Andrew Boyson / web

Common stuff for all my devices' web server pages: css, login, log, ipv4, ipv6, firmware update, clock, reset info etc.

Dependents:   oldheating gps motorhome heating

Security

A password has to be set whenever there has been a software reset. Resets following faults or power on do not require a new password as the hash is restored from the RTC GPREG register.

The password is not saved on the device; instead a 32 bit hash of the password is saved. It would take 2^31 attempts to brute force the password: this could be done in under a month if an attempt were possible every millisecond. To prevent this a 200 ms delay is introduced in the reply to the login form, that gives a more reasonable 13 years to brute force the password.

Once the password is accepted a random session id is created. This is 36 bit to give six base 64 characters but without an extra delay. If an attempt could be made every ms then this would still take over a year to brute force.

The most likely attack would to use a dictionary with, say, 10 million entries against the password which would still take 20 days to do.

base/http-ajax-script.js@95:8c9dda8a0caf, 2019-04-18 (annotated)

Committer:
andrewboyson
Date:
Thu Apr 18 15:26:29 2019 +0000
Revision:
95:8c9dda8a0caf
Used class to encapsulate ajax part of js in base.

Who changed what in which revision?

UserRevisionLine numberNew contents of line
andrewboyson 95:8c9dda8a0caf 1 //Ajax script
andrewboyson 95:8c9dda8a0caf 2 'use strict';
andrewboyson 95:8c9dda8a0caf 3
andrewboyson 95:8c9dda8a0caf 4 //Exposed properties
andrewboyson 95:8c9dda8a0caf 5 let ajaxResponse_ = '';
andrewboyson 95:8c9dda8a0caf 6 let ajaxHeaders_ = '';
andrewboyson 95:8c9dda8a0caf 7 let ajaxMs_ = 0;
andrewboyson 95:8c9dda8a0caf 8 let ajaxOnResponse_ = null;
andrewboyson 95:8c9dda8a0caf 9 let ajaxOnTick_ = null;
andrewboyson 95:8c9dda8a0caf 10 let ajaxServer_ = '';
andrewboyson 95:8c9dda8a0caf 11
andrewboyson 95:8c9dda8a0caf 12 //Private variables
andrewboyson 95:8c9dda8a0caf 13 let ajaxOverrideBlockUpdateOnFocus_ = false;
andrewboyson 95:8c9dda8a0caf 14 let ajaxXhr_ = null;
andrewboyson 95:8c9dda8a0caf 15 let ajaxMsCountAtAjaxSend_ = 0;
andrewboyson 95:8c9dda8a0caf 16 const ajaxTickMs_ = 100;
andrewboyson 95:8c9dda8a0caf 17 const ajaxUpdateMs_ = 10000;
andrewboyson 95:8c9dda8a0caf 18
andrewboyson 95:8c9dda8a0caf 19 //Private utilities
andrewboyson 95:8c9dda8a0caf 20 function ajaxGetElementOrNull_(elementName) //Returns the element if it: exists; block is overidden; does not have focus
andrewboyson 95:8c9dda8a0caf 21 {
andrewboyson 95:8c9dda8a0caf 22 let elem = document.getElementById(elementName);
andrewboyson 95:8c9dda8a0caf 23 if (!elem) return null;
andrewboyson 95:8c9dda8a0caf 24 if (ajaxOverrideBlockUpdateOnFocus_) return elem;
andrewboyson 95:8c9dda8a0caf 25 if (elem !== document.activeElement) return elem;
andrewboyson 95:8c9dda8a0caf 26 return null;
andrewboyson 95:8c9dda8a0caf 27 }
andrewboyson 95:8c9dda8a0caf 28 function ajaxHexToBit_(text, iBit)
andrewboyson 95:8c9dda8a0caf 29 {
andrewboyson 95:8c9dda8a0caf 30 let value = parseInt(text, 16);
andrewboyson 95:8c9dda8a0caf 31 value >>= iBit;
andrewboyson 95:8c9dda8a0caf 32 return value & 1;
andrewboyson 95:8c9dda8a0caf 33 }
andrewboyson 95:8c9dda8a0caf 34
andrewboyson 95:8c9dda8a0caf 35 //Private ajax functions
andrewboyson 95:8c9dda8a0caf 36 function ajaxHandleAjaxResponse_()
andrewboyson 95:8c9dda8a0caf 37 {
andrewboyson 95:8c9dda8a0caf 38 if (ajaxXhr_.readyState == 4 && ajaxXhr_.status == 200)
andrewboyson 95:8c9dda8a0caf 39 {
andrewboyson 95:8c9dda8a0caf 40 ajaxResponse_ = ajaxXhr_.responseText;
andrewboyson 95:8c9dda8a0caf 41 ajaxHeaders_ = ajaxXhr_.getAllResponseHeaders();
andrewboyson 95:8c9dda8a0caf 42 let elem;
andrewboyson 95:8c9dda8a0caf 43 elem = ajaxGetElementOrNull_('ajax-response'); if (elem) elem.textContent = ajaxResponse_;
andrewboyson 95:8c9dda8a0caf 44 elem = ajaxGetElementOrNull_('ajax-headers' ); if (elem) elem.textContent = ajaxHeaders_;
andrewboyson 95:8c9dda8a0caf 45 if (ajaxOnResponse_) ajaxOnResponse_();
andrewboyson 95:8c9dda8a0caf 46 ajaxOverrideBlockUpdateOnFocus_ = false; //Received response so reset override after display
andrewboyson 95:8c9dda8a0caf 47 }
andrewboyson 95:8c9dda8a0caf 48 }
andrewboyson 95:8c9dda8a0caf 49 function ajaxSendAjaxRequest_(request) //Used by this script and from HTML page
andrewboyson 95:8c9dda8a0caf 50 {
andrewboyson 95:8c9dda8a0caf 51 ajaxXhr_ = new XMLHttpRequest();
andrewboyson 95:8c9dda8a0caf 52 ajaxXhr_.onreadystatechange = ajaxHandleAjaxResponse_;
andrewboyson 95:8c9dda8a0caf 53 if (request) ajaxXhr_.open('GET', ajaxServer_ + '?' + request, true);
andrewboyson 95:8c9dda8a0caf 54 else ajaxXhr_.open('GET', ajaxServer_ , true);
andrewboyson 95:8c9dda8a0caf 55 ajaxXhr_.send();
andrewboyson 95:8c9dda8a0caf 56 ajaxMsCountAtAjaxSend_ = ajaxMs_;
andrewboyson 95:8c9dda8a0caf 57 }
andrewboyson 95:8c9dda8a0caf 58 function AjaxRequest(request) //From html
andrewboyson 95:8c9dda8a0caf 59 {
andrewboyson 95:8c9dda8a0caf 60 ajaxOverrideBlockUpdateOnFocus_ = true; //Request has come from an update
andrewboyson 95:8c9dda8a0caf 61 ajaxSendAjaxRequest_(request);
andrewboyson 95:8c9dda8a0caf 62 }
andrewboyson 95:8c9dda8a0caf 63
andrewboyson 95:8c9dda8a0caf 64 //Private functions
andrewboyson 95:8c9dda8a0caf 65 function ajaxTick_() //Called about every 100ms
andrewboyson 95:8c9dda8a0caf 66 {
andrewboyson 95:8c9dda8a0caf 67 ajaxMs_ += ajaxTickMs_; //Don't use Date.now() as we don't know when the PC's clock will be updated around a leap second
andrewboyson 95:8c9dda8a0caf 68 if (ajaxMs_ >= ajaxMsCountAtAjaxSend_ + ajaxUpdateMs_) ajaxSendAjaxRequest_('');
andrewboyson 95:8c9dda8a0caf 69 if (ajaxOnTick_) ajaxOnTick_();
andrewboyson 95:8c9dda8a0caf 70 }
andrewboyson 95:8c9dda8a0caf 71 function ajaxInit_()
andrewboyson 95:8c9dda8a0caf 72 {
andrewboyson 95:8c9dda8a0caf 73 setInterval(ajaxTick_, ajaxTickMs_);
andrewboyson 95:8c9dda8a0caf 74 ajaxSendAjaxRequest_('');
andrewboyson 95:8c9dda8a0caf 75 }
andrewboyson 95:8c9dda8a0caf 76
andrewboyson 95:8c9dda8a0caf 77 //Exposed public
andrewboyson 95:8c9dda8a0caf 78 class Ajax
andrewboyson 95:8c9dda8a0caf 79 {
andrewboyson 95:8c9dda8a0caf 80 static get ms () { return ajaxMs_ ; }
andrewboyson 95:8c9dda8a0caf 81 static get response () { return ajaxResponse_ ; }
andrewboyson 95:8c9dda8a0caf 82 static get headers () { return ajaxHeaders_ ; }
andrewboyson 95:8c9dda8a0caf 83 static set tickMs (v) { ajaxTickMs_ = v ; }
andrewboyson 95:8c9dda8a0caf 84 static set updateMs (v) { ajaxUpdateMs_ = v ; }
andrewboyson 95:8c9dda8a0caf 85 static set server (v) { ajaxServer_ = v ; }
andrewboyson 95:8c9dda8a0caf 86 static set onResponse(v) { ajaxOnResponse_ = v ; }
andrewboyson 95:8c9dda8a0caf 87 static set onTick (v) { ajaxOnTick_ = v ; }
andrewboyson 95:8c9dda8a0caf 88
andrewboyson 95:8c9dda8a0caf 89 static getElementOrNull(elementName) { return ajaxGetElementOrNull_(elementName) ; }
andrewboyson 95:8c9dda8a0caf 90 static hexToBit (text, iBit ) { return ajaxHexToBit_ (text, iBit ) ; }
andrewboyson 95:8c9dda8a0caf 91
andrewboyson 95:8c9dda8a0caf 92 static init()
andrewboyson 95:8c9dda8a0caf 93 {
andrewboyson 95:8c9dda8a0caf 94 if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', ajaxInit_ ); // Loading hasn't finished yet
andrewboyson 95:8c9dda8a0caf 95 else ajaxInit_(); //`DOMContentLoaded` has already fired
andrewboyson 95:8c9dda8a0caf 96 }
andrewboyson 95:8c9dda8a0caf 97 }