From 9dba51c12a78ccce865f3a573b9d6435a576f13e Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 11 Feb 2024 04:10:41 +0000
Subject: Use TimingSafeCompare when comparing server SSL fingerprints.

---
 src/modules/m_spanningtree/hmac.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src/modules')

diff --git a/src/modules/m_spanningtree/hmac.cpp b/src/modules/m_spanningtree/hmac.cpp
index ce0b070cd..4556006a2 100644
--- a/src/modules/m_spanningtree/hmac.cpp
+++ b/src/modules/m_spanningtree/hmac.cpp
@@ -77,7 +77,7 @@ bool TreeSocket::ComparePass(const Link& link, const std::string &theirs)
 	if (capab->auth_fingerprint)
 	{
 		/* Require fingerprint to exist and match */
-		if (link.Fingerprint != fp)
+		if (!InspIRCd::TimingSafeCompare(link.Fingerprint, fp))
 		{
 			ServerInstance->SNO->WriteToSnoMask('l',"Invalid SSL certificate fingerprint on link %s: need \"%s\" got \"%s\"",
 				link.Name.c_str(), link.Fingerprint.c_str(), fp.c_str());
-- 
cgit v1.3.1-10-gc9f91