File Coverage

blib/lib/AnyEvent/Yubico.pm

Criterion	Covered	Total	%
statement	85	95	89.4
branch	19	32	59.3
condition	2	3	66.6
subroutine	14	14	100.0
pod	0	6	0.0
total	120	150	80.0

package AnyEvent::Yubico;

use strict;
use AnyEvent::HTTP;
use UUID::Tiny;
use MIME::Base64;
use Digest::HMAC_SHA1 qw(hmac_sha1);
use URI::Escape;

our $VERSION = '0.9.3';

# Creates a new Yubico instance to be used for validation of OTPs.
sub new {
	my $class = shift;
	my $self = {
		sign_request => 1,
		local_timeout => 30.0,
		urls => [
			"https://api.yubico.com/wsapi/2.0/verify",
			"https://api2.yubico.com/wsapi/2.0/verify",
			"https://api3.yubico.com/wsapi/2.0/verify",
			"https://api4.yubico.com/wsapi/2.0/verify",
			"https://api5.yubico.com/wsapi/2.0/verify"
		]
	};

	my $options = shift;

	$self = { %$self, %$options };

	return bless $self, $class;
};

# Verifies the given OTP and returns a true value if the OTP could be
# verified, false otherwise.
sub verify {
	return verify_async(@_)->recv->{status} eq 'OK';
}

# Verifies the given OTP and returns a hash containing the server response.
sub verify_sync {
	return verify_async(@_)->recv
}

# Non-blocking version of verify_sync, which returns a condition variable
# (see AnyEvent->condvar for details).
sub verify_async {
	my($self, $otp, $callback) = @_;

	my $nonce = create_UUID_as_string(UUID_V4);
	$nonce =~ s/-//g;

	my $params = {
		id => $self->{client_id},
		nonce => $nonce,
		otp => $otp
	};

	if(exists $self->{timeout}) {
		$params->{timeout} = $self->{timeout};
	}
	if(exists $self->{sl}) {
		$params->{sl} = $self->{sl};
	}
	if($self->{timestamp}) {
		$params->{timestamp} = 1;
	}

	if($self->{sign_request} and !$self->{api_key} eq '') {
		$params->{h} = $self->sign($params);
	}

	my $query = "";
	for my $key (keys %$params) {
    		$query = "$query&$key=".uri_escape($params->{$key});
    	}
	$query = "?".substr($query, 1);

	my $last_response;
	my @requests = ();
	my $result_var = AnyEvent->condvar(cb => $callback);
	my $inner_var = AnyEvent->condvar(cb => sub {
		my $result = shift->recv;

		foreach my $req (@requests) {
			undef $req;
		}

		if(exists $result->{status}) {
			$result_var->send($result);
		} elsif(exists $last_response->{status}) {
			#All responses returned replayed request.
			$result_var->send($last_response);
		} else {
			#Didn't get any valid responses.
			$result_var->croak("No valid response!");
		}
	});

	foreach my $url (@{$self->{urls}}) {
		$inner_var->begin();
		push(@requests, http_get("$url$query",
				timeout => $self->{local_timeout},
				tls_ctx => 'high',
				sub {
			my($body, $hdr) = @_;

			if(not $hdr->{Status} =~ /^2/) {
				#Error, store message if none exists.
				if(not exists $last_response->{status}) {
					$last_response->{status} = $hdr->{Reason};
				}
				$inner_var->end();
				return;
			}

			my $response = parse_response($body);

			if(! exists $response->{status}) {
				#Response does not look valid, discard.
				$inner_var->end();
				return;
			}

			if(! $self->{api_key} eq '') {
				my $signature = $response->{h};
				delete $response->{h};
				if(! $signature eq $self->sign($response)) {
					$response->{status} = "BAD_RESPONSE_SIGNATURE";
				}
			}

			$last_response = $response;

			if($response->{status} eq "REPLAYED_REQUEST") {
				#Replayed request, wait for next.
				$inner_var->end();
			} else {
				#Definitive response, return it.
				if($response->{status} eq "OK") {
					$inner_var->croak("Response nonce does not match!") if(! $nonce eq $response->{nonce});
					$inner_var->croak("Response OTP does not match!") if(! $otp eq $response->{otp});
				}

				$inner_var->send($response);
			}
		}));
	}

	return $result_var;
};

# Signs a parameter hash using the client API key.
sub sign {
	my ($self, $params) = @_;
	my $content = "";

	foreach my $key (sort keys %$params) {
		$content = $content."&$key=$params->{$key}";
	}
	$content = substr($content, 1);

	my $key = decode_base64($self->{api_key});
	my $signature = encode_base64(hmac_sha1($content, $key), '');

	return $signature;
}

# Parses a response body into a hash.
sub parse_response {
	my $body = shift;
	my $response = {};

	if($body) {
		my @lines = split(' ', $body);
		foreach my $line (@lines) {
			my $index = index($line, '=');
			$response->{substr($line, 0, $index)} = substr($line, $index+1);
		}
	}

	return $response;
}

1;
__END__