authserver/authd/authd.php

   1 <?php
   2
   3 // TODO: SO MUCH ERROR CHECKING ITS NOT FUNNY
   4
   5 if(file_exists("config.php")) {
   6         require_once("config.php");
   7 } else {
   8         // config file doesnt exist, we must abort sensibly
   9 }
  10
  11 // get out master library for ga4php
  12 require_once("../lib/lib.php");
  13
  14
  15 //exit(0);
  16 // first we want to fork into the background like all good daemons should
  17 //$pid = pcntl_fork();
  18 $pid = 0;
  19
  20 if($pid == -1) {
  21
  22 } else if($pid) {
  23         // i am the parent, i shall leave
  24         echo "i am a parent, i leave\n";
  25         exit(0);
  26 } else {
  27         global $MSG_QUEUE_KEY_ID_SERVER, $MSG_QUEUE_KEY_ID_CLIENT;
  28
  29         $cl_queue = msg_get_queue($MSG_QUEUE_KEY_ID_CLIENT, 0666 | 'IPC_CREAT');
  30         $sr_queue = msg_get_queue($MSG_QUEUE_KEY_ID_SERVER, 0666 | 'IPC_CREAT');
  31
  32         $myga = new gaasGA();
  33         global $myga;
  34
  35
  36         while(true) {
  37                 msg_receive($sr_queue, 0, $msg_type, 16384, $msg);
  38                 switch($msg_type) {
  39                         case MSG_DELETE_USER_TOKEN:
  40                                 $username = $msg["username"];
  41
  42                                 $sql = "select users_otk from users where users_username='$username'";
  43                                 $dbo = getDatabase();
  44                                 $res = $dbo->query($sql);
  45                                 $otkid = "";
  46                                 foreach($res as $row) {
  47                                         $otkid = $row["users_otk"];
  48                                 }
  49                                 if($otkid!="") {
  50                                         unlink("otks/$otkid.png");
  51                                 }
  52
  53                                 $sql = "update users set users_tokendata='',users_otk='' where users_username='$username'";
  54                                 $dbo = getDatabase();
  55                                 $res = $dbo->query($sql);
  56
  57                                 msg_send($cl_queue, MSG_DELETE_USER_TOKEN, true);
  58                                 break;
  59                         case MSG_AUTH_USER_TOKEN:
  60                                 echo "Call to auth user token\n";
  61                                 // minimal checking, we leav it up to authenticateUser to do the real
  62                                 // checking
  63                                 if(!isset($msg["username"])) $msg["username"] = "";
  64                                 if(!isset($msg["passcode"])) $msg["passcode"] = "";
  65                                 $username = $msg["username"];
  66                                 $passcode = $msg["passcode"];
  67                                 global $myga;
  68                                 $authval = $myga->authenticateUser($username, $passcode);
  69                                 msg_send($cl_queue, MSG_AUTH_USER_TOKEN, $authval);
  70                                 break;
  71                         case MSG_GET_OTK_ID:
  72                                 if(!isset($msg["username"])) {
  73                                         msg_send($cl_queue, MSG_GET_OTK_ID, false);
  74                                 } else {
  75                                         $username = $msg["username"];
  76                                         $sql = "select users_otk from users where users_username='$username'";
  77                                         $dbo = getDatabase();
  78                                         $res = $dbo->query($sql);
  79                                         $otkid = "";
  80                                         foreach($res as $row) {
  81                                                 $otkid = $row["users_otk"];
  82                                         }
  83
  84                                         if($otkid == "") {
  85                                                 msg_send($cl_queue, MSG_GET_OTK_ID, false);
  86                                         } else {
  87                                                 msg_send($cl_queue, MSG_GET_OTK_ID, $otkid);
  88                                         }
  89                                 }
  90                                 break;
  91                         case MSG_GET_OTK_PNG:
  92                                 if(!isset($msg["otk"])) {
  93                                         msg_send($cl_queue, MSG_GET_OTK_PNG, false);
  94                                 } else {
  95                                         $otk = $msg["otk"];
  96                                         $sql = "select users_username from users where users_otk='$otk'";
  97                                         $dbo = getDatabase();
  98                                         $res = $dbo->query($sql);
  99                                         $username = "";
 100                                         foreach($res as $row) {
 101                                                 $username = $row["users_username"];
 102                                         }
 103
 104                                         if($username == "") {
 105                                                 msg_send($cl_queue, MSG_GET_OTK_PNG, false);
 106                                         } else if($username != $msg["username"]) {
 107                                                 msg_send($cl_queue, MSG_GET_OTK_PNG, false);
 108                                         } else {
 109                                                 $hand = fopen("otks/$otk.png", "rb");
 110                                                 $data = fread($hand, filesize("otks/$otk.png"));
 111                                                 fclose($hand);
 112                                                 unlink("otks/$otk.png");
 113                                                 $sql = "update users set users_otk='' where users_username='$username'";
 114                                                 $dbo->query($sql);
 115                                                 error_log("senting otk, fsize: ".filesize("otks/$otk.png")." $otk ");
 116                                                 msg_send($cl_queue, MSG_GET_OTK_PNG, $data);
 117                                         }
 118                                 }
 119
 120                                 break;
 121                         case MSG_ADD_USER_TOKEN:
 122                                 echo "Call to add user token\n";
 123                                 if(!isset($msg["username"])) {
 124                                         msg_send($cl_queue, MSG_ADD_USER_TOKEN, false);
 125                                 } else {
 126                                         $username = $msg["username"];
 127                                         $tokentype="HOTP";
 128                                         if(isset($msg["tokentype"])) {
 129                                                 $tokentype=$msg["tokentype"];
 130                                         }
 131                                         $hexkey = "";
 132                                         if(isset($msg["hexkey"])) {
 133                                                 $hexkey = $msg["hexkey"];
 134                                         }
 135                                         global $myga;
 136                                         $myga->setUser($username, $tokentype, "", $hexkey);
 137
 138                                         $url = $myga->createUrl($username);
 139                                         mkdir("otks");
 140                                         $otk = generateRandomString();
 141                                         system("qrencode -o otks/$otk.png $url");
 142
 143                                         $sql = "update users set users_otk='$otk' where users_username='$username'";
 144                                         $dbo = getDatabase();
 145                                         $res = $dbo->query($sql);
 146
 147                                         msg_send($cl_queue, MSG_ADD_USER_TOKEN, true);
 148                                 }
 149                                 break;
 150                         case MSG_DELETE_USER:
 151                                 echo "Call to del user\n";
 152                                 if(!isset($msg["username"])) {
 153                                         msg_send($cl_queue, MSG_DELETE_USER, false);
 154                                 } else {
 155                                         $username = $msg["username"];
 156                                         global $myga;
 157
 158                                         $sql = "select users_otk from users where users_username='$username'";
 159                                         $dbo = getDatabase();
 160                                         $res = $dbo->query($sql);
 161                                         $otkid = "";
 162                                         foreach($res as $row) {
 163                                                 $otkid = $row["users_otk"];
 164                                         }
 165                                         if($otkid!="") {
 166                                                 unlink("otks/$otkid.png");
 167                                         }
 168
 169
 170                                         $sql = "delete from users where users_username='$username'";
 171                                         $dbo = getDatabase();
 172                                         $dbo->query($sql);
 173
 174                                         msg_send($cl_queue, MSG_DELETE_USER, true);
 175                                 }
 176                                 break;
 177                         case MSG_AUTH_USER_PASSWORD:
 178                                 // TODO
 179                                 echo "Call to auth user pass\n";
 180                                 if(!isset($msg["username"])) {
 181                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, false);
 182                                         break;
 183                                 }
 184                                 if(!isset($msg["password"])) {
 185                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, false);
 186                                         break;
 187                                 }
 188
 189                                 $username = $msg["username"];
 190                                 $password = $msg["password"];
 191                                 $sql = "select users_password from users where users_username='$username'";
 192                                 $dbo = getDatabase();
 193                                 $res = $dbo->query($sql);
 194                                 $pass = "";
 195                                 foreach($res as $row) {
 196                                         $pass = $row["users_password"];
 197                                 }
 198
 199                                 // TODO now do auth
 200                                 $ourpass = hash('sha512', $password);
 201                                 echo "ourpass: $ourpass\nourhash: $pass\n";
 202                                 if($ourpass == $pass) {
 203                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, true);
 204
 205                                 } else {
 206                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, false);
 207
 208                                 }
 209
 210                                 break;
 211                         case MSG_SET_USER_PASSWORD:
 212                                 echo "how on earth is that happening Call to set user pass, wtf?\n";
 213                                 // TODO
 214                                 print_r($msg);
 215                                 if(!isset($msg["username"])) {
 216                                         msg_send($cl_queue, MSG_SET_USER_PASSWORD, false);
 217                                         echo "in break 1\n";
 218                                         break;
 219                                 }
 220                                 if(!isset($msg["password"])) {
 221                                         msg_send($cl_queue, MSG_SET_USER_PASSWORD, false);
 222                                         echo "in break 1\n";
 223                                         break;
 224                                 }
 225
 226                                 $username = $msg["username"];
 227                                 $password = $msg["password"];
 228
 229                                 echo "would set pass for $username, to $password\n";
 230                                 if($password == "") $pass = "";
 231                                 else $pass = hash('sha512', $password);
 232
 233                                 $dbo = getDatabase();
 234                                 echo "in set user pass for $username, $pass\n";
 235                                 $sql = "update users set users_password='$pass' where users_username='$username'";
 236
 237                                 $dbo->query($sql);
 238
 239                                 msg_send($cl_queue, MSG_SET_USER_REALNAME, true);
 240
 241
 242                                 // these are irrelavent yet
 243                                 // TODO now set pass
 244                                 break;
 245                         case MSG_SET_USER_REALNAME:
 246                                 echo "Call to set user realname\n";
 247                                 // TODO
 248                                 if(!isset($msg["username"])) {
 249                                         msg_send($cl_queue, MSG_SET_USER_REALNAME, false);
 250                                         break;
 251                                 }
 252                                 if(!isset($msg["realname"])) {
 253                                         msg_send($cl_queue, MSG_SET_USER_REALNAME, false);
 254                                         break;
 255                                 }
 256
 257                                 $username = $msg["username"];
 258                                 $realname = $msg["realname"];
 259                                 $sql = "update users set users_realname='$realname' where users_username='$username'";
 260                                 $dbo = getDatabase();
 261
 262                                 $dbo->query($sql);
 263
 264                                 msg_send($cl_queue, MSG_SET_USER_REALNAME, true);
 265
 266                                 // TODO now set real name
 267                                 break;
 268                         case MSG_SET_USER_TOKEN:
 269                                 // TODO
 270                                 echo "Call to set user token\n";
 271                                 if(!isset($msg["username"])) {
 272                                         msg_send($cl_queue, MSG_SET_USER_TOKEN, false);
 273                                         break;
 274                                 }
 275                                 if(!isset($msg["tokenstring"])) {
 276                                         msg_send($cl_queue, MSG_SET_USER_TOKEN, false);
 277                                         break;
 278                                 }
 279
 280                                 global $myga;
 281                                 $username = $msg["username"];
 282                                 $token = $msg["tokenstring"];
 283                                 $return = $myga->setUserKey($username, $token);
 284                                 msg_send($cl_queue, MSG_SET_USER_TOKEN, $return);
 285
 286                                 // TODO now set token
 287                                 break;
 288                         case MSG_SET_USER_TOKEN_TYPE:
 289                                 // TODO
 290                                 echo "Call to set user token type\n";
 291                                 if(!isset($msg["username"])) {
 292                                         msg_send($cl_queue, MSG_SET_USER_TOKEN_TYPE, false);
 293                                         break;
 294                                 }
 295                                 if(!isset($msg["tokentype"])) {
 296                                         msg_send($cl_queue, MSG_SET_USER_TOKEN_TYPE, false);
 297                                         break;
 298                                 }
 299
 300                                 $username = $msg["username"];
 301                                 $tokentype = $msg["tokentype"];
 302                                 global $myga;
 303                                 msg_send($cl_queue, MSG_SET_USER_TOKEN_TYPE, $myga->setTokenType($username, $tokentype));
 304
 305                                 // TODO now set token
 306                                 break;
 307                         case MSG_GET_USERS:
 308                                 // TODO this needs to be better
 309                                 $sql = "select * from users";
 310
 311                                 $dbo = getDatabase();
 312                                 $res = $dbo->query($sql);
 313
 314                                 $users = "";
 315                                 $i = 0;
 316                                 foreach($res as $row) {
 317                                         $users[$i]["username"] = $row["users_username"];
 318                                         $users[$i]["realname"] = $row["users_realname"];
 319                                         if($row["users_password"]!="") {
 320                                                 $users[$i]["haspass"] = true;
 321                                         } else {
 322                                                 $users[$i]["haspass"] = false;
 323                                         }
 324                                         echo "user: ".$users[$i]["username"]." has tdata: \"".$row["users_tokendata"]."\"\n";
 325                                         if($row["users_tokendata"]!="") {
 326                                                 $users[$i]["hastoken"] = true;
 327                                         } else {
 328                                                 $users[$i]["hastoken"] = false;
 329                                         }
 330
 331                                         if($row["users_otk"]!="") {
 332                                                 $users[$i]["otk"] = $row["users_otk"];
 333                                         } else {
 334                                                 $users[$i]["otk"] = "";
 335                                         }
 336                                         $i++;
 337                                 }
 338                                 msg_send($cl_queue, MSG_GET_USERS, $users);
 339
 340                                 // TODO now set token
 341                                 break;
 342
 343                 }
 344         }
 345 }
 346
 347 ?>