--- AnyEvent-MP/MP/Transport.pm	2009/08/04 18:33:30	1.18
+++ AnyEvent-MP/MP/Transport.pm	2009/08/04 21:36:28	1.19
@@ -29,6 +29,9 @@
 use Storable ();
 use JSON::XS ();
 
+use Digest::MD6 ();
+use Digest::HMAC_MD6 ();
+
 use AE ();
 use AnyEvent::Socket ();
 use AnyEvent::Handle ();
@@ -128,19 +131,24 @@
    {
       Scalar::Util::weaken (my $self = $self);
 
-      $arg{tls_ctx_disabled} ||= {
-         sslv2  => 0,
-         sslv3  => 0,
-         tlsv1  => 1,
-         verify => 1,
-         cert_file => "secret.pem",
-         ca_file   => "secret.pem",
-         verify_require_client_cert => 1,
-      };
-
       $arg{secret} = AnyEvent::MP::Base::default_secret ()
          unless exists $arg{secret};
 
+      my $secret = $arg{secret};
+
+      if ($secret =~ /-----BEGIN RSA PRIVATE KEY-----.*-----END RSA PRIVATE KEY-----.*-----BEGIN CERTIFICATE-----.*-----END CERTIFICATE-----/s) {
+         # assume TLS mode
+         $arg{tls_ctx} = {
+            sslv2   => 0,
+            sslv3   => 0,
+            tlsv1   => 1,
+            verify  => 1,
+            cert    => $secret,
+            ca_cert => $secret,
+            verify_require_client_cert => 1,
+         };
+      }
+
       $self->{hdl} = new AnyEvent::Handle
          fh       => delete $arg{fh},
          autocork => 1,
@@ -151,7 +159,6 @@
          peername => delete $arg{peername},
       ;
 
-      my $secret = $arg{secret};
       my $greeting_kv = $self->{greeting} ||= {};
       $greeting_kv->{"tls"} = "1.0"
          if $arg{tls_ctx};
@@ -219,34 +226,36 @@
          $self->{hdl}->push_read (line => sub {
             my $rgreeting2 = $_[1];
 
+            "$lgreeting1\012$lgreeting2" ne "$rgreeting1\012$rgreeting2" # echo attack?
+               or return $self->error ("authentication error, echo attack?");
+
+            my $key = Digest::MD6::md6 $secret;
+            my $lauth;
+
             if ($self->{tls_ctx} and 1 == int $self->{remote_greeting}{tls}) {
                $self->{tls} = $lgreeting2 lt $rgreeting2 ? "connect" : "accept";
                $self->{hdl}->starttls ($self->{tls}, $self->{tls_ctx});
+               $s_auth = "tls";
+               $lauth = "";
+            } else {
+               # we currently only support hmac_md6_64_256
+               $lauth = Digest::HMAC_MD6::hmac_md6_hex $key, "$lgreeting1\012$lgreeting2\012$rgreeting1\012$rgreeting2\012", 64, 256;
             }
-         
-            # auth
-            require Digest::MD6;
-            require Digest::HMAC_MD6;
-
-            my $key   = Digest::MD6::md6 ($secret);
-            my $lauth = Digest::HMAC_MD6::hmac_md6_hex ($key, "$lgreeting1\012$lgreeting2\012$rgreeting1\012$rgreeting2\012", 64, 256);
-
-            my $rauth =
-               $s_auth eq "hmac_md6_64_256" ? Digest::HMAC_MD6::hmac_md6_hex ($key, "$rgreeting1\012$rgreeting2\012$lgreeting1\012$lgreeting2\012", 64, 256)
-             : $s_auth eq "cleartext"       ? unpack "H*", $secret
-             : die;
-
-            $lauth ne $rauth # echo attack?
-               or return $self->error ("authentication error");
 
             $self->{hdl}->push_write ("$s_auth;$lauth;$s_framing\012");
 
-            # reasd the authentication response
+            # read the authentication response
             $self->{hdl}->push_read (line => sub {
                my ($hdl, $rline) = @_;
 
                my ($auth_method, $rauth2, $r_framing) = split /;/, $rline;
 
+               my $rauth =
+                  $auth_method eq "hmac_md6_64_256" ? Digest::HMAC_MD6::hmac_md6_hex $key, "$rgreeting1\012$rgreeting2\012$lgreeting1\012$lgreeting2\012", 64, 256
+                : $auth_method eq "cleartext"       ? unpack "H*", $secret
+                : $auth_method eq "tls"             ? ($self->{tls} ? "" : "\012\012") # \012\012 never matches
+                : return $self->error ("$auth_method: fatal, selected unsupported auth method");
+
                if ($rauth2 ne $rauth) {
                   return $self->error ("authentication failure/shared secret mismatch");
                }
@@ -481,6 +490,14 @@
 
 This is the token that is expected from the other side.
 
+=item tls
+
+This type is only valid iff TLS was enabled and the TLS handshake
+was successful. It has no authentication data, as the server/client
+certificate was successfully verified.
+
+Implementations supporting TLS I<must> accept this authentication type.
+
 =back
 
 =item the authentication data