ReactorcoremeltdownandClaude Opus 5.5
4ffc434b1b
Storage. The server keeps its data in SQLite (a file in the data directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or -database). Every row, the KDBX versions included, is sealed with AES-256-GCM under a key derived from the master key and named by an HMAC. The master key is required to start and a different one is refused. A data directory from 0.10 or earlier is imported on first start. Several servers may share one PostgreSQL database. Go goes to 1.26 for the pure-Go drivers (modernc.org/sqlite, jackc/pgx). Hardening, after an audit of the server, both clients and the deployment: - Single sign-on approves a device only after an explicit Approve in the browser that started it, bound by a cookie and PKCE; identities are never linked by username, by verified email only when allowed, never to admins. - Sign-in attempts are limited per address and per account, passwords are checked outside the store lock with uniform timing, one-time codes work once, and starting two-factor needs the password. - Merge vaults bound KDF parameters, payload size and XML shape, check pushes before storing them, and run at most two merges at once. A version is written in the same transaction as its metadata. - Tokens in URLs only on the event stream, which ends on revocation; CSP, frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases without access; new trusted_proxies. - Clients open only the server's approval page, keep case-variant and retired file names apart, never overwrite a save made during a pull, require https except locally, send the stream token in a header, bound their reads and escape notifications and terminal output. - The .deb creates the master key, systemd is sandboxed further, nginx sets modern TLS and HSTS, and CI deploys from main only. Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
99 lines
2.7 KiB
Go
99 lines
2.7 KiB
Go
// Package totp implements RFC 6238 time-based one-time passwords, the
|
|
// built-in second factor for password logins.
|
|
package totp
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/rand"
|
|
"crypto/sha1"
|
|
"encoding/base32"
|
|
"encoding/binary"
|
|
"fmt"
|
|
"net/url"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
const (
|
|
digits = 6
|
|
step = 30 * time.Second
|
|
// skew is how many steps either side of now are accepted, covering
|
|
// clock drift and a user typing slowly.
|
|
skew = 1
|
|
)
|
|
|
|
// NewSecret returns a fresh base32 secret with no padding, as authenticator
|
|
// apps expect.
|
|
func NewSecret() string {
|
|
b := make([]byte, 20)
|
|
if _, err := rand.Read(b); err != nil {
|
|
panic("totp: " + err.Error())
|
|
}
|
|
return base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(b)
|
|
}
|
|
|
|
// URI is the otpauth:// URL an authenticator app can scan.
|
|
func URI(issuer, account, secret string) string {
|
|
label := url.PathEscape(issuer + ":" + account)
|
|
q := url.Values{"secret": {secret}, "issuer": {issuer}, "algorithm": {"SHA1"},
|
|
"digits": {fmt.Sprint(digits)}, "period": {"30"}}
|
|
return "otpauth://totp/" + label + "?" + q.Encode()
|
|
}
|
|
|
|
// Code is the password for secret at time t.
|
|
func Code(secret string, t time.Time) (string, error) {
|
|
key, err := decode(secret)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return code(key, uint64(t.Unix())/uint64(step.Seconds())), nil
|
|
}
|
|
|
|
// Check reports whether given is a valid password for secret at time t,
|
|
// allowing one step of drift either way.
|
|
func Check(secret, given string, t time.Time) bool {
|
|
_, ok := Match(secret, given, t)
|
|
return ok
|
|
}
|
|
|
|
// Match is Check that also says which time step the code belongs to. A
|
|
// caller that remembers the last step it accepted, and refuses that one and
|
|
// any before it, makes each code good for one use only.
|
|
func Match(secret, given string, t time.Time) (int64, bool) {
|
|
key, err := decode(secret)
|
|
if err != nil {
|
|
return 0, false
|
|
}
|
|
given = strings.TrimSpace(given)
|
|
if len(given) != digits {
|
|
return 0, false
|
|
}
|
|
ctr := uint64(t.Unix()) / uint64(step.Seconds())
|
|
for d := -skew; d <= skew; d++ {
|
|
if hmac.Equal([]byte(code(key, ctr+uint64(d))), []byte(given)) {
|
|
return int64(ctr) + int64(d), true
|
|
}
|
|
}
|
|
return 0, false
|
|
}
|
|
|
|
func decode(secret string) ([]byte, error) {
|
|
s := strings.ToUpper(strings.ReplaceAll(strings.TrimSpace(secret), " ", ""))
|
|
return base32.StdEncoding.WithPadding(base32.NoPadding).DecodeString(s)
|
|
}
|
|
|
|
func code(key []byte, counter uint64) string {
|
|
var buf [8]byte
|
|
binary.BigEndian.PutUint64(buf[:], counter)
|
|
mac := hmac.New(sha1.New, key)
|
|
mac.Write(buf[:])
|
|
sum := mac.Sum(nil)
|
|
off := sum[len(sum)-1] & 0x0f
|
|
trunc := binary.BigEndian.Uint32(sum[off:off+4]) & 0x7fffffff
|
|
mod := uint32(1)
|
|
for i := 0; i < digits; i++ {
|
|
mod *= 10
|
|
}
|
|
return fmt.Sprintf("%0*d", digits, trunc%mod)
|
|
}
|