Cockatrice/libcockatrice_protocol/libcockatrice/protocol/pb/session_commands.proto
BruebachL a139084ad6
Some checks are pending
CodeQL / Analyze (cpp) (push) Waiting to run
CodeQL / Analyze (actions) (push) Waiting to run
Build Desktop / Configure (push) Waiting to run
Build Desktop / Debian 13 (push) Blocked by required conditions
Build Desktop / Debian 12 (push) Blocked by required conditions
Build Desktop / Fedora 44 (push) Blocked by required conditions
Build Desktop / Fedora 43 (push) Blocked by required conditions
Build Desktop / Servatrice_Debian 12 (push) Blocked by required conditions
Build Desktop / Ubuntu 24.04 (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 (push) Blocked by required conditions
Build Desktop / Arch (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 cover (push) Blocked by required conditions
Build Desktop / macOS 13 Intel (push) Blocked by required conditions
Build Desktop / macOS 14 (push) Blocked by required conditions
Build Desktop / macOS 15 (push) Blocked by required conditions
Build Desktop / macOS 26 Debug (push) Blocked by required conditions
Build Desktop / Windows 10 (push) Blocked by required conditions
Build Desktop / Prune caches (push) Waiting to run
Build Docker / Servatrice (arm) (push) Waiting to run
Build Docker / Servatrice (x86) (push) Waiting to run
Build Docker / Publish multi-platform Servatrice image (push) Blocked by required conditions
[Security] Add challenge-response auth with scrypt verifiers and stop storing plaintext passwords (#7193)
* [Security] Add challenge-response auth with scrypt verifiers and stop storing plaintext passwords

Challenge-response authentication: the client derives a scrypt verifier
(RFC 7914, EVP_PBE_scrypt, N=32768, r=8, p=1) and authenticates with
HMAC-SHA256(key, nonce), so neither the password nor its hash is
transmitted. The stored format becomes
"$scrypt$<n>$<r>$<p>$<salt>$<verifier>" and Response_PasswordSalt
now carries the cost parameters. Strict servers only accept scrypt
verifiers; legacy accounts are migrated after a successful login.

Fix #344 for challenge-response servers: a saved profile stores the
derived verifier under the password key instead of the plaintext password.
The connect dialog loads it without revealing it, autoconnect passes it
through, the change-password dialog no longer prefills the old password
field with it, and the client only persists the verifier when
"Save password" is checked.

Took 3 minutes

Took 1 minute

Took 10 seconds

Took 7 minutes

* [Security] Harden credential format acceptance and challenge nonce validation

* [Security] Refuse KDF downgrade; trim profile name and warn on silent credential drop

* [Security] Add SupportsAll ServerOptions enumerator to fix enum validation assert

The server advertised both SupportsPasswordHash (1) and
SupportsChallengeResponseAuth (2) via a bitwise-OR that produced the
value 3, which no enumerator declared. Protobuf's proto2 enum
validation rejects the value in _internal_set_server_options, crashing
servatrice on the debug assertion. Add a SupportsAll = 3 enumerator with
an identical wire value so the bitmask reads unchanged while the value
is now a documented, valid member of the enum.

* [Security] Normalize username when issuing challenge nonce

cmdRequestPasswordSalt bound the challenge nonce to the raw, un-simplified
username while cmdLogin verifies it against the simplified name. A user
who typed leading or trailing whitespace in the username box would be
silently rejected during challenge-response login even with the correct
password. Simplify at the nonce-issuing site so both commands agree on
the normalized name.

Also drive-by formatting: collapse the now single-expression
serverOptions initializer onto one line.

* [Security] Keep an encrypted legacy password backup for old-client logins

Migrating an account to scrypt stranded pre-challenge clients, which can
only present the legacy salt+hash: after migration the server served them
a scrypt salt they cannot use, so the only recovery was a password reset.

When security/legacy_backup_key is configured (64 hex chars,
openssl rand -hex 32), submitPasswordVerifier now seals the legacy
credential with AES-256-GCM under that key before overwriting the row,
storing it in password_legacy_backup with the time it was last used. Old
clients keep working: cmdRequestPasswordSalt serves the backup's 16-char
salt in password_salt so they can derive the legacy hash they were
always able to compute, while new clients derive the verifier from the
new scrypt_salt field, which always carries the verifier salt. The
non-challenge login path accepts the plaintext or legacy hash against
the decrypted backup and refreshes its window; a migrated row with no
usable backup fails closed.

Backups age out so a database dump taken after the window closes never
carries a crackable legacy hash: getUsableLegacyBackup purges on first
use past security/legacy_backup_ttl_days (default 90, clamped 1..3650),
and a six-hourly sweep drops backups idle accounts never touch.
changeUserPassword clears the backup since a new credential invalidates
it. Without a configured key nothing is sealed or purged, so a
temporarily missing key cannot destroy existing backups.

The AAD is the simplified user name on both sides, sealing the blob to
its row so it cannot be moved between accounts. Sealing failures
degrade to the previous lockout behaviour rather than blocking
migration. The columns extend the unmerged 0036->0037 migration, so the
schema version stays 37.

* [Security] Address review: proto compat, plaintext verify, AAD case, strict scope

Fix the two blockers and follow-ups from the 2026-10-16 review:

- Advertise challenge-response in a new supports_challenge_response
  field instead of the ServerOptions enum and drop SupportsAll:
  proto2 enums are closed, so already-released clients parsed
  server_options = 3 as NoOptions and fell back to plaintext
  passwords. server_options stays exactly SupportsPasswordHash
  on the wire; old clients ignore the new field.
- Verify a plaintext password directly against a migrated scrypt
  row with verifyPassword() so email changes (cmdAccountEdit)
  and old clients sending password keep working without a
  legacy backup key. Pre-hashed values are still checked
  against the backup, and its TTL window is refreshed only
  when the backup is what actually matched.
- Use the stored row name as the AES-GCM AAD on both seal
  and open so a login whose case differs from the stored
  name (utf8mb4_unicode_ci) still opens its backup.
- Require challenge-response in strict mode only for
  registered SQL accounts (userExists gate), leaving
  guest/unregistered logins and none/password auth
  methods unaffected.
- Document in servatrice.ini.example that a captured
  legacy hash can take over a not-yet-migrated account
  and that strict only constrains registered SQL
  accounts. Schema version is 38.

* [Security] Raise legacy backup TTL default to 180 days

Gives operators and slow-to-upgrade users a longer downgrade
window for pre-challenge clients before unused encrypted
legacy password backups age out.

* [Security] Fix servatrice.cpp formatting per clang-format-18

* [Security] Add missing forward declaration for Command_SubmitPasswordVerifier

The cmdSubmitPasswordVerifier declaration references the proto-generated
type, which otherwise does not name a type in this header and breaks
every C++ build.

---------

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
Co-authored-by: BruebachL <bruebachl@cockatrice.example>
2026-10-16 22:52:26 +02:00

245 lines
6.6 KiB
Protocol Buffer

syntax = "proto2";
message SessionCommand {
enum SessionCommandType {
PING = 1000;
LOGIN = 1001;
MESSAGE = 1002;
LIST_USERS = 1003;
GET_GAMES_OF_USER = 1004;
GET_USER_INFO = 1005;
ADD_TO_LIST = 1006;
REMOVE_FROM_LIST = 1007;
DECK_LIST = 1008;
DECK_NEW_DIR = 1009;
DECK_DEL_DIR = 1010;
DECK_DEL = 1011;
DECK_DOWNLOAD = 1012;
DECK_UPLOAD = 1013;
LIST_ROOMS = 1014;
JOIN_ROOM = 1015;
REGISTER = 1016;
ACTIVATE = 1017;
ACCOUNT_EDIT = 1018;
ACCOUNT_IMAGE = 1019;
ACCOUNT_PASSWORD = 1020;
FORGOT_PASSWORD_REQUEST = 1021;
FORGOT_PASSWORD_RESET = 1022;
FORGOT_PASSWORD_CHALLENGE = 1023;
REQUEST_PASSWORD_SALT = 1024;
SET_CARD_ART_PARAMS = 1025;
DECK_SHARE_CREATE = 1026;
DECK_SHARE_LIST = 1027;
DECK_SHARE_DOWNLOAD = 1028;
DECK_LIST_OTHER_USER = 1029;
DECK_SET_VISIBILITY = 1030;
DECK_DOWNLOAD_PUBLIC = 1031;
DECK_SHARE_LIST_MINE = 1032;
DECK_SHARE_REMOVE = 1033;
SUBMIT_PASSWORD_VERIFIER = 1034;
REPLAY_LIST = 1100;
REPLAY_DOWNLOAD = 1101;
REPLAY_MODIFY_MATCH = 1102;
REPLAY_DELETE_MATCH = 1103;
REPLAY_GET_CODE = 1104;
REPLAY_SUBMIT_CODE = 1105;
REPORT = 1200;
// 1201-1203 reserved: removed during squash
REPORT_MY_LIST = 1204;
REPORT_ADD_COMMENT = 1205;
REPORT_DETAILS = 1206;
}
extensions 100 to max;
}
message Command_Ping {
extend SessionCommand {
optional Command_Ping ext = 1000;
}
}
message Command_Login {
extend SessionCommand {
optional Command_Login ext = 1001;
}
optional string user_name = 1;
optional string password = 2;
optional string clientid = 3;
optional string clientver = 4;
repeated string clientfeatures = 5;
optional string hashed_password = 6;
}
message Command_Message {
extend SessionCommand {
optional Command_Message ext = 1002;
}
optional string user_name = 1;
optional string message = 2;
}
message Command_ListUsers {
extend SessionCommand {
optional Command_ListUsers ext = 1003;
}
}
message Command_GetGamesOfUser {
extend SessionCommand {
optional Command_GetGamesOfUser ext = 1004;
}
optional string user_name = 1;
}
message Command_GetUserInfo {
extend SessionCommand {
optional Command_GetUserInfo ext = 1005;
}
optional string user_name = 1;
}
message Command_AddToList {
extend SessionCommand {
optional Command_AddToList ext = 1006;
}
optional string list = 1;
optional string user_name = 2;
}
message Command_RemoveFromList {
extend SessionCommand {
optional Command_RemoveFromList ext = 1007;
}
optional string list = 1;
optional string user_name = 2;
}
message Command_ListRooms {
extend SessionCommand {
optional Command_ListRooms ext = 1014;
}
}
message Command_JoinRoom {
extend SessionCommand {
optional Command_JoinRoom ext = 1015;
}
optional uint32 room_id = 1;
}
// User wants to register a new account
message Command_Register {
extend SessionCommand {
optional Command_Register ext = 1016;
}
// User name client wants to register
required string user_name = 1;
// Hashed password to be inserted into database
optional string password = 2;
// Email address of the client for user validation
optional string email = 3;
// gender = 4; // obsolete
// Country code of the user. 2 letter ISO format
optional string country = 5;
optional string real_name = 6;
optional string clientid = 7;
optional string hashed_password = 8;
}
// User wants to activate an account
message Command_Activate {
extend SessionCommand {
optional Command_Activate ext = 1017;
}
// User name client wants to activate
required string user_name = 1;
// Activation token
required string token = 2;
optional string clientid = 3;
}
message Command_AccountEdit {
extend SessionCommand {
optional Command_AccountEdit ext = 1018;
}
optional string real_name = 1;
optional string email = 2;
// gender = 3; // obsolete
optional string country = 4;
optional string password_check = 100; // password is required to change sensitive information
}
message Command_AccountImage {
extend SessionCommand {
optional Command_AccountImage ext = 1019;
}
optional bytes image = 1;
}
message Command_AccountPassword {
extend SessionCommand {
optional Command_AccountPassword ext = 1020;
}
optional string old_password = 1;
optional string new_password = 2;
// optional string hashed_old_password = 3; // we don't want users to steal hashed passwords and change them
optional string hashed_new_password = 4;
}
message Command_ForgotPasswordRequest {
extend SessionCommand {
optional Command_ForgotPasswordRequest ext = 1021;
}
required string user_name = 1;
optional string clientid = 2;
}
message Command_ForgotPasswordReset {
extend SessionCommand {
optional Command_ForgotPasswordReset ext = 1022;
}
required string user_name = 1;
optional string clientid = 2;
optional string token = 3;
optional string new_password = 4;
optional string hashed_new_password = 5;
}
message Command_ForgotPasswordChallenge {
extend SessionCommand {
optional Command_ForgotPasswordChallenge ext = 1023;
}
required string user_name = 1;
optional string clientid = 2;
optional string email = 3;
}
message Command_RequestPasswordSalt {
extend SessionCommand {
optional Command_RequestPasswordSalt ext = 1024;
}
required string user_name = 1;
}
message Command_SetCardArtParams {
extend SessionCommand {
optional Command_SetCardArtParams ext = 1025;
}
optional string card_name = 1;
optional string card_provider_id = 2;
optional double margin_pct_l = 3;
optional double margin_pct_r = 4;
optional double vertical_offset = 5;
optional double zoom = 6;
}
// Client uploads the new password verifier to migrate a legacy account
// after a successful challenge-response login. Idempotent; only applies
// to accounts still using the legacy password format.
message Command_SubmitPasswordVerifier {
extend SessionCommand {
optional Command_SubmitPasswordVerifier ext = 1034;
}
// Full verifier string to store, e.g. "$scrypt$32768$8$1$<salt>$<verifier>"
required string password_verifier = 1;
}