rooty/yubikey-val
1
0
Fork 0
mirror of https://github.com/Yubico/yubikey-val.git synced 2025-02-12 15:54:27 +01:00
Code Issues Projects Releases Wiki Activity

Cosmetic changes.

Browse Source 
- spaces -> tabs
This commit is contained in:
Jean Paul Galea 2015-07-16 23:53:08 +02:00
parent f5099b682d
commit 365636e34a
1 changed files with 62 additions and 62 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

124
ykval-sync.php
View File

@ -34,7 +34,7 @@ require_once 'ykval-synclib.php';
header('content-type: text/plain'); header('content-type: text/plain');
if (empty($_SERVER['QUERY_STRING'])) { if (empty($_SERVER['QUERY_STRING'])) {
sendResp(S_MISSING_PARAMETER, $myLog); sendResp(S_MISSING_PARAMETER, $myLog);
} }
$ipaddr = $_SERVER['REMOTE_ADDR']; $ipaddr = $_SERVER['REMOTE_ADDR'];
@ -48,9 +48,9 @@ $myLog->log(LOG_DEBUG, 'Received request from ' . $ipaddr);
// verify request sent by whitelisted address // verify request sent by whitelisted address
if (in_array($ipaddr, $allowed, TRUE) === FALSE) { if (in_array($ipaddr, $allowed, TRUE) === FALSE) {
$myLog->log(LOG_NOTICE, 'Operation not allowed from IP ' . $ipaddr); $myLog->log(LOG_NOTICE, 'Operation not allowed from IP ' . $ipaddr);
$myLog->log(LOG_DEBUG, 'Remote IP ' . $ipaddr . ' not listed in allowed sync pool : ' . implode(', ', $allowed)); $myLog->log(LOG_DEBUG, 'Remote IP ' . $ipaddr . ' not listed in allowed sync pool : ' . implode(', ', $allowed));
sendResp(S_OPERATION_NOT_ALLOWED, $myLog); sendResp(S_OPERATION_NOT_ALLOWED, $myLog);
} }
@ -58,21 +58,21 @@ $sync = new SyncLib('ykval-sync:synclib');
$sync->addField('ip', $ipaddr); $sync->addField('ip', $ipaddr);
if (! $sync->isConnected()) { if (! $sync->isConnected()) {
sendResp(S_BACKEND_ERROR, $myLog); sendResp(S_BACKEND_ERROR, $myLog);
} }
# #
# Define requirements on protocol # Define requirements on protocol
# #
$syncParams = array( $syncParams = array(
'modified' => NULL, 'modified' => NULL,
'otp' => NULL, 'otp' => NULL,
'nonce' => NULL, 'nonce' => NULL,
'yk_publicname' => NULL, 'yk_publicname' => NULL,
'yk_counter' => NULL, 'yk_counter' => NULL,
'yk_use' => NULL, 'yk_use' => NULL,
'yk_high' => NULL, 'yk_high' => NULL,
'yk_low' => NULL 'yk_low' => NULL
); );
# #
@ -80,13 +80,13 @@ $syncParams = array(
# #
$tmp_log = "Received "; $tmp_log = "Received ";
foreach ($syncParams as $param=>$value) { foreach ($syncParams as $param=>$value) {
$value = getHttpVal($param, NULL); $value = getHttpVal($param, NULL);
if ($value==NULL) { if ($value==NULL) {
$myLog->log(LOG_NOTICE, "Received request with parameter[s] (" . $param . ") missing value"); $myLog->log(LOG_NOTICE, "Received request with parameter[s] (" . $param . ") missing value");
sendResp(S_MISSING_PARAMETER, $myLog); sendResp(S_MISSING_PARAMETER, $myLog);
} }
$syncParams[$param] = $value; $syncParams[$param] = $value;
$tmp_log .= "$param=$value "; $tmp_log .= "$param=$value ";
} }
$myLog->log(LOG_INFO, $tmp_log); $myLog->log(LOG_INFO, $tmp_log);
@ -101,16 +101,16 @@ $sync->addField('otp', $syncParams['otp']);
# #
foreach (array('modified','yk_counter', 'yk_use', 'yk_high', 'yk_low') as $param) foreach (array('modified','yk_counter', 'yk_use', 'yk_high', 'yk_low') as $param)
{ {
// -1 is valid except for modified // -1 is valid except for modified
if ($param !== 'modified' && $syncParams[$param] === '-1') if ($param !== 'modified' && $syncParams[$param] === '-1')
continue; continue;
// [0-9]+ // [0-9]+
if ($syncParams[$param] !== '' && ctype_digit($syncParams[$param])) if ($syncParams[$param] !== '' && ctype_digit($syncParams[$param]))
continue; continue;
$myLog->log(LOG_NOTICE, 'Input parameters ' . $param . ' not correct'); $myLog->log(LOG_NOTICE, 'Input parameters ' . $param . ' not correct');
sendResp(S_MISSING_PARAMETER, $myLog); sendResp(S_MISSING_PARAMETER, $myLog);
} }
# #
@ -119,8 +119,8 @@ foreach (array('modified','yk_counter', 'yk_use', 'yk_high', 'yk_low') as $param
$yk_publicname = $syncParams['yk_publicname']; $yk_publicname = $syncParams['yk_publicname'];
$localParams = $sync->getLocalParams($yk_publicname); $localParams = $sync->getLocalParams($yk_publicname);
if (!$localParams) { if (!$localParams) {
$myLog->log(LOG_NOTICE, 'Invalid Yubikey ' . $yk_publicname); $myLog->log(LOG_NOTICE, 'Invalid Yubikey ' . $yk_publicname);
sendResp(S_BACKEND_ERROR, $myLog); sendResp(S_BACKEND_ERROR, $myLog);
} }
/* Conditional update local database */ /* Conditional update local database */
@ -135,50 +135,50 @@ $myLog->log(LOG_DEBUG, 'Sync request params ', $syncParams);
*/ */
if ($sync->countersHigherThan($localParams, $syncParams)) { if ($sync->countersHigherThan($localParams, $syncParams)) {
$myLog->log(LOG_WARNING, 'Remote server out of sync.'); $myLog->log(LOG_WARNING, 'Remote server out of sync.');
} }
if ($sync->countersEqual($localParams, $syncParams)) { if ($sync->countersEqual($localParams, $syncParams)) {
if ($syncParams['modified'] == $localParams['modified'] && $syncParams['nonce'] == $localParams['nonce']) { if ($syncParams['modified'] == $localParams['modified'] && $syncParams['nonce'] == $localParams['nonce']) {
/* This is not an error. When the remote server received an OTP to verify, it would /* This is not an error. When the remote server received an OTP to verify, it would
* have sent out sync requests immediately. When the required number of responses had * have sent out sync requests immediately. When the required number of responses had
* been received, the current implementation discards all additional responses (to * been received, the current implementation discards all additional responses (to
* return the result to the client as soon as possible). If our response sent last * return the result to the client as soon as possible). If our response sent last
* time was discarded, we will end up here when the background ykval-queue processes * time was discarded, we will end up here when the background ykval-queue processes
* the sync request again. * the sync request again.
*/ */
$myLog->log(LOG_INFO, 'Sync request unnecessarily sent'); $myLog->log(LOG_INFO, 'Sync request unnecessarily sent');
} }
if ($syncParams['modified'] != $localParams['modified'] && $syncParams['nonce'] == $localParams['nonce']) { if ($syncParams['modified'] != $localParams['modified'] && $syncParams['nonce'] == $localParams['nonce']) {
$deltaModified = $syncParams['modified'] - $localParams['modified']; $deltaModified = $syncParams['modified'] - $localParams['modified'];
if ($deltaModified < -1 || $deltaModified > 1) { if ($deltaModified < -1 || $deltaModified > 1) {
$myLog->log(LOG_WARNING, 'We might have a replay. 2 events at different times have generated the same counters. The time difference is ' . $deltaModified . ' seconds'); $myLog->log(LOG_WARNING, 'We might have a replay. 2 events at different times have generated the same counters. The time difference is ' . $deltaModified . ' seconds');
} }
} }
if ($syncParams['nonce'] != $localParams['nonce']) { if ($syncParams['nonce'] != $localParams['nonce']) {
$myLog->log(LOG_WARNING, 'Remote server has received a request to validate an already validated OTP '); $myLog->log(LOG_WARNING, 'Remote server has received a request to validate an already validated OTP ');
} }
} }
if ($localParams['active'] != 1) { if ($localParams['active'] != 1) {
/* The remote server has accepted an OTP from a YubiKey which we would not. /* The remote server has accepted an OTP from a YubiKey which we would not.
* We still needed to update our counters with the counters from the OTP though. * We still needed to update our counters with the counters from the OTP though.
*/ */
$myLog->log(LOG_WARNING, 'Received sync-request for de-activated Yubikey ' . $yk_publicname . ' - check database synchronization!!!'); $myLog->log(LOG_WARNING, 'Received sync-request for de-activated Yubikey ' . $yk_publicname . ' - check database synchronization!!!');
sendResp(S_BAD_OTP, $myLog); sendResp(S_BAD_OTP, $myLog);
} }
$extra = array( $extra = array(
'modified' => $localParams['modified'], 'modified' => $localParams['modified'],
'nonce' => $localParams['nonce'], 'nonce' => $localParams['nonce'],
'yk_publicname' => $yk_publicname, 'yk_publicname' => $yk_publicname,
'yk_counter' => $localParams['yk_counter'], 'yk_counter' => $localParams['yk_counter'],
'yk_use' => $localParams['yk_use'], 'yk_use' => $localParams['yk_use'],
'yk_high' => $localParams['yk_high'], 'yk_high' => $localParams['yk_high'],
'yk_low' => $localParams['yk_low'] 'yk_low' => $localParams['yk_low']
); );
sendResp(S_OK, $myLog, '', $extra); sendResp(S_OK, $myLog, '', $extra);