feat: Phase 1 WinAuth Go 移植完整实现
将原 C#/.NET WinAuth 移植为 Go + Gio GUI，覆盖 Phase 1 全部功能。 核心模块： - internal/authenticator: TOTP (Google/Microsoft/Okta) + HOTP + BattleNet + Steam，含 enroll/sync/code 生成、Steam 交易确认轮询 - internal/config: YAML 配置 + 老版 WinAuth XML 导入（DPAPI + Password + Blowfish/PBKDF2 解密链） - internal/crypto: 现代加密 (WAGO1) + DPAPI 跨平台封装 + 老版 Blowfish ECB - internal/win32: 单实例 Mutex 锁 + 全局热键管理器 (RegisterHotKey + PeekMessage 泵) + SendInput Unicode 注入 + 剪贴板文本/CF_DIB 图像读写 + AttachThreadInput 焦点切换 - internal/hotkey: "Ctrl+Alt+G" 风格快捷键字符串解析/格式化 - internal/qr: gozxing 二维码解码 + otpauth:// URI 解析 - internal/i18n: en/zh-CN/de 三语 TOML UI 模块 (Gio)： - 主窗口：圆环倒计时进度条、复制按钮 + Toast 反馈、空列表占位、行分隔线 - 添加流程：vendor 菜单 + 各 vendor 独立对话框 + 二维码扫描入口（文件 / 剪贴板） - 设置：密码加密、老版 XML 导入、每条目热键配置 - Steam：注册向导（含 captcha/email/SMS 多步）+ 交易确认窗 构建：Windows 主目标，非 Windows 平台所有 Win32 功能走 build-tag 桩实现。
This commit is contained in:
@@ -0,0 +1,177 @@
|
||||
package authenticator
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/hmac"
|
||||
"crypto/sha1"
|
||||
"encoding/binary"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"git.wxccs.org/iceking2nd/winauth-go/internal/global"
|
||||
"git.wxccs.org/iceking2nd/winauth-go/internal/httpc"
|
||||
)
|
||||
|
||||
// steamChars is the alphanumeric alphabet that Steam Guard maps the
|
||||
// truncated HMAC into. It deliberately omits visually similar characters.
|
||||
var steamChars = []byte{
|
||||
'2', '3', '4', '5', '6', '7', '8', '9', 'B', 'C',
|
||||
'D', 'F', 'G', 'H', 'J', 'K', 'M', 'N', 'P', 'Q',
|
||||
'R', 'T', 'V', 'W', 'X', 'Y',
|
||||
}
|
||||
|
||||
const (
|
||||
steamCodeDigits = 5
|
||||
steamQueryTime = "https://api.steampowered.com:443/ITwoFactorService/QueryTime/v0001"
|
||||
)
|
||||
|
||||
// SteamAuthenticator implements Steam Guard's variant of TOTP. Full
|
||||
// enrollment / login / session handling will be added in a later phase;
|
||||
// this file covers code generation, time sync, and persistence — enough
|
||||
// for an already-enrolled authenticator imported from the original WinAuth
|
||||
// config to keep working.
|
||||
type SteamAuthenticator struct {
|
||||
Base
|
||||
Serial string
|
||||
DeviceID string
|
||||
SteamData string // JSON blob from FinalizeAddAuthenticator
|
||||
SessionData string // optional cookie/session JSON
|
||||
}
|
||||
|
||||
// NewSteamAuthenticator returns a fresh 5-character Steam Guard authenticator.
|
||||
func NewSteamAuthenticator() *SteamAuthenticator {
|
||||
s := &SteamAuthenticator{Base: NewBase()}
|
||||
s.CodeDigits = steamCodeDigits
|
||||
return s
|
||||
}
|
||||
|
||||
// Name returns the short logger tag for this type.
|
||||
func (s *SteamAuthenticator) Name() string { return "steam" }
|
||||
|
||||
// CurrentCode returns the current 5-char Steam Guard code.
|
||||
func (s *SteamAuthenticator) CurrentCode() (string, error) {
|
||||
if s.SecretKey == nil {
|
||||
return "", fmt.Errorf("steam: no secret loaded")
|
||||
}
|
||||
return s.steamCode(), nil
|
||||
}
|
||||
|
||||
// steamCode mirrors the C# CalculateCode override, mapping a 4-byte
|
||||
// truncation into the Steam alphabet.
|
||||
func (s *SteamAuthenticator) steamCode() string {
|
||||
mac := hmac.New(sha1.New, s.SecretKey)
|
||||
var counter [8]byte
|
||||
binary.BigEndian.PutUint64(counter[:], s.CodeInterval())
|
||||
_, _ = mac.Write(counter[:])
|
||||
sum := mac.Sum(nil)
|
||||
|
||||
start := sum[len(sum)-1] & 0x0F
|
||||
full := binary.BigEndian.Uint32(sum[start:start+4]) & 0x7FFFFFFF
|
||||
|
||||
out := make([]byte, steamCodeDigits)
|
||||
for i := 0; i < steamCodeDigits; i++ {
|
||||
out[i] = steamChars[full%uint32(len(steamChars))]
|
||||
full /= uint32(len(steamChars))
|
||||
}
|
||||
return string(out)
|
||||
}
|
||||
|
||||
// Sync hits the Steam ITwoFactorService/QueryTime endpoint to recompute
|
||||
// the local-vs-server clock offset.
|
||||
func (s *SteamAuthenticator) Sync() error {
|
||||
const fn = "internal.authenticator.SteamAuthenticator.Sync"
|
||||
logger := global.Log.WithField("func", fn)
|
||||
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||
defer cancel()
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost, steamQueryTime,
|
||||
strings.NewReader("steamid=0"))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
|
||||
resp, err := httpc.New().Do(req)
|
||||
if err != nil {
|
||||
logger.WithError(err).Warn("query time failed; using local clock")
|
||||
return nil
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
var parsed struct {
|
||||
Response struct {
|
||||
ServerTime json.Number `json:"server_time"`
|
||||
} `json:"response"`
|
||||
}
|
||||
if err := json.Unmarshal(body, &parsed); err != nil {
|
||||
logger.WithError(err).Warn("query time: invalid JSON")
|
||||
return nil
|
||||
}
|
||||
serverSec, err := strconv.ParseInt(string(parsed.Response.ServerTime), 10, 64)
|
||||
if err != nil {
|
||||
logger.WithError(err).Warn("query time: bad server_time")
|
||||
return nil
|
||||
}
|
||||
s.ServerTimeDiff = serverSec*1000 - NowMillis()
|
||||
s.LastServerTime = NowMillis()
|
||||
logger.WithField("offset_ms", s.ServerTimeDiff).Debug("clock synced")
|
||||
return nil
|
||||
}
|
||||
|
||||
// SecretData encodes the Steam-specific payload as "<base>|<serialhex>|<deviceidhex>|<steamdatahex>|<sessionhex>".
|
||||
func (s *SteamAuthenticator) SecretData() string {
|
||||
enc := func(v string) string { return strings.ToUpper(hex.EncodeToString([]byte(v))) }
|
||||
return s.EncodeSecretData() + "|" +
|
||||
enc(s.Serial) + "|" +
|
||||
enc(s.DeviceID) + "|" +
|
||||
enc(s.SteamData) + "|" +
|
||||
enc(s.SessionData)
|
||||
}
|
||||
|
||||
// SetSecretData reverses SecretData.
|
||||
func (s *SteamAuthenticator) SetSecretData(value string) error {
|
||||
if value == "" {
|
||||
s.SecretKey = nil
|
||||
s.Serial = ""
|
||||
s.DeviceID = ""
|
||||
s.SteamData = ""
|
||||
s.SessionData = ""
|
||||
return nil
|
||||
}
|
||||
parts := strings.Split(value, "|")
|
||||
if err := s.DecodeSecretData(parts[0]); err != nil {
|
||||
return err
|
||||
}
|
||||
dec := func(s string) string {
|
||||
raw, _ := hex.DecodeString(s)
|
||||
return string(raw)
|
||||
}
|
||||
if len(parts) > 1 {
|
||||
s.Serial = dec(parts[1])
|
||||
}
|
||||
if len(parts) > 2 {
|
||||
s.DeviceID = dec(parts[2])
|
||||
}
|
||||
if len(parts) > 3 {
|
||||
s.SteamData = dec(parts[3])
|
||||
if s.SteamData != "" && !strings.HasPrefix(s.SteamData, "{") {
|
||||
// legacy WinAuth stored only the revocation_code; wrap to JSON
|
||||
s.SteamData = `{"revocation_code":"` + s.SteamData + `"}`
|
||||
}
|
||||
}
|
||||
if len(parts) > 4 {
|
||||
s.SessionData = dec(parts[4])
|
||||
}
|
||||
return nil
|
||||
}
|
||||
Reference in New Issue
Block a user