-rw-r--r-- | include/Makefile.am | 1 | ||||
-rw-r--r-- | include/opkele/oauth.h | 22 | ||||
-rw-r--r-- | include/opkele/oauth/consumer.h | 124 | ||||
-rw-r--r-- | include/opkele/types.h | 18 | ||||
-rw-r--r-- | lib/Makefile.am | 9 | ||||
-rw-r--r-- | lib/fields.cc | 59 | ||||
-rw-r--r-- | lib/oauth-consumer.cc | 240 | ||||
-rw-r--r-- | test/.gitignore | 1 | ||||
-rw-r--r-- | test/Makefile.am | 17 | ||||
-rw-r--r-- | test/test-oauth-consumer.cc | 83 |
10 files changed, 559 insertions, 15 deletions
diff --git a/include/Makefile.am b/include/Makefile.am index f842bb9..b41e6cc 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -21,4 +21,5 @@ nobase_include_HEADERS = \ opkele/basic_op.h opkele/verify_op.h \ opkele/util.h \ + opkele/oauth.h opkele/oauth/consumer.h \ ${NODIST_HEADERS_} diff --git a/include/opkele/oauth.h b/include/opkele/oauth.h new file mode 100644 index 0000000..14d0586 --- a/dev/null +++ b/include/opkele/oauth.h @@ -0,0 +1,22 @@ +#ifndef __OPKELE_OAUTH_H +#define __OPKELE_OAUTH_H + +#include <string> + +namespace opkele { + namespace oauth { + using std::string; + + struct token_t { + string key; + string secret; + + token_t() { } + token_t(const string& k,const string& s) + : key(k), secret(s) { } + }; + + } +} + +#endif /* __OPKELE_OAUTH_H */ diff --git a/include/opkele/oauth/consumer.h b/include/opkele/oauth/consumer.h new file mode 100644 index 0000000..1e2784c --- a/dev/null +++ b/include/opkele/oauth/consumer.h @@ -0,0 +1,124 @@ +#ifndef __OPKELE_OAUTH_CONSUMER_H +#define __OPKELE_OAUTH_CONSUMER_H + +#include <string> +#include <opkele/types.h> +#include <opkele/oauth.h> + +namespace opkele { + namespace oauth { + using std::string; + + enum oauth_method_t { + oauth_auth_header, oauth_post_body, oauth_url_query + }; + + struct service_endpoint_t { + string url; + string signature_method; + oauth_method_t oauth_method; + + service_endpoint_t(const string& u,const string& sm,oauth_method_t om) + : url(u), signature_method(sm), oauth_method(om) { } + }; + + class basic_provider_endpoints { + public: + + virtual ~basic_provider_endpoints() { } + + virtual const service_endpoint_t& get_request_token_endpoint() const = 0; + virtual const service_endpoint_t& get_authorize_user_endpoint() const = 0; + virtual const service_endpoint_t& get_access_token_endpoint() const = 0; + + virtual service_endpoint_t& get_url_endpoint(service_endpoint_t& sep, + const string& url) const = 0; + }; + + struct http_request_t { + string authorize_header; + string method; + string url; + string body; + + http_request_t(const string& m,const string& u) + : method(m), url(u) { } + }; + + class basic_consumer { + public: + token_t consumer_token; + + basic_consumer(const token_t& ct) + : consumer_token(ct) { } + virtual ~basic_consumer() { } + + virtual const basic_provider_endpoints& get_endpoints() const = 0; + virtual const string allocate_nonce(time_t ts) = 0; + + token_t get_request_token(); + const string get_authorize_url(const token_t& rt,const string& callback=""); + token_t get_access_token(const token_t& rt); + + void prepare_request( + http_request_t& req, + const basic_fields& qf,const basic_fields& pf, + oauth_method_t om,const string& sm, + const token_t *t=0,const string& realm=""); + void prepare_request( + http_request_t& req, + const basic_fields& qf,const basic_fields& pf, + const service_endpoint_t& sep, + const token_t *t=0,const string& realm=""); + + const string signature( + const string& method, + const string& url, + const basic_fields& fields, + const token_t* rt=0); + + token_t acquire_token( + const service_endpoint_t& sep, + const token_t* rt=0); + }; + + class simple_provider_endpoints : public basic_provider_endpoints { + public: + service_endpoint_t sep_request_token; + service_endpoint_t sep_authorize_user; + service_endpoint_t sep_access_token; + service_endpoint_t sep_generic; + + simple_provider_endpoints( + const string& rt,const string& au,const string& at, + const string& sm, + oauth_method_t ams=oauth_post_body, + oauth_method_t amr=oauth_auth_header ) + : sep_request_token(rt,sm,ams), + sep_authorize_user(au,sm,oauth_url_query), + sep_access_token(at,sm,ams), + sep_generic("",sm,amr) { } + + const service_endpoint_t& get_request_token_endpoint() const; + const service_endpoint_t& get_authorize_user_endpoint() const; + const service_endpoint_t& get_access_token_endpoint() const; + service_endpoint_t& get_url_endpoint(service_endpoint_t& sep, + const string& url) const; + }; + + class simple_consumer : public basic_consumer { + public: + simple_provider_endpoints peps; + + simple_consumer(const simple_provider_endpoints& eps, + const token_t& ct) + : basic_consumer(ct), peps(eps) { } + + const basic_provider_endpoints& get_endpoints() const; + const string allocate_nonce(time_t ts); + }; + + } +} + +#endif /* __OPKELE_OAUTH_CONSUMER_H */ diff --git a/include/opkele/types.h b/include/opkele/types.h index f63bf5d..4471e6a 100644 --- a/include/opkele/types.h +++ b/include/opkele/types.h @@ -144,4 +144,22 @@ namespace opkele { virtual void reset_field(const string& n); + void from_query(const string& qs); + }; + + class fields_t : public basic_fields, public map<string,string> { + public: + fields_t() { } + fields_t(const basic_fields& x) + : basic_fields(x) { } + + bool has_field(const string& n) const; + const string& get_field(const string& n) const; + + virtual fields_iterator fields_begin() const; + virtual fields_iterator fields_end() const; + + virtual void reset_fields(); + virtual void set_field(const string& n,const string& v); + virtual void reset_field(const string& n); }; diff --git a/lib/Makefile.am b/lib/Makefile.am index 20d15b8..6b1fad6 100644 --- a/lib/Makefile.am +++ b/lib/Makefile.am @@ -8,10 +8,12 @@ INCLUDES = \ ${OPENSSL_CFLAGS} \ ${LIBCURL_CPPFLAGS} \ - ${PCRE_CFLAGS} ${EXPAT_CFLAGS} ${TIDY_CFLAGS} + ${PCRE_CFLAGS} ${EXPAT_CFLAGS} ${TIDY_CFLAGS} \ + ${UUID_CFLAGS} libopkele_la_LIBADD = \ ${LIBCURL} \ ${PCRE_LIBS} ${EXPAT_LIBS} \ ${OPENSSL_LIBS} \ - ${KONFORKA_LIBS} ${TIDY_LIBS} + ${KONFORKA_LIBS} ${TIDY_LIBS} \ + ${UUID_LIBS} libopkele_la_SOURCES = \ @@ -30,5 +32,6 @@ libopkele_la_SOURCES = \ basic_rp.cc prequeue_rp.cc \ fields.cc message.cc \ - basic_op.cc verify_op.cc + basic_op.cc verify_op.cc \ + oauth-consumer.cc libopkele_la_LDFLAGS = \ -version-info 2:0:0 diff --git a/lib/fields.cc b/lib/fields.cc index d494098..916b603 100644 --- a/lib/fields.cc +++ b/lib/fields.cc @@ -44,10 +44,14 @@ namespace opkele { __om_query_builder(const char *p,string& r,const basic_fields& m,const string& u) : om(m), first(true), rv(r), pfx(p) { + basic_fields::fields_iterator i=om.fields_begin(), + ie=om.fields_end(); rv = u; - if(rv.find('?')==string::npos) - rv += '?'; - else - first = false; - for_each(om.fields_begin(),om.fields_end(),*this); + if(i!=ie) { + if(rv.find('?')==string::npos) + rv += '?'; + else + first = false; + for_each(i,ie,*this); + } } @@ -83,4 +87,49 @@ namespace opkele { } + void basic_fields::from_query(const string& qs) { + for(string::size_type p=0,np;;p=np+1) { + np = qs.find('&',p); + string::size_type eq = qs.find('=',p); + if(eq==string::npos) break; + if(np==string::npos) { + set_field( + util::url_decode(qs.substr(p,eq-p)), + util::url_decode(qs.substr(eq+1)) ); + break; + }else if(eq<np) { + set_field( + util::url_decode(qs.substr(p,eq-p)), + util::url_decode(qs.substr(eq+1,np-eq-1)) ); + } + } + } + + + bool fields_t::has_field(const string& n) const { + return find(n)!=end(); + } + const string& fields_t::get_field(const string& n) const { + const_iterator i=find(n); + if(i==end()) + throw failed_lookup(OPKELE_CP_ n+": no such field"); + return i->second; + } + + fields_t::fields_iterator fields_t::fields_begin() const { + return util::map_keys_iterator<const_iterator,string,const string&,const string*>(begin(),end()); + } + fields_t::fields_iterator fields_t::fields_end() const { + return util::map_keys_iterator<const_iterator,string,const string&,const string*>(end(),end()); + } + + void fields_t::reset_fields() { + clear(); + } + void fields_t::set_field(const string& n,const string& v) { + (*this)[n]=v; + } + void fields_t::reset_field(const string& n) { + erase(n); + } } diff --git a/lib/oauth-consumer.cc b/lib/oauth-consumer.cc new file mode 100644 index 0000000..d717ed3 --- a/dev/null +++ b/lib/oauth-consumer.cc @@ -0,0 +1,240 @@ +#include <openssl/sha.h> +#include <openssl/evp.h> +#include <openssl/hmac.h> +#include <opkele/oauth/consumer.h> +#include <opkele/exception.h> +#include <opkele/util.h> +#include <opkele/curl.h> +#include <opkele/debug.h> + +#include "config.h" +#ifdef HAVE_LIBUUID +# include <uuid/uuid.h> +#endif + +namespace opkele { + namespace oauth { + + const service_endpoint_t& + simple_provider_endpoints::get_request_token_endpoint() const { + return sep_request_token; } + const service_endpoint_t& + simple_provider_endpoints::get_authorize_user_endpoint() const { + return sep_authorize_user; } + const service_endpoint_t& + simple_provider_endpoints::get_access_token_endpoint() const { + return sep_access_token; } + service_endpoint_t& + simple_provider_endpoints::get_url_endpoint(service_endpoint_t& sep, + const string& url) const { + sep = sep_generic; + sep.url = url; + return sep; } + + token_t basic_consumer::get_request_token() { + return acquire_token(get_endpoints().get_request_token_endpoint()); + } + + const string basic_consumer::get_authorize_url(const token_t& rt,const string& callback) { + fields_t f; + f.set_field("oauth_token",rt.key); + if(!callback.empty()) + f.set_field("oauth_callback",callback); + return f.append_query( + get_endpoints().get_authorize_user_endpoint().url ); + } + + token_t basic_consumer::get_access_token(const token_t& rt) { + return acquire_token(get_endpoints().get_access_token_endpoint(),&rt); + } + + const string basic_consumer::signature( + const string& method, const string& url, + const basic_fields& fields, + const token_t* at) { + if(fields.get_field("oauth_signature_method")!="HMAC-SHA1") + throw opkele::not_implemented(OPKELE_CP_ + "only HMAC-SHA1 signature is implemented"); + string key = util::url_encode(consumer_token.secret); + key += '&'; + if(at) + key += util::url_encode(at->secret); + /* TODO: do not build the whole subject */ + string subject = method; + subject += '&'; + string u = util::rfc_3986_normalize_uri(url); + string::size_type uco = u.find_first_of("#?"); + if(uco!=string::npos) u.erase(uco); + subject += util::url_encode(u); + subject += '&'; + subject += util::url_encode( fields.query_string() ); + unsigned char md[SHA_DIGEST_LENGTH]; + unsigned int md_len = 0; + HMAC( EVP_sha1(), + key.c_str(),key.size(), + (const unsigned char *)subject.c_str(),subject.size(), + md,&md_len ); + assert(md_len==sizeof(md)); + return util::encode_base64(md,md_len); + } + + static void noquerize_url(string& url,const string& sepurl,basic_fields& f) { + string::size_type q = sepurl.find('?'), + p = sepurl.find('#'); + if(q==string::npos) { + url = sepurl.substr(0,p); + }else{ + fields_t tmp; + tmp.from_query(sepurl.substr( + q+1, + (p==string::npos)?string::npos:(p-q-q))); + tmp.append_to(f); + url = sepurl.substr(0,(p==string::npos)?q:min(p,q)); + } + } + + token_t basic_consumer::acquire_token( + const service_endpoint_t& sep, + const token_t* rt) { + util::curl_pick_t curl = util::curl_t::easy_init(); + CURLcode r; + (r=curl.misc_sets()) + || (r=curl.set_write()); + if(r) + throw exception_curl(OPKELE_CP_ "failed to set basic curly options",r); + http_request_t hr( + (sep.oauth_method==oauth_post_body)?"POST":"GET", + ""); + fields_t uq; + noquerize_url(hr.url,sep.url,uq); + prepare_request(hr,uq,fields_t(),sep,rt); + switch(sep.oauth_method) { + case oauth_auth_header: + throw opkele::not_implemented(OPKELE_CP_ + "auth header for token acquisition isn't (yet?) supported"); + break; + case oauth_post_body: + (r=curl.easy_setopt(CURLOPT_POST,1)) + || (r=curl.easy_setopt(CURLOPT_POSTFIELDS,hr.body.c_str())) + || (r=curl.easy_setopt(CURLOPT_POSTFIELDSIZE,hr.body.size())); + break; + case oauth_url_query: + break; + default: + throw opkele::exception(OPKELE_CP_ /* TODO: specialize */ + "invalid oauth_method for request_token endpoint"); + }; + if(r) + throw exception_curl(OPKELE_CP_ "failed to set curly options",r); + if( (r=curl.easy_setopt(CURLOPT_URL,hr.url.c_str())) ) + throw exception_curl(OPKELE_CP_ "failed to set curly urlie",r); + if( (r=curl.easy_perform()) ) + throw exception_curl(OPKELE_CP_ "failed to perform curly request",r); + token_t rv; + string::size_type p=0; + while(p!=string::npos) { + string::size_type np = curl.response.find('&',p); + string part; + if(np==string::npos) { + part.assign(curl.response.c_str()+p); p = string::npos; + }else{ + part.assign(curl.response,p,np-p); p = np+1; + } + string::size_type eq = part.find('='); + if(eq==string::npos) continue; + string n(part,0,eq); + if(n=="oauth_token") { + if(!rv.key.empty()) /* TODO: specialize */ + throw opkele::exception(OPKELE_CP_ "found oauth_token twice"); + rv.key = util::url_decode(part.substr(eq+1)); + }else if(n=="oauth_token_secret") { + if(!rv.secret.empty()) /* TODO: specialize */ + throw opkele::exception(OPKELE_CP_ "found oauth_secret twice"); + rv.secret = util::url_decode(part.substr(eq+1)); + } + } + return rv; + } + + void basic_consumer::prepare_request( + http_request_t& req, + const basic_fields& qf,const basic_fields& pf, + oauth_method_t om,const string& sm, + const token_t *t,const string& realm) { + fields_t op; + op.set_field("oauth_consumer_key",consumer_token.key); + if(t) op.set_field("oauth_token",t->key); + op.set_field("oauth_signature_method",sm); + time_t now; + op.set_field("oauth_timestamp", + util::long_to_string(time(&now))); + op.set_field("oauth_nonce",allocate_nonce(now)); + op.set_field("oauth_version","1.0"); + /* TODO: normalize and strip down url */ + { + fields_t af; /* TODO: optimize, I don't want it to be copied */ + qf.copy_to(af); pf.append_to(af); op.append_to(af); + op.set_field("oauth_signature", signature( + req.method,req.url,af,t) ); + } + req.authorize_header.clear(); + if(om==oauth_auth_header) { + req.authorize_header = "OAuth "; + req.authorize_header += "realm=\""; + req.authorize_header += util::url_encode(realm); + req.authorize_header += '\"'; + for(basic_fields::fields_iterator + i=op.fields_begin(),ie=op.fields_end(); + i!=ie;++i) { + req.authorize_header += ", "; + req.authorize_header += *i; + req.authorize_header += "=\""; + req.authorize_header += util::url_encode(op.get_field(*i)); + req.authorize_header += "\""; + } + req.url = qf.append_query(req.url); + req.body = pf.query_string(); + }else if(om==oauth_post_body) { + assert(req.method=="POST"); + /* TODO: optimize, don't copy it over and over */ + fields_t p; + pf.append_to(p); op.append_to(p); + req.url = qf.append_query(req.url); + req.body = p.query_string(); + }else if(om==oauth_url_query) { + fields_t q; + qf.append_to(q); op.append_to(q); + req.url = q.append_query(req.url); + req.body = pf.query_string(); + }else + throw opkele::exception(OPKELE_CP_ /* TODO: specialize */ + "Unknown oauth method"); + } + + void basic_consumer::prepare_request( + http_request_t& req, + const basic_fields& qf,const basic_fields& pf, + const service_endpoint_t& sep, + const token_t *t,const string& realm) { + prepare_request( + req, qf, pf, + sep.oauth_method,sep.signature_method, + t,realm); + } + + + const basic_provider_endpoints& simple_consumer::get_endpoints() const { + return peps; } + + const string simple_consumer::allocate_nonce(time_t ts) { +# ifndef HAVE_LIBUUID + throw opkele::not_implemented(OPKELE_CP_ + "not implemented consumer's allocate_nonce()"); +# else /* HAVE_LIBUUID */ + uuid_t uuid; uuid_generate(uuid); + return util::encode_base64(uuid,sizeof(uuid)); +# endif /* HAVE_LIBUUID */ + } + + } +} diff --git a/test/.gitignore b/test/.gitignore index 3d88495..7b234bd 100644 --- a/test/.gitignore +++ b/test/.gitignore @@ -8,2 +8,3 @@ /OP.cgi /OP-db.cc +/test-oauth-consumer diff --git a/test/Makefile.am b/test/Makefile.am index 8fedf48..f0c0ea8 100644 --- a/test/Makefile.am +++ b/test/Makefile.am @@ -1,3 +1,3 @@ -noinst_PROGRAMS = test idiscover RP.cgi OP.cgi +noinst_PROGRAMS = test idiscover RP.cgi OP.cgi test-oauth-consumer AM_CPPFLAGS=${CPPFLAGS_DEBUG} @@ -15,13 +15,16 @@ idiscover_SOURCES = idiscover.cc idiscover_LDADD = ${top_builddir}/lib/libopkele.la +test_oauth_consumer_SOURCES = test-oauth-consumer.cc +test_oauth_consumer_LDADD = ${top_builddir}/lib/libopkele.la + if HAVE_SQLITE3 -if HAVE_KINGATE -if HAVE_UUID +if HAVE_UUID +if HAVE_KINGATE RP_cgi_SOURCES = RP.cc nodist_RP_cgi_SOURCES = RP-db.cc RP_cgi_LDADD = ${top_builddir}/lib/libopkele.la \ - ${SQLITE3_LIBS} ${KINGATE_LIBS} ${UUID_LIBS} -RP_cgi_CFLAGS = ${SQLITE3_CFLAGS} ${KINGATE_CFLAGS} ${UUID_CFLAGS} + ${SQLITE3_LIBS} ${KINGATE_LIBS} +RP_cgi_CFLAGS = ${SQLITE3_CFLAGS} ${KINGATE_CFLAGS} RP-db.cc: RP-db.sql @@ -47,5 +50,5 @@ clean-local: rm -f RP-db.cc OP-db.cc -endif #HAVE_UUID -endif #HAVE_KINGATE +endif #HAVE_KINGATE +endif #HAVE_UUID endif #HAVE_SQLITE3 diff --git a/test/test-oauth-consumer.cc b/test/test-oauth-consumer.cc new file mode 100644 index 0000000..3b3ca70 --- a/dev/null +++ b/test/test-oauth-consumer.cc @@ -0,0 +1,83 @@ +#include <iostream> +#include <cassert> +#include <stdexcept> +using namespace std; +#include <openssl/sha.h> +#include <openssl/evp.h> +#include <openssl/hmac.h> +#include <opkele/exception.h> +#include <opkele/debug.h> +#include <opkele/util.h> +#include <opkele/util-internal.h> +#include <opkele/curl.h> +#include <opkele/oauth/consumer.h> + +ostream& operator<<(ostream& o,const opkele::oauth::token_t& t) { + o << "{ key: \"" << t.key << "\", secret: \"" << t.secret <<"\" }"; + return o; +} + +int main(int,char**) { + try { + opkele::oauth::simple_consumer sc( + opkele::oauth::simple_provider_endpoints( + "http://term.ie/oauth/example/request_token.php", + "http://term.ie/oauth/example/user_authorization.php", + "http://term.ie/oauth/example/access_token.php", + "HMAC-SHA1", opkele::oauth::oauth_post_body, + opkele::oauth::oauth_auth_header), + opkele::oauth::token_t( "key","secret" ) ); + opkele::oauth::token_t rt = sc.get_request_token(); + cout << "Request token: " << rt << endl; + cout << "Authorize URL: " << sc.get_authorize_url(rt) << endl; + opkele::oauth::token_t at = sc.get_access_token(rt); + cout << "Access token: " << at << endl; + + opkele::fields_t test; + test.set_field("foo","bar"); + opkele::util::curl_pick_t curl = opkele::util::curl_t::easy_init(); + opkele::oauth::http_request_t hr("POST", + "http://term.ie/oauth/example/echo_api.php"); + sc.prepare_request(hr, + opkele::fields_t(),test, + opkele::oauth::oauth_auth_header,"HMAC-SHA1", + &at,"realm"); + DOUT_("url: " << hr.url << endl + << "body: " << hr.body << endl + << "header: " << hr.authorize_header); + opkele::util::curl_slist_t rh; + rh.append("Authorization: "+hr.authorize_header); + CURLcode r; + (r=curl.misc_sets()) + || (r=curl.set_write()) + || (r=curl.easy_setopt(CURLOPT_HTTPHEADER,rh) ) + || (r=curl.easy_setopt(CURLOPT_URL,hr.url.c_str())) + || (r=curl.easy_setopt(CURLOPT_POST,1)) + || (r=curl.easy_setopt(CURLOPT_POSTFIELDS,hr.body.c_str())) + || (r=curl.easy_setopt(CURLOPT_POSTFIELDSIZE,hr.body.size())); + if(r) + throw opkele::exception_curl(OPKELE_CP_ "failed to set curly options",r); + if( (r=curl.easy_perform()) ) + throw opkele::exception_curl(OPKELE_CP_ "failed to perform curly request",r); + DOUT_("Response: " << endl << curl.response); + +#ifdef OPKELE_HAVE_KONFORKA + }catch(konforka::exception& e) { + cerr + << "oops, caught " << opkele::util::abi_demangle(typeid(e).name()) << endl + << " what: " << e.what() << endl + << " where: " << e.where() << endl; + if(!e._seen.empty()) { + cerr << " seen:" << endl; + for(list<konforka::code_point>::const_iterator + i=e._seen.begin();i!=e._seen.end();++i) { + cerr << " " << i->c_str() << endl; + } + } +#endif + }catch(std::exception& e){ + cerr + << "oops, caught " << opkele::util::abi_demangle(typeid(e).name()) << endl + << " what: " << e.what() << endl; + } +} |