feat: Phase 1 WinAuth Go 移植完整实现
将原 C#/.NET WinAuth 移植为 Go + Gio GUI，覆盖 Phase 1 全部功能。 核心模块： - internal/authenticator: TOTP (Google/Microsoft/Okta) + HOTP + BattleNet + Steam，含 enroll/sync/code 生成、Steam 交易确认轮询 - internal/config: YAML 配置 + 老版 WinAuth XML 导入（DPAPI + Password + Blowfish/PBKDF2 解密链） - internal/crypto: 现代加密 (WAGO1) + DPAPI 跨平台封装 + 老版 Blowfish ECB - internal/win32: 单实例 Mutex 锁 + 全局热键管理器 (RegisterHotKey + PeekMessage 泵) + SendInput Unicode 注入 + 剪贴板文本/CF_DIB 图像读写 + AttachThreadInput 焦点切换 - internal/hotkey: "Ctrl+Alt+G" 风格快捷键字符串解析/格式化 - internal/qr: gozxing 二维码解码 + otpauth:// URI 解析 - internal/i18n: en/zh-CN/de 三语 TOML UI 模块 (Gio)： - 主窗口：圆环倒计时进度条、复制按钮 + Toast 反馈、空列表占位、行分隔线 - 添加流程：vendor 菜单 + 各 vendor 独立对话框 + 二维码扫描入口（文件 / 剪贴板） - 设置：密码加密、老版 XML 导入、每条目热键配置 - Steam：注册向导（含 captcha/email/SMS 多步）+ 交易确认窗 构建：Windows 主目标，非 Windows 平台所有 Win32 功能走 build-tag 桩实现。
This commit is contained in:
@@ -0,0 +1,251 @@
|
||||
package authenticator
|
||||
|
||||
import (
|
||||
"compress/gzip"
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/cookiejar"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"git.wxccs.org/iceking2nd/winauth-go/internal/global"
|
||||
)
|
||||
|
||||
// Steam base URLs. Kept as vars (not consts) so tests can override.
|
||||
var (
|
||||
steamCommunityBase = "https://steamcommunity.com"
|
||||
steamWebAPIBase = "https://api.steampowered.com"
|
||||
)
|
||||
|
||||
// steamMobileUserAgent is the exact UA the original WinAuth uses, chosen
|
||||
// so that Steam's mobile login endpoint accepts the request as coming
|
||||
// from the official Android app. Changing this without testing tends to
|
||||
// trigger captcha or outright rejection.
|
||||
const steamMobileUserAgent = "Mozilla/5.0 (Linux; U; Android 4.1.1; en-us; Google Nexus 4 - 4.1.1 - API 16 - 768x1280 Build/JRO03S) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30"
|
||||
|
||||
// steamOAuthClientID / steamOAuthScope are the constants the mobile app
|
||||
// sends to /mobilelogin. Do not log them — they are not secret, but
|
||||
// keeping the redact list short reduces accidents.
|
||||
const (
|
||||
steamOAuthClientID = "DE45CD61"
|
||||
steamOAuthScope = "read_profile write_profile read_client write_client"
|
||||
)
|
||||
|
||||
// steamFormFieldsToRedact lists the form keys that must never appear in
|
||||
// logs. The HTTP layer prints request body at debug only after filtering
|
||||
// these out.
|
||||
var steamFormFieldsToRedact = map[string]struct{}{
|
||||
"password": {},
|
||||
"access_token": {},
|
||||
"oauth_token": {},
|
||||
"twofactorcode": {},
|
||||
"emailauth": {},
|
||||
"shared_secret": {},
|
||||
"identity_secret": {},
|
||||
"revocation_code": {},
|
||||
"authenticator_code": {},
|
||||
"activation_code": {},
|
||||
}
|
||||
|
||||
// newSteamCookieJar returns a cookie jar pre-loaded with the constant
|
||||
// cookies the original mobile login flow needs before its first request.
|
||||
func newSteamCookieJar() (http.CookieJar, error) {
|
||||
jar, err := cookiejar.New(nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
u, _ := url.Parse(steamCommunityBase + "/")
|
||||
jar.SetCookies(u, []*http.Cookie{
|
||||
{Name: "mobileClientVersion", Value: "3067969+%282.1.3%29"},
|
||||
{Name: "mobileClient", Value: "android"},
|
||||
{Name: "steamid", Value: ""},
|
||||
{Name: "steamLogin", Value: ""},
|
||||
{Name: "Steam_Language", Value: "english"},
|
||||
{Name: "dob", Value: ""},
|
||||
})
|
||||
return jar, nil
|
||||
}
|
||||
|
||||
// steamHTTPClient returns a fresh http.Client that uses the given jar
|
||||
// and a 30s timeout. We intentionally do NOT reuse internal/httpc here:
|
||||
// httpc dumps full request bodies at Trace level, which would leak the
|
||||
// password / OAuth token form fields used by the Steam endpoints. This
|
||||
// client instead logs only method / URL / status at debug level.
|
||||
func steamHTTPClient(jar http.CookieJar) *http.Client {
|
||||
return &http.Client{
|
||||
Jar: jar,
|
||||
Timeout: 30 * time.Second,
|
||||
}
|
||||
}
|
||||
|
||||
// steamRequest performs a Steam mobile / WebAPI request. method is GET or
|
||||
// POST. For GET the form values are appended to the URL; for POST they
|
||||
// are sent as application/x-www-form-urlencoded.
|
||||
//
|
||||
// The returned body is the full response payload as a string. headers
|
||||
// are added before the call. extraCookies are sent as the explicit
|
||||
// Cookie header on top of whatever the jar already supplies — most
|
||||
// callers can pass nil.
|
||||
//
|
||||
// IMPORTANT: passwords/tokens MUST be in `form` and never in the URL.
|
||||
// The debug log only records method/URL/status; form keys listed in
|
||||
// steamFormFieldsToRedact are filtered out of the (debug-level) body
|
||||
// dump.
|
||||
func steamRequest(
|
||||
ctx context.Context, client *http.Client,
|
||||
method, rawURL string, form url.Values, headers http.Header,
|
||||
) (string, error) {
|
||||
const fn = "internal.authenticator.steamRequest"
|
||||
logger := global.Log.WithField("func", fn).
|
||||
WithField("method", method).
|
||||
WithField("url", rawURL)
|
||||
|
||||
method = strings.ToUpper(method)
|
||||
body := ""
|
||||
if form != nil {
|
||||
body = form.Encode()
|
||||
}
|
||||
|
||||
finalURL := rawURL
|
||||
var reqBody io.Reader
|
||||
if method == http.MethodGet {
|
||||
if body != "" {
|
||||
if strings.Contains(finalURL, "?") {
|
||||
finalURL += "&" + body
|
||||
} else {
|
||||
finalURL += "?" + body
|
||||
}
|
||||
}
|
||||
} else {
|
||||
reqBody = strings.NewReader(body)
|
||||
}
|
||||
|
||||
req, err := http.NewRequestWithContext(ctx, method, finalURL, reqBody)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
req.Header.Set("User-Agent", steamMobileUserAgent)
|
||||
req.Header.Set("Accept", "text/javascript, text/html, application/xml, text/xml, */*")
|
||||
req.Header.Set("Accept-Encoding", "gzip, deflate")
|
||||
req.Header.Set("Referer", steamCommunityBase)
|
||||
if method == http.MethodPost {
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8")
|
||||
}
|
||||
for k, vs := range headers {
|
||||
for _, v := range vs {
|
||||
req.Header.Add(k, v)
|
||||
}
|
||||
}
|
||||
|
||||
if global.Log != nil {
|
||||
logger.WithField("form", redactFormForLog(form)).Debug("steam request")
|
||||
}
|
||||
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
logger.WithError(err).Warn("steam request failed")
|
||||
return "", err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
logger = logger.WithField("status", resp.StatusCode)
|
||||
|
||||
var reader io.Reader = resp.Body
|
||||
if strings.EqualFold(resp.Header.Get("Content-Encoding"), "gzip") {
|
||||
gz, gerr := gzip.NewReader(resp.Body)
|
||||
if gerr != nil {
|
||||
return "", gerr
|
||||
}
|
||||
defer gz.Close()
|
||||
reader = gz
|
||||
}
|
||||
|
||||
raw, err := io.ReadAll(reader)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
if resp.StatusCode == http.StatusForbidden {
|
||||
logger.Warn("steam request unauthorised")
|
||||
return string(raw), errSteamUnauthorised
|
||||
}
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
logger.Warn("steam request non-200")
|
||||
return string(raw), fmt.Errorf("steam: %d %s", resp.StatusCode, resp.Status)
|
||||
}
|
||||
|
||||
logger.Debug("steam response ok")
|
||||
return string(raw), nil
|
||||
}
|
||||
|
||||
// errSteamUnauthorised maps the C# UnauthorisedRequestException — a 403
|
||||
// from /steamguard or related endpoints typically means Family View has
|
||||
// disabled community content.
|
||||
var errSteamUnauthorised = fmt.Errorf("steam: unauthorised (403)")
|
||||
|
||||
// redactFormForLog produces a copy of form with sensitive values
|
||||
// replaced by "<redacted>". Returns "" for nil/empty input.
|
||||
func redactFormForLog(form url.Values) string {
|
||||
if len(form) == 0 {
|
||||
return ""
|
||||
}
|
||||
parts := make([]string, 0, len(form))
|
||||
for k, vs := range form {
|
||||
if _, sensitive := steamFormFieldsToRedact[k]; sensitive {
|
||||
parts = append(parts, k+"=<redacted>")
|
||||
continue
|
||||
}
|
||||
for _, v := range vs {
|
||||
parts = append(parts, k+"="+v)
|
||||
}
|
||||
}
|
||||
return strings.Join(parts, "&")
|
||||
}
|
||||
|
||||
// buildRandomDeviceID returns "android:" followed by a freshly generated
|
||||
// UUID v4. Matches the C# SteamAuthenticator.BuildRandomId helper.
|
||||
func buildRandomDeviceID() string {
|
||||
var u [16]byte
|
||||
if _, err := rand.Read(u[:]); err != nil {
|
||||
// crypto/rand failing is fatal; fall back to a time-derived
|
||||
// value so the caller does not crash, but log it loudly.
|
||||
now := time.Now().UnixNano()
|
||||
for i := 0; i < 16; i++ {
|
||||
u[i] = byte(now >> (i % 8 * 8))
|
||||
}
|
||||
}
|
||||
u[6] = (u[6] & 0x0F) | 0x40 // version 4
|
||||
u[8] = (u[8] & 0x3F) | 0x80 // variant RFC 4122
|
||||
hexb := func(b byte) (byte, byte) {
|
||||
const hexd = "0123456789abcdef"
|
||||
return hexd[b>>4], hexd[b&0x0F]
|
||||
}
|
||||
out := make([]byte, 0, 8+36)
|
||||
out = append(out, "android:"...)
|
||||
for i, b := range u {
|
||||
if i == 4 || i == 6 || i == 8 || i == 10 {
|
||||
out = append(out, '-')
|
||||
}
|
||||
hi, lo := hexb(b)
|
||||
out = append(out, hi, lo)
|
||||
}
|
||||
return string(out)
|
||||
}
|
||||
|
||||
// stripNonASCII removes any non-ASCII code points from s. Steam's
|
||||
// login endpoint silently drops these from username/password, so the
|
||||
// client side must do the same to keep RSA-encrypted bytes consistent.
|
||||
func stripNonASCII(s string) string {
|
||||
b := make([]byte, 0, len(s))
|
||||
for i := 0; i < len(s); i++ {
|
||||
c := s[i]
|
||||
if c < 0x80 {
|
||||
b = append(b, c)
|
||||
}
|
||||
}
|
||||
return string(b)
|
||||
}
|
||||
Reference in New Issue
Block a user