3 files changed, 21 insertions, 10 deletions
diff --git a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp
index 4e00397..2cc7cea 100644
--- a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp
+++ b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp
@@ -35,7 +35,7 @@ static String escape(const String& s) {
 }
 
 
-SCRAMSHA1ClientAuthenticator::SCRAMSHA1ClientAuthenticator(const String& nonce, bool useChannelBinding) : ClientAuthenticator("SCRAM-SHA-1"), step(Initial), clientnonce(nonce), useChannelBinding(useChannelBinding) {
+SCRAMSHA1ClientAuthenticator::SCRAMSHA1ClientAuthenticator(const String& nonce, bool useChannelBinding) : ClientAuthenticator(useChannelBinding ? "SCRAM-SHA-1-PLUS" : "SCRAM-SHA-1"), step(Initial), clientnonce(nonce), useChannelBinding(useChannelBinding) {
 }
 
 boost::optional<ByteArray> SCRAMSHA1ClientAuthenticator::getResponse() const {
@@ -50,11 +50,7 @@ boost::optional<ByteArray> SCRAMSHA1ClientAuthenticator::getResponse() const {
 		for (unsigned int i = 0; i < clientProof.getSize(); ++i) {
 			clientProof[i] ^= clientSignature[i];
 		}
-		ByteArray channelBindData;
-		if (useChannelBinding && tlsChannelBindingData) {
-			channelBindData = *tlsChannelBindingData;
-		}
-		ByteArray result = ByteArray("c=") + Base64::encode(getGS2Header() + channelBindData) + ",r=" + clientnonce + serverNonce + ",p=" + Base64::encode(clientProof);
+		ByteArray result = getFinalMessageWithoutProof() + ",p=" + Base64::encode(clientProof);
 		return result;
 	}
 	else {
@@ -97,9 +93,14 @@ bool SCRAMSHA1ClientAuthenticator::setChallenge(const boost::optional<ByteArray>
 			return false;
 		}
 
+		ByteArray channelBindData;
+		if (useChannelBinding && tlsChannelBindingData) {
+			channelBindData = *tlsChannelBindingData;
+		}
+
 		// Compute all the values needed for the server signature
 		saltedPassword = PBKDF2::encode(StringPrep::getPrepared(getPassword(), StringPrep::SASLPrep), salt, iterations);
-		authMessage = getInitialBareClientMessage() + "," + initialServerMessage + "," + "c=" + Base64::encode(getGS2Header()) + ",r=" + clientnonce + serverNonce;
+		authMessage = getInitialBareClientMessage() + "," + initialServerMessage + "," + getFinalMessageWithoutProof();
 		ByteArray serverKey = HMACSHA1::getResult(saltedPassword, "Server Key");
 		serverSignature = HMACSHA1::getResult(serverKey, authMessage);
 
@@ -153,7 +154,7 @@ ByteArray SCRAMSHA1ClientAuthenticator::getGS2Header() const {
 	ByteArray channelBindingHeader("n");
 	if (tlsChannelBindingData) {
 		if (useChannelBinding) {
-			channelBindingHeader = ByteArray("p=tls-server-end-point");
+			channelBindingHeader = ByteArray("p=tls-unique");
 		}
 		else {
 			channelBindingHeader = ByteArray("y");
@@ -166,4 +167,13 @@ void SCRAMSHA1ClientAuthenticator::setTLSChannelBindingData(const ByteArray& cha
 	this->tlsChannelBindingData = channelBindingData;
 }
 
+ByteArray SCRAMSHA1ClientAuthenticator::getFinalMessageWithoutProof() const {
+	ByteArray channelBindData;
+	if (useChannelBinding && tlsChannelBindingData) {
+		channelBindData = *tlsChannelBindingData;
+	}
+	return ByteArray("c=") + Base64::encode(getGS2Header() + channelBindData) + ",r=" + clientnonce + serverNonce;
+}
+
+
 }
diff --git a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h
index b44e6b7..2cf3cc7 100644
--- a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h
+++ b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h
@@ -26,6 +26,7 @@ namespace Swift {
 		private:
 			ByteArray getInitialBareClientMessage() const;
 			ByteArray getGS2Header() const;
+			ByteArray getFinalMessageWithoutProof() const;
 
 			static std::map<char, String> parseMap(const String&);
 
diff --git a/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp b/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp
index 0d12bd3..0e42f38 100644
--- a/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp
+++ b/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp
@@ -92,7 +92,7 @@ class SCRAMSHA1ClientAuthenticatorTest : public CppUnit::TestFixture {
 
 			ByteArray response = *testling.getResponse();
 
-			CPPUNIT_ASSERT_EQUAL(String("p=tls-server-end-point,,n=user,r=abcdefghABCDEFGH"), response.toString());
+			CPPUNIT_ASSERT_EQUAL(String("p=tls-unique,,n=user,r=abcdefghABCDEFGH"), response.toString());
 		}
 
 		void testGetFinalResponse() {
@@ -124,7 +124,7 @@ class SCRAMSHA1ClientAuthenticatorTest : public CppUnit::TestFixture {
 
 			ByteArray response = *testling.getResponse();
 
-			CPPUNIT_ASSERT_EQUAL(String("c=cD10bHMtc2VydmVyLWVuZC1wb2ludCwseHl6YQ==,r=abcdefghABCDEFGH,p=ycZyNs03w1HlRzFmXl8dlKx3NAU="), response.toString());
+			CPPUNIT_ASSERT_EQUAL(String("c=cD10bHMtdW5pcXVlLCx4eXph,r=abcdefghABCDEFGH,p=i6Rghite81P1ype8XxaVAa5l7v0="), response.toString());
 		}
 
 		void testSetFinalChallenge() {