File perl-Session-Token.spec of Package perl-Session-Token

Overview Repositories Revisions Requests Users Attributes Meta

File perl-Session-Token.spec of Package perl-Session-Token (Revision 7b1fedef5a55eae446ce2274c9150439)

Currently displaying revision 7b1fedef5a55eae446ce2274c9150439 , Show latest

#
# spec file for package perl-Session-Token
#
# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via http://bugs.opensuse.org/
#

Name:           perl-Session-Token
Version:        1.007
Release:        0
%define cpan_name Session-Token
Summary:        Secure, efficient, simple random session token generation
License:        Artistic-1.0 or GPL-1.0+
Group:          Development/Libraries/Perl
Url:            http://search.cpan.org/dist/Session-Token/
Source:         http://www.cpan.org/authors/id/F/FR/FRACTAL/%{cpan_name}-%{version}.tar.gz
BuildRoot:      %{_tmppath}/%{name}-%{version}-build
BuildRequires:  perl
BuildRequires:  perl-macros
#BuildRequires: perl(Crypt::Random::Source::Strong::Win32)
#BuildRequires: perl(Session::Token)
%{perl_requires}

%description
This module provides a secure, efficient, and simple interface for creating
session tokens, password reset codes, temporary passwords, random
identifiers, and anything else you can think of.

When a Session::Token object is created, 1024 bytes are read from
'/dev/urandom' (Linux, Solaris, most BSDs), '/dev/arandom' (some older
BSDs), or the Crypt::Random::Source::Strong::Win32 manpage (Windows). These
bytes are used to seed the
http://www.burtleburtle.net/bob/rand/isaacafa.html pseudo random number
generator.

Once a generator is created, you can repeatedly call the 'get' method on
the generator object and it will return new tokens.

*IMPORTANT*: If your application calls 'fork', make sure that any
generators are re-created in one of the processes after the fork since
forking will duplicate the generator state and both parent and child
processes will go on to produce identical tokens (just like perl's the rand
manpage after it is seeded).

After the generator context is created, no system calls are used to
generate tokens. This is one way that Session::Token helps with efficiency.
However, this is only important for certain use cases (generally not web
sessions).

ISAAC is a cryptographically secure PRNG that improves on the well known
RC4 algorithm in some important areas. For instance, it doesn't have short
cycles like RC4 does. A theoretical shortest possible cycle in ISAAC is
'2**40', although no cycles this short have ever been found (and probably
don't exist at all). On average, ISAAC cycles are '2**8295'.

Creators of server applications must choose whether a single generator will
be kept around and used to generate all tokens, or if a new Session::Token
object will be created every time a token is needed. Using a generator may
be undesirable because servers start up early after a reboot and the
kernel's randomness pool might be poorly seeded at this point. For this
reason, you might want to defer creating the generator until the first
request comes in and/or periodically re-create the generator object.

There are good arguments for keeping the generator around, however.
Probably the most important is that generating a new token cannot fail due
to a full file descriptor table. Creating a new Session::Token object for
every token can fail for this reason because the constructor opens
'/dev/urandom'. Programs that re-use the generator are also more efficient
and are less likely to cause problems in 'chroot'ed environments where
'/dev/urandom' can no longer be opened.

Aside: Some crappy (usually C) programs that assume opening '/dev/urandom'
will always succeed can return session tokens based only on the contents of
nulled or uninitialised memory. Unix really ought to provide a system call
for random data.

%prep
%setup -q -n %{cpan_name}-%{version}

%build
%{__perl} Makefile.PL INSTALLDIRS=vendor OPTIMIZE="%{optflags}"
%{__make} %{?_smp_mflags}

%check
%{__make} test

%install
%perl_make_install
%perl_process_packlist
%perl_gen_filelist

%files -f %{name}.files
%defattr(-,root,root,755)
%doc Changes COPYING README

%changelog

Places

File perl-Session-Token.spec of Package perl-Session-Token (Revision 7b1fedef5a55eae446ce2274c9150439)

Places