jeirmeister/Cockatrice
1
0
Fork 0
mirror of https://github.com/Cockatrice/Cockatrice.git synced 2026-09-28 00:42:19 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Revert "[Security] Add challenge-response auth with scrypt verifiers and stop storing plaintext passwords"

Browse source 
This reverts commit 088e932882.


Took 6 minutes
This commit is contained in:
Lukas Brübach 2026-08-25 20:52:25 +02:00
parent 088e932882
commit 47df709f37
33 changed files with 23 additions and 675 deletions
Download patch file Download diff file Expand all files Collapse all files

96
libcockatrice_network/libcockatrice/network/client/remote/remote_client.cpp
View file

@ -27,8 +27,7 @@ static const unsigned int protocolVersion = 14;
RemoteClient::RemoteClient(QObject *parent, INetworkSettingsProvider *_networkSettingsProvider)
: AbstractClient(parent), networkSettingsProvider(_networkSettingsProvider), timeRunning(0), lastDataReceived(0),
messageInProgress(false), handshakeStarted(false), usingWebSocket(false), messageLength(0), hashedPassword(),
passwordNeedsMigration(false)
messageInProgress(false), handshakeStarted(false), usingWebSocket(false), messageLength(0), hashedPassword()
{
clearNewClientFeatures();
@ -115,8 +114,6 @@ void RemoteClient::processServerIdentificationEvent(const Event_ServerIdentifica
return;
}
serverSupportsPasswordHash = event.server_options() & Event_ServerIdentification::SupportsPasswordHash;
serverSupportsChallengeResponse =
event.server_options() & Event_ServerIdentification::SupportsChallengeResponseAuth;
if (getStatus() == StatusRequestingForgotPassword) {
Command_ForgotPasswordRequest cmdForgotPasswordRequest;
@ -133,10 +130,7 @@ void RemoteClient::processServerIdentificationEvent(const Event_ServerIdentifica
cmdForgotPasswordReset.set_user_name(userName.toStdString());
cmdForgotPasswordReset.set_clientid(getSrvClientID(lastHostname).toStdString());
cmdForgotPasswordReset.set_token(token.toStdString());
if (!password.isEmpty() && serverSupportsChallengeResponse) {
hashedPassword = PasswordHasher::generatePasswordVerifier(password);
cmdForgotPasswordReset.set_hashed_new_password(hashedPassword.toStdString());
} else if (!password.isEmpty() && serverSupportsPasswordHash) {
if (!password.isEmpty() && serverSupportsPasswordHash) {
auto passwordSalt = PasswordHasher::generateRandomSalt();
hashedPassword = PasswordHasher::computeHash(password, passwordSalt);
cmdForgotPasswordReset.set_hashed_new_password(hashedPassword.toStdString());
@ -164,10 +158,7 @@ void RemoteClient::processServerIdentificationEvent(const Event_ServerIdentifica
if (getStatus() == StatusRegistering) {
Command_Register cmdRegister;
cmdRegister.set_user_name(userName.toStdString());
if (!password.isEmpty() && serverSupportsChallengeResponse) {
hashedPassword = PasswordHasher::generatePasswordVerifier(password);
cmdRegister.set_hashed_password(hashedPassword.toStdString());
} else if (!password.isEmpty() && serverSupportsPasswordHash) {
if (!password.isEmpty() && serverSupportsPasswordHash) {
auto passwordSalt = PasswordHasher::generateRandomSalt();
hashedPassword = PasswordHasher::computeHash(password, passwordSalt);
cmdRegister.set_hashed_password(hashedPassword.toStdString());
@ -232,9 +223,7 @@ Command_Login RemoteClient::generateCommandLogin()
void RemoteClient::doLogin()
{
if ((!password.isEmpty() || !storedVerifier.isEmpty()) && serverSupportsChallengeResponse) {
doRequestPasswordSalt(); // ask salt + nonce to build the challenge response
} else if (!password.isEmpty() && serverSupportsPasswordHash) {
if (!password.isEmpty() && serverSupportsPasswordHash) {
//! \todo Store and log in using stored hashed password.
if (hashedPassword.isEmpty()) {
doRequestPasswordSalt(); // ask salt to create hashedPassword, then log in
@ -268,30 +257,6 @@ void RemoteClient::doHashedLogin()
sendCommand(pend);
}
void RemoteClient::doSubmitPasswordVerifier()
{
pendingVerifier = PasswordHasher::generatePasswordVerifier(password);
Command_SubmitPasswordVerifier cmdSubmitVerifier;
cmdSubmitVerifier.set_password_verifier(pendingVerifier.toStdString());
PendingCommand *pend = prepareSessionCommand(cmdSubmitVerifier);
connect(pend, &PendingCommand::finished, this, &RemoteClient::submitPasswordVerifierResponse);
sendCommand(pend);
}
void RemoteClient::submitPasswordVerifierResponse(const Response &response)
{
if (response.response_code() == Response::RespOk) {
qCDebug(RemoteClientLog) << "Password verifier migrated successfully";
if (!pendingVerifier.isEmpty()) {
emit sigPasswordVerifierReady(lastHostname, userName, pendingVerifier);
pendingVerifier.clear();
}
} else {
qCWarning(RemoteClientLog) << "Failed to migrate password verifier:" << response.response_code();
}
}
void RemoteClient::processConnectionClosedEvent(const Event_ConnectionClosed & /*event*/)
{
doDisconnectFromServer();
@ -304,47 +269,7 @@ void RemoteClient::passwordSaltResponse(const Response &response)
auto passwordSalt = QString::fromStdString(resp.password_salt());
if (passwordSalt.isEmpty()) { // the server does not recognize the user but allows them to enter unregistered
password.clear(); // the password will not be used
storedVerifier.clear();
doLogin();
} else if (serverSupportsChallengeResponse && resp.has_nonce()) {
const QByteArray nonce = QByteArray::fromStdString(resp.nonce());
QByteArray key;
if (resp.needs_migration()) {
// The account still uses the legacy format; the legacy full hash
// is only derivable from the plaintext password.
if (password.isEmpty()) {
emit loginError(Response::RespClientUpdateRequired,
QStringLiteral("This account must be logged in with its password once."), 0, {});
return;
}
key = PasswordHasher::computeHash(password, passwordSalt).toUtf8();
} else if (!password.isEmpty()) {
const int n = resp.has_n() ? resp.n() : SCRYPT_N;
const int r = resp.has_r() ? resp.r() : SCRYPT_R;
const int p = resp.has_p() ? resp.p() : SCRYPT_P;
key = PasswordHasher::deriveKey(password, QByteArray::fromBase64(passwordSalt.toUtf8()), n, r, p);
derivedVerifier = QString("$scrypt$%1$%2$%3$%4$%5")
.arg(n)
.arg(r)
.arg(p)
.arg(passwordSalt)
.arg(QString(key.toBase64()));
} else if (!storedVerifier.isEmpty()) {
const PasswordVerifier verifier = PasswordHasher::parsePasswordVerifier(storedVerifier);
if (!verifier.isValid) {
emit loginError(Response::RespClientUpdateRequired, QStringLiteral("Stored verifier is invalid."),
0, {});
return;
}
key = verifier.verifier;
} else {
emit loginError(Response::RespLoginNeeded, {}, 0, {});
return;
}
passwordNeedsMigration = resp.needs_migration();
const QByteArray responseBytes = PasswordHasher::computeResponse(key, nonce);
hashedPassword = "$challenge$" + QString(nonce.toBase64()) + "$" + QString(responseBytes.toBase64());
doHashedLogin();
} else {
hashedPassword = PasswordHasher::computeHash(password, passwordSalt);
doHashedLogin();
@ -369,14 +294,6 @@ void RemoteClient::loginResponse(const Response &response)
setStatus(StatusLoggedIn);
emit userInfoChanged(resp.user_info());
if (passwordNeedsMigration) {
// The account still used the legacy password format; upgrade it to scrypt.
doSubmitPasswordVerifier();
} else if (!derivedVerifier.isEmpty()) {
emit sigPasswordVerifierReady(lastHostname, userName, derivedVerifier);
derivedVerifier.clear();
}
QList<ServerInfo_User> buddyList;
for (int i = resp.buddy_list_size() - 1; i >= 0; --i) {
buddyList.append(resp.buddy_list(i));
@ -632,8 +549,6 @@ void RemoteClient::doDisconnectFromServer()
websocket->close();
}
socket->close();
derivedVerifier.clear();
pendingVerifier.clear();
}
void RemoteClient::ping()
@ -796,9 +711,6 @@ void RemoteClient::submitForgotPasswordResetResponse(const Response &response)
{
if (response.response_code() == Response::RespOk) {
emit sigForgotPasswordSuccess();
if (!hashedPassword.isEmpty()) {
emit sigPasswordVerifierReady(lastHostname, userName, hashedPassword);
}
} else {
emit sigForgotPasswordError();
}

19
libcockatrice_network/libcockatrice/network/client/remote/remote_client.h
View file

@ -54,9 +54,6 @@ signals:
unsigned int port,
const QString &_userName,
const QString &_email);
//! \brief Emitted once a scrypt verifier for the given account is known and
//! can be persisted instead of the plaintext password.
void sigPasswordVerifierReady(const QString &hostname, const QString &userName, const QString &verifier);
private slots:
void slotConnected();
void readData();
@ -83,8 +80,6 @@ private slots:
void doLogin();
void doHashedLogin();
Command_Login generateCommandLogin();
void doSubmitPasswordVerifier();
void submitPasswordVerifierResponse(const Response &response);
void doDisconnectFromServer();
void doActivateToServer(const QString &_token);
void doRequestForgotPasswordToServer(const QString &hostname, unsigned int port, const QString &_userName);
@ -116,14 +111,6 @@ private:
QString lastHostname;
unsigned int lastPort;
QString hashedPassword;
bool passwordNeedsMigration;
//! \brief A previously stored "$scrypt$..." verifier used to authenticate
//! without the plaintext password.
QString storedVerifier;
//! \brief Verifier derived during the current login, persisted after success.
QString derivedVerifier;
//! \brief Verifier sent for migration, persisted once the server accepts it.
QString pendingVerifier;
QString getSrvClientID(const QString &_hostname);
bool newMissingFeatureFound(const QString &_serversMissingFeatures);
@ -162,12 +149,6 @@ public:
}
void
connectToServer(const QString &hostname, unsigned int port, const QString &_userName, const QString &_password);
//! \brief Provide a stored "$scrypt$..." verifier so the client can
//! authenticate without the plaintext password.
void setStoredVerifier(const QString &verifier)
{
storedVerifier = verifier;
}
void registerToServer(const QString &hostname,
unsigned int port,
const QString &_userName,