Swiftdiff options
| author | Remko Tronçon <git@el-tramo.be> | 2009-11-22 16:39:21 (GMT) |
|---|---|---|
| committer | Remko Tronçon <git@el-tramo.be> | 2009-11-22 16:39:21 (GMT) |
| commit | d9ca66fa828e99ec5b4067d954c97d882b9ab8fe (patch) | |
| tree | 7d28f78e7f62cc95a1ef4fca31ec92d96a33b8e6 /Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp | |
| parent | 077d9f1f83c3a7ad819fea43e6c7beeefaaf81c7 (diff) | |
| download | swift-d9ca66fa828e99ec5b4067d954c97d882b9ab8fe.zip swift-d9ca66fa828e99ec5b4067d954c97d882b9ab8fe.tar.bz2 | |
Added SCRAM-SHA-1 test for invalid iteration count.
Diffstat (limited to 'Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp')
| -rw-r--r-- | Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp index ab61ef5..b55e5e4 100644 --- a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp +++ b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp @@ -33,27 +33,39 @@ ByteArray SCRAMSHA1ClientAuthenticator::getResponse() const { } bool SCRAMSHA1ClientAuthenticator::setChallenge(const ByteArray& challenge) { if (step == Initial) { initialServerMessage = challenge; - // TODO: Check if this is correct std::map<char, String> keys = parseMap(String(initialServerMessage.getData(), initialServerMessage.getSize())); + + // Extract the salt ByteArray salt = Base64::decode(keys['s']); - String clientServerNonce = keys['r']; // Extract the server nonce + String clientServerNonce = keys['r']; if (clientServerNonce.getUTF8Size() <= clientnonce.getUTF8Size()) { return false; } String receivedClientNonce = clientServerNonce.getSubstring(0, clientnonce.getUTF8Size()); if (receivedClientNonce != clientnonce) { return false; } serverNonce = clientServerNonce.getSubstring(clientnonce.getUTF8Size(), clientServerNonce.npos()); - int iterations = boost::lexical_cast<int>(keys['i'].getUTF8String()); + + // Extract the number of iterations + int iterations = 0; + try { + iterations = boost::lexical_cast<int>(keys['i'].getUTF8String()); + } + catch (const boost::bad_lexical_cast&) { + return false; + } + if (iterations <= 0) { + return false; + } // Compute all the values needed for the server signature saltedPassword = PBKDF2::encode(StringPrep::getPrepared(getPassword(), StringPrep::SASLPrep), salt, iterations); authMessage = getInitialBareClientMessage() + "," + initialServerMessage + "," + "c=biwsCg==," + "r=" + clientnonce + serverNonce; ByteArray serverKey = HMACSHA1::getResult(saltedPassword, "Server Key"); serverSignature = HMACSHA1::getResult(serverKey, authMessage); |