Sasl auth: remove BLOWFISH. fix #1483

git-svn-id: https://svn.kvirc.de/svn/trunk/kvirc@6445 17fca916-40b9-46aa-a4ea-0a15b648b75c

8 files changed, 16 insertions, 228 deletions

diff --git a/src/kvilib/net/KviSASL.cpp b/src/kvilib/net/KviSASL.cpp
index 407ab5122..16595db8e 100644
--- a/src/kvilib/net/KviSASL.cpp
+++ b/src/kvilib/net/KviSASL.cpp
@@ -28,17 +28,6 @@
 
 #include "KviMemory.h"
 
-#ifdef COMPILE_SSL_SUPPORT
-
-#include <openssl/blowfish.h>
-#include <openssl/bn.h>
-#include <openssl/dh.h>
-#include <openssl/err.h>
-#include <KviNetUtils.h>
-
-#endif
-
-
 namespace KviSASL
 {
 
@@ -73,126 +62,4 @@ namespace KviSASL
 		return false;
 	}
 
-#ifdef COMPILE_SSL_SUPPORT
-	bool dh_blowfishMethod(KviCString & szIn, KviCString & szOut, QByteArray & baNick, QByteArray & baPass)
-	{
-		/*
-		 * The format of the auth token is quite complex; the server sends us 3 strings:
-		 * p - a prime number
-		 * g - a generator number, tipically 2 or 5 are used.
-		 * y - the server-generated public key
-		 * These 3 strings are null-terminated and codified as pascal strings (they are prefixed
-		 * with a 16-bit lenght identifiedr in "network" big-endian order)
-		 * Then, the 3 strings are concatenated and base-64 encoded.
-		 */
-
-		BF_KEY key;
-		quint16 size, pKlen;
-		int secretLen;
-		unsigned char *secret = NULL, *pubKey = NULL;
-		char * tmpBuf;
-		DH * dh = DH_new();
-		int len = szIn.base64ToBuffer(&tmpBuf,false);
-
-		if(len < 7) return false;
-
-		// extract p
-		size = ntohs(*(unsigned int*)tmpBuf);
-		tmpBuf+=2;
-		len-=2;
-		if(size > len) return false;
-
-		if(!(dh->p = BN_bin2bn((unsigned char*) tmpBuf, size, NULL)))
-			return false;
-
-		tmpBuf+=size;
-		len-=size;
-
-		// extract g
-		size = ntohs(*(unsigned int*)tmpBuf);
-		tmpBuf+=2;
-		len-=2;
-		if(size > len) return false;
-
-		if(!(dh->g = BN_bin2bn((unsigned char*) tmpBuf, size, NULL)))
-			return false;
-
-		tmpBuf+=size;
-		len-=size;
-
-		// extract y
-		size = ntohs(*(unsigned int*)tmpBuf);
-		tmpBuf+=2;
-		len-=2;
-		if(size > len) return false;
-
-		// create our keys and extract shared secret
-		// note: any memory checking tool (as valgrind) will complain on this call. blame openssl
-		if(!DH_generate_key(dh))
-			return false;
-
-		secret=(unsigned char *) KviMemory::allocate(DH_size(dh));
-		// note: any memory checking tool (as valgrind) will complain on this call. blame openssl
-		if(-1 == (secretLen = DH_compute_key(secret, BN_bin2bn((unsigned char*) tmpBuf, size, NULL), dh)))
-			return false;
-
-		pKlen=BN_num_bytes(dh->pub_key);
-		pubKey = (unsigned char *) KviMemory::allocate(pKlen);
-		BN_bn2bin(dh->pub_key, pubKey);
-
-		//create crypto buffers
-		int passLen = baPass.size() + ((8 -( baPass.size() % 8)) % 8);
-		int passC = 0;
-		unsigned char *passIn = (unsigned char *) KviMemory::allocate(passLen);
-		unsigned char *passOut = (unsigned char *) KviMemory::allocate(passLen);
-
-		memset(passIn, 0, passLen);
-		memset(passOut, 0, passLen);
-		memcpy(passIn, baPass.data(), baPass.size());
-
-		// crypt our password
-		BF_set_key(&key, secretLen, secret);
-
-		for (passC=0; passC < passLen; passC += 8)
-			BF_ecb_encrypt(passIn + passC,  passOut + passC, &key, BF_ENCRYPT);
-
-		/*
-		 * Build up the answer
-		 * The format of the auth answer is quite complex, and formed by the byte concatenation of:
-		 * 1) a 16 bit integer containing the byte length of our public key
-		 * 2) our public key
-		 * 3) our username (nickname), null-terminated
-		 * 4) our password, crypted using blowfish in ecb mode and the dh secret as the blowfish key
-		 * Then, the answer is to be base64 encoded.
-		 */
-
-		int answerLen = 2 + pKlen + baNick.size() + 1 + passLen;
-		char * answer = (char *) malloc(answerLen);
-		char * answer2 = answer;
-		*((unsigned int *)answer) = htons(pKlen);
-		answer+=2;
-		memcpy(answer, pubKey, pKlen);
-		answer+=pKlen;
-		memcpy(answer, baNick.data(), baNick.size());
-		answer+=baNick.size();
-		memset(answer, 0, 1);
-		answer++;
-		memcpy(answer, passOut, passLen);
-		szOut.bufferToBase64(answer2,answerLen);
-
-		//clean up
-		KviMemory::free(secret);
-		KviMemory::free(pubKey);
-		KviMemory::free(passIn);
-		KviMemory::free(passOut);
-
-		return true;
-	}
-#else
-	bool dh_blowfishMethod(KviCString & szIn, KviCString & szOut, QByteArray & baNick, QByteArray & baPass)
-	{
-		return false;
-	}
-#endif
-
 };
diff --git a/src/kvilib/net/KviSASL.h b/src/kvilib/net/KviSASL.h
index f21b22df2..2978f7fa1 100644
--- a/src/kvilib/net/KviSASL.h
+++ b/src/kvilib/net/KviSASL.h
@@ -45,17 +45,6 @@ namespace KviSASL
 	* \return bool
 	*/
 	extern KVILIB_API bool plainMethod(KviCString & szIn, KviCString & szOut, QByteArray & baNick, QByteArray & baPass);
-
-	/**
-	* \brief Create the auth message for DH-BLOWFISH authentication
-	* \param szIn The server-provided token
-	* \param szOut A KviCString that will be filled with the authentication message
-	* \param baNick The username
-	* \param baPass	The password
-	* \return bool
-	*/
-	extern KVILIB_API bool dh_blowfishMethod(KviCString & szIn, KviCString & szOut, QByteArray & baNick, QByteArray & baPass);
-
 };
 
 #endif //_KVI_SASL_H_
diff --git a/src/kvirc/kernel/KviIrcConnection.cpp b/src/kvirc/kernel/KviIrcConnection.cpp
index 8d2a426a5..b71dfbc9b 100644
--- a/src/kvirc/kernel/KviIrcConnection.cpp
+++ b/src/kvirc/kernel/KviIrcConnection.cpp
@@ -513,40 +513,15 @@ void KviIrcConnection::handleInitialCapAck()
 	)
 	{
 		m_pStateData->setInsideAuthenticate(true);
-		m_pStateData->setInsideAuthenticateFallback(false);
 		bUsed=true;
 
-#ifdef COMPILE_SSL_SUPPORT
-		sendFmtData("AUTHENTICATE DH-BLOWFISH");
-#else
 		sendFmtData("AUTHENTICATE PLAIN");
-#endif
 	}
 
 	if(!bUsed)
 		endInitialCapNegotiation();
 }
 
-void KviIrcConnection::handleAuthenticateFallback()
-{
-#ifdef COMPILE_SSL_SUPPORT
-	// we tried DH_BLOWFISH but the server doesn't support it
-	if(m_pStateData->isInsideAuthenticateFallback())
-	{
-		// we alredy tried the fallback, move on
-		endInitialCapNegotiation();
-	} else {
-		// fallback to plain auth
-		m_pStateData->setInsideAuthenticateFallback(true);
-		sendFmtData("AUTHENTICATE PLAIN");	
-	}	
-#else 
-	// we failed authentication, move on
-	endInitialCapNegotiation();
-#endif
-
-}
-
 void KviIrcConnection::handleAuthenticate(KviCString & szAuth)
 {
 	//SASL
@@ -555,33 +530,18 @@ void KviIrcConnection::handleAuthenticate(KviCString & szAuth)
 
 	QByteArray szNick = encodeText(target()->server()->saslNick());
 	QByteArray szPass = encodeText(target()->server()->saslPass());
-	if(szAuth=="+")
+
+	//PLAIN
+	KviCString szOut;
+	if(KviSASL::plainMethod(szAuth,
+				szOut,
+				szNick,
+				szPass
+				))
 	{
-		//PLAIN
-		KviCString szOut;
-		if(KviSASL::plainMethod(szAuth,
-					szOut,
-					szNick,
-					szPass
-					))
-		{
-			sendFmtData("AUTHENTICATE %s",szOut.ptr());
-		} else {
-			sendFmtData("AUTHENTICATE *");
-		}
+		sendFmtData("AUTHENTICATE %s",szOut.ptr());
 	} else {
-		//DH-BLOWFISH sasl auth
-		KviCString szOut;
-		if(KviSASL::dh_blowfishMethod(szAuth,
-					szOut,
-					szNick,
-					szPass
-					))
-		{
-			sendFmtData("AUTHENTICATE %s",szOut.ptr());
-		} else {
-			sendFmtData("AUTHENTICATE *");
-		}
+		sendFmtData("AUTHENTICATE *");
 	}
 }
 
@@ -592,7 +552,6 @@ void KviIrcConnection::handleInitialCapNak()
 
 void KviIrcConnection::endInitialCapNegotiation()
 {
-	m_pStateData->setInsideAuthenticateFallback(false);
 	m_pStateData->setInsideAuthenticate(false);
 	sendFmtData("CAP END");
 	loginToIrcServer();
diff --git a/src/kvirc/kernel/KviIrcConnection.h b/src/kvirc/kernel/KviIrcConnection.h
index b4733e64c..fbde1fdbf 100644
--- a/src/kvirc/kernel/KviIrcConnection.h
+++ b/src/kvirc/kernel/KviIrcConnection.h
@@ -790,12 +790,6 @@ protected:
 	void handleAuthenticate(KviCString & szResponse);
 
 	/**
-	* \brief Called when AUTHENTICATE fails ad we fallback to PLAIN auth
-	* \return void
-	*/
-	void handleAuthenticateFallback();
-
-	/**
 	* \brief Called when CAP LS answer is received
 	* \return void
 	*/
diff --git a/src/kvirc/kernel/KviIrcConnectionStateData.h b/src/kvirc/kernel/KviIrcConnectionStateData.h
index 9b7705ff9..4b9f6e9d9 100644
--- a/src/kvirc/kernel/KviIrcConnectionStateData.h
+++ b/src/kvirc/kernel/KviIrcConnectionStateData.h
@@ -89,7 +89,6 @@ protected:
 	bool         m_bIgnoreOneYouHaveNotRegisteredError; // true if we have sent a CAP LS request followed by a PING which will generate an error (and we need to ignore it)
 	bool         m_bInsideInitialCapReq;                 // true if there's a CAP REQ request pending
 	bool         m_bInsideAuthenticate;           // true if there's a AUTHENTICATE request pending
-	bool         m_bInsideAuthenticateFallback;   // true if there's a AUTHENTICATE PLAIN request pending as a fallback
 	bool         m_bSentStartTls;                 // the state of STARTTLS protocol
 	bool         m_bSentQuit;                     // have we sent the quit message for this connection ?
 	QString      m_szCommandToExecAfterConnect;   // yes.. this is a special command to execute after connection
@@ -129,9 +128,6 @@ public:
 	bool isInsideAuthenticate(){ return m_bInsideAuthenticate; };
 	void setInsideAuthenticate(bool bInside){ m_bInsideAuthenticate = bInside; };
 
-	bool isInsideAuthenticateFallback(){ return m_bInsideAuthenticateFallback; };
-	void setInsideAuthenticateFallback(bool bInside){ m_bInsideAuthenticateFallback = bInside; };
-
 	bool isInsideInitialCapLs(){ return m_bInsideInitialCapLs; };
 	void setInsideInitialCapLs(bool bInside){ m_bInsideInitialCapLs = bInside; };
 
diff --git a/src/kvirc/sparser/KviIrcServerParser.h b/src/kvirc/sparser/KviIrcServerParser.h
index 98b42820a..847559ed5 100644
--- a/src/kvirc/sparser/KviIrcServerParser.h
+++ b/src/kvirc/sparser/KviIrcServerParser.h
@@ -263,7 +263,6 @@ private:
 	void parseNumericSaslSuccess(KviIrcMessage * msg);
 	void parseNumericSaslLogin(KviIrcMessage * msg);
 	void parseNumericSaslFail(KviIrcMessage * msg);
-	void parseNumericSaslIdiocy(KviIrcMessage * msg);
 
 public:
 	static void encodeCtcpParameter(const char * param,KviCString &buffer,bool bSpaceBreaks = true);
diff --git a/src/kvirc/sparser/KviIrcServerParser_numericHandlers.cpp b/src/kvirc/sparser/KviIrcServerParser_numericHandlers.cpp
index d0e437446..cdb36a41d 100644
--- a/src/kvirc/sparser/KviIrcServerParser_numericHandlers.cpp
+++ b/src/kvirc/sparser/KviIrcServerParser_numericHandlers.cpp
@@ -2442,28 +2442,15 @@ void KviIrcServerParser::parseNumericSaslSuccess(KviIrcMessage * msg)
 
 void KviIrcServerParser::parseNumericSaslFail(KviIrcMessage * msg)
 {
+	// 904: RPL_SASLFAILED
+	// :prefix 904 * :SASL authentication failed
+
 	// 906: RPL_SASLBORTED
 	// :prefix 906 <nickname> :SASL authentication aborted
 
 	// 907: RPL_SASLALREADYAUTH
 	// :prefix 907 <nick> :You have already completed SASL authentication
 
-	if(!msg->haltOutput())
-	{
-		KviWindow * pOut = (KviWindow *)(msg->console());
-		QString szParam=msg->connection()->decodeText(msg->safeTrailing());
-		pOut->output(KVI_OUT_SERVERINFO,__tr2qs("SASL Authentication error: %Q"),&szParam);
-	}
-
-	if(msg->connection()->stateData()->isInsideAuthenticate())
-		msg->connection()->endInitialCapNegotiation();
-}
-
-void KviIrcServerParser::parseNumericSaslIdiocy(KviIrcMessage * msg)
-{
-	// 904: RPL_SASLFAILED
-	// :prefix 904 * :SASL authentication failed
-
 	// 908: RPL_SASLMECHS
 	// :server 908 <nick> <mechanisms> :are available SASL mechanisms
 
@@ -2475,8 +2462,5 @@ void KviIrcServerParser::parseNumericSaslIdiocy(KviIrcMessage * msg)
 	}
 
 	if(msg->connection()->stateData()->isInsideAuthenticate())
-	{
-			// fallback to plain auth
-			msg->connection()->handleAuthenticateFallback();
-	}
+		msg->connection()->endInitialCapNegotiation();
 }
diff --git a/src/kvirc/sparser/KviIrcServerParser_tables.cpp b/src/kvirc/sparser/KviIrcServerParser_tables.cpp
index 10bbed520..2078348e7 100644
--- a/src/kvirc/sparser/KviIrcServerParser_tables.cpp
+++ b/src/kvirc/sparser/KviIrcServerParser_tables.cpp
@@ -992,11 +992,11 @@ messageParseProc KviIrcServerParser::m_numericParseProcTable[1000]=
 	0,                                               // 901
 	0,                                               // 902
 	PTM(parseNumericSaslSuccess),                    // 903 RPL_SASLSUCCESS
-	PTM(parseNumericSaslIdiocy),                     // 904 RPL_SASLFAILED
+	PTM(parseNumericSaslFail),                       // 904 RPL_SASLFAILED
 	PTM(parseNumericSaslFail),                       // 905 RPL_SASLERROR
 	PTM(parseNumericSaslFail),                       // 906 RPL_SASLABORT
 	PTM(parseNumericSaslFail),                       // 907 RPL_SASLALREADYAUTH
-	PTM(parseNumericSaslIdiocy),                     // 908 RPL_SASLMECHS
+	PTM(parseNumericSaslFail),                       // 908 RPL_SASLMECHS
 	0,                                               // 909
 	0,                                               // 910
 	0,                                               // 911