tilecache: remove cache poisoning headers

[chef.git] / cookbooks / tilecache / templates / default / nginx_generate_tilecache_qos_map.erb

diff --git a/cookbooks/tilecache/templates/default/nginx_generate_tilecache_qos_map.erb b/cookbooks/tilecache/templates/default/nginx_generate_tilecache_qos_map.erb
index efadcf602aab48eef94cc8dd87e1b1d08e72e09d..869b30de63de5d7f35a0223af28321c93b80021a 100755 (executable)
--- a/cookbooks/tilecache/templates/default/nginx_generate_tilecache_qos_map.erb
+++ b/cookbooks/tilecache/templates/default/nginx_generate_tilecache_qos_map.erb
@@ -1,14 +1,18 @@
 #!/bin/bash
 # DO NOT EDIT - This file is being maintained by Chef
 #!/bin/bash
 # DO NOT EDIT - This file is being maintained by Chef

-

 set -e
 set -e

+

 NUM_TOKENS=4 # current + 4
 VALID_TOKEN=3600 # in seconds
 NUM_TOKENS=4 # current + 4
 VALID_TOKEN=3600 # in seconds

-QOS_TOKENS=($(/usr/bin/oathtool --totp --window=${NUM_TOKENS} --time-step-size=${VALID_TOKEN}s -b <%= @totp_key %>))

 
 

-# ${qos_tokens[3]/[-1] } = OSM.org exclusive / current
-# ${qos_tokens[2]/[-2] } = tile.openstreetmap.org default
-# ${qos_tokens[1]/[-3] } = stale ~ 1 hour
+SECONDS_AGO=$((${NUM_TOKENS} * ${VALID_TOKEN}))
+OLD_TIME=$(/bin/date -u "+%Y-%m-%dT %H:%M:%S %z" -d "${SECONDS_AGO} seconds ago")
+QOS_TOKENS=($(/usr/bin/oathtool --totp --now="${OLD_TIME}" --window=${NUM_TOKENS} --time-step-size=${VALID_TOKEN}s -b "<%= @totp_key %>"))
+
+# ${qos_tokens[4]/[-1] } = OSM.org exclusive / current
+# ${qos_tokens[3]/[-2] } = OSM.org exclusive / stale
+# ${qos_tokens[2]/[-3] } = tile.openstreetmap.org default
+# ${qos_tokens[1]/[-4] } = stale ~ 1 hour

 # ${qos_tokens[0]} = expired
 
 # Test if number of tokens returned by oathtool is expected number
 # ${qos_tokens[0]} = expired
 
 # Test if number of tokens returned by oathtool is expected number


@@ -28,17 +32,19 @@ if [ -z "$QOS_TOKEN_OSM" -o -z "$QOS_TOKEN_DEFAULT" -o -z "$QOS_TOKEN_STALE" ];
 fi
 
 cat <<EOF >/etc/nginx/conf.d/tile_qos_rates.map
 fi
 
 cat <<EOF >/etc/nginx/conf.d/tile_qos_rates.map

-default 4096; # Default Rate (No QoS cookie)
-"${QOS_TOKEN_STALE}" 16384; # Stale
+default 8192; # Default Rate (No QoS cookie)
+"${QOS_TOKEN_STALE}" 24576; # Stale

 "${QOS_TOKEN_DEFAULT}" 24576; # Default
 "${QOS_TOKEN_OSM_STALE}" 32768; # Exclusive Stale
 "${QOS_TOKEN_OSM}" 32768; # Exclusive
 EOF
 
 cat <<EOF >/etc/nginx/conf.d/tile_qos_cookies.map
 "${QOS_TOKEN_DEFAULT}" 24576; # Default
 "${QOS_TOKEN_OSM_STALE}" 32768; # Exclusive Stale
 "${QOS_TOKEN_OSM}" 32768; # Exclusive
 EOF
 
 cat <<EOF >/etc/nginx/conf.d/tile_qos_cookies.map

-default 'qos_token=${QOS_TOKEN_DEFAULT}; Secure; httponly; Max-Age=${VALID_TOKEN}; Domain=openstreetmap.org; Path=/'; # Cookie Domain per RFC6265
+default '_osm_totp_token=${QOS_TOKEN_DEFAULT}; Max-Age=${VALID_TOKEN}; Domain=openstreetmap.org; Path=/'; # Cookie Domain per RFC6265

 "${QOS_TOKEN_DEFAULT}" ''; # Do not Set-Cookie. # Default
 "${QOS_TOKEN_DEFAULT}" ''; # Do not Set-Cookie. # Default

+"${QOS_TOKEN_OSM_STALE}" ''; # Do not Set-Cookie. # Exclusive Stale

 "${QOS_TOKEN_OSM}" ''; # Do not Set-Cookie. # Exclusive
 EOF
 
 "${QOS_TOKEN_OSM}" ''; # Do not Set-Cookie. # Exclusive
 EOF
 

-/etc/init.d/nginx configtest && service nginx reload
+# Check config, reload config and fail safe
+/etc/init.d/nginx configtest 2>/dev/null && /bin/systemctl try-reload-or-restart nginx