Andrew Boyson / web

Common stuff for all my devices' web server pages: css, login, log, ipv4, ipv6, firmware update, clock, reset info etc.

Dependents:   oldheating gps motorhome heating

Security

A password has to be set whenever there has been a software reset. Resets following faults or power on do not require a new password as the hash is restored from the RTC GPREG register.

The password is not saved on the device; instead a 32 bit hash of the password is saved. It would take 2^31 attempts to brute force the password: this could be done in under a month if an attempt were possible every millisecond. To prevent this a 200 ms delay is introduced in the reply to the login form, that gives a more reasonable 13 years to brute force the password.

Once the password is accepted a random session id is created. This is 36 bit to give six base 64 characters but without an extra delay. If an attempt could be made every ms then this would still take over a year to brute force.

The most likely attack would to use a dictionary with, say, 10 million entries against the password which would still take 20 days to do.

common/web-ajax-class.js@138:44d84506b2f6, 2020-06-02 (annotated)

Committer:
andrewboyson
Date:
Tue Jun 02 16:19:34 2020 +0000
Revision:
138:44d84506b2f6
Parent:
137:3b6632374855
Child:
139:e189c6669983
Modified AjaxRequest to AjaxSendNameValue in order to be able to encode '=' and '?' correctly

Who changed what in which revision?

UserRevisionLine numberNew contents of line
andrewboyson 96:eb2eb75bad0f 1 //Ajax class
andrewboyson 95:8c9dda8a0caf 2 'use strict';
andrewboyson 95:8c9dda8a0caf 3
andrewboyson 95:8c9dda8a0caf 4 //Exposed properties
andrewboyson 95:8c9dda8a0caf 5 let ajaxResponse_ = '';
andrewboyson 95:8c9dda8a0caf 6 let ajaxHeaders_ = '';
andrewboyson 96:eb2eb75bad0f 7 let ajaxDate_ = null;
andrewboyson 95:8c9dda8a0caf 8 let ajaxMs_ = 0;
andrewboyson 95:8c9dda8a0caf 9 let ajaxOnResponse_ = null;
andrewboyson 95:8c9dda8a0caf 10 let ajaxOnTick_ = null;
andrewboyson 95:8c9dda8a0caf 11 let ajaxServer_ = '';
andrewboyson 95:8c9dda8a0caf 12
andrewboyson 95:8c9dda8a0caf 13 //Private variables
andrewboyson 95:8c9dda8a0caf 14 let ajaxOverrideBlockUpdateOnFocus_ = false;
andrewboyson 95:8c9dda8a0caf 15 let ajaxXhr_ = null;
andrewboyson 95:8c9dda8a0caf 16 let ajaxMsCountAtAjaxSend_ = 0;
andrewboyson 95:8c9dda8a0caf 17 const ajaxTickMs_ = 100;
andrewboyson 95:8c9dda8a0caf 18 const ajaxUpdateMs_ = 10000;
andrewboyson 95:8c9dda8a0caf 19
andrewboyson 95:8c9dda8a0caf 20 //Private utilities
andrewboyson 95:8c9dda8a0caf 21 function ajaxGetElementOrNull_(elementName) //Returns the element if it: exists; block is overidden; does not have focus
andrewboyson 95:8c9dda8a0caf 22 {
andrewboyson 95:8c9dda8a0caf 23 let elem = document.getElementById(elementName);
andrewboyson 95:8c9dda8a0caf 24 if (!elem) return null;
andrewboyson 95:8c9dda8a0caf 25 if (ajaxOverrideBlockUpdateOnFocus_) return elem;
andrewboyson 95:8c9dda8a0caf 26 if (elem !== document.activeElement) return elem;
andrewboyson 95:8c9dda8a0caf 27 return null;
andrewboyson 95:8c9dda8a0caf 28 }
andrewboyson 95:8c9dda8a0caf 29 function ajaxHexToBit_(text, iBit)
andrewboyson 95:8c9dda8a0caf 30 {
andrewboyson 95:8c9dda8a0caf 31 let value = parseInt(text, 16);
andrewboyson 95:8c9dda8a0caf 32 value >>= iBit;
andrewboyson 95:8c9dda8a0caf 33 return value & 1;
andrewboyson 95:8c9dda8a0caf 34 }
andrewboyson 98:4e099563d5b9 35 function ajaxHexToSignedInt8_(text)
andrewboyson 98:4e099563d5b9 36 {
andrewboyson 98:4e099563d5b9 37 let value = parseInt(text, 16);
andrewboyson 98:4e099563d5b9 38 if (value < 0x80) return value;
andrewboyson 98:4e099563d5b9 39 return value - 0x100;
andrewboyson 98:4e099563d5b9 40 }
andrewboyson 98:4e099563d5b9 41 function ajaxHexToSignedInt16_(text)
andrewboyson 98:4e099563d5b9 42 {
andrewboyson 98:4e099563d5b9 43 let value = parseInt(text, 16);
andrewboyson 98:4e099563d5b9 44 if (value < 0x8000) return value;
andrewboyson 98:4e099563d5b9 45 return value - 0x10000;
andrewboyson 98:4e099563d5b9 46 }
andrewboyson 98:4e099563d5b9 47 function ajaxHexToSignedInt32_(text)
andrewboyson 98:4e099563d5b9 48 {
andrewboyson 98:4e099563d5b9 49 let value = parseInt(text, 16);
andrewboyson 98:4e099563d5b9 50 if (value < 0x80000000) return value;
andrewboyson 98:4e099563d5b9 51 return value - 0x100000000;
andrewboyson 98:4e099563d5b9 52 }
andrewboyson 98:4e099563d5b9 53
andrewboyson 95:8c9dda8a0caf 54
andrewboyson 95:8c9dda8a0caf 55 //Private ajax functions
andrewboyson 95:8c9dda8a0caf 56 function ajaxHandleAjaxResponse_()
andrewboyson 95:8c9dda8a0caf 57 {
andrewboyson 95:8c9dda8a0caf 58 if (ajaxXhr_.readyState == 4 && ajaxXhr_.status == 200)
andrewboyson 95:8c9dda8a0caf 59 {
andrewboyson 95:8c9dda8a0caf 60 ajaxResponse_ = ajaxXhr_.responseText;
andrewboyson 95:8c9dda8a0caf 61 ajaxHeaders_ = ajaxXhr_.getAllResponseHeaders();
andrewboyson 96:eb2eb75bad0f 62 let iDateStart = Ajax.headers.toLowerCase().indexOf('date:');
andrewboyson 96:eb2eb75bad0f 63 let iDateEnd = Ajax.headers.indexOf('\r', iDateStart);
andrewboyson 96:eb2eb75bad0f 64 ajaxDate_ = new Date(Ajax.headers.slice(iDateStart + 5, iDateEnd));
andrewboyson 96:eb2eb75bad0f 65
andrewboyson 95:8c9dda8a0caf 66 let elem;
andrewboyson 98:4e099563d5b9 67 elem = ajaxGetElementOrNull_('ajax-response' ); if (elem) elem.textContent = ajaxResponse_;
andrewboyson 98:4e099563d5b9 68 elem = ajaxGetElementOrNull_('ajax-headers' ); if (elem) elem.textContent = ajaxHeaders_;
andrewboyson 98:4e099563d5b9 69 elem = ajaxGetElementOrNull_('ajax-date-local' );
andrewboyson 98:4e099563d5b9 70 if (elem)
andrewboyson 98:4e099563d5b9 71 {
andrewboyson 98:4e099563d5b9 72 elem.textContent = ajaxDate_.toLocaleString( undefined, { weekday : 'short' ,
andrewboyson 98:4e099563d5b9 73 day : '2-digit',
andrewboyson 98:4e099563d5b9 74 month : 'short' ,
andrewboyson 98:4e099563d5b9 75 year : 'numeric',
andrewboyson 98:4e099563d5b9 76 hour : '2-digit',
andrewboyson 98:4e099563d5b9 77 minute : '2-digit',
andrewboyson 98:4e099563d5b9 78 timeZoneName: 'short'
andrewboyson 98:4e099563d5b9 79 }
andrewboyson 98:4e099563d5b9 80 );
andrewboyson 98:4e099563d5b9 81 }
andrewboyson 95:8c9dda8a0caf 82 if (ajaxOnResponse_) ajaxOnResponse_();
andrewboyson 95:8c9dda8a0caf 83 ajaxOverrideBlockUpdateOnFocus_ = false; //Received response so reset override after display
andrewboyson 95:8c9dda8a0caf 84 }
andrewboyson 95:8c9dda8a0caf 85 }
andrewboyson 138:44d84506b2f6 86 function ajaxSendNameValue_(name, value) //Used by this script and from HTML page
andrewboyson 95:8c9dda8a0caf 87 {
andrewboyson 95:8c9dda8a0caf 88 ajaxXhr_ = new XMLHttpRequest();
andrewboyson 95:8c9dda8a0caf 89 ajaxXhr_.onreadystatechange = ajaxHandleAjaxResponse_;
andrewboyson 138:44d84506b2f6 90 if (name)
andrewboyson 98:4e099563d5b9 91 {
andrewboyson 138:44d84506b2f6 92 if (value)
andrewboyson 138:44d84506b2f6 93 {
andrewboyson 138:44d84506b2f6 94 value = value.split('%').join('%25'); //Encode '%'s first
andrewboyson 138:44d84506b2f6 95 value = value.split('+').join('%2B');
andrewboyson 138:44d84506b2f6 96 value = value.split('=').join('%3D');
andrewboyson 138:44d84506b2f6 97 value = value.split('?').join('%3F');
andrewboyson 138:44d84506b2f6 98 value = value.split('#').join('%23');
andrewboyson 138:44d84506b2f6 99 ajaxXhr_.open('GET', ajaxServer_ + '?' + name + '=' + value, true);
andrewboyson 138:44d84506b2f6 100 }
andrewboyson 138:44d84506b2f6 101 else
andrewboyson 138:44d84506b2f6 102 {
andrewboyson 138:44d84506b2f6 103 ajaxXhr_.open('GET', ajaxServer_ + '?' + name, true);
andrewboyson 138:44d84506b2f6 104 }
andrewboyson 98:4e099563d5b9 105 }
andrewboyson 98:4e099563d5b9 106 else
andrewboyson 98:4e099563d5b9 107 {
andrewboyson 138:44d84506b2f6 108 ajaxXhr_.open('GET', ajaxServer_, true);
andrewboyson 98:4e099563d5b9 109 }
andrewboyson 95:8c9dda8a0caf 110 ajaxXhr_.send();
andrewboyson 95:8c9dda8a0caf 111 ajaxMsCountAtAjaxSend_ = ajaxMs_;
andrewboyson 95:8c9dda8a0caf 112 }
andrewboyson 138:44d84506b2f6 113 function AjaxSendNameValue(name, value) //From html
andrewboyson 95:8c9dda8a0caf 114 {
andrewboyson 95:8c9dda8a0caf 115 ajaxOverrideBlockUpdateOnFocus_ = true; //Request has come from an update
andrewboyson 138:44d84506b2f6 116 ajaxSendNameValue_(name, value);
andrewboyson 95:8c9dda8a0caf 117 }
andrewboyson 95:8c9dda8a0caf 118
andrewboyson 95:8c9dda8a0caf 119 //Private functions
andrewboyson 95:8c9dda8a0caf 120 function ajaxTick_() //Called about every 100ms
andrewboyson 95:8c9dda8a0caf 121 {
andrewboyson 95:8c9dda8a0caf 122 ajaxMs_ += ajaxTickMs_; //Don't use Date.now() as we don't know when the PC's clock will be updated around a leap second
andrewboyson 95:8c9dda8a0caf 123 if (ajaxMs_ >= ajaxMsCountAtAjaxSend_ + ajaxUpdateMs_) ajaxSendAjaxRequest_('');
andrewboyson 95:8c9dda8a0caf 124 if (ajaxOnTick_) ajaxOnTick_();
andrewboyson 95:8c9dda8a0caf 125 }
andrewboyson 95:8c9dda8a0caf 126 function ajaxInit_()
andrewboyson 95:8c9dda8a0caf 127 {
andrewboyson 95:8c9dda8a0caf 128 setInterval(ajaxTick_, ajaxTickMs_);
andrewboyson 95:8c9dda8a0caf 129 ajaxSendAjaxRequest_('');
andrewboyson 95:8c9dda8a0caf 130 }
andrewboyson 95:8c9dda8a0caf 131
andrewboyson 95:8c9dda8a0caf 132 //Exposed public
andrewboyson 95:8c9dda8a0caf 133 class Ajax
andrewboyson 95:8c9dda8a0caf 134 {
andrewboyson 98:4e099563d5b9 135 static get ms () { return ajaxMs_ ; }
andrewboyson 98:4e099563d5b9 136 static get response () { return ajaxResponse_ ; }
andrewboyson 98:4e099563d5b9 137 static get headers () { return ajaxHeaders_ ; }
andrewboyson 98:4e099563d5b9 138 static get date () { return ajaxDate_ ; }
andrewboyson 98:4e099563d5b9 139
andrewboyson 98:4e099563d5b9 140 static set tickMs (v) { ajaxTickMs_ = v; }
andrewboyson 98:4e099563d5b9 141 static set updateMs (v) { ajaxUpdateMs_ = v; }
andrewboyson 98:4e099563d5b9 142 static set server (v) { ajaxServer_ = v; }
andrewboyson 98:4e099563d5b9 143 static set onResponse(v) { ajaxOnResponse_ = v; }
andrewboyson 98:4e099563d5b9 144 static set onTick (v) { ajaxOnTick_ = v; }
andrewboyson 95:8c9dda8a0caf 145
andrewboyson 95:8c9dda8a0caf 146 static getElementOrNull(elementName) { return ajaxGetElementOrNull_(elementName) ; }
andrewboyson 95:8c9dda8a0caf 147 static hexToBit (text, iBit ) { return ajaxHexToBit_ (text, iBit ) ; }
andrewboyson 98:4e099563d5b9 148 static hexToSignedInt8 (text ) { return ajaxHexToSignedInt8_ (text ) ; }
andrewboyson 98:4e099563d5b9 149 static hexToSignedInt16(text ) { return ajaxHexToSignedInt16_(text ) ; }
andrewboyson 98:4e099563d5b9 150 static hexToSignedInt32(text ) { return ajaxHexToSignedInt32_(text ) ; }
andrewboyson 95:8c9dda8a0caf 151
andrewboyson 95:8c9dda8a0caf 152 static init()
andrewboyson 95:8c9dda8a0caf 153 {
andrewboyson 95:8c9dda8a0caf 154 if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', ajaxInit_ ); // Loading hasn't finished yet
andrewboyson 95:8c9dda8a0caf 155 else ajaxInit_(); //`DOMContentLoaded` has already fired
andrewboyson 95:8c9dda8a0caf 156 }
andrewboyson 95:8c9dda8a0caf 157 }