a58370ab74
The validity of authentication tokens was determined by the
mtime of respective authentication tokens on filesystem
stored in $sessionpath.
Talking about hardware without RTC or without a prior
connection to a time server, date/time usually around 1970 -
so is the mtime of the authentication token file in
$sessionpath.
When now configuring an internet connection via LuCI, the
system might fetch the current date/time (e.g. via ntp)
which invalidates the token, returns "403 Forbidden" and
kicks the user out of the interface.
This patch changes the authentication system to use time values
based on the uptime of the machine - rather than values based upon
gettimeofday() and {a|m}time values - and save them inside the token.
That way can always determine the difference between login
(last interaction respectively) and the current time, in-
dependant of the system clock jumping backwards/forwards.
Warning: This patch removes the clean() function and respective calls.
This means, invalid tokens will NOT be determined and removed from
filesystem automatically anymore.
Before, every HTTP-call caused a scan for invalid tokens,
which is quite expensive. Instead consider using a cron job
deleting all stalled files periodically.
Contributed by T-Labs, Deutsche Telekom Innovation Laboratories
Signed-off-by: Mirko Vogt <mirko@openwrt.org>
124 lines
2.6 KiB
Lua
124 lines
2.6 KiB
Lua
--[[
|
|
|
|
Session authentication
|
|
(c) 2008 Steven Barth <steven@midlink.org>
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
$Id$
|
|
|
|
]]--
|
|
|
|
--- LuCI session library.
|
|
module("luci.sauth", package.seeall)
|
|
require("luci.util")
|
|
require("luci.sys")
|
|
require("luci.config")
|
|
local nixio = require "nixio", require "nixio.util"
|
|
local fs = require "nixio.fs"
|
|
|
|
|
|
luci.config.sauth = luci.config.sauth or {}
|
|
sessionpath = luci.config.sauth.sessionpath
|
|
sessiontime = tonumber(luci.config.sauth.sessiontime) or 15 * 60
|
|
|
|
--- Prepare session storage by creating the session directory.
|
|
function prepare()
|
|
fs.mkdir(sessionpath, 700)
|
|
if not sane() then
|
|
error("Security Exception: Session path is not sane!")
|
|
end
|
|
end
|
|
|
|
function encode(t)
|
|
return luci.util.get_bytecode({
|
|
user=t.user,
|
|
token=t.token,
|
|
secret=t.secret,
|
|
atime=luci.sys.uptime()
|
|
})
|
|
end
|
|
|
|
function decode(blob)
|
|
local t = loadstring(blob)()
|
|
return {
|
|
user = t.user,
|
|
token = t.token,
|
|
secret = t.secret,
|
|
atime = t.atime
|
|
}
|
|
end
|
|
|
|
--- Read a session and return its content.
|
|
-- @param id Session identifier
|
|
-- @return Session data
|
|
local function _read(id)
|
|
local blob = fs.readfile(sessionpath .. "/" .. id)
|
|
return blob
|
|
end
|
|
|
|
--- Write session data to a session file.
|
|
-- @param id Session identifier
|
|
-- @param data Session data
|
|
local function _write(id, data)
|
|
local f = nixio.open(sessionpath .. "/" .. id, "w", 600)
|
|
f:writeall(data)
|
|
f:close()
|
|
end
|
|
|
|
function write(id, data)
|
|
if not sane() then
|
|
prepare()
|
|
end
|
|
|
|
if not id or #id == 0 or not id:match("^%w+$") then
|
|
error("Session ID is not sane!")
|
|
end
|
|
|
|
_write(id, data)
|
|
end
|
|
|
|
function read(id)
|
|
if not id or #id == 0 then
|
|
return
|
|
end
|
|
if not id:match("^%w+$") then
|
|
error("Session ID is not sane!")
|
|
end
|
|
if not sane(sessionpath .. "/" .. id) then
|
|
return
|
|
end
|
|
|
|
local blob = _read(id)
|
|
if decode(blob).atime + sessiontime < luci.sys.uptime()then
|
|
fs.unlink(sessionpath .. "/" .. id)
|
|
return
|
|
end
|
|
-- refresh atime in session
|
|
refreshed = encode(decode(blob))
|
|
write(id, refreshed)
|
|
return blob
|
|
end
|
|
|
|
|
|
--- Check whether Session environment is sane.
|
|
-- @return Boolean status
|
|
function sane(file)
|
|
return luci.sys.process.info("uid")
|
|
== fs.stat(file or sessionpath, "uid")
|
|
and fs.stat(file or sessionpath, "modestr")
|
|
== (file and "rw-------" or "rwx------")
|
|
end
|
|
|
|
--- Kills a session
|
|
-- @param id Session identifier
|
|
function kill(id)
|
|
if not id:match("^%w+$") then
|
|
error("Session ID is not sane!")
|
|
end
|
|
fs.unlink(sessionpath .. "/" .. id)
|
|
end
|