summaryrefslogtreecommitdiff
path: root/distfoldd
diff options
context:
space:
mode:
authorJavier S. Pedro <maemo@javispedro.com>2012-09-30 23:56:06 +0200
committerJavier S. Pedro <maemo@javispedro.com>2012-09-30 23:56:06 +0200
commitc0183326a6447f931d4ec971963633a687e12c5e (patch)
tree93d69414784fc9f60dd9805c7480d345c05b853e /distfoldd
parenteafd6be17a1bf1e6518180ffbc401cc0eacc332f (diff)
downloaddistfold-c0183326a6447f931d4ec971963633a687e12c5e.tar.gz
distfold-c0183326a6447f931d4ec971963633a687e12c5e.zip
prevent trivial mitm attack
Diffstat (limited to 'distfoldd')
-rw-r--r--distfoldd/agent.cc7
-rw-r--r--distfoldd/agent.h2
-rw-r--r--distfoldd/clientagent.cc4
-rw-r--r--distfoldd/serveragent.cc4
4 files changed, 12 insertions, 5 deletions
diff --git a/distfoldd/agent.cc b/distfoldd/agent.cc
index 8baa85b..1087889 100644
--- a/distfoldd/agent.cc
+++ b/distfoldd/agent.cc
@@ -175,9 +175,12 @@ QByteArray Agent::generateChallenge()
return QCA::Random::randomArray(challenge_size).toByteArray();
}
-QByteArray Agent::generateChallengeResponse(const QByteArray& server_challenge, const QByteArray& client_challenge)
+QByteArray Agent::generateChallengeResponse(const QByteArray& server_challenge, const QByteArray& client_challenge, const QSslCertificate& server_cert, const QSslCertificate& client_cert)
{
- return hmacSha1(_passwd.toUtf8(), server_challenge + client_challenge);
+ QByteArray server_digest = server_cert.digest(QCryptographicHash::Sha1);
+ QByteArray client_digest = client_cert.digest(QCryptographicHash::Sha1);
+ return hmacSha1(_passwd.toUtf8(), server_challenge + server_digest +
+ client_challenge + client_digest);
}
QByteArray Agent::encodeAuthReply(AuthResult result)
diff --git a/distfoldd/agent.h b/distfoldd/agent.h
index 0d25077..727eb55 100644
--- a/distfoldd/agent.h
+++ b/distfoldd/agent.h
@@ -187,7 +187,7 @@ protected:
static QByteArray hmacSha1(const QByteArray& key, const QByteArray& message);
QByteArray generateChallenge();
- QByteArray generateChallengeResponse(const QByteArray& server_challenge, const QByteArray& client_challenge);
+ QByteArray generateChallengeResponse(const QByteArray& server_challenge, const QByteArray& client_challenge, const QSslCertificate& server_cert, const QSslCertificate& client_cert);
QByteArray encodeAuthReply(AuthResult result);
AuthResult decodeAuthReply(const QByteArray& ba);
diff --git a/distfoldd/clientagent.cc b/distfoldd/clientagent.cc
index 8eb6c44..7d108cb 100644
--- a/distfoldd/clientagent.cc
+++ b/distfoldd/clientagent.cc
@@ -22,7 +22,9 @@ void ClientAgent::handleMessage(MessageType msg, const QByteArray &data)
qDebug() << "Hello reply";
Q_ASSERT(_socket->isEncrypted());
_state = STATE_AUTH;
- sendMessage(MSG_AUTH, generateChallengeResponse(data, _challenge));
+ sendMessage(MSG_AUTH, generateChallengeResponse(data, _challenge,
+ _socket->peerCertificate(),
+ _socket->localCertificate()));
break;
case MSG_AUTH_REPLY:
Q_ASSERT(_state == STATE_AUTH);
diff --git a/distfoldd/serveragent.cc b/distfoldd/serveragent.cc
index 3f133bd..2051e22 100644
--- a/distfoldd/serveragent.cc
+++ b/distfoldd/serveragent.cc
@@ -78,7 +78,9 @@ void ServerAgent::handleAuth(const QByteArray &response)
qDebug() << "Server Handling client auth";
- if (response == generateChallengeResponse(_challenge, _clientChallenge)) {
+ if (response == generateChallengeResponse(_challenge, _clientChallenge,
+ _socket->localCertificate(),
+ _socket->peerCertificate())) {
_authOk = true;
qDebug() << "Authentication successful";
} else {