lib/lib.php

   1 <?php
   2
   3 abstract class GoogleAuthenticator {
   4
   5         function __construct() {
   6         }
   7
   8         abstract function getData($username);
   9         abstract function putData($username, $data);
  10         abstract function getUsers();
  11
  12         // a function to create an empty data structure, filled with some defaults
  13         function createEmptyData() {
  14                 $data["tokenkey"] = ""; // the token key
  15                 $data["tokentype"] = "HOTP"; // the token type
  16                 $data["tokentimer"] = 30; // the token timer (For totp) and not supported by ga yet
  17                 $data["tokencounter"] = 1; // the token counter for hotp
  18                 $data["tokenalgorithm"] = "SHA1"; // the token algorithm (not supported by ga yet)
  19
  20                 return $data;
  21         }
  22
  23         // an internal funciton to get
  24         function internalGetData($username) {
  25                 $data = $this->getData($username);
  26                 $deco = unserialize(base64_decode($data));
  27
  28                 if(!$deco) {
  29                         $deco = $this->createEmptyData();
  30                 }
  31
  32                 return $deco;
  33         }
  34
  35
  36         function internalPutData($username, $data) {
  37                 $enco = base64_encode(serialize($data));
  38
  39                 return $this->putData($username, $enco);
  40         }
  41
  42
  43         // set the token type the user it going to use.
  44         // this defaults to HOTP - we only do 30s token
  45         // so lets not be able to set that yet
  46         function setupTokenType($username, $tokentype) {
  47                 if($tokentype!="HOTP" and $tokentype!="TOTP") {
  48                         $errorText = "Invalid Token Type";
  49                         return false;
  50                 }
  51
  52                 $data = $this->internalGetData($username);
  53                 $data["tokentype"] = $tokentype;
  54                 $this->internalPutData($username, $data);
  55
  56                 return true;
  57         }
  58
  59
  60         // create "user" with insert
  61         function setUser($username, $ttype="HOTP", $key = "") {
  62                 if($key == "") $key = $this->createBase32Key();
  63                 $hkey = $this->helperb322hex($key);
  64
  65                 $token = $this->internalGetData($username);
  66                 $token["tokenkey"] = $hkey;
  67                 $token["tokentype"] = $ttype;
  68
  69                 $this->internalPutData($username, $token);
  70                 return $key;
  71         }
  72
  73
  74         function hasToken($username) {
  75                 $token = $this->internalGetData($username);
  76                 // TODO: change this to a pattern match for an actual key
  77                 if(!isset($token["tokenkey"])) return false;
  78                 if($token["tokenkey"] == "") return false;
  79                 return true;
  80         }
  81
  82
  83         // sets the key for a user - this is assuming you dont want
  84         // to use one created by the application. returns false
  85         // if the key is invalid or the user doesn't exist.
  86         function setUserKey($username, $key) {
  87                 // consider scrapping this
  88                 $token = $this->internalGetData($username);
  89                 $token["tokenkey"] = $key;
  90                 $this->internalPutData($username, $token);
  91         }
  92
  93
  94         // self explanitory?
  95         function deleteUser($username) {
  96                 // oh, we need to figure out how to do thi?
  97                 $data = $this->internalGetData($username);
  98                 $data["tokenkey"] = "";
  99                 $this->internalPutData($username);
 100         }
 101
 102         // user has input their user name and some code, authenticate
 103         // it
 104         function authenticateUser($username, $code) {
 105
 106                 if(preg_match("/[0-9][0-9][0-9][0-9][0-9][0-9]/",$code)<1) return false;
 107                 error_log("begin auth user");
 108                 $tokendata = $this->internalGetData($username);
 109                 $asdf = print_r($tokendata, true);
 110                 error_log("dat is $asdf");
 111
 112                 if($tokendata["tokenkey"] == "") {
 113                         $errorText = "No Assigned Token";
 114                         return false;
 115                 }
 116
 117                 // TODO: check return value
 118                 $ttype = $tokendata["tokentype"];
 119                 $tlid = $tokendata["tokencounter"];
 120                 $tkey = $tokendata["tokenkey"];
 121
 122                 $asdf = print_r($tokendata, true);
 123                 error_log("dat is $asdf");
 124                 switch($ttype) {
 125                         case "HOTP":
 126                                 error_log("in hotp");
 127                                 $st = $tlid;
 128                                 $en = $tlid+20;
 129                                 for($i=$st; $i<$en; $i++) {
 130                                         $stest = $this->oath_hotp($tkey, $i);
 131                                         error_log("testing code: $code, $stest, $tkey, $tid");
 132                                         if($code == $stest) {
 133                                                 $tokendata["tokencounter"] = $i;
 134                                                 $this->internalPutData($username, $tokendata);
 135                                                 return true;
 136                                         }
 137                                 }
 138                                 return false;
 139                                 break;
 140                         case "TOTP":
 141                                 error_log("in totp");
 142                                 $t_now = time();
 143                                 $t_ear = $t_now - 45;
 144                                 $t_lat = $t_now + 60;
 145                                 $t_st = ((int)($t_ear/30));
 146                                 $t_en = ((int)($t_lat/30));
 147                                 //error_log("kmac: $t_now, $t_ear, $t_lat, $t_st, $t_en");
 148                                 for($i=$t_st; $i<=$t_en; $i++) {
 149                                         $stest = $this->oath_hotp($tkey, $i);
 150                                         error_log("testing code: $code, $stest, $tkey\n");
 151                                         if($code == $stest) {
 152                                                 return true;
 153                                         }
 154                                 }
 155                                 break;
 156                         default:
 157                                 echo "how the frig did i end up here?";
 158                 }
 159
 160                 return false;
 161
 162         }
 163
 164         // this function allows a user to resync their key. If too
 165         // many codes are called, we only check up to 20 codes in the future
 166         // so if the user is at 21, they'll always fail.
 167         function resyncCode($username, $code1, $code2) {
 168                 // here we'll go from 0 all the way thru to 200k.. if we cant find the code, so be it, they'll need a new one
 169                 // for HOTP tokens we start at x and go to x+20
 170
 171                 // for TOTP we go +/-1min TODO = remember that +/- 1min should
 172                 // be changed based on stepping if we change the expiration time
 173                 // for keys
 174
 175                 //              $this->dbConnector->query('CREATE TABLE "tokens" ("token_id" INTEGER PRIMARY KEY AUTOINCREMENT,"token_key" TEXT NOT NULL, "token_type" TEXT NOT NULL, "token_lastid" INTEGER NOT NULL)');
 176                 $tokendata = internalGetData($username);
 177
 178                 // TODO: check return value
 179                 $ttype = $tokendata["tokentype"];
 180                 $tlid = $tokendata["tokencounter"];
 181                 $tkey = $tokendata["tokenkey"];
 182
 183                 if($tkey == "") {
 184                         $this->errorText = "No Assigned Token";
 185                         return false;
 186                 }
 187
 188                 switch($ttype) {
 189                         case "HOTP":
 190                                 $st = 0;
 191                                 $en = 200000;
 192                                 for($i=$st; $i<$en; $i++) {
 193                                         $stest = $this->oath_hotp($tkey, $i);
 194                                         //echo "code: $code, $stest, $tkey\n";
 195                                         if($code1 == $stest) {
 196                                                 $stest2 = $this->oath_hotp($tkey, $i+1);
 197                                                 if($code2 == $stest2) {
 198                                                         $tokendata["tokencounter"] = $i+1;
 199                                                         internalPutData($username, $tokendata);
 200                                                         return true;
 201                                                 }
 202                                         }
 203                                 }
 204                                 return false;
 205                                 break;
 206                         case "TOTP":
 207                                 break;
 208                         default:
 209                                 echo "how the frig did i end up here?";
 210                 }
 211
 212                 return false;
 213         }
 214
 215         // gets the error text associated with the last error
 216         function getErrorText() {
 217                 return $this->errorText;
 218         }
 219
 220         // create a url compatibile with google authenticator.
 221         function createURL($user) {
 222                 // oddity in the google authenticator... hotp needs to be lowercase.
 223                 $data = $this->internalGetData($user);
 224                 $toktype = $data["tokentype"];
 225                 $key = $this->helperhex2b32($data["tokenkey"]);
 226                 $toktype = strtolower($toktype);
 227                 if($toktype == "hotp") {
 228                         $url = "otpauth://$toktype/$user?secret=$key&counter=1";
 229                 } else {
 230                         $url = "otpauth://$toktype/$user?secret=$key";
 231                 }
 232                 //echo "url: $url\n";
 233                 return $url;
 234         }
 235
 236         // creeates a base 32 key (random)
 237         function createBase32Key() {
 238                 $alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 239                 $key = "";
 240                 for($i=0; $i<16; $i++) {
 241                         $offset = rand(0,strlen($alphabet)-1);
 242                         //echo "$i off is $offset\n";
 243                         $key .= $alphabet[$offset];
 244                 }
 245
 246                 return $key;
 247         }
 248
 249         // returns a hex key
 250         function getKey($username) {
 251                 $data = $this->internalGetData($username);
 252                 $key = $data["tokenkey"];
 253
 254                 return $key;
 255         }
 256
 257         // get key type
 258         function getTokenType($username) {
 259                 $data = $this->internalGetData($username);
 260                 $toktype = $data["tokentype"];
 261
 262                 return $toktype;
 263         }
 264
 265
 266         function helperb322hex($b32) {
 267         $alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 268
 269         $out = "";
 270         $dous = "";
 271
 272         for($i = 0; $i < strlen($b32); $i++) {
 273                 $in = strrpos($alphabet, $b32[$i]);
 274                 $b = str_pad(base_convert($in, 10, 2), 5, "0", STR_PAD_LEFT);
 275             $out .= $b;
 276             $dous .= $b.".";
 277         }
 278
 279         $ar = str_split($out,20);
 280
 281         //echo "$dous, $b\n";
 282
 283         //print_r($ar);
 284         $out2 = "";
 285         foreach($ar as $val) {
 286                 $rv = str_pad(base_convert($val, 2, 16), 5, "0", STR_PAD_LEFT);
 287                 //echo "rv: $rv from $val\n";
 288                 $out2 .= $rv;
 289
 290         }
 291         //echo "$out2\n";
 292
 293         return $out2;
 294         }
 295
 296         function helperhex2b32($hex) {
 297         $alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 298
 299         $ar = str_split($hex, 5);
 300
 301         $out = "";
 302         foreach($ar as $var) {
 303                 $bc = base_convert($var, 16, 2);
 304                 $bin = str_pad($bc, 20, "0", STR_PAD_LEFT);
 305                 $out .= $bin;
 306                 //echo "$bc was, $var is, $bin are\n";
 307         }
 308
 309         $out2 = "";
 310         $ar2 = str_split($out, 5);
 311         foreach($ar2 as $var2) {
 312                 $bc = base_convert($var2, 2, 10);
 313                 $out2 .= $alphabet[$bc];
 314         }
 315
 316         return $out2;
 317         }
 318
 319         function oath_hotp($key, $counter)
 320         {
 321                 $key = pack("H*", $key);
 322             $cur_counter = array(0,0,0,0,0,0,0,0);
 323             for($i=7;$i>=0;$i--)
 324             {
 325                 $cur_counter[$i] = pack ('C*', $counter);
 326                 $counter = $counter >> 8;
 327             }
 328             $bin_counter = implode($cur_counter);
 329             // Pad to 8 chars
 330             if (strlen ($bin_counter) < 8)
 331             {
 332                 $bin_counter = str_repeat (chr(0), 8 - strlen ($bin_counter)) . $bin_counter;
 333             }
 334
 335             // HMAC
 336             $hash = hash_hmac ('sha1', $bin_counter, $key);
 337             return str_pad($this->oath_truncate($hash), 6, "0", STR_PAD_LEFT);
 338         }
 339
 340         function oath_truncate($hash, $length = 6)
 341         {
 342             // Convert to dec
 343             foreach(str_split($hash,2) as $hex)
 344             {
 345                 $hmac_result[]=hexdec($hex);
 346             }
 347
 348             // Find offset
 349             $offset = $hmac_result[19] & 0xf;
 350
 351             // Algorithm from RFC
 352             return
 353             (
 354                 (($hmac_result[$offset+0] & 0x7f) << 24 ) |
 355                 (($hmac_result[$offset+1] & 0xff) << 16 ) |
 356                 (($hmac_result[$offset+2] & 0xff) << 8 ) |
 357                 ($hmac_result[$offset+3] & 0xff)
 358             ) % pow(10,$length);
 359         }
 360
 361
 362         // some private data bits.
 363         private $getDatafunction;
 364         private $putDatafunction;
 365         private $errorText;
 366         private $errorCode;
 367
 368         /*
 369          * error codes
 370          * 1: Auth Failed
 371          * 2: No Key
 372          * 3: input code was invalid (user input an invalid code - must be 6 numerical digits)
 373          * 4: user doesnt exist?
 374          * 5: key invalid
 375          */
 376 }
 377 ?>