Meishin/LoginSystem
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add 2fa support

Browse Source
This commit is contained in:
games647
2016-02-06 23:21:45 +01:00
parent 31c3588378
commit 6a75184ad9
32 changed files with 201 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/fr/xephi/authme/command/executable/register/RegisterCommand.java
+12
View File
@@ -4,9 +4,11 @@ import fr.xephi.authme.command.CommandService;
import fr.xephi.authme.command.PlayerCommand;
import fr.xephi.authme.output.MessageKey;
import fr.xephi.authme.process.Management;
import fr.xephi.authme.security.HashAlgorithm;
import fr.xephi.authme.security.RandomString;
import fr.xephi.authme.settings.Settings;
import fr.xephi.authme.util.Utils;
import org.bukkit.entity.Player;
import java.util.List;
@@ -15,6 +17,12 @@ public class RegisterCommand extends PlayerCommand {
@Override
public void runCommand(Player player, List<String> arguments, CommandService commandService) {
if (Settings.getPasswordHash == HashAlgorithm.TWO_FACTOR) {
//for two factor auth we don't need to check the usage
commandService.getManagement().performRegister(player, "", "");
return;
}
if (arguments.isEmpty() || Settings.enablePasswordConfirmation && arguments.size() < 2) {
commandService.send(player, MessageKey.USAGE_REGISTER);
return;
@@ -26,19 +34,23 @@ public class RegisterCommand extends PlayerCommand {
commandService.send(player, MessageKey.USAGE_REGISTER);
return;
}
final String email = arguments.get(0);
if (!Utils.isEmailCorrect(email, commandService.getSettings())) {
commandService.send(player, MessageKey.INVALID_EMAIL);
return;
}
final String thePass = RandomString.generate(Settings.getRecoveryPassLength);
management.performRegister(player, thePass, email);
return;
}
if (arguments.size() > 1 && Settings.enablePasswordConfirmation && !arguments.get(0).equals(arguments.get(1))) {
commandService.send(player, MessageKey.PASSWORD_MATCH_ERROR);
return;
}
management.performRegister(player, arguments.get(0), "");
}
src/main/java/fr/xephi/authme/output/MessageKey.java
+2 -1
View File
@@ -123,8 +123,9 @@ public enum MessageKey {
ANTIBOT_AUTO_DISABLED_MESSAGE("antibot_auto_disabled", "%m"),
EMAIL_ALREADY_USED_ERROR("email_already_used");
EMAIL_ALREADY_USED_ERROR("email_already_used"),
TWO_FACTOR_CREATE("two_factor_create", "%code", "%url");
private String key;
private String[] tags;
src/main/java/fr/xephi/authme/process/register/AsyncRegister.java
+32 -13
View File
@@ -8,9 +8,12 @@ import fr.xephi.authme.datasource.DataSource;
import fr.xephi.authme.output.MessageKey;
import fr.xephi.authme.output.Messages;
import fr.xephi.authme.permission.PlayerPermission;
import fr.xephi.authme.security.HashAlgorithm;
import fr.xephi.authme.security.crypts.HashedPassword;
import fr.xephi.authme.security.crypts.TwoFactor;
import fr.xephi.authme.settings.NewSetting;
import fr.xephi.authme.settings.Settings;
import org.bukkit.Bukkit;
import org.bukkit.entity.Player;
/**
@@ -48,19 +51,27 @@ public class AsyncRegister {
} else if (!Settings.isRegistrationEnabled) {
m.send(player, MessageKey.REGISTRATION_DISABLED);
return false;
} else if (!passLow.matches(Settings.getPassRegex)) {
m.send(player, MessageKey.PASSWORD_MATCH_ERROR);
return false;
} else if (passLow.equalsIgnoreCase(player.getName())) {
m.send(player, MessageKey.PASSWORD_IS_USERNAME_ERROR);
return false;
} else if (password.length() < Settings.getPasswordMinLen || password.length() > Settings.passwordMaxLength) {
m.send(player, MessageKey.INVALID_PASSWORD_LENGTH);
return false;
} else if (!Settings.unsafePasswords.isEmpty() && Settings.unsafePasswords.contains(password.toLowerCase())) {
m.send(player, MessageKey.PASSWORD_UNSAFE_ERROR);
return false;
} else if (database.isAuthAvailable(name)) {
}
//check the password safety only if it's not a automatically generated password
if (Settings.getPasswordHash != HashAlgorithm.TWO_FACTOR) {
if (!passLow.matches(Settings.getPassRegex)) {
m.send(player, MessageKey.PASSWORD_MATCH_ERROR);
return false;
} else if (passLow.equalsIgnoreCase(player.getName())) {
m.send(player, MessageKey.PASSWORD_IS_USERNAME_ERROR);
return false;
} else if (password.length() < Settings.getPasswordMinLen || password.length() > Settings.passwordMaxLength) {
m.send(player, MessageKey.INVALID_PASSWORD_LENGTH);
return false;
} else if (!Settings.unsafePasswords.isEmpty() && Settings.unsafePasswords.contains(password.toLowerCase())) {
m.send(player, MessageKey.PASSWORD_UNSAFE_ERROR);
return false;
}
}
//check this in both possiblities so don't use 'else if'
if (database.isAuthAvailable(name)) {
m.send(player, MessageKey.NAME_ALREADY_REGISTERED);
return false;
} else if (Settings.getmaxRegPerIp > 0
@@ -133,14 +144,22 @@ public class AsyncRegister {
m.send(player, MessageKey.ERROR);
return;
}
if (!Settings.forceRegLogin) {
//PlayerCache.getInstance().addPlayer(auth);
//database.setLogged(name);
// TODO: check this...
plugin.getManagement().performLogin(player, "dontneed", true);
}
plugin.otherAccounts.addPlayer(player.getUniqueId());
ProcessSyncPasswordRegister sync = new ProcessSyncPasswordRegister(player, plugin, settings);
plugin.getServer().getScheduler().scheduleSyncDelayedTask(plugin, sync);
//give the user the secret code to setup their app code generation
if (Settings.getPasswordHash == HashAlgorithm.TWO_FACTOR) {
String qrCodeUrl = TwoFactor.getQRBarcodeURL(player.getName(), Bukkit.getIp(), hashedPassword.getHash());
m.send(player, MessageKey.TWO_FACTOR_CREATE, hashedPassword.getHash(), qrCodeUrl);
}
}
}
src/main/java/fr/xephi/authme/security/HashAlgorithm.java
+1
View File
@@ -29,6 +29,7 @@ public enum HashAlgorithm {
SHA1(fr.xephi.authme.security.crypts.SHA1.class),
SHA256(fr.xephi.authme.security.crypts.SHA256.class),
SHA512(fr.xephi.authme.security.crypts.SHA512.class),
TWO_FACTOR(fr.xephi.authme.security.crypts.TwoFactor.class),
SMF(fr.xephi.authme.security.crypts.SMF.class),
WBB3(fr.xephi.authme.security.crypts.WBB3.class),
WBB4(fr.xephi.authme.security.crypts.WBB4.class),
src/main/java/fr/xephi/authme/security/crypts/TwoFactor.java
+125
View File
@@ -0,0 +1,125 @@
package fr.xephi.authme.security.crypts;
import com.google.common.escape.Escaper;
import com.google.common.io.BaseEncoding;
import com.google.common.net.UrlEscapers;
import com.google.common.primitives.Ints;
import fr.xephi.authme.security.crypts.description.HasSalt;
import fr.xephi.authme.security.crypts.description.Recommendation;
import fr.xephi.authme.security.crypts.description.SaltType;
import fr.xephi.authme.security.crypts.description.Usage;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.Arrays;
import java.util.Calendar;
import java.util.concurrent.TimeUnit;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
@Recommendation(Usage.DOES_NOT_WORK)
@HasSalt(SaltType.NONE)
public class TwoFactor extends UnsaltedMethod {
private static final int SCRET_BYTE = 10;
private static final int SCRATCH_CODES = 5;
private static final int BYTES_PER_SCRATCH_CODE = 4;
private static final int TIME_PRECISION = 3;
private static final String CRYPTO_ALGO = "HmacSHA1";
public static String getQRBarcodeURL(String user, String host, String secret) {
String format = "https://www.google.com/chart?chs=130x130&chld=M%%7C0&cht=qr&chl="
+ "otpauth://totp/"
+ "%s@%s%%3Fsecret%%3D%s";
Escaper urlEscaper = UrlEscapers.urlFragmentEscaper();
return String.format(format, urlEscaper.escape(user), urlEscaper.escape(host), secret);
}
@Override
public String computeHash(String password) {
// Allocating the buffer
byte[] buffer = new byte[SCRET_BYTE + SCRATCH_CODES * BYTES_PER_SCRATCH_CODE];
// Filling the buffer with random numbers.
// Notice: you want to reuse the same random generator
// while generating larger random number sequences.
new SecureRandom().nextBytes(buffer);
// Getting the key and converting it to Base32
byte[] secretKey = Arrays.copyOf(buffer, SCRET_BYTE);
return BaseEncoding.base32().encode(secretKey);
}
@Override
public boolean comparePassword(String password, HashedPassword hashedPassword, String name) {
try {
return checkPassword(hashedPassword.getHash(), password);
} catch (NoSuchAlgorithmException | InvalidKeyException encryptionException) {
throw new UnsupportedOperationException("Failed to compare passwords", encryptionException);
}
}
public boolean checkPassword(String secretKey, String userInput)
throws NoSuchAlgorithmException, InvalidKeyException {
Integer code = Ints.tryParse(userInput);
if (code == null) {
//code is not an integer
return false;
}
long currentTime = Calendar.getInstance().getTimeInMillis() / TimeUnit.SECONDS.toMillis(30);
return check_code(secretKey, code, currentTime);
}
private boolean check_code(String secret, long code, long t)
throws NoSuchAlgorithmException, InvalidKeyException {
byte[] decodedKey = BaseEncoding.base32().decode(secret);
// Window is used to check codes generated in the near past.
// You can use this value to tune how far you're willing to go.
int window = TIME_PRECISION;
for (int i = -window; i <= window; ++i) {
long hash = verify_code(decodedKey, t + i);
if (hash == code) {
return true;
}
}
// The validation code is invalid.
return false;
}
private int verify_code(byte[] key, long t) throws NoSuchAlgorithmException, InvalidKeyException {
byte[] data = new byte[8];
long value = t;
for (int i = 8; i-- > 0; value >>>= 8) {
data[i] = (byte) value;
}
SecretKeySpec signKey = new SecretKeySpec(key, CRYPTO_ALGO);
Mac mac = Mac.getInstance(CRYPTO_ALGO);
mac.init(signKey);
byte[] hash = mac.doFinal(data);
int offset = hash[20 - 1] & 0xF;
// We're using a long because Java hasn't got unsigned int.
long truncatedHash = 0;
for (int i = 0; i < 4; ++i) {
truncatedHash <<= 8;
// We are dealing with signed bytes:
// we just keep the first byte.
truncatedHash |= (hash[offset + i] & 0xFF);
}
truncatedHash &= 0x7FFF_FFFF;
truncatedHash %= 1_000_000;
return (int) truncatedHash;
}
}
src/main/java/fr/xephi/authme/settings/properties/SecuritySettings.java
+1
View File
@@ -9,6 +9,7 @@ import java.util.List;
import static fr.xephi.authme.settings.domain.Property.newProperty;
import static fr.xephi.authme.settings.domain.PropertyType.STRING_LIST;
import static fr.xephi.authme.settings.domain.Property.newProperty;
public class SecuritySettings implements SettingsClass {