/* Timer callback */
static void on_sess_timer(pj_timer_heap_t *th,
pj_timer_entry *te)
{
nat_detect_session *sess;
sess = (nat_detect_session*) te->user_data;
if (te->id == TIMER_DESTROY) {
pj_grp_lock_acquire(sess->grp_lock);
pj_ioqueue_unregister(sess->key);
sess->key = NULL;
sess->sock = PJ_INVALID_SOCKET;
te->id = 0;
pj_grp_lock_release(sess->grp_lock);
sess_destroy(sess);
} else if (te->id == TIMER_TEST) {
pj_bool_t next_timer;
pj_grp_lock_acquire(sess->grp_lock);
next_timer = PJ_FALSE;
if (sess->timer_executed == 0) {
send_test(sess, ST_TEST_1, NULL, 0);
next_timer = PJ_TRUE;
} else if (sess->timer_executed == 1) {
send_test(sess, ST_TEST_2, NULL, CHANGE_IP_PORT_FLAG);
next_timer = PJ_TRUE;
} else if (sess->timer_executed == 2) {
send_test(sess, ST_TEST_3, NULL, CHANGE_PORT_FLAG);
} else {
pj_assert(!"Shouldn't have timer at this state");
}
++sess->timer_executed;
if (next_timer) {
pj_time_val delay = {0, TEST_INTERVAL};
pj_timer_heap_schedule(th, te, &delay);
} else {
te->id = 0;
}
pj_grp_lock_release(sess->grp_lock);
} else {
pj_assert(!"Invalid timer ID");
}
}
/**
* @brief Create a new session for a given web connection.
* @note The session stores the following data points: remote IP address, request path, application name, the specified http hostname,
* the remote client's user agent string, the server's host number, a unique session id, the server's current timestamp, a randomly-
* generated session key for authentication, and an encrypted token for the session returned to the user as a cookie.
* @param con a pointer to the connection underlying the web session.
* @param path a pointer to a managed string containing the pathname of the generating request (should be "/portal/camel").
* @param application a pointer to a managed string containing the name of the parent application of the session (should be "portal").
* @return NULL on failure or a pointer to a newly allocated session object for the specified connection.
*/
session_t *sess_create(connection_t *con, stringer_t *path, stringer_t *application) {
session_t *output;
multi_t key = { .type = M_TYPE_UINT64, .val.u64 = 0 };
if (!(output = mm_alloc(sizeof(session_t)))) {
log_pedantic("Unable to allocate %zu bytes for a session context.", sizeof(session_t));
return NULL;
}
else if (pthread_mutex_init(&(output->lock), NULL) != 0) {
log_pedantic("Unable to initialize reference lock for new user session.");
mm_free(output);
return NULL;
} else if (!(output->compositions = inx_alloc(M_INX_LINKED, &sess_release_composition))) {
log_pedantic("Unable to allocate space for user session's compositions.");
mm_free(output);
return NULL;
}
if (!(ip_copy(&(output->warden.ip), con_addr(con, MEMORYBUF(64)))) ||
(path && !(output->request.path = st_dupe_opts(MANAGED_T | HEAP | CONTIGUOUS, path))) ||
(application && !(output->request.application = st_dupe_opts(MANAGED_T | HEAP | CONTIGUOUS, application))) ||
(con->http.host && !(output->request.host = st_dupe_opts(MANAGED_T | HEAP | CONTIGUOUS, con->http.host))) ||
(con->http.agent && !(output->warden.agent = st_dupe_opts(MANAGED_T | HEAP | CONTIGUOUS, con->http.agent))) ||
!(output->warden.host = magma.host.number) || !(key.val.u64 = output->warden.number = sess_number()) ||
!(output->warden.stamp = time(NULL)) || !(output->warden.key = sess_key()) || !(output->warden.token = sess_token(output))) {
log_pedantic("Unable to initialize the session warden context.");
sess_destroy(output);
return NULL;
}
output->request.httponly = true;
output->request.secure = (con_secure(con) == 1 ? true : false);
sess_ref_add(output);
if (inx_insert(objects.sessions, key, output) != 1) {
log_pedantic("Unable to insert the session into the global context.");
sess_ref_dec(output);
sess_destroy(output);
return NULL;
}
return output;
}
/**
* @brief Try to retrieve the session associated with a client connection's supplied cookie.
* @param con a pointer to the connection object sending the cookie.
* @param application a managed string containing the application associated with the session.
* @param path a managed string containing the path associated with the session.
* @param token the encrypted user token retrieved from the supplied http cookie.
* @return 1 if the cookie was found and valid, or one of the following values on failure:
* 0 = Session not found.
* -1 = Server error.
* -2 = Invalid token.
* -3 = Security violation / incorrect user-agent.
* -4 = Security violation / incorrect session key.
* -5 = Security violation / incorrect source address.
* -6 = Session terminated by logout.
* -7 = Session timed out.
*/
int_t sess_get(connection_t *con, stringer_t *application, stringer_t *path, stringer_t *token) {
uint64_t *numbers;
scramble_t *scramble;
stringer_t *binary, *encrypted;
multi_t key = { .type = M_TYPE_UINT64, .val.u64 = 0 };
int_t result = 1;
/// Most session attributes need simple equality comparison, except for timeout checking. Make sure not to validate against a stale session that should have already timed out (which will have to be determined dynamically).
encrypted = zbase32_decode(token);
scramble = scramble_import(encrypted);
binary = scramble_decrypt(magma.secure.sessions, scramble);
st_cleanup(encrypted);
if (!binary) {
return 0;
}
numbers = st_data_get(binary);
// QUESTION: Is this necessary? doesn't inx_find() lock the inx?
inx_lock_read(objects.sessions);
key.val.u64 = *(numbers + 2);
if ((con->http.session = inx_find(objects.sessions, key))) {
sess_ref_add(con->http.session);
}
inx_unlock(objects.sessions);
st_free(binary);
// Return if we didn't find the session or user.
if (!con->http.session || !con->http.session->user) {
return 0;
}
// We need to do full validation against the cookie and associated session.
// First, the cookie.
if ((*numbers != con->http.session->warden.host) || (*(numbers + 1) != con->http.session->warden.stamp) ||
(*(numbers + 2) != con->http.session->warden.number)) {
log_error("Received mismatched cookie for authenticated session { user = %s }", st_char_get(con->http.session->user->username));
result = -2;
} else if (*(numbers + 3) != con->http.session->warden.key) {
log_error("Cookie contained an incorrect session key { user = %s }", st_char_get(con->http.session->user->username));
result = -4;
} else if (st_cmp_cs_eq(application, con->http.session->request.application)) {
log_error("Cookie did not match session's application { user = %s }", st_char_get(con->http.session->user->username));
result = -2;
} else if (st_cmp_cs_eq(path, con->http.session->request.path)) {
log_error("Cookie did not match session's path { user = %s }", st_char_get(con->http.session->user->username));
result = -2;
} else if (st_cmp_cs_eq(con->http.agent, con->http.session->warden.agent)) {
log_error("Cookie contained a mismatched user agent { user = %s }", st_char_get(con->http.session->user->username));
result = -3;
} else if (con->http.session->request.secure != (con_secure(con) ? 1 : 0)) {
log_error("Cookie was submitted from a mismatched transport layer { user = %s }", st_char_get(con->http.session->user->username));
result = -5;
} else if (!ip_address_equal(&(con->http.session->warden.ip), (ip_t *)con_addr(con, MEMORYBUF(64)))) {
log_error("Cookie was submitted from a mismatched IP address { user = %s }", st_char_get(con->http.session->user->username));
result = -5;
}
// Finally, do comparisons to see that we haven't timed out.
/* Did we expire? */
if (magma.http.session_timeout <= (time(NULL) - con->http.session->warden.stamp)) {
log_pedantic("User submitted expired or invalidated cookie; marking for deletion { user = %s }", st_char_get(con->http.session->user->username));
result = -7;
}
// QUESTION: This destruction needs a second look.
if (result < 0) {
if (!inx_delete(objects.sessions, key)) {
log_pedantic("Unexpected error occurred attempting to delete expired cookie { user = %s }", st_char_get(con->http.session->user->username));
}
sess_ref_dec(con->http.session);
//sess_destroy(con->http.session);
con->http.session = NULL;
}
// Otherwise, if the last session status update is more than 10 minutes ago, check now to see if things are current.
// QUESTION: Why is it 600 here and 120 elsewhere?
else if ((time(NULL) - sess_refresh_stamp(con->http.session)) > 600) {
sess_update(con->http.session);
}
return result;
}
pj_status_t pj_stun_detect_nat_type(const pj_sockaddr_in *server,
pj_stun_config *stun_cfg,
void *user_data,
pj_stun_nat_detect_cb *cb)
{
pj_pool_t *pool;
nat_detect_session *sess;
pj_stun_session_cb sess_cb;
pj_ioqueue_callback ioqueue_cb;
int addr_len;
pj_status_t status;
PJ_ASSERT_RETURN(server && stun_cfg, PJ_EINVAL);
PJ_ASSERT_RETURN(stun_cfg->pf && stun_cfg->ioqueue && stun_cfg->timer_heap,
PJ_EINVAL);
/*
* Init NAT detection session.
*/
pool = pj_pool_create(stun_cfg->pf, "natck%p", PJNATH_POOL_LEN_NATCK,
PJNATH_POOL_INC_NATCK, NULL);
if (!pool)
return PJ_ENOMEM;
sess = PJ_POOL_ZALLOC_T(pool, nat_detect_session);
sess->pool = pool;
sess->user_data = user_data;
sess->cb = cb;
status = pj_grp_lock_create(pool, NULL, &sess->grp_lock);
if (status != PJ_SUCCESS) {
/* Group lock not created yet, just destroy pool and return */
pj_pool_release(pool);
return status;
}
pj_grp_lock_add_ref(sess->grp_lock);
pj_grp_lock_add_handler(sess->grp_lock, pool, sess, &sess_on_destroy);
pj_memcpy(&sess->server, server, sizeof(pj_sockaddr_in));
/*
* Init timer to self-destroy.
*/
sess->timer_heap = stun_cfg->timer_heap;
sess->timer.cb = &on_sess_timer;
sess->timer.user_data = sess;
/*
* Initialize socket.
*/
status = pj_sock_socket(pj_AF_INET(), pj_SOCK_DGRAM(), 0, &sess->sock);
if (status != PJ_SUCCESS)
goto on_error;
/*
* Bind to any.
*/
pj_bzero(&sess->local_addr, sizeof(pj_sockaddr_in));
sess->local_addr.sin_family = pj_AF_INET();
status = pj_sock_bind(sess->sock, &sess->local_addr,
sizeof(pj_sockaddr_in));
if (status != PJ_SUCCESS)
goto on_error;
/*
* Get local/bound address.
*/
addr_len = sizeof(sess->local_addr);
status = pj_sock_getsockname(sess->sock, &sess->local_addr, &addr_len);
if (status != PJ_SUCCESS)
goto on_error;
/*
* Find out which interface is used to send to the server.
*/
status = get_local_interface(server, &sess->local_addr.sin_addr);
if (status != PJ_SUCCESS)
goto on_error;
PJ_LOG(5,(sess->pool->obj_name, "Local address is %s:%d",
pj_inet_ntoa(sess->local_addr.sin_addr),
pj_ntohs(sess->local_addr.sin_port)));
PJ_LOG(5,(sess->pool->obj_name, "Server set to %s:%d",
pj_inet_ntoa(server->sin_addr),
pj_ntohs(server->sin_port)));
/*
* Register socket to ioqueue to receive asynchronous input
* notification.
*/
pj_bzero(&ioqueue_cb, sizeof(ioqueue_cb));
ioqueue_cb.on_read_complete = &on_read_complete;
status = pj_ioqueue_register_sock2(sess->pool, stun_cfg->ioqueue,
sess->sock, sess->grp_lock, sess,
&ioqueue_cb, &sess->key);
if (status != PJ_SUCCESS)
goto on_error;
/*
* Create STUN session.
*/
pj_bzero(&sess_cb, sizeof(sess_cb));
sess_cb.on_request_complete = &on_request_complete;
sess_cb.on_send_msg = &on_send_msg;
status = pj_stun_session_create(stun_cfg, pool->obj_name, &sess_cb,
PJ_FALSE, sess->grp_lock, &sess->stun_sess);
if (status != PJ_SUCCESS)
goto on_error;
pj_stun_session_set_user_data(sess->stun_sess, sess);
/*
* Kick-off ioqueue reading.
*/
pj_ioqueue_op_key_init(&sess->read_op, sizeof(sess->read_op));
pj_ioqueue_op_key_init(&sess->write_op, sizeof(sess->write_op));
on_read_complete(sess->key, &sess->read_op, 0);
/*
* Start TEST_1
*/
sess->timer.id = TIMER_TEST;
on_sess_timer(stun_cfg->timer_heap, &sess->timer);
return PJ_SUCCESS;
on_error:
sess_destroy(sess);
return status;
}
