mirrors_public/schollz_croc
1
1
Fork 0
mirror of https://github.com/schollz/croc.git synced 2025-10-10 21:01:02 +02:00
Code Activity

check password hash, not password

Browse source
This commit is contained in:
Zack Scholl 2021-04-23 09:43:19 -07:00
parent 5b0883e1fe
commit 42d8980ba4
1 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/tcp/tcp.go
View file

@ -10,6 +10,7 @@ import (
log "github.com/schollz/logger" log "github.com/schollz/logger"
"github.com/schollz/pake/v3" "github.com/schollz/pake/v3"
"golang.org/x/crypto/bcrypt"
"github.com/schollz/croc/v9/src/comm" "github.com/schollz/croc/v9/src/comm"
"github.com/schollz/croc/v9/src/crypt" "github.com/schollz/croc/v9/src/crypt"
@ -190,15 +191,15 @@ func (s *server) clientCommunication(port string, c *comm.Comm) (room string, er
} }
log.Debugf("waiting for password") log.Debugf("waiting for password")
passwordBytesEnc, err := c.Receive() passwordHashBytesEnc, err := c.Receive()
if err != nil { if err != nil {
return return
} }
passwordBytes, err := crypt.Decrypt(passwordBytesEnc, strongKeyForEncryption) passwordHashBytes, err := crypt.Decrypt(passwordHashBytesEnc, strongKeyForEncryption)
if err != nil { if err != nil {
return return
} }
if strings.TrimSpace(string(passwordBytes)) != s.password { if bcrypt.CompareHashAndPassword(passwordHashBytes, []byte(s.password)) != nil {
err = fmt.Errorf("bad password") err = fmt.Errorf("bad password")
enc, _ := crypt.Decrypt([]byte(err.Error()), strongKeyForEncryption) enc, _ := crypt.Decrypt([]byte(err.Error()), strongKeyForEncryption)
if err := c.Send(enc); err != nil { if err := c.Send(enc); err != nil {
@ -448,8 +449,12 @@ func ConnectToTCPServer(address, password, room string, timelimit ...time.Durati
return return
} }
log.Debug("sending password") log.Debug("sending password hash")
bSend, err := crypt.Encrypt([]byte(password), strongKeyForEncryption) passwordHash, err := bcrypt.GenerateFromPassword([]byte(password), 10)
if err != nil {
return
}
bSend, err := crypt.Encrypt(passwordHash, strongKeyForEncryption)
if err != nil { if err != nil {
return return
} }