From 00708291ba49f657b64122a21da458b4c1be0578 Mon Sep 17 00:00:00 2001 From: Gunnar Wrobel Date: Tue, 30 Nov 2010 16:35:24 +0100 Subject: [PATCH] Remove Horde_Nonce as duplication protection in Horde does not need that amount of complexity (though I really liked the bloom filter thing). --- framework/Nonce/lib/Horde/Nonce.php | 87 ------------ framework/Nonce/lib/Horde/Nonce/Filter.php | 51 ------- framework/Nonce/lib/Horde/Nonce/Generator.php | 87 ------------ framework/Nonce/lib/Horde/Nonce/Hash.php | 83 ----------- framework/Nonce/package.xml | 111 --------------- framework/Nonce/test/Horde/Nonce/AllTests.php | 50 ------- framework/Nonce/test/Horde/Nonce/Autoload.php | 26 ---- .../test/Horde/Nonce/Integration/NonceTest.php | 142 ------------------- framework/Nonce/test/Horde/Nonce/StoryTestCase.php | 152 --------------------- framework/Nonce/test/Horde/Nonce/phpunit.xml | 8 -- 10 files changed, 797 deletions(-) delete mode 100644 framework/Nonce/lib/Horde/Nonce.php delete mode 100644 framework/Nonce/lib/Horde/Nonce/Filter.php delete mode 100644 framework/Nonce/lib/Horde/Nonce/Generator.php delete mode 100644 framework/Nonce/lib/Horde/Nonce/Hash.php delete mode 100644 framework/Nonce/package.xml delete mode 100644 framework/Nonce/test/Horde/Nonce/AllTests.php delete mode 100644 framework/Nonce/test/Horde/Nonce/Autoload.php delete mode 100644 framework/Nonce/test/Horde/Nonce/Integration/NonceTest.php delete mode 100644 framework/Nonce/test/Horde/Nonce/StoryTestCase.php delete mode 100644 framework/Nonce/test/Horde/Nonce/phpunit.xml diff --git a/framework/Nonce/lib/Horde/Nonce.php b/framework/Nonce/lib/Horde/Nonce.php deleted file mode 100644 index 892e50230..000000000 --- a/framework/Nonce/lib/Horde/Nonce.php +++ /dev/null @@ -1,87 +0,0 @@ - - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ - -/** - * The nonce handler. - * - * Copyright 2010 The Horde Project (http://www.horde.org/) - * - * See the enclosed file COPYING for license information (LGPL). If you - * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html. - * - * @category Horde - * @package Nonce - * @author Gunnar Wrobel - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ -class Horde_Nonce -{ - /** - * The nonce generator. - * - * @var Horde_Nonce_Generator - */ - private $_generator; - - /** - * Hashes the random part of a nonce for storage in the Bloom filter. - * - * @var Horde_Nonce_Hash - */ - private $_hash; - - /** - * Constructor. - * - * @param Horde_Nonce_Hash $hash Hashes the random part of a nonce for - * storage in the Bloom filter. - * @param int $size Size of the random part of the generated - * nonces. - */ - public function __construct( - Horde_Nonce_Generator $generator, - Horde_Nonce_Hash $hash - ) { - $this->_generator = $generator; - $this->_hash = $hash; - } - - /** - * Return a nonce. - * - * @return string The nonce. - */ - public function create() - { - return $this->_generator->create(); - } - - /** - * Validate a nonce. - * - * @param string $nonce The nonce that should be validate. - * @param float $timeout The nonce should be invalid after this amount of time. - * - * @return boolean True if the nonce is still valid. - */ - public function isValid($nonce, $timeout = -1) - { - list($timestamp, $random) = $this->_generator->split($nonce); - if ($timeout > 0 && $timestamp < (time() - $timeout)) { - return false; - } - - return true; - } -} diff --git a/framework/Nonce/lib/Horde/Nonce/Filter.php b/framework/Nonce/lib/Horde/Nonce/Filter.php deleted file mode 100644 index 2ca4f4f5c..000000000 --- a/framework/Nonce/lib/Horde/Nonce/Filter.php +++ /dev/null @@ -1,51 +0,0 @@ - - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ - -/** - * Generates nonces. - * - * Copyright 2010 The Horde Project (http://www.horde.org/) - * - * See the enclosed file COPYING for license information (LGPL). If you - * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html. - * - * @category Horde - * @package Nonce - * @author Gunnar Wrobel - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ -class Horde_Nonce_Filter -{ - private $_filter = array(); - - public function isUsed($counter, $hashes) - { - $unused_checks = 0; - foreach ($hashes as $hash) { - if (!isset($this->_filter[$hash]) || $counter > $this->_filter[$hash]) { - $unused_checks++; - } - } - foreach ($hashes as $hash) { - if (!isset($this->_filter[$hash]) || $counter > $this->_filter[$hash]) { - $this->_filter[$hash] = $counter; - } - } - if ($unused_checks > 0) { - return false; - } else { - return true; - } - } -} \ No newline at end of file diff --git a/framework/Nonce/lib/Horde/Nonce/Generator.php b/framework/Nonce/lib/Horde/Nonce/Generator.php deleted file mode 100644 index 83b8e61c1..000000000 --- a/framework/Nonce/lib/Horde/Nonce/Generator.php +++ /dev/null @@ -1,87 +0,0 @@ - - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ - -/** - * Generates nonces. - * - * Copyright 2010 The Horde Project (http://www.horde.org/) - * - * See the enclosed file COPYING for license information (LGPL). If you - * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html. - * - * @category Horde - * @package Nonce - * @author Gunnar Wrobel - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ -class Horde_Nonce_Generator -{ - /** - * Size of the random part of the nonce. - * - * @var int - */ - private $_size; - - /** - * Constructor. - * - * @param int $size Size of the random part of the generated nonces (16 bits - * per increment). - */ - public function __construct($size = 1) - { - $this->_size = $size; - } - - /** - * Return a nonce. - * - * @return string The nonce. - */ - public function create() - { - return pack('N', time()) . $this->_createRandom(); - } - - /** - * Return the random part for a nonce. - * - * @return string The random part. - */ - private function _createRandom() - { - $random = ''; - for ($i = 0;$i < $this->_size * 2; $i++) { - $random .= pack('n', mt_rand()); - } - return $random; - } - - /** - * Split a nonce into the timestamp and the random part. - * - * @param string $nonce The nonce to be splitted. - * - * @return array A list of two elements: the timestamp and the random part. - */ - public function split($nonce) - { - $timestamp = unpack('N', substr($nonce, 0, 4)); - return array( - array_pop($timestamp), - unpack('n' . $this->_size * 2, substr($nonce, 4)) - ); - } -} diff --git a/framework/Nonce/lib/Horde/Nonce/Hash.php b/framework/Nonce/lib/Horde/Nonce/Hash.php deleted file mode 100644 index f2c43d2aa..000000000 --- a/framework/Nonce/lib/Horde/Nonce/Hash.php +++ /dev/null @@ -1,83 +0,0 @@ - - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ - -/** - * Hashes the random part of a nonce so that it can be stored in the Bloom - * filter. - * - * Copyright 2010 The Horde Project (http://www.horde.org/) - * - * See the enclosed file COPYING for license information (LGPL). If you - * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html. - * - * @category Horde - * @package Nonce - * @author Gunnar Wrobel - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ -class Horde_Nonce_Hash -{ - /** - * Number of hash functions / resulting hash keys. - * - * @var int - */ - private $_keys; - - /** - * Bit length of the hash keys. - * - * @var int - */ - private $_size; - - /** - * Constructor. - * - * @param int $keys Number of resulting hash keys. - * @param int $size Size of the resulting hash keys. - */ - public function __construct($keys = 3, $size = 196) - { - $this->_keys = $keys; - $this->_size = $size; - } - - /** - * Hash the random part of a nonce. - * - * @param array $random The random part of the nonce splitted into two byte segments. - * - * @return array The resulting hash key array. - */ - public function hash(array $random) - { - /** - * Use only 31 bit of randomness as this is sufficient for the hashing - * and avoids troubles with signed integers. - */ - $start = array_pop($random); - $start |= (array_pop($random) & (pow(2, 15) - 1)) << 16; - - $hash = array(); - $hash[0] = $start % 197; - $start = (int) $start / 197; - $hash[1] = $start % 197; - $start = (int) $start / 197; - $hash[2] = $start % 197; - - return $hash; - } -} diff --git a/framework/Nonce/package.xml b/framework/Nonce/package.xml deleted file mode 100644 index 43df78071..000000000 --- a/framework/Nonce/package.xml +++ /dev/null @@ -1,111 +0,0 @@ - - - Nonce - pear.horde.org - Provides nonces (numbers used once) - Nonces (numbers used once) protect against reuse. They - can be used to disallow sending forms or using links twice. They can - can also be combined with tokens protecting against XSRF (though they - do not neccesarily provide any additional security in that - context). Generation of nonces is trivial but storage of used nonces - can be complex. This library relies primarily on modified Bloom - filters as suggested by Martin Schönert (who in turn refers to Robert - Floyd as the first one suggesting such an approach). - - Chuck Hagenbuch - chuck - chuck@horde.org - yes - - - Jan Schneider - jan - jan@horde.org - yes - - - Gunnar Wrobel - wrobel - wrobel@pardus.de - yes - - 2010-11-09 - - - 0.0.1 - 0.0.1 - - - alpha - alpha - - LGPL - -* Initial release. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 5.2.0 - - - 1.9.0 - - - - - - - - - - - - - - - - - - - 0.0.1 - 0.0.1 - - - alpha - alpha - - 2010-11-09 - LGPL - -* Initial release. - - - - diff --git a/framework/Nonce/test/Horde/Nonce/AllTests.php b/framework/Nonce/test/Horde/Nonce/AllTests.php deleted file mode 100644 index 0f972158b..000000000 --- a/framework/Nonce/test/Horde/Nonce/AllTests.php +++ /dev/null @@ -1,50 +0,0 @@ - - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ - -/** - * Define the main method - */ -if (!defined('PHPUnit_MAIN_METHOD')) { - define('PHPUnit_MAIN_METHOD', 'Horde_Nonce_AllTests::main'); -} - -/** - * Prepare the test setup. - */ -require_once 'Horde/Test/AllTests.php'; - -/** - * Combine the tests for this package. - * - * Copyright 2007-2010 The Horde Project (http://www.horde.org/) - * - * See the enclosed file COPYING for license information (LGPL). If you - * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html. - * - * @category Horde - * @package Nonce - * @subpackage UnitTests - * @author Gunnar Wrobel - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ -class Horde_Nonce_AllTests extends Horde_Test_AllTests -{ -} - -Horde_Nonce_AllTests::init('Horde_Nonce', __FILE__); - -if (PHPUnit_MAIN_METHOD == 'Horde_Nonce_AllTests::main') { - Horde_Nonce_AllTests::main(); -} diff --git a/framework/Nonce/test/Horde/Nonce/Autoload.php b/framework/Nonce/test/Horde/Nonce/Autoload.php deleted file mode 100644 index 09f45122c..000000000 --- a/framework/Nonce/test/Horde/Nonce/Autoload.php +++ /dev/null @@ -1,26 +0,0 @@ - - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ - -require_once 'Horde/Test/Autoload.php'; - -/** Catch strict standards */ -error_reporting(E_ALL | E_STRICT); - -/** Load the basic test definition */ -require_once dirname(__FILE__) . '/StoryTestCase.php'; diff --git a/framework/Nonce/test/Horde/Nonce/Integration/NonceTest.php b/framework/Nonce/test/Horde/Nonce/Integration/NonceTest.php deleted file mode 100644 index ce26f287c..000000000 --- a/framework/Nonce/test/Horde/Nonce/Integration/NonceTest.php +++ /dev/null @@ -1,142 +0,0 @@ - - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ - -/** - * Prepare the test setup. - */ -require_once dirname(__FILE__) . '/../Autoload.php'; - -/** - * Test the Nonce system. - * - * Copyright 2010 The Horde Project (http://www.horde.org/) - * - * See the enclosed file COPYING for license information (LGPL). If you - * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html. - * - * @category Horde - * @package Nonce - * @subpackage UnitTests - * @author Gunnar Wrobel - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ -class Horde_Nonce_Integration_NonceTest -extends Horde_Nonce_StoryTestCase -{ - /** - * @scenario - */ - public function defaultLength() - { - $this->given('the default nonce setup') - ->when('retrieving a nonce') - ->then('the nonce has a length of 8 bytes'); - } - - /** - * @scenario - */ - public function nonceTimeOut() - { - $this->given('the default nonce setup') - ->when('retrieving a nonce') - ->and('waiting for two seconds') - ->then('the nonce is invalid given a timeout of one second'); - } - - /** - * @scenario - */ - public function nonceWithoutTimeout() - { - $this->given('the default nonce setup') - ->when('retrieving a nonce') - ->and('waiting for two seconds') - ->then('the nonce is valid given no timeout'); - } - - /** - * @scenario - */ - public function nonceCounterValue() - { - $this->given('the default nonce generator') - ->when('splitting nonce', 'MABBCCDD') - ->then('the extracted counter value (here: timestamp) is', 1296122434); - } - - /** - * @scenario - */ - public function nonceRandomValue() - { - $this->given('the default nonce generator') - ->when('splitting nonce', 'MABBCCDD') - ->then('the extracted random part matches', array(1 => 17219, 2 => 17476)); - } - - /** - * @scenario - */ - public function nonceHashes() - { - $this->given('the default hash setup') - ->when('hashing nonce', 'MABBCCDD') - ->then('the hash representation provides the hashes', 62, 165, 118); - } - - /** - * @scenario - */ - public function emptyFilter() - { - $this->given('the default filter setup') - ->when('testing whether a nonce is unused if it has the following counter and hash values', 50, 3, 10, 47) - ->then('the nonce is unused'); - } - - /** - * @scenario - */ - public function lowerCounter() - { - $this->given('the default filter setup') - ->and('the following counter and hash values are marked', 10, 3, 10, 47) - ->when('testing whether a nonce is unused if it has the following counter and hash values', 50, 3, 10, 47) - ->then('the nonce is unused'); - } - - /** - * @scenario - */ - public function unusedElement() - { - $this->given('the default filter setup') - ->and('the following counter and hash values are marked', 100, 3, 11, 47) - ->when('testing whether a nonce is unused if it has the following counter and hash values', 50, 3, 10, 47) - ->then('the nonce is unused'); - } - - /** - * @scenario - */ - public function used() - { - $this->given('the default filter setup') - ->and('the following counter and hash values are marked', 100, 3, 10, 47) - ->when('testing whether a nonce is unused if it has the following counter and hash values', 50, 3, 10, 47) - ->then('the nonce is used'); - } -} \ No newline at end of file diff --git a/framework/Nonce/test/Horde/Nonce/StoryTestCase.php b/framework/Nonce/test/Horde/Nonce/StoryTestCase.php deleted file mode 100644 index 2fc7e5ace..000000000 --- a/framework/Nonce/test/Horde/Nonce/StoryTestCase.php +++ /dev/null @@ -1,152 +0,0 @@ - - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ - -/** - * Base for story based package testing. - * - * Copyright 2010 The Horde Project (http://www.horde.org/) - * - * See the enclosed file COPYING for license information (LGPL). If you - * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html. - * - * @category Horde - * @package Nonce - * @subpackage UnitTests - * @author Gunnar Wrobel - * @license http://www.fsf.org/copyleft/lgpl.html LGPL - * @link http://pear.horde.org/index.php?package=Nonce - */ -class Horde_Nonce_StoryTestCase -extends PHPUnit_Extensions_Story_TestCase -{ - /** - * Handle a "given" step. - * - * @param array &$world Joined "world" of variables. - * @param string $action The description of the step. - * @param array $arguments Additional arguments to the step. - * - * @return mixed The outcome of the step. - */ - public function runGiven(&$world, $action, $arguments) - { - switch($action) { - case 'the default nonce setup': - $world['nonce_handler'] = new Horde_Nonce( - new Horde_Nonce_Generator(), - new Horde_Nonce_Hash() - ); - break; - case 'the default hash setup': - $world['nonce_hash'] = new Horde_Nonce_Hash(); - case 'the default nonce generator': - $world['nonce_generator'] = new Horde_Nonce_Generator(); - break; - case 'the default filter setup': - $world['nonce_filter'] = new Horde_Nonce_Filter(); - break; - case 'the following counter and hash values are marked': - $world['nonce_filter']->isUsed(array_shift($arguments), $arguments); - break; - default: - return $this->notImplemented($action); - } - } - - /** - * Handle a "when" step. - * - * @param array &$world Joined "world" of variables. - * @param string $action The description of the step. - * @param array $arguments Additional arguments to the step. - * - * @return mixed The outcome of the step. - */ - public function runWhen(&$world, $action, $arguments) - { - switch($action) { - case 'retrieving a nonce': - $world['nonce'] = $world['nonce_handler']->create(); - break; - case 'waiting for two seconds': - sleep(2); - break; - case 'splitting nonce': - list($timestamp, $random) = $world['nonce_generator']->split($arguments[0]); - $world['timestamp'] = $timestamp; - $world['random'] = $random; - break; - case 'hashing nonce': - list($timestamp, $random) = $world['nonce_generator']->split($arguments[0]); - $world['hashes'] = $world['nonce_hash']->hash($random); - break; - case 'testing whether a nonce is unused if it has the following counter and hash values': - $world['used'] = $world['nonce_filter']->isUsed(array_shift($arguments), $arguments); - break; - default: - return $this->notImplemented($action); - } - } - - /** - * Handle a "then" step. - * - * @param array &$world Joined "world" of variables. - * @param string $action The description of the step. - * @param array $arguments Additional arguments to the step. - * - * @return mixed The outcome of the step. - */ - public function runThen(&$world, $action, $arguments) - { - switch($action) { - case 'the nonce has a length of 8 bytes': - $this->assertEquals(8, strlen($world['nonce'])); - break; - case 'the nonce is invalid given a timeout of one second': - $this->assertFalse($world['nonce_handler']->isValid($world['nonce'], 1)); - break; - case 'the nonce is valid given no timeout': - $this->assertTrue($world['nonce_handler']->isValid($world['nonce'])); - break; - case 'the extracted counter value (here: timestamp) is': - $this->assertEquals( - $world['timestamp'], - $arguments[0] - ); - break; - case 'the extracted random part matches': - $this->assertEquals( - $world['random'], - $arguments[0] - ); - break; - case 'the hash representation provides the hashes': - $this->assertEquals( - $world['hashes'], - $arguments - ); - break; - case 'the nonce is unused': - $this->assertFalse($world['used']); - break; - case 'the nonce is used': - $this->assertTrue($world['used']); - break; - default: - return $this->notImplemented($action); - } - } - -} \ No newline at end of file diff --git a/framework/Nonce/test/Horde/Nonce/phpunit.xml b/framework/Nonce/test/Horde/Nonce/phpunit.xml deleted file mode 100644 index 502d3c9b8..000000000 --- a/framework/Nonce/test/Horde/Nonce/phpunit.xml +++ /dev/null @@ -1,8 +0,0 @@ - - - - - ../../../lib - - - -- 2.11.0