<?php /** * This file supplies a Memcached store backend for OpenID servers and * consumers. * * PHP versions 4 and 5 * * LICENSE: See the COPYING file included in this distribution. * * @package OpenID * @author JanRain, Inc. <openid@janrain.com> * @copyright 2005-2008 Janrain, Inc. * @license http://www.apache.org/licenses/LICENSE-2.0 Apache */ /** * Require base class for creating a new interface. */ require_once 'Auth/OpenID.php'; require_once 'Auth/OpenID/Interface.php'; require_once 'Auth/OpenID/HMAC.php'; require_once 'Auth/OpenID/Nonce.php'; /** * This is a filesystem-based store for OpenID associations and * nonces. This store should be safe for use in concurrent systems on * both windows and unix (excluding NFS filesystems). There are a * couple race conditions in the system, but those failure cases have * been set up in such a way that the worst-case behavior is someone * having to try to log in a second time. * * Most of the methods of this class are implementation details. * People wishing to just use this store need only pay attention to * the constructor. * * @package OpenID */ class Auth_OpenID_FileStore extends Auth_OpenID_OpenIDStore { /** * Initializes a new {@link Auth_OpenID_FileStore}. This * initializes the nonce and association directories, which are * subdirectories of the directory passed in. * * @param string $directory This is the directory to put the store * directories in. */ function Auth_OpenID_FileStore($directory) { if (!Auth_OpenID::ensureDir($directory)) { trigger_error('Not a directory and failed to create: ' . $directory, E_USER_ERROR); } $directory = realpath($directory); $this->directory = $directory; $this->active = true; $this->nonce_dir = $directory . DIRECTORY_SEPARATOR . 'nonces'; $this->association_dir = $directory . DIRECTORY_SEPARATOR . 'associations'; // Temp dir must be on the same filesystem as the assciations // $directory. $this->temp_dir = $directory . DIRECTORY_SEPARATOR . 'temp'; $this->max_nonce_age = 6 * 60 * 60; // Six hours, in seconds if (!$this->_setup()) { trigger_error('Failed to initialize OpenID file store in ' . $directory, E_USER_ERROR); } } function destroy() { Auth_OpenID_FileStore::_rmtree($this->directory); $this->active = false; } /** * Make sure that the directories in which we store our data * exist. * * @access private */ function _setup() { return (Auth_OpenID::ensureDir($this->nonce_dir) && Auth_OpenID::ensureDir($this->association_dir) && Auth_OpenID::ensureDir($this->temp_dir)); } /** * Create a temporary file on the same filesystem as * $this->association_dir. * * The temporary directory should not be cleaned if there are any * processes using the store. If there is no active process using * the store, it is safe to remove all of the files in the * temporary directory. * * @return array ($fd, $filename) * @access private */ function _mktemp() { $name = Auth_OpenID_FileStore::_mkstemp($dir = $this->temp_dir); $file_obj = @fopen($name, 'wb'); if ($file_obj !== false) { return array($file_obj, $name); } else { Auth_OpenID_FileStore::_removeIfPresent($name); } } function cleanupNonces() { global $Auth_OpenID_SKEW; $nonces = Auth_OpenID_FileStore::_listdir($this->nonce_dir); $now = time(); $removed = 0; // Check all nonces for expiry foreach ($nonces as $nonce_fname) { $base = basename($nonce_fname); $parts = explode('-', $base, 2); $timestamp = $parts[0]; $timestamp = intval($timestamp, 16); if (abs($timestamp - $now) > $Auth_OpenID_SKEW) { Auth_OpenID_FileStore::_removeIfPresent($nonce_fname); $removed += 1; } } return $removed; } /** * Create a unique filename for a given server url and * handle. This implementation does not assume anything about the * format of the handle. The filename that is returned will * contain the domain name from the server URL for ease of human * inspection of the data directory. * * @return string $filename */ function getAssociationFilename($server_url, $handle) { if (!$this->active) { trigger_error("FileStore no longer active", E_USER_ERROR); return null; } if (strpos($server_url, '://') === false) { trigger_error(sprintf("Bad server URL: %s", $server_url), E_USER_WARNING); return null; } list($proto, $rest) = explode('://', $server_url, 2); $parts = explode('/', $rest); $domain = Auth_OpenID_FileStore::_filenameEscape($parts[0]); $url_hash = Auth_OpenID_FileStore::_safe64($server_url); if ($handle) { $handle_hash = Auth_OpenID_FileStore::_safe64($handle); } else { $handle_hash = ''; } $filename = sprintf('%s-%s-%s-%s', $proto, $domain, $url_hash, $handle_hash); return $this->association_dir. DIRECTORY_SEPARATOR . $filename; } /** * Store an association in the association directory. */ function storeAssociation($server_url, $association) { if (!$this->active) { trigger_error("FileStore no longer active", E_USER_ERROR); return false; } $association_s = $association->serialize(); $filename = $this->getAssociationFilename($server_url, $association->handle); list($tmp_file, $tmp) = $this->_mktemp(); if (!$tmp_file) { trigger_error("_mktemp didn't return a valid file descriptor", E_USER_WARNING); return false; } fwrite($tmp_file, $association_s); fflush($tmp_file); fclose($tmp_file); if (@rename($tmp, $filename)) { return true; } else { // In case we are running on Windows, try unlinking the // file in case it exists. @unlink($filename); // Now the target should not exist. Try renaming again, // giving up if it fails. if (@rename($tmp, $filename)) { return true; } } // If there was an error, don't leave the temporary file // around. Auth_OpenID_FileStore::_removeIfPresent($tmp); return false; } /** * Retrieve an association. If no handle is specified, return the * association with the most recent issue time. * * @return mixed $association */ function getAssociation($server_url, $handle = null) { if (!$this->active) { trigger_error("FileStore no longer active", E_USER_ERROR); return null; } if ($handle === null) { $handle = ''; } // The filename with the empty handle is a prefix of all other // associations for the given server URL. $filename = $this->getAssociationFilename($server_url, $handle); if ($handle) { return $this->_getAssociation($filename); } else { $association_files = Auth_OpenID_FileStore::_listdir($this->association_dir); $matching_files = array(); // strip off the path to do the comparison $name = basename($filename); foreach ($association_files as $association_file) { $base = basename($association_file); if (strpos($base, $name) === 0) { $matching_files[] = $association_file; } } $matching_associations = array(); // read the matching files and sort by time issued foreach ($matching_files as $full_name) { $association = $this->_getAssociation($full_name); if ($association !== null) { $matching_associations[] = array($association->issued, $association); } } $issued = array(); $assocs = array(); foreach ($matching_associations as $key => $assoc) { $issued[$key] = $assoc[0]; $assocs[$key] = $assoc[1]; } array_multisort($issued, SORT_DESC, $assocs, SORT_DESC, $matching_associations); // return the most recently issued one. if ($matching_associations) { list($issued, $assoc) = $matching_associations[0]; return $assoc; } else { return null; } } } /** * @access private */ function _getAssociation($filename) { if (!$this->active) { trigger_error("FileStore no longer active", E_USER_ERROR); return null; } if (file_exists($filename) !== true) { return null; } $assoc_file = @fopen($filename, 'rb'); if ($assoc_file === false) { return null; } $filesize = filesize($filename); if ($filesize === false || $filesize <= 0) { return null; } $assoc_s = fread($assoc_file, $filesize); fclose($assoc_file); if (!$assoc_s) { return null; } $association = Auth_OpenID_Association::deserialize('Auth_OpenID_Association', $assoc_s); if (!$association) { Auth_OpenID_FileStore::_removeIfPresent($filename); return null; } if ($association->getExpiresIn() == 0) { Auth_OpenID_FileStore::_removeIfPresent($filename); return null; } else { return $association; } } /** * Remove an association if it exists. Do nothing if it does not. * * @return bool $success */ function removeAssociation($server_url, $handle) { if (!$this->active) { trigger_error("FileStore no longer active", E_USER_ERROR); return null; } $assoc = $this->getAssociation($server_url, $handle); if ($assoc === null) { return false; } else { $filename = $this->getAssociationFilename($server_url, $handle); return Auth_OpenID_FileStore::_removeIfPresent($filename); } } /** * Return whether this nonce is present. As a side effect, mark it * as no longer present. * * @return bool $present */ function useNonce($server_url, $timestamp, $salt) { global $Auth_OpenID_SKEW; if (!$this->active) { trigger_error("FileStore no longer active", E_USER_ERROR); return null; } if ( abs($timestamp - time()) > $Auth_OpenID_SKEW ) { return false; } if ($server_url) { list($proto, $rest) = explode('://', $server_url, 2); } else { $proto = ''; $rest = ''; } $parts = explode('/', $rest, 2); $domain = $this->_filenameEscape($parts[0]); $url_hash = $this->_safe64($server_url); $salt_hash = $this->_safe64($salt); $filename = sprintf('%08x-%s-%s-%s-%s', $timestamp, $proto, $domain, $url_hash, $salt_hash); $filename = $this->nonce_dir . DIRECTORY_SEPARATOR . $filename; $result = @fopen($filename, 'x'); if ($result === false) { return false; } else { fclose($result); return true; } } /** * Remove expired entries from the database. This is potentially * expensive, so only run when it is acceptable to take time. * * @access private */ function _allAssocs() { $all_associations = array(); $association_filenames = Auth_OpenID_FileStore::_listdir($this->association_dir); foreach ($association_filenames as $association_filename) { $association_file = fopen($association_filename, 'rb'); if ($association_file !== false) { $assoc_s = fread($association_file, filesize($association_filename)); fclose($association_file); // Remove expired or corrupted associations $association = Auth_OpenID_Association::deserialize( 'Auth_OpenID_Association', $assoc_s); if ($association === null) { Auth_OpenID_FileStore::_removeIfPresent( $association_filename); } else { if ($association->getExpiresIn() == 0) { $all_associations[] = array($association_filename, $association); } } } } return $all_associations; } function clean() { if (!$this->active) { trigger_error("FileStore no longer active", E_USER_ERROR); return null; } $nonces = Auth_OpenID_FileStore::_listdir($this->nonce_dir); $now = time(); // Check all nonces for expiry foreach ($nonces as $nonce) { if (!Auth_OpenID_checkTimestamp($nonce, $now)) { $filename = $this->nonce_dir . DIRECTORY_SEPARATOR . $nonce; Auth_OpenID_FileStore::_removeIfPresent($filename); } } foreach ($this->_allAssocs() as $pair) { list($assoc_filename, $assoc) = $pair; if ($assoc->getExpiresIn() == 0) { Auth_OpenID_FileStore::_removeIfPresent($assoc_filename); } } } /** * @access private */ function _rmtree($dir) { if ($dir[strlen($dir) - 1] != DIRECTORY_SEPARATOR) { $dir .= DIRECTORY_SEPARATOR; } if ($handle = opendir($dir)) { while ($item = readdir($handle)) { if (!in_array($item, array('.', '..'))) { if (is_dir($dir . $item)) { if (!Auth_OpenID_FileStore::_rmtree($dir . $item)) { return false; } } else if (is_file($dir . $item)) { if (!unlink($dir . $item)) { return false; } } } } closedir($handle); if (!@rmdir($dir)) { return false; } return true; } else { // Couldn't open directory. return false; } } /** * @access private */ function _mkstemp($dir) { foreach (range(0, 4) as $i) { $name = tempnam($dir, "php_openid_filestore_"); if ($name !== false) { return $name; } } return false; } /** * @access private */ static function _mkdtemp($dir) { foreach (range(0, 4) as $i) { $name = $dir . strval(DIRECTORY_SEPARATOR) . strval(getmypid()) . "-" . strval(rand(1, time())); if (!mkdir($name, 0700)) { return false; } else { return $name; } } return false; } /** * @access private */ function _listdir($dir) { $handle = opendir($dir); $files = array(); while (false !== ($filename = readdir($handle))) { if (!in_array($filename, array('.', '..'))) { $files[] = $dir . DIRECTORY_SEPARATOR . $filename; } } return $files; } /** * @access private */ function _isFilenameSafe($char) { $_Auth_OpenID_filename_allowed = Auth_OpenID_letters . Auth_OpenID_digits . "."; return (strpos($_Auth_OpenID_filename_allowed, $char) !== false); } /** * @access private */ function _safe64($str) { $h64 = base64_encode(Auth_OpenID_SHA1($str)); $h64 = str_replace('+', '_', $h64); $h64 = str_replace('/', '.', $h64); $h64 = str_replace('=', '', $h64); return $h64; } /** * @access private */ function _filenameEscape($str) { $filename = ""; $b = Auth_OpenID::toBytes($str); for ($i = 0; $i < count($b); $i++) { $c = $b[$i]; if (Auth_OpenID_FileStore::_isFilenameSafe($c)) { $filename .= $c; } else { $filename .= sprintf("_%02X", ord($c)); } } return $filename; } /** * Attempt to remove a file, returning whether the file existed at * the time of the call. * * @access private * @return bool $result True if the file was present, false if not. */ function _removeIfPresent($filename) { return @unlink($filename); } function cleanupAssociations() { $removed = 0; foreach ($this->_allAssocs() as $pair) { list($assoc_filename, $assoc) = $pair; if ($assoc->getExpiresIn() == 0) { $this->_removeIfPresent($assoc_filename); $removed += 1; } } return $removed; } }