1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
|
/* +------------------------------------+
* | Inspire Internet Relay Chat Daemon |
* +------------------------------------+
*
* InspIRCd: (C) 2002-2010 InspIRCd Development Team
* See: http://wiki.inspircd.org/Credits
*
* This program is free but copyrighted software; see
* the file COPYING for details.
*
* ---------------------------------------------------
*/
#include "inspircd.h"
#include "socket.h"
#include "xline.h"
#include "../m_hash.h"
#include "../ssl.h"
#include "socketengine.h"
#include "main.h"
#include "utils.h"
#include "treeserver.h"
#include "link.h"
#include "treesocket.h"
#include "resolvers.h"
const std::string& TreeSocket::GetOurChallenge()
{
return capab->ourchallenge;
}
void TreeSocket::SetOurChallenge(const std::string &c)
{
capab->ourchallenge = c;
}
const std::string& TreeSocket::GetTheirChallenge()
{
return capab->theirchallenge;
}
void TreeSocket::SetTheirChallenge(const std::string &c)
{
capab->theirchallenge = c;
}
std::string TreeSocket::MakePass(const std::string &password, const std::string &challenge)
{
/* This is a simple (maybe a bit hacky?) HMAC algorithm, thanks to jilles for
* suggesting the use of HMAC to secure the password against various attacks.
*
* Note: If m_sha256.so is not loaded, we MUST fall back to plaintext with no
* HMAC challenge/response.
*/
HashProvider* sha256 = ServerInstance->Modules->FindDataService<HashProvider>("hash/sha256");
if (Utils->ChallengeResponse && sha256 && !challenge.empty())
{
/* This is how HMAC is supposed to be done:
*
* sha256( (pass xor 0x5c) + sha256((pass xor 0x36) + m) )
*
* 5c and 36 were chosen as part of the HMAC standard, because they
* flip the bits in a way likely to strengthen the function.
*/
std::string hmac1, hmac2;
for (size_t n = 0; n < password.length(); n++)
{
hmac1.push_back(static_cast<char>(password[n] ^ 0x5C));
hmac2.push_back(static_cast<char>(password[n] ^ 0x36));
}
if (proto_version >= 1202)
{
hmac2.append(challenge);
std::string hmac = sha256->hexsum(hmac1 + sha256->sum(hmac2));
return "AUTH:" + hmac;
}
else
{
// version 1.2 used a weaker HMAC, using hex output in the intermediate step
hmac2.append(challenge);
hmac2 = sha256->hexsum(hmac2);
std::string hmac = hmac1 + hmac2;
hmac = sha256->hexsum(hmac);
return "HMAC-SHA256:"+ hmac;
}
}
else if (!challenge.empty() && !sha256)
ServerInstance->Logs->Log("m_spanningtree",DEFAULT,"Not authenticating to server using SHA256/HMAC because we don't have m_sha256 loaded!");
return password;
}
bool TreeSocket::ComparePass(const Link& link, const std::string &theirs)
{
capab->auth_fingerprint = !link.Fingerprint.empty();
capab->auth_challenge = !capab->ourchallenge.empty() && !capab->theirchallenge.empty();
std::string fp;
if (GetIOHook())
{
SocketCertificateRequest req(this, Utils->Creator);
if (req.cert)
{
fp = req.cert->GetFingerprint();
}
}
if (capab->auth_challenge)
{
std::string our_hmac = MakePass(link.RecvPass, capab->ourchallenge);
/* Straight string compare of hashes */
if (our_hmac != theirs)
return false;
}
else
{
/* Straight string compare of plaintext */
if (link.RecvPass != theirs)
return false;
}
if (capab->auth_fingerprint)
{
/* Require fingerprint to exist and match */
if (link.Fingerprint != fp)
{
ServerInstance->SNO->WriteToSnoMask('l',"Invalid SSL fingerprint on link %s: need \"%s\" got \"%s\"",
link.Name.c_str(), link.Fingerprint.c_str(), fp.c_str());
SendError("Provided invalid SSL fingerprint " + fp + " - expected " + link.Fingerprint);
return false;
}
}
else if (!fp.empty())
{
ServerInstance->SNO->WriteToSnoMask('l', "SSL fingerprint for link %s is \"%s\". "
"You can improve security by specifying this in <link:fingerprint>.", link.Name.c_str(), fp.c_str());
}
return true;
}
|
