Andrew Boyson / web

Common stuff for all my devices' web server pages: css, login, log, ipv4, ipv6, firmware update, clock, reset info etc.

Dependents:   oldheating gps motorhome heating

Security

A password has to be set whenever there has been a software reset. Resets following faults or power on do not require a new password as the hash is restored from the RTC GPREG register.

The password is not saved on the device; instead a 32 bit hash of the password is saved. It would take 2^31 attempts to brute force the password: this could be done in under a month if an attempt were possible every millisecond. To prevent this a 200 ms delay is introduced in the reply to the login form, that gives a more reasonable 13 years to brute force the password.

Once the password is accepted a random session id is created. This is 36 bit to give six base 64 characters but without an extra delay. If an attempt could be made every ms then this would still take over a year to brute force.

The most likely attack would to use a dictionary with, say, 10 million entries against the password which would still take 20 days to do.

common/web-ajax-class.js@141:1dac268a197d, 2020-06-09 (annotated)

Committer:
andrewboyson
Date:
Tue Jun 09 14:33:55 2020 +0000
Revision:
141:1dac268a197d
Parent:
140:8951a8b45289
Child:
156:005785e4740e
Added routine to parse a float (double) value from a query.

Who changed what in which revision?

UserRevisionLine numberNew contents of line
andrewboyson 96:eb2eb75bad0f 1 //Ajax class
andrewboyson 95:8c9dda8a0caf 2 'use strict';
andrewboyson 95:8c9dda8a0caf 3
andrewboyson 95:8c9dda8a0caf 4 //Exposed properties
andrewboyson 95:8c9dda8a0caf 5 let ajaxResponse_ = '';
andrewboyson 95:8c9dda8a0caf 6 let ajaxHeaders_ = '';
andrewboyson 96:eb2eb75bad0f 7 let ajaxDate_ = null;
andrewboyson 95:8c9dda8a0caf 8 let ajaxMs_ = 0;
andrewboyson 95:8c9dda8a0caf 9 let ajaxOnResponse_ = null;
andrewboyson 95:8c9dda8a0caf 10 let ajaxOnTick_ = null;
andrewboyson 95:8c9dda8a0caf 11 let ajaxServer_ = '';
andrewboyson 95:8c9dda8a0caf 12
andrewboyson 95:8c9dda8a0caf 13 //Private variables
andrewboyson 95:8c9dda8a0caf 14 let ajaxOverrideBlockUpdateOnFocus_ = false;
andrewboyson 95:8c9dda8a0caf 15 let ajaxXhr_ = null;
andrewboyson 95:8c9dda8a0caf 16 let ajaxMsCountAtAjaxSend_ = 0;
andrewboyson 95:8c9dda8a0caf 17 const ajaxTickMs_ = 100;
andrewboyson 95:8c9dda8a0caf 18 const ajaxUpdateMs_ = 10000;
andrewboyson 95:8c9dda8a0caf 19
andrewboyson 95:8c9dda8a0caf 20 //Private utilities
andrewboyson 95:8c9dda8a0caf 21 function ajaxGetElementOrNull_(elementName) //Returns the element if it: exists; block is overidden; does not have focus
andrewboyson 95:8c9dda8a0caf 22 {
andrewboyson 95:8c9dda8a0caf 23 let elem = document.getElementById(elementName);
andrewboyson 95:8c9dda8a0caf 24 if (!elem) return null;
andrewboyson 95:8c9dda8a0caf 25 if (ajaxOverrideBlockUpdateOnFocus_) return elem;
andrewboyson 95:8c9dda8a0caf 26 if (elem !== document.activeElement) return elem;
andrewboyson 95:8c9dda8a0caf 27 return null;
andrewboyson 95:8c9dda8a0caf 28 }
andrewboyson 95:8c9dda8a0caf 29 function ajaxHexToBit_(text, iBit)
andrewboyson 95:8c9dda8a0caf 30 {
andrewboyson 95:8c9dda8a0caf 31 let value = parseInt(text, 16);
andrewboyson 95:8c9dda8a0caf 32 value >>= iBit;
andrewboyson 95:8c9dda8a0caf 33 return value & 1;
andrewboyson 95:8c9dda8a0caf 34 }
andrewboyson 98:4e099563d5b9 35 function ajaxHexToSignedInt8_(text)
andrewboyson 98:4e099563d5b9 36 {
andrewboyson 98:4e099563d5b9 37 let value = parseInt(text, 16);
andrewboyson 98:4e099563d5b9 38 if (value < 0x80) return value;
andrewboyson 98:4e099563d5b9 39 return value - 0x100;
andrewboyson 98:4e099563d5b9 40 }
andrewboyson 98:4e099563d5b9 41 function ajaxHexToSignedInt16_(text)
andrewboyson 98:4e099563d5b9 42 {
andrewboyson 98:4e099563d5b9 43 let value = parseInt(text, 16);
andrewboyson 98:4e099563d5b9 44 if (value < 0x8000) return value;
andrewboyson 98:4e099563d5b9 45 return value - 0x10000;
andrewboyson 98:4e099563d5b9 46 }
andrewboyson 98:4e099563d5b9 47 function ajaxHexToSignedInt32_(text)
andrewboyson 98:4e099563d5b9 48 {
andrewboyson 98:4e099563d5b9 49 let value = parseInt(text, 16);
andrewboyson 98:4e099563d5b9 50 if (value < 0x80000000) return value;
andrewboyson 98:4e099563d5b9 51 return value - 0x100000000;
andrewboyson 98:4e099563d5b9 52 }
andrewboyson 98:4e099563d5b9 53
andrewboyson 95:8c9dda8a0caf 54
andrewboyson 95:8c9dda8a0caf 55 //Private ajax functions
andrewboyson 95:8c9dda8a0caf 56 function ajaxHandleAjaxResponse_()
andrewboyson 95:8c9dda8a0caf 57 {
andrewboyson 95:8c9dda8a0caf 58 if (ajaxXhr_.readyState == 4 && ajaxXhr_.status == 200)
andrewboyson 95:8c9dda8a0caf 59 {
andrewboyson 95:8c9dda8a0caf 60 ajaxResponse_ = ajaxXhr_.responseText;
andrewboyson 95:8c9dda8a0caf 61 ajaxHeaders_ = ajaxXhr_.getAllResponseHeaders();
andrewboyson 96:eb2eb75bad0f 62 let iDateStart = Ajax.headers.toLowerCase().indexOf('date:');
andrewboyson 96:eb2eb75bad0f 63 let iDateEnd = Ajax.headers.indexOf('\r', iDateStart);
andrewboyson 96:eb2eb75bad0f 64 ajaxDate_ = new Date(Ajax.headers.slice(iDateStart + 5, iDateEnd));
andrewboyson 96:eb2eb75bad0f 65
andrewboyson 95:8c9dda8a0caf 66 let elem;
andrewboyson 98:4e099563d5b9 67 elem = ajaxGetElementOrNull_('ajax-response' ); if (elem) elem.textContent = ajaxResponse_;
andrewboyson 98:4e099563d5b9 68 elem = ajaxGetElementOrNull_('ajax-headers' ); if (elem) elem.textContent = ajaxHeaders_;
andrewboyson 98:4e099563d5b9 69 elem = ajaxGetElementOrNull_('ajax-date-local' );
andrewboyson 98:4e099563d5b9 70 if (elem)
andrewboyson 98:4e099563d5b9 71 {
andrewboyson 98:4e099563d5b9 72 elem.textContent = ajaxDate_.toLocaleString( undefined, { weekday : 'short' ,
andrewboyson 98:4e099563d5b9 73 day : '2-digit',
andrewboyson 98:4e099563d5b9 74 month : 'short' ,
andrewboyson 98:4e099563d5b9 75 year : 'numeric',
andrewboyson 98:4e099563d5b9 76 hour : '2-digit',
andrewboyson 98:4e099563d5b9 77 minute : '2-digit',
andrewboyson 98:4e099563d5b9 78 timeZoneName: 'short'
andrewboyson 98:4e099563d5b9 79 }
andrewboyson 98:4e099563d5b9 80 );
andrewboyson 98:4e099563d5b9 81 }
andrewboyson 95:8c9dda8a0caf 82 if (ajaxOnResponse_) ajaxOnResponse_();
andrewboyson 95:8c9dda8a0caf 83 ajaxOverrideBlockUpdateOnFocus_ = false; //Received response so reset override after display
andrewboyson 95:8c9dda8a0caf 84 }
andrewboyson 95:8c9dda8a0caf 85 }
andrewboyson 138:44d84506b2f6 86 function ajaxSendNameValue_(name, value) //Used by this script and from HTML page
andrewboyson 95:8c9dda8a0caf 87 {
andrewboyson 95:8c9dda8a0caf 88 ajaxXhr_ = new XMLHttpRequest();
andrewboyson 95:8c9dda8a0caf 89 ajaxXhr_.onreadystatechange = ajaxHandleAjaxResponse_;
andrewboyson 138:44d84506b2f6 90 if (name)
andrewboyson 98:4e099563d5b9 91 {
andrewboyson 138:44d84506b2f6 92 if (value)
andrewboyson 138:44d84506b2f6 93 {
andrewboyson 140:8951a8b45289 94 ajaxXhr_.open('GET', ajaxServer_ + '?' + name + '=' + encodeURIComponent(value), true);
andrewboyson 138:44d84506b2f6 95 }
andrewboyson 138:44d84506b2f6 96 else
andrewboyson 138:44d84506b2f6 97 {
andrewboyson 138:44d84506b2f6 98 ajaxXhr_.open('GET', ajaxServer_ + '?' + name, true);
andrewboyson 138:44d84506b2f6 99 }
andrewboyson 98:4e099563d5b9 100 }
andrewboyson 98:4e099563d5b9 101 else
andrewboyson 98:4e099563d5b9 102 {
andrewboyson 138:44d84506b2f6 103 ajaxXhr_.open('GET', ajaxServer_, true);
andrewboyson 98:4e099563d5b9 104 }
andrewboyson 95:8c9dda8a0caf 105 ajaxXhr_.send();
andrewboyson 95:8c9dda8a0caf 106 ajaxMsCountAtAjaxSend_ = ajaxMs_;
andrewboyson 95:8c9dda8a0caf 107 }
andrewboyson 138:44d84506b2f6 108 function AjaxSendNameValue(name, value) //From html
andrewboyson 95:8c9dda8a0caf 109 {
andrewboyson 95:8c9dda8a0caf 110 ajaxOverrideBlockUpdateOnFocus_ = true; //Request has come from an update
andrewboyson 138:44d84506b2f6 111 ajaxSendNameValue_(name, value);
andrewboyson 95:8c9dda8a0caf 112 }
andrewboyson 95:8c9dda8a0caf 113
andrewboyson 95:8c9dda8a0caf 114 //Private functions
andrewboyson 95:8c9dda8a0caf 115 function ajaxTick_() //Called about every 100ms
andrewboyson 95:8c9dda8a0caf 116 {
andrewboyson 95:8c9dda8a0caf 117 ajaxMs_ += ajaxTickMs_; //Don't use Date.now() as we don't know when the PC's clock will be updated around a leap second
andrewboyson 139:e189c6669983 118 if (ajaxMs_ >= ajaxMsCountAtAjaxSend_ + ajaxUpdateMs_) ajaxSendNameValue_('', '');
andrewboyson 95:8c9dda8a0caf 119 if (ajaxOnTick_) ajaxOnTick_();
andrewboyson 95:8c9dda8a0caf 120 }
andrewboyson 95:8c9dda8a0caf 121 function ajaxInit_()
andrewboyson 95:8c9dda8a0caf 122 {
andrewboyson 95:8c9dda8a0caf 123 setInterval(ajaxTick_, ajaxTickMs_);
andrewboyson 139:e189c6669983 124 ajaxSendNameValue_('', '');
andrewboyson 95:8c9dda8a0caf 125 }
andrewboyson 95:8c9dda8a0caf 126
andrewboyson 95:8c9dda8a0caf 127 //Exposed public
andrewboyson 95:8c9dda8a0caf 128 class Ajax
andrewboyson 95:8c9dda8a0caf 129 {
andrewboyson 98:4e099563d5b9 130 static get ms () { return ajaxMs_ ; }
andrewboyson 98:4e099563d5b9 131 static get response () { return ajaxResponse_ ; }
andrewboyson 98:4e099563d5b9 132 static get headers () { return ajaxHeaders_ ; }
andrewboyson 98:4e099563d5b9 133 static get date () { return ajaxDate_ ; }
andrewboyson 98:4e099563d5b9 134
andrewboyson 98:4e099563d5b9 135 static set tickMs (v) { ajaxTickMs_ = v; }
andrewboyson 98:4e099563d5b9 136 static set updateMs (v) { ajaxUpdateMs_ = v; }
andrewboyson 98:4e099563d5b9 137 static set server (v) { ajaxServer_ = v; }
andrewboyson 98:4e099563d5b9 138 static set onResponse(v) { ajaxOnResponse_ = v; }
andrewboyson 98:4e099563d5b9 139 static set onTick (v) { ajaxOnTick_ = v; }
andrewboyson 95:8c9dda8a0caf 140
andrewboyson 95:8c9dda8a0caf 141 static getElementOrNull(elementName) { return ajaxGetElementOrNull_(elementName) ; }
andrewboyson 95:8c9dda8a0caf 142 static hexToBit (text, iBit ) { return ajaxHexToBit_ (text, iBit ) ; }
andrewboyson 98:4e099563d5b9 143 static hexToSignedInt8 (text ) { return ajaxHexToSignedInt8_ (text ) ; }
andrewboyson 98:4e099563d5b9 144 static hexToSignedInt16(text ) { return ajaxHexToSignedInt16_(text ) ; }
andrewboyson 98:4e099563d5b9 145 static hexToSignedInt32(text ) { return ajaxHexToSignedInt32_(text ) ; }
andrewboyson 95:8c9dda8a0caf 146
andrewboyson 95:8c9dda8a0caf 147 static init()
andrewboyson 95:8c9dda8a0caf 148 {
andrewboyson 95:8c9dda8a0caf 149 if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', ajaxInit_ ); // Loading hasn't finished yet
andrewboyson 95:8c9dda8a0caf 150 else ajaxInit_(); //`DOMContentLoaded` has already fired
andrewboyson 95:8c9dda8a0caf 151 }
andrewboyson 95:8c9dda8a0caf 152 }