Initial commit

hosxp-webservice/inc/rfc6238.php

@@ -0,0 +1,208 @@
+<?php
+// http://www.faqs.org/rfcs/rfc6238.html   
+require_once(dirname(__FILE__) . '/base32static.php');
+
+class TokenAuth6238
+{
+
+  /**
+   * verify
+   * 
+   * @param string $secretkey Secret clue (base 32).
+   * @return bool True if success, false if failure
+   */
+  public static function verify($secretkey, $code, $rangein30s = 3)
+  {
+    $key = base32static::decode($secretkey);
+    if ($key === false) {
+      return false;
+    }
+    $unixtimestamp = time() / 30;
+
+    for ($i = - ($rangein30s); $i <= $rangein30s; $i++) {
+      $checktime = (int)($unixtimestamp + $i);
+      $thiskey = self::oath_hotp($key, $checktime);
+
+      if ((int)$code == self::oath_truncate($thiskey, 6)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+
+  public static function getTokenCode($secretkey, $rangein30s = 3)
+  {
+    $result = "";
+    $key = base32static::decode($secretkey);
+    $unixtimestamp = time() / 30;
+
+    for ($i = - ($rangein30s); $i <= $rangein30s; $i++) {
+      $checktime = (int)($unixtimestamp + $i);
+      $thiskey = self::oath_hotp($key, $checktime);
+      $result = $result . " # " . self::oath_truncate($thiskey, 6);
+    }
+
+    return $result;
+  }
+
+  public static function getTokenCodeDebug($secretkey, $rangein30s = 3)
+  {
+    $result = "";
+    print "<br/>SecretKey: $secretkey <br/>";
+
+    $key = base32static::decode($secretkey);
+    print "Key(base 32 decode): $key <br/>";
+
+    $unixtimestamp = time() / 30;
+    print "UnixTimeStamp (time()/30): $unixtimestamp <br/>";
+
+    for ($i = - ($rangein30s); $i <= $rangein30s; $i++) {
+      $checktime = (int)($unixtimestamp + $i);
+      print "Calculating oath_hotp from (int)(unixtimestamp +- 30sec offset): $checktime basing on secret key<br/>";
+
+      $thiskey = self::oath_hotp($key, $checktime, true);
+      print "======================================================<br/>";
+      print "CheckTime: $checktime oath_hotp:" . $thiskey . "<br/>";
+
+      $result = $result . " # " . self::oath_truncate($thiskey, 6, true);
+    }
+
+    return $result;
+  }
+
+  // public static function getBarCodeUrl($username, $domain, $secretkey, $issuer)
+  // {
+  //   $url = "http://chart.apis.google.com/chart";
+  //   $url = $url . "?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/";
+  //   $url = $url . $username . $domain . "%3Fsecret%3D" . $secretkey . '%26issuer%3D' . rawurlencode($issuer);
+
+  //   return $url;
+  // }
+
+  public static function getBarCodeUrl($username, $domain, $secretkey, $issuer)
+  {
+    $url = "https://api.qrserver.com/v1/create-qr-code/";
+    $url = $url . "?size=100x100&data=otpauth://totp/";
+    $url = $url . $username . $domain . "%3Fsecret%3D" . $secretkey . '%26issuer%3D' . rawurlencode($issuer);
+
+    return $url;
+  }
+
+  public static function generateRandomClue($length = 32)
+  {
+    $b32   = "234567QWERTYUIOPASDFGHJKLZXCVBNM";
+    $s   = "";
+
+    for ($i = 0; $i < $length; $i++)
+      $s .= $b32[rand(0, 31)];
+
+    return $s;
+  }
+
+  private static function hotp_tobytestream($key)
+  {
+    $result = "";
+    $last = strlen($key);
+    for ($i = 0; $i < $last; $i = $i + 2) {
+      $x = $key[$i] . $key[$i + 1];
+      $x = strtoupper($x);
+      $x = hexdec($x);
+      $result =  $result . chr($x);
+    }
+
+    return $result;
+  }
+
+  private static function oath_hotp($key, $counter, $debug = false)
+  {
+    $result = "";
+    $orgcounter = $counter;
+    $cur_counter = array(0, 0, 0, 0, 0, 0, 0, 0);
+
+    if ($debug) {
+      print "Packing counter $counter (" . dechex($counter) . ")into binary string - pay attention to hex representation of key and binary representation<br/>";
+    }
+
+    for ($i = 7; $i >= 0; $i--) { // C for unsigned char, * for  repeating to the end of the input data 
+      $cur_counter[$i] = pack('C*', $counter);
+
+      if ($debug) {
+        print $cur_counter[$i] . "(" . dechex(ord($cur_counter[$i])) . ")" . " from $counter <br/>";
+      }
+
+      $counter = $counter >> 8;
+    }
+
+    if ($debug) {
+      foreach ($cur_counter as $char) {
+        print ord($char) . " ";
+      }
+
+      print "<br/>";
+    }
+
+    $binary = implode($cur_counter);
+
+    // Pad to 8 characters
+    str_pad($binary, 8, chr(0), STR_PAD_LEFT);
+
+    if ($debug) {
+      print "Prior to HMAC calculation pad with zero on the left until 8 characters.<br/>";
+      print "Calculate sha1 HMAC(Hash-based Message Authentication Code http://en.wikipedia.org/wiki/HMAC).<br/>";
+      print "hash_hmac ('sha1', $binary, $key)<br/>";
+    }
+
+    $result = hash_hmac('sha1', $binary, $key);
+
+    if ($debug) {
+      print "Result: $result <br/>";
+    }
+
+    return $result;
+  }
+
+  private static function oath_truncate($hash, $length = 6, $debug = false)
+  {
+    $result = "";
+
+    // Convert to dec
+    if ($debug) {
+      print "converting hex hash into characters<br/>";
+    }
+
+    $hashcharacters = str_split($hash, 2);
+
+    if ($debug) {
+      print_r($hashcharacters);
+      print "<br/>and convert to decimals:<br/>";
+    }
+
+    for ($j = 0; $j < count($hashcharacters); $j++) {
+      $hmac_result[] = hexdec($hashcharacters[$j]);
+    }
+
+    if ($debug) {
+      print_r($hmac_result);
+    }
+
+    // http://php.net/manual/ru/function.hash-hmac.php 
+    // adopted from brent at thebrent dot net 21-May-2009 08:17 comment
+
+    $offset = $hmac_result[19] & 0xf;
+
+    if ($debug) {
+      print "Calculating offset as 19th element of hmac:" . $hmac_result[19] . "<br/>";
+      print "offset:" . $offset;
+    }
+
+    $result = (
+      (($hmac_result[$offset + 0] & 0x7f) << 24) |
+      (($hmac_result[$offset + 1] & 0xff) << 16) |
+      (($hmac_result[$offset + 2] & 0xff) << 8) |
+      ($hmac_result[$offset + 3] & 0xff)
+    ) % pow(10, $length);
+
+    return $result;
+  }
+}