authserver/authd/authd.php

   1 <?php
   2
   3 // TODO: SO MUCH ERROR CHECKING ITS NOT FUNNY
   4
   5
   6 // get out master library for ga4php
   7 require_once("../lib/lib.php");
   8
   9
  10 //exit(0);
  11 // first we want to fork into the background like all good daemons should
  12 //$pid = pcntl_fork();
  13
  14 // uncomment this bit and comment the fork above to stop it going into the background
  15 $pid = 0;
  16
  17 if($pid == -1) {
  18
  19 } else if($pid) {
  20         // i am the parent, i shall leave
  21         echo "i am a parent, i leave\n";
  22         exit(0);
  23 } else {
  24         // here is where i need to swithc to TCP network protocol stuff
  25         // i must bind 127.0.0.1 though.
  26         // what i want to happen is this:
  27         // 1) server receives connection
  28         // 2) server forks off process to process connection
  29         // 3) main server continues.
  30         // a forked process thingy should be fully self contained and capable of dealing
  31         // with "problems", i.e. the parent doesnt want to have to clean up children
  32         global $MSG_QUEUE_KEY_ID_SERVER, $MSG_QUEUE_KEY_ID_CLIENT;
  33         global $TCP_PORT_NUMBER;
  34
  35         $cl_queue = msg_get_queue($MSG_QUEUE_KEY_ID_CLIENT, 0666 | 'IPC_CREAT');
  36         $sr_queue = msg_get_queue($MSG_QUEUE_KEY_ID_SERVER, 0666 | 'IPC_CREAT');
  37
  38         // Here goes the tcp equivalent
  39         /*
  40         $res = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
  41         socket_bind($res, "127.0.0.1", 10056);
  42         socket_listen($res);
  43
  44         while(true) {
  45                 $data_socket = socket_accept($res);
  46                 // now i fork
  47                 $forked = pcntl_fork();
  48
  49                 // TODO: DEAL WITH THIS PROPERLY
  50                 if($forked == -1) {
  51                         echo "Failed to fork\n";
  52                 } else if(!$forked) {
  53                         // I am the child, i process the request
  54                         // all the shit down below goes in here
  55                         $recvd = "";
  56                         $continue = true;
  57                         while($continue) {
  58                                 $size = socket_recv($data_socket, $recvd_a, 1024, 0);
  59                                 $recvd .= $recvd_a;
  60                                 if(preg_match("/.*\:EOD$/", $recvd) {
  61                                         // we have a full string... break out
  62                                         $continue = false;
  63                                         break;
  64                                 }
  65                         }
  66
  67                         $myga = new gaasGA();
  68
  69                         $xps = explode(":", $recvd);
  70                         $component =  unserialize(base64_decode($xps[1]));
  71                         $msg_type = $component["type"];
  72                         $msg = $component["data"];
  73
  74                         // the switch should now set a $data_returned value that gets bundled up and sent back to the client
  75                         // HERES WHERE THE SWITCH GOES
  76                         // ******
  77                         switch($msg_type) {
  78                                 case MSG_GET_RADIUS_CLIENTS:
  79                                         $sql = "select * from radclients";
  80                                         $dbo = getDatabase();
  81                                         $res = $dbo->query($sql);
  82                                         $clients = "";
  83                                         $i=0;
  84                                         foreach($res as $row) {
  85                                                 //              $sql = 'CREATE TABLE "radclients" ("rad_id" INTEGER PRIMARY KEY AUTOINCREMENT,"rad_name" TEXT, "rad_ip" TEXT, "rad_secret" TEXT, "rad_desc" TEXT);';
  86                                                 $clients[$i]["name"] = $row["rad_name"];
  87                                                 $clients[$i]["ip"] = $row["rad_ip"];
  88                                                 $clients[$i]["secret"] = $row["rad_secret"];
  89                                                 $clients[$i]["desc"] = $row["rad_desc"];
  90                                                 $i++;
  91                                         }
  92                                         $data_returned = $clients;
  93                                         break;
  94                                 case MSG_REMOVE_RADIUS_CLIENT:
  95                                         // it should send us a client by rad_name - doesnt work yet
  96                                         $client = $msg["clientname"];
  97                                         $sql = "delete from radclients where rad_name='$client'";
  98                                         $dbo = getDatabase();
  99                                         $res = $dbo->query($sql);
 100                                         updateRadius();
 101                                         $data_returned = true;
 102                                         break;
 103                                 case MSG_ADD_RADIUS_CLIENT:
 104                                         echo "in addradclient\n";
 105                                         $client = $msg["clientname"];
 106                                         $clientsecret = $msg["clientsecret"];
 107                                         $clientip = $msg["clientip"];
 108                                         $clientdesc = $msg["clientdescription"];
 109                                         $dbo = getDatabase();
 110
 111                                         // check for existing clients with same name
 112                                         $sql = "select * from radclients where rad_name='$client'";
 113                                         echo "doing select, $sql\n";
 114                                         $res = $dbo->query($sql);
 115                                         if($res->fetchColumn() > 0) {
 116                                                 $data_returned = "name";
 117
 118                                         } else {
 119                                                 // check for existing clients with same ip
 120                                                 $sql = "select * from radclients where rad_ip='$clientip'";
 121                                                 $res = $dbo->query($sql);
 122                                                 echo "doing select, $sql\n";
 123                                                 if($res->fetchColumn() > 0) {
 124                                                         $data_returned = "ip";
 125
 126                                                 } else {
 127                                                         $sql = "insert into radclients values (NULL, '$client', '$clientip', '$clientsecret', '$clientdesc')";
 128                                                         $res = $dbo->query($sql);
 129                                                         updateRadius();
 130                                                         $data_returned = true;
 131                                                         break;
 132                                                 }
 133                                         }
 134                                         break;
 135                                 case MSG_DELETE_USER_TOKEN:
 136                                         $username = $msg["username"];
 137
 138                                         $sql = "select users_otk from users where users_username='$username'";
 139                                         $dbo = getDatabase();
 140                                         $res = $dbo->query($sql);
 141                                         $otkid = "";
 142                                         foreach($res as $row) {
 143                                                 $otkid = $row["users_otk"];
 144                                         }
 145                                         if($otkid!="") {
 146                                                 global $BASE_DIR;
 147                                                 unlink("$BASE_DIR/authserver/authd/otks/$otkid.png");
 148                                         }
 149
 150                                         $sql = "update users set users_tokendata='',users_otk='' where users_username='$username'";
 151                                         $dbo = getDatabase();
 152                                         $res = $dbo->query($sql);
 153
 154                                         $data_returned = true;
 155                                         break;
 156                                 case MSG_AUTH_USER_TOKEN:
 157                                         echo "Call to auth user token\n";
 158                                         // minimal checking, we leav it up to authenticateUser to do the real
 159                                         // checking
 160                                         if(!isset($msg["username"])) $msg["username"] = "";
 161                                         if(!isset($msg["passcode"])) $msg["passcode"] = "";
 162                                         $username = $msg["username"];
 163                                         $passcode = $msg["passcode"];
 164                                         global $myga;
 165                                         $authval = $myga->authenticateUser($username, $passcode);
 166                                         $data_returned = $authval;
 167                                         break;
 168                                 case MSG_GET_OTK_ID:
 169                                         if(!isset($msg["username"])) {
 170                                                 msg_send($cl_queue, MSG_GET_OTK_ID, false);
 171                                         } else {
 172                                                 $username = $msg["username"];
 173                                                 $sql = "select users_otk from users where users_username='$username'";
 174                                                 $dbo = getDatabase();
 175                                                 $res = $dbo->query($sql);
 176                                                 $otkid = "";
 177                                                 foreach($res as $row) {
 178                                                         $otkid = $row["users_otk"];
 179                                                 }
 180
 181                                                 if($otkid == "") {
 182                                                         $data_returned = false;
 183                                                 } else {
 184                                                         $data_returned = $otkid;
 185                                                 }
 186                                         }
 187                                         break;
 188                                 case MSG_GET_OTK_PNG:
 189                                         if(!isset($msg["otk"])) {
 190                                                 msg_send($cl_queue, MSG_GET_OTK_PNG, false);
 191                                         } else {
 192                                                 $otk = $msg["otk"];
 193                                                 $sql = "select users_username from users where users_otk='$otk'";
 194                                                 $dbo = getDatabase();
 195                                                 $res = $dbo->query($sql);
 196                                                 $username = "";
 197                                                 foreach($res as $row) {
 198                                                         $username = $row["users_username"];
 199                                                 }
 200
 201                                                 if($username == "") {
 202                                                         $data_returned = false;
 203
 204                                                 } else if($username != $msg["username"]) {
 205                                                         $data_returned = false;
 206                                                 } else {
 207                                                         global $BASE_DIR;
 208                                                         $hand = fopen("$BASE_DIR/authserver/authd/otks/$otk.png", "rb");
 209                                                         $data = fread($hand, filesize("$BASE_DIR/authserver/authd/otks/$otk.png"));
 210                                                         fclose($hand);
 211                                                         unlink("$BASE_DIR/authserver/authd/otks/$otk.png");
 212                                                         $sql = "update users set users_otk='' where users_username='$username'";
 213                                                         $dbo->query($sql);
 214                                                         error_log("senting otk, fsize: ".filesize("$BASE_DIR/authserver/authd/otks/$otk.png")." $otk ");
 215                                                         $data_returned = $data;
 216                                                 }
 217                                         }
 218
 219                                         break;
 220                                 case MSG_SYNC_TOKEN:
 221                                         if(!isset($msg["username"])) {
 222                                                 $data_returned = false;
 223                                         } else {
 224                                                 $tokenone = $msg["tokenone"];
 225                                                 $tokentwo = $msg["tokentwo"];
 226
 227                                                 $data_returned = $myga->resyncCode($msg["username"], $tokenone, $tokentwo);
 228                                         }
 229
 230                                         break;
 231                                 case MSG_GET_TOKEN_TYPE:
 232                                         if(!isset($msg["username"])) {
 233                                                 $data_returned = false;
 234                                         } else {
 235                                                 $data_returned = $myga->getTokenType($msg["username"]);
 236                                         }
 237                                         break;
 238                                 case MSG_ADD_USER_TOKEN:
 239                                         echo "Call to add user token\n";
 240                                         if(!isset($msg["username"])) {
 241                                                 $data_returned = false;
 242                                         } else {
 243                                                 global $BASE_DIR;
 244                                                 $username = $msg["username"];
 245                                                 $tokentype="TOTP";
 246                                                 if(isset($msg["tokentype"])) {
 247                                                         $tokentype=$msg["tokentype"];
 248                                                 }
 249                                                 $hexkey = "";
 250                                                 if(isset($msg["hexkey"])) {
 251                                                         $hexkey = $msg["hexkey"];
 252                                                 }
 253                                                 global $myga;
 254                                                 $myga->setUser($username, $tokentype, "", $hexkey);
 255
 256                                                 $url = $myga->createUrl($username);
 257                                                 echo "Url was: $url\n";
 258                                                 if(!file_exists("$BASE_DIR/authserver/authd/otks")) mkdir("$BASE_DIR/authserver/authd/otks");
 259                                                 $otk = generateRandomString();
 260                                                 system("qrencode -o $BASE_DIR/authserver/authd/otks/$otk.png '$url'");
 261
 262                                                 $sql = "update users set users_otk='$otk' where users_username='$username'";
 263                                                 $dbo = getDatabase();
 264                                                 $res = $dbo->query($sql);
 265
 266                                                 $data_returned = true;
 267                                         }
 268                                         break;
 269                                 case MSG_DELETE_USER:
 270                                         echo "Call to del user\n";
 271                                         if(!isset($msg["username"])) {
 272                                                 $data_returned = false;
 273                                         } else {
 274                                                 $username = $msg["username"];
 275                                                 global $myga;
 276
 277                                                 $sql = "select users_otk from users where users_username='$username'";
 278                                                 $dbo = getDatabase();
 279                                                 $res = $dbo->query($sql);
 280                                                 $otkid = "";
 281                                                 foreach($res as $row) {
 282                                                         $otkid = $row["users_otk"];
 283                                                 }
 284                                                 if($otkid!="") {
 285                                                         unlink("otks/$otkid.png");
 286                                                 }
 287
 288
 289                                                 $sql = "delete from users where users_username='$username'";
 290                                                 $dbo = getDatabase();
 291                                                 $dbo->query($sql);
 292
 293                                                 $data_returned = true;
 294                                         }
 295                                         break;
 296                                 case MSG_AUTH_USER_PASSWORD:
 297                                         // TODO
 298                                         echo "Call to auth user pass\n";
 299                                         if(!isset($msg["username"])) {
 300                                                 $data_returned = false;
 301                                                 break;
 302                                         }
 303                                         if(!isset($msg["password"])) {
 304                                                 $data_returned = false;
 305                                                 break;
 306                                         }
 307
 308                                         $username = $msg["username"];
 309                                         $password = $msg["password"];
 310                                         $sql = "select users_password from users where users_username='$username'";
 311                                         $dbo = getDatabase();
 312                                         $res = $dbo->query($sql);
 313                                         $pass = "";
 314                                         foreach($res as $row) {
 315                                                 $pass = $row["users_password"];
 316                                         }
 317
 318                                         // TODO now do auth
 319                                         $ourpass = hash('sha512', $password);
 320                                         echo "ourpass: $ourpass\nourhash: $pass\n";
 321                                         if($ourpass == $pass) {
 322                                                 $data_returned = true;
 323
 324                                         } else {
 325                                                 $data_returned = false;
 326
 327                                         }
 328
 329                                         break;
 330                                 case MSG_SET_USER_PASSWORD:
 331                                         echo "how on earth is that happening Call to set user pass, wtf?\n";
 332                                         // TODO
 333                                         print_r($msg);
 334                                         if(!isset($msg["username"])) {
 335                                                 $data_returned = false;
 336                                                 echo "in break 1\n";
 337                                                 break;
 338                                         }
 339                                         if(!isset($msg["password"])) {
 340                                                 $data_returned = false;
 341                                                 echo "in break 1\n";
 342                                                 break;
 343                                         }
 344
 345                                         $username = $msg["username"];
 346                                         $password = $msg["password"];
 347
 348                                         echo "would set pass for $username, to $password\n";
 349                                         if($password == "") $pass = "";
 350                                         else $pass = hash('sha512', $password);
 351
 352                                         $dbo = getDatabase();
 353                                         echo "in set user pass for $username, $pass\n";
 354                                         $sql = "update users set users_password='$pass' where users_username='$username'";
 355
 356                                         $dbo->query($sql);
 357
 358                                         $data_returned = true;
 359
 360
 361                                         // these are irrelavent yet
 362                                         // TODO now set pass
 363                                         break;
 364                                 case MSG_SET_USER_REALNAME:
 365                                         echo "Call to set user realname\n";
 366                                         // TODO
 367                                         if(!isset($msg["username"])) {
 368                                                 $data_returned = false;
 369                                                 break;
 370                                         }
 371                                         if(!isset($msg["realname"])) {
 372                                                 $data_returned = false;
 373                                                 break;
 374                                         }
 375
 376                                         $username = $msg["username"];
 377                                         $realname = $msg["realname"];
 378                                         $sql = "update users set users_realname='$realname' where users_username='$username'";
 379                                         $dbo = getDatabase();
 380
 381                                         $dbo->query($sql);
 382
 383                                         $data_returned = true;
 384
 385                                         // TODO now set real name
 386                                         break;
 387                                 case MSG_SET_USER_TOKEN:
 388                                         // TODO
 389                                         echo "Call to set user token\n";
 390                                         if(!isset($msg["username"])) {
 391                                                 $data_returned = false;
 392                                                 break;
 393                                         }
 394                                         if(!isset($msg["tokenstring"])) {
 395                                                 $data_returned = false;
 396                                                 break;
 397                                         }
 398
 399                                         global $myga;
 400                                         $username = $msg["username"];
 401                                         $token = $msg["tokenstring"];
 402                                         $return = $myga->setUserKey($username, $token);
 403                                         $data_returned = $return;
 404
 405                                         // TODO now set token
 406                                         break;
 407                                 case MSG_SET_USER_TOKEN_TYPE:
 408                                         // TODO
 409                                         echo "Call to set user token type\n";
 410                                         if(!isset($msg["username"])) {
 411                                                 $data_returned = false;
 412                                                 break;
 413                                         }
 414                                         if(!isset($msg["tokentype"])) {
 415                                                 $data_returned = false;
 416                                                 break;
 417                                         }
 418
 419                                         $username = $msg["username"];
 420                                         $tokentype = $msg["tokentype"];
 421                                         global $myga;
 422                                         $data_returned = $myga->setTokenType($username, $tokentype);
 423
 424                                         // TODO now set token
 425                                         break;
 426                                 case MSG_GET_USERS:
 427                                         // TODO this needs to be better
 428                                         $sql = "select * from users order by users_username";
 429
 430                                         $dbo = getDatabase();
 431                                         $res = $dbo->query($sql);
 432
 433                                         $users = "";
 434                                         $i = 0;
 435                                         foreach($res as $row) {
 436                                                 $users[$i]["username"] = $row["users_username"];
 437                                                 $users[$i]["realname"] = $row["users_realname"];
 438                                                 if($row["users_password"]!="") {
 439                                                         $users[$i]["haspass"] = true;
 440                                                 } else {
 441                                                         $users[$i]["haspass"] = false;
 442                                                 }
 443                                                 echo "user: ".$users[$i]["username"]." has tdata: \"".$row["users_tokendata"]."\"\n";
 444                                                 if($row["users_tokendata"]!="") {
 445                                                         $users[$i]["hastoken"] = true;
 446                                                 } else {
 447                                                         $users[$i]["hastoken"] = false;
 448                                                 }
 449
 450                                                 if($row["users_otk"]!="") {
 451                                                         $users[$i]["otk"] = $row["users_otk"];
 452                                                 } else {
 453                                                         $users[$i]["otk"] = "";
 454                                                 }
 455                                                 $i++;
 456                                         }
 457                                         $data_returned = $users;
 458
 459                                         // TODO now set token
 460                                         break;
 461
 462                         }
 463
 464                         $d_comp["type"] = $msg_type;
 465                         $d_comp["data"] = $data_returned;
 466
 467                         $realdata_returning = "AS:".base64_encode(serialize($d_comp)).":EOD";
 468
 469                         socket_send($data_socket, $realdata_returning, strlen($realdata_returning), 0);
 470                         socket_close($data_socket);
 471
 472                         // now our child exits?
 473                         return 0;
 474                 }
 475                 // otherwise return to the accept loop
 476         }
 477
 478         */
 479
 480         $myga = new gaasGA();
 481         global $myga;
 482
 483
 484         while(true) {
 485                 msg_receive($sr_queue, 0, $msg_type, 16384, $msg);
 486                 echo "got message of type $msg_type\n";
 487                 switch($msg_type) {
 488                         case MSG_GET_RADIUS_CLIENTS:
 489                                 $sql = "select * from radclients";
 490                                 $dbo = getDatabase();
 491                                 $res = $dbo->query($sql);
 492                                 $clients = "";
 493                                 $i=0;
 494                                 foreach($res as $row) {
 495                                         //              $sql = 'CREATE TABLE "radclients" ("rad_id" INTEGER PRIMARY KEY AUTOINCREMENT,"rad_name" TEXT, "rad_ip" TEXT, "rad_secret" TEXT, "rad_desc" TEXT);';
 496                                         $clients[$i]["name"] = $row["rad_name"];
 497                                         $clients[$i]["ip"] = $row["rad_ip"];
 498                                         $clients[$i]["secret"] = $row["rad_secret"];
 499                                         $clients[$i]["desc"] = $row["rad_desc"];
 500                                         $i++;
 501                                 }
 502                                 msg_send($cl_queue, MSG_GET_RADIUS_CLIENTS, $clients);
 503                                 break;
 504                         case MSG_REMOVE_RADIUS_CLIENT:
 505                                 // it should send us a client by rad_name - doesnt work yet
 506                                 $client = $msg["clientname"];
 507                                 $sql = "delete from radclients where rad_name='$client'";
 508                                 $dbo = getDatabase();
 509                                 $res = $dbo->query($sql);
 510                                 updateRadius();
 511                                 msg_send($cl_queue, MSG_REMOVE_RADIUS_CLIENT, true);
 512                                 break;
 513                         case MSG_ADD_RADIUS_CLIENT:
 514                                 echo "in addradclient\n";
 515                                 $client = $msg["clientname"];
 516                                 $clientsecret = $msg["clientsecret"];
 517                                 $clientip = $msg["clientip"];
 518                                 $clientdesc = $msg["clientdescription"];
 519                                 $dbo = getDatabase();
 520
 521                                 // check for existing clients with same name
 522                                 $sql = "select * from radclients where rad_name='$client'";
 523                                 echo "doing select, $sql\n";
 524                                 $res = $dbo->query($sql);
 525                                 if($res->fetchColumn() > 0) {
 526                                         msg_send($cl_queue, MSG_ADD_RADIUS_CLIENT, "name");
 527
 528                                 } else {
 529                                         // check for existing clients with same ip
 530                                         $sql = "select * from radclients where rad_ip='$clientip'";
 531                                         $res = $dbo->query($sql);
 532                                         echo "doing select, $sql\n";
 533                                         if($res->fetchColumn() > 0) {
 534                                                 msg_send($cl_queue, MSG_ADD_RADIUS_CLIENT, "ip");
 535
 536                                         } else {
 537                                                 $sql = "insert into radclients values (NULL, '$client', '$clientip', '$clientsecret', '$clientdesc')";
 538                                                 $res = $dbo->query($sql);
 539                                                 updateRadius();
 540                                                 msg_send($cl_queue, MSG_ADD_RADIUS_CLIENT, true);
 541                                                 break;
 542                                         }
 543                                 }
 544                                 break;
 545                         case MSG_DELETE_USER_TOKEN:
 546                                 $username = $msg["username"];
 547
 548                                 $sql = "select users_otk from users where users_username='$username'";
 549                                 $dbo = getDatabase();
 550                                 $res = $dbo->query($sql);
 551                                 $otkid = "";
 552                                 foreach($res as $row) {
 553                                         $otkid = $row["users_otk"];
 554                                 }
 555                                 if($otkid!="") {
 556                                         global $BASE_DIR;
 557                                         unlink("$BASE_DIR/authserver/authd/otks/$otkid.png");
 558                                 }
 559
 560                                 $sql = "update users set users_tokendata='',users_otk='' where users_username='$username'";
 561                                 $dbo = getDatabase();
 562                                 $res = $dbo->query($sql);
 563
 564                                 msg_send($cl_queue, MSG_DELETE_USER_TOKEN, true);
 565                                 break;
 566                         case MSG_AUTH_USER_TOKEN:
 567                                 echo "Call to auth user token\n";
 568                                 // minimal checking, we leav it up to authenticateUser to do the real
 569                                 // checking
 570                                 if(!isset($msg["username"])) $msg["username"] = "";
 571                                 if(!isset($msg["passcode"])) $msg["passcode"] = "";
 572                                 $username = $msg["username"];
 573                                 $passcode = $msg["passcode"];
 574                                 global $myga;
 575                                 $authval = $myga->authenticateUser($username, $passcode);
 576                                 msg_send($cl_queue, MSG_AUTH_USER_TOKEN, $authval);
 577                                 break;
 578                         case MSG_GET_OTK_ID:
 579                                 if(!isset($msg["username"])) {
 580                                         msg_send($cl_queue, MSG_GET_OTK_ID, false);
 581                                 } else {
 582                                         $username = $msg["username"];
 583                                         $sql = "select users_otk from users where users_username='$username'";
 584                                         $dbo = getDatabase();
 585                                         $res = $dbo->query($sql);
 586                                         $otkid = "";
 587                                         foreach($res as $row) {
 588                                                 $otkid = $row["users_otk"];
 589                                         }
 590
 591                                         if($otkid == "") {
 592                                                 msg_send($cl_queue, MSG_GET_OTK_ID, false);
 593                                         } else {
 594                                                 msg_send($cl_queue, MSG_GET_OTK_ID, $otkid);
 595                                         }
 596                                 }
 597                                 break;
 598                         case MSG_GET_OTK_PNG:
 599                                 if(!isset($msg["otk"])) {
 600                                         msg_send($cl_queue, MSG_GET_OTK_PNG, false);
 601                                 } else {
 602                                         $otk = $msg["otk"];
 603                                         $sql = "select users_username from users where users_otk='$otk'";
 604                                         $dbo = getDatabase();
 605                                         $res = $dbo->query($sql);
 606                                         $username = "";
 607                                         foreach($res as $row) {
 608                                                 $username = $row["users_username"];
 609                                         }
 610
 611                                         if($username == "") {
 612                                                 msg_send($cl_queue, MSG_GET_OTK_PNG, false);
 613                                         } else if($username != $msg["username"]) {
 614                                                 msg_send($cl_queue, MSG_GET_OTK_PNG, false);
 615                                         } else {
 616                                                 global $BASE_DIR;
 617                                                 $hand = fopen("$BASE_DIR/authserver/authd/otks/$otk.png", "rb");
 618                                                 $data = fread($hand, filesize("$BASE_DIR/authserver/authd/otks/$otk.png"));
 619                                                 fclose($hand);
 620                                                 unlink("$BASE_DIR/authserver/authd/otks/$otk.png");
 621                                                 $sql = "update users set users_otk='' where users_username='$username'";
 622                                                 $dbo->query($sql);
 623                                                 error_log("senting otk, fsize: ".filesize("$BASE_DIR/authserver/authd/otks/$otk.png")." $otk ");
 624                                                 msg_send($cl_queue, MSG_GET_OTK_PNG, $data);
 625                                         }
 626                                 }
 627
 628                                 break;
 629                         case MSG_SYNC_TOKEN:
 630                                 if(!isset($msg["username"])) {
 631                                         msg_send($cl_queue, MSG_SYNC_TOKEN, false);
 632                                 } else {
 633                                         $tokenone = $msg["tokenone"];
 634                                         $tokentwo = $msg["tokentwo"];
 635
 636                                         msg_send($cl_queue, MSG_SYNC_TOKEN, $myga->resyncCode($msg["username"], $tokenone, $tokentwo));
 637                                 }
 638
 639                                 break;
 640                         case MSG_GET_TOKEN_TYPE:
 641                                 if(!isset($msg["username"])) {
 642                                         msg_send($cl_queue, MSG_GET_TOKEN_TYPE, false);
 643                                 } else {
 644                                         msg_send($cl_queue, MSG_GET_TOKEN_TYPE, $myga->getTokenType($msg["username"]));
 645                                 }
 646                                 break;
 647                         case MSG_ADD_USER_TOKEN:
 648                                 echo "Call to add user token\n";
 649                                 if(!isset($msg["username"])) {
 650                                         msg_send($cl_queue, MSG_ADD_USER_TOKEN, false);
 651                                 } else {
 652                                         global $BASE_DIR;
 653                                         $username = $msg["username"];
 654                                         $tokentype="TOTP";
 655                                         if(isset($msg["tokentype"])) {
 656                                                 $tokentype=$msg["tokentype"];
 657                                         }
 658                                         $hexkey = "";
 659                                         if(isset($msg["hexkey"])) {
 660                                                 $hexkey = $msg["hexkey"];
 661                                         }
 662                                         global $myga;
 663                                         $myga->setUser($username, $tokentype, "", $hexkey);
 664
 665                                         $url = $myga->createUrl($username);
 666                                         echo "Url was: $url\n";
 667                                         if(!file_exists("$BASE_DIR/authserver/authd/otks")) mkdir("$BASE_DIR/authserver/authd/otks");
 668                                         $otk = generateRandomString();
 669                                         system("qrencode -o $BASE_DIR/authserver/authd/otks/$otk.png '$url'");
 670
 671                                         $sql = "update users set users_otk='$otk' where users_username='$username'";
 672                                         $dbo = getDatabase();
 673                                         $res = $dbo->query($sql);
 674
 675                                         msg_send($cl_queue, MSG_ADD_USER_TOKEN, true);
 676                                 }
 677                                 break;
 678                         case MSG_DELETE_USER:
 679                                 echo "Call to del user\n";
 680                                 if(!isset($msg["username"])) {
 681                                         msg_send($cl_queue, MSG_DELETE_USER, false);
 682                                 } else {
 683                                         $username = $msg["username"];
 684                                         global $myga;
 685
 686                                         $sql = "select users_otk from users where users_username='$username'";
 687                                         $dbo = getDatabase();
 688                                         $res = $dbo->query($sql);
 689                                         $otkid = "";
 690                                         foreach($res as $row) {
 691                                                 $otkid = $row["users_otk"];
 692                                         }
 693                                         if($otkid!="") {
 694                                                 unlink("otks/$otkid.png");
 695                                         }
 696
 697
 698                                         $sql = "delete from users where users_username='$username'";
 699                                         $dbo = getDatabase();
 700                                         $dbo->query($sql);
 701
 702                                         msg_send($cl_queue, MSG_DELETE_USER, true);
 703                                 }
 704                                 break;
 705                         case MSG_AUTH_USER_PASSWORD:
 706                                 // TODO
 707                                 echo "Call to auth user pass\n";
 708                                 if(!isset($msg["username"])) {
 709                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, false);
 710                                         break;
 711                                 }
 712                                 if(!isset($msg["password"])) {
 713                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, false);
 714                                         break;
 715                                 }
 716
 717                                 $username = $msg["username"];
 718                                 $password = $msg["password"];
 719                                 $sql = "select users_password from users where users_username='$username'";
 720                                 $dbo = getDatabase();
 721                                 $res = $dbo->query($sql);
 722                                 $pass = "";
 723                                 foreach($res as $row) {
 724                                         $pass = $row["users_password"];
 725                                 }
 726
 727                                 // TODO now do auth
 728                                 $ourpass = hash('sha512', $password);
 729                                 echo "ourpass: $ourpass\nourhash: $pass\n";
 730                                 if($ourpass == $pass) {
 731                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, true);
 732
 733                                 } else {
 734                                         msg_send($cl_queue, MSG_AUTH_USER_PASSWORD, false);
 735
 736                                 }
 737
 738                                 break;
 739                         case MSG_SET_USER_PASSWORD:
 740                                 echo "how on earth is that happening Call to set user pass, wtf?\n";
 741                                 // TODO
 742                                 print_r($msg);
 743                                 if(!isset($msg["username"])) {
 744                                         msg_send($cl_queue, MSG_SET_USER_PASSWORD, false);
 745                                         echo "in break 1\n";
 746                                         break;
 747                                 }
 748                                 if(!isset($msg["password"])) {
 749                                         msg_send($cl_queue, MSG_SET_USER_PASSWORD, false);
 750                                         echo "in break 1\n";
 751                                         break;
 752                                 }
 753
 754                                 $username = $msg["username"];
 755                                 $password = $msg["password"];
 756
 757                                 echo "would set pass for $username, to $password\n";
 758                                 if($password == "") $pass = "";
 759                                 else $pass = hash('sha512', $password);
 760
 761                                 $dbo = getDatabase();
 762                                 echo "in set user pass for $username, $pass\n";
 763                                 $sql = "update users set users_password='$pass' where users_username='$username'";
 764
 765                                 $dbo->query($sql);
 766
 767                                 msg_send($cl_queue, MSG_SET_USER_REALNAME, true);
 768
 769
 770                                 // these are irrelavent yet
 771                                 // TODO now set pass
 772                                 break;
 773                         case MSG_SET_USER_REALNAME:
 774                                 echo "Call to set user realname\n";
 775                                 // TODO
 776                                 if(!isset($msg["username"])) {
 777                                         msg_send($cl_queue, MSG_SET_USER_REALNAME, false);
 778                                         break;
 779                                 }
 780                                 if(!isset($msg["realname"])) {
 781                                         msg_send($cl_queue, MSG_SET_USER_REALNAME, false);
 782                                         break;
 783                                 }
 784
 785                                 $username = $msg["username"];
 786                                 $realname = $msg["realname"];
 787                                 $sql = "update users set users_realname='$realname' where users_username='$username'";
 788                                 $dbo = getDatabase();
 789
 790                                 $dbo->query($sql);
 791
 792                                 msg_send($cl_queue, MSG_SET_USER_REALNAME, true);
 793
 794                                 // TODO now set real name
 795                                 break;
 796                         case MSG_SET_USER_TOKEN:
 797                                 // TODO
 798                                 echo "Call to set user token\n";
 799                                 if(!isset($msg["username"])) {
 800                                         msg_send($cl_queue, MSG_SET_USER_TOKEN, false);
 801                                         break;
 802                                 }
 803                                 if(!isset($msg["tokenstring"])) {
 804                                         msg_send($cl_queue, MSG_SET_USER_TOKEN, false);
 805                                         break;
 806                                 }
 807
 808                                 global $myga;
 809                                 $username = $msg["username"];
 810                                 $token = $msg["tokenstring"];
 811                                 $return = $myga->setUserKey($username, $token);
 812                                 msg_send($cl_queue, MSG_SET_USER_TOKEN, $return);
 813
 814                                 // TODO now set token
 815                                 break;
 816                         case MSG_SET_USER_TOKEN_TYPE:
 817                                 // TODO
 818                                 echo "Call to set user token type\n";
 819                                 if(!isset($msg["username"])) {
 820                                         msg_send($cl_queue, MSG_SET_USER_TOKEN_TYPE, false);
 821                                         break;
 822                                 }
 823                                 if(!isset($msg["tokentype"])) {
 824                                         msg_send($cl_queue, MSG_SET_USER_TOKEN_TYPE, false);
 825                                         break;
 826                                 }
 827
 828                                 $username = $msg["username"];
 829                                 $tokentype = $msg["tokentype"];
 830                                 global $myga;
 831                                 msg_send($cl_queue, MSG_SET_USER_TOKEN_TYPE, $myga->setTokenType($username, $tokentype));
 832
 833                                 // TODO now set token
 834                                 break;
 835                         case MSG_GET_USERS:
 836                                 // TODO this needs to be better
 837                                 $sql = "select * from users order by users_username";
 838
 839                                 $dbo = getDatabase();
 840                                 $res = $dbo->query($sql);
 841
 842                                 $users = "";
 843                                 $i = 0;
 844                                 foreach($res as $row) {
 845                                         $users[$i]["username"] = $row["users_username"];
 846                                         $users[$i]["realname"] = $row["users_realname"];
 847                                         if($row["users_password"]!="") {
 848                                                 $users[$i]["haspass"] = true;
 849                                         } else {
 850                                                 $users[$i]["haspass"] = false;
 851                                         }
 852                                         echo "user: ".$users[$i]["username"]." has tdata: \"".$row["users_tokendata"]."\"\n";
 853                                         if($row["users_tokendata"]!="") {
 854                                                 $users[$i]["hastoken"] = true;
 855                                         } else {
 856                                                 $users[$i]["hastoken"] = false;
 857                                         }
 858
 859                                         if($row["users_otk"]!="") {
 860                                                 $users[$i]["otk"] = $row["users_otk"];
 861                                         } else {
 862                                                 $users[$i]["otk"] = "";
 863                                         }
 864                                         $i++;
 865                                 }
 866                                 msg_send($cl_queue, MSG_GET_USERS, $users);
 867
 868                                 // TODO now set token
 869                                 break;
 870
 871                 }
 872         }
 873 }
 874
 875 ?>