path: root/lib/session/session.go

package session

import (
	"encoding/base64"
	"strconv"
	"time"

	"github.com/Sirupsen/logrus"
	"github.com/gin-gonic/gin"
	"github.com/googollee/go-socket.io"
	uuid "github.com/satori/go.uuid"
	"github.com/syncthing/syncthing/lib/sync"
)

const sessionCookieName = "xds-sid"
const sessionHeaderName = "XDS-SID"

const sessionMonitorTime = 10 // Time (in seconds) to schedule monitoring session tasks

const initSessionMaxAge = 10 // Initial session max age in seconds
const maxSessions = 100000   // Maximum number of sessions in sessMap map

const secureCookie = false // TODO: see https://github.com/astaxie/beego/blob/master/session/session.go#L218

// ClientSession contains the info of a user/client session
type ClientSession struct {
	ID       string
	WSID     string // only one WebSocket per client/session
	MaxAge   int64
	IOSocket *socketio.Socket

	// private
	expireAt time.Time
	useCount int64
}

// Sessions holds client sessions
type Sessions struct {
	router       *gin.Engine
	cookieMaxAge int64
	sessMap      map[string]ClientSession
	mutex        sync.Mutex
	log          *logrus.Logger
	stop         chan struct{} // signals intentional stop
}

// NewClientSessions .
func NewClientSessions(router *gin.Engine, log *logrus.Logger, cookieMaxAge string) *Sessions {
	ckMaxAge, err := strconv.ParseInt(cookieMaxAge, 10, 0)
	if err != nil {
		ckMaxAge = 0
	}
	s := Sessions{
		router:       router,
		cookieMaxAge: ckMaxAge,
		sessMap:      make(map[string]ClientSession),
		mutex:        sync.NewMutex(),
		log:          log,
		stop:         make(chan struct{}),
	}
	s.router.Use(s.Middleware())

	// Start monitoring of sessions Map (use to manage expiration and cleanup)
	go s.monitorSessMap()

	return &s
}

// Stop sessions management
func (s *Sessions) Stop() {
	close(s.stop)
}

// Middleware is used to managed session
func (s *Sessions) Middleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		// FIXME Add CSRF management

		// Get session
		sess := s.Get(c)
		if sess == nil {
			// Allocate a new session key and put in cookie
			sess = s.newSession("")
		} else {
			s.refresh(sess.ID)
		}

		// Set session in cookie and in header
		// Do not set Domain to localhost (http://stackoverflow.com/questions/1134290/cookies-on-localhost-with-explicit-domain)
		c.SetCookie(sessionCookieName, sess.ID, int(sess.MaxAge), "/", "",
			secureCookie, false)
		c.Header(sessionHeaderName, sess.ID)

		// Save session id in gin metadata
		c.Set(sessionCookieName, sess.ID)

		c.Next()
	}
}

// Get returns the client session for a specific ID
func (s *Sessions) Get(c *gin.Context) *ClientSession {
	var sid string

	// First get from gin metadata
	v, exist := c.Get(sessionCookieName)
	if v != nil {
		sid = v.(string)
	}

	// Then look in cookie
	if !exist || sid == "" {
		sid, _ = c.Cookie(sessionCookieName)
	}

	// Then look in Header
	if sid == "" {
		sid = c.Request.Header.Get(sessionCookieName)
	}
	if sid != "" {
		s.mutex.Lock()
		defer s.mutex.Unlock()
		if key, ok := s.sessMap[sid]; ok {
			// TODO: return a copy ???
			return &key
		}
	}
	return nil
}

// IOSocketGet Get socketio definition from sid
func (s *Sessions) IOSocketGet(sid string) *socketio.Socket {
	s.mutex.Lock()
	defer s.mutex.Unlock()
	sess, ok := s.sessMap[sid]
	if ok {
		return sess.IOSocket
	}
	return nil
}

// UpdateIOSocket updates the IO Socket definition for of a session
func (s *Sessions) UpdateIOSocket(sid string, so *socketio.Socket) error {
	s.mutex.Lock()
	defer s.mutex.Unlock()
	if _, ok := s.sessMap[sid]; ok {
		sess := s.sessMap[sid]
		if so == nil {
			// Could be the case when socketio is closed/disconnected
			sess.WSID = ""
		} else {
			sess.WSID = (*so).Id()
		}
		sess.IOSocket = so
		s.sessMap[sid] = sess
	}
	return nil
}

// nesSession Allocate a new client session
func (s *Sessions) newSession(prefix string) *ClientSession {
	uuid := prefix + uuid.NewV4().String()
	id := base64.URLEncoding.EncodeToString([]byte(uuid))
	se := ClientSession{
		ID:       id,
		WSID:     "",
		MaxAge:   initSessionMaxAge,
		IOSocket: nil,
		expireAt: time.Now().Add(time.Duration(initSessionMaxAge) * time.Second),
		useCount: 0,
	}
	s.mutex.Lock()
	defer s.mutex.Unlock()

	s.sessMap[se.ID] = se

	s.log.Debugf("NEW session (%d): %s", len(s.sessMap), id)
	return &se
}

// refresh Move this session ID to the head of the list
func (s *Sessions) refresh(sid string) {
	s.mutex.Lock()
	defer s.mutex.Unlock()

	sess := s.sessMap[sid]
	sess.useCount++
	if sess.MaxAge < s.cookieMaxAge && sess.useCount > 1 {
		sess.MaxAge = s.cookieMaxAge
		sess.expireAt = time.Now().Add(time.Duration(sess.MaxAge) * time.Second)
	}

	// TODO - Add flood detection (like limit_req of nginx)
	// (delayed request when to much requests in a short period of time)

	s.sessMap[sid] = sess
}

func (s *Sessions) monitorSessMap() {
	const dbgFullTrace = false // for debugging

	for {
		select {
		case <-s.stop:
			s.log.Debugln("Stop monitorSessMap")
			return
		case <-time.After(sessionMonitorTime * time.Second):
			if dbgFullTrace {
				s.log.Debugf("Sessions Map size: %d", len(s.sessMap))
				s.log.Debugf("Sessions Map : %v", s.sessMap)
			}

			if len(s.sessMap) > maxSessions {
				s.log.Errorln("TOO MUCH sessions, cleanup old ones !")
			}

			s.mutex.Lock()
			for _, ss := range s.sessMap {
				if ss.expireAt.Sub(time.Now()) < 0 {
					s.log.Debugf("Delete expired session id: %s", ss.ID)
					delete(s.sessMap, ss.ID)
				}
			}
			s.mutex.Unlock()
		}
	}
}