Additional entropy when hashing match passwords.

The purpose of our client-side hashing for lobby game passwords is to
prevent malicious hosts from getting valuable passwords from clients
(e.g. accidentally typing their lobby password instead of the game, or
even their email password, etc).
However, the hashing was deterministic (and rather simple), making it
possible to compute rainbow tables and recover user passwords anyways.

By adding more variation, including some that cannot so easily be
controlled by the host (the client name), this becomes impractical. The
password hashing function used is rather fast, but given the base low
probability of mistypes, this seems fine.

Differential Revision: https://code.wildfiregames.com/D3459
This was SVN commit r25459.

source/lobby/IXmppClient.h

@@ -36,7 +36,7 @@ public:
 	virtual void SendIqGetProfile(const std::string& player) = 0;
 	virtual void SendIqGameReport(const ScriptRequest& rq, JS::HandleValue data) = 0;
 	virtual void SendIqRegisterGame(const ScriptRequest& rq, JS::HandleValue data) = 0;
-	virtual void SendIqGetConnectionData(const std::string& jid, const std::string& password, bool localIP) = 0;
+	virtual void SendIqGetConnectionData(const std::string& jid, const std::string& password, const std::string& clientSalt, bool localIP) = 0;
 	virtual void SendIqUnregisterGame() = 0;
 	virtual void SendIqChangeStateGame(const std::string& nbp, const std::string& players) = 0;
 	virtual void SendIqLobbyAuth(const std::string& to, const std::string& token) = 0;

source/lobby/StanzaExtensions.cpp

@@ -309,6 +309,9 @@ ConnectionData::ConnectionData(const glooxwrapper::Tag* tag)
 	const glooxwrapper::Tag* pw = tag->findTag_clone("connectiondata/password");
 	if (pw)
 		m_Password = pw->cdata();
+	const glooxwrapper::Tag* cs = tag->findTag_clone("connectiondata/clientsalt");
+	if (cs)
+		m_ClientSalt = cs->cdata();
 	const glooxwrapper::Tag* e = tag->findTag_clone("connectiondata/error");
 	if (e)
 		m_Error= e->cdata();
@@ -318,6 +321,7 @@ ConnectionData::ConnectionData(const glooxwrapper::Tag* tag)
 	glooxwrapper::Tag::free(pip);
 	glooxwrapper::Tag::free(s);
 	glooxwrapper::Tag::free(pw);
+	glooxwrapper::Tag::free(cs);
 	glooxwrapper::Tag::free(e);
 }
 
@@ -348,6 +352,8 @@ glooxwrapper::Tag* ConnectionData::tag() const
 		t->addChild(glooxwrapper::Tag::allocate("useSTUN", m_UseSTUN));
 	if (!m_Password.empty())
 		t->addChild(glooxwrapper::Tag::allocate("password", m_Password));
+	if (!m_ClientSalt.empty())
+		t->addChild(glooxwrapper::Tag::allocate("clientsalt", m_ClientSalt));
 	if (!m_Error.empty())
 		t->addChild(glooxwrapper::Tag::allocate("error", m_Error));
 	return t;

source/lobby/StanzaExtensions.h

@@ -63,6 +63,7 @@ public:
 	glooxwrapper::string m_IsLocalIP;
 	glooxwrapper::string m_UseSTUN;
 	glooxwrapper::string m_Password;
+	glooxwrapper::string m_ClientSalt;
 	glooxwrapper::string m_Error;
 };
 

source/lobby/XmppClient.cpp

@@ -365,12 +365,13 @@ void XmppClient::SendIqGetProfile(const std::string& player)
 /**
  * Request the Connection data (ip, port...) from the server.
  */
-void XmppClient::SendIqGetConnectionData(const std::string& jid, const std::string& password, bool localIP)
+void XmppClient::SendIqGetConnectionData(const std::string& jid, const std::string& password, const std::string& clientSalt, bool localIP)
 {
 	glooxwrapper::JID targetJID(jid);
 
 	ConnectionData* connectionData = new ConnectionData();
 	connectionData->m_Password = password;
+	connectionData->m_ClientSalt = clientSalt;
 	connectionData->m_IsLocalIP = localIP ? "1" : "0";
 	glooxwrapper::IQ iq(gloox::IQ::Get, targetJID, m_client->getID());
 	iq.addExtension(connectionData);
@@ -974,7 +975,7 @@ bool XmppClient::handleIq(const glooxwrapper::IQ& iq)
 				m_client->send(response);
 				return true;
 			}
-			if (!g_NetServer->CheckPasswordAndIncrement(CStr(cd->m_Password.to_string()), iq.from().username()))
+			if (!g_NetServer->CheckPasswordAndIncrement(iq.from().username(), cd->m_Password.to_string(), cd->m_ClientSalt.to_string()))
 			{
 				glooxwrapper::IQ response(gloox::IQ::Result, iq.from(), iq.id());
 				ConnectionData* connectionData = new ConnectionData();

source/lobby/XmppClient.h

@@ -86,7 +86,7 @@ public:
 	void SendIqGetProfile(const std::string& player);
 	void SendIqGameReport(const ScriptRequest& rq, JS::HandleValue data);
 	void SendIqRegisterGame(const ScriptRequest& rq, JS::HandleValue data);
-	void SendIqGetConnectionData(const std::string& jid, const std::string& password, bool localIP);
+	void SendIqGetConnectionData(const std::string& jid, const std::string& password, const std::string& clientSalt, bool localIP);
 	void SendIqUnregisterGame();
 	void SendIqChangeStateGame(const std::string& nbp, const std::string& players);
 	void SendIqLobbyAuth(const std::string& to, const std::string& token);