浅记多因素身份认证

1
#[derive(Debug)]
2
pub struct Totp(totp_rs::TOTP);
3

4
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
5
pub struct TotpVerifyResult {
6
    pub success: bool,
7
    pub matched_step: Option<u64>,
8
}
9

10
impl Totp {
11
    pub fn verify(&self, token: &str) -> Result<TotpVerifyResult, Error> {
12
        let now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_secs();
13
        let current_step = now / self.0.step;
14
        let base_step = current_step.saturating_sub(self.0.skew as u64);
15
        let window = (self.0.skew as u64) * 2 + 1;
16

17
        for offset in 0..window {
18
            let step = base_step + offset;
19
            if self.0.generate(step * self.0.step) == token {
20
                return Ok(TotpVerifyResult {
21
                    success: true,
22
                    matched_step: Some(step),
23
                });
24
            }
25
        }
26

27
        Ok(TotpVerifyResult {
28
            success: false,
29
            matched_step: None,
30
        })
31
    }
32
}

1
...
2
    /// Will check if token is valid given the provided timestamp in seconds, accounting [skew](struct.TOTP.html#structfield.skew)
3
    pub fn check(&self, token: &str, time: u64) -> bool {
4
        let basestep = time / self.step - (self.skew as u64);
5
        for i in 0..(self.skew as u16) * 2 + 1 {
6
            let step_time = (basestep + (i as u64)) * self.step;
7

8
            if constant_time_eq(self.generate(step_time).as_bytes(), token.as_bytes()) {
9
                return true;
10
            }
11
        }
12
        false
13
    }
14

15
    /// Will check if token is valid by current system time, accounting [skew](struct.TOTP.html#structfield.skew)
16
    pub fn check_current(&self, token: &str) -> Result<bool, SystemTimeError> {
17
        let t = system_time()?;
18
        Ok(self.check(token, t))
19
    }
20
...

1
use std::time::Duration;
2

3
use moka::{
4
    future::Cache,
5
    ops::compute::{CompResult, Op},
6
};
7
use uuid::Uuid;
8

9
#[derive(Debug, Hash, PartialEq, PartialOrd, Eq)]
10
struct TotpStepRecord {
11
    id: Uuid,
12
    matched_step: u64,
13
}
14

15
#[derive(Debug, Clone)]
16
pub struct TotpAntiReplay {
17
    cache: Cache<TotpStepRecord, ()>,
18
}
19

20
impl TotpAntiReplay {
21
    pub async fn consume(&self, id: Uuid, matched_step: u64) -> bool {
22
        let key = TotpStepRecord { id, matched_step };
23

24
        matches!(
25
            self.cache
26
                .entry(key)
27
                .and_compute_with(|entry| async move {
28
                    if entry.is_some() {
29
                        Op::Nop
30
                    } else {
31
                        Op::Put(())
32
                    }
33
                })
34
                .await,
35
            CompResult::Inserted(_)
36
        )
37
    }
38
}