GEANT /
CAT
| Total Complexity | 217 |
| Total Lines | 1320 |
| Duplicated Lines | 0 % |
| Changes | 2 | ||
| Bugs | 0 | Features | 0 |
Complex classes like RADIUSTests often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use RADIUSTests, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 49 | class RADIUSTests extends AbstractTest { |
||
| 50 | |||
| 51 | /** |
||
| 52 | * Was the reachability check executed already? |
||
| 53 | * |
||
| 54 | * @var integer |
||
| 55 | */ |
||
| 56 | private $UDP_reachability_executed; |
||
| 57 | |||
| 58 | /** |
||
| 59 | * the issues we found |
||
| 60 | * |
||
| 61 | * @var array |
||
| 62 | */ |
||
| 63 | private $errorlist; |
||
| 64 | |||
| 65 | /** |
||
| 66 | * This private variable contains the realm to be checked. Is filled in the |
||
| 67 | * class constructor. |
||
| 68 | * |
||
| 69 | * @var string |
||
| 70 | */ |
||
| 71 | private $realm; |
||
| 72 | |||
| 73 | /** |
||
| 74 | * which username to use as outer identity |
||
| 75 | * |
||
| 76 | * @var string |
||
| 77 | */ |
||
| 78 | private $outerUsernameForChecks; |
||
| 79 | |||
| 80 | /** |
||
| 81 | * list of CAs we expect incoming server certs to be from |
||
| 82 | * |
||
| 83 | * @var array |
||
| 84 | */ |
||
| 85 | private $expectedCABundle; |
||
| 86 | |||
| 87 | /** |
||
| 88 | * list of expected server names |
||
| 89 | * |
||
| 90 | * @var array |
||
| 91 | */ |
||
| 92 | private $expectedServerNames; |
||
| 93 | |||
| 94 | /** |
||
| 95 | * the list of EAP types which the IdP allegedly supports. |
||
| 96 | * |
||
| 97 | * @var array |
||
| 98 | */ |
||
| 99 | private $supportedEapTypes; |
||
| 100 | |||
| 101 | /** |
||
| 102 | * Do we run thorough or shallow checks? |
||
| 103 | * |
||
| 104 | * @var integer |
||
| 105 | */ |
||
| 106 | private $opMode; |
||
| 107 | |||
| 108 | /** |
||
| 109 | * result of the reachability tests |
||
| 110 | * |
||
| 111 | * @var array |
||
| 112 | */ |
||
| 113 | public $UDP_reachability_result; |
||
| 114 | |||
| 115 | const RADIUS_TEST_OPERATION_MODE_SHALLOW = 1; |
||
| 116 | const RADIUS_TEST_OPERATION_MODE_THOROUGH = 2; |
||
| 117 | |||
| 118 | /** |
||
| 119 | * Constructor for the EAPTests class. The single mandatory parameter is the |
||
| 120 | * realm for which the tests are to be carried out. |
||
| 121 | * |
||
| 122 | * @param string $realm the realm to check |
||
| 123 | * @param string $outerUsernameForChecks outer username to use |
||
| 124 | * @param array $supportedEapTypes array of integer representations of EAP types |
||
| 125 | * @param array $expectedServerNames array of strings |
||
| 126 | * @param array $expectedCABundle array of PEM blocks |
||
| 127 | * @throws Exception |
||
| 128 | */ |
||
| 129 | public function __construct($realm, $outerUsernameForChecks, $supportedEapTypes = [], $expectedServerNames = [], $expectedCABundle = []) { |
||
| 130 | parent::__construct(); |
||
| 131 | $this->realm = $realm; |
||
| 132 | $this->outerUsernameForChecks = $outerUsernameForChecks; |
||
| 133 | $this->expectedCABundle = $expectedCABundle; |
||
| 134 | $this->expectedServerNames = $expectedServerNames; |
||
| 135 | $this->supportedEapTypes = $supportedEapTypes; |
||
| 136 | |||
| 137 | $this->opMode = self::RADIUS_TEST_OPERATION_MODE_SHALLOW; |
||
| 138 | |||
| 139 | $caNeeded = FALSE; |
||
| 140 | $serverNeeded = FALSE; |
||
| 141 | foreach ($supportedEapTypes as $oneEapType) { |
||
| 142 | if ($oneEapType->needsServerCACert()) { |
||
| 143 | $caNeeded = TRUE; |
||
| 144 | } |
||
| 145 | if ($oneEapType->needsServerName()) { |
||
| 146 | $serverNeeded = TRUE; |
||
| 147 | } |
||
| 148 | } |
||
| 149 | |||
| 150 | if ($caNeeded) { |
||
| 151 | // we need to have info about at least one CA cert and server names |
||
| 152 | if (count($this->expectedCABundle) == 0) { |
||
| 153 | throw new Exception("Thorough checks for an EAP type needing CAs were requested, but the required parameters were not given."); |
||
| 154 | } else { |
||
| 155 | $this->opMode = self::RADIUS_TEST_OPERATION_MODE_THOROUGH; |
||
| 156 | } |
||
| 157 | } |
||
| 158 | |||
| 159 | if ($serverNeeded) { |
||
| 160 | if (count($this->expectedServerNames) == 0) { |
||
| 161 | throw new Exception("Thorough checks for an EAP type needing server names were requested, but the required parameter was not given."); |
||
| 162 | } else { |
||
| 163 | $this->opMode = self::RADIUS_TEST_OPERATION_MODE_THOROUGH; |
||
| 164 | } |
||
| 165 | } |
||
| 166 | |||
| 167 | $this->loggerInstance->debug(4, "RADIUSTests is in opMode " . $this->opMode . ", parameters were: $realm, $outerUsernameForChecks, " . /** @scrutinizer ignore-type */ print_r($supportedEapTypes, true)); |
||
| 168 | $this->loggerInstance->debug(4, /** @scrutinizer ignore-type */ print_r($expectedServerNames, true)); |
||
| 169 | $this->loggerInstance->debug(4, /** @scrutinizer ignore-type */ print_r($expectedCABundle, true)); |
||
| 170 | |||
| 171 | $this->UDP_reachability_result = []; |
||
| 172 | $this->errorlist = []; |
||
| 173 | } |
||
| 174 | |||
| 175 | /** |
||
| 176 | * creates a string with the DistinguishedName (comma-separated name=value fields) |
||
| 177 | * |
||
| 178 | * @param array $distinguishedName the components of the DN |
||
| 179 | * @return string |
||
| 180 | */ |
||
| 181 | private function printDN($distinguishedName) { |
||
| 182 | $out = ''; |
||
| 183 | foreach (array_reverse($distinguishedName) as $nameType => $nameValue) { // to give an example: "CN" => "some.host.example" |
||
| 184 | if (!is_array($nameValue)) { // single-valued: just a string |
||
| 185 | $nameValue = ["$nameValue"]; // convert it to a multi-value attrib with just one value :-) for unified processing later on |
||
| 186 | } |
||
| 187 | foreach ($nameValue as $oneValue) { |
||
| 188 | if ($out) { |
||
| 189 | $out .= ','; |
||
| 190 | } |
||
| 191 | $out .= "$nameType=$oneValue"; |
||
| 192 | } |
||
| 193 | } |
||
| 194 | return($out); |
||
| 195 | } |
||
| 196 | |||
| 197 | /** |
||
| 198 | * prints a timestamp in gmdate formatting |
||
| 199 | * |
||
| 200 | * @param int $time time in UNIX timestamp |
||
| 201 | * @return string |
||
| 202 | */ |
||
| 203 | private function printTm($time) { |
||
| 204 | return(gmdate(\DateTime::COOKIE, $time)); |
||
| 205 | } |
||
| 206 | |||
| 207 | /** |
||
| 208 | * This function parses a X.509 server cert and checks if it finds client device incompatibilities |
||
| 209 | * |
||
| 210 | * @param array $servercert the properties of the certificate as returned by |
||
| 211 | * processCertificate(), $servercert is modified, |
||
| 212 | * if CRL is defied, it is downloaded and added to |
||
| 213 | * the array incoming_server_names, sAN_DNS and CN |
||
| 214 | * array values are also defined |
||
| 215 | * @return array of oddities; the array is empty if everything is fine |
||
| 216 | */ |
||
| 217 | private function propertyCheckServercert(&$servercert) { |
||
| 218 | // we share the same checks as for CAs when it comes to signature algorithm and basicconstraints |
||
| 219 | // so call that function and memorise the outcome |
||
| 220 | $returnarray = $this->propertyCheckIntermediate($servercert, TRUE); |
||
| 221 | $sANdns = []; |
||
| 222 | if (!isset($servercert['full_details']['extensions'])) { |
||
| 223 | $returnarray[] = RADIUSTests::CERTPROB_NO_TLS_WEBSERVER_OID; |
||
| 224 | $returnarray[] = RADIUSTests::CERTPROB_NO_CDP_HTTP; |
||
| 225 | } else { // Extensions are present... |
||
| 226 | if (!isset($servercert['full_details']['extensions']['extendedKeyUsage']) || !preg_match("/TLS Web Server Authentication/", $servercert['full_details']['extensions']['extendedKeyUsage'])) { |
||
| 227 | $returnarray[] = RADIUSTests::CERTPROB_NO_TLS_WEBSERVER_OID; |
||
| 228 | } |
||
| 229 | if (isset($servercert['full_details']['extensions']['subjectAltName'])) { |
||
| 230 | $sANlist = explode(", ", $servercert['full_details']['extensions']['subjectAltName']); |
||
| 231 | foreach ($sANlist as $subjectAltName) { |
||
| 232 | if (preg_match("/^DNS:/", $subjectAltName)) { |
||
| 233 | $sANdns[] = substr($subjectAltName, 4); |
||
| 234 | } |
||
| 235 | } |
||
| 236 | } |
||
| 237 | } |
||
| 238 | |||
| 239 | // often, there is only one name, so we store it in an array of one member |
||
| 240 | $commonName = [$servercert['full_details']['subject']['CN']]; |
||
| 241 | // if we got an array of names instead, then that is already an array, so override |
||
| 242 | if (isset($servercert['full_details']['subject']['CN']) && is_array($servercert['full_details']['subject']['CN'])) { |
||
| 243 | $commonName = $servercert['full_details']['subject']['CN']; |
||
| 244 | $returnarray[] = RADIUSTests::CERTPROB_MULTIPLE_CN; |
||
| 245 | } |
||
| 246 | $allnames = array_values(array_unique(array_merge($commonName, $sANdns))); |
||
| 247 | // check for wildcards |
||
| 248 | // check for real hostnames, and whether there is a wildcard in a name |
||
| 249 | foreach ($allnames as $onename) { |
||
| 250 | if (preg_match("/\*/", $onename)) { |
||
| 251 | $returnarray[] = RADIUSTests::CERTPROB_WILDCARD_IN_NAME; |
||
| 252 | continue; // otherwise we'd ALSO complain that it's not a real hostname |
||
| 253 | } |
||
| 254 | if ($onename != "" && filter_var("foo@" . idn_to_ascii($onename), FILTER_VALIDATE_EMAIL) === FALSE) { |
||
| 255 | $returnarray[] = RADIUSTests::CERTPROB_NOT_A_HOSTNAME; |
||
| 256 | } |
||
| 257 | } |
||
| 258 | $servercert['incoming_server_names'] = $allnames; |
||
| 259 | $servercert['sAN_DNS'] = $sANdns; |
||
| 260 | $servercert['CN'] = $commonName; |
||
| 261 | return $returnarray; |
||
| 262 | } |
||
| 263 | |||
| 264 | /** |
||
| 265 | * This function parses a X.509 intermediate CA cert and checks if it finds client device incompatibilities |
||
| 266 | * |
||
| 267 | * @param array $intermediateCa the properties of the certificate as returned by processCertificate() |
||
| 268 | * @param boolean $serverCert treat as servercert? |
||
| 269 | * @return array of oddities; the array is empty if everything is fine |
||
| 270 | */ |
||
| 271 | private function propertyCheckIntermediate(&$intermediateCa, $serverCert = FALSE) { |
||
| 272 | $returnarray = []; |
||
| 273 | if (preg_match("/md5/i", $intermediateCa['full_details']['signatureTypeSN'])) { |
||
| 274 | $returnarray[] = RADIUSTests::CERTPROB_MD5_SIGNATURE; |
||
| 275 | } |
||
| 276 | if (preg_match("/sha1/i", $intermediateCa['full_details']['signatureTypeSN'])) { |
||
| 277 | $probValue = RADIUSTests::CERTPROB_SHA1_SIGNATURE; |
||
| 278 | $returnarray[] = $probValue; |
||
| 279 | } |
||
| 280 | $this->loggerInstance->debug(4, "CERT IS: " . /** @scrutinizer ignore-type */ print_r($intermediateCa, TRUE)); |
||
| 281 | if ($intermediateCa['basicconstraints_set'] == 0) { |
||
| 282 | $returnarray[] = RADIUSTests::CERTPROB_NO_BASICCONSTRAINTS; |
||
| 283 | } |
||
| 284 | if ($intermediateCa['full_details']['public_key_algorithm'] == \core\common\X509::KNOWN_PUBLIC_KEY_ALGORITHMS[0] && $intermediateCa['full_details']['public_key_length'] < 2048) { |
||
| 285 | $returnarray[] = RADIUSTests::CERTPROB_LOW_KEY_LENGTH; |
||
| 286 | } |
||
| 287 | if (!in_array($intermediateCa['full_details']['public_key_algorithm'], \core\common\X509::KNOWN_PUBLIC_KEY_ALGORITHMS)) { |
||
| 288 | $returnarray[] = RADIUSTests::CERTPROB_UNKNOWN_PUBLIC_KEY_ALGORITHM; |
||
| 289 | } |
||
| 290 | $validFrom = $intermediateCa['full_details']['validFrom_time_t']; |
||
| 291 | $now = time(); |
||
| 292 | $validTo = $intermediateCa['full_details']['validTo_time_t']; |
||
| 293 | if ($validFrom > $now || $validTo < $now) { |
||
| 294 | $returnarray[] = RADIUSTests::CERTPROB_OUTSIDE_VALIDITY_PERIOD; |
||
| 295 | } |
||
| 296 | $addCertCrlResult = $this->addCrltoCert($intermediateCa); |
||
| 297 | if ($addCertCrlResult !== 0 && $serverCert) { |
||
| 298 | $returnarray[] = $addCertCrlResult; |
||
| 299 | } |
||
| 300 | |||
| 301 | return $returnarray; |
||
| 302 | } |
||
| 303 | |||
| 304 | /** |
||
| 305 | * This function returns an array of errors which were encountered in all the tests. |
||
| 306 | * |
||
| 307 | * @return array all the errors |
||
| 308 | */ |
||
| 309 | public function listerrors() { |
||
| 310 | return $this->errorlist; |
||
| 311 | } |
||
| 312 | |||
| 313 | /** |
||
| 314 | * This function performs actual authentication checks with MADE-UP credentials. |
||
| 315 | * Its purpose is to check if a RADIUS server is reachable and speaks EAP. |
||
| 316 | * The function fills array RADIUSTests::UDP_reachability_result[$probeindex] with all check detail |
||
| 317 | * in case more than the return code is needed/wanted by the caller |
||
| 318 | * |
||
| 319 | * @param int $probeindex refers to the specific UDP-host in the config that should be checked |
||
| 320 | * @param boolean $opnameCheck should we check choking on Operator-Name? |
||
| 321 | * @param boolean $frag should we cause UDP fragmentation? (Warning: makes use of Operator-Name!) |
||
| 322 | * @return integer returncode |
||
| 323 | * @throws Exception |
||
| 324 | */ |
||
| 325 | public function udpReachability($probeindex, $opnameCheck = TRUE, $frag = TRUE) { |
||
| 326 | // for EAP-TLS to be a viable option, we need to pass a random client cert to make eapol_test happy |
||
| 327 | // the following PEM data is one of the SENSE EAPLab client certs (not secret at all) |
||
| 328 | $clientcert = file_get_contents(dirname(__FILE__) . "/clientcert.p12"); |
||
| 329 | if ($clientcert === FALSE) { |
||
| 330 | throw new Exception("A dummy client cert is part of the source distribution, but could not be loaded!"); |
||
| 331 | } |
||
| 332 | // if we are in thorough opMode, use our knowledge for a more clever check |
||
| 333 | // otherwise guess |
||
| 334 | if ($this->opMode == self::RADIUS_TEST_OPERATION_MODE_THOROUGH) { |
||
| 335 | return $this->udpLogin($probeindex, $this->supportedEapTypes[0]->getArrayRep(), $this->outerUsernameForChecks, 'eaplab', $opnameCheck, $frag, $clientcert); |
||
| 336 | } |
||
| 337 | return $this->udpLogin($probeindex, \core\common\EAP::EAPTYPE_ANY, "cat-connectivity-test@" . $this->realm, 'eaplab', $opnameCheck, $frag, $clientcert); |
||
| 338 | } |
||
| 339 | |||
| 340 | /** |
||
| 341 | * There is a CRL Distribution Point URL in the certificate. So download the |
||
| 342 | * CRL and attach it to the cert structure so that we can later find out if |
||
| 343 | * the cert was revoked |
||
| 344 | * @param array $cert by-reference: the cert data we are writing into |
||
| 345 | * @return integer result code whether we were successful in retrieving the CRL |
||
| 346 | * @throws Exception |
||
| 347 | */ |
||
| 348 | private function addCrltoCert(&$cert) { |
||
| 349 | $crlUrl = []; |
||
| 350 | $returnresult = 0; |
||
| 351 | if (!isset($cert['full_details']['extensions']['crlDistributionPoints'])) { |
||
| 352 | return RADIUSTests::CERTPROB_NO_CDP; |
||
| 353 | } |
||
| 354 | if (!preg_match("/^.*URI\:(http)(.*)$/", str_replace(["\r", "\n"], ' ', $cert['full_details']['extensions']['crlDistributionPoints']), $crlUrl)) { |
||
| 355 | return RADIUSTests::CERTPROB_NO_CDP_HTTP; |
||
| 356 | } |
||
| 357 | // first and second sub-match is the full URL... check it |
||
| 358 | $crlcontent = \core\common\OutsideComm::downloadFile(trim($crlUrl[1] . $crlUrl[2]), \config\Diagnostics::TIMEOUTS['crl_download']); |
||
| 359 | if ($crlcontent === FALSE) { |
||
| 360 | return RADIUSTests::CERTPROB_NO_CRL_AT_CDP_URL; |
||
| 361 | } |
||
| 362 | /* CRLs are always in DER form, so need encoding |
||
| 363 | * note that what we ACTUALLY got can be arbitrary junk; we just deposit |
||
| 364 | * it on the filesystem and let openssl figure out if it is usable or not |
||
| 365 | * |
||
| 366 | * Unfortunately, that freaks out Scrutinizer because we write unvetted |
||
| 367 | * data to the filesystem. Let's see if we can make things better. |
||
| 368 | */ |
||
| 369 | |||
| 370 | // $pem = chunk_split(base64_encode($crlcontent), 64, "\n"); |
||
| 371 | // inspired by https://stackoverflow.com/questions/2390604/how-to-pass-variables-as-stdin-into-command-line-from-php |
||
| 372 | |||
| 373 | $proc = \config\Master::PATHS['openssl'] . " crl -inform der"; |
||
| 374 | $descriptorspec = [ |
||
| 375 | 0 => ["pipe", "r"], |
||
| 376 | 1 => ["pipe", "w"], |
||
| 377 | 2 => ["pipe", "w"], |
||
| 378 | ]; |
||
| 379 | $process = proc_open($proc, $descriptorspec, $pipes); |
||
| 380 | if (!is_resource($process)) { |
||
| 381 | throw new Exception("Unable to execute openssl cmdline for CRL conversion!"); |
||
| 382 | } |
||
| 383 | fwrite($pipes[0], $crlcontent); |
||
| 384 | fclose($pipes[0]); |
||
| 385 | $pem = stream_get_contents($pipes[1]); |
||
| 386 | fclose($pipes[1]); |
||
| 387 | fclose($pipes[2]); |
||
| 388 | $retval = proc_close($process); |
||
| 389 | if ($retval != 0 || !preg_match("/BEGIN X509 CRL/", $pem)) { |
||
| 390 | // this was not a real CRL |
||
| 391 | return RADIUSTests::CERTPROB_NO_CRL_AT_CDP_URL; |
||
| 392 | } |
||
| 393 | $cert['CRL'] = []; |
||
| 394 | $cert['CRL'][] = $pem; |
||
| 395 | return $returnresult; |
||
| 396 | } |
||
| 397 | |||
| 398 | /** |
||
| 399 | * We don't want to write passwords of the live login test to our logs. Filter them out |
||
| 400 | * @param string $stringToRedact what should be redacted |
||
| 401 | * @param array $inputarray array of strings (outputs of eapol_test command) |
||
| 402 | * @return string[] the output of eapol_test with the password redacted |
||
| 403 | */ |
||
| 404 | private function redact($stringToRedact, $inputarray) { |
||
| 405 | $temparray = preg_replace("/^.*$stringToRedact.*$/", "LINE CONTAINING PASSWORD REDACTED", $inputarray); |
||
| 406 | $hex = bin2hex($stringToRedact); |
||
| 407 | $spaced = ""; |
||
| 408 | $origLength = strlen($hex); |
||
| 409 | for ($i = 1; $i < $origLength; $i++) { |
||
| 410 | if ($i % 2 == 1 && $i != strlen($hex)) { |
||
| 411 | $spaced .= $hex[$i] . " "; |
||
| 412 | } else { |
||
| 413 | $spaced .= $hex[$i]; |
||
| 414 | } |
||
| 415 | } |
||
| 416 | return preg_replace("/$spaced/", " HEX ENCODED PASSWORD REDACTED ", $temparray); |
||
| 417 | } |
||
| 418 | |||
| 419 | /** |
||
| 420 | * Filters eapol_test output and finds out the packet codes out of which the conversation was comprised of |
||
| 421 | * |
||
| 422 | * @param array $inputarray array of strings (outputs of eapol_test command) |
||
| 423 | * @return array the packet codes which were exchanged, in sequence |
||
| 424 | */ |
||
| 425 | private function filterPackettype($inputarray) { |
||
| 436 | } |
||
| 437 | |||
| 438 | const LINEPARSE_CHECK_REJECTIGNORE = 1; |
||
| 439 | const LINEPARSE_CHECK_691 = 2; |
||
| 440 | const LINEPARSE_EAPACK = 3; |
||
| 441 | const LINEPARSE_TLSVERSION = 4; |
||
| 442 | const TLS_VERSION_ANCIENT = "OTHER"; |
||
| 443 | const TLS_VERSION_1_0 = "TLSv1"; |
||
| 444 | const TLS_VERSION_1_1 = "TLSv1.1"; |
||
| 445 | const TLS_VERSION_1_2 = "TLSv1.2"; |
||
| 446 | const TLS_VERSION_1_3 = "TLSv1.3"; |
||
| 447 | |||
| 448 | /** |
||
| 449 | * this function checks for various special conditions which can be found |
||
| 450 | * only by parsing eapol_test output line by line. Checks currently |
||
| 451 | * implemented are: |
||
| 452 | * * if the ETLRs sent back an Access-Reject because there appeared to |
||
| 453 | * be a timeout further downstream |
||
| 454 | * * did the server send an MSCHAP Error 691 - Retry Allowed in a Challenge |
||
| 455 | * instead of an outright reject? |
||
| 456 | * * was an EAP method ever acknowledged by both sides during the EAP |
||
| 457 | * conversation |
||
| 458 | * |
||
| 459 | * @param array $inputarray array of strings (outputs of eapol_test command) |
||
| 460 | * @param integer $desiredCheck which test should be run (see constants above) |
||
| 461 | * @return boolean|string returns TRUE if ETLR Reject logic was detected; FALSE if not; strings are returned for TLS versions |
||
| 462 | * @throws Exception |
||
| 463 | */ |
||
| 464 | private function checkLineparse($inputarray, $desiredCheck) { |
||
| 465 | foreach ($inputarray as $lineid => $line) { |
||
| 466 | switch ($desiredCheck) { |
||
| 467 | case self::LINEPARSE_CHECK_REJECTIGNORE: |
||
| 468 | if (preg_match("/Attribute 18 (Reply-Message)/", $line) && preg_match("/Reject instead of Ignore at eduroam.org/", $inputarray[$lineid + 1])) { |
||
| 469 | return TRUE; |
||
| 470 | } |
||
| 471 | break; |
||
| 472 | case self::LINEPARSE_CHECK_691: |
||
| 473 | if (preg_match("/MSCHAPV2: error 691/", $line) && preg_match("/MSCHAPV2: retry is allowed/", $inputarray[$lineid + 1])) { |
||
| 474 | return TRUE; |
||
| 475 | } |
||
| 476 | break; |
||
| 477 | case self::LINEPARSE_EAPACK: |
||
| 478 | if (preg_match("/CTRL-EVENT-EAP-PROPOSED-METHOD/", $line) && !preg_match("/NAK$/", $line)) { |
||
| 479 | return TRUE; |
||
| 480 | } |
||
| 481 | break; |
||
| 482 | case self::LINEPARSE_TLSVERSION: |
||
| 483 | break; |
||
| 484 | default: |
||
| 485 | throw new Exception("This lineparse test does not exist."); |
||
| 486 | } |
||
| 487 | } |
||
| 488 | // for TLS version checks, we need to search from bottom to top |
||
| 489 | // eapol_test will always try its highest version first, and can be |
||
| 490 | // persuaded later on to do less. So look at the end result. |
||
| 491 | for ($counter = count($inputarray); $counter > 0; $counter--) { |
||
| 492 | switch ($desiredCheck) { |
||
| 493 | case self::LINEPARSE_TLSVERSION: |
||
| 494 | $version = []; |
||
| 495 | if (isset($inputarray[$counter]) && preg_match("/Using TLS version (.*)$/", $inputarray[$counter], $version)) { |
||
| 496 | switch (trim($version[1])) { |
||
| 497 | case self::TLS_VERSION_1_3: |
||
| 498 | return self::TLS_VERSION_1_3; |
||
| 499 | case self::TLS_VERSION_1_2: |
||
| 500 | return self::TLS_VERSION_1_2; |
||
| 501 | case self::TLS_VERSION_1_1: |
||
| 502 | return self::TLS_VERSION_1_1; |
||
| 503 | case self::TLS_VERSION_1_0: |
||
| 504 | return self::TLS_VERSION_1_0; |
||
| 505 | default: |
||
| 506 | return self::TLS_VERSION_ANCIENT; |
||
| 507 | } |
||
| 508 | } |
||
| 509 | break; |
||
| 510 | case self::LINEPARSE_CHECK_691: |
||
| 511 | /* fall-through intentional */ |
||
| 512 | case self::LINEPARSE_CHECK_REJECTIGNORE: |
||
| 513 | /* fall-through intentional */ |
||
| 514 | case self::LINEPARSE_EAPACK: |
||
| 515 | /* fall-through intentional */ |
||
| 516 | break; |
||
| 517 | default: |
||
| 518 | throw new Exception("This lineparse test does not exist."); |
||
| 519 | } |
||
| 520 | } |
||
| 521 | return FALSE; |
||
| 522 | } |
||
| 523 | |||
| 524 | /** |
||
| 525 | * |
||
| 526 | * @param array $eaptype array representation of the EAP type |
||
| 527 | * @param string $inner inner username |
||
| 528 | * @param string $outer outer username |
||
| 529 | * @param string $password the password |
||
| 530 | * @return string[] [0] is the actual config for wpa_supplicant, [1] is a redacted version for logs |
||
| 531 | */ |
||
| 532 | private function wpaSupplicantConfig(array $eaptype, string $inner, string $outer, string $password) { |
||
| 533 | $eapText = \core\common\EAP::eapDisplayName($eaptype); |
||
| 534 | $config = ' |
||
| 535 | network={ |
||
| 536 | ssid="' . \config\Master::APPEARANCE['productname'] . ' testing" |
||
| 537 | key_mgmt=WPA-EAP |
||
| 538 | proto=WPA2 |
||
| 539 | pairwise=CCMP |
||
| 540 | group=CCMP |
||
| 541 | '; |
||
| 542 | // phase 1 |
||
| 543 | $config .= 'eap=' . $eapText['OUTER'] . "\n"; |
||
| 544 | $logConfig = $config; |
||
| 545 | // phase 2 if applicable; all inner methods have passwords |
||
| 546 | if (isset($eapText['INNER']) && $eapText['INNER'] != "") { |
||
| 547 | $config .= ' phase2="auth=' . $eapText['INNER'] . "\"\n"; |
||
| 548 | $logConfig .= ' phase2="auth=' . $eapText['INNER'] . "\"\n"; |
||
| 549 | } |
||
| 550 | // all methods set a password, except EAP-TLS |
||
| 551 | if ($eaptype != \core\common\EAP::EAPTYPE_TLS) { |
||
| 552 | $config .= " password=\"$password\"\n"; |
||
| 553 | $logConfig .= " password=\"not logged for security reasons\"\n"; |
||
| 554 | } |
||
| 555 | // for methods with client certs, add a client cert config block |
||
| 556 | if ($eaptype == \core\common\EAP::EAPTYPE_TLS || $eaptype == \core\common\EAP::EAPTYPE_ANY) { |
||
| 557 | $config .= " private_key=\"./client.p12\"\n"; |
||
| 558 | $logConfig .= " private_key=\"./client.p12\"\n"; |
||
| 559 | $config .= " private_key_passwd=\"$password\"\n"; |
||
| 560 | $logConfig .= " private_key_passwd=\"not logged for security reasons\"\n"; |
||
| 561 | } |
||
| 562 | |||
| 563 | // inner identity |
||
| 564 | $config .= ' identity="' . $inner . "\"\n"; |
||
| 565 | $logConfig .= ' identity="' . $inner . "\"\n"; |
||
| 566 | // outer identity, may be equal |
||
| 567 | $config .= ' anonymous_identity="' . $outer . "\"\n"; |
||
| 568 | $logConfig .= ' anonymous_identity="' . $outer . "\"\n"; |
||
| 569 | // done |
||
| 570 | $config .= "}"; |
||
| 571 | $logConfig .= "}"; |
||
| 572 | |||
| 573 | return [$config, $logConfig]; |
||
| 574 | } |
||
| 575 | |||
| 576 | /** |
||
| 577 | * Checks whether the packets received are as expected in numbers |
||
| 578 | * |
||
| 579 | * @param array $testresults by-reference array of the testresults so far |
||
| 580 | * function adds its own findings to that array |
||
| 581 | * @param array $packetcount the count of incoming packets |
||
| 582 | * @return int |
||
| 583 | */ |
||
| 584 | private function packetCountEvaluation(&$testresults, $packetcount) { |
||
| 585 | $reqs = $packetcount[1] ?? 0; |
||
| 586 | $accepts = $packetcount[2] ?? 0; |
||
| 587 | $rejects = $packetcount[3] ?? 0; |
||
| 588 | $challenges = $packetcount[11] ?? 0; |
||
| 589 | $testresults['packetflow_sane'] = TRUE; |
||
| 590 | if ($reqs - $accepts - $rejects - $challenges != 0 || $accepts > 1 || $rejects > 1) { |
||
| 591 | $testresults['packetflow_sane'] = FALSE; |
||
| 592 | } |
||
| 593 | |||
| 594 | $this->loggerInstance->debug(5, "XYZ: Counting req, acc, rej, chal: $reqs, $accepts, $rejects, $challenges"); |
||
| 595 | |||
| 596 | // calculate the main return values that this test yielded |
||
| 597 | |||
| 598 | $finalretval = RADIUSTests::RETVAL_INVALID; |
||
| 599 | if ($accepts + $rejects == 0) { // no final response. hm. |
||
| 600 | if ($challenges > 0) { // but there was an Access-Challenge |
||
| 601 | $finalretval = RADIUSTests::RETVAL_SERVER_UNFINISHED_COMM; |
||
| 602 | } else { |
||
| 603 | $finalretval = RADIUSTests::RETVAL_NO_RESPONSE; |
||
| 604 | } |
||
| 605 | } else // either an accept or a reject |
||
| 606 | // rejection without EAP is fishy |
||
| 607 | if ($rejects > 0) { |
||
| 608 | if ($challenges == 0) { |
||
| 609 | $finalretval = RADIUSTests::RETVAL_IMMEDIATE_REJECT; |
||
| 610 | } else { // i.e. if rejected with challenges |
||
| 611 | $finalretval = RADIUSTests::RETVAL_CONVERSATION_REJECT; |
||
| 612 | } |
||
| 613 | } else if ($accepts > 0) { |
||
| 614 | $finalretval = RADIUSTests::RETVAL_OK; |
||
| 615 | } |
||
| 616 | |||
| 617 | return $finalretval; |
||
| 618 | } |
||
| 619 | |||
| 620 | /** |
||
| 621 | * generate an eapol_test command-line config for the fixed config filename |
||
| 622 | * ./udp_login_test.conf |
||
| 623 | * @param int $probeindex number of the probe to check against |
||
| 624 | * @param boolean $opName include Operator-Name in request? |
||
| 625 | * @param boolean $frag make request so large that fragmentation is needed? |
||
| 626 | * @return string the command-line for eapol_test |
||
| 627 | */ |
||
| 628 | private function eapolTestConfig($probeindex, $opName, $frag) { |
||
| 629 | $cmdline = \config\Diagnostics::PATHS['eapol_test'] . |
||
| 630 | " -a " . \config\Diagnostics::RADIUSTESTS['UDP-hosts'][$probeindex]['ip'] . |
||
| 631 | " -s " . \config\Diagnostics::RADIUSTESTS['UDP-hosts'][$probeindex]['secret'] . |
||
| 632 | " -o serverchain.pem" . |
||
| 633 | " -c ./udp_login_test.conf" . |
||
| 634 | " -M 22:44:66:CA:20:" . sprintf("%02d", $probeindex) . " " . |
||
| 635 | " -t " . \config\Diagnostics::RADIUSTESTS['UDP-hosts'][$probeindex]['timeout'] . " "; |
||
| 636 | if ($opName) { |
||
| 637 | $cmdline .= '-N126:s:"1cat.eduroam.org" '; |
||
| 638 | } |
||
| 639 | if ($frag) { |
||
| 640 | for ($i = 0; $i < 6; $i++) { // 6 x 250 bytes means UDP fragmentation will occur - good! |
||
| 641 | $cmdline .= '-N26:x:0000625A0BF961616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161 '; |
||
| 642 | } |
||
| 643 | } |
||
| 644 | return $cmdline; |
||
| 645 | } |
||
| 646 | |||
| 647 | /** |
||
| 648 | * collects CA certificates, both from the incoming EAP chain and from CAT |
||
| 649 | * config. Writes the root CAs into a trusted root CA dir and intermediate |
||
| 650 | * and first server cert into a PEM file for later chain validation |
||
| 651 | * |
||
| 652 | * @param string $tmpDir working directory |
||
| 653 | * @param array $intermOdditiesCAT by-reference array of already found |
||
| 654 | * oddities; adds its own |
||
| 655 | * @param array $servercert the servercert to validate |
||
| 656 | * @param array $eapIntermediates list of intermediate CA certs that came |
||
| 657 | * in via EAP |
||
| 658 | * @param array $eapIntermediateCRLs list of CRLs for the EAP-supplied |
||
| 659 | * intermediate CAs |
||
| 660 | * @return string |
||
| 661 | * @throws Exception |
||
| 662 | */ |
||
| 663 | private function createCArepository($tmpDir, &$intermOdditiesCAT, $servercert, $eapIntermediates, $eapIntermediateCRLs) { |
||
| 664 | if (!mkdir($tmpDir . "/root-ca-allcerts/", 0700, true)) { |
||
| 665 | throw new Exception("unable to create root CA directory (RADIUS Tests): $tmpDir/root-ca-allcerts/\n"); |
||
| 666 | } |
||
| 667 | if (!mkdir($tmpDir . "/root-ca-eaponly/", 0700, true)) { |
||
| 668 | throw new Exception("unable to create root CA directory (RADIUS Tests): $tmpDir/root-ca-eaponly/\n"); |
||
| 669 | } |
||
| 670 | // make a copy of the EAP-received chain and add the configured intermediates, if any |
||
| 671 | $catIntermediates = []; |
||
| 672 | $catRoots = []; |
||
| 673 | foreach ($this->expectedCABundle as $oneCA) { |
||
| 674 | $x509 = new \core\common\X509(); |
||
| 675 | $decoded = $x509->processCertificate($oneCA); |
||
| 676 | if (is_bool($decoded)) { |
||
| 677 | throw new Exception("Unable to parse an expected CA certificate."); |
||
| 678 | } |
||
| 679 | if ($decoded['ca'] == 1) { |
||
| 680 | if ($decoded['root'] == 1) { // save CAT roots to the root directory |
||
| 681 | file_put_contents($tmpDir . "/root-ca-eaponly/configuredroot" . count($catRoots) . ".pem", $decoded['pem']); |
||
| 682 | file_put_contents($tmpDir . "/root-ca-allcerts/configuredroot" . count($catRoots) . ".pem", $decoded['pem']); |
||
| 683 | $catRoots[] = $decoded['pem']; |
||
| 684 | } else { // save the intermediates to allcerts directory |
||
| 685 | file_put_contents($tmpDir . "/root-ca-allcerts/cat-intermediate" . count($catIntermediates) . ".pem", $decoded['pem']); |
||
| 686 | $intermOdditiesCAT = array_merge($intermOdditiesCAT, $this->propertyCheckIntermediate($decoded)); |
||
| 687 | if (isset($decoded['CRL']) && isset($decoded['CRL'][0])) { |
||
| 688 | $this->loggerInstance->debug(4, "got an intermediate CRL; adding them to the chain checks. (Remember: checking end-entity cert only, not the whole chain"); |
||
| 689 | file_put_contents($tmpDir . "/root-ca-allcerts/crl_cat" . count($catIntermediates) . ".pem", $decoded['CRL'][0]); |
||
| 690 | } |
||
| 691 | $catIntermediates[] = $decoded['pem']; |
||
| 692 | } |
||
| 693 | } |
||
| 694 | } |
||
| 695 | // save all intermediate certificates and CRLs to separate files in |
||
| 696 | // both root-ca directories |
||
| 697 | foreach ($eapIntermediates as $index => $onePem) { |
||
| 698 | file_put_contents($tmpDir . "/root-ca-eaponly/intermediate$index.pem", $onePem); |
||
| 699 | file_put_contents($tmpDir . "/root-ca-allcerts/intermediate$index.pem", $onePem); |
||
| 700 | } |
||
| 701 | foreach ($eapIntermediateCRLs as $index => $onePem) { |
||
| 702 | file_put_contents($tmpDir . "/root-ca-eaponly/intermediateCRL$index.pem", $onePem); |
||
| 703 | file_put_contents($tmpDir . "/root-ca-allcerts/intermediateCRL$index.pem", $onePem); |
||
| 704 | } |
||
| 705 | |||
| 706 | $checkstring = ""; |
||
| 707 | if (isset($servercert['CRL']) && isset($servercert['CRL'][0])) { |
||
| 708 | $this->loggerInstance->debug(4, "got a server CRL; adding them to the chain checks. (Remember: checking end-entity cert only, not the whole chain"); |
||
| 709 | $checkstring = "-crl_check_all"; |
||
| 710 | file_put_contents($tmpDir . "/root-ca-eaponly/crl-server.pem", $servercert['CRL'][0]); |
||
| 711 | file_put_contents($tmpDir . "/root-ca-allcerts/crl-server.pem", $servercert['CRL'][0]); |
||
| 712 | } |
||
| 713 | |||
| 714 | |||
| 715 | // now c_rehash the root CA directory ... |
||
| 716 | system(\config\Diagnostics::PATHS['c_rehash'] . " $tmpDir/root-ca-eaponly/ > /dev/null"); |
||
| 717 | system(\config\Diagnostics::PATHS['c_rehash'] . " $tmpDir/root-ca-allcerts/ > /dev/null"); |
||
| 718 | return $checkstring; |
||
| 719 | } |
||
| 720 | |||
| 721 | /** |
||
| 722 | * for checks which have a known trust root CA (i.e. a valid CAT profile |
||
| 723 | * exists), check against those known-good roots |
||
| 724 | * |
||
| 725 | * @param array $testresults by-reference list of testresults so far |
||
| 726 | * Function adds its own. |
||
| 727 | * @param array $intermOdditiesCAT by-reference list of oddities in the CA |
||
| 728 | * certs which are configured in CAT |
||
| 729 | * @param string $tmpDir working directory |
||
| 730 | * @param array $servercert the server certificate to validate |
||
| 731 | * @param array $eapIntermediates list of intermediate CA certs that came |
||
| 732 | * in via EAP |
||
| 733 | * @param array $eapIntermediateCRLs list of CRLs for the EAP-supplied |
||
| 734 | * intermediate CAs |
||
| 735 | * @return int |
||
| 736 | * @throws Exception |
||
| 737 | */ |
||
| 738 | private function thoroughChainChecks(&$testresults, &$intermOdditiesCAT, $tmpDir, $servercert, $eapIntermediates, $eapIntermediateCRLs) { |
||
| 739 | |||
| 740 | $crlCheckString = $this->createCArepository($tmpDir, $intermOdditiesCAT, $servercert, $eapIntermediates, $eapIntermediateCRLs); |
||
| 741 | // ... and run the verification test |
||
| 742 | $verifyResultEaponly = []; |
||
| 743 | $verifyResultAllcerts = []; |
||
| 744 | // the error log will complain if we run this test against an empty file of certs |
||
| 745 | // so test if there's something PEMy in the file at all |
||
| 746 | // serverchain.pem is the output from eapol_test; incomingserver.pem is written by extractIncomingCertsfromEAP() if there was at least one server cert. |
||
| 747 | if (filesize("$tmpDir/serverchain.pem") > 10 && filesize("$tmpDir/incomingserver.pem") > 10) { |
||
| 748 | $cmdString = \config\Master::PATHS['openssl'] . " verify $crlCheckString -no-CAstore -no-CApath -CApath $tmpDir/root-ca-eaponly/ -purpose any $tmpDir/incomingserver.pem 2>&1"; |
||
| 749 | exec($cmdString, $verifyResultEaponly); |
||
| 750 | $this->loggerInstance->debug(4, $cmdString."\n"); |
||
| 751 | $this->loggerInstance->debug(4, "Chain verify pass 1: " . /** @scrutinizer ignore-type */ print_r($verifyResultEaponly, TRUE) . "\n"); |
||
| 752 | $cmdString = \config\Master::PATHS['openssl'] . " verify $crlCheckString -no-CAstore -no-CApath -CApath $tmpDir/root-ca-allcerts/ -purpose any $tmpDir/incomingserver.pem 2>&1"; |
||
| 753 | exec($cmdString, $verifyResultAllcerts); |
||
| 754 | $this->loggerInstance->debug(4, $cmdString."\n"); |
||
| 755 | $this->loggerInstance->debug(4, "Chain verify pass 2: " . /** @scrutinizer ignore-type */ print_r($verifyResultAllcerts, TRUE) . "\n"); |
||
| 756 | } |
||
| 757 | |||
| 758 | // now we do certificate verification against the collected parents |
||
| 759 | // this is done first for the server and then for each of the intermediate CAs |
||
| 760 | // any oddities observed will |
||
| 761 | // openssl should havd returned exactly one line of output, |
||
| 762 | // and it should have ended with the string "OK", anything else is fishy |
||
| 763 | // The result can also be an empty array - this means there were no |
||
| 764 | // certificates to check. Don't complain about chain validation errors |
||
| 765 | // in that case. |
||
| 766 | // we have the following test result possibilities: |
||
| 767 | // 1. test against allcerts failed |
||
| 768 | // 2. test against allcerts succeeded, but against eaponly failed - warn admin |
||
| 769 | // 3. test against eaponly succeeded, in this case critical errors about expired certs |
||
| 770 | // need to be changed to notices, since these certs obviously do tot participate |
||
| 771 | // in server certificate validation. |
||
| 772 | if (count($verifyResultAllcerts) == 0 || count($verifyResultEaponly) == 0) { |
||
| 773 | throw new Exception("No output at all from openssl?"); |
||
| 774 | } |
||
| 775 | if (!isset($testresults['cert_oddities'])) { |
||
| 776 | $testresults['cert_oddities'] = array(); |
||
| 777 | } |
||
| 778 | if (!preg_match("/OK$/", $verifyResultAllcerts[0])) { // case 1 |
||
| 779 | if (preg_match("/certificate revoked$/", $verifyResultAllcerts[1])) { |
||
| 780 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_SERVER_CERT_REVOKED; |
||
| 781 | } elseif (preg_match("/unable to get certificate CRL/", $verifyResultAllcerts[1])) { |
||
| 782 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_UNABLE_TO_GET_CRL; |
||
| 783 | } else { |
||
| 784 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_TRUST_ROOT_NOT_REACHED; |
||
| 785 | } |
||
| 786 | return 1; |
||
| 787 | } |
||
| 788 | if (!preg_match("/OK$/", $verifyResultEaponly[0])) { // case 2 |
||
| 789 | if (preg_match("/certificate revoked$/", $verifyResultEaponly[1])) { |
||
| 790 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_SERVER_CERT_REVOKED; |
||
| 791 | } elseif (preg_match("/unable to get certificate CRL/", $verifyResultEaponly[1])) { |
||
| 792 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_UNABLE_TO_GET_CRL; |
||
| 793 | } else { |
||
| 794 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_TRUST_ROOT_REACHED_ONLY_WITH_OOB_INTERMEDIATES; |
||
| 795 | } |
||
| 796 | return 2; |
||
| 797 | } |
||
| 798 | return 3; |
||
| 799 | } |
||
| 800 | |||
| 801 | /** |
||
| 802 | * check the incoming hostname (both Subject:CN and subjectAltName:DNS |
||
| 803 | * against what is configured in the profile; it's a significant error |
||
| 804 | * if there is no match! |
||
| 805 | * |
||
| 806 | * FAIL if none of the configured names show up in the server cert |
||
| 807 | * WARN if the configured name is only in either CN or sAN:DNS |
||
| 808 | * |
||
| 809 | * @param array $servercert the server certificate to check |
||
| 810 | * @param array $testresults by-reference the existing testresults. Function |
||
| 811 | * adds its own findings. |
||
| 812 | * @return void |
||
| 813 | */ |
||
| 814 | private function thoroughNameChecks($servercert, &$testresults) { |
||
| 815 | // Strategy for checks: we are TOTALLY happy if any one of the |
||
| 816 | // configured names shows up in both the CN and a sAN |
||
| 817 | // This is the primary check. |
||
| 818 | // If that was not the case, we are PARTIALLY happy if any one of |
||
| 819 | // the configured names was in either of the CN or sAN lists. |
||
| 820 | // we are UNHAPPY if no names match! |
||
| 821 | $happiness = "UNHAPPY"; |
||
| 822 | foreach ($this->expectedServerNames as $expectedName) { |
||
| 823 | $this->loggerInstance->debug(4, "Managing expectations for $expectedName: " . /** @scrutinizer ignore-type */ print_r($servercert['CN'], TRUE) . /** @scrutinizer ignore-type */ print_r($servercert['sAN_DNS'], TRUE)); |
||
| 824 | if (array_search($expectedName, $servercert['CN']) !== FALSE && array_search($expectedName, $servercert['sAN_DNS']) !== FALSE) { |
||
| 825 | $this->loggerInstance->debug(4, "Totally happy!"); |
||
| 826 | $happiness = "TOTALLY"; |
||
| 827 | break; |
||
| 828 | } else { |
||
| 829 | if (array_search($expectedName, $servercert['CN']) !== FALSE || array_search($expectedName, $servercert['sAN_DNS']) !== FALSE) { |
||
| 830 | $happiness = "PARTIALLY"; |
||
| 831 | // keep trying with other expected names! We could be happier! |
||
| 832 | } |
||
| 833 | } |
||
| 834 | } |
||
| 835 | switch ($happiness) { |
||
| 836 | case "UNHAPPY": |
||
| 837 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_SERVER_NAME_MISMATCH; |
||
| 838 | return; |
||
| 839 | case "PARTIALLY": |
||
| 840 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_SERVER_NAME_PARTIAL_MATCH; |
||
| 841 | return; |
||
| 842 | default: // nothing to complain about! |
||
| 843 | return; |
||
| 844 | } |
||
| 845 | } |
||
| 846 | |||
| 847 | /** |
||
| 848 | * run eapol_test |
||
| 849 | * |
||
| 850 | * @param string $tmpDir working directory |
||
| 851 | * @param int $probeindex number of the probe this test should run through |
||
| 852 | * @param array $eaptype EAP type in array representation |
||
| 853 | * @param string $innerUser EAP method inner username to use |
||
| 854 | * @param string $password password to use |
||
| 855 | * @param boolean $opnameCheck inject Operator-Name? |
||
| 856 | * @param boolean $frag provoke UDP fragmentation? |
||
| 857 | * @return array timing information of the executed eapol_test run |
||
| 858 | * @throws Exception |
||
| 859 | */ |
||
| 860 | private function executeEapolTest($tmpDir, $probeindex, $eaptype, $outerUser, $innerUser, $password, $opnameCheck, $frag) { |
||
| 861 | $finalInner = $innerUser; |
||
| 862 | $finalOuter = $outerUser; |
||
| 863 | $theconfigs = $this->wpaSupplicantConfig($eaptype, $finalInner, $finalOuter, $password); |
||
| 864 | // the config intentionally does not include CA checking. We do this |
||
| 865 | // ourselves after getting the chain with -o. |
||
| 866 | file_put_contents($tmpDir . "/udp_login_test.conf", $theconfigs[0]); |
||
| 867 | |||
| 868 | $cmdline = $this->eapolTestConfig($probeindex, $opnameCheck, $frag); |
||
| 869 | $this->loggerInstance->debug(4, "Shallow reachability check cmdline: $cmdline\n"); |
||
| 870 | $this->loggerInstance->debug(4, "Shallow reachability check config: $tmpDir\n" . $theconfigs[1] . "\n"); |
||
| 871 | $time_start = microtime(true); |
||
| 872 | $pflow = []; |
||
| 873 | exec($cmdline, $pflow); |
||
| 874 | if ($pflow === NULL) { |
||
| 875 | throw new Exception("The output of an exec() call really can't be NULL!"); |
||
| 876 | } |
||
| 877 | $time_stop = microtime(true); |
||
| 878 | $output = print_r($this->redact($password, $pflow), TRUE); |
||
| 879 | file_put_contents($tmpDir . "/eapol_test_output_redacted_$probeindex.txt", $output); |
||
| 880 | $this->loggerInstance->debug(5, "eapol_test output saved to eapol_test_output_redacted_$probeindex.txt\n"); |
||
| 881 | return [ |
||
| 882 | "time" => ($time_stop - $time_start) * 1000, |
||
| 883 | "output" => $pflow, |
||
| 884 | ]; |
||
| 885 | } |
||
| 886 | |||
| 887 | /** |
||
| 888 | * checks if the RADIUS packets were coming in in the order they are |
||
| 889 | * expected. The function massages the raw result for some known oddities. |
||
| 890 | * |
||
| 891 | * @param array $testresults by-reference array of test results so far. |
||
| 892 | * function adds its own. |
||
| 893 | * @param array $packetflow_orig original flow of packets |
||
| 894 | * @return int |
||
| 895 | */ |
||
| 896 | private function checkRadiusPacketFlow(&$testresults, $packetflow_orig) { |
||
| 897 | |||
| 898 | $packetflow = $this->filterPackettype($packetflow_orig); |
||
| 899 | |||
| 900 | // when MS-CHAPv2 allows retry, we never formally get a reject (just a |
||
| 901 | // Challenge that PW was wrong but and we should try a different one; |
||
| 902 | // but that effectively is a reject |
||
| 903 | // so change the flow results to take that into account |
||
| 904 | if ($packetflow[count($packetflow) - 1] == 11 && $this->checkLineparse($packetflow_orig, self::LINEPARSE_CHECK_691)) { |
||
| 905 | $packetflow[count($packetflow) - 1] = 3; |
||
| 906 | } |
||
| 907 | // also, the ETLRs sometimes send a reject when the server is not |
||
| 908 | // responding. This should not be considered a real reject; it's a middle |
||
| 909 | // box unduly altering the end-to-end result. Do not consider this final |
||
| 910 | // Reject if it comes from ETLR |
||
| 911 | if ($packetflow[count($packetflow) - 1] == 3 && $this->checkLineparse($packetflow_orig, self::LINEPARSE_CHECK_REJECTIGNORE)) { |
||
| 912 | array_pop($packetflow); |
||
| 913 | } |
||
| 914 | $this->loggerInstance->debug(5, "Packetflow: " . /** @scrutinizer ignore-type */ print_r($packetflow, TRUE)); |
||
| 915 | $packetcount = array_count_values($packetflow); |
||
| 916 | $testresults['packetcount'] = $packetcount; |
||
| 917 | $testresults['packetflow'] = $packetflow; |
||
| 918 | |||
| 919 | // calculate packet counts and see what the overall flow was |
||
| 920 | return $this->packetCountEvaluation($testresults, $packetcount); |
||
| 921 | } |
||
| 922 | |||
| 923 | /** |
||
| 924 | * parses the eapol_test output to determine whether we got to a point where |
||
| 925 | * an EAP type was mutually agreed |
||
| 926 | * |
||
| 927 | * @param array $testresults by-reference, we add our findings if |
||
| 928 | * something is noteworthy |
||
| 929 | * @param array $packetflow_orig the array of text output from eapol_test |
||
| 930 | * @return bool |
||
| 931 | * @throws Exception |
||
| 932 | */ |
||
| 933 | private function wasEapTypeNegotiated(&$testresults, $packetflow_orig) { |
||
| 934 | $negotiatedEapType = $this->checkLineparse($packetflow_orig, self::LINEPARSE_EAPACK); |
||
| 935 | if (!is_bool($negotiatedEapType)) { |
||
| 936 | throw new Exception("checkLineparse should only ever return a boolean in this case!"); |
||
| 937 | } |
||
| 938 | if (!$negotiatedEapType) { |
||
| 939 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_NO_COMMON_EAP_METHOD; |
||
| 940 | } |
||
| 941 | |||
| 942 | return $negotiatedEapType; |
||
| 943 | } |
||
| 944 | |||
| 945 | /** |
||
| 946 | * parses eapol_test to find the TLS version used during the EAP conversation |
||
| 947 | * @param array $testresults by-reference, we add our findings if |
||
| 948 | * something is noteworthy |
||
| 949 | * @param array $packetflow_orig the array of text output from eapol_test |
||
| 950 | * @return string|bool the version as a string or FALSE if TLS version could not be determined |
||
| 951 | */ |
||
| 952 | private function wasModernTlsNegotiated(&$testresults, $packetflow_orig) { |
||
| 962 | } |
||
| 963 | |||
| 964 | const SERVER_NO_CA_EXTENSION = 1; |
||
| 965 | const SERVER_CA_SELFSIGNED = 2; |
||
| 966 | const CA_INTERMEDIATE = 3; |
||
| 967 | const CA_ROOT = 4; |
||
| 968 | |||
| 969 | /** |
||
| 970 | * what is the incoming certificate - root, intermediate, or server? |
||
| 971 | * @param array $cert the certificate to check |
||
| 972 | * @param int $totalCertCount number of certs in total in chain |
||
| 973 | * @return int |
||
| 974 | */ |
||
| 975 | private function determineCertificateType(&$cert, $totalCertCount) { |
||
| 988 | } |
||
| 989 | |||
| 990 | /** |
||
| 991 | * pull out the certificates that were sent during the EAP conversation |
||
| 992 | * |
||
| 993 | * @param array $testresults by-reference, add our findings if any |
||
| 994 | * @param string $tmpDir working directory |
||
| 995 | * @return array|FALSE an array with all the certs, CRLs and oddities, or FALSE if the EAP conversation did not yield a certificate at all |
||
| 996 | * @throws Exception |
||
| 997 | */ |
||
| 998 | private function extractIncomingCertsfromEAP(&$testresults, $tmpDir) { |
||
| 999 | /* |
||
| 1000 | * EAP's house rules: |
||
| 1001 | * 1) it is unnecessary to include the root CA itself (adding it has |
||
| 1002 | * detrimental effects on performance) |
||
| 1003 | * 2) TLS Web Server OID presence (Windows OSes need that) |
||
| 1004 | * 3) MD5 signature algorithm disallowed (iOS barks if so) |
||
| 1005 | * 4) CDP URL (Windows Phone 8 barks if not present) |
||
| 1006 | * 5) there should be exactly one server cert in the chain |
||
| 1007 | */ |
||
| 1008 | |||
| 1009 | $x509 = new \core\common\X509(); |
||
| 1010 | // $eap_certarray holds all certs received in EAP conversation |
||
| 1011 | $incomingData = file_get_contents($tmpDir . "/serverchain.pem"); |
||
| 1012 | if ($incomingData !== FALSE && strlen($incomingData) > 0) { |
||
| 1013 | $eapCertArray = $x509->splitCertificate($incomingData); |
||
| 1014 | } else { |
||
| 1015 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_NO_CERTIFICATE_IN_CONVERSATION; |
||
| 1016 | return FALSE; |
||
| 1017 | } |
||
| 1018 | $rootIncluded = []; |
||
| 1019 | $eapIntermediates = []; |
||
| 1020 | $eapIntermediateCRLs = []; |
||
| 1021 | $servercert = []; |
||
| 1022 | $intermOdditiesEAP = []; |
||
| 1023 | |||
| 1024 | $testresults['certdata'] = []; |
||
| 1025 | |||
| 1026 | foreach ($eapCertArray as $certPem) { |
||
| 1027 | $cert = $x509->processCertificate($certPem); |
||
| 1028 | if ($cert === FALSE) { |
||
| 1029 | continue; |
||
| 1030 | } |
||
| 1031 | // consider the certificate a server cert |
||
| 1032 | // a) if it is not a CA and is not a self-signed root |
||
| 1033 | // b) if it is a CA, and self-signed, and it is the only cert in |
||
| 1034 | // the incoming cert chain |
||
| 1035 | // (meaning the self-signed is itself the server cert) |
||
| 1036 | switch ($this->determineCertificateType($cert, count($eapCertArray))) { |
||
| 1037 | case RADIUSTests::SERVER_NO_CA_EXTENSION: // both are handled same, fall-through |
||
| 1038 | case RADIUSTests::SERVER_CA_SELFSIGNED: |
||
| 1039 | $servercert[] = $cert; |
||
| 1040 | if (count($servercert) == 1) { |
||
| 1041 | if (file_put_contents($tmpDir . "/incomingserver.pem", $cert['pem'] . "\n") === FALSE) { |
||
| 1042 | $this->loggerInstance->debug(4, "The (first) server certificate could not be written to $tmpDir/incomingserver.pem!\n"); |
||
| 1043 | } |
||
| 1044 | $this->loggerInstance->debug(4, "This is the (first) server certificate, with CRL content if applicable: " . /** @scrutinizer ignore-type */ print_r($servercert[0], true)); |
||
| 1045 | } elseif (!in_array(RADIUSTests::CERTPROB_TOO_MANY_SERVER_CERTS, $testresults['cert_oddities'])) { |
||
| 1046 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_TOO_MANY_SERVER_CERTS; |
||
| 1047 | } |
||
| 1048 | break; |
||
| 1049 | case RADIUSTests::CA_ROOT: |
||
| 1050 | if (!in_array(RADIUSTests::CERTPROB_ROOT_INCLUDED, $testresults['cert_oddities'])) { |
||
| 1051 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_ROOT_INCLUDED; |
||
| 1052 | } |
||
| 1053 | // chain checks need to be against the UPLOADED CA of the |
||
| 1054 | // IdP/profile, not against an EAP-discovered CA |
||
| 1055 | // save it anyway, but only for feature "root CA autodetection" is executed |
||
| 1056 | $rootIncluded[] = $cert['pem']; |
||
| 1057 | break; |
||
| 1058 | case RADIUSTests::CA_INTERMEDIATE: |
||
| 1059 | $intermOdditiesEAP = array_merge($intermOdditiesEAP, $this->propertyCheckIntermediate($cert)); |
||
| 1060 | $eapIntermediates[] = $cert['pem']; |
||
| 1061 | |||
| 1062 | if (isset($cert['CRL']) && isset($cert['CRL'][0])) { |
||
| 1063 | $eapIntermediateCRLs[] = $cert['CRL'][0]; |
||
| 1064 | } |
||
| 1065 | break; |
||
| 1066 | default: |
||
| 1067 | throw new Exception("Status of certificate could not be determined!"); |
||
| 1068 | } |
||
| 1069 | $testresults['certdata'][] = $cert['full_details']; |
||
| 1070 | } |
||
| 1071 | switch (count($servercert)) { |
||
| 1072 | case 0: |
||
| 1073 | $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_NO_SERVER_CERT; |
||
| 1074 | break; |
||
| 1075 | default: |
||
| 1076 | // check (first) server cert's properties |
||
| 1077 | $testresults['cert_oddities'] = array_merge($testresults['cert_oddities'], $this->propertyCheckServercert($servercert[0])); |
||
| 1078 | $testresults['incoming_server_names'] = $servercert[0]['incoming_server_names']; |
||
| 1079 | } |
||
| 1080 | return [ |
||
| 1081 | "SERVERCERT" => $servercert, |
||
| 1082 | "INTERMEDIATE_CA" => $eapIntermediates, |
||
| 1083 | "INTERMEDIATE_CRL" => $eapIntermediateCRLs, |
||
| 1084 | "INTERMEDIATE_OBSERVED_ODDITIES" => $intermOdditiesEAP, |
||
| 1085 | "UNTRUSTED_ROOT_INCLUDED" => $rootIncluded, |
||
| 1086 | ]; |
||
| 1087 | } |
||
| 1088 | |||
| 1089 | private function udpLoginPreliminaries($probeindex, $eaptype, $clientcertdata) { |
||
| 1090 | /** preliminaries */ |
||
| 1091 | $eapText = \core\common\EAP::eapDisplayName($eaptype); |
||
| 1092 | // no host to send probes to? Nothing to do then |
||
| 1093 | if (!isset(\config\Diagnostics::RADIUSTESTS['UDP-hosts'][$probeindex])) { |
||
| 1094 | $this->UDP_reachability_executed = RADIUSTests::RETVAL_NOTCONFIGURED; |
||
| 1095 | return RADIUSTests::RETVAL_NOTCONFIGURED; |
||
| 1096 | } |
||
| 1097 | |||
| 1098 | // if we need client certs but don't have one, return |
||
| 1099 | if (($eaptype == \core\common\EAP::EAPTYPE_ANY || $eaptype == \core\common\EAP::EAPTYPE_TLS) && $clientcertdata === NULL) { |
||
| 1100 | $this->UDP_reachability_executed = RADIUSTests::RETVAL_NOTCONFIGURED; |
||
| 1101 | return RADIUSTests::RETVAL_NOTCONFIGURED; |
||
| 1102 | } |
||
| 1103 | // if we don't have a string for outer EAP method name, give up |
||
| 1104 | if (!isset($eapText['OUTER'])) { |
||
| 1105 | $this->UDP_reachability_executed = RADIUSTests::RETVAL_NOTCONFIGURED; |
||
| 1106 | return RADIUSTests::RETVAL_NOTCONFIGURED; |
||
| 1107 | } |
||
| 1108 | return TRUE; |
||
| 1109 | } |
||
| 1110 | |||
| 1111 | public function autodetectCAWithProbe($outerId) { |
||
| 1112 | // for EAP-TLS to be a viable option, we need to pass a random client cert to make eapol_test happy |
||
| 1113 | // the following PEM data is one of the SENSE EAPLab client certs (not secret at all) |
||
| 1114 | $clientcert = file_get_contents(dirname(__FILE__) . "/clientcert.p12"); |
||
| 1115 | if ($clientcert === FALSE) { |
||
| 1116 | throw new Exception("A dummy client cert is part of the source distribution, but could not be loaded!"); |
||
| 1117 | } |
||
| 1118 | // which probe should we use? First is probably okay... |
||
| 1119 | $probeindex = 0; |
||
| 1120 | $preliminaries = $this->udpLoginPreliminaries($probeindex, \core\common\EAP::EAPTYPE_ANY, $clientcert); |
||
| 1121 | if ($preliminaries !== TRUE) { |
||
| 1122 | return $preliminaries; |
||
| 1123 | } |
||
| 1124 | // we will need a config blob for wpa_supplicant, in a temporary directory |
||
| 1125 | $temporary = \core\common\Entity::createTemporaryDirectory('test'); |
||
| 1126 | $tmpDir = $temporary['dir']; |
||
| 1127 | chdir($tmpDir); |
||
| 1128 | $this->loggerInstance->debug(4, "temp dir: $tmpDir\n"); |
||
| 1129 | file_put_contents($tmpDir . "/client.p12", $clientcert); |
||
| 1130 | $testresults = ['cert_oddities' => []]; |
||
| 1131 | $runtime_results = $this->executeEapolTest($tmpDir, $probeindex, \core\common\EAP::EAPTYPE_ANY, $outerId, $outerId, "eaplab", FALSE, FALSE); |
||
| 1132 | $packetflow_orig = $runtime_results['output']; |
||
| 1133 | $radiusResult = $this->checkRadiusPacketFlow($testresults, $packetflow_orig); |
||
| 1134 | $negotiatedEapType = FALSE; |
||
| 1135 | if ($radiusResult != RADIUSTests::RETVAL_IMMEDIATE_REJECT) { |
||
| 1136 | $negotiatedEapType = $this->wasEapTypeNegotiated($testresults, $packetflow_orig); |
||
| 1137 | $testresults['negotiated_eaptype'] = $negotiatedEapType; |
||
| 1138 | $negotiatedTlsVersion = $this->wasModernTlsNegotiated($testresults, $packetflow_orig); |
||
| 1139 | $testresults['tls_version_eap'] = $negotiatedTlsVersion; |
||
| 1140 | } |
||
| 1141 | // now let's look at the server cert+chain, if we got a cert at all |
||
| 1142 | // that's not the case if we do EAP-pwd or could not negotiate an EAP method at |
||
| 1143 | // all |
||
| 1144 | // in that case: no server CA guess possible |
||
| 1145 | if (! |
||
| 1146 | ($radiusResult == RADIUSTests::RETVAL_CONVERSATION_REJECT && $negotiatedEapType) || $radiusResult == RADIUSTests::RETVAL_OK |
||
| 1147 | ) { |
||
| 1148 | return RADIUSTests::RETVAL_INVALID; |
||
| 1149 | } |
||
| 1150 | $bundle = $this->extractIncomingCertsfromEAP($testresults, $tmpDir); |
||
| 1151 | // we need to check if we know the issuer of the server cert |
||
| 1152 | // assume we have only one server cert - anything else is a |
||
| 1153 | // misconfiguration on the EAP server side |
||
| 1154 | $previousHighestKnownIssuer = []; |
||
| 1155 | $currentHighestKnownIssuer = $bundle['SERVERCERT'][0]['full_details']['issuer']; |
||
| 1156 | $serverName = $bundle['SERVERCERT'][0]['CN'][0]; |
||
| 1157 | // maybe there is an intermediate and the EAP server sent it. If so, |
||
| 1158 | // go and look at that, going one level higher |
||
| 1159 | $x509 = new \core\common\X509(); |
||
| 1160 | $allCACerts = array_merge($bundle['INTERMEDIATE_CA'], $bundle['UNTRUSTED_ROOT_INCLUDED']); |
||
| 1161 | while ($previousHighestKnownIssuer != $currentHighestKnownIssuer) { |
||
| 1162 | $previousHighestKnownIssuer = $currentHighestKnownIssuer; |
||
| 1163 | foreach ($allCACerts as $oneCACert) { |
||
| 1164 | $certDetails = $x509->processCertificate($oneCACert); |
||
| 1165 | if ($certDetails['full_details']['subject'] == $previousHighestKnownIssuer) { |
||
| 1166 | $currentHighestKnownIssuer = $certDetails['full_details']['issuer']; |
||
| 1167 | } |
||
| 1168 | if ($certDetails['full_details']['subject'] == $certDetails['full_details']['issuer']) { |
||
| 1169 | // if we see a subject == issuer, then the EAP server even |
||
| 1170 | // sent a root certificate. We'll propose that then. |
||
| 1171 | return [ |
||
| 1172 | "NAME" => $serverName, |
||
| 1173 | "INTERMEDIATE_CA" => $bundle['INTERMEDIATE_CA'], |
||
| 1174 | "HIGHEST_ISSUER" => $currentHighestKnownIssuer, |
||
| 1175 | "ROOT_CA" => $certDetails['pem'], |
||
| 1176 | ]; |
||
| 1177 | } |
||
| 1178 | } |
||
| 1179 | } |
||
| 1180 | // we now know the "highest" issuer name we got from the EAP |
||
| 1181 | // conversation - ideally the name of a root CA we know. Let's look at |
||
| 1182 | // our own system store to get a list of all commercial CAs with browser |
||
| 1183 | // trust, and custom ones we may have configured |
||
| 1184 | $ourRoots = file_get_contents(\config\ConfAssistant::PATHS['trust-store-custom']); |
||
| 1185 | $mozillaRoots = file_get_contents(\config\ConfAssistant::PATHS['trust-store-mozilla']); |
||
| 1186 | $allRoots = $x509->splitCertificate($ourRoots . "\n" . $mozillaRoots); |
||
| 1187 | foreach ($allRoots as $oneRoot) { |
||
| 1188 | $processedRoot = $x509->processCertificate($oneRoot); |
||
| 1189 | if ($processedRoot['full_details']['subject'] == $currentHighestKnownIssuer) { |
||
| 1190 | return [ |
||
| 1191 | "NAME" => $serverName, |
||
| 1192 | "INTERMEDIATE_CA" => $bundle['INTERMEDIATE_CA'], |
||
| 1193 | "HIGHEST_ISSUER" => $currentHighestKnownIssuer, |
||
| 1194 | "ROOT_CA" => $oneRoot, |
||
| 1195 | ]; |
||
| 1196 | } |
||
| 1197 | } |
||
| 1198 | return [ |
||
| 1199 | "NAME" => $serverName, |
||
| 1200 | "INTERMEDIATE_CA" => $bundle['INTERMEDIATE_CA'], |
||
| 1201 | "HIGHEST_ISSUER" => $currentHighestKnownIssuer, |
||
| 1202 | "ROOT_CA" => NULL, |
||
| 1203 | ]; |
||
| 1204 | } |
||
| 1205 | |||
| 1206 | /** |
||
| 1207 | * The big Guy. This performs an actual login with EAP and records how far |
||
| 1208 | * it got and what oddities were observed along the way |
||
| 1209 | * @param int $probeindex the probe we are connecting to (as set in product config) |
||
| 1210 | * @param array $eaptype EAP type to use for connection |
||
| 1211 | * @param string $innerUser inner username to try |
||
| 1212 | * @param string $password password to try |
||
| 1213 | * @param boolean $opnameCheck whether or not we check with Operator-Name set |
||
| 1214 | * @param boolean $frag whether or not we check with an oversized packet forcing fragmentation |
||
| 1215 | * @param string $clientcertdata client certificate credential to try |
||
| 1216 | * @return int overall return code of the login test |
||
| 1217 | * @throws Exception |
||
| 1218 | */ |
||
| 1219 | public function udpLogin($probeindex, $eaptype, $innerUser, $password, $opnameCheck = TRUE, $frag = TRUE, $clientcertdata = NULL) { |
||
| 1298 | } |
||
| 1299 | |||
| 1300 | /** |
||
| 1301 | * sets the outer identity to use in the checks |
||
| 1302 | * |
||
| 1303 | * @param string $id the outer ID to use |
||
| 1304 | * @return void |
||
| 1305 | */ |
||
| 1306 | public function setOuterIdentity($id) { |
||
| 1308 | } |
||
| 1309 | |||
| 1310 | /** |
||
| 1311 | * pull together all sub tests into a cohesive test result |
||
| 1312 | * @param int $host index of the probe for which the results are collated |
||
| 1313 | * @return array |
||
| 1314 | */ |
||
| 1315 | public function consolidateUdpResult($host) { |
||
| 1369 | } |
||
| 1370 | |||
| 1371 | } |
||
| 1372 |
The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g.
excluded_paths: ["lib/*"], you can move it to the dependency path list as follows:For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths