add timestamps to management requests

docker-compose.yml

@@ -6,6 +6,7 @@ services:
     ports: [ "8430:80" ]
     environment:
       - SECRET=${SECRET}
+      - MAX_AGE_MS=${MAX_AGE_MS}
     restart: unless-stopped
   redis:
     hostname: sus-redis

main.go

@@ -24,6 +24,8 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"strconv"
+	"time"
 
 	"github.com/go-redis/redis/v8"
 	"github.com/gorilla/mux"
@@ -38,6 +40,7 @@ var client = redis.NewClient(&redis.Options{
 
 var SECRET string
 var INDEX_GET_REDIRECT = "http://alv.cx"
+var MAX_AGE_MS int64 = 500
 
 func main() {
 	r := mux.NewRouter()
@@ -59,6 +62,14 @@ func main() {
 		INDEX_GET_REDIRECT = p
 	}
 
+	if p, ok := os.LookupEnv("MAX_AGE_MS"); ok {
+		if v, err := strconv.ParseInt(p, 10, 64); err != nil {
+			fmt.Printf("Unable to parse environment variable MAX_AGE_MS: %v\n", p)
+		} else {
+			MAX_AGE_MS = v
+		}
+	}
+
 	log.Fatal(http.ListenAndServe(listenAddress, r))
 }
 
@@ -74,16 +85,29 @@ func indexHandler(w http.ResponseWriter, r *http.Request) {
 	command := r.PostForm.Get("Command")
 	shortlink := r.PostForm.Get("Shortlink")
 	value := r.PostForm.Get("Value")
-	fmt.Printf("command: %v, shortlink: %v, value: %v\n", command, shortlink, value)
+	req_timestamp := r.PostForm.Get("Timestamp")
-	fmt.Println(shortlink)
+	req_timestamp_int, err := strconv.ParseInt(req_timestamp, 10, 64)
-	fmt.Println(value)
+	if err != nil {
+		w.WriteHeader(http.StatusBadRequest)
+		w.Write([]byte("Bad request"))
+		return
+	}
+
+	cur_timestamp := time.Now().UnixNano()
+	if req_timestamp_int+MAX_AGE_MS*1000*1000 < cur_timestamp {
+		w.WriteHeader(http.StatusBadRequest)
+		w.Write([]byte("Bad request"))
+		return
+	}
+
+	fmt.Printf("req_timestamp: %v, command: %v, shortlink: %v, value: %v\n", req_timestamp, command, shortlink, value)
 
 	signature := r.Header.Get("Signature")
 	calculatedSignature := fmt.Sprintf(
 		"SUS-SIGNATURE-%v",
 		getSha256HMACSignature(
 			[]byte(SECRET),
-			command+":"+shortlink+":"+value,
+			req_timestamp+":"+command+":"+shortlink+":"+value,
 		),
 	)
 

readme.md

@@ -39,6 +39,7 @@ flag is not provided.
 - `LISTEN_ADDRESS`---the address the server is listening on (default is `0.0.0.0:80`)
 - `INDEX_GET_REDIRECT`---the URL the user should be redirected to if they try to access `/` on the
    server (default is `http://alv.cx`)
+- `MAX_AGE_MS`---how old a request can be (in milliseconds) before the server will refuse to process it. (default is 500 milliseconds)
 
 ### setting up susmng
 

susmng.py

@@ -8,6 +8,7 @@ import pathlib
 import os
 import json
 import sys
+import time
 
 
 def get_args():
@@ -51,20 +52,34 @@ def main(args):
     if args.command == "delete" and args.value != "confirm":
         print("--value not set to 'confirm'... delete operation may fail")
 
-    r = requests.post(f"{'http' if args.http else 'https'}://{server}",
+    # accoring to python documentation (https://docs.python.org/3/library/time.html#time.time)
-            data = {
+    # this function does not explicitly have to use unix time, and implementation is dependent
-                'Command': args.command,
+    # platform.
-                'Shortlink': args.shortlink,
+    # most platforms (windows, unix) will probably give unix time though.
-                'Value': args.value,
+    #
-                },
+    # the server side (main.go file) does explicitly use unix time (time.Now().UnixNano()) to get
-            headers = {
+    # this number, but hopefully there should be no issues on most platforms.
-                'Signature': 'SUS-SIGNATURE-' + hmac.new(
+    timestamp = str(time.time_ns())
-                    secret.encode("UTF-8"),
+
-                    (args.command+":"+args.shortlink+":"+args.value).encode("UTF-8"),
+    data = {
-                    hashlib.sha256
+        'Command': args.command,
-                    ).hexdigest()
+        'Shortlink': args.shortlink,
-                }
+        'Value': args.value,
-            )
+        'Timestamp': timestamp,
+        }
+
+    headers = {
+        'Signature': 'SUS-SIGNATURE-' + hmac.new(
+            secret.encode("UTF-8"),
+            (timestamp + ":" + args.command + ":" + args.shortlink + ":" + args.value).encode("UTF-8"),
+            hashlib.sha256
+            ).hexdigest()
+        }
+
+    print(f"{data=}")
+    print(f"{headers=}")
+
+    r = requests.post(f"{'http' if args.http else 'https'}://{server}", data=data, headers=headers)
     print(r, file=sys.stderr)
     print(r.content.decode().strip())
     return 0