utils: process_mime_part: Initialise file_info to 0

memset the file_info structure that we've just malloc'd to 0, to prevent
random contents from appearing in there. I think I just saw this as the
file_info->sha256 entry seemed to end up being

    Localhost via UNIX socketa676bf0ce8a7e89a1bc34a70ff950eb7c9c6079

That Localhost part is a string from mysqld.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
common: Size file_info.orig_file_name as NAME_MAX + 1

The orig_file_name is only ever a filename (without any directory
components) and NAME_MAX defines the limit on a filename. We + 1 it as
it doesn't include the terminating nul byte.

This saves 3840 bytes from the structure.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
utils: Add a function to generate a hash of a given file

This will primarily be used in the uploads table of the database to
detect duplicate file uploads.

Initially this produces a SHA-256, but in future can be made to do
others.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
utils: process_mime_part: Generate and store a SHA-256 file hash

This makes use of the hash_file() function added in the previous commit,
to store a SHA-256 hash of uploaded files into file_info.sha256

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
utils: Introduce a generic hash generation function

There are various places where we want a hash to use as a key or some
such. So rather than having multiple slightly different hash functions,
consolidate them into one.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
url_helpers: Use generate_hash() in create_session()

Switch to the new generate_hash() function from create_session_id()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
url_helpers: Switch to generate_hash() in generate_csrf_token()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
hashing: Remove redundant hash generation functions

With the introduction and switch over to generate_hash(), the
create_session_id() and generate_activation_key() functions are no
longer used.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
db: Remove a no longer needed include from db.c

netdb.h is no required due to tenant using TENANT_MAX now instead of
NI_MAXHOST

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
url_helpers: Use SID_LEN in is_logged_in()

Use SID_LEN + 1 for the size of session_id

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
url_helpers: Use SID_LEN in set_user_session()

Use SID_LEN + 1 for the size of session_id

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
common: Remove a no longer needed include

netdb.h is no required due to tenant using TENANT_MAX now instead of
NI_MAXHOST

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
url_handlers: There is no need to include url_handlers.h

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
utils: generate_hash: Reduce the amount of entropy used

Various bits of the application want to generate a unique key/id and use
a SHA-256 hash for this purpose. To create this hash, we were taking
1024 bytes of data from /dev/urandom.

However, the kernel's entropy source is not endless (without the
employment of HWRNGs) and 1024 bytes is way excessive for its uses
here. Assuming you get the full 256 possible values of a byte from the
entropy source, 1024 bytes could produce 1x10^2466 unique hashes.

That does seem to be the case, in a test creating a million hashes using
1 byte of entropy, produced 256 unique hashes each with ~3-4000
duplicates.

So, lets reduce the number of bytes used to 8, this can produce 256^8
(1.8x10^19) unique hashes. Which I think suffices for things like one
off activation keys, CSRF tokens and even longer lasting things like
session ids.

Also, due to the way the hashing algorithm works, a minor change in
input will generally lead to a very different hash.

Several runs of creating a million hashes using 8 bytes of entropy
produced no duplicates. It's also worth noting that in this case,
producing duplicate hashes over the lifetime of the application
wouldn't generally be a major issue.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
utils: Make get_{avar,var}() return a const char *

The string returned by these functions should not then be modified,
other than by the specific free'ing functions.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>