X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=src%2Fmodules%2Fm_spanningtree%2Fhmac.cpp;h=e1d46d0d974da1ce9d33f6d5999f98d88b1fc219;hb=8cebe2878f3878afce6f643d93668155cb26801d;hp=4ad6658b8f5d38fee1491f8b35af56fa3336cfc5;hpb=43a376fd68197db472472db78afd7bb5545fde38;p=user%2Fhenk%2Fcode%2Finspircd.git

diff --git a/src/modules/m_spanningtree/hmac.cpp b/src/modules/m_spanningtree/hmac.cpp
index 4ad6658b8..e1d46d0d9 100644
--- a/src/modules/m_spanningtree/hmac.cpp
+++ b/src/modules/m_spanningtree/hmac.cpp
@@ -2,8 +2,8 @@
  *       | Inspire Internet Relay Chat Daemon |
  *       +------------------------------------+
  *
- *  InspIRCd: (C) 2002-2008 InspIRCd Development Team
- * See: http://www.inspircd.org/wiki/index.php/Credits
+ *  InspIRCd: (C) 2002-2009 InspIRCd Development Team
+ * See: http://wiki.inspircd.org/Credits
  *
  * This program is free but copyrighted software; see
  *            the file COPYING for details.
@@ -15,21 +15,20 @@
 #include "commands/cmd_whois.h"
 #include "commands/cmd_stats.h"
 #include "socket.h"
-#include "wildcard.h"
 #include "xline.h"
-#include "transport.h"
-#include "m_hash.h"
+#include "../transport.h"
+#include "../m_hash.h"
 #include "socketengine.h"
 
-#include "m_spanningtree/main.h"
-#include "m_spanningtree/utils.h"
-#include "m_spanningtree/treeserver.h"
-#include "m_spanningtree/link.h"
-#include "m_spanningtree/treesocket.h"
-#include "m_spanningtree/resolvers.h"
-#include "m_spanningtree/handshaketimer.h"
+#include "main.h"
+#include "utils.h"
+#include "treeserver.h"
+#include "link.h"
+#include "treesocket.h"
+#include "resolvers.h"
+#include "handshaketimer.h"
 
-/* $ModDep: m_spanningtree/timesynctimer.h m_spanningtree/resolvers.h m_spanningtree/main.h m_spanningtree/utils.h m_spanningtree/treeserver.h m_spanningtree/link.h m_spanningtree/treesocket.h m_hash.h */
+/* $ModDep: m_spanningtree/resolvers.h m_spanningtree/main.h m_spanningtree/utils.h m_spanningtree/treeserver.h m_spanningtree/link.h m_spanningtree/treesocket.h m_hash.h */
 
 const std::string& TreeSocket::GetOurChallenge()
 {
@@ -59,7 +58,7 @@ std::string TreeSocket::MakePass(const std::string &password, const std::string
 	 * Note: If m_sha256.so is not loaded, we MUST fall back to plaintext with no
 	 *       HMAC challenge/response.
 	 */
-	Module* sha256 = Instance->Modules->Find("m_sha256.so");
+	Module* sha256 = ServerInstance->Modules->Find("m_sha256.so");
 	if (Utils->ChallengeResponse && sha256 && !challenge.empty())
 	{
 		/* XXX: This is how HMAC is supposed to be done:
@@ -69,7 +68,8 @@ std::string TreeSocket::MakePass(const std::string &password, const std::string
 		 * Note that we are encoding the hex hash, not the binary
 		 * output of the hash which is slightly different to standard.
 		 *
-		 * Don't ask me why its always 0x5c and 0x36... it just is.
+		 * 5c and 36 were chosen as part of the HMAC standard, because they
+		 * flip the bits in a way likely to strengthen the function.
 		 */
 		std::string hmac1, hmac2;
 
@@ -90,7 +90,7 @@ std::string TreeSocket::MakePass(const std::string &password, const std::string
 		return "HMAC-SHA256:"+ hmac;
 	}
 	else if (!challenge.empty() && !sha256)
-		Instance->Logs->Log("m_spanningtree",DEFAULT,"Not authenticating to server using SHA256/HMAC because we don't have m_sha256 loaded!");
+		ServerInstance->Logs->Log("m_spanningtree",DEFAULT,"Not authenticating to server using SHA256/HMAC because we don't have m_sha256 loaded!");
 
 	return password;
 }
@@ -99,21 +99,17 @@ std::string TreeSocket::RandString(unsigned int ilength)
 {
 	char* randombuf = new char[ilength+1];
 	std::string out;
-#ifdef WINDOWS
-	int f = -1;
-#else
+#ifndef WINDOWS
 	int f = open("/dev/urandom", O_RDONLY, 0);
-#endif
 
 	if (f >= 0)
 	{
-#ifndef WINDOWS
-		if (read(f, randombuf, ilength) < 1)
-			Instance->Logs->Log("m_spanningtree", DEFAULT, "There are crack smoking monkeys in your kernel (in other words, nonblocking /dev/urandom blocked.)");
+		if (read(f, randombuf, ilength) < ilength)
+			ServerInstance->Logs->Log("m_spanningtree", DEFAULT, "Entropy source has gone predictable (did not return enough data)");
 		close(f);
-#endif
 	}
 	else
+#endif
 	{
 		for (unsigned int i = 0; i < ilength; i++)
 			randombuf[i] = rand();
@@ -121,28 +117,41 @@ std::string TreeSocket::RandString(unsigned int ilength)
 
 	for (unsigned int i = 0; i < ilength; i++)
 	{
-		char randchar = static_cast<char>((randombuf[i] & 0x7F) | 0x21);
-		out += (randchar == '=' ? '_' : randchar);
+		char randchar = static_cast<char>(0x3F + (randombuf[i] & 0x3F));
+		out += randchar;
 	}
 
 	delete[] randombuf;
 	return out;
 }
 
-bool TreeSocket::ComparePass(const std::string &ours, const std::string &theirs)
+bool TreeSocket::ComparePass(const Link& link, const std::string &theirs)
 {
-	if ((!strncmp(ours.c_str(), "HMAC-SHA256:", 12)) || (!strncmp(theirs.c_str(), "HMAC-SHA256:", 12)))
+	this->auth_fingerprint = !link.Fingerprint.empty();
+	this->auth_challenge = !ourchallenge.empty() && !theirchallenge.empty();
+
+	const char* fp = NULL;
+	if (GetHook())
+		fp = BufferedSocketFingerprintRequest(this, Utils->Creator, GetHook()).Send();
+
+	if (fp)
+		ServerInstance->Logs->Log("m_spanningtree", DEFAULT, std::string("Server SSL fingerprint ") + fp);
+
+	if (auth_fingerprint)
 	{
-		/* One or both of us specified hmac sha256, but we don't have sha256 module loaded!
-		 * We can't allow this password as valid.
-		  */
-		if (!Instance->Modules->Find("m_sha256.so") || !Utils->ChallengeResponse)
+		/* Require fingerprint to exist and match */
+		if (!fp || link.Fingerprint != std::string(fp))
 			return false;
-		else
-			/* Straight string compare of hashes */
-			return ours == theirs;
 	}
-	else
-		/* Straight string compare of plaintext */
-		return ours == theirs;
-}  
+
+	if (auth_challenge)
+	{
+		std::string our_hmac = MakePass(link.RecvPass, ourchallenge);
+
+		/* Straight string compare of hashes */
+		return our_hmac == theirs;
+	}
+
+	/* Straight string compare of plaintext */
+	return link.RecvPass == theirs;
+}