Harden OTP system: brute-force protection, memory cleanup, and key collision fix

include/server/Config.hpp

@@ -20,8 +20,10 @@
 #ifndef CONFIG_HPP
 #define CONFIG_HPP
 
-#include <nlohmann/json.hpp>
 #include <boost/asio/ip/address.hpp>
+#include <chrono>
+#include <cstdint>
+#include <nlohmann/json.hpp>
 
 namespace server
 {
@@ -131,7 +133,8 @@ class Config
   {
     enum class Source
     {
-      File, Postgres
+      File,
+      Postgres
     } source{Source::File};
 
     struct File
@@ -145,6 +148,14 @@ class Config
     } postgres{};
   } data{};
 
+  //!
+  struct Otp
+  {
+    std::chrono::seconds codeTtl{30};
+    uint32_t maxFailedAttempts{5};
+    std::chrono::seconds purgeInterval{60};
+  } otp{};
+
   //! Loads the config from the environment.
   void LoadFromEnvironment();
   //! Loads the config from the specified file.
@@ -154,4 +165,4 @@ class Config
 
 } // namespace server
 
-#endif // CONFIG_HPP
+#endif // CONFIG_HPP

include/server/chat/PrivateChatDirector.hpp

@@ -14,7 +14,7 @@ namespace server
 {
 
 //! Chat client OTP constant
-constexpr uint32_t PrivateChatOtpConstant = 0x14E05CE5;
+constexpr uint32_t PrivateChatOtpConstant = 0x7C3D91A2;
 
 class ServerInstance;
 

include/server/system/OtpSystem.hpp

@@ -6,31 +6,61 @@
 #define OTPSYSTEM_HPP
 
 #include <chrono>
-#include <random>
+#include <cstddef>
+#include <cstdint>
 #include <mutex>
+#include <random>
 #include <unordered_map>
 
 namespace server
 {
 
+class ServerInstance;
+
 class OtpSystem
 {
 public:
-  uint32_t GrantCode(size_t key);
-  bool AuthorizeCode(size_t key, uint32_t code, bool consume = true);
+  explicit OtpSystem(ServerInstance& serverInstance);
+
+  //! Grants a one-time code for the given key.
+  //! If a code already exists for this key, it is replaced.
+  //! @param key Identity key the code is bound to.
+  //! @return The generated one-time code.
+  [[nodiscard]] uint32_t GrantCode(size_t key);
+
+  //! Authorizes a one-time code for the given key.
+  //! If the code is unsuccessfully authorized multiple times the code is invalidated
+  //! to protect against brute force.
+  //! @param key Identity key the code is bound to.
+  //! @param code The code to verify.
+  //! @param consume If true, the code is consumed (erased) on success.
+  //! @retval `true` if the code is valid
+  //! @retval `false` if the code is invalid.
+  [[nodiscard]] bool AuthorizeCode(size_t key, uint32_t code, bool consume = true);
+
+  //! Removes all expired codes.
+  //! Called automatically on a periodic basis, but can be invoked manually.
+  void PurgeExpired();
 
 private:
+  ServerInstance& _serverInstance;
+
   struct Code
   {
+    //! A time point of when the code expires.
     std::chrono::steady_clock::time_point expiry{};
+    //! A counter of (failed) authorization attempts; code is invalidated after max.
+    size_t authorizationAttempts{};
+    //! A value of the code.
     uint32_t code{};
   };
 
   std::mutex _codesMutex;
-  std::random_device _rd;
+  std::mt19937 _rng;
   std::unordered_map<size_t, Code> _codes;
+  std::chrono::steady_clock::time_point _lastPurge;
 };
 
 } // namespace server
 
-#endif //OTPSYSTEM_HPP
+#endif // OTPSYSTEM_HPP

src/server/Config.cpp

@@ -25,8 +25,8 @@
 #include <format>
 #include <fstream>
 
-#include <yaml-cpp/yaml.h>
 #include <spdlog/spdlog.h>
+#include <yaml-cpp/yaml.h>
 
 namespace server
 {
@@ -48,10 +48,10 @@ void Config::LoadFromEnvironment()
   };
 
   const auto getAddressAndPortVariables = [&getEnvValue](
-    const std::string& addressVariableName,
-    const std::string& portVariableName,
-    asio::ip::address_v4& address,
-    uint16_t& port)
+                                            const std::string& addressVariableName,
+                                            const std::string& portVariableName,
+                                            asio::ip::address_v4& address,
+                                            uint16_t& port)
   {
     try
     {
@@ -150,8 +150,7 @@ void Config::LoadFromFile(const std::filesystem::path& filePath)
     {
       return Listen{
         .address = util::ResolveHostName(node["address"].as<std::string>()),
-        .port = node["port"].as<uint16_t>()
-      };
+        .port = node["port"].as<uint16_t>()};
     }
     catch (const std::exception& e)
     {
@@ -289,6 +288,22 @@ void Config::LoadFromFile(const std::filesystem::path& filePath)
     {
       spdlog::error("Unhandled exception parsing the dat config: {}", e.what());
     }
+
+    // OTP config
+    try
+    {
+      const auto otpYaml = serverYaml["otp"];
+      if (otpYaml)
+      {
+        otp.codeTtl = std::chrono::seconds(otpYaml["code_ttl"].as<int>(30));
+        otp.maxFailedAttempts = otpYaml["max_failed_attempts"].as<uint32_t>(5);
+        otp.purgeInterval = std::chrono::seconds(otpYaml["purge_interval"].as<int>(60));
+      }
+    }
+    catch (const std::exception& e)
+    {
+      spdlog::error("Unhandled exception parsing the OTP config: {}", e.what());
+    }
   }
   catch (const std::exception& e)
   {