From 9dba51c12a78ccce865f3a573b9d6435a576f13e Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 11 Feb 2024 04:10:41 +0000
Subject: Use TimingSafeCompare when comparing server SSL fingerprints.

---
 src/modules/m_spanningtree/hmac.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/modules/m_spanningtree')

diff --git a/src/modules/m_spanningtree/hmac.cpp b/src/modules/m_spanningtree/hmac.cpp
index ce0b070cd..4556006a2 100644
--- a/src/modules/m_spanningtree/hmac.cpp
+++ b/src/modules/m_spanningtree/hmac.cpp
@@ -77,7 +77,7 @@ bool TreeSocket::ComparePass(const Link& link, const std::string &theirs)
 	if (capab->auth_fingerprint)
 	{
 		/* Require fingerprint to exist and match */
-		if (link.Fingerprint != fp)
+		if (!InspIRCd::TimingSafeCompare(link.Fingerprint, fp))
 		{
 			ServerInstance->SNO->WriteToSnoMask('l',"Invalid SSL certificate fingerprint on link %s: need \"%s\" got \"%s\"",
 				link.Name.c_str(), link.Fingerprint.c_str(), fp.c_str());
-- 
cgit v1.3.1-10-gc9f91


From 3d0ca1a79bb38de00d534aee336021d3c1787058 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 11 Feb 2024 04:11:17 +0000
Subject: Fix matching certificate fingerprints to be case insensitive.

Closes #2083.
---
 src/modules/m_spanningtree/utils.cpp | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src/modules/m_spanningtree')

diff --git a/src/modules/m_spanningtree/utils.cpp b/src/modules/m_spanningtree/utils.cpp
index f6bc25c81..885295079 100644
--- a/src/modules/m_spanningtree/utils.cpp
+++ b/src/modules/m_spanningtree/utils.cpp
@@ -320,7 +320,9 @@ void SpanningTreeUtilities::ReadConfiguration()
 		if (!L->Port && L->IPAddr.find('/') == std::string::npos)
 			ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Configuration warning: Link block '" + L->Name + "' has no port defined, you will not be able to /connect it.");
 
+		std::transform(L->Fingerprint.begin(), L->Fingerprint.end(), L->Fingerprint.begin(), ::tolower);
 		L->Fingerprint.erase(std::remove(L->Fingerprint.begin(), L->Fingerprint.end(), ':'), L->Fingerprint.end());
+
 		LinkBlocks.push_back(L);
 	}
 
-- 
cgit v1.3.1-10-gc9f91