Google Authenticator Verification iRule (TMOS v11.1+ optimized)

Hi Kai,

what do you think to use this loop instead of three times the same code: (

~$i

-(i+1)

0 -1 1 -2 2

    for {set i 0; set result 0} {$i < 20 && !($result)} {incr i} {
        foreach x "$i [expr {~$i}]" { 

            
             Perform verification of the provided ga(token) for time frame ga(clock)  $x 
            

             Calculate hex encoded HMAC checksum value for wide-int value of time frame ga(clock) + x using ga(key) as secret

            binary scan [CRYPTO::sign -alg $static::ga_hmac_mode -key $ga(key) [binary format W* [expr { $ga(clock) + $x }]]] H* ga(verify)

             Parse ga(offset) based on the last nibble (= 4 bits / 1 hex) of the ga(verify) HMAC checksum and multiply with 2 for byte to hex conversation

            set ga(offset) [expr { "0x[string index $ga(verify) end]" * 2 } ]

             Parse (= 4 bytes / 8 hex) from ga(verify) starting at the ga(offset) value, then remove the most significant bit, perform the modulo 1000000 and format the result to a 6 digit number

            set ga(verify) [format %06d [expr { ( "0x[string range $ga(verify) $ga(offset) [expr { $ga(offset) + 7 } ]]" & 0x7FFFFFFF ) % 1000000 } ]]

             Compare ga(verify) with user provided ga(token) value

            if { $ga(verify) equals $ga(token) } then {

                 The provided ga(token) is valid"
                set result 1
                break

            }
        }
    }

I also replaced Valid / Invalid with 0 / 1

you can return status with [lindex {Invalid Valid} $result]