X-Git-Url: https://git.defcon.no/?a=blobdiff_plain;f=api%2Flib%2Fauth_base.php;h=5f517714062682c59282baba9df03edc41d8b1cc;hb=f3015bf71883bd725cda73203e04367789d917d2;hp=ae8a5ebf9989bdea71d30417757d3a03a1252f6c;hpb=ad1d2910ca34f0d69be10b637a4294a400beceb8;p=hermes

diff --git a/api/lib/auth_base.php b/api/lib/auth_base.php
index ae8a5eb..5f51771 100644
--- a/api/lib/auth_base.php
+++ b/api/lib/auth_base.php
@@ -15,15 +15,13 @@ else
 {  print json_encode( array( 'response' => 'error', 'cause' => 'config-error' ) ); exit; }
 /*******************************/
 
-function check_authkey ( $key )
+function apikey_verify( $key )
 {
-	global $config;
-	if ( $key == "6327c08b70f9" ) return true;
+	if ( $key == "6327c08b70f9" ) return 1;
 	return false;
-
 }
 
-function new_key(  )
+function new_key( $hex = false )
 {
 	// Basically this is at the moment a slightly modified
 	// version of generate_password() from user_functiions.php
@@ -33,8 +31,13 @@ function new_key(  )
 	$string = "";
 	 while ( strlen( $string ) < $length )
 	 {
-		$string .= crypt( substr(sha1(rand()), 0, $length) );
-		$string = preg_replace( '/\W/', '', $string);
+		if ( $hex )
+			$string .= substr(md5(rand().rand()), 0, $length);
+		else
+		{
+			$string .= crypt( substr(sha1(rand()), 0, $length) );
+			$string = preg_replace( '/\W/', '', $string);
+		}
 	 }
 	return substr( $string, 0, $length );
 }
@@ -49,14 +52,185 @@ function token_auth( )
 {
 	global $_GET;
 
-	if ( array_key_exists('auth_key', $_GET ) )
-	{ if ( ! check_authkey($_GET['auth_key'] ) ) simple_authfail(); }
+	// TODO: Part of ping/pong requirement.
+	// Run a function to clear all authkeys older than 5 minutes.
+	expire_authkeys();
+
+	if ( array_key_exists('session', $_GET ) 
+	     && array_key_exists('auth_key', $_GET ) )
+	{ 
+		if ( ! check_session($_GET['session'] ) ) simple_authfail();
+		if ( ! check_authkey($_GET['auth_key'] ) ) simple_authfail(); 
+	}
 	else simple_authfail();
 }
 
+function get_cookie_path ()
+{
+	$name = $_SERVER["SCRIPT_NAME"];
+	$file = basename($name);
+	$path = preg_replace("/".$file."/", "", $name);
+	return $path;
+
+}
+
+function check_authkey ( $key )
+{
+	// TODO: Make real, actual checks...
+	if ( $key ) return true;
+	return false;
+}
+
+function expire_authkeys()
+{
+	global $config;
+
+	// Force deletion of sessions that have expired keys.
+	$query = sprintf("SELECT session, sessid FROM %s WHERE `last` < DATE_SUB( NOW(), INTERVAL %d MINUTE)",
+		$config['sessionkeys_table'],
+		$config['sessionkey_lifetime']);
+	$result = sql_dbquery( $config['provision_db'], $query );
+	while ( $row = @mysql_fetch_row( $result ) )
+	{
+		remove_session( $row[0], $row[1] );
+	}
+
+	$query = sprintf("DELETE FROM %s WHERE `last` < DATE_SUB( NOW(), INTERVAL %d MINUTE)",
+		$config['sessionkeys_table'],
+		$config['sessionkey_lifetime']);
+
+	sql_dbexec( $config['provision_db'], $query );
+}
+
+function update_authkey ( $session, $authid )
+{
+	global $config;
+
+	$key = substr(new_key(), 0, 8);
+
+	expire_authkeys();
+
+	// TODO: Refresh cookie
+
+	$remote = $_SERVER['REMOTE_ADDR'];
+	$query = sprintf("INSERT INTO %s ( `sessid`, `session`, `authid`, `client`, `key`, `last` )
+				VALUES ( '%s', '%s', '%s', '%s', '%s', NOW() )
+				ON DUPLICATE KEY UPDATE `key` = '%s', `last` = NOW()",
+		$config['sessionkeys_table'],
+		session_id(),
+		session_name(),
+		sql_clean($authid),
+		sql_clean($remote),
+		sql_clean($key),
+		sql_clean($key));
+	if ( ! sql_dbexec( $config['provision_db'], $query ) )
+	{
+		mysql_error();
+	}
+	$_SESSION['kkey'] = $key;
+	$_SESSION['when'] = time();
+	return $key;
+}
+
+function check_session ( $name )
+{
+	session_name( $name );
+	session_start();
+	if ( ! $_SESSION['authid'] )
+	{
+		return clear_credentials($name);
+	}
+	if ( ! $_COOKIE['client_key'] )
+	{
+		return clear_credentials($name);
+	}
+
+	$authid = $_SESSION['authid'];
+	$type   = $_SESSION['type'];
+	$client_key = $_COOKIE['client_key'];
+
+	$level = get_authorization( $type, $authid );
+	if ( $level == false )
+	{
+		return clear_credentials($name);
+	}
+
+	$session_key = md5( $name . $authid );
+	if ( $client_key != $session_key )
+	{
+		return clear_credentials($name);
+	}
+
+	// If we got this far, things are looking good.
+	return true;
+}
+
+function set_credentials( $authid, $type )
+{
+	$name = new_key(true);
+	session_name( $name );
+	session_start();
+	$_SESSION['authid'] = $authid;
+	$_SESSION['type']   = $type;
+
+	$client_key  = md5( $name . $authid );
+	setcookie('client_key', $client_key, time()+180*60, get_cookie_path() );
+
+	return $name;
+}
+
+function clear_credentials($name)
+{
+	global $config;
+
+	setcookie('client_key', '', 0, get_cookie_path() );
+
+	remove_session($name);
+	$_SESSION = array();
+
+	$query = sprintf("DELETE FROM %s WHERE `session` = '%s'",
+		$config['sessionkeys_table'],
+		sql_clean($name));
+	sql_dbexec( $config['provision_db'], $query );
+
+	return false;
+}
+
+function remove_session ($name, $id = null )
+{
+	if ( $id == null )
+	{
+		session_destroy();
+		setcookie($name, '', 0, "/");
+		return;
+	}
+	$current_session = session_name( );
+	$current_sessid = session_id( );
+	session_commit();
+
+	session_id( $id );
+	session_start();
+	setcookie( $name, '', 0, "/");
+	$_SESSION=array();
+	session_destroy();
+
+	if ( $current_session != $name )
+	{
+		session_id($current_sessid);
+		session_start();
+	}
+}
+
+function get_authorization()
+{
+	return 1;
+}
 function can_write ( )
 {
-	// Stub, to be called on any API nodes taht write data in the DB.
+	// Stub, to be called on any API nodes that write data in the DB.
+	$authid = $_SESSION['authid'];
+	$type   = $_SESSION['type'];
+	$level = get_authorization( $type, $authid );
 	return true;
 }