Skip to content

Add ability to store securely hashed sessionkeys #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 13 commits into
base: FREESIDE_4_BRANCH
Choose a base branch
from
Open

Add ability to store securely hashed sessionkeys #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
8e16e00
Freeside sessionkey Should Not Be Stored in Plaintext
Jul 30, 2015
72153e6
Add overlooked line that mentions the $conf_hashsalt in install_callback
Aug 6, 2015
fd8e7f1
Add overlooked $conf_hashsalt in callback
Aug 6, 2015
64463ff
Merge branch 'feature/hash-sessionkey' of https://github.com/wwhipple…
wwhipple Aug 12, 2015
78a3ea0
Remove salted hash from FS::Record's update method. (The field passed
Aug 12, 2015
5d60a40
Merge branch 'feature/hash-sessionkey' of https://github.com/wwhipple…
wwhipple Dec 10, 2015
d9fd356
In FS::Record, use sha512_hex for sessionkey
wwhipple Dec 14, 2015
1a08a4b
In access_user_session table, expand sessionkey to 128 (from 80)
wwhipple Dec 14, 2015
dc83c64
Generate initial hashsalt (for sessionkeys) if it doesn't exist already
wwhipple Dec 14, 2015
4da342c
Return t/Record.t back to its original content
wwhipple Dec 14, 2015
55d7f62
Modified FS::Conf description to state that changing the salt will
wwhipple Dec 14, 2015
a2eaeff
Fix typo in comment
wwhipple Dec 14, 2015
fd0c91d
Tweak description of hashsalt in FS::Conf
wwhipple Dec 15, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions FS/FS/Conf.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -831,6 +831,13 @@ my $validate_email = sub { $_[0] =~
'type' => 'checkbox',
},

{
'key' => 'hashsalt',
'section' => 'billing',
'description' => 'Hash salt string (enables hashing of session keys/cookies). Changing salt string will force a new login for all sessions in progress.',
'type' => 'text',
},

{
'key' => 'encryption',
'section' => 'billing',
Expand Down
30 changes: 28 additions & 2 deletions FS/FS/Record.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ use FS::Schema qw(dbdef);
use FS::SearchCache;
use FS::Msgcat qw(gettext);
#use FS::Conf; #dependency loop bs, in install_callback below instead
use Digest::SHA qw(sha512_hex);

use FS::part_virtual_field;

Expand Down Expand Up @@ -59,6 +60,7 @@ our $conf_encryption = '';
our $conf_encryptionmodule = '';
our $conf_encryptionpublickey = '';
our $conf_encryptionprivatekey = '';
our $conf_hashsalt = '';
FS::UID->install_callback( sub {

eval "use FS::Conf;";
Expand All @@ -72,6 +74,7 @@ FS::UID->install_callback( sub {
my $nw_coords = $conf->exists('geocode-require_nw_coordinates');
$lat_lower = $nw_coords ? 1 : -90;
$lon_upper = $nw_coords ? -1 : 180;
$conf_hashsalt = $conf->config('hashsalt');

$File::CounterFile::DEFAULT_DIR = $conf->base_dir . "/counters.". datasrc;

Expand Down Expand Up @@ -430,6 +433,18 @@ sub qsearch {
) {

my $value = $record->{$field};
# If searching for the user session, search for SHA512'ed
# (Also works for other ::hashed_fields ...)
if ( $conf_hashsalt
&& defined(eval '@FS::'. $stable . '::hashed_fields')
&& scalar( eval '@FS::'. $stable . '::hashed_fields')
) {
foreach my $hashed_field_name (eval '@FS::'. $stable . '::hashed_fields') {
next if $hashed_field_name ne $field; # continue if this isn't a hashed field
$value = sha512_hex($value.$conf_hashsalt);
}
}

my $op = (ref($value) && $value->{op}) ? $value->{op} : '=';
$value = $value->{'value'} if ref($value);
my $type = dbdef->table($table)->column($field)->type;
Expand Down Expand Up @@ -1299,9 +1314,9 @@ sub insert {
my $table = $self->table;

# Encrypt before the database
if ( defined(eval '@FS::'. $table . '::encrypted_fields')
if ( $conf_encryption
&& defined(eval '@FS::'. $table . '::encrypted_fields')
&& scalar( eval '@FS::'. $table . '::encrypted_fields')
&& $conf_encryption
) {
foreach my $field (eval '@FS::'. $table . '::encrypted_fields') {
next if $field eq 'payinfo'
Expand All @@ -1314,6 +1329,17 @@ sub insert {
}
}

# SHA512 before the database
if ( $conf_hashsalt
&& defined(eval '@FS::'. $table . '::hashed_fields')
&& scalar( eval '@FS::'. $table . '::hashed_fields')
) {
foreach my $field (eval '@FS::'. $table . '::hashed_fields') {
$saved->{$field} = $self->getfield($field);
$self->setfield($field, sha512_hex($self->getfield($field).$conf_hashsalt));
}
}

#false laziness w/delete
my @real_fields =
grep { defined($self->getfield($_)) && $self->getfield($_) ne "" }
Expand Down
2 changes: 1 addition & 1 deletion FS/FS/Schema.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5623,7 +5623,7 @@ sub tables_hashref {
'access_user_session' => {
'columns' => [
'sessionnum', 'serial', '', '', '', '',
'sessionkey', 'varchar', '', $char_d, '', '',
'sessionkey', 'varchar', '', 128, '', '',
'usernum', 'int', '', '', '', '',
'start_date', @date_type, '', '',
'last_date', @date_type, '', '',
Expand Down
16 changes: 16 additions & 0 deletions FS/FS/Upgrade.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,22 @@ If you need to continue using the old Form 477 report, turn on the

enable_banned_pay_pad() unless length($conf->config('banned_pay-pad'));

# generate initial hashsalt (for sessionkeys) if it doesn't exist already
my @conf_hashsalt_key = grep { /^hashsalt$/ } map { $_->{'key'} } @FS::Conf::config_items;
if (scalar(@conf_hashsalt_key)) { # using hash salts
my $hashsalt_entry = qsearchs('conf', { 'name' => 'hashsalt'});
unless ($hashsalt_entry) {
my $salt_length = int(rand(26)) + 25; # between 25 and 50 inclusive
my @chars = ("A" .. "Z", "a" .. "z", 0 .. 9, qw(! $ % ^ *) );
my $init_salt = join("", @chars[ map { rand @chars } ( 1 .. $salt_length ) ]);
my $hs = new FS::conf {
'name' => 'hashsalt',
'value' => $init_salt,
};
my $ret = $hs->insert;
warn "Unable to insert default hash salt for session keys\n" if $ret;
}
}
}

sub upgrade_overlimit_groups {
Expand Down
2 changes: 2 additions & 0 deletions FS/FS/access_user_session.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@ use base qw( FS::Record );

use strict;

our @hashed_fields = ('sessionkey');

=head1 NAME

FS::access_user_session - Object methods for access_user_session records
Expand Down