-rw-r--r-- | lib/basic_op.cc | 29 |
1 files changed, 13 insertions, 16 deletions
diff --git a/lib/basic_op.cc b/lib/basic_op.cc index 18446dc..2d82147 100644 --- a/lib/basic_op.cc +++ b/lib/basic_op.cc | |||
@@ -61,19 +61,16 @@ namespace opkele { | |||
61 | basic_openid_message& basic_OP::associate( | 61 | basic_openid_message& basic_OP::associate( |
62 | basic_openid_message& oum, | 62 | basic_openid_message& oum, |
63 | const basic_openid_message& inm) try { | 63 | const basic_openid_message& inm) try { |
64 | assert(inm.get_field("mode")=="associate"); | 64 | assert(inm.get_field("mode")=="associate"); |
65 | util::dh_t dh; | 65 | util::dh_t dh; |
66 | util::bignum_t c_pub; | 66 | util::bignum_t c_pub; |
67 | unsigned char key_digest[SHA256_DIGEST_LENGTH]; | 67 | unsigned char key_digest[SHA256_DIGEST_LENGTH]; |
68 | size_t d_len = 0; | 68 | size_t d_len = 0; |
69 | enum { | ||
70 | sess_cleartext, sess_dh_sha1, sess_dh_sha256 | ||
71 | } st = sess_cleartext; | ||
72 | string sts = inm.get_field("session_type"); | 69 | string sts = inm.get_field("session_type"); |
73 | string ats = inm.get_field("assoc_type"); | 70 | string ats = inm.get_field("assoc_type"); |
74 | if(sts=="DH-SHA1" || sts=="DH-SHA256") { | 71 | if(sts=="DH-SHA1" || sts=="DH-SHA256") { |
75 | if(!(dh = DH_new())) | 72 | if(!(dh = DH_new())) |
76 | throw exception_openssl(OPKELE_CP_ "failed to DH_new()"); | 73 | throw exception_openssl(OPKELE_CP_ "failed to DH_new()"); |
77 | c_pub = util::base64_to_bignum(inm.get_field("dh_consumer_public")); | 74 | c_pub = util::base64_to_bignum(inm.get_field("dh_consumer_public")); |
78 | try { dh->p = util::base64_to_bignum(inm.get_field("dh_modulus")); | 75 | try { dh->p = util::base64_to_bignum(inm.get_field("dh_modulus")); |
79 | }catch(failed_lookup&) { | 76 | }catch(failed_lookup&) { |
@@ -93,29 +90,29 @@ namespace opkele { | |||
93 | if(sts=="DH-SHA1") { | 90 | if(sts=="DH-SHA1") { |
94 | SHA1(ckptr,cklen,key_digest); d_len = SHA_DIGEST_LENGTH; | 91 | SHA1(ckptr,cklen,key_digest); d_len = SHA_DIGEST_LENGTH; |
95 | }else if(sts=="DH-SHA256") { | 92 | }else if(sts=="DH-SHA256") { |
96 | SHA256(ckptr,cklen,key_digest); d_len = SHA256_DIGEST_LENGTH; | 93 | SHA256(ckptr,cklen,key_digest); d_len = SHA256_DIGEST_LENGTH; |
97 | }else | 94 | }else |
98 | throw internal_error(OPKELE_CP_ "I thought I knew the session type"); | 95 | throw internal_error(OPKELE_CP_ "I thought I knew the session type"); |
99 | }else | 96 | }else |
100 | throw unsupported(OPKELE_CP_ "Unsupported session_type"); | 97 | throw unsupported(OPKELE_CP_ "Unsupported session_type"); |
101 | assoc_t assoc; | 98 | assoc_t a; |
102 | if(ats=="HMAC-SHA1") | 99 | if(ats=="HMAC-SHA1") |
103 | assoc = alloc_assoc(ats,SHA_DIGEST_LENGTH,true); | 100 | a = alloc_assoc(ats,SHA_DIGEST_LENGTH,true); |
104 | else if(ats=="HMAC-SHA256") | 101 | else if(ats=="HMAC-SHA256") |
105 | assoc = alloc_assoc(ats,SHA256_DIGEST_LENGTH,true); | 102 | a = alloc_assoc(ats,SHA256_DIGEST_LENGTH,true); |
106 | else | 103 | else |
107 | throw unsupported(OPKELE_CP_ "Unsupported assoc_type"); | 104 | throw unsupported(OPKELE_CP_ "Unsupported assoc_type"); |
108 | oum.reset_fields(); | 105 | oum.reset_fields(); |
109 | oum.set_field("ns",OIURI_OPENID20); | 106 | oum.set_field("ns",OIURI_OPENID20); |
110 | oum.set_field("assoc_type",assoc->assoc_type()); | 107 | oum.set_field("assoc_type",a->assoc_type()); |
111 | oum.set_field("assoc_handle",assoc->handle()); | 108 | oum.set_field("assoc_handle",a->handle()); |
112 | oum.set_field("expires_in",util::long_to_string(assoc->expires_in())); | 109 | oum.set_field("expires_in",util::long_to_string(assoc->expires_in())); |
113 | secret_t secret = assoc->secret(); | 110 | secret_t secret = a->secret(); |
114 | if(sts=="DH-SHA1" || sts=="DH-SHA256") { | 111 | if(sts=="DH-SHA1" || sts=="DH-SHA256") { |
115 | if(d_len != secret.size()) | 112 | if(d_len != secret.size()) |
116 | throw bad_input(OPKELE_CP_ "Association secret and session MAC are not of the same size"); | 113 | throw bad_input(OPKELE_CP_ "Association secret and session MAC are not of the same size"); |
117 | oum.set_field("session_type",sts); | 114 | oum.set_field("session_type",sts); |
118 | oum.set_field("dh_server_public",util::bignum_to_base64(dh->pub_key)); | 115 | oum.set_field("dh_server_public",util::bignum_to_base64(dh->pub_key)); |
119 | string b64; secret.enxor_to_base64(key_digest,b64); | 116 | string b64; secret.enxor_to_base64(key_digest,b64); |
120 | oum.set_field("enc_mac_key",b64); | 117 | oum.set_field("enc_mac_key",b64); |
121 | }else /* TODO: support cleartext over encrypted connection */ | 118 | }else /* TODO: support cleartext over encrypted connection */ |
@@ -129,20 +126,20 @@ namespace opkele { | |||
129 | oum.set_field("session_type","DH-SHA256"); | 126 | oum.set_field("session_type","DH-SHA256"); |
130 | oum.set_field("assoc_type","HMAC-SHA256"); | 127 | oum.set_field("assoc_type","HMAC-SHA256"); |
131 | return oum; | 128 | return oum; |
132 | } | 129 | } |
133 | 130 | ||
134 | void basic_OP::checkid_(const basic_openid_message& inm, | 131 | void basic_OP::checkid_(const basic_openid_message& inm, |
135 | extension_t *ext) { | 132 | extension_t *ext) { |
136 | reset_vars(); | 133 | reset_vars(); |
137 | string mode = inm.get_field("mode"); | 134 | string modestr = inm.get_field("mode"); |
138 | if(mode=="checkid_setup") | 135 | if(modestr=="checkid_setup") |
139 | mode = mode_checkid_setup; | 136 | mode = mode_checkid_setup; |
140 | else if(mode=="checkid_immediate") | 137 | else if(modestr=="checkid_immediate") |
141 | mode = mode_checkid_immediate; | 138 | mode = mode_checkid_immediate; |
142 | else | 139 | else |
143 | throw bad_input(OPKELE_CP_ "Invalid checkid_* mode"); | 140 | throw bad_input(OPKELE_CP_ "Invalid checkid_* mode"); |
144 | try { | 141 | try { |
145 | assoc = retrieve_assoc(invalidate_handle=inm.get_field("assoc_handle")); | 142 | assoc = retrieve_assoc(invalidate_handle=inm.get_field("assoc_handle")); |
146 | invalidate_handle.clear(); | 143 | invalidate_handle.clear(); |
147 | }catch(failed_lookup&) { } | 144 | }catch(failed_lookup&) { } |
148 | try { | 145 | try { |
@@ -233,24 +230,24 @@ namespace opkele { | |||
233 | basic_openid_message& basic_OP::cancel(basic_openid_message& om) { | 230 | basic_openid_message& basic_OP::cancel(basic_openid_message& om) { |
234 | assert(!return_to.empty()); | 231 | assert(!return_to.empty()); |
235 | om.set_field("ns",OIURI_OPENID20); | 232 | om.set_field("ns",OIURI_OPENID20); |
236 | om.set_field("mode","cancel"); | 233 | om.set_field("mode","cancel"); |
237 | return om; | 234 | return om; |
238 | } | 235 | } |
239 | 236 | ||
240 | basic_openid_message& basic_OP::error(basic_openid_message& om, | 237 | basic_openid_message& basic_OP::error(basic_openid_message& om, |
241 | const string& error,const string& contact, | 238 | const string& err,const string& contact, |
242 | const string& reference ) { | 239 | const string& reference ) { |
243 | assert(!return_to.empty()); | 240 | assert(!return_to.empty()); |
244 | om.set_field("ns",OIURI_OPENID20); | 241 | om.set_field("ns",OIURI_OPENID20); |
245 | om.set_field("mode","error"); | 242 | om.set_field("mode","error"); |
246 | om.set_field("error",error); | 243 | om.set_field("error",err); |
247 | om.set_field("contact",contact); | 244 | if(!contact.empty()) om.set_field("contact",contact); |
248 | om.set_field("reference",reference); | 245 | if(!reference.empty()) om.set_field("reference",reference); |
249 | return om; | 246 | return om; |
250 | } | 247 | } |
251 | 248 | ||
252 | basic_openid_message& basic_OP::setup_needed( | 249 | basic_openid_message& basic_OP::setup_needed( |
253 | basic_openid_message& oum,const basic_openid_message& inm) { | 250 | basic_openid_message& oum,const basic_openid_message& inm) { |
254 | assert(mode==mode_checkid_immediate); | 251 | assert(mode==mode_checkid_immediate); |
255 | assert(!return_to.empty()); | 252 | assert(!return_to.empty()); |
256 | if(openid2) { | 253 | if(openid2) { |