speatzle/go-passbolt
1
0
Fork 0
mirror of https://github.com/passbolt/go-passbolt.git synced 2025-05-10 09:58:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update Login to gopenpgpv3, Simplify login.

Browse source
This commit is contained in:
Samuel Lorch 2025-03-14 14:07:01 +01:00
parent cca7de6c07
commit 8d6a423d9c
2 changed files with 9 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
api/auth.go
View file

@ -7,9 +7,6 @@ import (
"net/http" "net/http"
"net/url" "net/url"
"strings" "strings"
"github.com/ProtonMail/gopenpgp/v2/crypto"
"github.com/ProtonMail/gopenpgp/v2/helper"
) )
// Login is used for login // Login is used for login
@ -33,15 +30,14 @@ func (c *Client) CheckSession(ctx context.Context) bool {
func (c *Client) Login(ctx context.Context) error { func (c *Client) Login(ctx context.Context) error {
c.csrfToken = http.Cookie{} c.csrfToken = http.Cookie{}
if c.userPrivateKey == "" { privateKey, err := c.getPrivateKey(c.userPrivateKey, c.userPassword)
return fmt.Errorf("Client has no Private Key")
}
privateKeyObj, err := crypto.NewKeyFromArmored(c.userPrivateKey)
if err != nil { if err != nil {
return fmt.Errorf("Parsing User Private Key: %w", err) return fmt.Errorf("Parsing User Private Key: %w", err)
} }
data := Login{&GPGAuth{KeyID: privateKeyObj.GetFingerprint()}}
defer privateKey.ClearPrivateParams()
data := Login{&GPGAuth{KeyID: privateKey.GetFingerprint()}}
res, _, err := c.DoCustomRequestAndReturnRawResponse(ctx, "POST", "/auth/login.json", "v2", data, nil) res, _, err := c.DoCustomRequestAndReturnRawResponse(ctx, "POST", "/auth/login.json", "v2", data, nil)
if err != nil && !strings.Contains(err.Error(), "Error API JSON Response Status: Message: The authentication failed.") { if err != nil && !strings.Contains(err.Error(), "Error API JSON Response Status: Message: The authentication failed.") {
@ -62,7 +58,7 @@ func (c *Client) Login(ctx context.Context) error {
} }
encAuthToken = strings.ReplaceAll(encAuthToken, "\\ ", " ") encAuthToken = strings.ReplaceAll(encAuthToken, "\\ ", " ")
authToken, err := helper.DecryptMessageArmored(c.userPrivateKey, c.userPassword, encAuthToken) authToken, err := c.DecryptMessage(encAuthToken)
if err != nil { if err != nil {
return fmt.Errorf("Decrypting User Auth Token: %w", err) return fmt.Errorf("Decrypting User Auth Token: %w", err)
} }
@ -104,29 +100,13 @@ func (c *Client) Login(ctx context.Context) error {
return fmt.Errorf("Getting CSRF Token: %w", err) return fmt.Errorf("Getting CSRF Token: %w", err)
} }
// Get Users Own Public Key from Server // Get Users ID from Server
var user User var user User
err = json.Unmarshal(apiMsg.Body, &user) err = json.Unmarshal(apiMsg.Body, &user)
if err != nil { if err != nil {
return fmt.Errorf("Parsing User 'Me' JSON from API Request: %w", err) return fmt.Errorf("Parsing User 'Me' JSON from API Request: %w", err)
} }
// Validate that this Publickey that the Server gave us actually Matches our Privatekey
randomString := randStringBytesRmndr(50)
armor, err := helper.EncryptMessageArmored(user.GPGKey.ArmoredKey, randomString)
if err != nil {
return fmt.Errorf("Encryping PublicKey Validation Message: %w", err)
}
decrypted, err := helper.DecryptMessageArmored(c.userPrivateKey, c.userPassword, armor)
if err != nil {
return fmt.Errorf("Decrypting PublicKey Validation Message (you might be getting Hacked): %w", err)
}
if decrypted != randomString {
return fmt.Errorf("Decrypted PublicKey Validation Message does not Match Original (you might be getting Hacked): %w", err)
}
// Insert PublicKey into Client after checking it to Prevent ignored errors leading to proceeding with a potentially Malicious PublicKey
c.userPublicKey = user.GPGKey.ArmoredKey
c.userID = user.ID c.userID = user.ID
// after Login, fetch MetadataTypeSettings to finish the Client Setup // after Login, fetch MetadataTypeSettings to finish the Client Setup

4
api/client.go
View file

@ -24,10 +24,10 @@ type Client struct {
csrfToken http.Cookie csrfToken http.Cookie
mfaToken http.Cookie mfaToken http.Cookie
// for some reason []byte is used for Passwords in gopenpgp instead of string like they do for keys... // userPublicKey has been removed since it can be gotten from the private userPrivateKey
userPassword []byte userPassword []byte
userPrivateKey string userPrivateKey string
userPublicKey string
userID string userID string
// Server Settings Determining which Resource Types we can use // Server Settings Determining which Resource Types we can use