Cavemanon/haproxy-protection
8
Fork 0
mirror of https://gitgud.io/fatchan/haproxy-protection.git synced 2025-05-09 02:05:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow a bit better granularity for the difficulty. Recommend an "easier" challenge in terms of memory and iterations, but higher diff.

Browse Source 
Make failed request for captcha/bot form show a little error text.
Make CHALLENGE_INCLUDES_IP "1" = on, anything else = off instead of needing to be unset.
This commit is contained in:
Thomas Lynch
2022-10-01 05:31:47 +10:00
parent 434756a7a1
commit eede92d47d
5 changed files with 35 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/libs/utils.lua
View File

@ -12,7 +12,7 @@ function _M.generate_secret(context, salt, user_key, is_applet)
-- optional IP to lock challenges/user_keys to IP (for clearnet or single-onion aka 99% of cases)
local ip = ""
if challenge_includes_ip then
if challenge_includes_ip == "1" then
ip = context.sf:src()
end
@ -38,5 +38,18 @@ function _M.split(inputstr, sep)
return t
end
function _M.checkdiff(hash, diff)
local i = 1
for j = 0, (diff-8), 8 do
if hash:sub(i, i) ~= "0" then
return false
end
i = i + 1
end
local lnm = tonumber(hash:sub(i, i), 16)
local msk = 0xff >> ((i*8)-diff)
return (lnm & msk) == 0
end
return _M

10
src/scripts/hcaptcha.lua
View File

@ -7,7 +7,7 @@ local json = require("json")
local sha = require("sha")
local randbytes = require("randbytes")
local argon2 = require("argon2")
local pow_difficulty = tonumber(os.getenv("POW_DIFFICULTY") or 3)
local pow_difficulty = tonumber(os.getenv("POW_DIFFICULTY") or 18)
local pow_kb = tonumber(os.getenv("POW_KB") or 6000)
local pow_time = tonumber(os.getenv("POW_TIME") or 1)
argon2.t_cost(pow_time)
@ -48,6 +48,9 @@ else
end
function _M.setup_servers()
if pow_difficulty < 8 then
error("POW_DIFFICULTY must be > 8. Around 16-32 is better")
end
local backend_name = os.getenv("BACKEND_NAME")
local server_prefix = os.getenv("SERVER_PREFIX")
if backend_name == nil or server_prefix == nil then
@ -207,7 +210,7 @@ function _M.view(applet)
else
pow_body = pow_section_template
noscript_extra_body = string.format(noscript_extra_template, user_key, challenge_hash, signature,
pow_difficulty, pow_time, pow_kb)
math.ceil(pow_difficulty/8), pow_time, pow_kb)
end
-- sub in the body sections
@ -303,9 +306,8 @@ function _M.view(applet)
-- check the output is correct
local hash_output = utils.split(full_hash, '$')[5]:sub(0, 43) -- https://github.com/thibaultcha/lua-argon2/issues/37
local hex_hash_output = sha.bin_to_hex(sha.base64_to_bin(hash_output));
local hex_hash_sub = hex_hash_output:sub(0, pow_difficulty)
if hex_hash_sub == string.rep('0', pow_difficulty) then
if utils.checkdiff(hex_hash_output, pow_difficulty) then
-- the answer was good, give them a cookie
local signature = sha.hmac(sha.sha3_256, hmac_cookie_secret, given_user_key .. given_challenge_hash .. given_answer)