authserver/authd/authd.php

   1 <?php
   2
   3 // TODO: SO MUCH ERROR CHECKING ITS NOT FUNNY
   4
   5
   6 // get out master library for ga4php
   7 require_once("../lib/lib.php");
   8
   9
  10 //exit(0);
  11 // first we want to fork into the background like all good daemons should
  12 //$pid = pcntl_fork();
  13 $pid = 0;
  14
  15 if($pid == -1) {
  16
  17 } else if($pid) {
  18         // i am the parent, i shall leave
  19         echo "i am a parent, i leave\n";
  20         exit(0);
  21 } else {
  22         global $MSG_QUEUE_KEY_ID_SERVER, $MSG_QUEUE_KEY_ID_CLIENT;
  23
  24         $cl_queue = msg_get_queue($MSG_QUEUE_KEY_ID_CLIENT, 0666 | 'IPC_CREAT');
  25         $sr_queue = msg_get_queue($MSG_QUEUE_KEY_ID_SERVER, 0666 | 'IPC_CREAT');
  26
  27         $myga = new gaasGA();
  28         global $myga;
  29
  30
  31         while(true) {
  32                 msg_receive($sr_queue, 0, $msg_type, 16384, $msg);
  33                 switch($msg_type) {
  34                         case MSG_DELETE_USER_TOKEN:
  35                                 $username = $msg["username"];
  36
  37                                 $sql = "select users_otk from users where users_username='$username'";
  38                                 $dbo = getDatabase();
  39                                 $res = $dbo->query($sql);
  40                                 $otkid = "";
  41                                 foreach($res as $row) {
  42                                         $otkid = $row["users_otk"];
  43                                 }
  44                                 if($otkid!="") {
  45                                         global $BASE_DIR;
  46                                         unlink("$BASE_DIR/authserver/authd/otks/$otkid.png");
  47                                 }
  48
  49                                 $sql = "update users set users_tokendata='',users_otk='' where users_username='$username'";
  50                                 $dbo = getDatabase();
  51                                 $res = $dbo->query($sql);
  52
  53                                 msg_send($cl_queue, MSG_DELETE_USER_TOKEN, true);
  54                                 break;
  55                         case MSG_AUTH_USER_TOKEN:
  56                                 echo "Call to auth user token\n";
  57                                 // minimal checking, we leav it up to authenticateUser to do the real
  58                                 // checking
  59                                 if(!isset($msg["username"])) $msg["username"] = "";
  60                                 if(!isset($msg["passcode"])) $msg["passcode"] = "";
  61                                 $username = $msg["username"];
  62                                 $passcode = $msg["passcode"];
  63                                 global $myga;
  64                                 $authval = $myga->authenticateUser($username, $passcode);
  65                                 msg_send($cl_queue, MSG_AUTH_USER_TOKEN, $authval);
  66                                 break;
  67                         case MSG_GET_OTK_ID:
  68                                 if(!isset($msg["username"])) {
  69                                         msg_send($cl_queue, MSG_GET_OTK_ID, false);
  70                                 } else {
  71                                         $username = $msg["username"];
  72                                         $sql = "select users_otk from users where users_username='$username'";
  73                                         $dbo = getDatabase();
  74                                         $res = $dbo->query($sql);
  75                                         $otkid = "";
  76                                         foreach($res as $row) {
  77                                                 $otkid = $row["users_otk"];
  78                                         }
  79
  80                                         if($otkid == "") {
  81                                                 msg_send($cl_queue, MSG_GET_OTK_ID, false);
  82                                         } else {
  83                                                 msg_send($cl_queue, MSG_GET_OTK_ID, $otkid);
  84                                         }
  85                                 }
  86                                 break;
  87                         case MSG_GET_OTK_PNG:
  88                                 if(!isset($msg["otk"])) {
  89                                         msg_send($cl_queue, MSG_GET_OTK_PNG, false);
  90                                 } else {
  91                                         $otk = $msg["otk"];
  92                                         $sql = "select users_username from users where users_otk='$otk'";
  93                                         $dbo = getDatabase();
  94                                         $res = $dbo->query($sql);
  95                                         $username = "";
  96                                         foreach($res as $row) {
  97                                                 $username = $row["users_username"];
  98                                         }
  99
 100                                         if($username == "") {
 101                                                 msg_send($cl_queue, MSG_GET_OTK_PNG, false);
 102                                         } else if($username != $msg["username"]) {
 103                                                 msg_send($cl_queue, MSG_GET_OTK_PNG, false);
 104                                         } else {
 105                                                 global $BASE_DIR;
 106                                                 $hand = fopen("$BASE_DIR/authserver/authd/otks/$otk.png", "rb");
 107                                                 $data = fread($hand, filesize("$BASE_DIR/authserver/authd/otks/$otk.png"));
 108                                                 fclose($hand);
 109                                                 unlink("$BASE_DIR/authserver/authd/otks/$otk.png");
 110                                                 $sql = "update users set users_otk='' where users_username='$username'";
 111                                                 $dbo->query($sql);
 112                                                 error_log("senting otk, fsize: ".filesize("$BASE_DIR/authserver/authd/otks/$otk.png")." $otk ");
 113                                                 msg_send($cl_queue, MSG_GET_OTK_PNG, $data);
 114                                         }
 115                                 }
 116
 117                                 break;
 118                         case MSG_SYNC_TOKEN:
 119                                 if(!isset($msg["username"])) {
 120                                         msg_send($cl_queue, MSG_SYNC_TOKEN, false);
 121                                 } else {
 122                                         $tokenone = $msg["tokenone"];
 123                                         $tokentwo = $msg["tokentwo"];
 124
 125                                         msg_send($cl_queue,MSG_SYNC_TOKEN, $myga->resyncCode($username, $tokenone, $tokentwo));
 126                                 }
 127
 128                                 break;
 129                         case MSG_ADD_USER_TOKEN:
 130                                 echo "Call to add user token\n";
 131                                 if(!isset($msg["username"])) {
 132                                         msg_send($cl_queue, MSG_ADD_USER_TOKEN, false);
 133                                 } else {
 134                                         global $BASE_DIR;
 135                                         $username = $msg["username"];
 136                                         $tokentype="TOTP";
 137                                         if(isset($msg["tokentype"])) {
 138                                                 $tokentype=$msg["tokentype"];
 139                                         }
 140                                         $hexkey = "";
 141                                         if(isset($msg["hexkey"])) {
 142                                                 $hexkey = $msg["hexkey"];
 143                                         }
 144                                         global $myga;
 145                                         $myga->setUser($username, $tokentype, "", $hexkey);
 146
 147                                         $url = $myga->createUrl($username);
 148                                         if(!file_exists("$BASE_DIR/authserver/authd/otks")) mkdir("$BASE_DIR/authserver/authd/otks");
 149                                         $otk = generateRandomString();
 150                                         system("qrencode -o $BASE_DIR/authserver/authd/otks/$otk.png $url");
 151
 152                                         $sql = "update users set users_otk='$otk' where users_username='$username'";
 153                                         $dbo = getDatabase();
 154                                         $res = $dbo->query($sql);
 155
 156                                         msg_send($cl_queue, MSG_ADD_USER_TOKEN, true);
 157                                 }
 158                                 break;
 159                         case MSG_DELETE_USER:
 160                                 echo "Call to del user\n";
 161                                 if(!isset($msg["username"])) {
 162                                         msg_send($cl_queue, MSG_DELETE_USER, false);
 163                                 } else {
 164                                         $username = $msg["username"];
 165                                         global $myga;
 166
 167                                         $sql = "select users_otk from users where users_username='$username'";
 168                                         $dbo = getDatabase();
 169                                         $res = $dbo->query($sql);
 170                                         $otkid = "";
 171                                         foreach($res as $row) {
 172                                                 $otkid = $row["users_otk"];
 173                                         }
 174                                         if($otkid!="") {
 175                                                 unlink("otks/$otkid.png");
 176                                         }
 177
 178
 179                                         $sql = "delete from users where users_username='$username'";
 180                                         $dbo = getDatabase();
 181                                         $dbo->query($sql);
 182
 183                                         msg_send($cl_queue, MSG_DELETE_USER, true);
 184                                 }
 185                                 break;
 186                         case MSG_AUTH_USER_PASSWORD:
 187                                 // TODO
 188                                 echo "Call to auth user pass\n";
 189                                 if(!isset($msg["username"])) {
 190                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, false);
 191                                         break;
 192                                 }
 193                                 if(!isset($msg["password"])) {
 194                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, false);
 195                                         break;
 196                                 }
 197
 198                                 $username = $msg["username"];
 199                                 $password = $msg["password"];
 200                                 $sql = "select users_password from users where users_username='$username'";
 201                                 $dbo = getDatabase();
 202                                 $res = $dbo->query($sql);
 203                                 $pass = "";
 204                                 foreach($res as $row) {
 205                                         $pass = $row["users_password"];
 206                                 }
 207
 208                                 // TODO now do auth
 209                                 $ourpass = hash('sha512', $password);
 210                                 echo "ourpass: $ourpass\nourhash: $pass\n";
 211                                 if($ourpass == $pass) {
 212                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, true);
 213
 214                                 } else {
 215                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, false);
 216
 217                                 }
 218
 219                                 break;
 220                         case MSG_SET_USER_PASSWORD:
 221                                 echo "how on earth is that happening Call to set user pass, wtf?\n";
 222                                 // TODO
 223                                 print_r($msg);
 224                                 if(!isset($msg["username"])) {
 225                                         msg_send($cl_queue, MSG_SET_USER_PASSWORD, false);
 226                                         echo "in break 1\n";
 227                                         break;
 228                                 }
 229                                 if(!isset($msg["password"])) {
 230                                         msg_send($cl_queue, MSG_SET_USER_PASSWORD, false);
 231                                         echo "in break 1\n";
 232                                         break;
 233                                 }
 234
 235                                 $username = $msg["username"];
 236                                 $password = $msg["password"];
 237
 238                                 echo "would set pass for $username, to $password\n";
 239                                 if($password == "") $pass = "";
 240                                 else $pass = hash('sha512', $password);
 241
 242                                 $dbo = getDatabase();
 243                                 echo "in set user pass for $username, $pass\n";
 244                                 $sql = "update users set users_password='$pass' where users_username='$username'";
 245
 246                                 $dbo->query($sql);
 247
 248                                 msg_send($cl_queue, MSG_SET_USER_REALNAME, true);
 249
 250
 251                                 // these are irrelavent yet
 252                                 // TODO now set pass
 253                                 break;
 254                         case MSG_SET_USER_REALNAME:
 255                                 echo "Call to set user realname\n";
 256                                 // TODO
 257                                 if(!isset($msg["username"])) {
 258                                         msg_send($cl_queue, MSG_SET_USER_REALNAME, false);
 259                                         break;
 260                                 }
 261                                 if(!isset($msg["realname"])) {
 262                                         msg_send($cl_queue, MSG_SET_USER_REALNAME, false);
 263                                         break;
 264                                 }
 265
 266                                 $username = $msg["username"];
 267                                 $realname = $msg["realname"];
 268                                 $sql = "update users set users_realname='$realname' where users_username='$username'";
 269                                 $dbo = getDatabase();
 270
 271                                 $dbo->query($sql);
 272
 273                                 msg_send($cl_queue, MSG_SET_USER_REALNAME, true);
 274
 275                                 // TODO now set real name
 276                                 break;
 277                         case MSG_SET_USER_TOKEN:
 278                                 // TODO
 279                                 echo "Call to set user token\n";
 280                                 if(!isset($msg["username"])) {
 281                                         msg_send($cl_queue, MSG_SET_USER_TOKEN, false);
 282                                         break;
 283                                 }
 284                                 if(!isset($msg["tokenstring"])) {
 285                                         msg_send($cl_queue, MSG_SET_USER_TOKEN, false);
 286                                         break;
 287                                 }
 288
 289                                 global $myga;
 290                                 $username = $msg["username"];
 291                                 $token = $msg["tokenstring"];
 292                                 $return = $myga->setUserKey($username, $token);
 293                                 msg_send($cl_queue, MSG_SET_USER_TOKEN, $return);
 294
 295                                 // TODO now set token
 296                                 break;
 297                         case MSG_SET_USER_TOKEN_TYPE:
 298                                 // TODO
 299                                 echo "Call to set user token type\n";
 300                                 if(!isset($msg["username"])) {
 301                                         msg_send($cl_queue, MSG_SET_USER_TOKEN_TYPE, false);
 302                                         break;
 303                                 }
 304                                 if(!isset($msg["tokentype"])) {
 305                                         msg_send($cl_queue, MSG_SET_USER_TOKEN_TYPE, false);
 306                                         break;
 307                                 }
 308
 309                                 $username = $msg["username"];
 310                                 $tokentype = $msg["tokentype"];
 311                                 global $myga;
 312                                 msg_send($cl_queue, MSG_SET_USER_TOKEN_TYPE, $myga->setTokenType($username, $tokentype));
 313
 314                                 // TODO now set token
 315                                 break;
 316                         case MSG_GET_USERS:
 317                                 // TODO this needs to be better
 318                                 $sql = "select * from users";
 319
 320                                 $dbo = getDatabase();
 321                                 $res = $dbo->query($sql);
 322
 323                                 $users = "";
 324                                 $i = 0;
 325                                 foreach($res as $row) {
 326                                         $users[$i]["username"] = $row["users_username"];
 327                                         $users[$i]["realname"] = $row["users_realname"];
 328                                         if($row["users_password"]!="") {
 329                                                 $users[$i]["haspass"] = true;
 330                                         } else {
 331                                                 $users[$i]["haspass"] = false;
 332                                         }
 333                                         echo "user: ".$users[$i]["username"]." has tdata: \"".$row["users_tokendata"]."\"\n";
 334                                         if($row["users_tokendata"]!="") {
 335                                                 $users[$i]["hastoken"] = true;
 336                                         } else {
 337                                                 $users[$i]["hastoken"] = false;
 338                                         }
 339
 340                                         if($row["users_otk"]!="") {
 341                                                 $users[$i]["otk"] = $row["users_otk"];
 342                                         } else {
 343                                                 $users[$i]["otk"] = "";
 344                                         }
 345                                         $i++;
 346                                 }
 347                                 msg_send($cl_queue, MSG_GET_USERS, $users);
 348
 349                                 // TODO now set token
 350                                 break;
 351
 352                 }
 353         }
 354 }
 355
 356 ?>