Add secure pin generation for ui

cmd/bodies_download.go

@@ -16,17 +16,17 @@ import (
 const VisLimit = 1000
 
 type BodyDownload struct {
-	Legends [9]bool
-	BlockNum uint64
-	Pre1 []struct{}
-	Pre10 []struct{}
-	Pre100 []struct{}
-	Pre1_000 []struct{}
-	Pre10_000 []struct{}
-	Pre100_000 []struct{}
-	Pre1_000_000 []struct{}
+	Legends       [9]bool
+	BlockNum      uint64
+	Pre1          []struct{}
+	Pre10         []struct{}
+	Pre100        []struct{}
+	Pre1_000      []struct{}
+	Pre10_000     []struct{}
+	Pre100_000    []struct{}
+	Pre1_000_000  []struct{}
 	Pre10_000_000 []struct{}
-	States []SnapshotItem
+	States        []SnapshotItem
 }
 
 type SnapshotItem struct {
@@ -100,14 +100,14 @@ func (uih *UiHandler) bodiesDownload(ctx context.Context, w http.ResponseWriter,
 				}
 				if changesMode {
 					/*
-					if _, ok := changes[id]; ok {
-						if firstItem, firstOk := snapshot.Min(); firstOk {
-							if id < firstItem.Id + VisLimit {
-								sendSnapshot(snapshot, w, templ, sendEvery)
-								maps.Clear(changes)
+						if _, ok := changes[id]; ok {
+							if firstItem, firstOk := snapshot.Min(); firstOk {
+								if id < firstItem.Id + VisLimit {
+									sendSnapshot(snapshot, w, templ, sendEvery)
+									maps.Clear(changes)
+								}
 							}
 						}
-					}
 					*/
 					tick++
 				}
@@ -121,7 +121,7 @@ func (uih *UiHandler) bodiesDownload(ctx context.Context, w http.ResponseWriter,
 		}
 		sendSnapshot(snapshot, w, templ, sendEvery)
 		maps.Clear(changes)
-		<- sendEvery.C
+		<-sendEvery.C
 	}
 }
 
@@ -134,25 +134,25 @@ func sendSnapshot(snapshot *btree.BTreeG[SnapshotItem], w http.ResponseWriter, t
 			first = false
 			bd.BlockNum = item.Id
 			pre := int(bd.BlockNum)
-			bd.Pre10_000_000 = make([]struct{}, pre / 10_000_000)
+			bd.Pre10_000_000 = make([]struct{}, pre/10_000_000)
 			pre %= 10_000_000
-			bd.Pre1_000_000 = make([]struct{}, pre / 1_000_000)
+			bd.Pre1_000_000 = make([]struct{}, pre/1_000_000)
 			pre %= 1_000_000
-			bd.Pre100_000 = make([]struct{}, pre / 100_000)
+			bd.Pre100_000 = make([]struct{}, pre/100_000)
 			pre %= 100_000
-			bd.Pre10_000 = make([]struct{}, pre / 10_000)
+			bd.Pre10_000 = make([]struct{}, pre/10_000)
 			pre %= 10_000
-			bd.Pre1_000 = make([]struct{}, pre / 1_000)
+			bd.Pre1_000 = make([]struct{}, pre/1_000)
 			pre %= 1_000
-			bd.Pre100 = make([]struct{}, pre / 100)
+			bd.Pre100 = make([]struct{}, pre/100)
 			pre %= 100
-			bd.Pre10 = make([]struct{}, pre / 10)
+			bd.Pre10 = make([]struct{}, pre/10)
 			pre %= 10
 			bd.Pre1 = make([]struct{}, pre)
 		}
 		bd.States = append(bd.States, item)
 		bd.Legends[item.State] = true
-		return item.Id < bd.BlockNum + VisLimit // We limit visualisation to VisLimit first blocks
+		return item.Id < bd.BlockNum+VisLimit // We limit visualisation to VisLimit first blocks
 	})
 	if err := templ.ExecuteTemplate(w, "body_download.html", bd); err != nil {
 		fmt.Fprintf(w, "Executing body_download template: %v", err)

cmd/root.go

@@ -28,6 +28,7 @@ var (
 	serverKeyFile  string
 	serverCertFile string
 	caCertFiles    []string
+	insecure       bool
 
 	rootCmd = &cobra.Command{
 		Use:   "diagnostics",
@@ -55,6 +56,7 @@ func init() {
 	rootCmd.Flags().StringVar(&serverCertFile, "tls.cert", "", "paths to server TLS certificates")
 	rootCmd.MarkFlagRequired("tls.cert")
 	rootCmd.Flags().StringSliceVar(&caCertFiles, "tls.cacerts", []string{}, "comma-separated list of paths to and CAs TLS certificates")
+	rootCmd.Flags().BoolVar(&insecure, "insecure", false, "whether to use insecure PIN generation for testing purposes (default is false)")
 }
 
 func initConfig() {

cmd/ui_handler.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"html/template"
 	"io"
+	"math/big"
 	weakrand "math/rand"
 	"net/http"
 	"net/url"
@@ -105,7 +106,6 @@ func (uih *UiHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	case "bodies_download":
 		uih.bodiesDownload(r.Context(), w, uih.uiTemplate, requestChannel)
 		return
-
 	}
 	uiSession.lock.Lock()
 	defer func() {
@@ -124,7 +124,11 @@ func (uih *UiHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		}
 		uiSession.Session = true
 		uiSession.SessionName = sessionName
-		uiSession.SessionPin, uiSession.NodeS = uih.allocateNewNodeSession()
+		uiSession.SessionPin, uiSession.NodeS, err = uih.allocateNewNodeSession()
+		if err != nil {
+			uiSession.Errors = append(uiSession.Errors, fmt.Sprintf("Generating new node session PIN %v", err))
+			break
+		}
 		uiSession.uiNodeTree.ReplaceOrInsert(UiNodeSession{SessionName: sessionName, SessionPin: uiSession.SessionPin})
 	case r.FormValue("resume_session") != "":
 		// Resume (take over) node session using known PIN
@@ -205,16 +209,23 @@ type UiHandler struct {
 	uiTemplate       *template.Template
 }
 
-func (uih *UiHandler) allocateNewNodeSession() (uint64, *NodeSession) {
+func (uih *UiHandler) allocateNewNodeSession() (uint64, *NodeSession, error) {
 	uih.nodeSessionsLock.Lock()
 	defer uih.nodeSessionsLock.Unlock()
-	pin := uint64(weakrand.Int63n(100_000_000))
+	pin, err := generatePIN()
+	if err != nil {
+		return pin, nil, err
+	}
+
 	for _, ok := uih.nodeSessions[pin]; ok; _, ok = uih.nodeSessions[pin] {
-		pin = uint64(weakrand.Int63n(100_000_000))
+		pin, err = generatePIN()
+	}
+	if err != nil {
+		return pin, nil, err
 	}
 	nodeSession := &NodeSession{requestCh: make(chan *NodeRequest, 16)}
 	uih.nodeSessions[pin] = nodeSession
-	return pin, nodeSession
+	return pin, nodeSession, nil
 }
 
 func (sh *UiHandler) findNodeSession(pin uint64) (*NodeSession, bool) {
@@ -295,3 +306,15 @@ func (sh *UiHandler) fetch(url string, requestChannel chan *NodeRequest) (bool,
 	}
 	return success, sb.String()
 }
+
+func generatePIN() (uint64, error) {
+	if insecure {
+		return uint64(weakrand.Int63n(100_000_000)), nil
+	}
+	max := big.NewInt(100_000_000) // For an 8-digit PIN
+	randNum, err := rand.Int(rand.Reader, max)
+	if err != nil {
+		return 0, err
+	}
+	return randNum.Uint64(), nil
+}