moved some stuff out of the now installed util.h header

Signed-off-by: Michael Krelin <hacker@klever.net>

8 files changed, 110 insertions, 82 deletions

diff --git a/include/Makefile.am b/include/Makefile.am
index 9f5982c..f842bb9 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -1,32 +1,33 @@
 NODIST_HEADERS_ = \
 	opkele/acconfig.h \
 	opkele/tr1-mem.h
 
 nobase_include_HEADERS = \
 	opkele/opkele-config.h \
 	opkele/types.h \
 	opkele/association.h \
 	opkele/exception.h \
 	opkele/server.h \
 	opkele/consumer.h \
 	opkele/extension.h \
 	opkele/sreg.h \
 	opkele/extension_chain.h \
 	opkele/xconsumer.h \
 	opkele/xserver.h \
 	opkele/uris.h \
 	opkele/tr1-mem.h \
 	opkele/basic_rp.h opkele/prequeue_rp.h \
 	opkele/iterator.h \
 	opkele/basic_op.h opkele/verify_op.h \
+	opkele/util.h \
 	${NODIST_HEADERS_}
 
 noinst_HEADERS = \
 	opkele/data.h \
 	opkele/curl.h opkele/expat.h opkele/tidy.h \
-	opkele/util.h \
+	opkele/util-internal.h \
 	opkele/debug.h \
 	opkele/discovery.h
 
 dist-hook:
 	rm -f $(addprefix ${distdir}/,${NODIST_HEADERS_})
diff --git a/include/opkele/util-internal.h b/include/opkele/util-internal.h
new file mode 100644
index 0000000..ec091ce
--- a/dev/null
+++ b/include/opkele/util-internal.h
@@ -0,0 +1,92 @@
+#ifndef __OPKELE_UTIL_INTERNAL_H
+#define __OPKELE_UTIL_INTERNAL_H
+
+#include <openssl/bn.h>
+#include <openssl/dh.h>
+
+namespace opkele {
+    namespace util {
+
+	/**
+	 * Convenience class encapsulating SSL BIGNUM object for the purpose of
+	 * automatical freeing.
+	 */
+	class bignum_t {
+	    public:
+		BIGNUM *_bn;
+
+		bignum_t() : _bn(0) { }
+		bignum_t(BIGNUM *bn) : _bn(bn) { }
+		~bignum_t() throw() { if(_bn) BN_free(_bn); }
+		
+		bignum_t& operator=(BIGNUM *bn) { if(_bn) BN_free(_bn); _bn = bn; return *this; }
+
+		operator const BIGNUM*(void) const { return _bn; }
+		operator BIGNUM*(void) { return _bn; }
+	};
+	/**
+	 * Convenience clas encapsulating SSL DH object for the purpose of
+	 * automatic freeing.
+	 */
+	class dh_t {
+	    public:
+		DH *_dh;
+		
+		dh_t() : _dh(0) { }
+		dh_t(DH *dh) : _dh(dh) { }
+		~dh_t() throw() { if(_dh) DH_free(_dh); }
+
+		dh_t& operator=(DH *dh) { if(_dh) DH_free(_dh); _dh = dh; return *this; }
+
+		operator const DH*(void) const { return _dh; }
+		operator DH*(void) { return _dh; }
+
+		DH* operator->() { return _dh; }
+		const DH* operator->() const { return _dh; }
+	};
+
+	/**
+	 * Convert base64-encoded SSL BIGNUM to internal representation.
+	 * @param b64 base64-encoded number
+	 * @return SSL BIGNUM
+	 * @throw failed_conversion in case of error
+	 */
+	BIGNUM *base64_to_bignum(const string& b64);
+	/**
+	 * Convert decimal representation to SSL BIGNUM.
+	 * @param dec decimal representation
+	 * @return resulting BIGNUM
+	 * @throw failed_conversion in case of error
+	 */
+	BIGNUM *dec_to_bignum(const string& dec);
+	/**
+	 * Convert SSL BIGNUM data to base64 encoded string.
+	 * @param bn BIGNUM
+	 * @return base64encoded string
+	 */
+	string bignum_to_base64(const BIGNUM *bn);
+
+	string abi_demangle(const char* mn);
+
+	class change_mode_message_proxy : public basic_openid_message {
+	    public:
+		const basic_openid_message& x;
+		const string& mode;
+
+		change_mode_message_proxy(const basic_openid_message& xx,const string& m) : x(xx), mode(m) { }
+
+		bool has_field(const string& n) const { return x.has_field(n); }
+		const string& get_field(const string& n) const {
+		    return (n=="mode")?mode:x.get_field(n); }
+		bool has_ns(const string& uri) const {return x.has_ns(uri); }
+		string get_ns(const string& uri) const { return x.get_ns(uri); }
+		fields_iterator fields_begin() const {
+		    return x.fields_begin(); }
+		fields_iterator fields_end() const {
+		    return x.fields_end(); }
+	};
+
+    }
+}
+
+#endif /* __OPKELE_UTIL_INTERNAL_H */
diff --git a/include/opkele/util.h b/include/opkele/util.h
index bc1a0ea..60955e1 100644
--- a/include/opkele/util.h
+++ b/include/opkele/util.h
@@ -1,184 +1,114 @@
 #ifndef __OPKELE_UTIL_H
 #define __OPKELE_UTIL_H
 
 #include <time.h>
 #include <string>
 #include <vector>
-#include <openssl/bn.h>
-#include <openssl/dh.h>
 #include <opkele/types.h>
 
 namespace opkele {
     using std::string;
     using std::vector;
 
     /**
      * @brief opkele utils namespace
      */
     namespace util {
 
 	/**
-	 * Convenience class encapsulating SSL BIGNUM object for the purpose of
-	 * automatical freeing.
-	 */
-	class bignum_t {
-	    public:
-		BIGNUM *_bn;
-
-		bignum_t() : _bn(0) { }
-		bignum_t(BIGNUM *bn) : _bn(bn) { }
-		~bignum_t() throw() { if(_bn) BN_free(_bn); }
-		
-		bignum_t& operator=(BIGNUM *bn) { if(_bn) BN_free(_bn); _bn = bn; return *this; }
-
-		operator const BIGNUM*(void) const { return _bn; }
-		operator BIGNUM*(void) { return _bn; }
-	};
-	/**
-	 * Convenience clas encapsulating SSL DH object for the purpose of
-	 * automatic freeing.
-	 */
-	class dh_t {
-	    public:
-		DH *_dh;
-		
-		dh_t() : _dh(0) { }
-		dh_t(DH *dh) : _dh(dh) { }
-		~dh_t() throw() { if(_dh) DH_free(_dh); }
-
-		dh_t& operator=(DH *dh) { if(_dh) DH_free(_dh); _dh = dh; return *this; }
-
-		operator const DH*(void) const { return _dh; }
-		operator DH*(void) { return _dh; }
-
-		DH* operator->() { return _dh; }
-		const DH* operator->() const { return _dh; }
-	};
-
-	/**
-	 * Convert base64-encoded SSL BIGNUM to internal representation.
-	 * @param b64 base64-encoded number
-	 * @return SSL BIGNUM
-	 * @throw failed_conversion in case of error
-	 */
-	BIGNUM *base64_to_bignum(const string& b64);
-	/**
-	 * Convert decimal representation to SSL BIGNUM.
-	 * @param dec decimal representation
-	 * @return resulting BIGNUM
-	 * @throw failed_conversion in case of error
-	 */
-	BIGNUM *dec_to_bignum(const string& dec);
-	/**
-	 * Convert SSL BIGNUM data to base64 encoded string.
-	 * @param bn BIGNUM
-	 * @return base64encoded string
-	 */
-	string bignum_to_base64(const BIGNUM *bn);
-
-	/**
 	 * Convert internal time representation to w3c format
 	 * @param t internal representation
 	 * @return w3c time
 	 * @throw failed_conversion in case of error
 	 */
 	string time_to_w3c(time_t t);
 	/**
 	 * Convert W3C time representation to  internal time_t
 	 * @param w w3c representation
 	 * @return converted time
 	 * @throw failed_conversion in case of error
 	 */
 	time_t w3c_to_time(const string& w);
 
 	/**
 	 * Encode string to the representation suitable for using in URL.
 	 * @param str string to encode
 	 * @return encoded string
 	 * @throw failed_conversion in case of failure
 	 */
 	string url_encode(const string& str);
 
 	/**
 	 * Make string suitable for using as x(ht)ml attribute.
 	 * @param str string to escape
 	 * @return escaped string
 	 */
 	string attr_escape(const string& str);
 
 	/**
 	 * Convert number to string
 	 * @param l number
 	 * @return string representation
 	 * @throw failed_conversion in case of failure
 	 */
 	string long_to_string(long l);
 	/**
 	 * Convert string to number
 	 * @param s string, containing the number
 	 * @return the number
 	 * @throw failed_conversion in case of failure
 	 */
 	long string_to_long(const string& s);
 
 	/**
 	 * Encode binary data using base64.
 	 * @param data pointer to binary data
 	 * @param length length of data
 	 * @return encoded data
 	 */
 	string encode_base64(const void *data,size_t length);
 	/**
 	 * Decode binary data from base64 representation.
 	 * @param data base64-encoded data
 	 * @param rv container for decoded binary
 	 */
 	void decode_base64(const string& data,vector<unsigned char>& rv);
 
 	/**
 	 * Normalize http(s) URI according to RFC3986, section 6. URI is
 	 * expected to have scheme: in front of it.
 	 * @param uri URI
 	 * @return normalized URI
 	 * @throw not_implemented in case of non-httpi(s) URI
 	 * @throw bad_input in case of malformed URI
 	 */
 	string rfc_3986_normalize_uri(const string& uri);
 
 	/**
 	 * Match URI against realm
 	 * @param uri URI to match
 	 * @param realm realm to match against
 	 * @return true if URI matches realm
 	 */
 	bool uri_matches_realm(const string& uri,const string& realm);
 
+	/**
+	 * Strip fragment part from URI
+	 * @param uri input/output parameter containing the URI
+	 * @return reference to uri
+	 */
 	string& strip_uri_fragment_part(string& uri);
 
-	string abi_demangle(const char* mn);
-
+	/**
+	 * Calculate signature and encode it using base64
+	 * @param assoc association being used for signing
+	 * @param om openid message
+	 * @return base64 representation of the signature
+	 */
 	string base64_signature(const assoc_t& assoc,const basic_openid_message& om);
 
-	class change_mode_message_proxy : public basic_openid_message {
-	    public:
-		const basic_openid_message& x;
-		const string& mode;
-
-		change_mode_message_proxy(const basic_openid_message& xx,const string& m) : x(xx), mode(m) { }
-
-		bool has_field(const string& n) const { return x.has_field(n); }
-		const string& get_field(const string& n) const {
-		    return (n=="mode")?mode:x.get_field(n); }
-		bool has_ns(const string& uri) const {return x.has_ns(uri); }
-		string get_ns(const string& uri) const { return x.get_ns(uri); }
-		fields_iterator fields_begin() const {
-		    return x.fields_begin(); }
-		fields_iterator fields_end() const {
-		    return x.fields_end(); }
-	};
-
     }
 
 }
 
 #endif /* __OPKELE_UTIL_H */
diff --git a/lib/basic_op.cc b/lib/basic_op.cc
index c247493..fa659ac 100644
--- a/lib/basic_op.cc
+++ b/lib/basic_op.cc
@@ -1,327 +1,328 @@
 #include <time.h>
 #include <cassert>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <opkele/data.h>
 #include <opkele/basic_op.h>
 #include <opkele/exception.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/uris.h>
 
 namespace opkele {
 
     void basic_OP::reset_vars() {
 	assoc.reset();
 	return_to.clear(); realm.clear();
 	claimed_id.clear(); identity.clear();
 	invalidate_handle.clear();
     }
 
     bool basic_OP::has_return_to() const {
 	return !return_to.empty();
     }
     const string& basic_OP::get_return_to() const {
 	if(return_to.empty())
 	    throw no_return_to(OPKELE_CP_ "No return_to URL provided with request");
 	return return_to;
     }
 
     const string& basic_OP::get_realm() const {
 	assert(!realm.empty());
 	return realm;
     }
 
     bool basic_OP::has_identity() const {
 	return !identity.empty();
     }
     const string& basic_OP::get_claimed_id() const {
 	if(claimed_id.empty())
 	    throw non_identity(OPKELE_CP_ "attempting to retrieve claimed_id of non-identity related request");
 	assert(!identity.empty());
 	return claimed_id;
     }
     const string& basic_OP::get_identity() const {
 	if(identity.empty())
 	    throw non_identity(OPKELE_CP_ "attempting to retrieve identity of non-identity related request");
 	assert(!claimed_id.empty());
 	return identity;
     }
 
     bool basic_OP::is_id_select() const {
 	return identity==IDURI_SELECT20;
     }
 
     void basic_OP::select_identity(const string& c,const string& i) {
 	claimed_id = c; identity = i;
     }
     void basic_OP::set_claimed_id(const string& c) {
 	claimed_id = c;
     }
 
     basic_openid_message& basic_OP::associate(
 	    basic_openid_message& oum,
 	    const basic_openid_message& inm) try {
 	assert(inm.get_field("mode")=="associate");
 	util::dh_t dh;
 	util::bignum_t c_pub;
 	unsigned char key_digest[SHA256_DIGEST_LENGTH];
 	size_t d_len = 0;
 	string sts = inm.get_field("session_type");
 	string ats = inm.get_field("assoc_type");
 	if(sts=="DH-SHA1" || sts=="DH-SHA256") {
 	    if(!(dh = DH_new()))
 		throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
 	    c_pub = util::base64_to_bignum(inm.get_field("dh_consumer_public"));
 	    try { dh->p = util::base64_to_bignum(inm.get_field("dh_modulus"));
 	    }catch(failed_lookup&) {
 		dh->p = util::dec_to_bignum(data::_default_p); }
 	    try { dh->g = util::base64_to_bignum(inm.get_field("dh_gen"));
 	    }catch(failed_lookup&) {
 		dh->g = util::dec_to_bignum(data::_default_g); }
 	    if(!DH_generate_key(dh))
 		throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
 	    vector<unsigned char> ck(DH_size(dh)+1);
 	    unsigned char *ckptr = &(ck.front())+1;
 	    int cklen = DH_compute_key(ckptr,c_pub,dh);
 	    if(cklen<0)
 		throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
 	    if(cklen && (*ckptr)&0x80) {
 		(*(--ckptr)) = 0; ++cklen; }
 	    if(sts=="DH-SHA1") {
 		SHA1(ckptr,cklen,key_digest); d_len = SHA_DIGEST_LENGTH;
 	    }else if(sts=="DH-SHA256") {
 		SHA256(ckptr,cklen,key_digest); d_len = SHA256_DIGEST_LENGTH;
 	    }else
 		throw internal_error(OPKELE_CP_ "I thought I knew the session type");
 	}else
 	    throw unsupported(OPKELE_CP_ "Unsupported session_type");
 	assoc_t a;
 	if(ats=="HMAC-SHA1")
 	    a = alloc_assoc(ats,SHA_DIGEST_LENGTH,false);
 	else if(ats=="HMAC-SHA256")
 	    a = alloc_assoc(ats,SHA256_DIGEST_LENGTH,false);
 	else
 	    throw unsupported(OPKELE_CP_ "Unsupported assoc_type");
 	oum.reset_fields();
 	oum.set_field("ns",OIURI_OPENID20);
 	oum.set_field("assoc_type",a->assoc_type());
 	oum.set_field("assoc_handle",a->handle());
 	oum.set_field("expires_in",util::long_to_string(a->expires_in()));
 	secret_t secret = a->secret();
 	if(sts=="DH-SHA1" || sts=="DH-SHA256") {
 	    if(d_len != secret.size())
 		throw bad_input(OPKELE_CP_ "Association secret and session MAC are not of the same size");
 	    oum.set_field("session_type",sts);
 	    oum.set_field("dh_server_public",util::bignum_to_base64(dh->pub_key));
 	    string b64; secret.enxor_to_base64(key_digest,b64);
 	    oum.set_field("enc_mac_key",b64);
 	}else /* TODO: support cleartext over encrypted connection */
 	    throw unsupported(OPKELE_CP_ "Unsupported session type");
 	return oum;
     } catch(unsupported& u) {
 	oum.reset_fields();
 	oum.set_field("ns",OIURI_OPENID20);
 	oum.set_field("error",u.what());
 	oum.set_field("error_code","unsupported-type");
 	oum.set_field("session_type","DH-SHA256");
 	oum.set_field("assoc_type","HMAC-SHA256");
 	return oum;
     }
 
     void basic_OP::checkid_(const basic_openid_message& inm,
 	    extension_t *ext) {
 	reset_vars();
 	string modestr = inm.get_field("mode");
 	if(modestr=="checkid_setup")
 	    mode = mode_checkid_setup;
 	else if(modestr=="checkid_immediate")
 	    mode = mode_checkid_immediate;
 	else
 	    throw bad_input(OPKELE_CP_ "Invalid checkid_* mode");
 	try {
 	    assoc = retrieve_assoc(invalidate_handle=inm.get_field("assoc_handle"));
 	    invalidate_handle.clear();
 	}catch(failed_lookup&) { }
 	try {
 	    openid2 = (inm.get_field("ns")==OIURI_OPENID20);
 	}catch(failed_lookup&) { openid2 = false; }
 	try {
 	    return_to = inm.get_field("return_to");
 	}catch(failed_lookup&) { }
 	if(openid2) {
 	    try {
 		realm = inm.get_field("realm");
 	    }catch(failed_lookup&) {
 		try {
 		    realm = inm.get_field("trust_root");
 		}catch(failed_lookup&) {
 		    if(return_to.empty())
 			throw bad_input(OPKELE_CP_
 				"Both realm and return_to are unset");
 		    realm = return_to;
 		}
 	    }
 	}else{
 	    try {
 		realm = inm.get_field("trust_root");
 	    }catch(failed_lookup&) {
 		if(return_to.empty())
 		    throw bad_input(OPKELE_CP_
 			    "Both realm and return_to are unset");
 		realm = return_to;
 	    }
 	}
 	try {
 	    identity = inm.get_field("identity");
 	    try {
 		claimed_id = inm.get_field("claimed_id");
 	    }catch(failed_lookup&) {
 		if(openid2)
 		    throw bad_input(OPKELE_CP_
 			    "claimed_id and identity must be either both present or both absent");
 		claimed_id = identity;
 	    }
 	}catch(failed_lookup&) {
 	    if(openid2 && inm.has_field("claimed_id"))
 		throw bad_input(OPKELE_CP_
 		    "claimed_id and identity must be either both present or both absent");
 	}
 	verify_return_to();
 	if(ext) ext->op_checkid_hook(inm);
     }
 
     basic_openid_message& basic_OP::id_res(basic_openid_message& om,
 	    extension_t *ext) {
 	assert(!return_to.empty());
 	assert(!is_id_select());
 	if(!assoc) {
 	    assoc = alloc_assoc("HMAC-SHA256",SHA256_DIGEST_LENGTH,true);
 	}
 	time_t now = time(0);
 	struct tm gmt; gmtime_r(&now,&gmt);
 	char w3timestr[24];
 	if(!strftime(w3timestr,sizeof(w3timestr),"%Y-%m-%dT%H:%M:%SZ",&gmt))
 	    throw failed_conversion(OPKELE_CP_
 		    "Failed to build time string for nonce" );
 	om.set_field("ns",OIURI_OPENID20);
 	om.set_field("mode","id_res");
 	om.set_field("op_endpoint",get_op_endpoint());
 	string ats = "ns,mode,op_endpoint,return_to,response_nonce,"
 	    "assoc_handle,signed";
 	if(!identity.empty()) {
 	    om.set_field("identity",identity);
 	    om.set_field("claimed_id",claimed_id);
 	    ats += ",identity,claimed_id";
 	}
 	om.set_field("return_to",return_to);
 	string nonce = w3timestr;
 	om.set_field("response_nonce",alloc_nonce(nonce));
 	if(!invalidate_handle.empty()) {
 	    om.set_field("invalidate_handle",invalidate_handle);
 	    ats += ",invalidate_handle";
 	}
 	om.set_field("assoc_handle",assoc->handle());
 	om.add_to_signed(ats);
 	if(ext) ext->op_id_res_hook(om);
 	om.set_field("sig",util::base64_signature(assoc,om));
 	return om;
     }
 
     basic_openid_message& basic_OP::cancel(basic_openid_message& om) {
 	assert(!return_to.empty());
 	om.set_field("ns",OIURI_OPENID20);
 	om.set_field("mode","cancel");
 	return om;
     }
 
     basic_openid_message& basic_OP::error(basic_openid_message& om,
 	    const string& err,const string& contact,
 	    const string& reference ) {
 	assert(!return_to.empty());
 	om.set_field("ns",OIURI_OPENID20);
 	om.set_field("mode","error");
 	om.set_field("error",err);
 	if(!contact.empty()) om.set_field("contact",contact);
 	if(!reference.empty()) om.set_field("reference",reference);
 	return om;
     }
 
     basic_openid_message& basic_OP::setup_needed(
 	    basic_openid_message& oum,const basic_openid_message& inm) {
 	assert(mode==mode_checkid_immediate);
 	assert(!return_to.empty());
 	if(openid2) {
 	    oum.set_field("ns",OIURI_OPENID20);
 	    oum.set_field("mode","setup_needed");
 	}else{
 	    oum.set_field("mode","id_res");
 	    static const string setupmode = "checkid_setup";
 	    oum.set_field("user_setup_url",
 		    util::change_mode_message_proxy(inm,setupmode)
 		    .append_query(get_op_endpoint()));
 	}
 	return oum;
     }
 
     basic_openid_message& basic_OP::check_authentication(
 	    basic_openid_message& oum,
 	    const basic_openid_message& inm) try {
 	assert(inm.get_field("mode")=="check_authentication");
 	oum.reset_fields();
 	oum.set_field("ns",OIURI_OPENID20);
 	bool o2;
 	try {
 	    o2 = (inm.get_field("ns")==OIURI_OPENID20);
 	}catch(failed_lookup&) { o2 = false; }
 	string nonce;
 	if(o2) {
 	    try {
 		if(!check_nonce(nonce = inm.get_field("response_nonce")))
 		    throw failed_check_authentication(OPKELE_CP_ "Invalid nonce");
 	    }catch(failed_lookup&) {
 		throw failed_check_authentication(OPKELE_CP_ "No nonce provided with check_authentication request");
 	    }
 	}
 	try {
 	    assoc = retrieve_assoc(inm.get_field("assoc_handle"));
 	    if(!assoc->stateless())
 		throw failed_check_authentication(OPKELE_CP_ "Will not do check_authentication on a stateful handle");
 	}catch(failed_lookup&) {
 	    throw failed_check_authentication(OPKELE_CP_ "No assoc_handle or invalid assoc_handle specified with check_authentication request");
 	}
 	static const string idresmode = "id_res";
 	try {
 	    if(util::base64_signature(assoc,util::change_mode_message_proxy(inm,idresmode))!=inm.get_field("sig"))
 		throw failed_check_authentication(OPKELE_CP_ "Signature mismatch");
 	}catch(failed_lookup&) {
 	    throw failed_check_authentication(OPKELE_CP_ "failed to calculate signature");
 	}
 	oum.set_field("is_valid","true");
 	try {
 	    string h = inm.get_field("invalidate_handle");
 	    try {
 		assoc_t ih = retrieve_assoc(h);
 	    }catch(invalid_handle& ih) {
 		oum.set_field("invalidate_handle",h);
 	    }catch(failed_lookup& ih) {
 		oum.set_field("invalidate_handle",h);
 	    }
 	}catch(failed_lookup&) { }
 	if(o2) {
 	    assert(!nonce.empty());
 	    invalidate_nonce(nonce);
 	}
 	return oum;
     }catch(failed_check_authentication& ) {
 	oum.set_field("is_valid","false");
 	return oum;
     }
 
     void basic_OP::verify_return_to() {
 	if(realm.find('#')!=string::npos)
 	    throw opkele::bad_realm(OPKELE_CP_ "authentication realm contains URI fragment");
 	if(!util::uri_matches_realm(return_to,realm))
 	    throw bad_return_to(OPKELE_CP_ "return_to URL doesn't match realm");
     }
 
 }
diff --git a/lib/basic_rp.cc b/lib/basic_rp.cc
index a0ad130..e65d9fb 100644
--- a/lib/basic_rp.cc
+++ b/lib/basic_rp.cc
@@ -1,299 +1,300 @@
 #include <cassert>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <opkele/basic_rp.h>
 #include <opkele/exception.h>
 #include <opkele/uris.h>
 #include <opkele/data.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/curl.h>
 
 namespace opkele {
 
     static void dh_get_secret(
 	    secret_t& secret, const basic_openid_message& om,
 	    const char *exp_assoc, const char *exp_sess,
 	    util::dh_t& dh,
 	    size_t d_len, unsigned char *(*d_fun)(const unsigned char*,size_t,unsigned char*),
 	    size_t exp_s_len) try {
 	if(om.get_field("assoc_type")!=exp_assoc || om.get_field("session_type")!=exp_sess)
 	    throw bad_input(OPKELE_CP_ "Unexpected associate response");
 	util::bignum_t s_pub = util::base64_to_bignum(om.get_field("dh_server_public"));
 	vector<unsigned char> ck(DH_size(dh)+1);
 	unsigned char *ckptr = &(ck.front())+1;
 	int cklen = DH_compute_key(ckptr,s_pub,dh);
 	if(cklen<0)
 	    throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
 	if(cklen && (*ckptr)&0x80) {
 	    (*(--ckptr))=0; ++cklen; }
 	assert(d_len<=SHA256_DIGEST_LENGTH);
 	unsigned char key_digest[SHA256_DIGEST_LENGTH];
 	secret.enxor_from_base64((*d_fun)(ckptr,cklen,key_digest),om.get_field("enc_mac_key"));
 	if(secret.size()!=exp_s_len)
 	    throw bad_input(OPKELE_CP_ "Secret length isn't consistent with association type");
     }catch(opkele::failed_lookup& ofl) {
 	throw bad_input(OPKELE_CP_ "Incoherent response from OP");
     } OPKELE_RETHROW
 
     static void direct_request(basic_openid_message& oum,const basic_openid_message& inm,const string& OP) {
 	util::curl_pick_t curl = util::curl_pick_t::easy_init();
 	if(!curl)
 	    throw exception_curl(OPKELE_CP_ "failed to initialize curl");
 	string request = inm.query_string();
 	CURLcode r;
 	(r=curl.misc_sets())
 	    || (r=curl.easy_setopt(CURLOPT_URL,OP.c_str()))
 	    || (r=curl.easy_setopt(CURLOPT_POST,1))
 	    || (r=curl.easy_setopt(CURLOPT_POSTFIELDS,request.data()))
 	    || (r=curl.easy_setopt(CURLOPT_POSTFIELDSIZE,request.length()))
 	    || (r=curl.set_write());
 	if(r)
 	    throw exception_curl(OPKELE_CP_ "failed to set curly options",r);
 	if( (r=curl.easy_perform()) )
 	    throw exception_curl(OPKELE_CP_ "failed to perform curly request",r);
 	oum.from_keyvalues(curl.response);
     }
 
 
     assoc_t basic_RP::associate(const string& OP) {
 	util::dh_t dh = DH_new();
 	if(!dh)
 	    throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
 	dh->p = util::dec_to_bignum(data::_default_p);
 	dh->g = util::dec_to_bignum(data::_default_g);
 	if(!DH_generate_key(dh))
 	    throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
 	openid_message_t req;
 	req.set_field("ns",OIURI_OPENID20);
 	req.set_field("mode","associate");
 	req.set_field("dh_modulus",util::bignum_to_base64(dh->p));
 	req.set_field("dh_gen",util::bignum_to_base64(dh->g));
 	req.set_field("dh_consumer_public",util::bignum_to_base64(dh->pub_key));
 	openid_message_t res;
 	req.set_field("assoc_type","HMAC-SHA256");
 	req.set_field("session_type","DH-SHA256");
 	secret_t secret;
 	int expires_in;
 	try {
 	    direct_request(res,req,OP);
 	    dh_get_secret( secret, res,
 		    "HMAC-SHA256", "DH-SHA256",
 		    dh, SHA256_DIGEST_LENGTH, SHA256, SHA256_DIGEST_LENGTH );
 	    expires_in = util::string_to_long(res.get_field("expires_in"));
 	}catch(exception&) {
 	    try {
 		req.set_field("assoc_type","HMAC-SHA1");
 		req.set_field("session_type","DH-SHA1");
 		direct_request(res,req,OP);
 		dh_get_secret( secret, res,
 			"HMAC-SHA1", "DH-SHA1",
 			dh, SHA_DIGEST_LENGTH, SHA1, SHA_DIGEST_LENGTH );
 		expires_in = util::string_to_long(res.get_field("expires_in"));
 	    }catch(bad_input&) {
 		throw dumb_RP(OPKELE_CP_ "OP failed to supply an association");
 	    }
 	}
 	return store_assoc(
 		OP, res.get_field("assoc_handle"),
 		res.get_field("assoc_type"), secret,
 		expires_in );
     }
 
     basic_openid_message& basic_RP::checkid_(
 	    basic_openid_message& rv,
 	    mode_t mode,
 	    const string& return_to,const string& realm,
 	    extension_t *ext) {
 	rv.reset_fields();
 	rv.set_field("ns",OIURI_OPENID20);
 	if(mode==mode_checkid_immediate)
 	    rv.set_field("mode","checkid_immediate");
 	else if(mode==mode_checkid_setup)
 	    rv.set_field("mode","checkid_setup");
 	else
 	    throw bad_input(OPKELE_CP_ "unknown checkid_* mode");
 	if(realm.empty() && return_to.empty())
 	    throw bad_input(OPKELE_CP_ "At least one of realm and return_to must be non-empty");
 	if(!realm.empty()) {
 	    rv.set_field("realm",realm);
 	    rv.set_field("trust_root",realm);
 	}
 	if(!return_to.empty())
 	    rv.set_field("return_to",return_to);
 	const openid_endpoint_t& ep = get_endpoint();
 	rv.set_field("claimed_id",ep.claimed_id);
 	rv.set_field("identity",ep.local_id);
 	try {
 	    rv.set_field("assoc_handle",find_assoc(ep.uri)->handle());
 	}catch(dumb_RP& drp) {
 	}catch(failed_lookup& fl) {
 	    try {
 		rv.set_field("assoc_handle",associate(ep.uri)->handle());
 	    }catch(dumb_RP& drp) { }
 	} OPKELE_RETHROW
 	if(ext) ext->rp_checkid_hook(rv);
 	return rv;
     }
 
     class signed_part_message_proxy : public basic_openid_message {
 	public:
 	    const basic_openid_message& x;
 	    set<string> signeds;
 
 	    signed_part_message_proxy(const basic_openid_message& xx) : x(xx) {
 		const string& slist = x.get_field("signed");
 		string::size_type p = 0;
 		while(true) {
 		    string::size_type co = slist.find(',',p);
 		    string f = (co==string::npos)
 			?slist.substr(p):slist.substr(p,co-p);
 		    signeds.insert(f);
 		    if(co==string::npos) break;
 		    p = co+1;
 		}
 	    }
 
 	    bool has_field(const string& n) const {
 		return signeds.find(n)!=signeds.end() && x.has_field(n); }
 	    const string& get_field(const string& n) const {
 		if(signeds.find(n)==signeds.end())
 		    throw failed_lookup(OPKELE_CP_ "The field isn't known to be signed");
 		return x.get_field(n); }
 
 	    fields_iterator fields_begin() const {
 		return signeds.begin(); }
 	    fields_iterator fields_end() const {
 		return signeds.end(); }
     };
 
     static void parse_query(const string& u,string::size_type q,
 	    map<string,string>& p) {
 	if(q==string::npos)
 	    return;
 	assert(u[q]=='?');
 	++q;
 	string::size_type l = u.size();
 	while(q<l) {
 	    string::size_type eq = u.find('=',q);
 	    string::size_type am = u.find('&',q);
 	    if(am==string::npos) {
 		if(eq==string::npos) {
 		    p[""] = u.substr(q);
 		}else{
 		    p[u.substr(q,eq-q)] = u.substr(eq+1);
 		}
 		break;
 	    }else{
 		if(eq==string::npos || eq>am) {
 		    p[""] = u.substr(q,eq-q);
 		}else{
 		    p[u.substr(q,eq-q)] = u.substr(eq+1,am-eq-1);
 		}
 		q = ++am;
 	    }
 	}
     }
 
     void basic_RP::id_res(const basic_openid_message& om,extension_t *ext) {
 	bool o2 = om.has_field("ns")
 	    && om.get_field("ns")==OIURI_OPENID20;
 	if( (!o2) && om.has_field("user_setup_url"))
 	    throw id_res_setup(OPKELE_CP_ "assertion failed, setup url provided",
 		    om.get_field("user_setup_url"));
 	string m = om.get_field("mode");
 	if(o2 && m=="setup_needed")
 	    throw id_res_setup(OPKELE_CP_ "setup needed, no setup url provided");
 	if(m=="cancel")
 	    throw id_res_cancel(OPKELE_CP_ "authentication cancelled");
 	bool go_dumb=false;
 	try {
 	    string OP = o2
 		?om.get_field("op_endpoint")
 		:get_endpoint().uri;
 	    assoc_t assoc = retrieve_assoc(
 		    OP,om.get_field("assoc_handle"));
 	    if(om.get_field("sig")!=util::base64_signature(assoc,om))
 		throw id_res_mismatch(OPKELE_CP_ "signature mismatch");
 	}catch(dumb_RP& drp) {
 	    go_dumb=true;
 	}catch(failed_lookup& e) {
 	    go_dumb=true;
 	} OPKELE_RETHROW
 	if(go_dumb) {
 	    try {
 		string OP = o2
 		    ?om.get_field("op_endpoint")
 		    :get_endpoint().uri;
 		check_authentication(OP,om);
 	    }catch(failed_check_authentication& fca) {
 		throw id_res_failed(OPKELE_CP_ "failed to check_authentication()");
 	    } OPKELE_RETHROW
 	}
 	signed_part_message_proxy signeds(om);
 	if(o2) {
 	    check_nonce(om.get_field("op_endpoint"),
 		    om.get_field("response_nonce"));
 	    static const char *mustsign[] = {
 		"op_endpoint", "return_to", "response_nonce", "assoc_handle",
 		"claimed_id", "identity" };
 	    for(size_t ms=0;ms<(sizeof(mustsign)/sizeof(*mustsign));++ms) {
 		if(om.has_field(mustsign[ms]) && !signeds.has_field(mustsign[ms]))
 		    throw bad_input(OPKELE_CP_ string("Field '")+mustsign[ms]+"' is not signed against the specs");
 	    }
 	    if( (
 		    (om.has_field("claimed_id")?1:0)
 		    ^
 		    (om.has_field("identity")?1:0)
 		)&1 )
 		throw bad_input(OPKELE_CP_ "claimed_id and identity must be either both present or both absent");
 
 	    string turl = util::rfc_3986_normalize_uri(get_this_url());
 	    util::strip_uri_fragment_part(turl);
 	    string rurl = util::rfc_3986_normalize_uri(om.get_field("return_to"));
 	    util::strip_uri_fragment_part(rurl);
 	    string::size_type
 		tq = turl.find('?'), rq = rurl.find('?');
 	    if(
 		    ((tq==string::npos)?turl:turl.substr(0,tq))
 		    !=
 		    ((rq==string::npos)?rurl:rurl.substr(0,rq))
 	      )
 		throw id_res_bad_return_to(OPKELE_CP_ "return_to url doesn't match request url");
 	    map<string,string> tp; parse_query(turl,tq,tp);
 	    map<string,string> rp; parse_query(rurl,rq,rp);
 	    for(map<string,string>::const_iterator rpi=rp.begin();rpi!=rp.end();++rpi) {
 		map<string,string>::const_iterator tpi = tp.find(rpi->first);
 		if(tpi==tp.end())
 		    throw id_res_bad_return_to(OPKELE_CP_ string("Parameter '")+rpi->first+"' from return_to is missing from the request");
 		if(tpi->second!=rpi->second)
 		    throw id_res_bad_return_to(OPKELE_CP_ string("Parameter '")+rpi->first+"' from return_to doesn't matche the request");
 	    }
 
 	    if(om.has_field("claimed_id")) {
 		verify_OP(
 			om.get_field("op_endpoint"),
 			om.get_field("claimed_id"),
 			om.get_field("identity") );
 	    }
 
 	}
 	if(ext) ext->rp_id_res_hook(om,signeds);
     }
 
     void basic_RP::check_authentication(const string& OP,
 	    const basic_openid_message& om){
 	openid_message_t res;
 	static const string checkauthmode = "check_authentication";
 	direct_request(res,util::change_mode_message_proxy(om,checkauthmode),OP);
 	if(res.has_field("is_valid")) {
 	    if(res.get_field("is_valid")=="true") {
 		if(res.has_field("invalidate_handle"))
 		    invalidate_assoc(OP,res.get_field("invalidate_handle"));
 		return;
 	    }
 	}
 	throw failed_check_authentication(
 		OPKELE_CP_ "failed to verify response");
     }
 
 }
diff --git a/lib/consumer.cc b/lib/consumer.cc
index ebda262..801496e 100644
--- a/lib/consumer.cc
+++ b/lib/consumer.cc
@@ -1,395 +1,396 @@
 #include <algorithm>
 #include <cassert>
 #include <cstring>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/curl.h>
 #include <opkele/exception.h>
 #include <opkele/data.h>
 #include <opkele/consumer.h>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <iostream>
 
 #include "config.h"
 
 #include <pcre.h>
 
 namespace opkele {
     using namespace std;
     using util::curl_t;
     using util::curl_pick_t;
 
     class pcre_matches_t {
 	public:
 	    int *_ov;
 	    int _s;
 
 	    pcre_matches_t() : _ov(0), _s(0) { }
 	    pcre_matches_t(int s) : _ov(0), _s(s) {
 		if(_s&1) ++_s;
 		_s += _s>>1;
 		_ov = new int[_s];
 	    }
 	    ~pcre_matches_t() throw() { if(_ov) delete[] _ov; }
 
 	    int begin(int i) const { return _ov[i<<1]; }
 	    int end(int i) const { return _ov[(i<<1)+1]; }
 	    int length(int i) const { int t=i<<1; return _ov[t+1]-_ov[t]; }
     };
 
     class pcre_t {
 	public:
 	    pcre *_p;
 
 	    pcre_t() : _p(0) { }
 	    pcre_t(pcre *p) : _p(p) { }
 	    pcre_t(const char *re,int opts) : _p(0) {
 		static const char *errptr; static int erroffset;
 		_p = pcre_compile(re,opts,&errptr,&erroffset,NULL);
 		if(!_p)
 		    throw internal_error(OPKELE_CP_ string("Failed to compile regexp: ")+errptr);
 	    }
 	    ~pcre_t() throw() { if(_p) (*pcre_free)(_p); }
 
 	    pcre_t& operator=(pcre *p) { if(_p) (*pcre_free)(_p); _p=p; return *this; }
 
 	    operator const pcre*(void) const { return _p; }
 	    operator pcre*(void) { return _p; }
 
 	    int exec(const string& s,pcre_matches_t& m) {
 		if(!_p)
 		    throw internal_error(OPKELE_CP_ "Trying to execute absent regexp");
 		return pcre_exec(_p,NULL,s.c_str(),s.length(),0,0,m._ov,m._s);
 	    }
     };
 
     assoc_t consumer_t::associate(const string& server) {
 	util::dh_t dh = DH_new();
 	if(!dh)
 	    throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
 	dh->p = util::dec_to_bignum(data::_default_p);
 	dh->g = util::dec_to_bignum(data::_default_g);
 	if(!DH_generate_key(dh))
 	    throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
 	string request = 
 	    "openid.mode=associate"
 	    "&openid.assoc_type=HMAC-SHA1"
 	    "&openid.session_type=DH-SHA1"
 	    "&openid.dh_consumer_public=";
 	request += util::url_encode(util::bignum_to_base64(dh->pub_key));
 	curl_pick_t curl = curl_pick_t::easy_init();
 	if(!curl)
 	    throw exception_curl(OPKELE_CP_ "failed to initialize curl");
 	CURLcode r;
 	(r=curl.misc_sets())
 	|| (r=curl.easy_setopt(CURLOPT_URL,server.c_str()))
 	|| (r=curl.easy_setopt(CURLOPT_POST,1))
 	|| (r=curl.easy_setopt(CURLOPT_POSTFIELDS,request.data()))
 	|| (r=curl.easy_setopt(CURLOPT_POSTFIELDSIZE,request.length()))
 	|| (r=curl.set_write())
 	;
 	if(r)
 	    throw exception_curl(OPKELE_CP_ "failed to set curly options",r);
 	if( (r=curl.easy_perform()) )
 	    throw exception_curl(OPKELE_CP_ "failed to perform curly request",r);
 	params_t p; p.parse_keyvalues(curl.response);
 	if(p.has_param("assoc_type") && p.get_param("assoc_type")!="HMAC-SHA1")
 	    throw bad_input(OPKELE_CP_ "unsupported assoc_type");
 	string st;
 	if(p.has_param("session_type")) st = p.get_param("session_type");
 	if((!st.empty()) && st!="DH-SHA1")
 	    throw bad_input(OPKELE_CP_ "unsupported session_type");
 	secret_t secret;
 	if(st.empty()) {
 	    secret.from_base64(p.get_param("mac_key"));
 	}else{
 	    util::bignum_t s_pub = util::base64_to_bignum(p.get_param("dh_server_public"));
 	    vector<unsigned char> ck(DH_size(dh)+1);
 	    unsigned char *ckptr = &(ck.front())+1;
 	    int cklen = DH_compute_key(ckptr,s_pub,dh);
 	    if(cklen<0)
 		throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
 	    if(cklen && (*ckptr)&0x80) {
 		(*(--ckptr)) = 0; ++cklen;
 	    }
 	    unsigned char key_sha1[SHA_DIGEST_LENGTH];
 	    SHA1(ckptr,cklen,key_sha1);
 	    secret.enxor_from_base64(key_sha1,p.get_param("enc_mac_key"));
 	}
 	int expires_in = 0;
 	if(p.has_param("expires_in")) {
 	    expires_in = util::string_to_long(p.get_param("expires_in"));
 	}else if(p.has_param("issued") && p.has_param("expiry")) {
 	    expires_in = util::w3c_to_time(p.get_param("expiry"))-util::w3c_to_time(p.get_param("issued"));
 	}else
 	    throw bad_input(OPKELE_CP_ "no expiration information");
 	return store_assoc(server,p.get_param("assoc_handle"),secret,expires_in);
     }
 
     string consumer_t::checkid_immediate(const string& identity,const string& return_to,const string& trust_root,extension_t *ext) {
 	return checkid_(mode_checkid_immediate,identity,return_to,trust_root,ext);
     }
     string consumer_t::checkid_setup(const string& identity,const string& return_to,const string& trust_root,extension_t *ext) {
 	return checkid_(mode_checkid_setup,identity,return_to,trust_root,ext);
     }
     string consumer_t::checkid_(mode_t mode,const string& identity,const string& return_to,const string& trust_root,extension_t *ext) {
 	params_t p;
 	if(mode==mode_checkid_immediate)
 	    p["mode"]="checkid_immediate";
 	else if(mode==mode_checkid_setup)
 	    p["mode"]="checkid_setup";
 	else
 	    throw bad_input(OPKELE_CP_ "unknown checkid_* mode");
 	string iurl = canonicalize(identity);
 	string server, delegate;
 	retrieve_links(iurl,server,delegate);
 	p["identity"] = delegate.empty()?iurl:delegate;
 	if(!trust_root.empty())
 	    p["trust_root"] = trust_root;
 	p["return_to"] = return_to;
 	try {
 	    string ah = find_assoc(server)->handle();
 	    p["assoc_handle"] = ah;
 	}catch(failed_lookup& fl) {
 	    string ah = associate(server)->handle();
 	    p["assoc_handle"] = ah;
 	}
 	if(ext) ext->checkid_hook(p);
 	return p.append_query(server);
     }
 
     void consumer_t::id_res(const params_t& pin,const string& identity,extension_t *ext) {
 	if(pin.has_param("openid.user_setup_url"))
 	    throw id_res_setup(OPKELE_CP_ "assertion failed, setup url provided",pin.get_param("openid.user_setup_url"));
 	string server,delegate;
 	retrieve_links(identity.empty()?pin.get_param("openid.identity"):canonicalize(identity),server,delegate);
 	params_t ps;
 	try {
 	    assoc_t assoc = retrieve_assoc(server,pin.get_param("openid.assoc_handle"));
 	    if(assoc->is_expired())
 		throw id_res_expired_on_delivery(OPKELE_CP_ "retrieve_assoc() has returned expired handle");
 	    const string& sigenc = pin.get_param("openid.sig");
 	    vector<unsigned char> sig;
 	    util::decode_base64(sigenc,sig);
 	    const string& slist = pin.get_param("openid.signed");
 	    string kv;
 	    string::size_type p = 0;
 	    while(true) {
 		string::size_type co = slist.find(',',p);
 		string f = (co==string::npos)?slist.substr(p):slist.substr(p,co-p);
 		kv += f;
 		kv += ':';
 		f.insert(0,"openid.");
 		kv += pin.get_param(f);
 		kv += '\n';
 		if(ext) ps[f.substr(sizeof("openid.")-1)] = pin.get_param(f);
 		if(co==string::npos)
 		    break;
 		p = co+1;
 	    }
 	    secret_t secret = assoc->secret();
 	    unsigned int md_len = 0;
 	    unsigned char *md = HMAC(
 		    EVP_sha1(),
 		    &(secret.front()),secret.size(),
 		    (const unsigned char *)kv.data(),kv.length(),
 		    0,&md_len);
 	    if(sig.size()!=md_len || memcmp(&(sig.front()),md,md_len))
 		throw id_res_mismatch(OPKELE_CP_ "signature mismatch");
 	}catch(failed_lookup& e) {
 	    const string& slist = pin.get_param("openid.signed");
 	    string::size_type pp = 0;
 	    params_t p;
 	    while(true) {
 		string::size_type co = slist.find(',',pp);
 		string f = "openid.";
 		f += (co==string::npos)?slist.substr(pp):slist.substr(pp,co-pp);
 		p[f] = pin.get_param(f);
 		if(co==string::npos)
 		    break;
 		pp = co+1;
 	    }
 	    p["openid.assoc_handle"] = pin.get_param("openid.assoc_handle");
 	    p["openid.sig"] = pin.get_param("openid.sig");
 	    p["openid.signed"] = pin.get_param("openid.signed");
 	    try {
 		string ih = pin.get_param("openid.invalidate_handle");
 		p["openid.invalidate_handle"] = ih;
 	    }catch(failed_lookup& fl) { }
 	    try {
 		check_authentication(server,p);
 	    }catch(failed_check_authentication& fca) {
 		throw id_res_failed(OPKELE_CP_ "failed to check_authentication()");
 	    }
 	}
 	if(ext) ext->id_res_hook(pin,ps);
     }
 
     void consumer_t::check_authentication(const string& server,const params_t& p) {
 	string request = "openid.mode=check_authentication";
 	for(params_t::const_iterator i=p.begin();i!=p.end();++i) {
 	    if(i->first!="openid.mode") {
 		request += '&';
 		request += i->first;
 		request += '=';
 		request += util::url_encode(i->second);
 	    }
 	}
 	curl_pick_t curl = curl_pick_t::easy_init();
 	if(!curl)
 	    throw exception_curl(OPKELE_CP_ "failed to initialize curl");
 	CURLcode r;
 	(r=curl.misc_sets())
 	|| (r=curl.easy_setopt(CURLOPT_URL,server.c_str()))
 	|| (r=curl.easy_setopt(CURLOPT_POST,1))
 	|| (r=curl.easy_setopt(CURLOPT_POSTFIELDS,request.data()))
 	|| (r=curl.easy_setopt(CURLOPT_POSTFIELDSIZE,request.length()))
 	|| (r=curl.set_write())
 	;
 	if(r)
 	    throw exception_curl(OPKELE_CP_ "failed to set curly options",r);
 	if( (r=curl.easy_perform()) )
 	    throw exception_curl(OPKELE_CP_ "failed to perform curly request",r);
 	params_t pp; pp.parse_keyvalues(curl.response);
 	if(pp.has_param("invalidate_handle"))
 	    invalidate_assoc(server,pp.get_param("invalidate_handle"));
 	if(pp.has_param("is_valid")) {
 	    if(pp.get_param("is_valid")=="true")
 		return;
 	}else if(pp.has_param("lifetime")) {
 	    if(util::string_to_long(pp.get_param("lifetime")))
 		return;
 	}
 	throw failed_check_authentication(OPKELE_CP_ "failed to verify response");
     }
 
     void consumer_t::retrieve_links(const string& url,string& server,string& delegate) {
 	server.erase();
 	delegate.erase();
 	curl_pick_t curl = curl_pick_t::easy_init();
 	if(!curl)
 	    throw exception_curl(OPKELE_CP_ "failed to initialize curl");
 	string& html = curl.response;
 	CURLcode r;
 	(r=curl.misc_sets())
 	|| (r=curl.easy_setopt(CURLOPT_URL,url.c_str()))
 	|| (r=curl.set_write());
 	;
 	if(r)
 	    throw exception_curl(OPKELE_CP_ "failed to set curly options",r);
 	r = curl.easy_perform();
 	if(r && r!=CURLE_WRITE_ERROR)
 	    throw exception_curl(OPKELE_CP_ "failed to perform curly request",r);
 	static const char *re_bre = "<\\s*body\\b", *re_hdre = "<\\s*head[^>]*>",
 		     *re_lre = "<\\s*link\\b([^>]+)>",
 		     *re_rre = "\\brel\\s*=\\s*['\"]([^'\"]+)['\"]",
 		     *re_hre = "\\bhref\\s*=\\s*['\"]\\s*([^'\"\\s]+)\\s*['\"]";
 	pcre_matches_t m1(3), m2(3);
 	pcre_t bre(re_bre,PCRE_CASELESS);
 	if(bre.exec(html,m1)>0)
 	    html.erase(m1.begin(0));
 	pcre_t hdre(re_hdre,PCRE_CASELESS);
 	if(hdre.exec(html,m1)<=0)
 	    throw bad_input(OPKELE_CP_ "failed to find <head>");
 	html.erase(0,m1.end(0)+1);
 	pcre_t lre(re_lre,PCRE_CASELESS), rre(re_rre,PCRE_CASELESS), hre(re_hre,PCRE_CASELESS);
 	bool gotit = false;
 	while( (!gotit) && lre.exec(html,m1)>=2 ) {
 	    static const char *whitespace = " \t";
 	    string attrs(html,m1.begin(1),m1.length(1));
 	    html.erase(0,m1.end(0)+1);
 	    if(!( rre.exec(attrs,m1)>=2 && hre.exec(attrs,m2)>=2 ))
 		continue;
 	    string rels(attrs,m1.begin(1),m1.length(1));
 	    for(string::size_type ns = rels.find_first_not_of(whitespace);
 		    ns!=string::npos;
 		    ns=rels.find_first_not_of(whitespace,ns)) {
 		string::size_type s = rels.find_first_of(whitespace,ns);
 		string rel;
 		if(s==string::npos) {
 		    rel.assign(rels,ns,string::npos);
 		    ns=string::npos;
 		}else{
 		    rel.assign(rels,ns,s-ns);
 		    ns=s;
 		}
 		if(rel=="openid.server") {
 		    server.assign(attrs,m2.begin(1),m2.length(1));
 		    if(!delegate.empty()) {
 			gotit = true;
 			break;
 		    }
 		}else if(rel=="openid.delegate") {
 		    delegate.assign(attrs,m2.begin(1),m2.length(1));
 		    if(!server.empty()) {
 			gotit = true;
 			break;
 		    }
 		}
 	    }
 	}
 	if(server.empty())
 	    throw failed_assertion(OPKELE_CP_ "The location has no openid.server declaration");
     }
 
     assoc_t consumer_t::find_assoc(const string& /* server */) {
 	throw failed_lookup(OPKELE_CP_ "no find_assoc() provided");
     }
 
     string consumer_t::normalize(const string& url) {
 	string rv = url;
 	// strip leading and trailing spaces
 	string::size_type i = rv.find_first_not_of(" \t\r\n");
 	if(i==string::npos)
 	    throw bad_input(OPKELE_CP_ "empty URL");
 	if(i)
 	    rv.erase(0,i);
 	i = rv.find_last_not_of(" \t\r\n");
 	assert(i!=string::npos);
 	if(i<(rv.length()-1))
 	    rv.erase(i+1);
 	// add missing http://
 	i = rv.find("://");
 	if(i==string::npos) { // primitive. but do we need more?
 	    rv.insert(0,"http://");
 	    i = sizeof("http://")-1;
 	}else{
 	    i += sizeof("://")-1;
 	}
 	string::size_type qm = rv.find('?',i);
 	string::size_type sl = rv.find('/',i);
 	if(qm!=string::npos) {
 	    if(sl==string::npos || sl>qm)
 		rv.insert(qm,1,'/');
 	}else{
 	    if(sl==string::npos)
 		rv += '/';
 	}
 	return rv;
     }
 
     string consumer_t::canonicalize(const string& url) {
 	string rv = normalize(url);
 	curl_t curl = curl_t::easy_init();
 	if(!curl)
 	    throw exception_curl(OPKELE_CP_ "failed to initialize curl()");
 	string html;
 	CURLcode r;
 	(r=curl.misc_sets())
 	|| (r=curl.easy_setopt(CURLOPT_URL,rv.c_str()))
 	|| (r=curl.easy_setopt(CURLOPT_NOBODY,1))
 	;
 	if(r)
 	    throw exception_curl(OPKELE_CP_ "failed to set curly options",r);
 	r = curl.easy_perform();
 	if(r)
 	    throw exception_curl(OPKELE_CP_ "failed to perform curly request",r);
 	const char *eu = 0;
 	r = curl.easy_getinfo(CURLINFO_EFFECTIVE_URL,&eu);
 	if(r)
 	    throw exception_curl(OPKELE_CP_ "failed to get CURLINFO_EFFECTIVE_URL",r);
 	rv = eu;
 	return normalize(rv);
     }
 
 }
diff --git a/lib/server.cc b/lib/server.cc
index 776f1ae..0dea1eb 100644
--- a/lib/server.cc
+++ b/lib/server.cc
@@ -1,171 +1,172 @@
 #include <cstring>
 #include <vector>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/exception.h>
 #include <opkele/server.h>
 #include <opkele/data.h>
 
 namespace opkele {
     using namespace std;
 
     void server_t::associate(const params_t& pin,params_t& pout) {
 	util::dh_t dh;
 	util::bignum_t c_pub;
 	unsigned char key_sha1[SHA_DIGEST_LENGTH];
 	enum {
 	    sess_cleartext,
 	    sess_dh_sha1
 	} st = sess_cleartext;
 	if(
 		pin.has_param("openid.session_type")
 		&& pin.get_param("openid.session_type")=="DH-SHA1" ) {
 	    /* TODO: fallback to cleartext in case of exceptions here? */
 	    if(!(dh = DH_new()))
 		throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
 	    c_pub = util::base64_to_bignum(pin.get_param("openid.dh_consumer_public"));
 	    if(pin.has_param("openid.dh_modulus"))
 		dh->p = util::base64_to_bignum(pin.get_param("openid.dh_modulus"));
 	    else
 		dh->p = util::dec_to_bignum(data::_default_p);
 	    if(pin.has_param("openid.dh_gen"))
 		dh->g = util::base64_to_bignum(pin.get_param("openid.dh_gen"));
 	    else
 		dh->g = util::dec_to_bignum(data::_default_g);
 	    if(!DH_generate_key(dh))
 		throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
 	    vector<unsigned char> ck(DH_size(dh)+1);
 	    unsigned char *ckptr = &(ck.front())+1;
 	    int cklen = DH_compute_key(ckptr,c_pub,dh);
 	    if(cklen<0)
 		throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
 	    if(cklen && (*ckptr)&0x80) {
 		(*(--ckptr)) = 0; ++cklen;
 	    }
 	    SHA1(ckptr,cklen,key_sha1);
 	    st = sess_dh_sha1;
 	}
 	assoc_t assoc = alloc_assoc(mode_associate);
 	time_t now = time(0);
 	pout.clear();
 	pout["assoc_type"] = assoc->assoc_type();
 	pout["assoc_handle"] = assoc->handle();
 	/* TODO: eventually remove deprecated stuff */
 	pout["issued"] = util::time_to_w3c(now);
 	pout["expiry"] = util::time_to_w3c(now+assoc->expires_in());
 	pout["expires_in"] = util::long_to_string(assoc->expires_in());
 	secret_t secret = assoc->secret();
 	switch(st) {
 	    case sess_dh_sha1:
 		pout["session_type"] = "DH-SHA1";
 		pout["dh_server_public"] = util::bignum_to_base64(dh->pub_key);
 		secret.enxor_to_base64(key_sha1,pout["enc_mac_key"]);
 		break;
 	    default:
 		secret.to_base64(pout["mac_key"]);
 		break;
 	}
     }
 
     void server_t::checkid_immediate(const params_t& pin,string& return_to,params_t& pout,extension_t *ext) {
 	checkid_(mode_checkid_immediate,pin,return_to,pout,ext);
     }
 
     void server_t::checkid_setup(const params_t& pin,string& return_to,params_t& pout,extension_t *ext) {
 	checkid_(mode_checkid_setup,pin,return_to,pout,ext);
     }
 
     void server_t::checkid_(mode_t mode,const params_t& pin,string& return_to,params_t& pout,extension_t *ext) {
 	if(mode!=mode_checkid_immediate && mode!=mode_checkid_setup)
 	    throw bad_input(OPKELE_CP_ "invalid checkid_* mode");
 	pout.clear();
 	assoc_t assoc;
 	try {
 	    assoc = retrieve_assoc(pin.get_param("openid.assoc_handle"));
 	}catch(failed_lookup& fl) {
 	    // no handle specified or no valid handle found, going dumb
 	    assoc = alloc_assoc(mode_checkid_setup);
 	    if(pin.has_param("openid.assoc_handle"))
 		pout["invalidate_handle"]=pin.get_param("openid.assoc_handle");
 	}
 	string trust_root;
 	try {
 	    trust_root = pin.get_param("openid.trust_root");
 	}catch(failed_lookup& fl) { }
 	string identity = pin.get_param("openid.identity");
 	return_to = pin.get_param("openid.return_to");
 	validate(*assoc,pin,identity,trust_root);
 	pout["mode"] = "id_res";
 	pout["assoc_handle"] = assoc->handle();
 	if(pin.has_param("openid.assoc_handle") && assoc->stateless())
 	    pout["invalidate_handle"] = pin.get_param("openid.assoc_handle");
 	pout["identity"] = identity;
 	pout["return_to"] = return_to;
 	/* TODO: eventually remove deprecated stuff */
 	time_t now = time(0);
 	pout["issued"] = util::time_to_w3c(now);
 	pout["valid_to"] = util::time_to_w3c(now+120);
 	pout["exipres_in"] = "120";
 	pout["signed"]="mode,identity,return_to";
 	if(ext) ext->checkid_hook(pin,pout);
 	pout["sig"] = util::base64_signature(assoc,pout);
     }
 
     void server_t::check_authentication(const params_t& pin,params_t& pout) {
 	vector<unsigned char>  sig;
 	const string& sigenc = pin.get_param("openid.sig");
 	util::decode_base64(sigenc,sig);
 	assoc_t assoc;
 	try {
 	    assoc = retrieve_assoc(pin.get_param("openid.assoc_handle"));
 	}catch(failed_lookup& fl) {
 	    throw failed_assertion(OPKELE_CP_ "invalid handle or handle not specified");
 	}
 	if(!assoc->stateless())
 	    throw stateful_handle(OPKELE_CP_ "will not do check_authentication on a stateful handle");
 	const string& slist = pin.get_param("openid.signed");
 	string kv;
 	string::size_type p =0;
 	while(true) {
 	    string::size_type co = slist.find(',',p);
 	    string f = (co==string::npos)?slist.substr(p):slist.substr(p,co-p);
 	    kv += f;
 	    kv += ':';
 	    if(f=="mode")
 		kv += "id_res";
 	    else {
 		f.insert(0,"openid.");
 		kv += pin.get_param(f);
 	    }
 	    kv += '\n';
 	    if(co==string::npos)
 		break;
 	    p = co+1;
 	}
 	secret_t secret = assoc->secret();
 	unsigned int md_len = 0;
 	unsigned char *md = HMAC(
 		EVP_sha1(),
 		&(secret.front()),secret.size(),
 		(const unsigned char *)kv.data(),kv.length(),
 		0,&md_len);
 	pout.clear();
 	if(sig.size()==md_len && !memcmp(&(sig.front()),md,md_len)) {
 	    pout["is_valid"]="true";
 	    pout["lifetime"]="60"; /* TODO: eventually remove deprecated stuff */
 	}else{
 	    pout["is_valid"]="false";
 	    pout["lifetime"]="0"; /* TODO: eventually remove deprecated stuff */
 	}
 	if(pin.has_param("openid.invalidate_handle")) {
 	    string h = pin.get_param("openid.invalidate_handle");
 	    try {
 		assoc_t tmp = retrieve_assoc(h);
 	    }catch(invalid_handle& ih) {
 		pout["invalidate_handle"] = h;
 	    }catch(failed_lookup& fl) { }
 	}
     }
 
 }
diff --git a/test/idiscover.cc b/test/idiscover.cc
index 44df9ce..4b1e90c 100644
--- a/test/idiscover.cc
+++ b/test/idiscover.cc
@@ -1,40 +1,41 @@
 #include <iostream>
 #include <stdexcept>
 #include <iterator>
 #include <algorithm>
 using namespace std;
 #include <opkele/exception.h>
 #include <opkele/discovery.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 
 namespace opkele {
     ostream& operator<<(ostream& o,const opkele::openid_endpoint_t& oep) {
 	o
 	    << " URI:        " << oep.uri << endl
 	    << " Claimed ID: " << oep.claimed_id << endl
 	    << " Local ID:   " << oep.local_id << endl;
 	return o;
     }
 }
 
 int main(int argc,char **argv) {
     try {
 	if(argc<2)
 	    throw opkele::exception(OPKELE_CP_ "Please, give me something to resolve");
 	for(int a=1;a<argc;++a) {
 	    cout << "==============================================================" << endl
 		<< "User-supplied ID: " << argv[a] << endl
 		<< "Endpoints:" << endl
 		<< " --" << endl;
 	    string normalized = opkele::idiscover(
 			ostream_iterator<opkele::openid_endpoint_t>(cout," --\n")
 		     ,argv[a]);
 	    cout << "Normalized ID:   " << normalized << endl;
 	}
     }catch(exception& e) {
 	cerr << "oops, caught " << opkele::util::abi_demangle(typeid(e).name()) << endl
 	    << " .what(): " << e.what() << endl;
 	_exit(1);
     }
     _exit(0);
 }