mirrors/0ad
1
0
Fork 2
mirror of https://gitea.wildfiregames.com/0ad/0ad.git synced 2026-10-14 07:17:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Additional entropy when hashing match passwords.

Browse Source 
The purpose of our client-side hashing for lobby game passwords is to
prevent malicious hosts from getting valuable passwords from clients
(e.g. accidentally typing their lobby password instead of the game, or
even their email password, etc).
However, the hashing was deterministic (and rather simple), making it
possible to compute rainbow tables and recover user passwords anyways.

By adding more variation, including some that cannot so easily be
controlled by the host (the client name), this becomes impractical. The
password hashing function used is rather fast, but given the base low
probability of mistypes, this seems fine.

Differential Revision: https://code.wildfiregames.com/D3459
This was SVN commit r25459.
This commit is contained in:
wraitii
2021-05-18 14:47:36 +00:00
parent 40f9372d29
commit 7bfcd9f78b
13 changed files with 221 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/network/NetServer.cpp
+11 -3
View File
@@ -31,6 +31,7 @@
#include "ps/CLogger.h"
#include "ps/ConfigDB.h"
#include "ps/GUID.h"
#include "ps/Hashing.h"
#include "ps/Profile.h"
#include "ps/Threading.h"
#include "scriptinterface/ScriptContext.h"
@@ -206,6 +207,12 @@ void CNetServerWorker::SetControllerSecret(const std::string& secret)
}
bool CNetServerWorker::CheckPassword(const std::string& password, const std::string& salt) const
{
return HashCryptographically(m_Password, salt) == password;
}
bool CNetServerWorker::SetupConnection(const u16 port)
{
ENSURE(m_State == SERVER_STATE_UNCONNECTED);
@@ -999,7 +1006,8 @@ bool CNetServerWorker::OnAuthenticate(void* context, CFsmEvent* event)
}
// Check the password before anything else.
if (server.m_Password != message->m_Password)
// NB: m_Name must match the client's salt, @see CNetClient::SetGamePassword
if (!server.CheckPassword(message->m_Password, message->m_Name.ToUTF8()))
{
// Noisy logerror because players are not supposed to be able to get the IP,
// so this might be someone targeting the host for some reason
@@ -1674,10 +1682,10 @@ bool CNetServer::SetConnectionDataViaSTUN()
return StunClient::FindPublicIP(*m_Worker->m_Host, m_PublicIp, m_PublicPort);
}
bool CNetServer::CheckPasswordAndIncrement(const CStr& password, const std::string& username)
bool CNetServer::CheckPasswordAndIncrement(const std::string& username, const std::string& password, const std::string& salt)
{
std::unordered_map<std::string, int>::iterator it = m_FailedAttempts.find(username);
if (m_Password == password)
if (m_Worker->CheckPassword(password, salt))
{
if (it != m_FailedAttempts.end())
it->second = 0;