From 9dba51c12a78ccce865f3a573b9d6435a576f13e Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 11 Feb 2024 04:10:41 +0000
Subject: Use TimingSafeCompare when comparing server SSL fingerprints.

---
 src/modules/m_spanningtree/hmac.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/modules/m_spanningtree/hmac.cpp b/src/modules/m_spanningtree/hmac.cpp
index ce0b070cd..4556006a2 100644
--- a/src/modules/m_spanningtree/hmac.cpp
+++ b/src/modules/m_spanningtree/hmac.cpp
@@ -77,7 +77,7 @@ bool TreeSocket::ComparePass(const Link& link, const std::string &theirs)
 	if (capab->auth_fingerprint)
 	{
 		/* Require fingerprint to exist and match */
-		if (link.Fingerprint != fp)
+		if (!InspIRCd::TimingSafeCompare(link.Fingerprint, fp))
 		{
 			ServerInstance->SNO->WriteToSnoMask('l',"Invalid SSL certificate fingerprint on link %s: need \"%s\" got \"%s\"",
 				link.Name.c_str(), link.Fingerprint.c_str(), fp.c_str());
-- 
cgit v1.3.1-10-gc9f91


From 3d0ca1a79bb38de00d534aee336021d3c1787058 Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 11 Feb 2024 04:11:17 +0000
Subject: Fix matching certificate fingerprints to be case insensitive.

Closes #2083.
---
 src/modules/m_spanningtree/utils.cpp | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src')

diff --git a/src/modules/m_spanningtree/utils.cpp b/src/modules/m_spanningtree/utils.cpp
index f6bc25c81..885295079 100644
--- a/src/modules/m_spanningtree/utils.cpp
+++ b/src/modules/m_spanningtree/utils.cpp
@@ -320,7 +320,9 @@ void SpanningTreeUtilities::ReadConfiguration()
 		if (!L->Port && L->IPAddr.find('/') == std::string::npos)
 			ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "Configuration warning: Link block '" + L->Name + "' has no port defined, you will not be able to /connect it.");
 
+		std::transform(L->Fingerprint.begin(), L->Fingerprint.end(), L->Fingerprint.begin(), ::tolower);
 		L->Fingerprint.erase(std::remove(L->Fingerprint.begin(), L->Fingerprint.end(), ':'), L->Fingerprint.end());
+
 		LinkBlocks.push_back(L);
 	}
 
-- 
cgit v1.3.1-10-gc9f91


From 57a4eca963044d4ed8c586f7cbb0d0977bf1c2bd Mon Sep 17 00:00:00 2001
From: Sadie Powell
Date: Sun, 25 Feb 2024 22:20:02 +0000
Subject: Fix erroneously sending RPL_CHANNELSMSG when a whois chanlist is
 blocked.

---
 src/modules/m_hidechans.cpp   | 2 +-
 src/modules/m_servprotect.cpp | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/modules/m_hidechans.cpp b/src/modules/m_hidechans.cpp
index 91048e971..250915fe2 100644
--- a/src/modules/m_hidechans.cpp
+++ b/src/modules/m_hidechans.cpp
@@ -82,7 +82,7 @@ class ModuleHideChans CXX11_FINAL
 
 	ModResult OnWhoisLine(Whois::Context& whois, Numeric::Numeric& numeric) CXX11_OVERRIDE
 	{
-		if (numeric.GetNumeric() != RPL_WHOISCHANNELS)
+		if (numeric.GetNumeric() != RPL_WHOISCHANNELS && numeric.GetNumeric() != RPL_CHANNELSMSG)
 			return MOD_RES_PASSTHRU;
 
 		return ShouldHideChans(whois.GetSource(), whois.GetTarget());
diff --git a/src/modules/m_servprotect.cpp b/src/modules/m_servprotect.cpp
index 6b8f5c3e5..7405b69e2 100644
--- a/src/modules/m_servprotect.cpp
+++ b/src/modules/m_servprotect.cpp
@@ -129,7 +129,10 @@ class ModuleServProtectMode CXX11_FINAL
 
 	ModResult OnWhoisLine(Whois::Context& whois, Numeric::Numeric& numeric) CXX11_OVERRIDE
 	{
-		return ((numeric.GetNumeric() == RPL_WHOISCHANNELS) && whois.GetTarget()->IsModeSet(bm)) ? MOD_RES_DENY : MOD_RES_PASSTHRU;
+		if (numeric.GetNumeric() != RPL_WHOISCHANNELS && numeric.GetNumeric() != RPL_CHANNELSMSG)
+			return MOD_RES_PASSTHRU;
+
+		return whois.GetTarget()->IsModeSet(bm) ? MOD_RES_DENY : MOD_RES_PASSTHRU;
 	}
 };
 
-- 
cgit v1.3.1-10-gc9f91