octoleo/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2024-12-23 11:29:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Recoded TOTP time drift validation

Browse Source
This commit is contained in:
BlackDex 2019-10-12 15:28:28 +02:00
parent d989a19f76
commit 9466f02696
1 changed files with 24 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
src/api/core/two_factor/authenticator.rs
View File

@ -118,43 +118,32 @@ pub fn validate_totp_code(user_uuid: &str, totp_code: u64, secret: &str, conn: &
let current_time: u64 = SystemTime::now().duration_since(UNIX_EPOCH) let current_time: u64 = SystemTime::now().duration_since(UNIX_EPOCH)
.expect("Earlier than 1970-01-01 00:00:00 UTC").as_secs(); .expect("Earlier than 1970-01-01 00:00:00 UTC").as_secs();
// First check the current time for a valid token. // The amount of steps back and forward in time
let time_step_now = (current_time / 30) as i32; let steps = 1;
let generated_now = totp_raw_custom_time(&decoded_secret, 6, 0, 30, current_time, &HashType::SHA1); for step in -steps..=steps {
if generated_now == totp_code && time_step_now > twofactor.last_used {
twofactor.last_used = time_step_now;
twofactor.save(&conn)?;
return Ok(());
} else if generated_now == totp_code && time_step_now <= twofactor.last_used {
warn!("This or a future TOTP code has already been used!");
err!("Invalid TOTP code!");
}
// Check for time drifted codes let time_step = (current_time / 30) as i32 + step;
// First check the previous TOTP code // We need to calculate the time offsite and cast it as an i128.
let time_step_prev = ((current_time - 30) / 30) as i32; // Else we can't do math with it on a default u64 variable.
let generated_prev = totp_raw_custom_time(&decoded_secret, 6, 0, 30, current_time - 30, &HashType::SHA1); let time_offset: i128 = (step * 30).into();
if generated_prev == totp_code && time_step_prev > twofactor.last_used { let generated = totp_raw_custom_time(&decoded_secret, 6, 0, 30, (current_time as i128 + time_offset) as u64, &HashType::SHA1);
info!("TOTP Time drift detected. Token is valide for one step on the past.");
twofactor.last_used = time_step_prev;
twofactor.save(&conn)?;
return Ok(());
} else if generated_prev == totp_code && time_step_prev <= twofactor.last_used {
warn!("This or a future TOTP code has already been used!");
err!("Invalid TOTP code!");
}
// Second check the next TOTP code // Check the the given code equals the generated and if the time_step is larger then the one last used.
let time_step_next = ((current_time + 30) / 30) as i32; if generated == totp_code && time_step > twofactor.last_used {
let generated_next = totp_raw_custom_time(&decoded_secret, 6, 0, 30, current_time + 30, &HashType::SHA1);
if generated_next == totp_code && time_step_next > twofactor.last_used { // If the step does not equals 0 the time is drifted either server or client side.
info!("TOTP Time drift detected. Token is valide for one step on the future."); if step != 0 {
twofactor.last_used = time_step_next; info!("TOTP Time drift detected. The step offset is {}", step);
twofactor.save(&conn)?; }
return Ok(());
} else if generated_next == totp_code && time_step_next <= twofactor.last_used { // Save the last used time step so only totp time steps higher then this one are allowed.
warn!("This or a previous TOTP code has already been used!"); twofactor.last_used = time_step;
err!("Invalid TOTP code!"); twofactor.save(&conn)?;
return Ok(());
} else if generated == totp_code && time_step <= twofactor.last_used {
warn!("This or a TOTP code within {} steps back and forward has already been used!", steps);
err!("Invalid TOTP Code!");
}
} }
// Else no valide code received, deny access // Else no valide code received, deny access