rooty/yubikey-val
1
0
Fork 0
mirror of https://github.com/Yubico/yubikey-val.git synced 2025-01-20 10:52:15 +01:00
Code Issues Projects Releases Wiki Activity

Sanity check OTP variable before trusting it.

Browse Source 
Reported by Ricky Zhou <ricky@fedoraproject.org>.
This commit is contained in:
Simon Josefsson 2010-09-12 10:39:23 +00:00
parent c9f58a83c7
commit 8ea97ab0fb
2 changed files with 19 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ykval-common.php
View File

@ -20,6 +20,7 @@ define('TS_REL_TOLERANCE', 0.3);
define('TS_ABS_TOLERANCE', 20);
define('TOKEN_LEN', 32);
define('OTP_MAX_LEN', 48); // TOKEN_LEN plus public identity of 0..16
global $ykval_common_log;
$ykval_common_log = new Log('ykval-common');

31
ykval-verify.php
View File

@ -69,6 +69,24 @@ if ($protocol_version>=2.0) {
*/
if ($otp == '') {
$myLog->log(LOG_NOTICE, 'OTP is missing');
sendResp(S_MISSING_PARAMETER, $apiKey, $extra);
exit;
}
if (strlen($otp) < TOKEN_LEN || strlen ($otp) > TOKEN_MAXLEN) {
$myLog->log(LOG_NOTICE, 'Incorrect OTP length: ' . $otp);
sendResp(S_BAD_OTP, $apiKey, $extra);
exit;
}
if (preg_match("/^[cbdefghijklnrtuv]+$/", $otp)==0) {
$myLog->log(LOG_NOTICE, 'Invalid OTP: ' . $otp);
sendResp(S_BAD_OTP, $apiKey, $extra);
exit;
}
if (preg_match("/^[0-9]+$/", $client)==0){
$myLog->log(LOG_NOTICE, 'id provided in request must be an integer');
sendResp(S_MISSING_PARAMETER, $apiKey, $extra);
@ -163,19 +181,6 @@ if ($protocol_version<2.0) {
$myLog->log(LOG_INFO, 'protocol version below 2.0. Created nonce ' . $nonce);
}
//// Sanity check OTP
//
if ($otp == '') {
$myLog->log(LOG_NOTICE, 'OTP is missing');
sendResp(S_MISSING_PARAMETER, $apiKey, $extra);
exit;
}
if (strlen($otp) <= TOKEN_LEN) {
$myLog->log(LOG_NOTICE, 'Too short OTP: ' . $otp);
sendResp(S_BAD_OTP, $apiKey, $extra);
exit;
}
//// Which YK-KSM should we talk to?
//
$urls = otp2ksmurls ($otp, $client);