-rw-r--r-- | lib/consumer.cc | 40 |
1 files changed, 31 insertions, 9 deletions
diff --git a/lib/consumer.cc b/lib/consumer.cc index 7f31d52..f72ae08 100644 --- a/lib/consumer.cc +++ b/lib/consumer.cc | |||
@@ -232,186 +232,208 @@ namespace opkele { | |||
232 | unsigned char *md = HMAC( | 232 | unsigned char *md = HMAC( |
233 | EVP_sha1(), | 233 | EVP_sha1(), |
234 | &(secret.front()),secret.size(), | 234 | &(secret.front()),secret.size(), |
235 | (const unsigned char *)kv.data(),kv.length(), | 235 | (const unsigned char *)kv.data(),kv.length(), |
236 | 0,&md_len); | 236 | 0,&md_len); |
237 | if(sig.size()!=md_len || memcmp(&(sig.front()),md,md_len)) | 237 | if(sig.size()!=md_len || memcmp(&(sig.front()),md,md_len)) |
238 | throw id_res_mismatch(OPKELE_CP_ "signature mismatch"); | 238 | throw id_res_mismatch(OPKELE_CP_ "signature mismatch"); |
239 | }catch(failed_lookup& e) { /* XXX: more specific? */ | 239 | }catch(failed_lookup& e) { /* XXX: more specific? */ |
240 | const string& slist = pin.get_param("openid.signed"); | 240 | const string& slist = pin.get_param("openid.signed"); |
241 | string::size_type pp = 0; | 241 | string::size_type pp = 0; |
242 | params_t p; | 242 | params_t p; |
243 | while(true) { | 243 | while(true) { |
244 | string::size_type co = slist.find(',',pp); | 244 | string::size_type co = slist.find(',',pp); |
245 | string f = "openid."; | 245 | string f = "openid."; |
246 | f += (co==string::npos)?slist.substr(pp):slist.substr(pp,co-pp); | 246 | f += (co==string::npos)?slist.substr(pp):slist.substr(pp,co-pp); |
247 | p[f] = pin.get_param(f); | 247 | p[f] = pin.get_param(f); |
248 | if(co==string::npos) | 248 | if(co==string::npos) |
249 | break; | 249 | break; |
250 | pp = co+1; | 250 | pp = co+1; |
251 | } | 251 | } |
252 | p["openid.assoc_handle"] = pin.get_param("openid.assoc_handle"); | 252 | p["openid.assoc_handle"] = pin.get_param("openid.assoc_handle"); |
253 | p["openid.sig"] = pin.get_param("openid.sig"); | 253 | p["openid.sig"] = pin.get_param("openid.sig"); |
254 | p["openid.signed"] = pin.get_param("openid.signed"); | 254 | p["openid.signed"] = pin.get_param("openid.signed"); |
255 | try { | 255 | try { |
256 | string ih = pin.get_param("openid.invalidate_handle"); | 256 | string ih = pin.get_param("openid.invalidate_handle"); |
257 | p["openid.invalidate_handle"] = ih; | 257 | p["openid.invalidate_handle"] = ih; |
258 | }catch(failed_lookup& fl) { } | 258 | }catch(failed_lookup& fl) { } |
259 | try { | 259 | try { |
260 | check_authentication(server,p); | 260 | check_authentication(server,p); |
261 | }catch(failed_check_authentication& fca) { | 261 | }catch(failed_check_authentication& fca) { |
262 | throw id_res_failed(OPKELE_CP_ "failed to check_authentication()"); | 262 | throw id_res_failed(OPKELE_CP_ "failed to check_authentication()"); |
263 | } | 263 | } |
264 | } | 264 | } |
265 | if(ext) ext->id_res_hook(pin,ps,identity); | 265 | if(ext) ext->id_res_hook(pin,ps,identity); |
266 | } | 266 | } |
267 | 267 | ||
268 | void consumer_t::check_authentication(const string& server,const params_t& p) { | 268 | void consumer_t::check_authentication(const string& server,const params_t& p) { |
269 | string request = "openid.mode=check_authentication"; | 269 | string request = "openid.mode=check_authentication"; |
270 | for(params_t::const_iterator i=p.begin();i!=p.end();++i) { | 270 | for(params_t::const_iterator i=p.begin();i!=p.end();++i) { |
271 | if(i->first!="openid.mode") { | 271 | if(i->first!="openid.mode") { |
272 | request += '&'; | 272 | request += '&'; |
273 | request += i->first; | 273 | request += i->first; |
274 | request += '='; | 274 | request += '='; |
275 | request += util::url_encode(i->second); | 275 | request += util::url_encode(i->second); |
276 | } | 276 | } |
277 | } | 277 | } |
278 | curl_t curl = curl_easy_init(); | 278 | curl_t curl = curl_easy_init(); |
279 | if(!curl) | 279 | if(!curl) |
280 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); | 280 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); |
281 | string response; | 281 | string response; |
282 | CURLcode r; | 282 | CURLcode r; |
283 | (r=curl_misc_sets(curl)) | 283 | (r=curl_misc_sets(curl)) |
284 | || (r=curl_easy_setopt(curl,CURLOPT_URL,server.c_str())) | 284 | || (r=curl_easy_setopt(curl,CURLOPT_URL,server.c_str())) |
285 | || (r=curl_easy_setopt(curl,CURLOPT_POST,1)) | 285 | || (r=curl_easy_setopt(curl,CURLOPT_POST,1)) |
286 | || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDS,request.data())) | 286 | || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDS,request.data())) |
287 | || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDSIZE,request.length())) | 287 | || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDSIZE,request.length())) |
288 | || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring)) | 288 | || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring)) |
289 | || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&response)) | 289 | || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&response)) |
290 | ; | 290 | ; |
291 | if(r) | 291 | if(r) |
292 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); | 292 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); |
293 | if(r=curl_easy_perform(curl)) | 293 | if(r=curl_easy_perform(curl)) |
294 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); | 294 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); |
295 | params_t pp; pp.parse_keyvalues(response); | 295 | params_t pp; pp.parse_keyvalues(response); |
296 | if(pp.has_param("invalidate_handle")) | 296 | if(pp.has_param("invalidate_handle")) |
297 | invalidate_assoc(server,pp.get_param("invalidate_handle")); | 297 | invalidate_assoc(server,pp.get_param("invalidate_handle")); |
298 | if(pp.has_param("is_valid")) { | 298 | if(pp.has_param("is_valid")) { |
299 | if(pp.get_param("is_valid")=="true") | 299 | if(pp.get_param("is_valid")=="true") |
300 | return; | 300 | return; |
301 | }else if(pp.has_param("lifetime")) { | 301 | }else if(pp.has_param("lifetime")) { |
302 | if(util::string_to_long(pp.get_param("lifetime"))) | 302 | if(util::string_to_long(pp.get_param("lifetime"))) |
303 | return; | 303 | return; |
304 | } | 304 | } |
305 | throw failed_check_authentication(OPKELE_CP_ "failed to verify response"); | 305 | throw failed_check_authentication(OPKELE_CP_ "failed to verify response"); |
306 | } | 306 | } |
307 | 307 | ||
308 | void consumer_t::retrieve_links(const string& url,string& server,string& delegate) { | 308 | void consumer_t::retrieve_links(const string& url,string& server,string& delegate) { |
309 | server.erase(); | 309 | server.erase(); |
310 | delegate.erase(); | 310 | delegate.erase(); |
311 | curl_t curl = curl_easy_init(); | 311 | curl_t curl = curl_easy_init(); |
312 | if(!curl) | 312 | if(!curl) |
313 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); | 313 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); |
314 | string html; | 314 | string html; |
315 | CURLcode r; | 315 | CURLcode r; |
316 | (r=curl_misc_sets(curl)) | 316 | (r=curl_misc_sets(curl)) |
317 | || (r=curl_easy_setopt(curl,CURLOPT_URL,url.c_str())) | 317 | || (r=curl_easy_setopt(curl,CURLOPT_URL,url.c_str())) |
318 | || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring)) | 318 | || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring)) |
319 | || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&html)) | 319 | || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&html)) |
320 | ; | 320 | ; |
321 | if(r) | 321 | if(r) |
322 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); | 322 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); |
323 | r = curl_easy_perform(curl); | 323 | r = curl_easy_perform(curl); |
324 | if(r && r!=CURLE_WRITE_ERROR) | 324 | if(r && r!=CURLE_WRITE_ERROR) |
325 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); | 325 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); |
326 | static const char *re_bre = "<\\s*body\\b", *re_hdre = "<\\s*head[^>]*>", | 326 | static const char *re_bre = "<\\s*body\\b", *re_hdre = "<\\s*head[^>]*>", |
327 | *re_lre = "<\\s*link\\b([^>]+)>", | 327 | *re_lre = "<\\s*link\\b([^>]+)>", |
328 | *re_rre = "\\brel\\s*=\\s*['\"]\\s*([^'\"\\s]+)\\s*['\"]", | 328 | *re_rre = "\\brel\\s*=\\s*['\"]([^'\"]+)['\"]", |
329 | *re_hre = "\\bhref\\s*=\\s*['\"]\\s*([^'\"\\s]+)\\s*['\"]"; | 329 | *re_hre = "\\bhref\\s*=\\s*['\"]\\s*([^'\"\\s]+)\\s*['\"]"; |
330 | pcre_matches_t m1(3), m2(3); | 330 | pcre_matches_t m1(3), m2(3); |
331 | pcre_t bre(re_bre,PCRE_CASELESS); | 331 | pcre_t bre(re_bre,PCRE_CASELESS); |
332 | if(bre.exec(html,m1)>0) | 332 | if(bre.exec(html,m1)>0) |
333 | html.erase(m1.begin(0)); | 333 | html.erase(m1.begin(0)); |
334 | pcre_t hdre(re_hdre,PCRE_CASELESS); | 334 | pcre_t hdre(re_hdre,PCRE_CASELESS); |
335 | if(hdre.exec(html,m1)<=0) | 335 | if(hdre.exec(html,m1)<=0) |
336 | throw bad_input(OPKELE_CP_ "failed to find <head>"); | 336 | throw bad_input(OPKELE_CP_ "failed to find <head>"); |
337 | html.erase(0,m1.end(0)+1); | 337 | html.erase(0,m1.end(0)+1); |
338 | pcre_t lre(re_lre,PCRE_CASELESS), rre(re_rre,PCRE_CASELESS), hre(re_hre,PCRE_CASELESS); | 338 | pcre_t lre(re_lre,PCRE_CASELESS), rre(re_rre,PCRE_CASELESS), hre(re_hre,PCRE_CASELESS); |
339 | while(lre.exec(html,m1)>=2) { | 339 | bool gotit = false; |
340 | while( (!gotit) && lre.exec(html,m1)>=2 ) { | ||
341 | static const char *whitespace = " \t"; | ||
340 | string attrs(html,m1.begin(1),m1.length(1)); | 342 | string attrs(html,m1.begin(1),m1.length(1)); |
341 | html.erase(0,m1.end(0)+1); | 343 | html.erase(0,m1.end(0)+1); |
342 | if(!( rre.exec(attrs,m1)>=2 && hre.exec(attrs,m2)>=2 )) | 344 | if(!( rre.exec(attrs,m1)>=2 && hre.exec(attrs,m2)>=2 )) |
343 | continue; | 345 | continue; |
344 | string rel(attrs,m1.begin(1),m1.length(1)); | 346 | string rels(attrs,m1.begin(1),m1.length(1)); |
345 | if(rel=="openid.server") { | 347 | for(string::size_type ns = rels.find_first_not_of(whitespace); |
346 | server.assign(attrs,m2.begin(1),m2.length(1)); | 348 | ns!=string::npos; |
347 | if(!delegate.empty()) break; | 349 | ns=rels.find_first_not_of(whitespace,ns)) { |
348 | }else if(rel=="openid.delegate") { | 350 | string::size_type s = rels.find_first_of(whitespace,ns); |
349 | delegate.assign(attrs,m2.begin(1),m2.length(1)); | 351 | string rel; |
350 | if(!server.empty()) break; | 352 | if(s==string::npos) { |
353 | rel.assign(rels,ns,string::npos); | ||
354 | ns=string::npos; | ||
355 | }else{ | ||
356 | rel.assign(rels,ns,s-ns); | ||
357 | ns=s; | ||
358 | } | ||
359 | if(rel=="openid.server") { | ||
360 | server.assign(attrs,m2.begin(1),m2.length(1)); | ||
361 | if(!delegate.empty()) { | ||
362 | gotit = true; | ||
363 | break; | ||
364 | } | ||
365 | }else if(rel=="openid.delegate") { | ||
366 | delegate.assign(attrs,m2.begin(1),m2.length(1)); | ||
367 | if(!server.empty()) { | ||
368 | gotit = true; | ||
369 | break; | ||
370 | } | ||
371 | } | ||
372 | if(ns==string::npos) break; | ||
351 | } | 373 | } |
352 | } | 374 | } |
353 | if(server.empty()) | 375 | if(server.empty()) |
354 | throw failed_assertion(OPKELE_CP_ "The location has no openid.server declaration"); | 376 | throw failed_assertion(OPKELE_CP_ "The location has no openid.server declaration"); |
355 | } | 377 | } |
356 | 378 | ||
357 | assoc_t consumer_t::find_assoc(const string& server) { | 379 | assoc_t consumer_t::find_assoc(const string& server) { |
358 | throw failed_lookup(OPKELE_CP_ "no find_assoc() provided"); | 380 | throw failed_lookup(OPKELE_CP_ "no find_assoc() provided"); |
359 | } | 381 | } |
360 | 382 | ||
361 | string consumer_t::normalize(const string& url) { | 383 | string consumer_t::normalize(const string& url) { |
362 | string rv = url; | 384 | string rv = url; |
363 | // strip leading and trailing spaces | 385 | // strip leading and trailing spaces |
364 | string::size_type i = rv.find_first_not_of(" \t\r\n"); | 386 | string::size_type i = rv.find_first_not_of(" \t\r\n"); |
365 | if(i==string::npos) | 387 | if(i==string::npos) |
366 | throw bad_input(OPKELE_CP_ "empty URL"); | 388 | throw bad_input(OPKELE_CP_ "empty URL"); |
367 | if(i) | 389 | if(i) |
368 | rv.erase(0,i); | 390 | rv.erase(0,i); |
369 | i = rv.find_last_not_of(" \t\r\n"); | 391 | i = rv.find_last_not_of(" \t\r\n"); |
370 | assert(i!=string::npos); | 392 | assert(i!=string::npos); |
371 | if(i<(rv.length()-1)) | 393 | if(i<(rv.length()-1)) |
372 | rv.erase(i+1); | 394 | rv.erase(i+1); |
373 | // add missing http:// | 395 | // add missing http:// |
374 | i = rv.find("://"); | 396 | i = rv.find("://"); |
375 | if(i==string::npos) { // primitive. but do we need more? | 397 | if(i==string::npos) { // primitive. but do we need more? |
376 | rv.insert(0,"http://"); | 398 | rv.insert(0,"http://"); |
377 | i = sizeof("http://")-1; | 399 | i = sizeof("http://")-1; |
378 | }else{ | 400 | }else{ |
379 | i += sizeof("://")-1; | 401 | i += sizeof("://")-1; |
380 | } | 402 | } |
381 | string::size_type qm = rv.find('?',i); | 403 | string::size_type qm = rv.find('?',i); |
382 | string::size_type sl = rv.find('/',i); | 404 | string::size_type sl = rv.find('/',i); |
383 | if(qm!=string::npos) { | 405 | if(qm!=string::npos) { |
384 | if(sl==string::npos || sl>qm) | 406 | if(sl==string::npos || sl>qm) |
385 | rv.insert(qm,1,'/'); | 407 | rv.insert(qm,1,'/'); |
386 | }else{ | 408 | }else{ |
387 | if(sl==string::npos) | 409 | if(sl==string::npos) |
388 | rv += '/'; | 410 | rv += '/'; |
389 | } | 411 | } |
390 | return rv; | 412 | return rv; |
391 | } | 413 | } |
392 | 414 | ||
393 | string consumer_t::canonicalize(const string& url) { | 415 | string consumer_t::canonicalize(const string& url) { |
394 | string rv = normalize(url); | 416 | string rv = normalize(url); |
395 | curl_t curl = curl_easy_init(); | 417 | curl_t curl = curl_easy_init(); |
396 | if(!curl) | 418 | if(!curl) |
397 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); | 419 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); |
398 | string html; | 420 | string html; |
399 | CURLcode r; | 421 | CURLcode r; |
400 | (r=curl_misc_sets(curl)) | 422 | (r=curl_misc_sets(curl)) |
401 | || (r=curl_easy_setopt(curl,CURLOPT_URL,rv.c_str())) | 423 | || (r=curl_easy_setopt(curl,CURLOPT_URL,rv.c_str())) |
402 | || (r=curl_easy_setopt(curl,CURLOPT_NOBODY,1)) | 424 | || (r=curl_easy_setopt(curl,CURLOPT_NOBODY,1)) |
403 | ; | 425 | ; |
404 | if(r) | 426 | if(r) |
405 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); | 427 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); |
406 | r = curl_easy_perform(curl); | 428 | r = curl_easy_perform(curl); |
407 | if(r) | 429 | if(r) |
408 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); | 430 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); |
409 | const char *eu = 0; | 431 | const char *eu = 0; |
410 | r = curl_easy_getinfo(curl,CURLINFO_EFFECTIVE_URL,&eu); | 432 | r = curl_easy_getinfo(curl,CURLINFO_EFFECTIVE_URL,&eu); |
411 | if(r) | 433 | if(r) |
412 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_getinfo(..CURLINFO_EFFECTIVE_URL..)",r); | 434 | throw exception_curl(OPKELE_CP_ "failed to curl_easy_getinfo(..CURLINFO_EFFECTIVE_URL..)",r); |
413 | rv = eu; | 435 | rv = eu; |
414 | return normalize(rv); | 436 | return normalize(rv); |
415 | } | 437 | } |
416 | 438 | ||
417 | } | 439 | } |