mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-11-13 08:35:00 +03:00
Aleksey Fedorov
7367ff75cd
gotp decodes the stored secret with strict base32 and panics when that fails, so a 2FA secret saved through the settings API in lower case, grouped by spaces, or not base32 at all turned every login and every attempt to turn 2FA off into an HTTP 500. An empty secret had the opposite problem: the login check accepted the code of an empty HMAC key, which anyone can compute. VerifyWithSkew now normalizes the secret and verifies nothing for an empty or non-base32 one, so secrets already stored in a display form work again. Turning 2FA on through the settings update stores the normalized secret and refuses one no authenticator could match.
41 lines
1.2 KiB
Go
41 lines
1.2 KiB
Go
package totp
|
|
|
|
import (
|
|
"encoding/base32"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/xlzd/gotp"
|
|
)
|
|
|
|
// SkewWindows is how many 30s steps around now VerifyWithSkew accepts.
|
|
// Standard TOTP clock-drift tolerance, see MHSanaei/3x-ui#6535.
|
|
const SkewWindows = 1
|
|
|
|
// NormalizeSecret turns a base32 key as authenticator apps show it (lower case,
|
|
// grouped by spaces, padded) into the bare upper-case form gotp decodes.
|
|
func NormalizeSecret(secret string) string {
|
|
return strings.TrimRight(strings.ToUpper(strings.Join(strings.Fields(secret), "")), "=")
|
|
}
|
|
|
|
// ValidSecret reports whether secret is a non-empty base32 key once normalized.
|
|
func ValidSecret(secret string) bool {
|
|
key, err := base32.StdEncoding.WithPadding(base32.NoPadding).DecodeString(NormalizeSecret(secret))
|
|
return err == nil && len(key) > 0
|
|
}
|
|
|
|
// VerifyWithSkew accepts the code for the current step plus/minus SkewWindows.
|
|
// An empty or non-base32 secret verifies nothing (gotp panics on the latter).
|
|
func VerifyWithSkew(secret, code string, now time.Time) bool {
|
|
if !ValidSecret(secret) {
|
|
return false
|
|
}
|
|
totp := gotp.NewDefaultTOTP(NormalizeSecret(secret))
|
|
for i := -SkewWindows; i <= SkewWindows; i++ {
|
|
if totp.AtTime(now.Add(time.Duration(i*30)*time.Second)) == code {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|