8 files changed, 110 insertions, 82 deletions

diff --git a/include/Makefile.am b/include/Makefile.am
index 9f5982c..f842bb9 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -1,32 +1,33 @@
 NODIST_HEADERS_ = \
         opkele/acconfig.h \
         opkele/tr1-mem.h
 
 nobase_include_HEADERS = \
         opkele/opkele-config.h \
         opkele/types.h \
         opkele/association.h \
         opkele/exception.h \
         opkele/server.h \
         opkele/consumer.h \
         opkele/extension.h \
         opkele/sreg.h \
         opkele/extension_chain.h \
         opkele/xconsumer.h \
         opkele/xserver.h \
         opkele/uris.h \
         opkele/tr1-mem.h \
         opkele/basic_rp.h opkele/prequeue_rp.h \
         opkele/iterator.h \
         opkele/basic_op.h opkele/verify_op.h \
+        opkele/util.h \
         ${NODIST_HEADERS_}
 
 noinst_HEADERS = \
         opkele/data.h \
         opkele/curl.h opkele/expat.h opkele/tidy.h \
-        opkele/util.h \
+        opkele/util-internal.h \
         opkele/debug.h \
         opkele/discovery.h
 
 dist-hook:
         rm -f $(addprefix ${distdir}/,${NODIST_HEADERS_})
diff --git a/include/opkele/util-internal.h b/include/opkele/util-internal.h
new file mode 100644
index 0000000..ec091ce
--- a/dev/null
+++ b/include/opkele/util-internal.h
@@ -0,0 +1,92 @@
+#ifndef __OPKELE_UTIL_INTERNAL_H
+#define __OPKELE_UTIL_INTERNAL_H
+
+#include <openssl/bn.h>
+#include <openssl/dh.h>
+
+namespace opkele {
+    namespace util {
+
+        /**
+         * Convenience class encapsulating SSL BIGNUM object for the purpose of
+         * automatical freeing.
+         */
+        class bignum_t {
+            public:
+                BIGNUM *_bn;
+
+                bignum_t() : _bn(0) { }
+                bignum_t(BIGNUM *bn) : _bn(bn) { }
+                ~bignum_t() throw() { if(_bn) BN_free(_bn); }
+                
+                bignum_t& operator=(BIGNUM *bn) { if(_bn) BN_free(_bn); _bn = bn; return *this; }
+
+                operator const BIGNUM*(void) const { return _bn; }
+                operator BIGNUM*(void) { return _bn; }
+        };
+        /**
+         * Convenience clas encapsulating SSL DH object for the purpose of
+         * automatic freeing.
+         */
+        class dh_t {
+            public:
+                DH *_dh;
+                
+                dh_t() : _dh(0) { }
+                dh_t(DH *dh) : _dh(dh) { }
+                ~dh_t() throw() { if(_dh) DH_free(_dh); }
+
+                dh_t& operator=(DH *dh) { if(_dh) DH_free(_dh); _dh = dh; return *this; }
+
+                operator const DH*(void) const { return _dh; }
+                operator DH*(void) { return _dh; }
+
+                DH* operator->() { return _dh; }
+                const DH* operator->() const { return _dh; }
+        };
+
+        /**
+         * Convert base64-encoded SSL BIGNUM to internal representation.
+         * @param b64 base64-encoded number
+         * @return SSL BIGNUM
+         * @throw failed_conversion in case of error
+         */
+        BIGNUM *base64_to_bignum(const string& b64);
+        /**
+         * Convert decimal representation to SSL BIGNUM.
+         * @param dec decimal representation
+         * @return resulting BIGNUM
+         * @throw failed_conversion in case of error
+         */
+        BIGNUM *dec_to_bignum(const string& dec);
+        /**
+         * Convert SSL BIGNUM data to base64 encoded string.
+         * @param bn BIGNUM
+         * @return base64encoded string
+         */
+        string bignum_to_base64(const BIGNUM *bn);
+
+        string abi_demangle(const char* mn);
+
+        class change_mode_message_proxy : public basic_openid_message {
+            public:
+                const basic_openid_message& x;
+                const string& mode;
+
+                change_mode_message_proxy(const basic_openid_message& xx,const string& m) : x(xx), mode(m) { }
+
+                bool has_field(const string& n) const { return x.has_field(n); }
+                const string& get_field(const string& n) const {
+                    return (n=="mode")?mode:x.get_field(n); }
+                bool has_ns(const string& uri) const {return x.has_ns(uri); }
+                string get_ns(const string& uri) const { return x.get_ns(uri); }
+                fields_iterator fields_begin() const {
+                    return x.fields_begin(); }
+                fields_iterator fields_end() const {
+                    return x.fields_end(); }
+        };
+
+    }
+}
+
+#endif /* __OPKELE_UTIL_INTERNAL_H */
diff --git a/include/opkele/util.h b/include/opkele/util.h
index bc1a0ea..60955e1 100644
--- a/include/opkele/util.h
+++ b/include/opkele/util.h
@@ -1,184 +1,114 @@
 #ifndef __OPKELE_UTIL_H
 #define __OPKELE_UTIL_H
 
 #include <time.h>
 #include <string>
 #include <vector>
-#include <openssl/bn.h>
-#include <openssl/dh.h>
 #include <opkele/types.h>
 
 namespace opkele {
     using std::string;
     using std::vector;
 
     /**
      * @brief opkele utils namespace
      */
     namespace util {
 
         /**
-         * Convenience class encapsulating SSL BIGNUM object for the purpose of
-         * automatical freeing.
-         */
-        class bignum_t {
-            public:
-                BIGNUM *_bn;
-
-                bignum_t() : _bn(0) { }
-                bignum_t(BIGNUM *bn) : _bn(bn) { }
-                ~bignum_t() throw() { if(_bn) BN_free(_bn); }
-                
-                bignum_t& operator=(BIGNUM *bn) { if(_bn) BN_free(_bn); _bn = bn; return *this; }
-
-                operator const BIGNUM*(void) const { return _bn; }
-                operator BIGNUM*(void) { return _bn; }
-        };
-        /**
-         * Convenience clas encapsulating SSL DH object for the purpose of
-         * automatic freeing.
-         */
-        class dh_t {
-            public:
-                DH *_dh;
-                
-                dh_t() : _dh(0) { }
-                dh_t(DH *dh) : _dh(dh) { }
-                ~dh_t() throw() { if(_dh) DH_free(_dh); }
-
-                dh_t& operator=(DH *dh) { if(_dh) DH_free(_dh); _dh = dh; return *this; }
-
-                operator const DH*(void) const { return _dh; }
-                operator DH*(void) { return _dh; }
-
-                DH* operator->() { return _dh; }
-                const DH* operator->() const { return _dh; }
-        };
-
-        /**
-         * Convert base64-encoded SSL BIGNUM to internal representation.
-         * @param b64 base64-encoded number
-         * @return SSL BIGNUM
-         * @throw failed_conversion in case of error
-         */
-        BIGNUM *base64_to_bignum(const string& b64);
-        /**
-         * Convert decimal representation to SSL BIGNUM.
-         * @param dec decimal representation
-         * @return resulting BIGNUM
-         * @throw failed_conversion in case of error
-         */
-        BIGNUM *dec_to_bignum(const string& dec);
-        /**
-         * Convert SSL BIGNUM data to base64 encoded string.
-         * @param bn BIGNUM
-         * @return base64encoded string
-         */
-        string bignum_to_base64(const BIGNUM *bn);
-
-        /**
          * Convert internal time representation to w3c format
          * @param t internal representation
          * @return w3c time
          * @throw failed_conversion in case of error
          */
         string time_to_w3c(time_t t);
         /**
          * Convert W3C time representation to  internal time_t
          * @param w w3c representation
          * @return converted time
          * @throw failed_conversion in case of error
          */
         time_t w3c_to_time(const string& w);
 
         /**
          * Encode string to the representation suitable for using in URL.
          * @param str string to encode
          * @return encoded string
          * @throw failed_conversion in case of failure
          */
         string url_encode(const string& str);
 
         /**
          * Make string suitable for using as x(ht)ml attribute.
          * @param str string to escape
          * @return escaped string
          */
         string attr_escape(const string& str);
 
         /**
          * Convert number to string
          * @param l number
          * @return string representation
          * @throw failed_conversion in case of failure
          */
         string long_to_string(long l);
         /**
          * Convert string to number
          * @param s string, containing the number
          * @return the number
          * @throw failed_conversion in case of failure
          */
         long string_to_long(const string& s);
 
         /**
          * Encode binary data using base64.
          * @param data pointer to binary data
          * @param length length of data
          * @return encoded data
          */
         string encode_base64(const void *data,size_t length);
         /**
          * Decode binary data from base64 representation.
          * @param data base64-encoded data
          * @param rv container for decoded binary
          */
         void decode_base64(const string& data,vector<unsigned char>& rv);
 
         /**
          * Normalize http(s) URI according to RFC3986, section 6. URI is
          * expected to have scheme: in front of it.
          * @param uri URI
          * @return normalized URI
          * @throw not_implemented in case of non-httpi(s) URI
          * @throw bad_input in case of malformed URI
          */
         string rfc_3986_normalize_uri(const string& uri);
 
         /**
          * Match URI against realm
          * @param uri URI to match
          * @param realm realm to match against
          * @return true if URI matches realm
          */
         bool uri_matches_realm(const string& uri,const string& realm);
 
+        /**
+         * Strip fragment part from URI
+         * @param uri input/output parameter containing the URI
+         * @return reference to uri
+         */
         string& strip_uri_fragment_part(string& uri);
 
-        string abi_demangle(const char* mn);
-
+        /**
+         * Calculate signature and encode it using base64
+         * @param assoc association being used for signing
+         * @param om openid message
+         * @return base64 representation of the signature
+         */
         string base64_signature(const assoc_t& assoc,const basic_openid_message& om);
 
-        class change_mode_message_proxy : public basic_openid_message {
-            public:
-                const basic_openid_message& x;
-                const string& mode;
-
-                change_mode_message_proxy(const basic_openid_message& xx,const string& m) : x(xx), mode(m) { }
-
-                bool has_field(const string& n) const { return x.has_field(n); }
-                const string& get_field(const string& n) const {
-                    return (n=="mode")?mode:x.get_field(n); }
-                bool has_ns(const string& uri) const {return x.has_ns(uri); }
-                string get_ns(const string& uri) const { return x.get_ns(uri); }
-                fields_iterator fields_begin() const {
-                    return x.fields_begin(); }
-                fields_iterator fields_end() const {
-                    return x.fields_end(); }
-        };
-
     }
 
 }
 
 #endif /* __OPKELE_UTIL_H */
diff --git a/lib/basic_op.cc b/lib/basic_op.cc
index c247493..fa659ac 100644
--- a/lib/basic_op.cc
+++ b/lib/basic_op.cc
@@ -1,104 +1,105 @@
 #include <time.h>
 #include <cassert>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <opkele/data.h>
 #include <opkele/basic_op.h>
 #include <opkele/exception.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/uris.h>
 
 namespace opkele {
 
     void basic_OP::reset_vars() {
         assoc.reset();
         return_to.clear(); realm.clear();
         claimed_id.clear(); identity.clear();
         invalidate_handle.clear();
     }
 
     bool basic_OP::has_return_to() const {
         return !return_to.empty();
     }
     const string& basic_OP::get_return_to() const {
         if(return_to.empty())
             throw no_return_to(OPKELE_CP_ "No return_to URL provided with request");
         return return_to;
     }
 
     const string& basic_OP::get_realm() const {
         assert(!realm.empty());
         return realm;
     }
 
     bool basic_OP::has_identity() const {
         return !identity.empty();
     }
     const string& basic_OP::get_claimed_id() const {
         if(claimed_id.empty())
             throw non_identity(OPKELE_CP_ "attempting to retrieve claimed_id of non-identity related request");
         assert(!identity.empty());
         return claimed_id;
     }
     const string& basic_OP::get_identity() const {
         if(identity.empty())
             throw non_identity(OPKELE_CP_ "attempting to retrieve identity of non-identity related request");
         assert(!claimed_id.empty());
         return identity;
     }
 
     bool basic_OP::is_id_select() const {
         return identity==IDURI_SELECT20;
     }
 
     void basic_OP::select_identity(const string& c,const string& i) {
         claimed_id = c; identity = i;
     }
     void basic_OP::set_claimed_id(const string& c) {
         claimed_id = c;
     }
 
     basic_openid_message& basic_OP::associate(
             basic_openid_message& oum,
             const basic_openid_message& inm) try {
         assert(inm.get_field("mode")=="associate");
         util::dh_t dh;
         util::bignum_t c_pub;
         unsigned char key_digest[SHA256_DIGEST_LENGTH];
         size_t d_len = 0;
         string sts = inm.get_field("session_type");
         string ats = inm.get_field("assoc_type");
         if(sts=="DH-SHA1" || sts=="DH-SHA256") {
             if(!(dh = DH_new()))
                 throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
             c_pub = util::base64_to_bignum(inm.get_field("dh_consumer_public"));
             try { dh->p = util::base64_to_bignum(inm.get_field("dh_modulus"));
             }catch(failed_lookup&) {
                 dh->p = util::dec_to_bignum(data::_default_p); }
             try { dh->g = util::base64_to_bignum(inm.get_field("dh_gen"));
             }catch(failed_lookup&) {
                 dh->g = util::dec_to_bignum(data::_default_g); }
             if(!DH_generate_key(dh))
                 throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
             vector<unsigned char> ck(DH_size(dh)+1);
             unsigned char *ckptr = &(ck.front())+1;
             int cklen = DH_compute_key(ckptr,c_pub,dh);
             if(cklen<0)
                 throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
             if(cklen && (*ckptr)&0x80) {
                 (*(--ckptr)) = 0; ++cklen; }
             if(sts=="DH-SHA1") {
                 SHA1(ckptr,cklen,key_digest); d_len = SHA_DIGEST_LENGTH;
             }else if(sts=="DH-SHA256") {
                 SHA256(ckptr,cklen,key_digest); d_len = SHA256_DIGEST_LENGTH;
             }else
                 throw internal_error(OPKELE_CP_ "I thought I knew the session type");
         }else
             throw unsupported(OPKELE_CP_ "Unsupported session_type");
         assoc_t a;
         if(ats=="HMAC-SHA1")
             a = alloc_assoc(ats,SHA_DIGEST_LENGTH,false);
         else if(ats=="HMAC-SHA256")
             a = alloc_assoc(ats,SHA256_DIGEST_LENGTH,false);
         else
             throw unsupported(OPKELE_CP_ "Unsupported assoc_type");
diff --git a/lib/basic_rp.cc b/lib/basic_rp.cc
index a0ad130..e65d9fb 100644
--- a/lib/basic_rp.cc
+++ b/lib/basic_rp.cc
@@ -1,104 +1,105 @@
 #include <cassert>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <opkele/basic_rp.h>
 #include <opkele/exception.h>
 #include <opkele/uris.h>
 #include <opkele/data.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/curl.h>
 
 namespace opkele {
 
     static void dh_get_secret(
             secret_t& secret, const basic_openid_message& om,
             const char *exp_assoc, const char *exp_sess,
             util::dh_t& dh,
             size_t d_len, unsigned char *(*d_fun)(const unsigned char*,size_t,unsigned char*),
             size_t exp_s_len) try {
         if(om.get_field("assoc_type")!=exp_assoc || om.get_field("session_type")!=exp_sess)
             throw bad_input(OPKELE_CP_ "Unexpected associate response");
         util::bignum_t s_pub = util::base64_to_bignum(om.get_field("dh_server_public"));
         vector<unsigned char> ck(DH_size(dh)+1);
         unsigned char *ckptr = &(ck.front())+1;
         int cklen = DH_compute_key(ckptr,s_pub,dh);
         if(cklen<0)
             throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
         if(cklen && (*ckptr)&0x80) {
             (*(--ckptr))=0; ++cklen; }
         assert(d_len<=SHA256_DIGEST_LENGTH);
         unsigned char key_digest[SHA256_DIGEST_LENGTH];
         secret.enxor_from_base64((*d_fun)(ckptr,cklen,key_digest),om.get_field("enc_mac_key"));
         if(secret.size()!=exp_s_len)
             throw bad_input(OPKELE_CP_ "Secret length isn't consistent with association type");
     }catch(opkele::failed_lookup& ofl) {
         throw bad_input(OPKELE_CP_ "Incoherent response from OP");
     } OPKELE_RETHROW
 
     static void direct_request(basic_openid_message& oum,const basic_openid_message& inm,const string& OP) {
         util::curl_pick_t curl = util::curl_pick_t::easy_init();
         if(!curl)
             throw exception_curl(OPKELE_CP_ "failed to initialize curl");
         string request = inm.query_string();
         CURLcode r;
         (r=curl.misc_sets())
             || (r=curl.easy_setopt(CURLOPT_URL,OP.c_str()))
             || (r=curl.easy_setopt(CURLOPT_POST,1))
             || (r=curl.easy_setopt(CURLOPT_POSTFIELDS,request.data()))
             || (r=curl.easy_setopt(CURLOPT_POSTFIELDSIZE,request.length()))
             || (r=curl.set_write());
         if(r)
             throw exception_curl(OPKELE_CP_ "failed to set curly options",r);
         if( (r=curl.easy_perform()) )
             throw exception_curl(OPKELE_CP_ "failed to perform curly request",r);
         oum.from_keyvalues(curl.response);
     }
 
 
     assoc_t basic_RP::associate(const string& OP) {
         util::dh_t dh = DH_new();
         if(!dh)
             throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
         dh->p = util::dec_to_bignum(data::_default_p);
         dh->g = util::dec_to_bignum(data::_default_g);
         if(!DH_generate_key(dh))
             throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
         openid_message_t req;
         req.set_field("ns",OIURI_OPENID20);
         req.set_field("mode","associate");
         req.set_field("dh_modulus",util::bignum_to_base64(dh->p));
         req.set_field("dh_gen",util::bignum_to_base64(dh->g));
         req.set_field("dh_consumer_public",util::bignum_to_base64(dh->pub_key));
         openid_message_t res;
         req.set_field("assoc_type","HMAC-SHA256");
         req.set_field("session_type","DH-SHA256");
         secret_t secret;
         int expires_in;
         try {
             direct_request(res,req,OP);
             dh_get_secret( secret, res,
                     "HMAC-SHA256", "DH-SHA256",
                     dh, SHA256_DIGEST_LENGTH, SHA256, SHA256_DIGEST_LENGTH );
             expires_in = util::string_to_long(res.get_field("expires_in"));
         }catch(exception&) {
             try {
                 req.set_field("assoc_type","HMAC-SHA1");
                 req.set_field("session_type","DH-SHA1");
                 direct_request(res,req,OP);
                 dh_get_secret( secret, res,
                         "HMAC-SHA1", "DH-SHA1",
                         dh, SHA_DIGEST_LENGTH, SHA1, SHA_DIGEST_LENGTH );
                 expires_in = util::string_to_long(res.get_field("expires_in"));
             }catch(bad_input&) {
                 throw dumb_RP(OPKELE_CP_ "OP failed to supply an association");
             }
         }
         return store_assoc(
                 OP, res.get_field("assoc_handle"),
                 res.get_field("assoc_type"), secret,
                 expires_in );
     }
 
     basic_openid_message& basic_RP::checkid_(
             basic_openid_message& rv,
             mode_t mode,
diff --git a/lib/consumer.cc b/lib/consumer.cc
index ebda262..801496e 100644
--- a/lib/consumer.cc
+++ b/lib/consumer.cc
@@ -1,100 +1,101 @@
 #include <algorithm>
 #include <cassert>
 #include <cstring>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/curl.h>
 #include <opkele/exception.h>
 #include <opkele/data.h>
 #include <opkele/consumer.h>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <iostream>
 
 #include "config.h"
 
 #include <pcre.h>
 
 namespace opkele {
     using namespace std;
     using util::curl_t;
     using util::curl_pick_t;
 
     class pcre_matches_t {
         public:
             int *_ov;
             int _s;
 
             pcre_matches_t() : _ov(0), _s(0) { }
             pcre_matches_t(int s) : _ov(0), _s(s) {
                 if(_s&1) ++_s;
                 _s += _s>>1;
                 _ov = new int[_s];
             }
             ~pcre_matches_t() throw() { if(_ov) delete[] _ov; }
 
             int begin(int i) const { return _ov[i<<1]; }
             int end(int i) const { return _ov[(i<<1)+1]; }
             int length(int i) const { int t=i<<1; return _ov[t+1]-_ov[t]; }
     };
 
     class pcre_t {
         public:
             pcre *_p;
 
             pcre_t() : _p(0) { }
             pcre_t(pcre *p) : _p(p) { }
             pcre_t(const char *re,int opts) : _p(0) {
                 static const char *errptr; static int erroffset;
                 _p = pcre_compile(re,opts,&errptr,&erroffset,NULL);
                 if(!_p)
                     throw internal_error(OPKELE_CP_ string("Failed to compile regexp: ")+errptr);
             }
             ~pcre_t() throw() { if(_p) (*pcre_free)(_p); }
 
             pcre_t& operator=(pcre *p) { if(_p) (*pcre_free)(_p); _p=p; return *this; }
 
             operator const pcre*(void) const { return _p; }
             operator pcre*(void) { return _p; }
 
             int exec(const string& s,pcre_matches_t& m) {
                 if(!_p)
                     throw internal_error(OPKELE_CP_ "Trying to execute absent regexp");
                 return pcre_exec(_p,NULL,s.c_str(),s.length(),0,0,m._ov,m._s);
             }
     };
 
     assoc_t consumer_t::associate(const string& server) {
         util::dh_t dh = DH_new();
         if(!dh)
             throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
         dh->p = util::dec_to_bignum(data::_default_p);
         dh->g = util::dec_to_bignum(data::_default_g);
         if(!DH_generate_key(dh))
             throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
         string request = 
             "openid.mode=associate"
             "&openid.assoc_type=HMAC-SHA1"
             "&openid.session_type=DH-SHA1"
             "&openid.dh_consumer_public=";
         request += util::url_encode(util::bignum_to_base64(dh->pub_key));
         curl_pick_t curl = curl_pick_t::easy_init();
         if(!curl)
             throw exception_curl(OPKELE_CP_ "failed to initialize curl");
         CURLcode r;
         (r=curl.misc_sets())
         || (r=curl.easy_setopt(CURLOPT_URL,server.c_str()))
         || (r=curl.easy_setopt(CURLOPT_POST,1))
         || (r=curl.easy_setopt(CURLOPT_POSTFIELDS,request.data()))
         || (r=curl.easy_setopt(CURLOPT_POSTFIELDSIZE,request.length()))
         || (r=curl.set_write())
         ;
         if(r)
             throw exception_curl(OPKELE_CP_ "failed to set curly options",r);
         if( (r=curl.easy_perform()) )
             throw exception_curl(OPKELE_CP_ "failed to perform curly request",r);
         params_t p; p.parse_keyvalues(curl.response);
         if(p.has_param("assoc_type") && p.get_param("assoc_type")!="HMAC-SHA1")
             throw bad_input(OPKELE_CP_ "unsupported assoc_type");
         string st;
         if(p.has_param("session_type")) st = p.get_param("session_type");
         if((!st.empty()) && st!="DH-SHA1")
diff --git a/lib/server.cc b/lib/server.cc
index 776f1ae..0dea1eb 100644
--- a/lib/server.cc
+++ b/lib/server.cc
@@ -1,101 +1,102 @@
 #include <cstring>
 #include <vector>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/exception.h>
 #include <opkele/server.h>
 #include <opkele/data.h>
 
 namespace opkele {
     using namespace std;
 
     void server_t::associate(const params_t& pin,params_t& pout) {
         util::dh_t dh;
         util::bignum_t c_pub;
         unsigned char key_sha1[SHA_DIGEST_LENGTH];
         enum {
             sess_cleartext,
             sess_dh_sha1
         } st = sess_cleartext;
         if(
                 pin.has_param("openid.session_type")
                 && pin.get_param("openid.session_type")=="DH-SHA1" ) {
             /* TODO: fallback to cleartext in case of exceptions here? */
             if(!(dh = DH_new()))
                 throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
             c_pub = util::base64_to_bignum(pin.get_param("openid.dh_consumer_public"));
             if(pin.has_param("openid.dh_modulus"))
                 dh->p = util::base64_to_bignum(pin.get_param("openid.dh_modulus"));
             else
                 dh->p = util::dec_to_bignum(data::_default_p);
             if(pin.has_param("openid.dh_gen"))
                 dh->g = util::base64_to_bignum(pin.get_param("openid.dh_gen"));
             else
                 dh->g = util::dec_to_bignum(data::_default_g);
             if(!DH_generate_key(dh))
                 throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
             vector<unsigned char> ck(DH_size(dh)+1);
             unsigned char *ckptr = &(ck.front())+1;
             int cklen = DH_compute_key(ckptr,c_pub,dh);
             if(cklen<0)
                 throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
             if(cklen && (*ckptr)&0x80) {
                 (*(--ckptr)) = 0; ++cklen;
             }
             SHA1(ckptr,cklen,key_sha1);
             st = sess_dh_sha1;
         }
         assoc_t assoc = alloc_assoc(mode_associate);
         time_t now = time(0);
         pout.clear();
         pout["assoc_type"] = assoc->assoc_type();
         pout["assoc_handle"] = assoc->handle();
         /* TODO: eventually remove deprecated stuff */
         pout["issued"] = util::time_to_w3c(now);
         pout["expiry"] = util::time_to_w3c(now+assoc->expires_in());
         pout["expires_in"] = util::long_to_string(assoc->expires_in());
         secret_t secret = assoc->secret();
         switch(st) {
             case sess_dh_sha1:
                 pout["session_type"] = "DH-SHA1";
                 pout["dh_server_public"] = util::bignum_to_base64(dh->pub_key);
                 secret.enxor_to_base64(key_sha1,pout["enc_mac_key"]);
                 break;
             default:
                 secret.to_base64(pout["mac_key"]);
                 break;
         }
     }
 
     void server_t::checkid_immediate(const params_t& pin,string& return_to,params_t& pout,extension_t *ext) {
         checkid_(mode_checkid_immediate,pin,return_to,pout,ext);
     }
 
     void server_t::checkid_setup(const params_t& pin,string& return_to,params_t& pout,extension_t *ext) {
         checkid_(mode_checkid_setup,pin,return_to,pout,ext);
     }
 
     void server_t::checkid_(mode_t mode,const params_t& pin,string& return_to,params_t& pout,extension_t *ext) {
         if(mode!=mode_checkid_immediate && mode!=mode_checkid_setup)
             throw bad_input(OPKELE_CP_ "invalid checkid_* mode");
         pout.clear();
         assoc_t assoc;
         try {
             assoc = retrieve_assoc(pin.get_param("openid.assoc_handle"));
         }catch(failed_lookup& fl) {
             // no handle specified or no valid handle found, going dumb
             assoc = alloc_assoc(mode_checkid_setup);
             if(pin.has_param("openid.assoc_handle"))
                 pout["invalidate_handle"]=pin.get_param("openid.assoc_handle");
         }
         string trust_root;
         try {
             trust_root = pin.get_param("openid.trust_root");
         }catch(failed_lookup& fl) { }
         string identity = pin.get_param("openid.identity");
         return_to = pin.get_param("openid.return_to");
         validate(*assoc,pin,identity,trust_root);
         pout["mode"] = "id_res";
         pout["assoc_handle"] = assoc->handle();
         if(pin.has_param("openid.assoc_handle") && assoc->stateless())
diff --git a/test/idiscover.cc b/test/idiscover.cc
index 44df9ce..4b1e90c 100644
--- a/test/idiscover.cc
+++ b/test/idiscover.cc
@@ -1,40 +1,41 @@
 #include <iostream>
 #include <stdexcept>
 #include <iterator>
 #include <algorithm>
 using namespace std;
 #include <opkele/exception.h>
 #include <opkele/discovery.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 
 namespace opkele {
     ostream& operator<<(ostream& o,const opkele::openid_endpoint_t& oep) {
         o
             << " URI:        " << oep.uri << endl
             << " Claimed ID: " << oep.claimed_id << endl
             << " Local ID:   " << oep.local_id << endl;
         return o;
     }
 }
 
 int main(int argc,char **argv) {
     try {
         if(argc<2)
             throw opkele::exception(OPKELE_CP_ "Please, give me something to resolve");
         for(int a=1;a<argc;++a) {
             cout << "==============================================================" << endl
                 << "User-supplied ID: " << argv[a] << endl
                 << "Endpoints:" << endl
                 << " --" << endl;
             string normalized = opkele::idiscover(
                         ostream_iterator<opkele::openid_endpoint_t>(cout," --\n")
                      ,argv[a]);
             cout << "Normalized ID:   " << normalized << endl;
         }
     }catch(exception& e) {
         cerr << "oops, caught " << opkele::util::abi_demangle(typeid(e).name()) << endl
             << " .what(): " << e.what() << endl;
         _exit(1);
     }
     _exit(0);
 }