Fix secret

Author: Str1ker17

src/plugins/BoundAuthPlugin/BoundAuth.c

@@ -295,7 +295,8 @@ PLUGINAPI int PLUGINCALL Initialize(struct pluginlink *link, int argc, char **ar
 
     /* DONE: parse passwordLen= and other parameters. */
     for (int i = 1; i < argc; ++i) {
-        const char *val = strtok(argv[i], "=");
+        strtok(argv[i], "=");
+        const char *val = strtok(NULL, "=");
         if (val && strcmp(argv[i], "len") == 0) {
             if (sscanf(val, "%hhu", &PluginConfig.len) != 1 || PluginConfig.len == 0) {
                 log_err_config(link, "%s= should be followed by a positive integer", argv[i]);

src/plugins/BoundAuthPlugin/generator.html

@@ -17,17 +17,30 @@ <h3>BoundAuth Generator</h3>
   <p><b>Result:</b> <code id="output">–</code></p>
 
   <script>
-    async function computeHMAC(password, ip, sharedSecret = "") {
-      const keyData = new TextEncoder().encode(password + sharedSecret);
+    async function hmacSHA256(keyBytes, messageBytes) {
       const key = await crypto.subtle.importKey(
-        "raw", keyData,
+        "raw", keyBytes,
         { name: "HMAC", hash: "SHA-256" },
         false, ["sign"]
       );
+      return new Uint8Array(await crypto.subtle.sign("HMAC", key, messageBytes));
+    }
 
+    async function computeHMAC(password, ip, sharedSecret = "") {
       const ipBin = parseIP(ip);
-      const signature = await crypto.subtle.sign("HMAC", key, ipBin);
-      return base32encode(new Uint8Array(signature)).slice(0, parseInt(document.getElementById("length").value, 10));
+      const pwBytes = new TextEncoder().encode(password);
+
+      const inner = await hmacSHA256(pwBytes, ipBin);  // inner = HMAC(user_secret, ip)
+
+      let final;
+      if (sharedSecret.length > 0) {
+        const sharedBytes = new TextEncoder().encode(sharedSecret);
+        final = await hmacSHA256(sharedBytes, inner);  // final = HMAC(server_secret, inner)
+      } else {
+        final = inner;
+      }
+
+      return base32encode(final).slice(0, parseInt(document.getElementById("length").value, 10));
     }
 
     function parseIP(ip) {