~steering/inspircd++.git/src/modules/m_spanningtree/hmac.cpp, branch v3.15.0 Unnamed repository; edit this file 'description' to name the repository. https://www.cgit.space/~steering/inspircd++.git/atom/src/modules/m_spanningtree/hmac.cpp?h=v3.15.0 2022-12-30T11:31:28Z Update copyright headers. 2022-12-30T11:31:28Z InspIRCd Robot 2022-12-30T11:31:28Z urn:sha1:2b810b412aeee2d9c79d97fa54a80e317981a6d8 Update copyright headers. 2020-01-11T22:14:43Z InspIRCd Robot 2020-01-11T22:02:47Z urn:sha1:aa692dc1039b63deef7886e914ec499abe7facaf Say "SSL certificate fingerprint" instead of "SSL fingerprint" everywhere 2014-07-19T12:39:04Z Attila Molnar 2014-07-19T12:39:04Z urn:sha1:3d0fa60ba524ce1af8056f86a126aa506f97261b Use TimingSafeCompare() to compare passwords and password hashes (non-hmac only) 2014-06-28T16:27:51Z Attila Molnar 2014-06-28T16:27:51Z urn:sha1:c1cc5cf147babcd834ba0dbbdd4b1c1d4ae010b6 Issue #882 m_spanningtree Send the cert fingerprint message to opers only after successful auth 2014-06-28T16:15:59Z Attila Molnar 2014-06-28T16:15:59Z urn:sha1:0c9a94ea9285d1094c031d0c4ed06326b99cf890 Check fingerprint before checking password (server linking) 2014-06-28T16:15:12Z Matthew Martin 2014-06-26T17:36:51Z urn:sha1:2cffabe0c7375a15c702aeaea5d553d90a549860 Checking the password before the fingerprint means that even without the correct cert it's possible to brute force the password or leak information about it. Checking the fingerprint means attackers must forge the cert before they can learn any information about the password. m_spanningtree Don't rely on "m_sha256.so" being loaded, use any "hash/sha256" service provider 2014-04-08T14:48:10Z Attila Molnar 2014-04-08T14:48:10Z urn:sha1:a5986ac2d317d148074522007007a6aac85baadb m_spanningtree Remove the (now) undocumented disablehmac config option 2014-04-08T14:41:09Z Attila Molnar 2014-04-08T14:41:09Z urn:sha1:f7eabed15819e7a3316b0ab2dc8a28f59f25ce2c Change modules to use the MODNAME constant when logging. 2013-08-04T12:32:51Z Peter Powell 2013-07-07T19:01:44Z urn:sha1:abc57eddfb56462ac3e433601d010abf1942e611 The majority of modules were logging with their module name as the log type. There was a few places which were logging to a non-name type but, with the exception of CONFIG, those messages are so uncommon that it doesn't make sense to use a seperate type for them. Create SSLIOHook interface that provides GetCertificate() 2013-06-06T23:00:10Z attilamolnar 2013-05-24T17:34:25Z urn:sha1:3d6d9cda32d72ff25cf6e624bb271b629898e018