{ print json_encode( array( 'response' => 'error', 'cause' => 'config-error' ) ); exit; }
/*******************************/
-function check_authkey ( $key )
+function apikey_verify( $key )
{
- global $config;
- if ( $key == "6327c08b70f9" ) return true;
+ if ( $key == "6327c08b70f9" ) return 1;
return false;
-
}
-function new_key( )
+function new_key( $hex = false )
{
// Basically this is at the moment a slightly modified
// version of generate_password() from user_functiions.php
$string = "";
while ( strlen( $string ) < $length )
{
- $string .= crypt( substr(sha1(rand()), 0, $length) );
- $string = preg_replace( '/\W/', '', $string);
+ if ( $hex )
+ $string .= substr(md5(rand().rand()), 0, $length);
+ else
+ {
+ $string .= crypt( substr(sha1(rand()), 0, $length) );
+ $string = preg_replace( '/\W/', '', $string);
+ }
}
return substr( $string, 0, $length );
}
{
global $_GET;
- if ( array_key_exists('auth_key', $_GET ) )
- { if ( ! check_authkey($_GET['auth_key'] ) ) simple_authfail(); }
+ // TODO: Part of ping/pong requirement.
+ // Run a function to clear all authkeys older than 5 minutes.
+ expire_authkeys();
+
+ if ( array_key_exists('session', $_GET )
+ && array_key_exists('auth_key', $_GET ) )
+ {
+ if ( ! check_session($_GET['session'] ) ) simple_authfail();
+ if ( ! check_authkey($_GET['auth_key'] ) ) simple_authfail();
+ }
else simple_authfail();
}
+function get_cookie_path ()
+{
+ $name = $_SERVER["SCRIPT_NAME"];
+ $file = basename($name);
+ $path = preg_replace("/".$file."/", "", $name);
+ return $path;
+
+}
+
+function check_authkey ( $key )
+{
+ // TODO: Make real, actual checks...
+ if ( $key ) return true;
+ return false;
+}
+
+function expire_authkeys()
+{
+ global $config;
+
+ // Force deletion of sessions that have expired keys.
+ $query = sprintf("SELECT session, sessid FROM %s WHERE `last` < DATE_SUB( NOW(), INTERVAL %d MINUTE)",
+ $config['sessionkeys_table'],
+ $config['sessionkey_lifetime']);
+ $result = sql_dbquery( $config['provision_db'], $query );
+ while ( $row = @mysql_fetch_row( $result ) )
+ {
+ remove_session( $row[0], $row[1] );
+ }
+
+ $query = sprintf("DELETE FROM %s WHERE `last` < DATE_SUB( NOW(), INTERVAL %d MINUTE)",
+ $config['sessionkeys_table'],
+ $config['sessionkey_lifetime']);
+
+ sql_dbexec( $config['provision_db'], $query );
+}
+
+function update_authkey ( $session, $authid )
+{
+ global $config;
+
+ $key = substr(new_key(), 0, 8);
+
+ expire_authkeys();
+
+ // TODO: Refresh cookie
+
+ $remote = $_SERVER['REMOTE_ADDR'];
+ $query = sprintf("INSERT INTO %s ( `sessid`, `session`, `authid`, `client`, `key`, `last` )
+ VALUES ( '%s', '%s', '%s', '%s', '%s', NOW() )
+ ON DUPLICATE KEY UPDATE `key` = '%s', `last` = NOW()",
+ $config['sessionkeys_table'],
+ session_id(),
+ session_name(),
+ sql_clean($authid),
+ sql_clean($remote),
+ sql_clean($key),
+ sql_clean($key));
+ if ( ! sql_dbexec( $config['provision_db'], $query ) )
+ {
+ mysql_error();
+ }
+ $_SESSION['kkey'] = $key;
+ $_SESSION['when'] = time();
+ return $key;
+}
+
+function check_session ( $name )
+{
+ session_name( $name );
+ session_start();
+ if ( ! $_SESSION['authid'] )
+ {
+ return clear_credentials($name);
+ }
+ if ( ! $_COOKIE['client_key'] )
+ {
+ return clear_credentials($name);
+ }
+
+ $authid = $_SESSION['authid'];
+ $type = $_SESSION['type'];
+ $client_key = $_COOKIE['client_key'];
+
+ $level = get_authorization( $type, $authid );
+ if ( $level == false )
+ {
+ return clear_credentials($name);
+ }
+
+ $session_key = md5( $name . $authid );
+ if ( $client_key != $session_key )
+ {
+ return clear_credentials($name);
+ }
+
+ // If we got this far, things are looking good.
+ return true;
+}
+
+function set_credentials( $authid, $type )
+{
+ $name = new_key(true);
+ session_name( $name );
+ session_start();
+ $_SESSION['authid'] = $authid;
+ $_SESSION['type'] = $type;
+
+ $client_key = md5( $name . $authid );
+ setcookie('client_key', $client_key, time()+180*60, get_cookie_path() );
+
+ return $name;
+}
+
+function clear_credentials($name)
+{
+ global $config;
+
+ setcookie('client_key', '', 0, get_cookie_path() );
+
+ remove_session($name);
+ $_SESSION = array();
+
+ $query = sprintf("DELETE FROM %s WHERE `session` = '%s'",
+ $config['sessionkeys_table'],
+ sql_clean($name));
+ sql_dbexec( $config['provision_db'], $query );
+
+ return false;
+}
+
+function remove_session ($name, $id = null )
+{
+ if ( $id == null )
+ {
+ session_destroy();
+ setcookie($name, '', 0, "/");
+ return;
+ }
+ $current_session = session_name( );
+ $current_sessid = session_id( );
+ session_commit();
+
+ session_id( $id );
+ session_start();
+ setcookie( $name, '', 0, "/");
+ $_SESSION=array();
+ session_destroy();
+
+ if ( $current_session != $name )
+ {
+ session_id($current_sessid);
+ session_start();
+ }
+}
+
+function get_authorization()
+{
+ return 1;
+}
function can_write ( )
{
- // Stub, to be called on any API nodes taht write data in the DB.
+ // Stub, to be called on any API nodes that write data in the DB.
+ $authid = $_SESSION['authid'];
+ $type = $_SESSION['type'];
+ $level = get_authorization( $type, $authid );
return true;
}
git.defcon.no / hermes / blobdiff