mirrors/0ad
1
0
Fork 2
mirror of https://gitea.wildfiregames.com/0ad/0ad.git synced 2026-06-21 01:29:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Additional entropy when hashing match passwords.

Browse Source 
The purpose of our client-side hashing for lobby game passwords is to
prevent malicious hosts from getting valuable passwords from clients
(e.g. accidentally typing their lobby password instead of the game, or
even their email password, etc).
However, the hashing was deterministic (and rather simple), making it
possible to compute rainbow tables and recover user passwords anyways.

By adding more variation, including some that cannot so easily be
controlled by the host (the client name), this becomes impractical. The
password hashing function used is rather fast, but given the base low
probability of mistypes, this seems fine.

Differential Revision: https://code.wildfiregames.com/D3459
This was SVN commit r25459.
This commit is contained in:
wraitii
2021-05-18 14:47:36 +00:00
parent 40f9372d29
commit 7bfcd9f78b
13 changed files with 221 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/lobby/XmppClient.cpp
+3 -2
View File
@@ -365,12 +365,13 @@ void XmppClient::SendIqGetProfile(const std::string& player)
/**
* Request the Connection data (ip, port...) from the server.
*/
void XmppClient::SendIqGetConnectionData(const std::string& jid, const std::string& password, bool localIP)
void XmppClient::SendIqGetConnectionData(const std::string& jid, const std::string& password, const std::string& clientSalt, bool localIP)
{
glooxwrapper::JID targetJID(jid);
ConnectionData* connectionData = new ConnectionData();
connectionData->m_Password = password;
connectionData->m_ClientSalt = clientSalt;
connectionData->m_IsLocalIP = localIP ? "1" : "0";
glooxwrapper::IQ iq(gloox::IQ::Get, targetJID, m_client->getID());
iq.addExtension(connectionData);
@@ -974,7 +975,7 @@ bool XmppClient::handleIq(const glooxwrapper::IQ& iq)
m_client->send(response);
return true;
}
if (!g_NetServer->CheckPasswordAndIncrement(CStr(cd->m_Password.to_string()), iq.from().username()))
if (!g_NetServer->CheckPasswordAndIncrement(iq.from().username(), cd->m_Password.to_string(), cd->m_ClientSalt.to_string()))
{
glooxwrapper::IQ response(gloox::IQ::Result, iq.from(), iq.id());
ConnectionData* connectionData = new ConnectionData();