Andrew Boyson / web

Common stuff for all my devices' web server pages: css, login, log, ipv4, ipv6, firmware update, clock, reset info etc.

Dependents:   oldheating gps motorhome heating

Security

A password has to be set whenever there has been a software reset. Resets following faults or power on do not require a new password as the hash is restored from the RTC GPREG register.

The password is not saved on the device; instead a 32 bit hash of the password is saved. It would take 2^31 attempts to brute force the password: this could be done in under a month if an attempt were possible every millisecond. To prevent this a 200 ms delay is introduced in the reply to the login form, that gives a more reasonable 13 years to brute force the password.

Once the password is accepted a random session id is created. This is 36 bit to give six base 64 characters but without an extra delay. If an attempt could be made every ms then this would still take over a year to brute force.

The most likely attack would to use a dictionary with, say, 10 million entries against the password which would still take 20 days to do.

http/http.c@160:daa94b75b94c, 2021-05-11 (annotated)

Committer:
andrewboyson
Date:
Tue May 11 11:00:00 2021 +0000
Revision:
160:daa94b75b94c
Parent:
135:c1490f7e95be 
CSS modified to not change the text colour when hovering over a disabled button: it still does for buttons which are enabled.

Who changed what in which revision?

UserRevisionLine numberNew contents of line
andrewboyson 130:9a5b8fe308f1 1 #include "http.h"
andrewboyson 130:9a5b8fe308f1 2 #include "http-connection.h"
andrewboyson 130:9a5b8fe308f1 3 #include "web.h"
andrewboyson 130:9a5b8fe308f1 4 #include "mstimer.h"
andrewboyson 130:9a5b8fe308f1 5 #include "log.h"
andrewboyson 130:9a5b8fe308f1 6
andrewboyson 130:9a5b8fe308f1 7 bool HttpGetTrace()
andrewboyson 130:9a5b8fe308f1 8 {
andrewboyson 130:9a5b8fe308f1 9 return WebTrace;
andrewboyson 130:9a5b8fe308f1 10 }
andrewboyson 130:9a5b8fe308f1 11
andrewboyson 130:9a5b8fe308f1 12 void HttpReset(int connection)
andrewboyson 130:9a5b8fe308f1 13 {
andrewboyson 130:9a5b8fe308f1 14 HttpConnectionReset(connection);
andrewboyson 130:9a5b8fe308f1 15 }
andrewboyson 130:9a5b8fe308f1 16 bool HttpAdd(int connectionId, int* pWindowSize, char* pWindow, uint32_t windowPositionInStream)
andrewboyson 130:9a5b8fe308f1 17 {
andrewboyson 130:9a5b8fe308f1 18 HttpAddStart(windowPositionInStream, *pWindowSize, pWindow); //We have something to send so start the buffer
andrewboyson 130:9a5b8fe308f1 19 *pWindowSize = 0;
andrewboyson 130:9a5b8fe308f1 20
andrewboyson 130:9a5b8fe308f1 21 struct HttpConnection* pConnection = HttpConnectionOrNull(connectionId);
andrewboyson 130:9a5b8fe308f1 22 if (!pConnection) return false; //Protects the gap between the connection being established and the request being started
andrewboyson 130:9a5b8fe308f1 23
andrewboyson 130:9a5b8fe308f1 24 int todo = pConnection->toDo; //Make a copy so that we don't modify todo in the state
andrewboyson 130:9a5b8fe308f1 25
andrewboyson 130:9a5b8fe308f1 26 WebAddResponse(todo);
andrewboyson 130:9a5b8fe308f1 27
andrewboyson 130:9a5b8fe308f1 28 *pWindowSize = HttpAddLength();
andrewboyson 130:9a5b8fe308f1 29
andrewboyson 130:9a5b8fe308f1 30 return !HttpAddFilled(); //If we haven't used a full buffer then we have finished
andrewboyson 130:9a5b8fe308f1 31 }
andrewboyson 130:9a5b8fe308f1 32 int HttpPoll(int connectionId, bool clientFinished)
andrewboyson 130:9a5b8fe308f1 33 {
andrewboyson 130:9a5b8fe308f1 34 struct HttpConnection* pConnection = HttpConnectionOrNull(connectionId);
andrewboyson 134:3d0abf4cd097 35 if (!pConnection) //Protects the gap between the connection being established and the request being started
andrewboyson 134:3d0abf4cd097 36 {
andrewboyson 134:3d0abf4cd097 37 if (clientFinished) return HTTP_FINISHED; //The client hasn't requested anything and never will so finish
andrewboyson 134:3d0abf4cd097 38 else return HTTP_WAIT; //The client hasn't requested anything yet but still could
andrewboyson 134:3d0abf4cd097 39 }
andrewboyson 130:9a5b8fe308f1 40
andrewboyson 130:9a5b8fe308f1 41 if (!pConnection->toDo)
andrewboyson 130:9a5b8fe308f1 42 {
andrewboyson 130:9a5b8fe308f1 43 if (clientFinished) return HTTP_FINISHED; //The client hasn't requested anything and never will so finish
andrewboyson 130:9a5b8fe308f1 44 else return HTTP_WAIT; //The client hasn't requested anything yet but still could
andrewboyson 130:9a5b8fe308f1 45 }
andrewboyson 130:9a5b8fe308f1 46 if (!pConnection->postComplete ) return HTTP_WAIT; //Wait for the request (usually a POST) to finish
andrewboyson 130:9a5b8fe308f1 47 if (!MsTimerAbsolute(pConnection->delayUntil)) return HTTP_WAIT; //Wait a while (usually after a LOGIN attempt)
andrewboyson 130:9a5b8fe308f1 48
andrewboyson 130:9a5b8fe308f1 49 return HTTP_HAVE_SOMETHING_TO_SEND;
andrewboyson 130:9a5b8fe308f1 50 }
andrewboyson 130:9a5b8fe308f1 51 void HttpRequest(int connectionId, int windowSize, char* pWindow, uint32_t windowPositionInStream)
andrewboyson 130:9a5b8fe308f1 52 {
andrewboyson 130:9a5b8fe308f1 53 struct HttpConnection* pConnection;
andrewboyson 130:9a5b8fe308f1 54 if (!windowPositionInStream)
andrewboyson 130:9a5b8fe308f1 55 {
andrewboyson 130:9a5b8fe308f1 56 pConnection = HttpConnectionNew(connectionId);
andrewboyson 130:9a5b8fe308f1 57 }
andrewboyson 130:9a5b8fe308f1 58 else
andrewboyson 130:9a5b8fe308f1 59 {
andrewboyson 130:9a5b8fe308f1 60 pConnection = HttpConnectionOrNull(connectionId);
andrewboyson 130:9a5b8fe308f1 61 if (!pConnection)
andrewboyson 130:9a5b8fe308f1 62 {
andrewboyson 130:9a5b8fe308f1 63 LogTimeF("WebRequest - no connection corresponds to id %d\r\n", connectionId);
andrewboyson 130:9a5b8fe308f1 64 return;
andrewboyson 130:9a5b8fe308f1 65 }
andrewboyson 130:9a5b8fe308f1 66 }
andrewboyson 130:9a5b8fe308f1 67
andrewboyson 130:9a5b8fe308f1 68 pConnection->delayUntil = MsTimerCount; //Default to no delay unless modified;
andrewboyson 130:9a5b8fe308f1 69
andrewboyson 130:9a5b8fe308f1 70 //Handle request for the first packet of data received but leave todo the same after that.
andrewboyson 130:9a5b8fe308f1 71 int contentLength = 0;
andrewboyson 130:9a5b8fe308f1 72 int contentStart = 0;
andrewboyson 130:9a5b8fe308f1 73 if (windowSize && windowPositionInStream == 0)
andrewboyson 130:9a5b8fe308f1 74 {
andrewboyson 130:9a5b8fe308f1 75 //Read the headers
andrewboyson 130:9a5b8fe308f1 76 char* pMethod;
andrewboyson 130:9a5b8fe308f1 77 char* pPath;
andrewboyson 130:9a5b8fe308f1 78 char* pQuery;
andrewboyson 130:9a5b8fe308f1 79 char* pLastModified;
andrewboyson 130:9a5b8fe308f1 80 char* pCookies;
andrewboyson 130:9a5b8fe308f1 81 contentStart = HttpRequestRead(pWindow, windowSize, &pMethod, &pPath, &pQuery, &pLastModified, &pCookies, &contentLength);
andrewboyson 130:9a5b8fe308f1 82
andrewboyson 130:9a5b8fe308f1 83 //Ask the web server what to do
andrewboyson 130:9a5b8fe308f1 84 pConnection->toDo = WebDecideWhatToDo(pPath, pLastModified);
andrewboyson 130:9a5b8fe308f1 85
andrewboyson 130:9a5b8fe308f1 86 //Handle the query
andrewboyson 130:9a5b8fe308f1 87 int stop = WebHandleQuery(pQuery, pCookies, &pConnection->toDo, &pConnection->delayUntil); //return -1 on stop; 0 on continue
andrewboyson 130:9a5b8fe308f1 88 if (stop)
andrewboyson 130:9a5b8fe308f1 89 {
andrewboyson 130:9a5b8fe308f1 90 pConnection->postComplete = true;
andrewboyson 130:9a5b8fe308f1 91 return;
andrewboyson 130:9a5b8fe308f1 92 }
andrewboyson 130:9a5b8fe308f1 93 }
andrewboyson 130:9a5b8fe308f1 94
andrewboyson 130:9a5b8fe308f1 95 //Do the upload of anything that needs it. Todos it doesn't understand are ignored.
andrewboyson 130:9a5b8fe308f1 96 if (!pConnection->postComplete) WebHandlePost(pConnection->toDo, contentLength, contentStart, windowSize, pWindow, windowPositionInStream, &pConnection->postComplete);
andrewboyson 130:9a5b8fe308f1 97 }