+ cprintf("%d Transmit OpenID data now\n", START_CHAT_MODE);
+
+ while (client_getln(buf, sizeof buf), strcmp(buf, "000")) {
+ len = extract_token(thiskey, buf, 0, '|', sizeof thiskey);
+ if (len < 0) {
+ len = sizeof(thiskey) - 1;
+ }
+ extract_token(thisdata, buf, 1, '|', sizeof thisdata);
+ syslog(LOG_DEBUG, "%s: ["SIZE_T_FMT"] %s", thiskey, strlen(thisdata), thisdata);
+ Put(keys, thiskey, len, strdup(thisdata), NULL);
+ }
+
+ /* Check to see if this is a correct response */
+
+ /* oooh, really bad juju here. we're just accepting the assertion without validating it. */
+ oiddata->verified = 1;
+
+ char *openid_ns = NULL;
+ if ( (!GetHash(keys, "ns", 2, (void *) &openid_ns))
+ || (strcasecmp(openid_ns, "http://specs.openid.net/auth/2.0"))
+ ) {
+ syslog(LOG_DEBUG, "This is not an an OpenID assertion");
+ oiddata->verified = 0;
+ }
+
+ char *openid_mode = NULL;
+ if ( (!GetHash(keys, "mode", 4, (void *) &openid_mode))
+ || (strcasecmp(openid_mode, "id_res"))
+ ) {
+ oiddata->verified = 0;
+ }
+
+ char *openid_claimed_id = NULL;
+ if (GetHash(keys, "claimed_id", 10, (void *) &openid_claimed_id)) {
+ FreeStrBuf(&oiddata->claimed_id);
+ oiddata->claimed_id = NewStrBufPlain(openid_claimed_id, -1);
+ syslog(LOG_DEBUG, "Provider is asserting the Claimed ID '%s'", ChrPtr(oiddata->claimed_id));
+ }
+
+#if 0
+ /* Now that we have all of the parameters, we have to validate the signature against the server */
+ syslog(LOG_DEBUG, "Validating signature...");
+
+ CURL *curl;
+ CURLcode res;
+ struct curl_httppost *formpost = NULL;
+ struct curl_httppost *lastptr = NULL;
+ char errmsg[1024] = "";
+ char *o_assoc_handle = NULL;
+ char *o_sig = NULL;
+ char *o_signed = NULL;
+ int num_signed_values;
+ int i;
+ char k_keyname[128];
+ char k_o_keyname[128];
+ char *k_value = NULL;
+ StrBuf *ReplyBuf;
+
+ curl_formadd(&formpost, &lastptr,
+ CURLFORM_COPYNAME, "openid.mode",
+ CURLFORM_COPYCONTENTS, "check_authentication",
+ CURLFORM_END);
+ syslog(LOG_DEBUG, "%25s : %s", "openid.mode", "check_authentication");
+
+ if (GetHash(keys, "assoc_handle", 12, (void *) &o_assoc_handle)) {
+ curl_formadd(&formpost, &lastptr,
+ CURLFORM_COPYNAME, "openid.assoc_handle",
+ CURLFORM_COPYCONTENTS, o_assoc_handle,
+ CURLFORM_END);
+ syslog(LOG_DEBUG, "%25s : %s", "openid.assoc_handle", o_assoc_handle);
+ }
+
+ if (GetHash(keys, "sig", 3, (void *) &o_sig)) {
+ curl_formadd(&formpost, &lastptr,
+ CURLFORM_COPYNAME, "openid.sig",
+ CURLFORM_COPYCONTENTS, o_sig,
+ CURLFORM_END);
+ syslog(LOG_DEBUG, "%25s : %s", "openid.sig", o_sig);
+ }
+
+ if (GetHash(keys, "signed", 6, (void *) &o_signed)) {
+ curl_formadd(&formpost, &lastptr,
+ CURLFORM_COPYNAME, "openid.signed",
+ CURLFORM_COPYCONTENTS, o_signed,
+ CURLFORM_END);
+ syslog(LOG_DEBUG, "%25s : %s", "openid.signed", o_signed);
+
+ num_signed_values = num_tokens(o_signed, ',');
+ for (i=0; i<num_signed_values; ++i) {
+ extract_token(k_keyname, o_signed, i, ',', sizeof k_keyname);
+ if (strcasecmp(k_keyname, "mode")) { // work around phpMyID bug
+ if (GetHash(keys, k_keyname, strlen(k_keyname), (void *) &k_value)) {
+ snprintf(k_o_keyname, sizeof k_o_keyname, "openid.%s", k_keyname);
+ curl_formadd(&formpost, &lastptr,
+ CURLFORM_COPYNAME, k_o_keyname,
+ CURLFORM_COPYCONTENTS, k_value,
+ CURLFORM_END);
+ syslog(LOG_DEBUG, "%25s : %s", k_o_keyname, k_value);
+ }
+ else {
+ syslog(LOG_INFO, "OpenID: signed field '%s' is missing",
+ k_keyname);
+ }
+ }
+ }
+ }
+
+ ReplyBuf = NewStrBuf();