From ec2bd5d84c4583a38f0086bac207e88f27d77749 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Mon, 11 Jul 2016 08:57:21 +0200 Subject: [PATCH] Remove Swekey support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It is buggy and their servers are no longer working. Signed-off-by: Michal Čihař --- config.sample.inc.php | 2 - doc/config.rst | 9 - doc/setup.rst | 29 - examples/swekey.sample.conf | 44 -- libraries/config.default.php | 8 - libraries/config/messages.inc.php | 2 - libraries/config/setup.forms.php | 3 - .../auth/AuthenticationCookie.class.php | 15 - .../auth/swekey/authentication.inc.php | 172 ------ libraries/plugins/auth/swekey/musbe-ca.crt | 25 - .../plugins/auth/swekey/swekey.auth.lib.php | 297 ---------- libraries/plugins/auth/swekey/swekey.php | 522 ------------------ 12 files changed, 1128 deletions(-) delete mode 100644 examples/swekey.sample.conf delete mode 100644 libraries/plugins/auth/swekey/authentication.inc.php delete mode 100644 libraries/plugins/auth/swekey/musbe-ca.crt delete mode 100644 libraries/plugins/auth/swekey/swekey.auth.lib.php delete mode 100644 libraries/plugins/auth/swekey/swekey.php diff --git a/config.sample.inc.php b/config.sample.inc.php index 10db2b508e..d4bc8eaa44 100644 --- a/config.sample.inc.php +++ b/config.sample.inc.php @@ -58,8 +58,6 @@ $cfg['Servers'][$i]['AllowNoPassword'] = false; // $cfg['Servers'][$i]['designer_coords'] = 'pma__designer_coords'; // $cfg['Servers'][$i]['userconfig'] = 'pma__userconfig'; // $cfg['Servers'][$i]['recent'] = 'pma__recent'; -/* Contrib / Swekey authentication */ -// $cfg['Servers'][$i]['auth_swekey_config'] = '/etc/swekey-pma.conf'; /* * End of servers configuration diff --git a/doc/config.rst b/doc/config.rst index 9624a96591..963655a623 100644 --- a/doc/config.rst +++ b/doc/config.rst @@ -321,15 +321,6 @@ Server connection settings "phpMyAdmin " and either :config:option:`$cfg['Servers'][$i]['verbose']` or :config:option:`$cfg['Servers'][$i]['host']` will be used. -.. _servers_auth_swekey_config: -.. config:option:: $cfg['Servers'][$i]['auth_swekey_config'] - - :type: string - :default: ``''`` - - The name of the file containing :ref:`swekey` ids and login names for hardware - authentication. Leave empty to deactivate this feature. - .. _servers_user: .. config:option:: $cfg['Servers'][$i]['user'] diff --git a/doc/setup.rst b/doc/setup.rst index 6e4c6f1fe9..07eac693ac 100644 --- a/doc/setup.rst +++ b/doc/setup.rst @@ -377,35 +377,6 @@ Config authentication mode of which are beyond the scope of this manual but easily searchable with Google). -.. index:: pair: Swekey; Authentication mode - -.. _swekey: - -Swekey authentication mode --------------------------- - -The Swekey is a low cost authentication USB key that can be used in -web applications. When Swekey authentication is activated, phpMyAdmin -requires the users's Swekey to be plugged before entering the login -page (currently supported for cookie authentication mode only). Swekey -Authentication is disabled by default. To enable it, add the following -line to :file:`config.inc.php`: - -.. code-block:: php - - $cfg['Servers'][$i]['auth_swekey_config'] = '/etc/swekey.conf'; - -You then have to create the ``swekey.conf`` file that will associate -each user with their Swekey Id. It is important to place this file -outside of your web server's document root (in the example, it is -located in ``/etc``). A self documented sample file is provided in the -``examples`` directory. Feel free to use it with your own users' -information. If you want to purchase a Swekey please visit -`http://phpmyadmin.net/auth\_key `_ -since this link provides funding for phpMyAdmin. - -.. seealso:: :config:option:`$cfg['Servers'][$i]['auth_swekey_config']` - Securing your phpMyAdmin installation +++++++++++++++++++++++++++++++++++++ diff --git a/examples/swekey.sample.conf b/examples/swekey.sample.conf deleted file mode 100644 index ebf1aedf02..0000000000 --- a/examples/swekey.sample.conf +++ /dev/null @@ -1,44 +0,0 @@ -# This is a typical file used to enable Swekey hardware authentication. -# -# To activate the Swekey authentication add the following line to your config.inc.php file. -# $cfg['Servers'][$i]['auth_swekey_config'] = '/etc/swekey-pma.conf'; -# Then rename this file "swekey-pma.conf" and copy it to the /etc directory. -# Add all the Swekey ids you want to grant access to in the file. -# After each Swekey id put the corresponding user name. -# -# If you don't know the id of a Swekey just visit http://www.swekey.com?sel=support -# while your Swekey is connected. -# -# If you need to purchase a Swekey please visit http://phpmyadmin.net/auth_key -# since this link provides funding to PhpMyAdmin. -# - -0000000000000000000000000000763A:root -000000000000000000000000000089E4:steve -0000000000000000000000000000231E:scott - -# -# It is recommended to include the following lines to contact the -# authentication servers in SSL mode. -# - -SERVER_CHECK=https://auth-check-ssl.musbe.net -SERVER_RNDTOKEN=https://auth-rnd-gen-ssl.musbe.net -SERVER_STATUS=https://auth-status-ssl.musbe.net - -# -# The path of the root certificate file used to ensure a secure -# communication with the authentication servers in SSL mode. -# If not specified, will use musbe-ca.crt found in your -# phpMyAdmin/libraries/auth/swekey. -# - -#CA_FILE=/var/http-root/phpmyadmin/libraries/auth/swekey/musbe-ca.crt - -# -# If your server receives many login requests, you can enable the random -# token caching to accelerate the authentication process. -# Token caching is enabled by default. -# - -#ENABLE_TOKEN_CACHE=0 diff --git a/libraries/config.default.php b/libraries/config.default.php index e3aa2cdd14..f0e3d5630a 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -207,14 +207,6 @@ $cfg['Servers'][$i]['auth_type'] = 'cookie'; */ $cfg['Servers'][$i]['auth_http_realm'] = ''; -/** - * File containing Swekey ids and login names (see /contrib); - * leave empty to deactivate Swekey hardware authentication - * - * @global string $cfg['Servers'][$i]['auth_swekey_config'] - */ -$cfg['Servers'][$i]['auth_swekey_config'] = ''; - /** * MySQL user * diff --git a/libraries/config/messages.inc.php b/libraries/config/messages.inc.php index 76040f7bcb..b5c86d89ab 100644 --- a/libraries/config/messages.inc.php +++ b/libraries/config/messages.inc.php @@ -373,8 +373,6 @@ $strConfigServers_AllowNoPassword_name = __('Allow logins without a password'); $strConfigServers_AllowRoot_name = __('Allow root login'); $strConfigServers_auth_http_realm_desc = __('HTTP Basic Auth Realm name to display when doing HTTP Auth'); $strConfigServers_auth_http_realm_name = __('HTTP Realm'); -$strConfigServers_auth_swekey_config_desc = __('The path for the config file for [a@http://swekey.com]SweKey hardware authentication[/a] (not located in your document root; suggested: /etc/swekey.conf)'); -$strConfigServers_auth_swekey_config_name = __('SweKey config file'); $strConfigServers_auth_type_desc = __('Authentication method to use'); $strConfigServers_auth_type_name = __('Authentication type'); $strConfigServers_bookmarktable_desc = __('Leave blank for no [a@https://wiki.phpmyadmin.net/pma/bookmark]bookmark[/a] support, suggested: [kbd]pma__bookmark[/kbd]'); diff --git a/libraries/config/setup.forms.php b/libraries/config/setup.forms.php index 1d40e0f20b..d5bab9e427 100644 --- a/libraries/config/setup.forms.php +++ b/libraries/config/setup.forms.php @@ -42,9 +42,6 @@ $forms['Servers']['Server_auth'] = array('Servers' => array(1 => array( 'user', 'password', ':group:end', - ':group:' . __('Cookie authentication'), - 'auth_swekey_config' => './swekey.conf', - ':group:end', ':group:' . __('HTTP authentication'), 'auth_http_realm', ':group:end', diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php index e0170404df..756793f08a 100644 --- a/libraries/plugins/auth/AuthenticationCookie.class.php +++ b/libraries/plugins/auth/AuthenticationCookie.class.php @@ -23,11 +23,6 @@ if (! empty($_REQUEST['target'])) { $GLOBALS['target'] = basename(PMA_getenv('SCRIPT_NAME')); } -/** - * Swekey authentication functions. - */ -require './libraries/plugins/auth/swekey/swekey.auth.lib.php'; - /** * Initialization * Store the initialization vector because it will be needed for @@ -258,10 +253,6 @@ class AuthenticationCookie extends AuthenticationPlugin echo ' '; - // BEGIN Swekey Integration - Swekey_login('input_username', 'input_go'); - // END Swekey Integration - if ($GLOBALS['error_handler']->hasDisplayErrors()) { echo '
'; $GLOBALS['error_handler']->dispErrors(); @@ -306,12 +297,6 @@ class AuthenticationCookie extends AuthenticationPlugin $GLOBALS['PHP_AUTH_USER'] = $GLOBALS['PHP_AUTH_PW'] = ''; $GLOBALS['from_cookie'] = false; - // BEGIN Swekey Integration - if (! Swekey_auth_check()) { - return false; - } - // END Swekey Integration - if (defined('PMA_CLEAR_COOKIES')) { foreach ($GLOBALS['cfg']['Servers'] as $key => $val) { $GLOBALS['PMA_Config']->removeCookie('pmaPass-' . $key); diff --git a/libraries/plugins/auth/swekey/authentication.inc.php b/libraries/plugins/auth/swekey/authentication.inc.php deleted file mode 100644 index 1977f883e1..0000000000 --- a/libraries/plugins/auth/swekey/authentication.inc.php +++ /dev/null @@ -1,172 +0,0 @@ - - - diff --git a/libraries/plugins/auth/swekey/musbe-ca.crt b/libraries/plugins/auth/swekey/musbe-ca.crt deleted file mode 100644 index 2a31ad18f9..0000000000 --- a/libraries/plugins/auth/swekey/musbe-ca.crt +++ /dev/null @@ -1,25 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIEKjCCAxKgAwIBAgIJAMjw7QcLWCd6MA0GCSqGSIb3DQEBBQUAMGsxCzAJBgNV -BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQwEgYDVQQKEwtNdXNiZSwgSW5j -LjESMBAGA1UEAxMJbXVzYmUuY29tMR0wGwYJKoZIhvcNAQkBFg5pbmZvQG11c2Jl -LmNvbTAeFw0wODA5MDQxNDE2MTNaFw0zNzEyMjExNDE2MTNaMGsxCzAJBgNVBAYT -AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQwEgYDVQQKEwtNdXNiZSwgSW5jLjES -MBAGA1UEAxMJbXVzYmUuY29tMR0wGwYJKoZIhvcNAQkBFg5pbmZvQG11c2JlLmNv -bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOBhOljxVzQfK4gted2I -d3BemcjW4abAUOzn3KYWXpPO5xIfVeXNDGkDbyH+X+7fo94sX25/ewuKNFDSOcvo -tXHq7uQenTHB35r+a+LY81KceUHgW90a3XsqPAkwAjyYcgo3zmM2DtLvw+5Yod8T -wAHk9m3qavnQ1uk99jBTwL7RZ9jIZHh9pFCL93uJc2obtd8O96Iycbn2q0w/AWbb -+eUVWIHzvLtfPvROeL3lJzr/Uz5LjKapxJ3qyqASflfHpnj9pU8l6g2TQ6Hg5KT5 -tLFkRe7uGhOfRtOQ/+NjaWrEuNCFnpyN4Q5Fv+5qA1Ip1IpH0200sWbAf/k2u0Qp -Sx0CAwEAAaOB0DCBzTAdBgNVHQ4EFgQUczJrQ7hCvtsnzcqiDIZ/GSn/CiwwgZ0G -A1UdIwSBlTCBkoAUczJrQ7hCvtsnzcqiDIZ/GSn/Ciyhb6RtMGsxCzAJBgNVBAYT -AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRQwEgYDVQQKEwtNdXNiZSwgSW5jLjES -MBAGA1UEAxMJbXVzYmUuY29tMR0wGwYJKoZIhvcNAQkBFg5pbmZvQG11c2JlLmNv -bYIJAMjw7QcLWCd6MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAGxk -8xzIljeBDQWWVRr0NEALVSv3i09V4jAKkyEOfmZ8lKMKJi0atwbtjrXTzLnNYj+Q -pyUbyY/8ItWvV7pnVxMiF9qcer7e9X4vw358GZuMVE/da1nWxz+CwzTm5oO30RzA -antM9bISFFr9lJq69bDWOnCUi1IG8DSL3TxtlABso7S4vqiZ+sB33l6k1K4a/Njb -QkU9UejKhKkVVZTsOrumfnOJ4MCmPfX8Y/AY2o670y5HnzpxerIYziCVzApPVrW7 -sKH0tuVGturMfQOKgstYe4/m9glBTeTLMkjD+6MJC2ONBD7GAiOO95gNl5M1fzJQ -FEe5CJ7DCYl0GdmLXXw= ------END CERTIFICATE----- diff --git a/libraries/plugins/auth/swekey/swekey.auth.lib.php b/libraries/plugins/auth/swekey/swekey.auth.lib.php deleted file mode 100644 index 678cb1a61d..0000000000 --- a/libraries/plugins/auth/swekey/swekey.auth.lib.php +++ /dev/null @@ -1,297 +0,0 @@ - - - \n"; -// if (file_exists($caFile)) -// echo "\n"; - } - - if (file_exists($caFile)) { - Swekey_SetCAFile($caFile); - } elseif (! empty($caFile) && (substr($_SESSION['SWEKEY']['CONF_SERVER_CHECK'], 0, 8) == "https://")) { - return "Internal Error: CA File $caFile not found"; - } - - $result = null; - $swekey_id = $_GET['swekey_id']; - $swekey_otp = $_GET['swekey_otp']; - - if (isset($swekey_id)) { - unset($_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY']); - if (! isset($_SESSION['SWEKEY']['RND_TOKEN'])) { - unset($swekey_id); - } else { - if (strlen($swekey_id) == 32) { - $res = Swekey_CheckOtp($swekey_id, $_SESSION['SWEKEY']['RND_TOKEN'], $swekey_otp); - unset($_SESSION['SWEKEY']['RND_TOKEN']); - if (! $res) { - $result = __('Hardware authentication failed') . ' (' . Swekey_GetLastError() . ')'; - } else { - $_SESSION['SWEKEY']['AUTHENTICATED_SWEKEY'] = $swekey_id; - $_SESSION['SWEKEY']['FORCE_USER'] = $_SESSION['SWEKEY']['VALID_SWEKEYS'][$swekey_id]; - return null; - } - } else { - $result = __('No valid authentication key plugged'); - if ($_SESSION['SWEKEY']['CONF_DEBUG']) { - $result .= "
" . htmlspecialchars($swekey_id); - } - unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file - } - } - } else { - unset($_SESSION['SWEKEY']); - } - - $_SESSION['SWEKEY']['RND_TOKEN'] = Swekey_GetFastRndToken(); - if (strlen($_SESSION['SWEKEY']['RND_TOKEN']) != 64) { - $result = __('Hardware authentication failed') . ' (' . Swekey_GetLastError() . ')'; - unset($_SESSION['SWEKEY']['CONF_LOADED']); // reload the conf file - } - - if (! isset($swekey_id)) { - ?> - - display(); - if ($GLOBALS['error_handler']->hasDisplayErrors()) { - echo '
'; - $GLOBALS['error_handler']->dispErrors(); - echo '
'; - } - } - - if (isset($_SESSION['SWEKEY']) && $_SESSION['SWEKEY']['ENABLED']) { - echo ''; - } -} - -if (!empty($_GET['session_to_unset'])) { - session_write_close(); - session_id($_GET['session_to_unset']); - session_start(); - $_SESSION = array(); - session_write_close(); - session_destroy(); - exit; -} - -if (isset($_GET['swekey_reset'])) { - unset($_SESSION['SWEKEY']); -} - -?> diff --git a/libraries/plugins/auth/swekey/swekey.php b/libraries/plugins/auth/swekey/swekey.php deleted file mode 100644 index d495d45b4f..0000000000 --- a/libraries/plugins/auth/swekey/swekey.php +++ /dev/null @@ -1,522 +0,0 @@ -"; - -/** - * Servers addresses - * Use the Swekey_SetXxxServer($server) functions to set them - */ - -global $gSwekeyCheckServer; -if (! isset($gSwekeyCheckServer)) { - $gSwekeyCheckServer = SWEKEY_DEFAULT_CHECK_SERVER; -} - -global $gSwekeyRndTokenServer; -if (! isset($gSwekeyRndTokenServer)) { - $gSwekeyRndTokenServer = SWEKEY_DEFAULT_RND_SERVER; -} - -global $gSwekeyStatusServer; -if (! isset($gSwekeyStatusServer)) { - $gSwekeyStatusServer = SWEKEY_DEFAULT_STATUS_SERVER; -} - -global $gSwekeyCA; - -global $gSwekeyTokenCacheEnabled; -if (! isset($gSwekeyTokenCacheEnabled)) { - $gSwekeyTokenCacheEnabled = true; -} - -/** - * Change the address of the Check server. - * If $server is empty the default value 'http://auth-check.musbe.net' will be used - * - * @param server The protocol and hostname to use - * - * @access public - */ -function Swekey_SetCheckServer($server) -{ - global $gSwekeyCheckServer; - if (empty($server)) { - $gSwekeyCheckServer = SWEKEY_DEFAULT_CHECK_SERVER; - } else { - $gSwekeyCheckServer = $server; - } -} - -/** - * Change the address of the Random Token Generator server. - * If $server is empty the default value 'http://auth-rnd-gen.musbe.net' will be used - * - * @param server The protocol and hostname to use - * - * @access public - */ -function Swekey_SetRndTokenServer($server) -{ - global $gSwekeyRndTokenServer; - if (empty($server)) { - $gSwekeyRndTokenServer = SWEKEY_DEFAULT_RND_SERVER; - } else { - $gSwekeyRndTokenServer = $server; - } -} - -/** - * Change the address of the Satus server. - * If $server is empty the default value 'http://auth-status.musbe.net' will be used - * - * @param server The protocol and hostname to use - * - * @access public - */ -function Swekey_SetStatusServer($server) -{ - global $gSwekeyStatusServer; - if (empty($server)) { - $gSwekeyStatusServer = SWEKEY_DEFAULT_STATUS_SERVER; - } else { - $gSwekeyStatusServer = $server; - } -} - -/** - * Change the certificat file in case of the the severs use https instead of http - * - * @param cafile The path of the crt file to use - * - * @access public - */ -function Swekey_SetCAFile($cafile) -{ - global $gSwekeyCA; - $gSwekeyCA = $cafile; -} - -/** - * Enable or disable the random token caching - * Because everybody has full access to the cache file, it can be a DOS vulnerability - * So disable it if you are running in a non secure enviromnement - * - * @param $enable - * - * @access public - */ -function Swekey_EnableTokenCache($enable) -{ - global $gSwekeyTokenCacheEnabled; - $gSwekeyTokenCacheEnabled = ! empty($enable); -} - - -/** - * Return the last error. - * - * @return The Last Error - * @access public - */ -function Swekey_GetLastError() -{ - global $gSwekeyLastError; - return $gSwekeyLastError; -} - -/** - * Return the last result. - * - * @return The Last Error - * @access public - */ -function Swekey_GetLastResult() -{ - global $gSwekeyLastResult; - return $gSwekeyLastResult; -} - -/** - * Send a synchronous request to the server. - * This function manages timeout then will not block if one of the server is down - * - * @param url The url to get - * @param response_code The response code - * - * @return The body of the response or "" in case of error - * @access private - */ -function Swekey_HttpGet($url, &$response_code) -{ - global $gSwekeyLastError; - $gSwekeyLastError = 0; - global $gSwekeyLastResult; - $gSwekeyLastResult = ""; - - // use curl if available - if (function_exists('curl_init')) { - $sess = curl_init($url); - if (substr($url, 0, 8) == "https://") { - global $gSwekeyCA; - - if (! empty($gSwekeyCA)) { - if (file_exists($gSwekeyCA)) { - if (! curl_setopt($sess, CURLOPT_CAINFO, $gSwekeyCA)) { - error_log("SWEKEY_ERROR:Could not set CA file : ".curl_error($sess)); - } else { - $caFileOk = true; - } - } else { - error_log("SWEKEY_ERROR:Could not find CA file $gSwekeyCA getting $url"); - } - } - - curl_setopt($sess, CURLOPT_SSL_VERIFYHOST, '2'); - curl_setopt($sess, CURLOPT_SSL_VERIFYPEER, '2'); - curl_setopt($sess, CURLOPT_CONNECTTIMEOUT, '20'); - curl_setopt($sess, CURLOPT_TIMEOUT, '20'); - } else { - curl_setopt($sess, CURLOPT_CONNECTTIMEOUT, '3'); - curl_setopt($sess, CURLOPT_TIMEOUT, '5'); - } - - curl_setopt($sess, CURLOPT_RETURNTRANSFER, '1'); - $res=curl_exec($sess); - $response_code = curl_getinfo($sess, CURLINFO_HTTP_CODE); - $curlerr = curl_error($sess); - curl_close($sess); - - if ($response_code == 200) { - $gSwekeyLastResult = $res; - return $res; - } - - if (! empty($response_code)) { - $gSwekeyLastError = $response_code; - error_log("SWEKEY_ERROR:Error $gSwekeyLastError ($curlerr) getting $url"); - return ""; - } - - $response_code = 408; // Request Timeout - $gSwekeyLastError = $response_code; - error_log("SWEKEY_ERROR:Error $curlerr getting $url"); - return ""; - } - - // use pecl_http if available - if (class_exists('HttpRequest')) { - // retry if one of the server is down - for ($num=1; $num <= 3; $num++ ) { - $r = new HttpRequest($url); - $options = array('timeout' => '3'); - - if (substr($url, 0, 6) == "https:") { - $sslOptions = array(); - $sslOptions['verifypeer'] = true; - $sslOptions['verifyhost'] = true; - - $capath = __FILE__; - $name = strrchr($capath, '/'); - // windows - if (empty($name)) { - $name = strrchr($capath, '\\'); - } - $capath = substr($capath, 0, strlen($capath) - strlen($name) + 1).'musbe-ca.crt'; - - if (! empty($gSwekeyCA)) { - $sslOptions['cainfo'] = $gSwekeyCA; - } - - $options['ssl'] = $sslOptions; - } - - $r->setOptions($options); - - // try - { - $reply = $r->send(); - $res = $reply->getBody(); - $info = $r->getResponseInfo(); - $response_code = $info['response_code']; - if ($response_code != 200) { - $gSwekeyLastError = $response_code; - error_log("SWEKEY_ERROR:Error ".$gSwekeyLastError." getting ".$url); - return ""; - } - - - $gSwekeyLastResult = $res; - return $res; - } - // catch (HttpException $e) - // { - // error_log("SWEKEY_WARNING:HttpException ".$e." getting ".$url); - // } - } - - $response_code = 408; // Request Timeout - $gSwekeyLastError = $response_code; - error_log("SWEKEY_ERROR:Error ".$gSwekeyLastError." getting ".$url); - return ""; - } - - global $http_response_header; - $res = @file_get_contents($url); - $response_code = substr($http_response_header[0], 9, 3); //HTTP/1.0 - if ($response_code == 200) { - $gSwekeyLastResult = $res; - return $res; - } - - $gSwekeyLastError = $response_code; - error_log("SWEKEY_ERROR:Error ".$response_code." getting ".$url); - return ""; -} - -/** - * Get a Random Token from a Token Server - * The RT is a 64 vhars hexadecimal value - * You should better use Swekey_GetFastRndToken() for performance - * @access public - */ -function Swekey_GetRndToken() -{ - global $gSwekeyRndTokenServer; - return Swekey_HttpGet($gSwekeyRndTokenServer.'/FULL-RND-TOKEN', $response_code); -} - -/** - * Get a Half Random Token from a Token Server - * The RT is a 64 vhars hexadecimal value - * Use this value if you want to make your own Swekey_GetFastRndToken() - * @access public - */ -function Swekey_GetHalfRndToken() -{ - global $gSwekeyRndTokenServer; - return Swekey_HttpGet($gSwekeyRndTokenServer.'/HALF-RND-TOKEN', $response_code); -} - -/** - * Get a Half Random Token - * The RT is a 64 vhars hexadecimal value - * This function get a new random token and reuse it. - * Token are refetched from the server only once every 30 seconds. - * You should always use this function to get half random token. - * @access public - */ -function Swekey_GetFastHalfRndToken() -{ - global $gSwekeyTokenCacheEnabled; - - $res = ""; - $cachefile = ""; - - // We check if we have a valid RT is the session - if (isset($_SESSION['rnd-token-date'])) { - if (time() - $_SESSION['rnd-token-date'] < 30) { - $res = $_SESSION['rnd-token']; - } - } - - // If not we try to get it from a temp file (PHP >= 5.2.1 only) - if (strlen($res) != 32 && $gSwekeyTokenCacheEnabled) { - if (function_exists('sys_get_temp_dir')) { - $tempdir = sys_get_temp_dir(); - $cachefile = $tempdir."/swekey-rnd-token-".get_current_user(); - $modif = filemtime($cachefile); - if ($modif != false) { - if (time() - $modif < 30) { - $res = @file_get_contents($cachefile); - if (strlen($res) != 32) { - $res = ""; - } else { - $_SESSION['rnd-token'] = $res; - $_SESSION['rnd-token-date'] = $modif; - } - } - } - } - } - - // If we don't have a valid RT here we have to get it from the server - if (strlen($res) != 32) { - $res = substr(Swekey_GetHalfRndToken(), 0, 32); - $_SESSION['rnd-token'] = $res; - $_SESSION['rnd-token-date'] = time(); - if (! empty($cachefile)) { - // we unlink the file so no possible tempfile race attack - unlink($cachefile); - $file = fopen($cachefile, "x"); - if ($file != false) { - @fwrite($file, $res); - @fclose($file); - } - } - } - - return $res."00000000000000000000000000000000"; -} - -/** - * Get a Random Token - * The RT is a 64 vhars hexadecimal value - * This function generates a unique random token for each call but call the - * server only once every 30 seconds. - * You should always use this function to get random token. - * @access public - */ -function Swekey_GetFastRndToken() -{ - $res = Swekey_GetFastHalfRndToken(); - if (strlen($res) == 64) { - return substr($res, 0, 32).strtoupper(md5("Musbe Authentication Key" . mt_rand() . date(DATE_ATOM))); - } - return ""; -} - - -/** - * Checks that an OTP generated by a Swekey is valid - * - * @param id The id of the swekey - * @param rt The random token used to generate the otp - * @param otp The otp generated by the swekey - * - * @return true or false - * @access public - */ -function Swekey_CheckOtp($id, $rt, $otp) -{ - global $gSwekeyCheckServer; - $res = Swekey_HttpGet($gSwekeyCheckServer.'/CHECK-OTP/'.$id.'/'.$rt.'/'.$otp, $response_code); - return $response_code == 200 && $res == "OK"; -} - -/** - * Values that are associated with a key. - * The following values can be returned by the Swekey_GetStatus() function - */ -define("SWEKEY_STATUS_OK", 0); -define("SWEKEY_STATUS_NOT_FOUND", 1); // The key does not exist in the db -define("SWEKEY_STATUS_INACTIVE", 2); // The key has never been activated -define("SWEKEY_STATUS_LOST", 3); // The user has lost his key -define("SWEKEY_STATUS_STOLEN", 4); // The key was stolen -define("SWEKEY_STATUS_FEE_DUE", 5); // The annual fee was not paid -define("SWEKEY_STATUS_OBSOLETE", 6); // The hardware is no longer supported -define("SWEKEY_STATUS_UNKOWN", 201); // We could not connect to the authentication server - -/** - * Values that are associated with a key. - * The Javascript Api can also return the following values - */ -define("SWEKEY_STATUS_REPLACED", 100); // This key has been replaced by a backup key -define("SWEKEY_STATUS_BACKUP_KEY", 101); // This key is a backup key that is not activated yet -define("SWEKEY_STATUS_NOTPLUGGED", 200); // This key is not plugged in the computer - - -/** - * Return the text corresponding to the integer status of a key - * - * @param status The status - * - * @return The text corresponding to the status - * @access public - */ -function Swekey_GetStatusStr($status) -{ - switch($status) - { - case SWEKEY_STATUS_OK : - return 'OK'; - case SWEKEY_STATUS_NOT_FOUND : - return 'Key does not exist in the db'; - case SWEKEY_STATUS_INACTIVE : - return 'Key not activated'; - case SWEKEY_STATUS_LOST : - return 'Key was lost'; - case SWEKEY_STATUS_STOLEN : - return 'Key was stolen'; - case SWEKEY_STATUS_FEE_DUE : - return 'The annual fee was not paid'; - case SWEKEY_STATUS_OBSOLETE : - return 'Key no longer supported'; - case SWEKEY_STATUS_REPLACED : - return 'This key has been replaced by a backup key'; - case SWEKEY_STATUS_BACKUP_KEY : - return 'This key is a backup key that is not activated yet'; - case SWEKEY_STATUS_NOTPLUGGED : - return 'This key is not plugged in the computer'; - case SWEKEY_STATUS_UNKOWN : - return 'Unknow Status, could not connect to the authentication server'; - } - return 'unknown status '.$status; -} - -/** - * If your web site requires a key to login you should check that the key - * is still valid (has not been lost or stolen) before requiring it. - * A key can be authenticated only if its status is SWEKEY_STATUS_OK - * - * @param id The id of the swekey - * - * @return The status of the swekey - * @access public - */ -function Swekey_GetStatus($id) -{ - global $gSwekeyStatusServer; - $res = Swekey_HttpGet($gSwekeyStatusServer.'/GET-STATUS/'.$id, $response_code); - if ($response_code == 200) { - return intval($res); - } - return SWEKEY_STATUS_UNKOWN; -} - -?>