From c0183326a6447f931d4ec971963633a687e12c5e Mon Sep 17 00:00:00 2001 From: "Javier S. Pedro" Date: Sun, 30 Sep 2012 23:56:06 +0200 Subject: prevent trivial mitm attack --- distfoldd/agent.cc | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'distfoldd/agent.cc') diff --git a/distfoldd/agent.cc b/distfoldd/agent.cc index 8baa85b..1087889 100644 --- a/distfoldd/agent.cc +++ b/distfoldd/agent.cc @@ -175,9 +175,12 @@ QByteArray Agent::generateChallenge() return QCA::Random::randomArray(challenge_size).toByteArray(); } -QByteArray Agent::generateChallengeResponse(const QByteArray& server_challenge, const QByteArray& client_challenge) +QByteArray Agent::generateChallengeResponse(const QByteArray& server_challenge, const QByteArray& client_challenge, const QSslCertificate& server_cert, const QSslCertificate& client_cert) { - return hmacSha1(_passwd.toUtf8(), server_challenge + client_challenge); + QByteArray server_digest = server_cert.digest(QCryptographicHash::Sha1); + QByteArray client_digest = client_cert.digest(QCryptographicHash::Sha1); + return hmacSha1(_passwd.toUtf8(), server_challenge + server_digest + + client_challenge + client_digest); } QByteArray Agent::encodeAuthReply(AuthResult result) -- cgit v1.2.3