tokens.go

package tokens

import (
	"crypto/hmac"
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"errors"
	"fmt"
	"io"

	prng "github.com/EricLagerg/go-prng/xorshift"

	"github.com/golang/glog"
)

const (
	HashSize = 32

	// We exclude '0' here because casting a byte slice/array that contains
	// a '0' to a string will cause it to have a null byte. On Unix --
	// and I'm assuming Windows -- platforms a null byte denotes the end
	// of the string. This causes syscalls like Create or Open to break
	// because the string is interpreted incorrectly.
	charTable = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ123456789"

	tableLen = uint64(len(charTable) - 1)
)

var (
	CSRFKey = []byte("0655A28CAAEB0448132026D863771C5D")

	ErrGeneratedBadToken = errors.New("Generated a token with an invalid length.")
)

// NewAuthToken returns a hex-encoded byte slice with a length of 64.
// The token is generated by reading from the OS' PRNG source, usually
// /dev/urandom on Unix-like systems and the CryptGenRandom API on
// Windows.
func NewAuthToken() []byte {
	return newSecureToken()
}

func NewSessionID() string {
	return string(newSecureToken())
}

// NewCSRFToken returns a byte slice with a new base-64 encoded CSRF token,
// only valid for a user's session.
func NewCSRFToken(id string) []byte {
	mac := hmac.New(sha256.New, CSRFKey)

	_, err := mac.Write([]byte(id))
	if err != nil {
		glog.Fatalln(err)
	}

	src := mac.Sum(nil)
	buf := make([]byte, base64.StdEncoding.EncodedLen(len(src)))
	base64.URLEncoding.Encode(buf, src)

	return buf
}

func newSecureToken() []byte {
	buf := make([]byte, HashSize)
	n, err := io.ReadFull(rand.Reader, buf)
	if err != nil {
		glog.Fatalln(err)
	}

	if n != HashSize {
		glog.Fatalln(ErrGeneratedBadToken)
	}

	tok := make([]byte, hex.EncodedLen(len(buf)))

	if hex.Encode(tok, buf) != 64 {
		glog.Fatalln(ErrGeneratedBadToken)
	}

	return tok
}

var (
	r  = new(prng.Shift128Plus) // Our xorshift PRNG
	_u uint64                   // Prevent Go from optimizing out the warmup.
)

func init() {
	r.Seed()
	// Warm up the PRNG. It doesn't necessarily need it, but it won't
	// hurt.
	var n uint64
	fmt.Println("Starting PRNG warmup. MAKE SURE TO CHANGE THIS.")
	for i := 0; i < 1; i++ { //e9; i++ {
		n = r.Next()
	}
	_u = n
	fmt.Printf("Ended PRNG warmup with value of %d.\n", n)
}

// Create fast random strings for job IDs.
// Made up to 29 million unique strings before I quit testing.
func NewJobID() string {
	var buf [32]byte

	for i := HashSize - 1; i >= 0; i-- {
		key := r.Next() % tableLen
		buf[i] = charTable[key]
	}

	return string(buf[:])
}