Server.php

Go to the documentation of this file.

<?php
 
class sspmod_cdc_Server
{
    private $domain;
 
 
    private $server;
 
 
    private $key;
 
 
    private $cookieLifetime;
 
 
    public function __construct($domain)
    {
        assert(is_string($domain));
 
        $cdcConfig = SimpleSAML_Configuration::getConfig('module_cdc.php');
        $config = $cdcConfig->getConfigItem($domain, null);
 
        if ($config === null) {
            throw new SimpleSAML_Error_Exception('Unknown CDC domain: ' . var_export($domain, true));
        }
 
        $this->domain = $domain;
        $this->server = $config->getString('server');
        $this->key = $config->getString('key');
        $this->cookieLifetime = $config->getInteger('cookie.lifetime', 0);
 
        if ($this->key === 'ExampleSharedKey') {
            throw new SimpleSAML_Error_Exception('Key for CDC domain ' . var_export($domain, true) . ' not changed from default.');
        }
    }
 
 
    public function sendRequest(array $request)
    {
        assert(isset($request['return']));
        assert(isset($request['op']));
 
        $request['domain'] = $this->domain;
        $this->send($this->server, 'CDCRequest', $request);
    }
 
 
    public function getResponse()
    {
        $response = self::get('CDCResponse');
        if ($response === null) {
            return null;
        }
 
        if ($response['domain'] !== $this->domain) {
            throw new SimpleSAML_Error_Exception('Response received from wrong domain.');
        }
 
        $this->validate('CDCResponse');
 
        return $response;
    }
 
 
    public static function processRequest()
    {
        $request = self::get('CDCRequest');
        if ($request === null) {
            throw new SimpleSAML_Error_BadRequest('Missing "CDCRequest" parameter.');
        }
 
        $domain = $request['domain'];
        $server = new sspmod_cdc_Server($domain);
 
        $server->validate('CDCRequest');
        $server->handleRequest($request);
    }
 
 
    private function handleRequest(array $request)
    {
        if (!isset($request['op'])) {
            throw new SimpleSAML_Error_BadRequest('Missing "op" in CDC request.');
        }
        $op = (string)$request['op'];
 
        SimpleSAML\Logger::info('Received CDC request with "op": ' . var_export($op, true));
 
        if (!isset($request['return'])) {
            throw new SimpleSAML_Error_BadRequest('Missing "return" in CDC request.');
        }
        $return = (string)$request['return'];
 
        switch ($op) {
            case 'append':
                $response = $this->handleAppend($request);
                break;
            case 'delete':
                $response = $this->handleDelete($request);
                break;
            case 'read':
                $response = $this->handleRead($request);
                break;
            default:
                $response = 'unknown-op';
        }
 
        if (is_string($response)) {
            $response = array(
                'status' => $response,
            );
        }
 
        $response['op'] = $op;
        if (isset($request['id'])) {
            $response['id'] = (string)$request['id'];
        }
        $response['domain'] = $this->domain;
 
        $this->send($return, 'CDCResponse', $response);
    }
 
 
    private function handleAppend(array $request)
    {
        if (!isset($request['entityID'])) {
            throw new SimpleSAML_Error_BadRequest('Missing entityID in append request.');
        }
        $entityID = (string)$request['entityID'];
 
        $list = $this->getCDC();
 
        $prevIndex = array_search($entityID, $list, true);
        if ($prevIndex !== false) {
            unset($list[$prevIndex]);
        }
        $list[] = $entityID;
 
        $this->setCDC($list);
 
        return 'ok';
    }
 
 
    private function handleDelete(array $request)
    {
        $params = array(
            'path' => '/',
            'domain' => '.' . $this->domain,
            'secure' => true,
            'httponly' => false,
        );
 
        \SimpleSAML\Utils\HTTP::setCookie('_saml_idp', null, $params, false);
        return 'ok';
    }
 
 
    private function handleRead(array $request)
    {
        $list = $this->getCDC();
 
        return array(
            'status' => 'ok',
            'cdc' => $list,
        );
    }
 
 
    private static function get($parameter)
    {
        assert(is_string($parameter));
 
        if (!isset($_REQUEST[$parameter])) {
            return null;
        }
        $message = (string)$_REQUEST[$parameter];
 
        $message = @base64_decode($message);
        if ($message === false) {
            throw new SimpleSAML_Error_BadRequest('Error base64-decoding CDC message.');
        }
 
        $message = @json_decode($message, true);
        if ($message === false) {
            throw new SimpleSAML_Error_BadRequest('Error json-decoding CDC message.');
        }
 
        if (!isset($message['timestamp'])) {
            throw new SimpleSAML_Error_BadRequest('Missing timestamp in CDC message.');
        }
        $timestamp = (int)$message['timestamp'];
 
        if ($timestamp + 60 < time()) {
            throw new SimpleSAML_Error_BadRequest('CDC signature has expired.');
        }
        if ($timestamp - 60 > time()) {
            throw new SimpleSAML_Error_BadRequest('CDC signature from the future.');
        }
 
        if (!isset($message['domain'])) {
            throw new SimpleSAML_Error_BadRequest('Missing domain in CDC message.');
        }
 
        return $message;
    }
 
 
    private function validate($parameter)
    {
        assert(is_string($parameter));
        assert(isset($_REQUEST[$parameter]));
 
        $message = (string)$_REQUEST[$parameter];
 
        if (!isset($_REQUEST['Signature'])) {
            throw new SimpleSAML_Error_BadRequest('Missing Signature on CDC message.');
        }
        $signature = (string)$_REQUEST['Signature'];
 
        $cSignature = $this->calcSignature($message);
        if ($signature !== $cSignature) {
            throw new SimpleSAML_Error_BadRequest('Invalid signature on CDC message.');
        }
    }
 
 
    private function send($to, $parameter, array $message)
    {
        assert(is_string($to));
        assert(is_string($parameter));
 
        $message['timestamp'] = time();
        $message = json_encode($message);
        $message = base64_encode($message);
 
        $signature = $this->calcSignature($message);
 
        $params = array(
            $parameter => $message,
            'Signature' => $signature,
        );
 
        $url = \SimpleSAML\Utils\HTTP::addURLParameters($to, $params);
        if (strlen($url) < 2048) {
            \SimpleSAML\Utils\HTTP::redirectTrustedURL($url);
        } else {
            \SimpleSAML\Utils\HTTP::submitPOSTData($to, $params);
        }
    }
 
 
    private function calcSignature($rawMessage)
    {
        assert(is_string($rawMessage));
 
        return sha1($this->key . $rawMessage . $this->key);
    }
 
 
    private function getCDC()
    {
        if (!isset($_COOKIE['_saml_idp'])) {
            return array();
        }
 
        $ret = (string)$_COOKIE['_saml_idp'];
        $ret = explode(' ', $ret);
        foreach ($ret as &$idp) {
            $idp = base64_decode($idp);
            if ($idp === false) {
                // Not properly base64 encoded
                SimpleSAML\Logger::warning('CDC - Invalid base64-encoding of CDC entry.');
                return array();
            }
        }
 
        return $ret;
    }
 
 
    private function setCDC(array $list)
    {
        foreach ($list as &$value) {
            $value = base64_encode($value);
        }
 
        $cookie = implode(' ', $list);
 
        while (strlen($cookie) > 4000) {
            // The cookie is too long. Remove the oldest elements until it is short enough
            $tmp = explode(' ', $cookie, 2);
            if (count($tmp) === 1) {
                /*
                 * We are left with a single entityID whose base64
                 * representation is too long to fit in a cookie.
                 */
                break;
            }
            $cookie = $tmp[1];
        }
 
        $params = array(
            'lifetime' => $this->cookieLifetime,
            'path' => '/',
            'domain' => '.' . $this->domain,
            'secure' => true,
            'httponly' => false,
        );
 
        \SimpleSAML\Utils\HTTP::setCookie('_saml_idp', $cookie, $params, false);
    }
}