Strict session

Author: Yasuo Ohgaki

ext/session/mod_files.c

@@ -61,40 +61,9 @@ typedef struct {
 } ps_files;
 
 ps_module ps_mod_files = {
-	PS_MOD(files)
+	PS_MOD_SID(files)
 };
 
-/* If you change the logic here, please also update the error message in
- * ps_files_open() appropriately */
-static int ps_files_valid_key(const char *key)
-{
-	size_t len;
-	const char *p;
-	char c;
-	int ret = 1;
-
-	for (p = key; (c = *p); p++) {
-		/* valid characters are a..z,A..Z,0..9 */
-		if (!((c >= 'a' && c <= 'z')
-				|| (c >= 'A' && c <= 'Z')
-				|| (c >= '0' && c <= '9')
-				|| c == ','
-				|| c == '-')) {
-			ret = 0;
-			break;
-		}
-	}
-
-	len = p - key;
-
-	/* Somewhat arbitrary length limit here, but should be way more than
-	   anyone needs and avoids file-level warnings later on if we exceed MAX_PATH */
-	if (len == 0 || len > 128) {
-		ret = 0;
-	}
-
-	return ret;
-}
 
 static char *ps_files_path_create(char *buf, size_t buflen, ps_files *data, const char *key)
 {
@@ -155,11 +124,11 @@ static void ps_files_open(ps_files *data, const char *key TSRMLS_DC)
 
 		ps_files_close(data);
 
-		if (!ps_files_valid_key(key)) {
+		if (php_session_valid_key(key) == FAILURE) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,'");
-			PS(invalid_session_id) = 1;
 			return;
 		}
+
 		if (!ps_files_path_create(buf, sizeof(buf), data, key)) {
 			return;
 		}
@@ -253,6 +222,21 @@ static int ps_files_cleanup_dir(const char *dirname, int maxlifetime TSRMLS_DC)
 	return (nrdels);
 }
 
+static int ps_files_key_exists(ps_files *data, const char *key TSRMLS_DC)
+{
+	char buf[MAXPATHLEN];
+	struct stat sbuf;
+
+	if (!key || !ps_files_path_create(buf, sizeof(buf), data, key)) {
+		return FAILURE;
+	}
+	if (VCWD_STAT(buf, &sbuf)) {
+		return FAILURE;
+	}
+	return SUCCESS;
+}
+
+
 #define PS_FILES_DATA ps_files *data = PS_GET_MOD_DATA()
 
 PS_OPEN_FUNC(files)
@@ -342,6 +326,24 @@ PS_READ_FUNC(files)
 	struct stat sbuf;
 	PS_FILES_DATA;
 
+	/* If strict mode, check session id existence */
+	if (PS(use_strict_mode) &&
+		ps_files_key_exists(data, key TSRMLS_CC) == FAILURE) {
+		/* key points to PS(id), but cannot change here. */
+		if (key) {
+			efree(PS(id));
+			PS(id) = NULL;
+		}
+		PS(id) = PS(mod)->s_create_sid((void **)&data, NULL TSRMLS_CC);
+		if (!PS(id)) {
+			return FAILURE;
+		}
+		php_session_reset_id(TSRMLS_C);
+		if (PS(use_cookies)) {
+			PS(send_cookie) = 1;
+		}
+	}
+
 	ps_files_open(data, key TSRMLS_CC);
 	if (data->fd < 0) {
 		return FAILURE;
@@ -454,6 +456,17 @@ PS_GC_FUNC(files)
 	return SUCCESS;
 }
 
+PS_CREATE_SID_FUNC(files)
+{
+	char *sid;
+	PS_FILES_DATA;
+
+	sid = php_session_create_id((void **)&data, newlen TSRMLS_CC);
+
+	return sid;
+}
+
+
 /*
  * Local variables:
  * tab-width: 4

ext/session/mod_files.h

@@ -24,6 +24,6 @@
 extern ps_module ps_mod_files;
 #define ps_files_ptr &ps_mod_files
 
-PS_FUNCS(files);
+PS_FUNCS_SID(files);
 
 #endif

ext/session/mod_mm.c

@@ -124,7 +124,7 @@ static ps_sd *ps_sd_new(ps_mm *data, const char *key)
 	if (!sd) {
 		TSRMLS_FETCH();
 
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "mm_malloc failed, avail %d, err %s", mm_available(data->mm), mm_error());
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "mm_malloc failed, avail %ld, err %s", mm_available(data->mm), mm_error());
 		return NULL;
 	}
 
@@ -208,8 +208,22 @@ static ps_sd *ps_sd_lookup(ps_mm *data, const char *key, int rw)
 	return ret;
 }
 
+static int ps_mm_key_exists(ps_mm *data, const char *key TSRMLS_DC)
+{
+	ps_sd *sd;
+
+	if (!key) {
+		return FAILURE;
+	}
+	sd = ps_sd_lookup(data, key, 0);
+	if (sd) {
+		return SUCCESS;
+	}
+	return FAILURE;
+}
+
 ps_module ps_mod_mm = {
-	PS_MOD(mm)
+	PS_MOD_SID(mm)
 };
 
 #define PS_MM_DATA ps_mm *data = PS_GET_MOD_DATA()
@@ -341,6 +355,24 @@ PS_READ_FUNC(mm)
 
 	mm_lock(data->mm, MM_LOCK_RD);
 
+	/* If there is an ID and strict mode, verify existence */
+	if (PS(use_strict_mode)
+		&& ps_mm_key_exists(data, key TSRMLS_CC) == FAILURE) {
+		/* key points to PS(id), but cannot change here. */
+		if (key) {
+			efree(PS(id));
+			PS(id) = NULL;
+		}
+		PS(id) = PS(mod)->s_create_sid((void **)&data, NULL TSRMLS_CC);
+		if (!PS(id)) {
+			return FAILURE;
+		}
+		php_session_reset_id(TSRMLS_C);
+		if (PS(use_cookies)) {
+			PS(send_cookie) = 1;
+		}
+	}
+
 	sd = ps_sd_lookup(data, key, 0);
 	if (sd) {
 		*vallen = sd->datalen;
@@ -444,6 +476,16 @@ PS_GC_FUNC(mm)
 	return SUCCESS;
 }
 
+PS_CREATE_SID_FUNC(mm)
+{
+	char *sid;
+	PS_MM_DATA;
+
+	sid = php_session_create_id((void **)&data, newlen TSRMLS_CC);
+
+	return sid;
+}
+
 #endif
 
 /*

ext/session/php_session.h

@@ -29,6 +29,9 @@
 
 #define PHP_SESSION_API 20020330
 
+/* To check php_session_valid_key()/php_session_reset_id() */
+#define PHP_SESSION_STRICT 1
+
 #define PS_OPEN_ARGS void **mod_data, const char *save_path, const char *session_name TSRMLS_DC
 #define PS_CLOSE_ARGS void **mod_data TSRMLS_DC
 #define PS_READ_ARGS void **mod_data, const char *key, char **val, int *vallen TSRMLS_DC
@@ -75,7 +78,7 @@ typedef struct ps_module_struct {
 	#x, ps_open_##x, ps_close_##x, ps_read_##x, ps_write_##x, \
 	 ps_delete_##x, ps_gc_##x, php_session_create_id
 
-/* SID enabled module handler definitions */
+/* SID creation enabled module handler definitions */
 #define PS_FUNCS_SID(x) \
 	PS_OPEN_FUNC(x); \
 	PS_CLOSE_FUNC(x); \
@@ -175,6 +178,8 @@ typedef struct _php_ps_globals {
 	smart_str rfc1867_name;    /* session.upload_progress.name */
 	long rfc1867_freq;         /* session.upload_progress.freq */
 	double rfc1867_min_freq;   /* session.upload_progress.min_freq */
+
+	zend_bool use_strict_mode; /* whether or not PHP accepts unknown session ids */
 } php_ps_globals;
 
 typedef php_ps_globals zend_ps_globals;
@@ -230,6 +235,9 @@ PHPAPI void php_session_start(TSRMLS_D);
 PHPAPI ps_module *_php_find_ps_module(char *name TSRMLS_DC);
 PHPAPI const ps_serializer *_php_find_ps_serializer(char *name TSRMLS_DC);
 
+PHPAPI int php_session_valid_key(const char *key);
+PHPAPI void php_session_reset_id(TSRMLS_D);
+
 #define PS_ADD_VARL(name,namelen) do {										\
 	php_add_session_var(name, namelen TSRMLS_CC);							\
 } while (0)