Subversion Repositories php_clientchallenge

Rev

Rev 4 | Rev 6 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed

Rev Author Line No. Line
2 daniel-mar 1 
<?php
2 
 
3 
/*
4 
 * php_clientchallenge
5 
 * Copyright 2021 Daniel Marschall, ViaThinkSoft
6 
 *
7 
 * Licensed under the Apache License, Version 2.0 (the "License");
8 
 * you may not use this file except in compliance with the License.
9 
 * You may obtain a copy of the License at
10 
 *
11 
 *     http://www.apache.org/licenses/LICENSE-2.0
12 
 *
13 
 * Unless required by applicable law or agreed to in writing, software
14 
 * distributed under the License is distributed on an "AS IS" BASIS,
15 
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 
 * See the License for the specific language governing permissions and
17 
 * limitations under the License.
18 
 */
19 
 
20 
namespace ViaThinkSoft\RateLimitingChallenge;
21 
 
22 
class ClientChallenge {
23 
 
4 daniel-mar 24 
        private static function sha3_512($message, $raw_output=false) {
2 daniel-mar 25 
                if (version_compare(PHP_VERSION, '7.1.0') >= 0) {
4 daniel-mar 26 
                        return hash('sha3-512', $message, $raw_output);
2 daniel-mar 27 
                } else {
5 daniel-mar 28 
                        return \bb\Sha3\Sha3::hash($message, 512, $raw_output); /** @phpstan-ignore-line */
2 daniel-mar 29 
                }
30 
        }
31 
 
4 daniel-mar 32 
        private static function sha3_512_hmac($message, $key, $raw_output=false) {
33 
                // RFC 2104 HMAC
34 
                if (version_compare(PHP_VERSION, '7.1.0') >= 0) {
35 
                        return hash_hmac('sha3-512', $message, $key, $raw_output);
36 
                } else {
37 
                        $blocksize = 576; // block size of sha-512!
2 daniel-mar 38 
 
4 daniel-mar 39 
                        if (strlen($key) > ($blocksize/8)) {
5 daniel-mar 40 
                                $k_ = self::sha3_512($key,true);
4 daniel-mar 41 
                        } else {
42 
                                $k_ = $key;
43 
                        }
2 daniel-mar 44 
 
4 daniel-mar 45 
                        $k_opad = str_repeat(chr(0x5C),($blocksize/8));
46 
                        $k_ipad = str_repeat(chr(0x36),($blocksize/8));
47 
                        for ($i=0; $i<strlen($k_); $i++) {
48 
                                $k_opad[$i] = $k_opad[$i] ^ $k_[$i];
49 
                                $k_ipad[$i] = $k_ipad[$i] ^ $k_[$i];
50 
                        }
2 daniel-mar 51 
 
5 daniel-mar 52 
                        return self::sha3_512($k_opad . self::sha3_512($k_ipad . $message, true));
4 daniel-mar 53 
                }
54 
        }
55 
 
56 
        public static function checkValidation($max_time=10, $server_secret) {
57 
 
58 
                if (!isset($_REQUEST['vts_validation_result'])) throw new \Exception('No challenge response found');
59 
 
60 
                list($starttime, $ip_target, $challenge, $answer, $challenge_integrity) = @json_decode($_REQUEST['vts_validation_result'], true);
61 
 
2 daniel-mar 62 
                if ($ip_target != $_SERVER['REMOTE_ADDR']) {
4 daniel-mar 63 
                        throw new \Exception('Wrong IP');
2 daniel-mar 64 
                } else if (time()-$starttime > $max_time) {
4 daniel-mar 65 
                        throw new \Exception('Challenge expired');
66 
                } else if ($challenge_integrity != self::sha3_512_hmac($challenge,$server_secret)) {
67 
                        throw new \Exception('Challenge integrity failed');
2 daniel-mar 68 
                } else if ($challenge !== self::sha3_512($starttime.'/'.$ip_target.'/'.$answer)) {
4 daniel-mar 69 
                        throw new \Exception('Wrong answer');
2 daniel-mar 70 
                } else {
71 
                        return true;
72 
                }
73 
        }
74 
 
75 
        // This is only called by ajax_get_challenge.php
4 daniel-mar 76 
        public static function createChallenge($complexity=500000, $server_secret) {
2 daniel-mar 77 
 
78 
                $min = 0;
79 
                $max = $complexity;
80 
 
81 
                $starttime = time();
82 
 
83 
                $random = rand($min,$max); // TODO: cryptographic rand
84 
 
85 
                $ip_target = $_SERVER['REMOTE_ADDR'];
86 
 
87 
                $challenge = self::sha3_512($starttime.'/'.$ip_target.'/'.$random);
88 
 
4 daniel-mar 89 
                $challenge_integrity = self::sha3_512_hmac($challenge,$server_secret);
2 daniel-mar 90 
 
4 daniel-mar 91 
                $send_to_client = array($starttime, $ip_target, $challenge, $min, $max, $challenge_integrity);
92 
 
2 daniel-mar 93 
                header('Content-Type:application/json');
94 
                die(json_encode($send_to_client));
95 
 
96 
        }
97 
 
98 
}