Add typed account and password settings
- Add admin account list, create, role, delete, and password workflows - Execute identity-checked mutations through the existing dispatcher - Bound queued credential lifetime and wipe transient secrets - Add explicit password generation with saved-value acknowledgement - Handle self-revocation and uncertain outcomes without automatic retries - Register optional account routes without disrupting terminal transports - Expand host regressions and document contracts and pending target checks Validated host suites and pio run; hardware validation remains pending.
This commit is contained in:
@@ -0,0 +1,353 @@
|
||||
/* SPDX-License-Identifier: GPL-3.0-only */
|
||||
#include "web_account_settings.h"
|
||||
|
||||
#include <inttypes.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include "admin_ssh_console.h"
|
||||
#include "esp_timer.h"
|
||||
#include "freertos/FreeRTOS.h"
|
||||
#include "secure_random.h"
|
||||
#include "ssh_transport.h"
|
||||
#include "web_cookie_auth.h"
|
||||
#include "web_auth_parse.h"
|
||||
#include "web_httpd_adapter.h"
|
||||
#include "web_serial_transport.h"
|
||||
|
||||
enum { IDLE, PENDING, OK, FAILED, CANCELLED, STALE, PROTECTED, DUPLICATE, FULL };
|
||||
static const char *const s_states[] = {"idle", "pending", "ok", "failed", "cancelled", "stale", "protected", "duplicate", "full"};
|
||||
typedef enum { ACTION_ROLE, ACTION_DELETE, ACTION_CREATE, ACTION_PASSWORD } account_action_t;
|
||||
static const char *const s_actions[] = {"role", "delete", "create", "password"};
|
||||
typedef struct {
|
||||
uint32_t id;
|
||||
web_session_id_t session;
|
||||
user_principal_t principal;
|
||||
user_database_account_t target;
|
||||
int64_t deadline;
|
||||
user_role_t role;
|
||||
unsigned state;
|
||||
account_action_t action;
|
||||
bool executing;
|
||||
uint8_t password[USER_DATABASE_PASSWORD_CAPACITY + 1U];
|
||||
size_t password_length;
|
||||
} account_operation_t;
|
||||
static portMUX_TYPE s_lock = portMUX_INITIALIZER_UNLOCKED;
|
||||
static account_operation_t s_operation;
|
||||
static uint32_t s_next_id;
|
||||
static esp_timer_handle_t s_secret_timer;
|
||||
static bool s_secret_timer_started;
|
||||
|
||||
static bool credential_action(account_action_t action)
|
||||
{
|
||||
return action == ACTION_CREATE || action == ACTION_PASSWORD;
|
||||
}
|
||||
|
||||
static void wipe_input(account_operation_t *operation)
|
||||
{
|
||||
secure_wipe(&operation->principal, sizeof(operation->principal));
|
||||
secure_wipe(&operation->target, sizeof(operation->target));
|
||||
secure_wipe(operation->password, sizeof(operation->password));
|
||||
operation->password_length = 0;
|
||||
}
|
||||
|
||||
static void expire_secret(void *unused)
|
||||
{
|
||||
(void)unused;
|
||||
taskENTER_CRITICAL(&s_lock);
|
||||
/* Inspect only the current ID/deadline, never a captured/rearmed job. A late
|
||||
* tick cannot cancel a replacement before its own deadline or executing work. */
|
||||
if (s_operation.id && s_operation.state == PENDING && !s_operation.executing &&
|
||||
credential_action(s_operation.action) && esp_timer_get_time() >= s_operation.deadline) {
|
||||
s_operation.state = CANCELLED;
|
||||
wipe_input(&s_operation);
|
||||
}
|
||||
taskEXIT_CRITICAL(&s_lock);
|
||||
}
|
||||
|
||||
static bool ensure_secret_timer(void)
|
||||
{
|
||||
/* HTTPD is the sole admission owner. Once started, this one firmware-lifetime
|
||||
* timer is never stopped/rearmed/deleted. Expiry is best-effort scheduling,
|
||||
* not hard realtime; no network/database work runs in its callback. */
|
||||
if (!s_secret_timer) {
|
||||
const esp_timer_create_args_t args = {.callback = expire_secret, .name = "account-secret"};
|
||||
if (esp_timer_create(&args, &s_secret_timer) != ESP_OK) return false;
|
||||
}
|
||||
if (!s_secret_timer_started) {
|
||||
if (esp_timer_start_periodic(s_secret_timer, 1000000ULL) != ESP_OK) return false;
|
||||
s_secret_timer_started = true;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/* Exact flat schemas. Only password accepts JSON escapes; canonical database
|
||||
* policy validates the decoded bytes. No coercion/unknown/duplicate fields. */
|
||||
static bool parse(const char *body, size_t length, account_operation_t *operation)
|
||||
{
|
||||
const char *keys[] = {"action", "username", "user_id", "auth_generation", "role", "password"};
|
||||
unsigned seen = 0;
|
||||
size_t pos = 0;
|
||||
#define SPACE() while (pos < length && (body[pos] == ' ' || body[pos] == '\t' || body[pos] == '\r' || body[pos] == '\n')) ++pos
|
||||
#define TAKE(c) do { SPACE(); if (pos == length || body[pos++] != (c)) return false; } while (0)
|
||||
TAKE('{');
|
||||
for (unsigned field = 0; field < 6; ++field) {
|
||||
if (field) { TAKE(','); }
|
||||
TAKE('"');
|
||||
size_t start = pos;
|
||||
while (pos < length && body[pos] != '"') ++pos;
|
||||
if (pos == length) return false;
|
||||
unsigned key = 0;
|
||||
for (; key < 6; ++key)
|
||||
if (strlen(keys[key]) == pos - start && !memcmp(body + start, keys[key], pos - start)) break;
|
||||
if (key == 6 || (seen & (1U << key))) return false;
|
||||
++pos; TAKE(':'); SPACE();
|
||||
uint32_t number = 0;
|
||||
char value[USER_DATABASE_USERNAME_CAPACITY + 1] = {0};
|
||||
if (key == 2 || key == 3) {
|
||||
start = pos;
|
||||
while (pos < length && body[pos] >= '0' && body[pos] <= '9') {
|
||||
unsigned digit = (unsigned)(body[pos++] - '0');
|
||||
if (number > (UINT32_MAX - digit) / 10U) return false;
|
||||
number = number * 10U + digit;
|
||||
}
|
||||
if (!number || pos == start || (pos - start > 1 && body[start] == '0')) return false;
|
||||
} else if (key == 5) {
|
||||
if (!web_auth_parse_json_string(body, length, &pos, operation->password,
|
||||
sizeof(operation->password), &operation->password_length) ||
|
||||
!user_database_password_valid(operation->password, operation->password_length)) return false;
|
||||
} else {
|
||||
TAKE('"'); start = pos;
|
||||
while (pos < length && body[pos] != '"') {
|
||||
if (body[pos] < ' ' || body[pos] > '~' || body[pos] == '\\' || pos - start >= sizeof(value) - 1) return false;
|
||||
++pos;
|
||||
}
|
||||
if (pos == length) return false;
|
||||
memcpy(value, body + start, pos - start); ++pos;
|
||||
}
|
||||
switch (key) {
|
||||
case 0:
|
||||
{
|
||||
unsigned action = 0;
|
||||
for (; action < sizeof(s_actions) / sizeof(*s_actions); ++action)
|
||||
if (!strcmp(value, s_actions[action])) break;
|
||||
if (action == sizeof(s_actions) / sizeof(*s_actions)) return false;
|
||||
operation->action = (account_action_t)action;
|
||||
}
|
||||
break;
|
||||
case 1:
|
||||
if (!user_database_username_valid((const uint8_t *)value, strlen(value))) return false;
|
||||
memcpy(operation->target.username, value, sizeof(value)); break;
|
||||
case 2: operation->target.user_id = number; break;
|
||||
case 3: operation->target.auth_generation = number; break;
|
||||
case 4: if (!user_role_parse(value, &operation->role)) return false; break;
|
||||
}
|
||||
seen |= 1U << key;
|
||||
SPACE();
|
||||
if (pos < length && body[pos] == '}') break;
|
||||
}
|
||||
TAKE('}'); SPACE();
|
||||
#undef TAKE
|
||||
#undef SPACE
|
||||
const unsigned schemas[] = {31U, 15U, 51U, 47U};
|
||||
return pos == length && seen == schemas[operation->action];
|
||||
}
|
||||
|
||||
void web_account_settings_execute(uint32_t id)
|
||||
{
|
||||
account_operation_t operation = {0};
|
||||
taskENTER_CRITICAL(&s_lock);
|
||||
bool admitted = id && s_operation.id == id && s_operation.state == PENDING && !s_operation.executing;
|
||||
if (admitted) {
|
||||
s_operation.executing = true;
|
||||
operation = s_operation;
|
||||
wipe_input(&s_operation);
|
||||
}
|
||||
taskEXIT_CRITICAL(&s_lock);
|
||||
if (!admitted) return;
|
||||
bool current = false;
|
||||
esp_err_t error = web_session_store_check_principal(operation.session, &operation.principal, ¤t);
|
||||
unsigned state = CANCELLED;
|
||||
if (error == ESP_OK && current && operation.principal.role == USER_ROLE_ADMIN &&
|
||||
esp_timer_get_time() < operation.deadline) {
|
||||
/* CLI and typed mutations share this dispatcher. Target identity is also
|
||||
* compared under the database mutation lock, not just at HTTP admission. */
|
||||
switch (operation.action) {
|
||||
case ACTION_ROLE: error = user_database_set_role_current(&operation.target, operation.role); break;
|
||||
case ACTION_DELETE: error = user_database_delete_current(&operation.target); break;
|
||||
case ACTION_CREATE:
|
||||
error = user_database_create((const uint8_t *)operation.target.username,
|
||||
strlen(operation.target.username), operation.role, operation.password, operation.password_length);
|
||||
break;
|
||||
case ACTION_PASSWORD:
|
||||
error = user_database_set_password_current(&operation.target, operation.password, operation.password_length);
|
||||
break;
|
||||
}
|
||||
secure_wipe(operation.password, sizeof(operation.password));
|
||||
operation.password_length = 0;
|
||||
state = error == ESP_OK ? OK : error == ESP_ERR_NOT_FOUND ? STALE :
|
||||
error == ESP_ERR_INVALID_STATE ? (operation.action == ACTION_CREATE ? DUPLICATE : PROTECTED) :
|
||||
error == ESP_ERR_NO_MEM && operation.action == ACTION_CREATE ? FULL : FAILED;
|
||||
if (error == ESP_OK && operation.action != ACTION_CREATE) {
|
||||
size_t length = strlen(operation.target.username);
|
||||
(void)web_serial_transport_revoke_user((const uint8_t *)operation.target.username, length);
|
||||
(void)ssh_transport_revoke_user((const uint8_t *)operation.target.username, length);
|
||||
}
|
||||
}
|
||||
secure_wipe(operation.password, sizeof(operation.password));
|
||||
operation.password_length = 0;
|
||||
taskENTER_CRITICAL(&s_lock);
|
||||
if (s_operation.id == id && s_operation.state == PENDING && s_operation.executing) {
|
||||
s_operation.state = state;
|
||||
s_operation.executing = false;
|
||||
wipe_input(&s_operation);
|
||||
}
|
||||
taskEXIT_CRITICAL(&s_lock);
|
||||
secure_wipe(&operation, sizeof(operation));
|
||||
}
|
||||
|
||||
static esp_err_t respond(httpd_req_t *request, const char *status, const char *body)
|
||||
{
|
||||
esp_err_t error = httpd_resp_set_status(request, status);
|
||||
if (error == ESP_OK) error = httpd_resp_set_type(request, "application/json; charset=utf-8");
|
||||
if (error == ESP_OK) error = httpd_resp_set_hdr(request, "Cache-Control", "no-store");
|
||||
if (error == ESP_OK) error = httpd_resp_set_hdr(request, "X-Content-Type-Options", "nosniff");
|
||||
if (error == ESP_OK) error = httpd_resp_set_hdr(request, "Referrer-Policy", "no-referrer");
|
||||
if (error == ESP_OK) error = httpd_resp_sendstr(request, body);
|
||||
return web_httpd_unread_body(request) ? ESP_FAIL : error;
|
||||
}
|
||||
|
||||
static esp_err_t list_accounts(httpd_req_t *request)
|
||||
{
|
||||
user_database_accounts_t accounts;
|
||||
if (user_database_get_accounts(&accounts) != ESP_OK)
|
||||
return respond(request, "503 Service Unavailable", "{\"error\":\"accounts_unavailable\"}");
|
||||
char body[1024];
|
||||
size_t used = (size_t)snprintf(body, sizeof(body), "{\"users\":[");
|
||||
for (size_t i = 0; i < accounts.count; ++i) {
|
||||
const user_database_account_t *user = &accounts.users[i];
|
||||
/* Database username policy makes these ASCII strings JSON-safe. */
|
||||
int written = snprintf(body + used, sizeof(body) - used,
|
||||
"%s{\"username\":\"%s\",\"user_id\":%" PRIu32 ",\"auth_generation\":%" PRIu32 ",\"role\":\"%s\"}",
|
||||
i ? "," : "", user->username, user->user_id, user->auth_generation, user_role_to_string(user->role));
|
||||
if (written < 0 || (size_t)written >= sizeof(body) - used) return ESP_FAIL;
|
||||
used += (size_t)written;
|
||||
}
|
||||
if (used + 3 > sizeof(body)) return ESP_FAIL;
|
||||
memcpy(body + used, "]}", 3);
|
||||
return respond(request, "200 OK", body);
|
||||
}
|
||||
|
||||
esp_err_t web_account_generate_password_handler(httpd_req_t *request)
|
||||
{
|
||||
web_session_view_t view = {0};
|
||||
user_database_generated_password_t generated = {0};
|
||||
char response[96] = {0};
|
||||
bool allowed = false;
|
||||
esp_err_t error = web_cookie_auth_require(request, true, false, &view, &allowed);
|
||||
if (error != ESP_OK || !allowed) goto done;
|
||||
if (view.principal.role != USER_ROLE_ADMIN) {
|
||||
error = respond(request, "403 Forbidden", "{\"error\":\"admin_required\"}");
|
||||
goto done;
|
||||
}
|
||||
error = user_database_generate_password_value(&generated);
|
||||
if (error != ESP_OK) {
|
||||
secure_wipe(&generated, sizeof(generated));
|
||||
error = respond(request, "503 Service Unavailable", "{\"error\":\"unavailable\"}");
|
||||
goto done;
|
||||
}
|
||||
bool current = false;
|
||||
error = web_session_store_check_principal(view.id, &view.principal, ¤t);
|
||||
if (error != ESP_OK || !current) {
|
||||
secure_wipe(&generated, sizeof(generated));
|
||||
error = respond(request, "401 Unauthorized", "{\"error\":\"authentication_required\"}");
|
||||
goto done;
|
||||
}
|
||||
int written = snprintf(response, sizeof(response), "{\"password\":\"%s\"}", (const char *)generated.password);
|
||||
secure_wipe(&generated, sizeof(generated));
|
||||
error = written < 0 || (size_t)written >= sizeof(response) ? ESP_FAIL : respond(request, "200 OK", response);
|
||||
done:
|
||||
secure_wipe(&generated, sizeof(generated));
|
||||
secure_wipe(response, sizeof(response));
|
||||
secure_wipe(&view, sizeof(view));
|
||||
web_httpd_wipe_request(request, web_httpd_unread_body(request));
|
||||
return error;
|
||||
}
|
||||
|
||||
esp_err_t web_account_settings_handler(httpd_req_t *request)
|
||||
{
|
||||
web_session_view_t view = {0};
|
||||
account_operation_t operation = {0};
|
||||
bool allowed = false, mutation = request->method == HTTP_POST;
|
||||
esp_err_t error = mutation ? web_cookie_auth_require_json(request, 768, &view, &allowed) :
|
||||
web_cookie_auth_require(request, false, false, &view, &allowed);
|
||||
if (error != ESP_OK || !allowed) goto done;
|
||||
if (view.principal.role != USER_ROLE_ADMIN) {
|
||||
error = respond(request, "403 Forbidden", "{\"error\":\"admin_required\"}");
|
||||
goto done;
|
||||
}
|
||||
if (!strcmp(request->uri, "/api/settings/accounts")) {
|
||||
error = mutation ? respond(request, "400 Bad Request", "{\"error\":\"invalid_request\"}") : list_accounts(request);
|
||||
goto done;
|
||||
}
|
||||
if (mutation) {
|
||||
char type[40] = {0}, body[768];
|
||||
size_t received = 0;
|
||||
bool valid = request->content_len && request->content_len <= sizeof(body) &&
|
||||
httpd_req_get_hdr_value_str(request, "Content-Type", type, sizeof(type)) == ESP_OK &&
|
||||
(!strcmp(type, "application/json") || !strcmp(type, "application/json; charset=utf-8"));
|
||||
for (unsigned reads = 0; valid && received < request->content_len && reads < 4; ++reads) {
|
||||
int count = httpd_req_recv(request, body + received, request->content_len - received);
|
||||
if (count <= 0 || (size_t)count > request->content_len - received) valid = false;
|
||||
else received += (size_t)count;
|
||||
}
|
||||
valid = valid && received == request->content_len && parse(body, received, &operation);
|
||||
secure_wipe(body, sizeof(body));
|
||||
if (!valid) {
|
||||
wipe_input(&operation);
|
||||
error = respond(request, "400 Bad Request", "{\"error\":\"invalid_account_request\"}");
|
||||
goto done;
|
||||
}
|
||||
if (credential_action(operation.action) && !ensure_secret_timer()) {
|
||||
wipe_input(&operation);
|
||||
error = respond(request, "503 Service Unavailable", "{\"error\":\"unavailable\"}");
|
||||
goto done;
|
||||
}
|
||||
operation.session = view.id;
|
||||
operation.principal = view.principal;
|
||||
operation.deadline = esp_timer_get_time() + 30000000LL;
|
||||
operation.state = PENDING;
|
||||
taskENTER_CRITICAL(&s_lock);
|
||||
bool busy = s_operation.state == PENDING || s_next_id == UINT32_MAX;
|
||||
if (!busy) { operation.id = ++s_next_id; s_operation = operation; }
|
||||
taskEXIT_CRITICAL(&s_lock);
|
||||
if (busy || admin_ssh_console_submit_account_settings(operation.id) != ESP_OK) {
|
||||
taskENTER_CRITICAL(&s_lock);
|
||||
if (!busy && s_operation.id == operation.id && !s_operation.executing)
|
||||
secure_wipe(&s_operation, sizeof(s_operation));
|
||||
taskEXIT_CRITICAL(&s_lock);
|
||||
wipe_input(&operation);
|
||||
error = httpd_resp_set_hdr(request, "Retry-After", "1");
|
||||
if (error == ESP_OK) error = respond(request, "503 Service Unavailable", "{\"error\":\"busy\"}");
|
||||
goto done;
|
||||
}
|
||||
} else {
|
||||
taskENTER_CRITICAL(&s_lock);
|
||||
if (s_operation.session == view.id) {
|
||||
operation.id = s_operation.id;
|
||||
operation.action = s_operation.action;
|
||||
operation.state = s_operation.state;
|
||||
}
|
||||
taskEXIT_CRITICAL(&s_lock);
|
||||
}
|
||||
wipe_input(&operation);
|
||||
char response[96];
|
||||
int written = snprintf(response, sizeof(response), "{\"id\":%" PRIu32 ",\"action\":\"%s\",\"state\":\"%s\"}",
|
||||
operation.id, operation.id ? s_actions[operation.action] : "none", s_states[operation.state]);
|
||||
error = written < 0 || (size_t)written >= sizeof(response) ? ESP_FAIL :
|
||||
respond(request, mutation ? "202 Accepted" : "200 OK", response);
|
||||
done:
|
||||
secure_wipe(&operation, sizeof(operation));
|
||||
secure_wipe(&view, sizeof(view));
|
||||
web_httpd_wipe_request(request, web_httpd_unread_body(request));
|
||||
return error;
|
||||
}
|
||||
Reference in New Issue
Block a user