summaryrefslogtreecommitdiffabout
path: root/lib
Unidiff
Diffstat (limited to 'lib') (more/less context) (ignore whitespace changes)
-rw-r--r--lib/consumer.cc25
1 files changed, 5 insertions, 20 deletions
diff --git a/lib/consumer.cc b/lib/consumer.cc
index 7881f5f..20f4174 100644
--- a/lib/consumer.cc
+++ b/lib/consumer.cc
@@ -1,440 +1,425 @@
1#include <algorithm> 1#include <algorithm>
2#include <cassert> 2#include <cassert>
3#include <cstring> 3#include <cstring>
4#include <opkele/util.h> 4#include <opkele/util.h>
5#include <opkele/curl.h>
5#include <opkele/exception.h> 6#include <opkele/exception.h>
6#include <opkele/data.h> 7#include <opkele/data.h>
7#include <opkele/consumer.h> 8#include <opkele/consumer.h>
8#include <openssl/sha.h> 9#include <openssl/sha.h>
9#include <openssl/hmac.h> 10#include <openssl/hmac.h>
10#include <curl/curl.h>
11
12#include <iostream> 11#include <iostream>
13 12
14#include "config.h" 13#include "config.h"
15 14
16#include <pcre.h> 15#include <pcre.h>
17 16
18namespace opkele { 17namespace opkele {
19 using namespace std; 18 using namespace std;
20 19
21 class pcre_matches_t { 20 class pcre_matches_t {
22 public: 21 public:
23 int *_ov; 22 int *_ov;
24 int _s; 23 int _s;
25 24
26 pcre_matches_t() : _ov(0), _s(0) { } 25 pcre_matches_t() : _ov(0), _s(0) { }
27 pcre_matches_t(int s) : _ov(0), _s(s) { 26 pcre_matches_t(int s) : _ov(0), _s(s) {
28 if(_s&1) ++_s; 27 if(_s&1) ++_s;
29 _s += _s>>1; 28 _s += _s>>1;
30 _ov = new int[_s]; 29 _ov = new int[_s];
31 } 30 }
32 ~pcre_matches_t() throw() { if(_ov) delete[] _ov; } 31 ~pcre_matches_t() throw() { if(_ov) delete[] _ov; }
33 32
34 int begin(int i) const { return _ov[i<<1]; } 33 int begin(int i) const { return _ov[i<<1]; }
35 int end(int i) const { return _ov[(i<<1)+1]; } 34 int end(int i) const { return _ov[(i<<1)+1]; }
36 int length(int i) const { int t=i<<1; return _ov[t+1]-_ov[t]; } 35 int length(int i) const { int t=i<<1; return _ov[t+1]-_ov[t]; }
37 }; 36 };
38 37
39 class pcre_t { 38 class pcre_t {
40 public: 39 public:
41 pcre *_p; 40 pcre *_p;
42 41
43 pcre_t() : _p(0) { } 42 pcre_t() : _p(0) { }
44 pcre_t(pcre *p) : _p(p) { } 43 pcre_t(pcre *p) : _p(p) { }
45 pcre_t(const char *re,int opts) : _p(0) { 44 pcre_t(const char *re,int opts) : _p(0) {
46 static const char *errptr; static int erroffset; 45 static const char *errptr; static int erroffset;
47 _p = pcre_compile(re,opts,&errptr,&erroffset,NULL); 46 _p = pcre_compile(re,opts,&errptr,&erroffset,NULL);
48 if(!_p) 47 if(!_p)
49 throw internal_error(OPKELE_CP_ string("Failed to compile regexp: ")+errptr); 48 throw internal_error(OPKELE_CP_ string("Failed to compile regexp: ")+errptr);
50 } 49 }
51 ~pcre_t() throw() { if(_p) (*pcre_free)(_p); } 50 ~pcre_t() throw() { if(_p) (*pcre_free)(_p); }
52 51
53 pcre_t& operator=(pcre *p) { if(_p) (*pcre_free)(_p); _p=p; return *this; } 52 pcre_t& operator=(pcre *p) { if(_p) (*pcre_free)(_p); _p=p; return *this; }
54 53
55 operator const pcre*(void) const { return _p; } 54 operator const pcre*(void) const { return _p; }
56 operator pcre*(void) { return _p; } 55 operator pcre*(void) { return _p; }
57 56
58 int exec(const string& s,pcre_matches_t& m) { 57 int exec(const string& s,pcre_matches_t& m) {
59 if(!_p) 58 if(!_p)
60 throw internal_error(OPKELE_CP_ "Trying to execute absent regexp"); 59 throw internal_error(OPKELE_CP_ "Trying to execute absent regexp");
61 return pcre_exec(_p,NULL,s.c_str(),s.length(),0,0,m._ov,m._s); 60 return pcre_exec(_p,NULL,s.c_str(),s.length(),0,0,m._ov,m._s);
62 } 61 }
63 }; 62 };
64 63
65 class curl_t {
66 public:
67 CURL *_c;
68
69 curl_t() : _c(0) { }
70 curl_t(CURL *c) : _c(c) { }
71 ~curl_t() throw() { if(_c) curl_easy_cleanup(_c); }
72
73 curl_t& operator=(CURL *c) { if(_c) curl_easy_cleanup(_c); _c=c; return *this; }
74
75 operator const CURL*(void) const { return _c; }
76 operator CURL*(void) { return _c; }
77 };
78
79 static CURLcode curl_misc_sets(CURL* c) { 64 static CURLcode curl_misc_sets(CURL* c) {
80 CURLcode r; 65 CURLcode r;
81 (r=curl_easy_setopt(c,CURLOPT_FOLLOWLOCATION,1)) 66 (r=curl_easy_setopt(c,CURLOPT_FOLLOWLOCATION,1))
82 || (r=curl_easy_setopt(c,CURLOPT_MAXREDIRS,5)) 67 || (r=curl_easy_setopt(c,CURLOPT_MAXREDIRS,5))
83 || (r=curl_easy_setopt(c,CURLOPT_DNS_CACHE_TIMEOUT,120)) 68 || (r=curl_easy_setopt(c,CURLOPT_DNS_CACHE_TIMEOUT,120))
84 || (r=curl_easy_setopt(c,CURLOPT_DNS_USE_GLOBAL_CACHE,1)) 69 || (r=curl_easy_setopt(c,CURLOPT_DNS_USE_GLOBAL_CACHE,1))
85 || (r=curl_easy_setopt(c,CURLOPT_USERAGENT,PACKAGE_NAME"/"PACKAGE_SRC_VERSION)) 70 || (r=curl_easy_setopt(c,CURLOPT_USERAGENT,PACKAGE_NAME"/"PACKAGE_SRC_VERSION))
86 || (r=curl_easy_setopt(c,CURLOPT_TIMEOUT,20)) 71 || (r=curl_easy_setopt(c,CURLOPT_TIMEOUT,20))
87 #ifdefDISABLE_CURL_SSL_VERIFYHOST 72 #ifdefDISABLE_CURL_SSL_VERIFYHOST
88 || (r=curl_easy_setopt(c,CURLOPT_SSL_VERIFYHOST,0)) 73 || (r=curl_easy_setopt(c,CURLOPT_SSL_VERIFYHOST,0))
89#endif 74#endif
90 #ifdefDISABLE_CURL_SSL_VERIFYPEER 75 #ifdefDISABLE_CURL_SSL_VERIFYPEER
91 || (r=curl_easy_setopt(c,CURLOPT_SSL_VERIFYPEER,0)) 76 || (r=curl_easy_setopt(c,CURLOPT_SSL_VERIFYPEER,0))
92#endif 77#endif
93 ; 78 ;
94 return r; 79 return r;
95 } 80 }
96 81
97 static size_t _curl_tostring(void *ptr,size_t size,size_t nmemb,void *stream) { 82 static size_t _curl_tostring(void *ptr,size_t size,size_t nmemb,void *stream) {
98 string *str = (string*)stream; 83 string *str = (string*)stream;
99 size_t bytes = size*nmemb; 84 size_t bytes = size*nmemb;
100 size_t get = min(16384-str->length(),bytes); 85 size_t get = min(16384-str->length(),bytes);
101 str->append((const char*)ptr,get); 86 str->append((const char*)ptr,get);
102 return get; 87 return get;
103 } 88 }
104 89
105 assoc_t consumer_t::associate(const string& server) { 90 assoc_t consumer_t::associate(const string& server) {
106 util::dh_t dh = DH_new(); 91 util::dh_t dh = DH_new();
107 if(!dh) 92 if(!dh)
108 throw exception_openssl(OPKELE_CP_ "failed to DH_new()"); 93 throw exception_openssl(OPKELE_CP_ "failed to DH_new()");
109 dh->p = util::dec_to_bignum(data::_default_p); 94 dh->p = util::dec_to_bignum(data::_default_p);
110 dh->g = util::dec_to_bignum(data::_default_g); 95 dh->g = util::dec_to_bignum(data::_default_g);
111 if(!DH_generate_key(dh)) 96 if(!DH_generate_key(dh))
112 throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()"); 97 throw exception_openssl(OPKELE_CP_ "failed to DH_generate_key()");
113 string request = 98 string request =
114 "openid.mode=associate" 99 "openid.mode=associate"
115 "&openid.assoc_type=HMAC-SHA1" 100 "&openid.assoc_type=HMAC-SHA1"
116 "&openid.session_type=DH-SHA1" 101 "&openid.session_type=DH-SHA1"
117 "&openid.dh_consumer_public="; 102 "&openid.dh_consumer_public=";
118 request += util::url_encode(util::bignum_to_base64(dh->pub_key)); 103 request += util::url_encode(util::bignum_to_base64(dh->pub_key));
119 curl_t curl = curl_easy_init(); 104 util::curl_t curl = curl_easy_init();
120 if(!curl) 105 if(!curl)
121 throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); 106 throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()");
122 string response; 107 string response;
123 CURLcode r; 108 CURLcode r;
124 (r=curl_misc_sets(curl)) 109 (r=curl_misc_sets(curl))
125 || (r=curl_easy_setopt(curl,CURLOPT_URL,server.c_str())) 110 || (r=curl_easy_setopt(curl,CURLOPT_URL,server.c_str()))
126 || (r=curl_easy_setopt(curl,CURLOPT_POST,1)) 111 || (r=curl_easy_setopt(curl,CURLOPT_POST,1))
127 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDS,request.data())) 112 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDS,request.data()))
128 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDSIZE,request.length())) 113 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDSIZE,request.length()))
129 || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring)) 114 || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring))
130 || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&response)) 115 || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&response))
131 ; 116 ;
132 if(r) 117 if(r)
133 throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); 118 throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r);
134 if( (r=curl_easy_perform(curl)) ) 119 if( (r=curl_easy_perform(curl)) )
135 throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); 120 throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r);
136 params_t p; p.parse_keyvalues(response); 121 params_t p; p.parse_keyvalues(response);
137 if(p.has_param("assoc_type") && p.get_param("assoc_type")!="HMAC-SHA1") 122 if(p.has_param("assoc_type") && p.get_param("assoc_type")!="HMAC-SHA1")
138 throw bad_input(OPKELE_CP_ "unsupported assoc_type"); 123 throw bad_input(OPKELE_CP_ "unsupported assoc_type");
139 string st; 124 string st;
140 if(p.has_param("session_type")) st = p.get_param("session_type"); 125 if(p.has_param("session_type")) st = p.get_param("session_type");
141 if((!st.empty()) && st!="DH-SHA1") 126 if((!st.empty()) && st!="DH-SHA1")
142 throw bad_input(OPKELE_CP_ "unsupported session_type"); 127 throw bad_input(OPKELE_CP_ "unsupported session_type");
143 secret_t secret; 128 secret_t secret;
144 if(st.empty()) { 129 if(st.empty()) {
145 secret.from_base64(p.get_param("mac_key")); 130 secret.from_base64(p.get_param("mac_key"));
146 }else{ 131 }else{
147 util::bignum_t s_pub = util::base64_to_bignum(p.get_param("dh_server_public")); 132 util::bignum_t s_pub = util::base64_to_bignum(p.get_param("dh_server_public"));
148 vector<unsigned char> ck(DH_size(dh)+1); 133 vector<unsigned char> ck(DH_size(dh)+1);
149 unsigned char *ckptr = &(ck.front())+1; 134 unsigned char *ckptr = &(ck.front())+1;
150 int cklen = DH_compute_key(ckptr,s_pub,dh); 135 int cklen = DH_compute_key(ckptr,s_pub,dh);
151 if(cklen<0) 136 if(cklen<0)
152 throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()"); 137 throw exception_openssl(OPKELE_CP_ "failed to DH_compute_key()");
153 if(cklen && (*ckptr)&0x80) { 138 if(cklen && (*ckptr)&0x80) {
154 (*(--ckptr)) = 0; ++cklen; 139 (*(--ckptr)) = 0; ++cklen;
155 } 140 }
156 unsigned char key_sha1[SHA_DIGEST_LENGTH]; 141 unsigned char key_sha1[SHA_DIGEST_LENGTH];
157 SHA1(ckptr,cklen,key_sha1); 142 SHA1(ckptr,cklen,key_sha1);
158 secret.enxor_from_base64(key_sha1,p.get_param("enc_mac_key")); 143 secret.enxor_from_base64(key_sha1,p.get_param("enc_mac_key"));
159 } 144 }
160 int expires_in = 0; 145 int expires_in = 0;
161 if(p.has_param("expires_in")) { 146 if(p.has_param("expires_in")) {
162 expires_in = util::string_to_long(p.get_param("expires_in")); 147 expires_in = util::string_to_long(p.get_param("expires_in"));
163 }else if(p.has_param("issued") && p.has_param("expiry")) { 148 }else if(p.has_param("issued") && p.has_param("expiry")) {
164 expires_in = util::w3c_to_time(p.get_param("expiry"))-util::w3c_to_time(p.get_param("issued")); 149 expires_in = util::w3c_to_time(p.get_param("expiry"))-util::w3c_to_time(p.get_param("issued"));
165 }else 150 }else
166 throw bad_input(OPKELE_CP_ "no expiration information"); 151 throw bad_input(OPKELE_CP_ "no expiration information");
167 return store_assoc(server,p.get_param("assoc_handle"),secret,expires_in); 152 return store_assoc(server,p.get_param("assoc_handle"),secret,expires_in);
168 } 153 }
169 154
170 string consumer_t::checkid_immediate(const string& identity,const string& return_to,const string& trust_root,extension_t *ext) { 155 string consumer_t::checkid_immediate(const string& identity,const string& return_to,const string& trust_root,extension_t *ext) {
171 return checkid_(mode_checkid_immediate,identity,return_to,trust_root,ext); 156 return checkid_(mode_checkid_immediate,identity,return_to,trust_root,ext);
172 } 157 }
173 string consumer_t::checkid_setup(const string& identity,const string& return_to,const string& trust_root,extension_t *ext) { 158 string consumer_t::checkid_setup(const string& identity,const string& return_to,const string& trust_root,extension_t *ext) {
174 return checkid_(mode_checkid_setup,identity,return_to,trust_root,ext); 159 return checkid_(mode_checkid_setup,identity,return_to,trust_root,ext);
175 } 160 }
176 string consumer_t::checkid_(mode_t mode,const string& identity,const string& return_to,const string& trust_root,extension_t *ext) { 161 string consumer_t::checkid_(mode_t mode,const string& identity,const string& return_to,const string& trust_root,extension_t *ext) {
177 params_t p; 162 params_t p;
178 if(mode==mode_checkid_immediate) 163 if(mode==mode_checkid_immediate)
179 p["mode"]="checkid_immediate"; 164 p["mode"]="checkid_immediate";
180 else if(mode==mode_checkid_setup) 165 else if(mode==mode_checkid_setup)
181 p["mode"]="checkid_setup"; 166 p["mode"]="checkid_setup";
182 else 167 else
183 throw bad_input(OPKELE_CP_ "unknown checkid_* mode"); 168 throw bad_input(OPKELE_CP_ "unknown checkid_* mode");
184 string iurl = canonicalize(identity); 169 string iurl = canonicalize(identity);
185 string server, delegate; 170 string server, delegate;
186 retrieve_links(iurl,server,delegate); 171 retrieve_links(iurl,server,delegate);
187 p["identity"] = delegate.empty()?iurl:delegate; 172 p["identity"] = delegate.empty()?iurl:delegate;
188 if(!trust_root.empty()) 173 if(!trust_root.empty())
189 p["trust_root"] = trust_root; 174 p["trust_root"] = trust_root;
190 p["return_to"] = return_to; 175 p["return_to"] = return_to;
191 try { 176 try {
192 string ah = find_assoc(server)->handle(); 177 string ah = find_assoc(server)->handle();
193 p["assoc_handle"] = ah; 178 p["assoc_handle"] = ah;
194 }catch(failed_lookup& fl) { 179 }catch(failed_lookup& fl) {
195 string ah = associate(server)->handle(); 180 string ah = associate(server)->handle();
196 p["assoc_handle"] = ah; 181 p["assoc_handle"] = ah;
197 } 182 }
198 if(ext) ext->checkid_hook(p,identity); 183 if(ext) ext->checkid_hook(p,identity);
199 return p.append_query(server); 184 return p.append_query(server);
200 } 185 }
201 186
202 void consumer_t::id_res(const params_t& pin,const string& identity,extension_t *ext) { 187 void consumer_t::id_res(const params_t& pin,const string& identity,extension_t *ext) {
203 if(pin.has_param("openid.user_setup_url")) 188 if(pin.has_param("openid.user_setup_url"))
204 throw id_res_setup(OPKELE_CP_ "assertion failed, setup url provided",pin.get_param("openid.user_setup_url")); 189 throw id_res_setup(OPKELE_CP_ "assertion failed, setup url provided",pin.get_param("openid.user_setup_url"));
205 string server,delegate; 190 string server,delegate;
206 retrieve_links(identity.empty()?pin.get_param("openid.identity"):canonicalize(identity),server,delegate); 191 retrieve_links(identity.empty()?pin.get_param("openid.identity"):canonicalize(identity),server,delegate);
207 params_t ps; 192 params_t ps;
208 try { 193 try {
209 assoc_t assoc = retrieve_assoc(server,pin.get_param("openid.assoc_handle")); 194 assoc_t assoc = retrieve_assoc(server,pin.get_param("openid.assoc_handle"));
210 if(assoc->is_expired()) /* TODO: or should I throw some other exception to force programmer fix his implementation? */ 195 if(assoc->is_expired()) /* TODO: or should I throw some other exception to force programmer fix his implementation? */
211 throw failed_lookup(OPKELE_CP_ "retrieve_assoc() has returned expired handle"); 196 throw failed_lookup(OPKELE_CP_ "retrieve_assoc() has returned expired handle");
212 const string& sigenc = pin.get_param("openid.sig"); 197 const string& sigenc = pin.get_param("openid.sig");
213 vector<unsigned char> sig; 198 vector<unsigned char> sig;
214 util::decode_base64(sigenc,sig); 199 util::decode_base64(sigenc,sig);
215 const string& slist = pin.get_param("openid.signed"); 200 const string& slist = pin.get_param("openid.signed");
216 string kv; 201 string kv;
217 string::size_type p = 0; 202 string::size_type p = 0;
218 while(true) { 203 while(true) {
219 string::size_type co = slist.find(',',p); 204 string::size_type co = slist.find(',',p);
220 string f = (co==string::npos)?slist.substr(p):slist.substr(p,co-p); 205 string f = (co==string::npos)?slist.substr(p):slist.substr(p,co-p);
221 kv += f; 206 kv += f;
222 kv += ':'; 207 kv += ':';
223 f.insert(0,"openid."); 208 f.insert(0,"openid.");
224 kv += pin.get_param(f); 209 kv += pin.get_param(f);
225 kv += '\n'; 210 kv += '\n';
226 if(ext) ps[f.substr(sizeof("openid.")-1)] = pin.get_param(f); 211 if(ext) ps[f.substr(sizeof("openid.")-1)] = pin.get_param(f);
227 if(co==string::npos) 212 if(co==string::npos)
228 break; 213 break;
229 p = co+1; 214 p = co+1;
230 } 215 }
231 secret_t secret = assoc->secret(); 216 secret_t secret = assoc->secret();
232 unsigned int md_len = 0; 217 unsigned int md_len = 0;
233 unsigned char *md = HMAC( 218 unsigned char *md = HMAC(
234 EVP_sha1(), 219 EVP_sha1(),
235 &(secret.front()),secret.size(), 220 &(secret.front()),secret.size(),
236 (const unsigned char *)kv.data(),kv.length(), 221 (const unsigned char *)kv.data(),kv.length(),
237 0,&md_len); 222 0,&md_len);
238 if(sig.size()!=md_len || memcmp(&(sig.front()),md,md_len)) 223 if(sig.size()!=md_len || memcmp(&(sig.front()),md,md_len))
239 throw id_res_mismatch(OPKELE_CP_ "signature mismatch"); 224 throw id_res_mismatch(OPKELE_CP_ "signature mismatch");
240 }catch(failed_lookup& e) { /* XXX: more specific? */ 225 }catch(failed_lookup& e) { /* XXX: more specific? */
241 const string& slist = pin.get_param("openid.signed"); 226 const string& slist = pin.get_param("openid.signed");
242 string::size_type pp = 0; 227 string::size_type pp = 0;
243 params_t p; 228 params_t p;
244 while(true) { 229 while(true) {
245 string::size_type co = slist.find(',',pp); 230 string::size_type co = slist.find(',',pp);
246 string f = "openid."; 231 string f = "openid.";
247 f += (co==string::npos)?slist.substr(pp):slist.substr(pp,co-pp); 232 f += (co==string::npos)?slist.substr(pp):slist.substr(pp,co-pp);
248 p[f] = pin.get_param(f); 233 p[f] = pin.get_param(f);
249 if(co==string::npos) 234 if(co==string::npos)
250 break; 235 break;
251 pp = co+1; 236 pp = co+1;
252 } 237 }
253 p["openid.assoc_handle"] = pin.get_param("openid.assoc_handle"); 238 p["openid.assoc_handle"] = pin.get_param("openid.assoc_handle");
254 p["openid.sig"] = pin.get_param("openid.sig"); 239 p["openid.sig"] = pin.get_param("openid.sig");
255 p["openid.signed"] = pin.get_param("openid.signed"); 240 p["openid.signed"] = pin.get_param("openid.signed");
256 try { 241 try {
257 string ih = pin.get_param("openid.invalidate_handle"); 242 string ih = pin.get_param("openid.invalidate_handle");
258 p["openid.invalidate_handle"] = ih; 243 p["openid.invalidate_handle"] = ih;
259 }catch(failed_lookup& fl) { } 244 }catch(failed_lookup& fl) { }
260 try { 245 try {
261 check_authentication(server,p); 246 check_authentication(server,p);
262 }catch(failed_check_authentication& fca) { 247 }catch(failed_check_authentication& fca) {
263 throw id_res_failed(OPKELE_CP_ "failed to check_authentication()"); 248 throw id_res_failed(OPKELE_CP_ "failed to check_authentication()");
264 } 249 }
265 } 250 }
266 if(ext) ext->id_res_hook(pin,ps,identity); 251 if(ext) ext->id_res_hook(pin,ps,identity);
267 } 252 }
268 253
269 void consumer_t::check_authentication(const string& server,const params_t& p) { 254 void consumer_t::check_authentication(const string& server,const params_t& p) {
270 string request = "openid.mode=check_authentication"; 255 string request = "openid.mode=check_authentication";
271 for(params_t::const_iterator i=p.begin();i!=p.end();++i) { 256 for(params_t::const_iterator i=p.begin();i!=p.end();++i) {
272 if(i->first!="openid.mode") { 257 if(i->first!="openid.mode") {
273 request += '&'; 258 request += '&';
274 request += i->first; 259 request += i->first;
275 request += '='; 260 request += '=';
276 request += util::url_encode(i->second); 261 request += util::url_encode(i->second);
277 } 262 }
278 } 263 }
279 curl_t curl = curl_easy_init(); 264 util::curl_t curl = curl_easy_init();
280 if(!curl) 265 if(!curl)
281 throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); 266 throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()");
282 string response; 267 string response;
283 CURLcode r; 268 CURLcode r;
284 (r=curl_misc_sets(curl)) 269 (r=curl_misc_sets(curl))
285 || (r=curl_easy_setopt(curl,CURLOPT_URL,server.c_str())) 270 || (r=curl_easy_setopt(curl,CURLOPT_URL,server.c_str()))
286 || (r=curl_easy_setopt(curl,CURLOPT_POST,1)) 271 || (r=curl_easy_setopt(curl,CURLOPT_POST,1))
287 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDS,request.data())) 272 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDS,request.data()))
288 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDSIZE,request.length())) 273 || (r=curl_easy_setopt(curl,CURLOPT_POSTFIELDSIZE,request.length()))
289 || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring)) 274 || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring))
290 || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&response)) 275 || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&response))
291 ; 276 ;
292 if(r) 277 if(r)
293 throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); 278 throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r);
294 if( (r=curl_easy_perform(curl)) ) 279 if( (r=curl_easy_perform(curl)) )
295 throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); 280 throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r);
296 params_t pp; pp.parse_keyvalues(response); 281 params_t pp; pp.parse_keyvalues(response);
297 if(pp.has_param("invalidate_handle")) 282 if(pp.has_param("invalidate_handle"))
298 invalidate_assoc(server,pp.get_param("invalidate_handle")); 283 invalidate_assoc(server,pp.get_param("invalidate_handle"));
299 if(pp.has_param("is_valid")) { 284 if(pp.has_param("is_valid")) {
300 if(pp.get_param("is_valid")=="true") 285 if(pp.get_param("is_valid")=="true")
301 return; 286 return;
302 }else if(pp.has_param("lifetime")) { 287 }else if(pp.has_param("lifetime")) {
303 if(util::string_to_long(pp.get_param("lifetime"))) 288 if(util::string_to_long(pp.get_param("lifetime")))
304 return; 289 return;
305 } 290 }
306 throw failed_check_authentication(OPKELE_CP_ "failed to verify response"); 291 throw failed_check_authentication(OPKELE_CP_ "failed to verify response");
307 } 292 }
308 293
309 void consumer_t::retrieve_links(const string& url,string& server,string& delegate) { 294 void consumer_t::retrieve_links(const string& url,string& server,string& delegate) {
310 server.erase(); 295 server.erase();
311 delegate.erase(); 296 delegate.erase();
312 curl_t curl = curl_easy_init(); 297 util::curl_t curl = curl_easy_init();
313 if(!curl) 298 if(!curl)
314 throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); 299 throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()");
315 string html; 300 string html;
316 CURLcode r; 301 CURLcode r;
317 (r=curl_misc_sets(curl)) 302 (r=curl_misc_sets(curl))
318 || (r=curl_easy_setopt(curl,CURLOPT_URL,url.c_str())) 303 || (r=curl_easy_setopt(curl,CURLOPT_URL,url.c_str()))
319 || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring)) 304 || (r=curl_easy_setopt(curl,CURLOPT_WRITEFUNCTION,_curl_tostring))
320 || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&html)) 305 || (r=curl_easy_setopt(curl,CURLOPT_WRITEDATA,&html))
321 ; 306 ;
322 if(r) 307 if(r)
323 throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); 308 throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r);
324 r = curl_easy_perform(curl); 309 r = curl_easy_perform(curl);
325 if(r && r!=CURLE_WRITE_ERROR) 310 if(r && r!=CURLE_WRITE_ERROR)
326 throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); 311 throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r);
327 static const char *re_bre = "<\\s*body\\b", *re_hdre = "<\\s*head[^>]*>", 312 static const char *re_bre = "<\\s*body\\b", *re_hdre = "<\\s*head[^>]*>",
328 *re_lre = "<\\s*link\\b([^>]+)>", 313 *re_lre = "<\\s*link\\b([^>]+)>",
329 *re_rre = "\\brel\\s*=\\s*['\"]([^'\"]+)['\"]", 314 *re_rre = "\\brel\\s*=\\s*['\"]([^'\"]+)['\"]",
330 *re_hre = "\\bhref\\s*=\\s*['\"]\\s*([^'\"\\s]+)\\s*['\"]"; 315 *re_hre = "\\bhref\\s*=\\s*['\"]\\s*([^'\"\\s]+)\\s*['\"]";
331 pcre_matches_t m1(3), m2(3); 316 pcre_matches_t m1(3), m2(3);
332 pcre_t bre(re_bre,PCRE_CASELESS); 317 pcre_t bre(re_bre,PCRE_CASELESS);
333 if(bre.exec(html,m1)>0) 318 if(bre.exec(html,m1)>0)
334 html.erase(m1.begin(0)); 319 html.erase(m1.begin(0));
335 pcre_t hdre(re_hdre,PCRE_CASELESS); 320 pcre_t hdre(re_hdre,PCRE_CASELESS);
336 if(hdre.exec(html,m1)<=0) 321 if(hdre.exec(html,m1)<=0)
337 throw bad_input(OPKELE_CP_ "failed to find <head>"); 322 throw bad_input(OPKELE_CP_ "failed to find <head>");
338 html.erase(0,m1.end(0)+1); 323 html.erase(0,m1.end(0)+1);
339 pcre_t lre(re_lre,PCRE_CASELESS), rre(re_rre,PCRE_CASELESS), hre(re_hre,PCRE_CASELESS); 324 pcre_t lre(re_lre,PCRE_CASELESS), rre(re_rre,PCRE_CASELESS), hre(re_hre,PCRE_CASELESS);
340 bool gotit = false; 325 bool gotit = false;
341 while( (!gotit) && lre.exec(html,m1)>=2 ) { 326 while( (!gotit) && lre.exec(html,m1)>=2 ) {
342 static const char *whitespace = " \t"; 327 static const char *whitespace = " \t";
343 string attrs(html,m1.begin(1),m1.length(1)); 328 string attrs(html,m1.begin(1),m1.length(1));
344 html.erase(0,m1.end(0)+1); 329 html.erase(0,m1.end(0)+1);
345 if(!( rre.exec(attrs,m1)>=2 && hre.exec(attrs,m2)>=2 )) 330 if(!( rre.exec(attrs,m1)>=2 && hre.exec(attrs,m2)>=2 ))
346 continue; 331 continue;
347 string rels(attrs,m1.begin(1),m1.length(1)); 332 string rels(attrs,m1.begin(1),m1.length(1));
348 for(string::size_type ns = rels.find_first_not_of(whitespace); 333 for(string::size_type ns = rels.find_first_not_of(whitespace);
349 ns!=string::npos; 334 ns!=string::npos;
350 ns=rels.find_first_not_of(whitespace,ns)) { 335 ns=rels.find_first_not_of(whitespace,ns)) {
351 string::size_type s = rels.find_first_of(whitespace,ns); 336 string::size_type s = rels.find_first_of(whitespace,ns);
352 string rel; 337 string rel;
353 if(s==string::npos) { 338 if(s==string::npos) {
354 rel.assign(rels,ns,string::npos); 339 rel.assign(rels,ns,string::npos);
355 ns=string::npos; 340 ns=string::npos;
356 }else{ 341 }else{
357 rel.assign(rels,ns,s-ns); 342 rel.assign(rels,ns,s-ns);
358 ns=s; 343 ns=s;
359 } 344 }
360 if(rel=="openid.server") { 345 if(rel=="openid.server") {
361 server.assign(attrs,m2.begin(1),m2.length(1)); 346 server.assign(attrs,m2.begin(1),m2.length(1));
362 if(!delegate.empty()) { 347 if(!delegate.empty()) {
363 gotit = true; 348 gotit = true;
364 break; 349 break;
365 } 350 }
366 }else if(rel=="openid.delegate") { 351 }else if(rel=="openid.delegate") {
367 delegate.assign(attrs,m2.begin(1),m2.length(1)); 352 delegate.assign(attrs,m2.begin(1),m2.length(1));
368 if(!server.empty()) { 353 if(!server.empty()) {
369 gotit = true; 354 gotit = true;
370 break; 355 break;
371 } 356 }
372 } 357 }
373 if(ns==string::npos) break; 358 if(ns==string::npos) break;
374 } 359 }
375 } 360 }
376 if(server.empty()) 361 if(server.empty())
377 throw failed_assertion(OPKELE_CP_ "The location has no openid.server declaration"); 362 throw failed_assertion(OPKELE_CP_ "The location has no openid.server declaration");
378 } 363 }
379 364
380 assoc_t consumer_t::find_assoc(const string& /* server */) { 365 assoc_t consumer_t::find_assoc(const string& /* server */) {
381 throw failed_lookup(OPKELE_CP_ "no find_assoc() provided"); 366 throw failed_lookup(OPKELE_CP_ "no find_assoc() provided");
382 } 367 }
383 368
384 string consumer_t::normalize(const string& url) { 369 string consumer_t::normalize(const string& url) {
385 string rv = url; 370 string rv = url;
386 // strip leading and trailing spaces 371 // strip leading and trailing spaces
387 string::size_type i = rv.find_first_not_of(" \t\r\n"); 372 string::size_type i = rv.find_first_not_of(" \t\r\n");
388 if(i==string::npos) 373 if(i==string::npos)
389 throw bad_input(OPKELE_CP_ "empty URL"); 374 throw bad_input(OPKELE_CP_ "empty URL");
390 if(i) 375 if(i)
391 rv.erase(0,i); 376 rv.erase(0,i);
392 i = rv.find_last_not_of(" \t\r\n"); 377 i = rv.find_last_not_of(" \t\r\n");
393 assert(i!=string::npos); 378 assert(i!=string::npos);
394 if(i<(rv.length()-1)) 379 if(i<(rv.length()-1))
395 rv.erase(i+1); 380 rv.erase(i+1);
396 // add missing http:// 381 // add missing http://
397 i = rv.find("://"); 382 i = rv.find("://");
398 if(i==string::npos) { // primitive. but do we need more? 383 if(i==string::npos) { // primitive. but do we need more?
399 rv.insert(0,"http://"); 384 rv.insert(0,"http://");
400 i = sizeof("http://")-1; 385 i = sizeof("http://")-1;
401 }else{ 386 }else{
402 i += sizeof("://")-1; 387 i += sizeof("://")-1;
403 } 388 }
404 string::size_type qm = rv.find('?',i); 389 string::size_type qm = rv.find('?',i);
405 string::size_type sl = rv.find('/',i); 390 string::size_type sl = rv.find('/',i);
406 if(qm!=string::npos) { 391 if(qm!=string::npos) {
407 if(sl==string::npos || sl>qm) 392 if(sl==string::npos || sl>qm)
408 rv.insert(qm,1,'/'); 393 rv.insert(qm,1,'/');
409 }else{ 394 }else{
410 if(sl==string::npos) 395 if(sl==string::npos)
411 rv += '/'; 396 rv += '/';
412 } 397 }
413 return rv; 398 return rv;
414 } 399 }
415 400
416 string consumer_t::canonicalize(const string& url) { 401 string consumer_t::canonicalize(const string& url) {
417 string rv = normalize(url); 402 string rv = normalize(url);
418 curl_t curl = curl_easy_init(); 403 util::curl_t curl = curl_easy_init();
419 if(!curl) 404 if(!curl)
420 throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()"); 405 throw exception_curl(OPKELE_CP_ "failed to curl_easy_init()");
421 string html; 406 string html;
422 CURLcode r; 407 CURLcode r;
423 (r=curl_misc_sets(curl)) 408 (r=curl_misc_sets(curl))
424 || (r=curl_easy_setopt(curl,CURLOPT_URL,rv.c_str())) 409 || (r=curl_easy_setopt(curl,CURLOPT_URL,rv.c_str()))
425 || (r=curl_easy_setopt(curl,CURLOPT_NOBODY,1)) 410 || (r=curl_easy_setopt(curl,CURLOPT_NOBODY,1))
426 ; 411 ;
427 if(r) 412 if(r)
428 throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r); 413 throw exception_curl(OPKELE_CP_ "failed to curl_easy_setopt()",r);
429 r = curl_easy_perform(curl); 414 r = curl_easy_perform(curl);
430 if(r) 415 if(r)
431 throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r); 416 throw exception_curl(OPKELE_CP_ "failed to curl_easy_perform()",r);
432 const char *eu = 0; 417 const char *eu = 0;
433 r = curl_easy_getinfo(curl,CURLINFO_EFFECTIVE_URL,&eu); 418 r = curl_easy_getinfo(curl,CURLINFO_EFFECTIVE_URL,&eu);
434 if(r) 419 if(r)
435 throw exception_curl(OPKELE_CP_ "failed to curl_easy_getinfo(..CURLINFO_EFFECTIVE_URL..)",r); 420 throw exception_curl(OPKELE_CP_ "failed to curl_easy_getinfo(..CURLINFO_EFFECTIVE_URL..)",r);
436 rv = eu; 421 rv = eu;
437 return normalize(rv); 422 return normalize(rv);
438 } 423 }
439 424
440} 425}