CString::Equals falls through to strcmp, which short-circuits on the first
differing byte. That leaks the length of the common prefix between the
stored hash (or plain password) and the attacker's guess via response
timing. Argon2id already uses argon2id_verify which is constant-time.
Add a small ConstantTimeEquals helper and use it for the legacy MD5,
SHA256 and plain HASH_NONE branches. No new dependency: the helper is
~10 lines and works on builds without OpenSSL.
These days salted SHA-256 is considered quite weak for passwords.
Transparently upgrade existing hashes upon login.
Bump cmake requirement to able to use IMPORTED_TARGET, this will allow
further cleanup in next commits.
Instead of only networkless clients, which is a very rare case, because
most clients are connected to some network. This resulted in
CModule::PutModule to sometimes have no effect.
I fixed CUser::PutStatus and PutStatusNotice back in 2011 in
0b6d609014, but missed these 3 functions.
Deprecate CUser::PutAllUser() which is now essentially alias to
CUser::PutUser().
Building with CFLAGS="-flto -Werror=odr -Werror=lto-type-mismatch
-Werror=strict-aliasing" CXXFLAGS="-flto -Werror=odr
-Werror=lto-type-mismatch -Werror=strict-aliasing" LDFLAGS=-flto fails
due to a violation of the one definition rule. There are two different
definitions of TOption that are both linked into the znc binary.
Fix this by putting them into anonymous namespaces.
Fixes: https://github.com/znc/znc/issues/1834
Signed-off-by: Uli Schlachter <psychon@znc.in>
Setting AuthOnlyViaModule on a user causes CheckPass to never return true,
causing all authentication attempts using the configured password to fail, both
on IRC connections and for webadmin. This is useful in situations where an
external module (cyrusauth, certauth, imapauth) handles authentication. Setting
the global AuthOnlyViaModule option causes similar behavior across every
user. If AuthOnlyViaModule is set to true globally, it cannot be overridden
per-user.
Close#1474Close#331
While not kicking upon disconnect can cause desync with client and other
issues, there were multiple complains about the new behavior, and the
user should have the choice.
Revert 2f65dbbc64
Ref #968
MarkLee131