| 62 | } |
| 63 | |
| 64 | func (r *SharedSecretRegistration) IsValidMacLogin( |
| 65 | nonce, username, password string, |
| 66 | isAdmin bool, |
| 67 | givenMac []byte, |
| 68 | ) (bool, error) { |
| 69 | // Check that shared secret registration isn't disabled. |
| 70 | if r.sharedSecret == "" { |
| 71 | return false, errors.New("shared secret registration is disabled") |
| 72 | } |
| 73 | if !r.validNonce(nonce) { |
| 74 | return false, fmt.Errorf("incorrect or expired nonce: %s", nonce) |
| 75 | } |
| 76 | |
| 77 | // Check that username/password don't contain the HMAC delimiters. |
| 78 | if strings.Contains(username, "\x00") { |
| 79 | return false, errors.New("username contains invalid character") |
| 80 | } |
| 81 | if strings.Contains(password, "\x00") { |
| 82 | return false, errors.New("password contains invalid character") |
| 83 | } |
| 84 | |
| 85 | adminString := "notadmin" |
| 86 | if isAdmin { |
| 87 | adminString = "admin" |
| 88 | } |
| 89 | joined := strings.Join([]string{nonce, username, password, adminString}, "\x00") |
| 90 | |
| 91 | mac := hmac.New(sha1.New, []byte(r.sharedSecret)) |
| 92 | _, err := mac.Write([]byte(joined)) |
| 93 | if err != nil { |
| 94 | return false, err |
| 95 | } |
| 96 | expectedMAC := mac.Sum(nil) |
| 97 | |
| 98 | return hmac.Equal(givenMac, expectedMAC), nil |
| 99 | } |