OpenPunk/OpenFusion
1
0
Fork 0
mirror of https://github.com/OpenFusionProject/OpenFusion.git synced 2026-02-05 20:30:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refactor login packet handler for more flexible auth (#298)

Browse Source 
This PR enables auth cookies to be used simultaneously with plaintext paasswords sent in the cookie authID field.

* Hoist a bunch of checks from the login packet handler into helper functions.
* Rename the LoginType enum to AuthMethod and distinguish it from the iLoginType packet field (see comment in code for why these should be decoupled).
* If the provided token does not pass the cookie check and password auth is enabled, treat it as a plaintext password and authenticate if it is correct.
This commit is contained in:
Gent Semaj
2024-11-16 20:21:37 -08:00
committed by GitHub
parent 1543dac4e0
commit 55cf3f7102
6 changed files with 161 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
src/db/login.cpp
View File

@@ -1,3 +1,5 @@
#include "core/CNStructs.hpp"
#include "db/internal.hpp"
#include "bcrypt/BCrypt.hpp"
@@ -130,19 +132,21 @@ bool Database::checkCookie(int accountId, const char *tryCookie) {
return false;
}
/*
* since cookies are immediately invalidated, we don't need to be concerned about
* timing-related side channel attacks, so strcmp is fine here
*/
bool match = (strcmp(cookie, tryCookie) == 0);
bool match = (timingSafeStrcmp(cookie, tryCookie) == 0);
sqlite3_finalize(stmt);
sqlite3_prepare_v2(db, sql_invalidate, -1, &stmt, NULL);
sqlite3_bind_int(stmt, 1, accountId);
rc = sqlite3_step(stmt);
sqlite3_finalize(stmt);
if (rc != SQLITE_DONE)
std::cout << "[WARN] Database fail on checkCookie(): " << sqlite3_errmsg(db) << std::endl;
/*
* Only invalidate the cookie if it was correct. This prevents
* replay attacks without enabling DOS attacks on accounts.
*/
if (match) {
sqlite3_prepare_v2(db, sql_invalidate, -1, &stmt, NULL);
sqlite3_bind_int(stmt, 1, accountId);
rc = sqlite3_step(stmt);
sqlite3_finalize(stmt);
if (rc != SQLITE_DONE)
std::cout << "[WARN] Database fail on checkCookie(): " << sqlite3_errmsg(db) << std::endl;
}
return match;
}