author | Michael Krelin <hacker@klever.net> | 2013-11-25 20:52:56 (UTC) |
---|---|---|
committer | Michael Krelin <hacker@klever.net> | 2013-11-25 20:52:56 (UTC) |
commit | fab898af773b3bbf28ed6c67c89b032d740d19f1 (patch) (unidiff) | |
tree | 0e7f59253d11556dcb29dc5372f7a77e91de086d | |
parent | 352f2216eec032efce4bdeddd2ffe5a9e326a99d (diff) | |
download | clipperz-fab898af773b3bbf28ed6c67c89b032d740d19f1.zip clipperz-fab898af773b3bbf28ed6c67c89b032d740d19f1.tar.gz clipperz-fab898af773b3bbf28ed6c67c89b032d740d19f1.tar.bz2 |
PG: also tracelog error (if any)
-rw-r--r-- | backend/node/src/clipperz.js | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/backend/node/src/clipperz.js b/backend/node/src/clipperz.js index 73af0a0..b98c00e 100644 --- a/backend/node/src/clipperz.js +++ b/backend/node/src/clipperz.js | |||
@@ -1,181 +1,181 @@ | |||
1 | var FS = require('fs'); | 1 | var FS = require('fs'); |
2 | var CRYPTO = require('crypto'); | 2 | var CRYPTO = require('crypto'); |
3 | var BIGNUM = require('bignum'); | 3 | var BIGNUM = require('bignum'); |
4 | var ASYNC = require('async'); | 4 | var ASYNC = require('async'); |
5 | 5 | ||
6 | var express_store = require('express').session.Store; | 6 | var express_store = require('express').session.Store; |
7 | 7 | ||
8 | function clipperz_hash(v) { | 8 | function clipperz_hash(v) { |
9 | return CRYPTO.createHash('sha256').update( | 9 | return CRYPTO.createHash('sha256').update( |
10 | CRYPTO.createHash('sha256').update(v).digest('binary') | 10 | CRYPTO.createHash('sha256').update(v).digest('binary') |
11 | ).digest('hex'); | 11 | ).digest('hex'); |
12 | }; | 12 | }; |
13 | function clipperz_random() { | 13 | function clipperz_random() { |
14 | for(var r = '';r.length<64;r+=''+BIGNUM(Math.floor(Math.random()*1e18)).toString(16)); | 14 | for(var r = '';r.length<64;r+=''+BIGNUM(Math.floor(Math.random()*1e18)).toString(16)); |
15 | return r.substr(0,64); | 15 | return r.substr(0,64); |
16 | }; | 16 | }; |
17 | function clipperz_store(PG) { | 17 | function clipperz_store(PG) { |
18 | var rv = function(o) { express_store.call(this,o); } | 18 | var rv = function(o) { express_store.call(this,o); } |
19 | rv.prototype.get = function(sid,cb) { PG.Q( | 19 | rv.prototype.get = function(sid,cb) { PG.Q( |
20 | "SELECT s_data FROM clipperz.thesession WHERE s_id=$1",[sid], | 20 | "SELECT s_data FROM clipperz.thesession WHERE s_id=$1",[sid], |
21 | function(e,r) { cb(e,(e||!r.rowCount)?null:r.rows[0].s_data); } | 21 | function(e,r) { cb(e,(e||!r.rowCount)?null:r.rows[0].s_data); } |
22 | ) }; | 22 | ) }; |
23 | rv.prototype.set = function(sid,data,cb) { PG.Q( | 23 | rv.prototype.set = function(sid,data,cb) { PG.Q( |
24 | "UPDATE clipperz.thesession SET s_data=$1, s_mtime=current_timestamp" | 24 | "UPDATE clipperz.thesession SET s_data=$1, s_mtime=current_timestamp" |
25 | +" WHERE s_id=$2",[data,sid], function(e,r) { | 25 | +" WHERE s_id=$2",[data,sid], function(e,r) { |
26 | if(e) return cb(e); | 26 | if(e) return cb(e); |
27 | if(r.rowCount) return cb(); | 27 | if(r.rowCount) return cb(); |
28 | PG.Q("INSERT INTO clipperz.thesession (s_id,s_data) VALUES ($1,$2)",[sid,data],cb); | 28 | PG.Q("INSERT INTO clipperz.thesession (s_id,s_data) VALUES ($1,$2)",[sid,data],cb); |
29 | } | 29 | } |
30 | ) }; | 30 | ) }; |
31 | rv.prototype.destroy = function(sid,cb) { PG.Q( | 31 | rv.prototype.destroy = function(sid,cb) { PG.Q( |
32 | "DELETE FROM clipperz.thesession WHERE s_id=$1",[sid],cb | 32 | "DELETE FROM clipperz.thesession WHERE s_id=$1",[sid],cb |
33 | ) }; | 33 | ) }; |
34 | rv.prototype.length = function(cb) { PG.Q( | 34 | rv.prototype.length = function(cb) { PG.Q( |
35 | "SELECT count(*) AS c FROM clipperz.thesession", function(e,r) { | 35 | "SELECT count(*) AS c FROM clipperz.thesession", function(e,r) { |
36 | cb(e,e?null:r.rows[0].c); | 36 | cb(e,e?null:r.rows[0].c); |
37 | } | 37 | } |
38 | ) }; | 38 | ) }; |
39 | rv.prototype.length = function(cb) { PQ.Q( | 39 | rv.prototype.length = function(cb) { PQ.Q( |
40 | "DELETE FROM clipperz.thesession", cb | 40 | "DELETE FROM clipperz.thesession", cb |
41 | ) }; | 41 | ) }; |
42 | rv.prototype.__proto__ = express_store.prototype; | 42 | rv.prototype.__proto__ = express_store.prototype; |
43 | return rv; | 43 | return rv; |
44 | } | 44 | } |
45 | 45 | ||
46 | var srp_g = BIGNUM(2); | 46 | var srp_g = BIGNUM(2); |
47 | var srp_n = BIGNUM("115b8b692e0e045692cf280b436735c77a5a9e8a9e7ed56c965f87db5b2a2ece3",16); | 47 | var srp_n = BIGNUM("115b8b692e0e045692cf280b436735c77a5a9e8a9e7ed56c965f87db5b2a2ece3",16); |
48 | var n123 = '112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00'; | 48 | var n123 = '112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00'; |
49 | 49 | ||
50 | 50 | ||
51 | var CLIPPERZ = module.exports = function(CONFIG) { | 51 | var CLIPPERZ = module.exports = function(CONFIG) { |
52 | 52 | ||
53 | var LOGGER = CONFIG.logger||{trace:function(){}}; | 53 | var LOGGER = CONFIG.logger||{trace:function(){}}; |
54 | 54 | ||
55 | var PG = { | 55 | var PG = { |
56 | url: CONFIG.psql, | 56 | url: CONFIG.psql, |
57 | PG: require('pg').native, | 57 | PG: require('pg').native, |
58 | Q: function(q,a,cb) { | 58 | Q: function(q,a,cb) { |
59 | if('function'===typeof a) cb=a,a=[]; | 59 | if('function'===typeof a) cb=a,a=[]; |
60 | LOGGER.trace({query:q,args:a},'SQL: %s',q); | 60 | LOGGER.trace({query:q,args:a},'SQL: %s',q); |
61 | PG.PG.connect(PG.url,function(e,C,D) { | 61 | PG.PG.connect(PG.url,function(e,C,D) { |
62 | if(e) return cb(e); | 62 | if(e) return cb(e); |
63 | var t0=new Date(); | 63 | var t0=new Date(); |
64 | C.query(q,a,function(e,r) { | 64 | C.query(q,a,function(e,r) { |
65 | var t1=new Date(), dt=t1-t0; | 65 | var t1=new Date(), dt=t1-t0; |
66 | D(); | 66 | D(); |
67 | LOGGER.trace({query:q,args:a,ms:dt,rows:r&&r.rowCount},"SQL query '%s' took %dms",q,dt); | 67 | LOGGER.trace({query:q,args:a,ms:dt,rows:r&&r.rowCount,err:e},"SQL query '%s' took %dms",q,dt); |
68 | cb(e,r); | 68 | cb(e,r); |
69 | }); | 69 | }); |
70 | }); | 70 | }); |
71 | }, | 71 | }, |
72 | T: function(cb) { | 72 | T: function(cb) { |
73 | PG.PG.connect(PG.url,function(e,C,D) { | 73 | PG.PG.connect(PG.url,function(e,C,D) { |
74 | if(e) return cb(e); | 74 | if(e) return cb(e); |
75 | C.query('BEGIN',function(e){ | 75 | C.query('BEGIN',function(e){ |
76 | if(e) return D(),cb(e); | 76 | if(e) return D(),cb(e); |
77 | cb(null,{ | 77 | cb(null,{ |
78 | Q: function(q,a,cb) { | 78 | Q: function(q,a,cb) { |
79 | LOGGER.trace({query:q,args:a},'SQL: %s',q); | 79 | LOGGER.trace({query:q,args:a},'SQL: %s',q); |
80 | if(this.over) return cb(new Error('game over')); | 80 | if(this.over) return cb(new Error('game over')); |
81 | if('function'===typeof a) cb=a,a=[]; | 81 | if('function'===typeof a) cb=a,a=[]; |
82 | var t0=new Date(); | 82 | var t0=new Date(); |
83 | C.query(q,a,function(e,r) { | 83 | C.query(q,a,function(e,r) { |
84 | var t1=new Date(), dt=t1-t0; | 84 | var t1=new Date(), dt=t1-t0; |
85 | LOGGER.trace({query:q,args:a,ms:dt,rows:r&&r.rowCount},"SQL query '%s' took %dms",q,dt); | 85 | LOGGER.trace({query:q,args:a,ms:dt,rows:r&&r.rowCount,err:e},"SQL query '%s' took %dms",q,dt); |
86 | cb(e,r); | 86 | cb(e,r); |
87 | }); | 87 | }); |
88 | }, | 88 | }, |
89 | commit: function(cb) { | 89 | commit: function(cb) { |
90 | LOGGER.trace('SQL: commit'); | 90 | LOGGER.trace('SQL: commit'); |
91 | if(this.over) return cb(new Error('game over')); | 91 | if(this.over) return cb(new Error('game over')); |
92 | return (this.over=true),C.query('COMMIT',function(e){D();cb&&cb(e)}); | 92 | return (this.over=true),C.query('COMMIT',function(e){D();cb&&cb(e)}); |
93 | }, | 93 | }, |
94 | rollback: function(cb) { | 94 | rollback: function(cb) { |
95 | LOGGER.trace('SQL: rollback'); | 95 | LOGGER.trace('SQL: rollback'); |
96 | if(this.over) return cb(new Error('game over')); | 96 | if(this.over) return cb(new Error('game over')); |
97 | return (this.over=true),C.query('ROLLBACK',function(e){D();cb&&cb(e)}); | 97 | return (this.over=true),C.query('ROLLBACK',function(e){D();cb&&cb(e)}); |
98 | }, | 98 | }, |
99 | end: function(e,cb) { | 99 | end: function(e,cb) { |
100 | if(e) return LOGGER.trace(e,"rolling back transaction due to an error"),this.rollback(cb); | 100 | if(e) return LOGGER.trace(e,"rolling back transaction due to an error"),this.rollback(cb); |
101 | this.commit(cb); | 101 | this.commit(cb); |
102 | } | 102 | } |
103 | }); | 103 | }); |
104 | }); | 104 | }); |
105 | }); | 105 | }); |
106 | } | 106 | } |
107 | }; | 107 | }; |
108 | 108 | ||
109 | 109 | ||
110 | var rv = { | 110 | var rv = { |
111 | 111 | ||
112 | json: function clipperz_json(req,res,cb) { | 112 | json: function clipperz_json(req,res,cb) { |
113 | var method = req.body.method, pp = JSON.parse(req.body.parameters).parameters; | 113 | var method = req.body.method, pp = JSON.parse(req.body.parameters).parameters; |
114 | var message = pp.message; | 114 | var message = pp.message; |
115 | var ppp = pp.parameters; | 115 | var ppp = pp.parameters; |
116 | res.res = function(o) { return res.json({result:o}) }; | 116 | res.res = function(o) { return res.json({result:o}) }; |
117 | LOGGER.trace({method:method,parameters:pp},"JSON request"); | 117 | LOGGER.trace({method:method,parameters:pp},"JSON request"); |
118 | 118 | ||
119 | switch(method) { | 119 | switch(method) { |
120 | case 'registration': | 120 | case 'registration': |
121 | switch(message) { | 121 | switch(message) { |
122 | case 'completeRegistration': return PG.Q( | 122 | case 'completeRegistration': return PG.Q( |
123 | "INSERT INTO clipperz.theuser" | 123 | "INSERT INTO clipperz.theuser" |
124 | +" (u_name, u_srp_s,u_srp_v, u_authversion,u_header,u_statistics,u_version,u_lock)" | 124 | +" (u_name, u_srp_s,u_srp_v, u_authversion,u_header,u_statistics,u_version,u_lock)" |
125 | +" VALUES ($1, $2,$3, $4,$5,$6,$7,$8)", | 125 | +" VALUES ($1, $2,$3, $4,$5,$6,$7,$8)", |
126 | [pp.credentials.C, pp.credentials.s, pp.credentials.v, | 126 | [pp.credentials.C, pp.credentials.s, pp.credentials.v, |
127 | pp.credentials.version,pp.user.header, pp.user.statistics, | 127 | pp.credentials.version,pp.user.header, pp.user.statistics, |
128 | pp.user.version, pp.user.lock], function(e,r) { | 128 | pp.user.version, pp.user.lock], function(e,r) { |
129 | if(e) return cb(e); | 129 | if(e) return cb(e); |
130 | res.res({lock:pp.user.lock,result:'done'}); | 130 | res.res({lock:pp.user.lock,result:'done'}); |
131 | }); | 131 | }); |
132 | } | 132 | } |
133 | break; | 133 | break; |
134 | 134 | ||
135 | case 'handshake': | 135 | case 'handshake': |
136 | switch(message) { | 136 | switch(message) { |
137 | case 'connect': return ASYNC.auto({ | 137 | case 'connect': return ASYNC.auto({ |
138 | u: function(cb) { PG.Q( | 138 | u: function(cb) { PG.Q( |
139 | "SELECT u_id, u_srp_s, u_srp_v FROM clipperz.theuser WHERE u_name=$1", | 139 | "SELECT u_id, u_srp_s, u_srp_v FROM clipperz.theuser WHERE u_name=$1", |
140 | [ppp.C], function(e,r) { | 140 | [ppp.C], function(e,r) { |
141 | if(e) return cb(e); | 141 | if(e) return cb(e); |
142 | if(!r.rowCount) return cb(null,{u_id:null,u_srp_s:n123,u_srp_v:n123}); | 142 | if(!r.rowCount) return cb(null,{u_id:null,u_srp_s:n123,u_srp_v:n123}); |
143 | cb(null,r.rows[0]); | 143 | cb(null,r.rows[0]); |
144 | }) }, | 144 | }) }, |
145 | otp: ['u',function(cb,r) { | 145 | otp: ['u',function(cb,r) { |
146 | if(!req.session.otp) return cb(); | 146 | if(!req.session.otp) return cb(); |
147 | if(req.session.u!=r.u.u_id) return cb(new Error('user/OTP mismatch')); | 147 | if(req.session.u!=r.u.u_id) return cb(new Error('user/OTP mismatch')); |
148 | PG.Q( | 148 | PG.Q( |
149 | "UPDATE clipperz.theotp AS otp" | 149 | "UPDATE clipperz.theotp AS otp" |
150 | +" SET" | 150 | +" SET" |
151 | +" otps_id=CASE WHEN s.otps_code='REQUESTED' THEN (" | 151 | +" otps_id=CASE WHEN s.otps_code='REQUESTED' THEN (" |
152 | +" SELECT ss.otps_id FROM clipperz.otpstatus AS ss WHERE ss.otps_code='USED'" | 152 | +" SELECT ss.otps_id FROM clipperz.otpstatus AS ss WHERE ss.otps_code='USED'" |
153 | +" ) ELSE otp.otps_id END," | 153 | +" ) ELSE otp.otps_id END," |
154 | +" otp_utime=current_timestamp" | 154 | +" otp_utime=current_timestamp" |
155 | +" FROM clipperz.otpstatus AS s, clipperz.theotp AS o" | 155 | +" FROM clipperz.otpstatus AS s, clipperz.theotp AS o" |
156 | +" WHERE" | 156 | +" WHERE" |
157 | +" o.otp_id=otp.otp_id AND otp.otps_id=s.otps_id" | 157 | +" o.otp_id=otp.otp_id AND otp.otps_id=s.otps_id" |
158 | +" AND otp.otp_id=$1 AND otp.u_id=$2" | 158 | +" AND otp.otp_id=$1 AND otp.u_id=$2" |
159 | +" RETURNING o.otps_id!=otp.otps_id AS yes, o.otp_ref", | 159 | +" RETURNING o.otps_id!=otp.otps_id AS yes, o.otp_ref", |
160 | [ req.session.otp, req.session.u ], | 160 | [ req.session.otp, req.session.u ], |
161 | function(e,r) { | 161 | function(e,r) { |
162 | if(e) return cb(e); | 162 | if(e) return cb(e); |
163 | if(!r.rowCount) return cb(new Error('no OTP found')); | 163 | if(!r.rowCount) return cb(new Error('no OTP found')); |
164 | r=r.rows[0]; | 164 | r=r.rows[0]; |
165 | if(!r.yes) return cb(new Error('OTP is in a sorry state')); | 165 | if(!r.yes) return cb(new Error('OTP is in a sorry state')); |
166 | cb(null,{ref:r.otp_ref}); | 166 | cb(null,{ref:r.otp_ref}); |
167 | }); | 167 | }); |
168 | }] | 168 | }] |
169 | },function(e,r) { | 169 | },function(e,r) { |
170 | if(e) return cb(e); | 170 | if(e) return cb(e); |
171 | req.session.C = ppp.C; req.session.A = ppp.A; | 171 | req.session.C = ppp.C; req.session.A = ppp.A; |
172 | req.session.s = r.u.u_srp_s; req.session.v = r.u.u_srp_v; | 172 | req.session.s = r.u.u_srp_s; req.session.v = r.u.u_srp_v; |
173 | req.session.u = r.u.u_id; | 173 | req.session.u = r.u.u_id; |
174 | req.session.b = clipperz_random(); | 174 | req.session.b = clipperz_random(); |
175 | req.session.B = BIGNUM(req.session.v,16).add(srp_g.powm(BIGNUM(req.session.b,16),srp_n)).toString(16); | 175 | req.session.B = BIGNUM(req.session.v,16).add(srp_g.powm(BIGNUM(req.session.b,16),srp_n)).toString(16); |
176 | var rv = {s:req.session.s,B:req.session.B} | 176 | var rv = {s:req.session.s,B:req.session.B} |
177 | if(r.otp && r.otp.otp_ref) rv.oneTimePassword=r.otp.otp_ref; | 177 | if(r.otp && r.otp.otp_ref) rv.oneTimePassword=r.otp.otp_ref; |
178 | res.res(rv); | 178 | res.res(rv); |
179 | }); | 179 | }); |
180 | 180 | ||
181 | case 'credentialCheck': | 181 | case 'credentialCheck': |