@@ -26,7 +26,7 @@

 #include "kakumei_config.h"

 #define CONFIGFILE "kakumei.conf"

-#define CFCOOKIEPREFIX "kakumei_"

+#define CFCOOKIENAME "kakumeiauthid"

 #define CFCOOKIEDOMAIN "localhost"

 #define CFBANNERPATH "default.png"

@@ -60,7 +60,7 @@ main(int argc, char *argv[])

         port=atoi(argv[1]);

         if(kaconfig_exists(CONFIGFILE)!=0) {

                 log_write("INIT","Config file not found, writing default file %s",CONFIGFILE);

-                kaconfig_write(CONFIGFILE,CFCOOKIEPREFIX,CFCOOKIEDOMAIN,CFBANNERPATH);

+                kaconfig_write(CONFIGFILE,CFCOOKIENAME,CFCOOKIEDOMAIN,CFBANNERPATH);

         }

         if((ka->config=kaconfig_init(CONFIGFILE))==NULL) {

                 log_write("INIT","ERROR: insufficient memory or config file error");

@@ -164,8 +164,9 @@ callback_http(wk *web, int connid, wk_uri *uri, void *userptr)

         int ishtml;

         int whitelisted;

         int validsession;

-        char session[SESSIONSIZE];

+        char session[SESSIONSIZE+1];

         char user[MAXUSERSIZE+1];

+        char authid[AUTHIDSIZE+1];

         int i;

         if(ka==NULL)

                 return(wkact_finished);

@@ -200,7 +201,9 @@ callback_http(wk *web, int connid, wk_uri *uri, void *userptr)

         if(wk_uri_copyvar(uri,"s",session,sizeof(session))==NULL)

                 session[0]='\0';

         user[0]='\0';

-        validsession=(session_check(ka,session,user,sizeof(user))!=NULL)?1:0;

+        if(wk_uri_copycookie(uri,ka->config->cookiename,authid,sizeof(authid))==NULL)

+                authid[0]='\0';

+        validsession=(session_check(ka,session,authid,user,sizeof(user))!=NULL)?1:0;

         /* serve the page */

         if(partialpath[0]=='/' && (res=res_find(resindexdata,partialpath+1))!=NULL) {

                 if(whitelisted || validsession) {

@@ -269,7 +272,8 @@ http_login(wk *web, int connid, wk_uri *uri, void *userptr)

 {

         char u[MAXUSERSIZE+1],p[MAXPASSWDSIZE+1];

         char reply[1024];

-        char session[SESSIONSIZE];

+        char session[SESSIONSIZE+1];

+        char authid[AUTHIDSIZE+1];

         kakumei *ka=(kakumei *)userptr;

         if(web==NULL || connid<0 || uri==NULL || ka==NULL) {

                 log_write("EINT","%s:%i",__FILE__,__LINE__);

@@ -290,10 +294,11 @@ http_login(wk *web, int connid, wk_uri *uri, void *userptr)

                 log_write("LGIN","Reply: %s",reply);

                 return(wkact_finished);

         } else if(pass_check(ka,u,p)==0 &&

-                  session_new(ka,u,session,sizeof(session))!=NULL) {

+                  session_new(ka,u,session,sizeof(session),authid,sizeof(authid))!=NULL) {

                 /* valid login */

                 snprintf(reply,sizeof(reply),"/posts.html?s=%s",session);

                 reply[sizeof(reply)-1]='\0';

+                wk_serve_cookieadd(web,connid,ka->config->cookiename,authid,ka->config->cookiedomain,21600 /* 6h */,"secure");

                 wk_serve_buffer_as_file(web,connid,reply,strlen(reply),"text/plain");

                 log_write("LGIN","Reply: %s",reply);

                 return(wkact_finished);

@@ -308,7 +313,8 @@ http_newuser(wk *web, int connid, wk_uri *uri, void *userptr)

 {

         char u[MAXUSERSIZE+1],p[MAXPASSWDSIZE+1],i[MAXPASSWDSIZE+1];

         char reply[1024];

-        char session[SESSIONSIZE];

+        char session[SESSIONSIZE+1];

+        char authid[AUTHIDSIZE+1];

         kakumei *ka=(kakumei *)userptr;

         if(web==NULL || connid<0 || uri==NULL || ka==NULL) {

                 log_write("EINT","%s:%i",__FILE__,__LINE__);

@@ -339,7 +345,7 @@ http_newuser(wk *web, int connid, wk_uri *uri, void *userptr)

         /* delete invitation */

         kakumei_invitedel(ka,i);

         /* create session and go to "posts" page */

-        if(session_new(ka,u,session,sizeof(session))==NULL) {

+        if(session_new(ka,u,session,sizeof(session),authid,sizeof(authid))==NULL) {

                 /* "autologin" didn't work, ask for login */

                 log_write("NEWU","couldn't generate new session, redirecting to login");

                 wk_serve_buffer_as_file(web,connid,"/",1,"text/plain");

@@ -348,6 +354,7 @@ http_newuser(wk *web, int connid, wk_uri *uri, void *userptr)

         /* valid login */

         snprintf(reply,sizeof(reply),"/posts.html?s=%s",session);

         reply[sizeof(reply)-1]='\0';

+        wk_serve_cookieadd(web,connid,ka->config->cookiename,authid,ka->config->cookiedomain,21600 /* 6h */,"secure");

         wk_serve_buffer_as_file(web,connid,reply,strlen(reply),"text/plain");

         log_write("NEWU","Reply: %s",reply);

         return(wkact_finished);

@@ -24,7 +24,8 @@

 #define SESSIONSDIR "data/sessions"

 #define MAXUSERSIZE 32

 #define MAXPASSWDSIZE 64

-#define SESSIONSIZE 33

+#define SESSIONSIZE 32

+#define AUTHIDSIZE 32

 typedef struct kakumei {

         sselect *ssel;

@@ -85,8 +85,8 @@ kaconfig_init(char *configfile)

                                 continue;

                         }

                         /* identify key-value pair */

-                        if(strcmp(ptr,"cookieprefix")==0) {

-                                configvalue=&(config->cookieprefix);

+                        if(strcmp(ptr,"cookiename")==0) {

+                                configvalue=&(config->cookiename);

                         } else if(strcmp(ptr,"cookiedomain")==0) {

                                 configvalue=&(config->cookiedomain);

                         } else if(strcmp(ptr,"bannerpath")==0) {

@@ -121,8 +121,8 @@ kaconfig_free(kaconfig *config)

 {

         if(config==NULL)

                 return;

-        if(config->cookieprefix!=NULL)

-                free(config->cookieprefix),config->cookieprefix=NULL;

+        if(config->cookiename!=NULL)

+                free(config->cookiename),config->cookiename=NULL;

         if(config->cookiedomain!=NULL)

                 free(config->cookiedomain),config->cookiedomain=NULL;

         if(config->bannerpath!=NULL)

@@ -141,14 +141,14 @@ kaconfig_exists(char *configfile)

 }

 int

-kaconfig_write(char *configfile,char *cookieprefix,char *cookiedomain, char *bannerpath)

+kaconfig_write(char *configfile,char *cookiename,char *cookiedomain, char *bannerpath)

 {

         FILE *f;

         if((f=fopen(configfile,"w"))==NULL)

                 return(-1);

         fprintf(f,"; kakumei config file\n");

         fprintf(f,"[general]\n");

-        fprintf(f,"cookieprefix=%s\n",(cookieprefix!=NULL)?cookieprefix:"kakumei_");

+        fprintf(f,"cookiename=%s\n",(cookiename!=NULL)?cookiename:"kakumeiauthid");

         fprintf(f,"cookiedomain=%s\n",(cookiedomain!=NULL)?cookiedomain:"localhost");

         fprintf(f,"bannerpath=%s\n",(bannerpath!=NULL)?bannerpath:"default.png");

         return(0);

@@ -12,7 +12,7 @@

 #ifndef KAKUMEI_CONFIG_H

 #define KAKUMEI_CONFIG_H

 typedef struct kaconfig {

-        char *cookieprefix;

+        char *cookiename;

         char *cookiedomain;

         char *bannerpath;

 } kaconfig;

@@ -21,5 +21,5 @@ kaconfig *kaconfig_init(char *configfile);

 void kaconfig_free(kaconfig *config);

 int kaconfig_exists(char *configfile);

-int kaconfig_write(char *configfile,char *cookieprefix,char *cookiedomain, char *bannerpath);

+int kaconfig_write(char *configfile,char *cookiename,char *cookiedomain, char *bannerpath);

 #endif

@@ -18,21 +18,22 @@

 #include "kakumei_session.h"

 char *

-session_new(kakumei *ka, char *user, char *session, int sessionsize)

+session_new(kakumei *ka, char *user, char *session, int sessionsize, char *authid, int authidsize)

 {

         static int init=0;

         MHASH td;

         struct timeval tv;

         struct timezone tz;

-        int i;

+        int i,k;

         long n;

         char c;

         char binhash[32];

         char filename[1024];

         int len;

         int fd;

-        char oldsession[SESSIONSIZE];

-        if(ka==NULL || user==NULL || session==NULL || sessionsize<SESSIONSIZE || kakumei_uservalid(ka,user)!=0)

+        int authidlen;

+        char oldsession[SESSIONSIZE+1];

+        if(ka==NULL || user==NULL || session==NULL || sessionsize<(SESSIONSIZE+1) || authidsize<(AUTHIDSIZE+1)|| kakumei_uservalid(ka,user)!=0)

                 return(NULL);

         if(init==0) {

                 gettimeofday(&tv,&tz);

@@ -50,7 +51,7 @@ session_new(kakumei *ka, char *user, char *session, int sessionsize)

                 mhash(td,&n,sizeof(n));

         }

         mhash_deinit(td,&binhash);

-        for(i=0;i<sizeof(binhash) && i<SESSIONSIZE;i++) {

+        for(i=0;i<sizeof(binhash) && i<(SESSIONSIZE/2);i++) {

                 c=(((unsigned char *)binhash)[i]>>4);

                 c=(c>=10)?(c-10+'a'):c+'0';

                 session[i<<1]=c;

@@ -58,7 +59,16 @@ session_new(kakumei *ka, char *user, char *session, int sessionsize)

                 c=(c>=10)?(c-10+'a'):c+'0';

                 session[(i<<1)+1]=c;

         }

-        session[SESSIONSIZE-1]='\0';

+        session[SESSIONSIZE]='\0';

+        for(k=0;i<sizeof(binhash) && k<(AUTHIDSIZE/2);i++,k++) {

+                c=(((unsigned char *)binhash)[i]>>4);

+                c=(c>=10)?(c-10+'a'):c+'0';

+                authid[k<<1]=c;

+                c=(((unsigned char *)binhash)[i]&0xf);

+                c=(c>=10)?(c-10+'a'):c+'0';

+                authid[(k<<1)+1]=c;

+        }

+        authid[AUTHIDSIZE]='\0';

         /* save the hash */

         mkdir(DATADIR,0700);

         mkdir(SESSIONSDIR,0700);

@@ -67,7 +77,8 @@ session_new(kakumei *ka, char *user, char *session, int sessionsize)

         if((fd=open(filename,O_WRONLY|O_TRUNC|O_CREAT,0600))==-1)

                 return(NULL);

         len=strlen(user);

-        if(write(fd,user,len)!=len) {

+        authidlen=strlen(authid);

+        if(write(fd,user,len)!=len || write(fd,"\n",1)!=1 || write(fd,authid,authidlen)!=authidlen) {

                 close(fd),fd=-1;

                 return(NULL);

         }

@@ -93,11 +104,14 @@ session_new(kakumei *ka, char *user, char *session, int sessionsize)

 }

 char *

-session_check(kakumei *ka, char *session, char *user, int usersize)

+session_check(kakumei *ka, char *session, char *authid, char *user, int usersize)

 {

         int i;

         int fd;

         char filename[1024];

+        char sesbuf[MAXUSERSIZE+AUTHIDSIZE+2];

+        char *sep;

+        int len;

         if(ka==NULL || session==NULL || session[0]=='\0' || user==NULL || usersize<(MAXUSERSIZE+1))

                 return(NULL);

         for(i=0;session[i]!='\0';i++) {

@@ -110,11 +124,25 @@ session_check(kakumei *ka, char *session, char *user, int usersize)

         filename[sizeof(filename)-1]='\0';

         if((fd=open(filename,O_RDONLY))==-1)

                 return(NULL);

-        memset(user,0,usersize);

-        read(fd,user,usersize-1);

+        memset(sesbuf,0,sizeof(sesbuf));

+        read(fd,sesbuf,sizeof(sesbuf));

+        sesbuf[sizeof(sesbuf)-1]='\0';

         close(fd),fd=-1;

+        if((sep=strchr(sesbuf,'\n'))==NULL)

+                return(NULL); /* invalid format */

+        *sep='\0';

+        memset(user,0,usersize);

+        strncpy(user,sesbuf,usersize);

+        user[usersize-1]='\0';

+        /* position sep to authid and trim the last '\n' if it exists */

+        sep++;

+        if((len=strlen(sep))>0 && sep[len-1]=='\n')

+                sep[len-1]='\0';

+        /* check validity */

+        if(strcmp(authid,sep)!=0)

+                return(NULL); /* authid doesn't match */

         if(kakumei_uservalid(ka,user)!=0)

-                return(NULL);

+                return(NULL); /* invalid user */

         return(user);

 }

@@ -11,7 +11,7 @@

 #include "kakumei.h"

-char *session_new(kakumei *ka, char *user, char *session, int sessionsize);

-char *session_check(kakumei *ka, char *session, char *user, int usersize);

+char *session_new(kakumei *ka, char *user, char *session, int sessionsize, char *authid, int authidsize);

+char *session_check(kakumei *ka, char *session, char *authid, char *user, int usersize);

 int session_del(kakumei *ka, char *session);