth_challenge = !ourchallenge.empty() && !theirchallenge.empty();
+       capab->auth_fingerprint = !link.Fingerprint.empty();
+       capab->auth_challenge = !capab->ourchallenge.empty() && !capab->theirchallenge.empty();
 
        std::string fp;
        if (GetIOHook())
        {
-               SocketCertificateRequest req(this, Utils->Creator, GetIOHook());
+               SocketCertificateRequest req(this, Utils->Creator);
                if (req.cert)
                {
                        fp = req.cert->GetFingerprint();
                }
        }
 
-       if (auth_challenge)
+       if (capab->auth_challenge)
        {
-               std::string our_hmac = MakePass(link.RecvPass, ourchallenge);
+               std::string our_hmac = MakePass(link.RecvPass, capab->ourchallenge);
 
                /* Straight string compare of hashes */
                if (our_hmac != theirs)
@@ -150,12 +156,12 @@ bool TreeSocket::ComparePass(const Link& link, const std::string &theirs)
                        return false;
        }
 
-       if (auth_fingerprint)
+       if (capab->auth_fingerprint)
        {
                /* Require fingerprint to exist and match */
                if (link.Fingerprint != fp)
                {
-                       ServerInstance->SNO->WriteToSnoMask('l',"Invalid SSL fingerprint on link %s: need '%s' got '%s'", 
+                       ServerInstance->SNO->WriteToSnoMask('l',"Invalid SSL fingerprint on link %s: need \"%s\" got \"%s\"",
                                link.Name.c_str(), link.Fingerprint.c_str(), fp.c_str());
                        SendError("Provided invalid SSL fingerprint " + fp + " - expected " + link.Fingerprint);
                        return false;
@@ -163,7 +169,8 @@ bool TreeSocket::ComparePass(const Link& link, const std::string &theirs)
        }
        else if (!fp.empty())
        {
-               ServerInstance->SNO->WriteToSnoMask('l', "SSL fingerprint for link %s is %s", link.Name.c_str(), fp.c_str());
+               ServerInstance->SNO->WriteToSnoMask('l', "SSL fingerprint for link %s is \"%s\". "
+                       "You can improve security by specifying this in <link:fingerprint>.", link.Name.c_str(), fp.c_str());
        }
        return true;
 }