Andrew Boyson
Common stuff for all my devices' web server pages: css, login, log, ipv4, ipv6, firmware update, clock, reset info etc.
Dependents: oldheating gps motorhome heating
Security
A password has to be set whenever there has been a software reset. Resets following faults or power on do not require a new password as the hash is restored from the RTC GPREG register.
The password is not saved on the device; instead a 32 bit hash of the password is saved. It would take 2^31 attempts to brute force the password: this could be done in under a month if an attempt were possible every millisecond. To prevent this a 200 ms delay is introduced in the reply to the login form, that gives a more reasonable 13 years to brute force the password.
Once the password is accepted a random session id is created. This is 36 bit to give six base 64 characters but without an extra delay. If an attempt could be made every ms then this would still take over a year to brute force.
The most likely attack would to use a dictionary with, say, 10 million entries against the password which would still take 20 days to do.
clock/http-clock-script.js
- Committer:
- andrewboyson
- Date:
- 2019-03-23
- Revision:
- 77:4689596a2f3f
- Parent:
- 46:1822fdbe6c0c
- Child:
- 94:d7226b2c14b6
File content as of revision 77:4689596a2f3f:
'use strict';
var response = '';
var headers = '';
var msRtc = 0; //nibbles 0 to 3: 16 bits
var msCountAtRtcSet = 0;
var msDiff = 0;
var rtcIsSet = false; //nibble 4 : bit 0
var clockIsSet = false; //nibble 4 : bit 1
var sourceIsOk = false; //nibble 4 : bit 2
var rateIsLocked = false; //nibble 4 : bit 3
var timeIsLocked = false; //nibble 5 : bit 0
var leapEnable = false; //nibble 5 : bit 1
var leapForward = false; //nibble 5 : bit 2
var leapmonths1970 = 0; //nibbles 6 to 8: 12 bits
var leapmonth = 0;
var leapyear = 0;
var leaps = 0; //nibbles 9 to 12: 16 bits
var ppb = 0; //nibbles 13 to 20: 32 bits
var scanavg = 0; //nibbles 21 to 28: 32 bits
var scanmax = 0; //nibbles 29 to 36: 32 bits
var scanmin = 0; //nibbles 37 to 44: 32 bits
var msCount = 0;
const TICK_MS = 100;
const AJAX_REFRESH_MS = 10000;
const AJAX_QUIET_MS = 3000;
function hexToBit(iChar, iBit)
{
var value = parseInt(response.charAt(iChar), 16);
value >>= iBit;
return value & 1;
}
function parseAjax()
{
var iDateStart = headers.toLowerCase().indexOf('date:');
var iDateEnd = headers.indexOf('\r', iDateStart);
var rtcDate = new Date(headers.slice(iDateStart + 5, iDateEnd));
msRtc = parseInt(response.substr(0, 4), 16);
msRtc += rtcDate.getTime();
msDiff = msRtc - Date.now();
msCountAtRtcSet = msCount;
rtcIsSet = hexToBit(4, 0);
clockIsSet = hexToBit(4, 1);
sourceIsOk = hexToBit(4, 2);
rateIsLocked = hexToBit(4, 3);
timeIsLocked = hexToBit(5, 0);
leapEnable = hexToBit(5, 1);
leapForward = hexToBit(5, 2);
leapmonths1970 = parseInt(response.substr(6, 3), 16);
leapmonth = leapmonths1970 % 12;
leapyear = (leapmonths1970 - leapmonth) / 12;
leapmonth += 1;
leapyear += 1970;
leaps = parseInt(response.substr( 9, 4), 16);
ppb = parseInt(response.substr(13, 8), 16);
scanavg = parseInt(response.substr(21, 8), 16);
scanmax = parseInt(response.substr(29, 8), 16);
scanmin = parseInt(response.substr(37, 8), 16);
}
function displayGeneral()
{
var elem;
elem = document.getElementById('ajax-rtc-set' ); if (elem) elem.setAttribute('dir', rtcIsSet ? 'rtl' : 'ltr');
elem = document.getElementById('ajax-clock-set' ); if (elem) elem.setAttribute('dir', clockIsSet ? 'rtl' : 'ltr');
elem = document.getElementById('ajax-source-ok' ); if (elem) elem.setAttribute('dir', sourceIsOk ? 'rtl' : 'ltr');
elem = document.getElementById('ajax-rate-locked' ); if (elem) elem.setAttribute('dir', rateIsLocked ? 'rtl' : 'ltr');
elem = document.getElementById('ajax-time-locked' ); if (elem) elem.setAttribute('dir', timeIsLocked ? 'rtl' : 'ltr');
elem = document.getElementById('ajax-leap-enable' ); if (elem) elem.setAttribute('dir', leapEnable ? 'rtl' : 'ltr');
elem = document.getElementById('ajax-leap-forward' ); if (elem) elem.setAttribute('dir', leapForward ? 'rtl' : 'ltr');
elem = document.getElementById('ajax-leap-year' ); if (elem) elem.value = leapmonths1970 ? leapyear : '';
elem = document.getElementById('ajax-leap-month' ); if (elem) elem.value = leapmonths1970 ? leapmonth : '';
elem = document.getElementById('ajax-leap-count' ); if (elem) elem.value = leaps;
elem = document.getElementById('ajax-ppb' ); if (elem) elem.value = ppb;
elem = document.getElementById('ajax-scan-avg' ); if (elem) elem.textContent = scanavg;
elem = document.getElementById('ajax-scan-max' ); if (elem) elem.textContent = scanmax;
elem = document.getElementById('ajax-scan-min' ); if (elem) elem.textContent = scanmin;
elem = document.getElementById('ajax-response' ); if (elem) elem.textContent = response;
elem = document.getElementById('ajax-headers' ); if (elem) elem.textContent = headers;
elem = document.getElementById('ajax-date-diff' ); if (elem) elem.textContent = msDiff;
}
function formatNumbers00(i)
{
if (i<10) i='0' + i;
return i;
}
function formatDayOfWeek(wday)
{
switch(wday)
{
case 0: return 'Sun';
case 1: return 'Mon';
case 2: return 'Tue';
case 3: return 'Wed';
case 4: return 'Thu';
case 5: return 'Fri';
case 6: return 'Sat';
default: return '---';
}
}
function adjustLeap()
{
if (msRtc == 0) return; //Don't attempt to adjust an invalid time
if (!leapEnable) return; // Adjustment disabled
//Get the calander date and time from the ms
var now = msCount - msCountAtRtcSet + msRtc;
var leapStart = Date.UTC(leapyear, leapmonth - 1, 1, 0, 0, leapForward ? 0: -1);
if (now < leapStart) return; //Do nothing until reached the leap start
if (leapForward) { msRtc -= 1000; leaps += 1; } //repeat 59
else { msRtc += 1000; leaps -= 1; } //skip 59
leapEnable = false;
}
function displayTime()
{
if (msRtc == 0) return; //Don't attempt to display an invalid time
//Get the calander date and time from the ms
var now = new Date(msCount - msCountAtRtcSet + msRtc);
var y = now.getUTCFullYear();
var n = now.getUTCMonth () + 1;
var d = now.getUTCDate ();
var w = now.getUTCDay (); // 0 == Sunday
var h = now.getUTCHours ();
var m = now.getUTCMinutes ();
var s = now.getUTCSeconds ();
//Format time
n = formatNumbers00(n);
d = formatNumbers00(d);
h = formatNumbers00(h);
m = formatNumbers00(m);
s = formatNumbers00(s);
w = formatDayOfWeek(w);
//Display time
var elem;
elem = document.getElementById('ajax-date-utc');
if (elem) elem.textContent = y + '-' + n + '-' + d + ' ' + w + ' ' + h + ':' + m + ':' + s + ' TAI-UTC=' + leaps;
elem = document.getElementById('ajax-date-pc');
var options =
{
year: 'numeric',
month: 'short',
day: '2-digit',
weekday: 'short',
hour: '2-digit',
minute: '2-digit',
second: '2-digit',
timeZoneName: 'short'
};
if (elem) elem.textContent = now.toLocaleString(undefined, options);
}
var ajax;
var msCountAtAjaxSend = 0;
function AjaxRequest(request) //Used by this script and from HTML page
{
ajax=new XMLHttpRequest();
ajax.onreadystatechange=handleAjaxResponse;
if (request) ajax.open('GET', '/clock-ajax' + '?' + request, true);
else ajax.open('GET', '/clock-ajax' , true);
ajax.send();
}
function requestAjax() //Used in this script
{
AjaxRequest('');
msCountAtAjaxSend = msCount;
}
function counter()
{
msCount += TICK_MS; //Don't use Date.now() as we don't know when its clock will be updated around a leap second
adjustLeap();
displayTime();
if (msCount >= msCountAtRtcSet + AJAX_REFRESH_MS && //Wait until time to refresh
msCount >= msCountAtAjaxSend + AJAX_QUIET_MS) //Don't repeat during quiet period
{
requestAjax(); //RequestAjax will set msRtc and reset msCount
}
}
function handleAjaxResponse()
{
if (ajax.readyState==4 && ajax.status==200)
{
response = ajax.responseText;
headers = ajax.getAllResponseHeaders();
parseAjax();
displayGeneral();
}
}
function DisplayLeap() //Called by display leap button in HTML
{
leapEnable = true;
msRtc = Date.UTC(leapyear, leapmonth - 1, 1) - AJAX_REFRESH_MS / 2; //displays the refresh period around the latest leap second
msCountAtRtcSet = msCount;
}
function init()
{
setInterval(counter, TICK_MS);
requestAjax();
}
if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', init ); // Loading hasn't finished yet
else init(); //`DOMContentLoaded` has already fired