4 files changed, 4 insertions, 0 deletions

diff --git a/lib/basic_op.cc b/lib/basic_op.cc
index c247493..fa659ac 100644
--- a/lib/basic_op.cc
+++ b/lib/basic_op.cc
@@ -1,104 +1,105 @@
 #include <time.h>
 #include <cassert>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <opkele/data.h>
 #include <opkele/basic_op.h>
 #include <opkele/exception.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/uris.h>
 
 namespace opkele {
 
     void basic_OP::reset_vars() {
         assoc.reset();
         return_to.clear(); realm.clear();
         claimed_id.clear(); identity.clear();
         invalidate_handle.clear();
     }
 
     bool basic_OP::has_return_to() const {
         return !return_to.empty();
     }
     const string& basic_OP::get_return_to() const {
         if(return_to.empty())
             throw no_return_to(OPKELE_CP_ "No return_to URL provided with request");
         return return_to;
     }
 
     const string& basic_OP::get_realm() const {
         assert(!realm.empty());
         return realm;
     }
 
     bool basic_OP::has_identity() const {
         return !identity.empty();
     }
     const string& basic_OP::get_claimed_id() const {
         if(claimed_id.empty())
             throw non_identity(OPKELE_CP_ "attempting to retrieve claimed_id of non-identity related request");
         assert(!identity.empty());
         return claimed_id;
     }
     const string& basic_OP::get_identity() const {
         if(identity.empty())
             throw non_identity(OPKELE_CP_ "attempting to retrieve identity of non-identity related request");
         assert(!claimed_id.empty());
         return identity;
     }
 
     bool basic_OP::is_id_select() const {
         return identity==IDURI_SELECT20;
     }
 
     void basic_OP::select_identity(const string& c,const string& i) {
         claimed_id = c; identity = i;
     }
     void basic_OP::set_claimed_id(const string& c) {
         claimed_id = c;
     }
 
     basic_openid_message& basic_OP::associate(
             basic_openid_message& oum,
             const basic_openid_message& inm) try {
         assert(inm.get_field("mode")=="associate");
         util::dh_t dh;
         util::bignum_t c_pub;
         unsigned char key_digest[SHA256_DIGEST_LENGTH];
         size_t d_len = 0;
         string sts = inm.get_field("session_type");
         string ats = inm.get_field("assoc_type");
         if(sts=="DH-SHA1" || sts=="DH-SHA256") {
             if(!(dh = DH_new()))
                 throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
             c_pub = util::base64_to_bignum(inm.get_field("dh_consumer_public"));
             try { dh->p = util::base64_to_bignum(inm.get_field("dh_modulus"));
             }catch(failed_lookup&) {
                 dh->p = util::dec_to_bignum(data::_default_p); }
             try { dh->g = util::base64_to_bignum(inm.get_field("dh_gen"));
             }catch(failed_lookup&) {
                 dh->g = util::dec_to_bignum(data::_default_g); }
             if(!DH_generate_key(dh))
                 throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
             vector<unsigned char> ck(DH_size(dh)+1);
             unsigned char *ckptr = &(ck.front())+1;
             int cklen = DH_compute_key(ckptr,c_pub,dh);
             if(cklen<0)
                 throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
             if(cklen && (*ckptr)&0x80) {
                 (*(--ckptr)) = 0; ++cklen; }
             if(sts=="DH-SHA1") {
                 SHA1(ckptr,cklen,key_digest); d_len = SHA_DIGEST_LENGTH;
             }else if(sts=="DH-SHA256") {
                 SHA256(ckptr,cklen,key_digest); d_len = SHA256_DIGEST_LENGTH;
             }else
                 throw internal_error(OPKELE_CP_ "I thought I knew the session type");
         }else
             throw unsupported(OPKELE_CP_ "Unsupported session_type");
         assoc_t a;
         if(ats=="HMAC-SHA1")
             a = alloc_assoc(ats,SHA_DIGEST_LENGTH,false);
         else if(ats=="HMAC-SHA256")
             a = alloc_assoc(ats,SHA256_DIGEST_LENGTH,false);
         else
             throw unsupported(OPKELE_CP_ "Unsupported assoc_type");
diff --git a/lib/basic_rp.cc b/lib/basic_rp.cc
index a0ad130..e65d9fb 100644
--- a/lib/basic_rp.cc
+++ b/lib/basic_rp.cc
@@ -1,104 +1,105 @@
 #include <cassert>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <opkele/basic_rp.h>
 #include <opkele/exception.h>
 #include <opkele/uris.h>
 #include <opkele/data.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/curl.h>
 
 namespace opkele {
 
     static void dh_get_secret(
             secret_t& secret, const basic_openid_message& om,
             const char *exp_assoc, const char *exp_sess,
             util::dh_t& dh,
             size_t d_len, unsigned char *(*d_fun)(const unsigned char*,size_t,unsigned char*),
             size_t exp_s_len) try {
         if(om.get_field("assoc_type")!=exp_assoc || om.get_field("session_type")!=exp_sess)
             throw bad_input(OPKELE_CP_ "Unexpected associate response");
         util::bignum_t s_pub = util::base64_to_bignum(om.get_field("dh_server_public"));
         vector<unsigned char> ck(DH_size(dh)+1);
         unsigned char *ckptr = &(ck.front())+1;
         int cklen = DH_compute_key(ckptr,s_pub,dh);
         if(cklen<0)
             throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
         if(cklen && (*ckptr)&0x80) {
             (*(--ckptr))=0; ++cklen; }
         assert(d_len<=SHA256_DIGEST_LENGTH);
         unsigned char key_digest[SHA256_DIGEST_LENGTH];
         secret.enxor_from_base64((*d_fun)(ckptr,cklen,key_digest),om.get_field("enc_mac_key"));
         if(secret.size()!=exp_s_len)
             throw bad_input(OPKELE_CP_ "Secret length isn't consistent with association type");
     }catch(opkele::failed_lookup& ofl) {
         throw bad_input(OPKELE_CP_ "Incoherent response from OP");
     } OPKELE_RETHROW
 
     static void direct_request(basic_openid_message& oum,const basic_openid_message& inm,const string& OP) {
         util::curl_pick_t curl = util::curl_pick_t::easy_init();
         if(!curl)
             throw exception_curl(OPKELE_CP_ "failed to initialize curl");
         string request = inm.query_string();
         CURLcode r;
         (r=curl.misc_sets())
             || (r=curl.easy_setopt(CURLOPT_URL,OP.c_str()))
             || (r=curl.easy_setopt(CURLOPT_POST,1))
             || (r=curl.easy_setopt(CURLOPT_POSTFIELDS,request.data()))
             || (r=curl.easy_setopt(CURLOPT_POSTFIELDSIZE,request.length()))
             || (r=curl.set_write());
         if(r)
             throw exception_curl(OPKELE_CP_ "failed to set curly options",r);
         if( (r=curl.easy_perform()) )
             throw exception_curl(OPKELE_CP_ "failed to perform curly request",r);
         oum.from_keyvalues(curl.response);
     }
 
 
     assoc_t basic_RP::associate(const string& OP) {
         util::dh_t dh = DH_new();
         if(!dh)
             throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
         dh->p = util::dec_to_bignum(data::_default_p);
         dh->g = util::dec_to_bignum(data::_default_g);
         if(!DH_generate_key(dh))
             throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
         openid_message_t req;
         req.set_field("ns",OIURI_OPENID20);
         req.set_field("mode","associate");
         req.set_field("dh_modulus",util::bignum_to_base64(dh->p));
         req.set_field("dh_gen",util::bignum_to_base64(dh->g));
         req.set_field("dh_consumer_public",util::bignum_to_base64(dh->pub_key));
         openid_message_t res;
         req.set_field("assoc_type","HMAC-SHA256");
         req.set_field("session_type","DH-SHA256");
         secret_t secret;
         int expires_in;
         try {
             direct_request(res,req,OP);
             dh_get_secret( secret, res,
                     "HMAC-SHA256", "DH-SHA256",
                     dh, SHA256_DIGEST_LENGTH, SHA256, SHA256_DIGEST_LENGTH );
             expires_in = util::string_to_long(res.get_field("expires_in"));
         }catch(exception&) {
             try {
                 req.set_field("assoc_type","HMAC-SHA1");
                 req.set_field("session_type","DH-SHA1");
                 direct_request(res,req,OP);
                 dh_get_secret( secret, res,
                         "HMAC-SHA1", "DH-SHA1",
                         dh, SHA_DIGEST_LENGTH, SHA1, SHA_DIGEST_LENGTH );
                 expires_in = util::string_to_long(res.get_field("expires_in"));
             }catch(bad_input&) {
                 throw dumb_RP(OPKELE_CP_ "OP failed to supply an association");
             }
         }
         return store_assoc(
                 OP, res.get_field("assoc_handle"),
                 res.get_field("assoc_type"), secret,
                 expires_in );
     }
 
     basic_openid_message& basic_RP::checkid_(
             basic_openid_message& rv,
             mode_t mode,
diff --git a/lib/consumer.cc b/lib/consumer.cc
index ebda262..801496e 100644
--- a/lib/consumer.cc
+++ b/lib/consumer.cc
@@ -1,100 +1,101 @@
 #include <algorithm>
 #include <cassert>
 #include <cstring>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/curl.h>
 #include <opkele/exception.h>
 #include <opkele/data.h>
 #include <opkele/consumer.h>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <iostream>
 
 #include "config.h"
 
 #include <pcre.h>
 
 namespace opkele {
     using namespace std;
     using util::curl_t;
     using util::curl_pick_t;
 
     class pcre_matches_t {
         public:
             int *_ov;
             int _s;
 
             pcre_matches_t() : _ov(0), _s(0) { }
             pcre_matches_t(int s) : _ov(0), _s(s) {
                 if(_s&1) ++_s;
                 _s += _s>>1;
                 _ov = new int[_s];
             }
             ~pcre_matches_t() throw() { if(_ov) delete[] _ov; }
 
             int begin(int i) const { return _ov[i<<1]; }
             int end(int i) const { return _ov[(i<<1)+1]; }
             int length(int i) const { int t=i<<1; return _ov[t+1]-_ov[t]; }
     };
 
     class pcre_t {
         public:
             pcre *_p;
 
             pcre_t() : _p(0) { }
             pcre_t(pcre *p) : _p(p) { }
             pcre_t(const char *re,int opts) : _p(0) {
                 static const char *errptr; static int erroffset;
                 _p = pcre_compile(re,opts,&errptr,&erroffset,NULL);
                 if(!_p)
                     throw internal_error(OPKELE_CP_ string("Failed to compile regexp: ")+errptr);
             }
             ~pcre_t() throw() { if(_p) (*pcre_free)(_p); }
 
             pcre_t& operator=(pcre *p) { if(_p) (*pcre_free)(_p); _p=p; return *this; }
 
             operator const pcre*(void) const { return _p; }
             operator pcre*(void) { return _p; }
 
             int exec(const string& s,pcre_matches_t& m) {
                 if(!_p)
                     throw internal_error(OPKELE_CP_ "Trying to execute absent regexp");
                 return pcre_exec(_p,NULL,s.c_str(),s.length(),0,0,m._ov,m._s);
             }
     };
 
     assoc_t consumer_t::associate(const string& server) {
         util::dh_t dh = DH_new();
         if(!dh)
             throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
         dh->p = util::dec_to_bignum(data::_default_p);
         dh->g = util::dec_to_bignum(data::_default_g);
         if(!DH_generate_key(dh))
             throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
         string request = 
             "openid.mode=associate"
             "&openid.assoc_type=HMAC-SHA1"
             "&openid.session_type=DH-SHA1"
             "&openid.dh_consumer_public=";
         request += util::url_encode(util::bignum_to_base64(dh->pub_key));
         curl_pick_t curl = curl_pick_t::easy_init();
         if(!curl)
             throw exception_curl(OPKELE_CP_ "failed to initialize curl");
         CURLcode r;
         (r=curl.misc_sets())
         || (r=curl.easy_setopt(CURLOPT_URL,server.c_str()))
         || (r=curl.easy_setopt(CURLOPT_POST,1))
         || (r=curl.easy_setopt(CURLOPT_POSTFIELDS,request.data()))
         || (r=curl.easy_setopt(CURLOPT_POSTFIELDSIZE,request.length()))
         || (r=curl.set_write())
         ;
         if(r)
             throw exception_curl(OPKELE_CP_ "failed to set curly options",r);
         if( (r=curl.easy_perform()) )
             throw exception_curl(OPKELE_CP_ "failed to perform curly request",r);
         params_t p; p.parse_keyvalues(curl.response);
         if(p.has_param("assoc_type") && p.get_param("assoc_type")!="HMAC-SHA1")
             throw bad_input(OPKELE_CP_ "unsupported assoc_type");
         string st;
         if(p.has_param("session_type")) st = p.get_param("session_type");
         if((!st.empty()) && st!="DH-SHA1")
diff --git a/lib/server.cc b/lib/server.cc
index 776f1ae..0dea1eb 100644
--- a/lib/server.cc
+++ b/lib/server.cc
@@ -1,101 +1,102 @@
 #include <cstring>
 #include <vector>
 #include <openssl/sha.h>
 #include <openssl/hmac.h>
 #include <opkele/util.h>
+#include <opkele/util-internal.h>
 #include <opkele/exception.h>
 #include <opkele/server.h>
 #include <opkele/data.h>
 
 namespace opkele {
     using namespace std;
 
     void server_t::associate(const params_t& pin,params_t& pout) {
         util::dh_t dh;
         util::bignum_t c_pub;
         unsigned char key_sha1[SHA_DIGEST_LENGTH];
         enum {
             sess_cleartext,
             sess_dh_sha1
         } st = sess_cleartext;
         if(
                 pin.has_param("openid.session_type")
                 && pin.get_param("openid.session_type")=="DH-SHA1" ) {
             /* TODO: fallback to cleartext in case of exceptions here? */
             if(!(dh = DH_new()))
                 throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
             c_pub = util::base64_to_bignum(pin.get_param("openid.dh_consumer_public"));
             if(pin.has_param("openid.dh_modulus"))
                 dh->p = util::base64_to_bignum(pin.get_param("openid.dh_modulus"));
             else
                 dh->p = util::dec_to_bignum(data::_default_p);
             if(pin.has_param("openid.dh_gen"))
                 dh->g = util::base64_to_bignum(pin.get_param("openid.dh_gen"));
             else
                 dh->g = util::dec_to_bignum(data::_default_g);
             if(!DH_generate_key(dh))
                 throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
             vector<unsigned char> ck(DH_size(dh)+1);
             unsigned char *ckptr = &(ck.front())+1;
             int cklen = DH_compute_key(ckptr,c_pub,dh);
             if(cklen<0)
                 throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
             if(cklen && (*ckptr)&0x80) {
                 (*(--ckptr)) = 0; ++cklen;
             }
             SHA1(ckptr,cklen,key_sha1);
             st = sess_dh_sha1;
         }
         assoc_t assoc = alloc_assoc(mode_associate);
         time_t now = time(0);
         pout.clear();
         pout["assoc_type"] = assoc->assoc_type();
         pout["assoc_handle"] = assoc->handle();
         /* TODO: eventually remove deprecated stuff */
         pout["issued"] = util::time_to_w3c(now);
         pout["expiry"] = util::time_to_w3c(now+assoc->expires_in());
         pout["expires_in"] = util::long_to_string(assoc->expires_in());
         secret_t secret = assoc->secret();
         switch(st) {
             case sess_dh_sha1:
                 pout["session_type"] = "DH-SHA1";
                 pout["dh_server_public"] = util::bignum_to_base64(dh->pub_key);
                 secret.enxor_to_base64(key_sha1,pout["enc_mac_key"]);
                 break;
             default:
                 secret.to_base64(pout["mac_key"]);
                 break;
         }
     }
 
     void server_t::checkid_immediate(const params_t& pin,string& return_to,params_t& pout,extension_t *ext) {
         checkid_(mode_checkid_immediate,pin,return_to,pout,ext);
     }
 
     void server_t::checkid_setup(const params_t& pin,string& return_to,params_t& pout,extension_t *ext) {
         checkid_(mode_checkid_setup,pin,return_to,pout,ext);
     }
 
     void server_t::checkid_(mode_t mode,const params_t& pin,string& return_to,params_t& pout,extension_t *ext) {
         if(mode!=mode_checkid_immediate && mode!=mode_checkid_setup)
             throw bad_input(OPKELE_CP_ "invalid checkid_* mode");
         pout.clear();
         assoc_t assoc;
         try {
             assoc = retrieve_assoc(pin.get_param("openid.assoc_handle"));
         }catch(failed_lookup& fl) {
             // no handle specified or no valid handle found, going dumb
             assoc = alloc_assoc(mode_checkid_setup);
             if(pin.has_param("openid.assoc_handle"))
                 pout["invalidate_handle"]=pin.get_param("openid.assoc_handle");
         }
         string trust_root;
         try {
             trust_root = pin.get_param("openid.trust_root");
         }catch(failed_lookup& fl) { }
         string identity = pin.get_param("openid.identity");
         return_to = pin.get_param("openid.return_to");
         validate(*assoc,pin,identity,trust_root);
         pout["mode"] = "id_res";
         pout["assoc_handle"] = assoc->handle();
         if(pin.has_param("openid.assoc_handle") && assoc->stateless())