summaryrefslogtreecommitdiffabout
path: root/lib/consumer.cc
Unidiff
Diffstat (limited to 'lib/consumer.cc') (more/less context) (ignore whitespace changes)
-rw-r--r--lib/consumer.cc2
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/consumer.cc b/lib/consumer.cc
index f72ae08..76b6ea7 100644
--- a/lib/consumer.cc
+++ b/lib/consumer.cc
@@ -1,180 +1,180 @@
1#include <algorithm> 1#include <algorithm>
2#include <cassert> 2#include <cassert>
3#include <opkele/util.h> 3#include <opkele/util.h>
4#include <opkele/exception.h> 4#include <opkele/exception.h>
5#include <opkele/data.h> 5#include <opkele/data.h>
6#include <opkele/consumer.h> 6#include <opkele/consumer.h>
7#include <openssl/sha.h> 7#include <openssl/sha.h>
8#include <openssl/hmac.h> 8#include <openssl/hmac.h>
9#include <curl/curl.h> 9#include <curl/curl.h>
10 10
11#include <iostream> 11#include <iostream>
12 12
13#include "config.h" 13#include "config.h"
14 14
15#include <pcre.h> 15#include <pcre.h>
16 16
17namespace opkele { 17namespace opkele {
18 using namespace std; 18 using namespace std;
19 19
20 class pcre_matches_t { 20 class pcre_matches_t {
21 public: 21 public:
22 int *_ov; 22 int *_ov;
23 int _s; 23 int _s;
24 24
25 pcre_matches_t() : _ov(0), _s(0) { } 25 pcre_matches_t() : _ov(0), _s(0) { }
26 pcre_matches_t(int s) : _ov(0), _s(s) { 26 pcre_matches_t(int s) : _ov(0), _s(s) {
27 if(_s&1) ++_s; 27 if(_s&1) ++_s;
28 _s += _s>>1; 28 _s += _s>>1;
29 _ov = new int[_s]; 29 _ov = new int[_s];
30 } 30 }
31 ~pcre_matches_t() throw() { if(_ov) delete[] _ov; } 31 ~pcre_matches_t() throw() { if(_ov) delete[] _ov; }
32 32
33 int begin(int i) const { return _ov[i<<1]; } 33 int begin(int i) const { return _ov[i<<1]; }
34 int end(int i) const { return _ov[(i<<1)+1]; } 34 int end(int i) const { return _ov[(i<<1)+1]; }
35 int length(int i) const { int t=i<<1; return _ov[t+1]-_ov[t]; } 35 int length(int i) const { int t=i<<1; return _ov[t+1]-_ov[t]; }
36 }; 36 };
37 37
38 class pcre_t { 38 class pcre_t {
39 public: 39 public:
40 pcre *_p; 40 pcre *_p;
41 41
42 pcre_t() : _p(0) { } 42 pcre_t() : _p(0) { }
43 pcre_t(pcre *p) : _p(p) { } 43 pcre_t(pcre *p) : _p(p) { }
44 pcre_t(const char *re,int opts) : _p(0) { 44 pcre_t(const char *re,int opts) : _p(0) {
45 static const char *errptr; static int erroffset; 45 static const char *errptr; static int erroffset;
46 _p = pcre_compile(re,opts,&errptr,&erroffset,NULL); 46 _p = pcre_compile(re,opts,&errptr,&erroffset,NULL);
47 if(!_p) 47 if(!_p)
48 throw internal_error(OPKELE_CP_ string("Failed to compile regexp: ")+errptr); 48 throw internal_error(OPKELE_CP_ string("Failed to compile regexp: ")+errptr);
49 } 49 }
50 ~pcre_t() throw() { if(_p) (*pcre_free)(_p); } 50 ~pcre_t() throw() { if(_p) (*pcre_free)(_p); }
51 51
52 pcre_t& operator=(pcre *p) { if(_p) (*pcre_free)(_p); _p=p; return *this; } 52 pcre_t& operator=(pcre *p) { if(_p) (*pcre_free)(_p); _p=p; return *this; }
53 53
54 operator const pcre*(void) const { return _p; } 54 operator const pcre*(void) const { return _p; }
55 operator pcre*(void) { return _p; } 55 operator pcre*(void) { return _p; }
56 56
57 int exec(const string& s,pcre_matches_t& m) { 57 int exec(const string& s,pcre_matches_t& m) {
58 if(!_p) 58 if(!_p)
59 throw internal_error(OPKELE_CP_ "Trying to execute absent regexp"); 59 throw internal_error(OPKELE_CP_ "Trying to execute absent regexp");
60 return pcre_exec(_p,NULL,s.c_str(),s.length(),0,0,m._ov,m._s); 60 return pcre_exec(_p,NULL,s.c_str(),s.length(),0,0,m._ov,m._s);
61 } 61 }
62 }; 62 };
63 63
64 class curl_t { 64 class curl_t {
65 public: 65 public:
66 CURL *_c; 66 CURL *_c;
67 67
68 curl_t() : _c(0) { } 68 curl_t() : _c(0) { }
69 curl_t(CURL *c) : _c(c) { } 69 curl_t(CURL *c) : _c(c) { }
70 ~curl_t() throw() { if(_c) curl_easy_cleanup(_c); } 70 ~curl_t() throw() { if(_c) curl_easy_cleanup(_c); }
71 71
72 curl_t& operator=(CURL *c) { if(_c) curl_easy_cleanup(_c); _c=c; return *this; } 72 curl_t& operator=(CURL *c) { if(_c) curl_easy_cleanup(_c); _c=c; return *this; }
73 73
74 operator const CURL*(void) const { return _c; } 74 operator const CURL*(void) const { return _c; }
75 operator CURL*(void) { return _c; } 75 operator CURL*(void) { return _c; }
76 }; 76 };
77 77
78 static CURLcode curl_misc_sets(CURL* c) { 78 static CURLcode curl_misc_sets(CURL* c) {
79 CURLcode r; 79 CURLcode r;
80 (r=curl_easy_setopt(c,CURLOPT_FOLLOWLOCATION,1)) 80 (r=curl_easy_setopt(c,CURLOPT_FOLLOWLOCATION,1))
81 || (r=curl_easy_setopt(c,CURLOPT_MAXREDIRS,5)) 81 || (r=curl_easy_setopt(c,CURLOPT_MAXREDIRS,5))
82 || (r=curl_easy_setopt(c,CURLOPT_DNS_CACHE_TIMEOUT,120)) 82 || (r=curl_easy_setopt(c,CURLOPT_DNS_CACHE_TIMEOUT,120))
83 || (r=curl_easy_setopt(c,CURLOPT_DNS_USE_GLOBAL_CACHE,1)) 83 || (r=curl_easy_setopt(c,CURLOPT_DNS_USE_GLOBAL_CACHE,1))
84 || (r=curl_easy_setopt(c,CURLOPT_USERAGENT,PACKAGE_NAME"/"PACKAGE_VERSION)) 84 || (r=curl_easy_setopt(c,CURLOPT_USERAGENT,PACKAGE_NAME"/"PACKAGE_SRC_VERSION))
85 || (r=curl_easy_setopt(c,CURLOPT_TIMEOUT,20)) 85 || (r=curl_easy_setopt(c,CURLOPT_TIMEOUT,20))
86 #ifdefDISABLE_CURL_SSL_VERIFYHOST 86 #ifdefDISABLE_CURL_SSL_VERIFYHOST
87 || (r=curl_easy_setopt(c,CURLOPT_SSL_VERIFYHOST,0)) 87 || (r=curl_easy_setopt(c,CURLOPT_SSL_VERIFYHOST,0))
88#endif 88#endif
89 #ifdefDISABLE_CURL_SSL_VERIFYPEER 89 #ifdefDISABLE_CURL_SSL_VERIFYPEER
90 || (r=curl_easy_setopt(c,CURLOPT_SSL_VERIFYPEER,0)) 90 || (r=curl_easy_setopt(c,CURLOPT_SSL_VERIFYPEER,0))
91#endif 91#endif
92 ; 92 ;
93 return r; 93 return r;
94 } 94 }
95 95
96 static size_t _curl_tostring(void *ptr,size_t size,size_t nmemb,void *stream) { 96 static size_t _curl_tostring(void *ptr,size_t size,size_t nmemb,void *stream) {
97 string *str = (string*)stream; 97 string *str = (string*)stream;
98 size_t bytes = size*nmemb; 98 size_t bytes = size*nmemb;
99 size_t get = min(16384-str->length(),bytes); 99 size_t get = min(16384-str->length(),bytes);
100 str->append((const char*)ptr,get); 100 str->append((const char*)ptr,get);
101 return get; 101 return get;
102 } 102 }
103 103
104 assoc_t consumer_t::associate(const string& server) { 104 assoc_t consumer_t::associate(const string& server) {
105 util::dh_t dh = DH_new(); 105 util::dh_t dh = DH_new();
106 if(!dh) 106 if(!dh)
107 throw exception_openssl(OPKELE_CP_ "failed to DH_new()"); 107 throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
108 dh->p = util::dec_to_bignum(data::_default_p); 108 dh->p = util::dec_to_bignum(data::_default_p);
109 dh->g = util::dec_to_bignum(data::_default_g); 109 dh->g = util::dec_to_bignum(data::_default_g);
110 if(!DH_generate_key(dh)) 110 if(!DH_generate_key(dh))
111 throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()"); 111 throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
112 string request = 112 string request =
113 "openid.mode=associate" 113 "openid.mode=associate"
114 "&openid.assoc_type=HMAC-SHA1" 114 "&openid.assoc_type=HMAC-SHA1"
115 "&openid.session_type=DH-SHA1" 115 "&openid.session_type=DH-SHA1"
116 "&openid.dh_consumer_public="; 116 "&openid.dh_consumer_public=";
117 request += util::url_encode(util::bignum_to_base64(dh->pub_key)); 117 request += util::url_encode(util::bignum_to_base64(dh->pub_key));
118 curl_t curl = curl_easy_init(); 118 curl_t curl = curl_easy_init();
119 if(!curl) 119 if(!curl)
120 throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); 120 throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()");
121 string response; 121 string response;
122 CURLcode r; 122 CURLcode r;
123 (r=curl_misc_sets(curl)) 123 (r=curl_misc_sets(curl))
124 || (r=curl_easy_setopt(curl,CURLOPT_URL,server.c_str())) 124 || (r=curl_easy_setopt(curl,CURLOPT_URL,server.c_str()))
125 || (r=curl_easy_setopt(curl,CURLOPT_POST,1)) 125 || (r=curl_easy_setopt(curl,CURLOPT_POST,1))
126 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDS,request.data())) 126 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDS,request.data()))
127 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDSIZE,request.length())) 127 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDSIZE,request.length()))
128 || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring)) 128 || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring))
129 || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&response)) 129 || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&response))
130 ; 130 ;
131 if(r) 131 if(r)
132 throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); 132 throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r);
133 if(r=curl_easy_perform(curl)) 133 if(r=curl_easy_perform(curl))
134 throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); 134 throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r);
135 params_t p; p.parse_keyvalues(response); 135 params_t p; p.parse_keyvalues(response);
136 if(p.has_param("assoc_type") && p.get_param("assoc_type")!="HMAC-SHA1") 136 if(p.has_param("assoc_type") && p.get_param("assoc_type")!="HMAC-SHA1")
137 throw bad_input(OPKELE_CP_ "unsupported assoc_type"); 137 throw bad_input(OPKELE_CP_ "unsupported assoc_type");
138 string st; 138 string st;
139 if(p.has_param("session_type")) st = p.get_param("session_type"); 139 if(p.has_param("session_type")) st = p.get_param("session_type");
140 if((!st.empty()) && st!="DH-SHA1") 140 if((!st.empty()) && st!="DH-SHA1")
141 throw bad_input(OPKELE_CP_ "unsupported session_type"); 141 throw bad_input(OPKELE_CP_ "unsupported session_type");
142 secret_t secret; 142 secret_t secret;
143 if(st.empty()) { 143 if(st.empty()) {
144 secret.from_base64(p.get_param("mac_key")); 144 secret.from_base64(p.get_param("mac_key"));
145 }else{ 145 }else{
146 util::bignum_t s_pub = util::base64_to_bignum(p.get_param("dh_server_public")); 146 util::bignum_t s_pub = util::base64_to_bignum(p.get_param("dh_server_public"));
147 vector<unsigned char> ck(DH_size(dh)+1); 147 vector<unsigned char> ck(DH_size(dh)+1);
148 unsigned char *ckptr = &(ck.front())+1; 148 unsigned char *ckptr = &(ck.front())+1;
149 int cklen = DH_compute_key(ckptr,s_pub,dh); 149 int cklen = DH_compute_key(ckptr,s_pub,dh);
150 if(cklen<0) 150 if(cklen<0)
151 throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()"); 151 throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
152 if(cklen && (*ckptr)&0x80) { 152 if(cklen && (*ckptr)&0x80) {
153 (*(--ckptr)) = 0; ++cklen; 153 (*(--ckptr)) = 0; ++cklen;
154 } 154 }
155 unsigned char key_sha1[SHA_DIGEST_LENGTH]; 155 unsigned char key_sha1[SHA_DIGEST_LENGTH];
156 SHA1(ckptr,cklen,key_sha1); 156 SHA1(ckptr,cklen,key_sha1);
157 secret.enxor_from_base64(key_sha1,p.get_param("enc_mac_key")); 157 secret.enxor_from_base64(key_sha1,p.get_param("enc_mac_key"));
158 } 158 }
159 int expires_in = 0; 159 int expires_in = 0;
160 if(p.has_param("expires_in")) { 160 if(p.has_param("expires_in")) {
161 expires_in = util::string_to_long(p.get_param("expires_in")); 161 expires_in = util::string_to_long(p.get_param("expires_in"));
162 }else if(p.has_param("issued") && p.has_param("expiry")) { 162 }else if(p.has_param("issued") && p.has_param("expiry")) {
163 expires_in = util::w3c_to_time(p.get_param("expiry"))-util::w3c_to_time(p.get_param("issued")); 163 expires_in = util::w3c_to_time(p.get_param("expiry"))-util::w3c_to_time(p.get_param("issued"));
164 }else 164 }else
165 throw bad_input(OPKELE_CP_ "no expiration information"); 165 throw bad_input(OPKELE_CP_ "no expiration information");
166 return store_assoc(server,p.get_param("assoc_handle"),secret,expires_in); 166 return store_assoc(server,p.get_param("assoc_handle"),secret,expires_in);
167 } 167 }
168 168
169 string consumer_t::checkid_immediate(const string& identity,const string& return_to,const string& trust_root,extension_t *ext) { 169 string consumer_t::checkid_immediate(const string& identity,const string& return_to,const string& trust_root,extension_t *ext) {
170 return checkid_(mode_checkid_immediate,identity,return_to,trust_root,ext); 170 return checkid_(mode_checkid_immediate,identity,return_to,trust_root,ext);
171 } 171 }
172 string consumer_t::checkid_setup(const string& identity,const string& return_to,const string& trust_root,extension_t *ext) { 172 string consumer_t::checkid_setup(const string& identity,const string& return_to,const string& trust_root,extension_t *ext) {
173 return checkid_(mode_checkid_setup,identity,return_to,trust_root,ext); 173 return checkid_(mode_checkid_setup,identity,return_to,trust_root,ext);
174 } 174 }
175 string consumer_t::checkid_(mode_t mode,const string& identity,const string& return_to,const string& trust_root,extension_t *ext) { 175 string consumer_t::checkid_(mode_t mode,const string& identity,const string& return_to,const string& trust_root,extension_t *ext) {
176 params_t p; 176 params_t p;
177 if(mode==mode_checkid_immediate) 177 if(mode==mode_checkid_immediate)
178 p["mode"]="checkid_immediate"; 178 p["mode"]="checkid_immediate";
179 else if(mode==mode_checkid_setup) 179 else if(mode==mode_checkid_setup)
180 p["mode"]="checkid_setup"; 180 p["mode"]="checkid_setup";