@@ -168,27 +168,27 @@ discard block  | 
                                                    ||
| 168 | 168 |      { | 
                                                        
| 169 | 169 | // it could match CN or sAN:DNS, we don't care which  | 
                                                        
| 170 | 170 |          if (isset($this->TLS_CA_checks_result[$host]['certdata']['subject'])) { | 
                                                        
| 171 | - $this->loggerInstance->debug(4, "Checking expected server name " . $this->expectedName .  | 
                                                        |
| 172 | - " against Subject: " . $this->TLS_CA_checks_result[$host]['certdata']['subject']);  | 
                                                        |
| 171 | + $this->loggerInstance->debug(4, "Checking expected server name ".$this->expectedName.  | 
                                                        |
| 172 | + " against Subject: ".$this->TLS_CA_checks_result[$host]['certdata']['subject']);  | 
                                                        |
| 173 | 173 | // we are checking against accidental misconfig, not attacks, so loosely checking against end of string is appropriate  | 
                                                        
| 174 | -            if (preg_match("/CN=" . $this->expectedName . "/", $this->TLS_CA_checks_result[$host]['certdata']['subject']) === 1) { | 
                                                        |
| 174 | +            if (preg_match("/CN=".$this->expectedName."/", $this->TLS_CA_checks_result[$host]['certdata']['subject']) === 1) { | 
                                                        |
| 175 | 175 | return TRUE;  | 
                                                        
| 176 | 176 | }  | 
                                                        
| 177 | 177 | }  | 
                                                        
| 178 | 178 |          if (isset($this->TLS_CA_checks_result[$host]['certdata']['extensions']['subjectaltname'])) { | 
                                                        
| 179 | - $this->loggerInstance->debug(4, "Checking expected server name " . $this->expectedName . " against sANs: ");  | 
                                                        |
| 179 | + $this->loggerInstance->debug(4, "Checking expected server name ".$this->expectedName." against sANs: ");  | 
                                                        |
| 180 | 180 | $this->loggerInstance->debug(4, $this->TLS_CA_checks_result[$host]['certdata']['extensions']['subjectaltname']);  | 
                                                        
| 181 | 181 | $testNames = $this->TLS_CA_checks_result[$host]['certdata']['extensions']['subjectaltname'];  | 
                                                        
| 182 | 182 |              if (!is_array($testNames)) { | 
                                                        
| 183 | 183 | $testNames = [$testNames];  | 
                                                        
| 184 | 184 | }  | 
                                                        
| 185 | 185 |              foreach ($testNames as $oneName) { | 
                                                        
| 186 | -                if (preg_match("/" . $this->expectedName . "/", $oneName) === 1) { | 
                                                        |
| 186 | +                if (preg_match("/".$this->expectedName."/", $oneName) === 1) { | 
                                                        |
| 187 | 187 | return TRUE;  | 
                                                        
| 188 | 188 | }  | 
                                                        
| 189 | 189 | }  | 
                                                        
| 190 | 190 | }  | 
                                                        
| 191 | - $this->loggerInstance->debug(3, "Tried to check expected server name " . $this->expectedName . " but neither CN nor sANs matched.");  | 
                                                        |
| 191 | + $this->loggerInstance->debug(3, "Tried to check expected server name ".$this->expectedName." but neither CN nor sANs matched.");  | 
                                                        |
| 192 | 192 | |
| 193 | 193 | $this->TLS_CA_checks_result[$host]['cert_oddity'] = RADIUSTests::CERTPROB_DYN_SERVER_NAME_MISMATCH;  | 
                                                        
| 194 | 194 | return FALSE;  | 
                                                        
@@ -218,9 +218,9 @@ discard block  | 
                                                    ||
| 218 | 218 | $this->TLS_clients_checks_result[$host]['ca'][$type]['certificate'][$k]['status'] = $cert['status'];  | 
                                                        
| 219 | 219 | $this->TLS_clients_checks_result[$host]['ca'][$type]['certificate'][$k]['message'] = $this->TLS_certkeys[$cert['status']];  | 
                                                        
| 220 | 220 | $this->TLS_clients_checks_result[$host]['ca'][$type]['certificate'][$k]['expected'] = $cert['expected'];  | 
                                                        
| 221 | - $add = ' -cert ' . ROOT . '/config/cli-certs/' . $cert['public'] . ' -key ' . ROOT . '/config/cli-certs/' . $cert['private'];  | 
                                                        |
| 222 | - if (!file_exists(ROOT . '/config/cli-certs/' . $cert['public']) ||!file_exists(ROOT .  | 
                                                        |
| 223 | -                        '/config/cli-certs/' . $cert['private'])) { | 
                                                        |
| 221 | + $add = ' -cert '.ROOT.'/config/cli-certs/'.$cert['public'].' -key '.ROOT.'/config/cli-certs/'.$cert['private'];  | 
                                                        |
| 222 | + if (!file_exists(ROOT.'/config/cli-certs/'.$cert['public']) || !file_exists(ROOT.  | 
                                                        |
| 223 | +                        '/config/cli-certs/'.$cert['private'])) { | 
                                                        |
| 224 | 224 | $this->TLS_clients_checks_result[$host]['ca'][$type]['certificate'][$k]['finalerror'] = 2;  | 
                                                        
| 225 | 225 | continue;  | 
                                                        
| 226 | 226 | }  | 
                                                        
@@ -231,7 +231,7 @@ discard block  | 
                                                    ||
| 231 | 231 |                  if (in_array("TLS1.3", $protocols) && count($protocols) > 1) { | 
                                                        
| 232 | 232 | $prot .= ' -no_tls1_3';  | 
                                                        
| 233 | 233 | }  | 
                                                        
| 234 | - $add .= ' ' . $prot;  | 
                                                        |
| 234 | + $add .= ' '.$prot;  | 
                                                        |
| 235 | 235 | $opensslbabble = $this->execOpensslClient($host, $add, $this->TLS_clients_checks_result[$host]['ca'][$type]['certificate'][$k]);  | 
                                                        
| 236 | 236 | $res = $this->opensslClientsResult($host, $opensslbabble, $this->TLS_clients_checks_result, $type, $k);  | 
                                                        
| 237 | 237 |                  if ($cert['expected'] == 'PASS') { | 
                                                        
@@ -273,11 +273,11 @@ discard block  | 
                                                    ||
| 273 | 273 | // but code analysers want this more explicit, so here is this extra  | 
                                                        
| 274 | 274 | // call to escapeshellarg()  | 
                                                        
| 275 | 275 | $escapedHost = escapeshellarg($host);  | 
                                                        
| 276 | - $this->loggerInstance->debug(4, \config\Master::PATHS['openssl'] . " s_client -connect " . $escapedHost . " -CApath " . ROOT . "/config/ca-certs/$this->consortium/ $arg 2>&1\n");  | 
                                                        |
| 276 | + $this->loggerInstance->debug(4, \config\Master::PATHS['openssl']." s_client -connect ".$escapedHost." -CApath ".ROOT."/config/ca-certs/$this->consortium/ $arg 2>&1\n");  | 
                                                        |
| 277 | 277 | $time_start = microtime(true);  | 
                                                        
| 278 | 278 | $opensslbabble = [];  | 
                                                        
| 279 | 279 | $result = 999; // likely to become zero by openssl; don't want to initialise to zero, could cover up exec failures  | 
                                                        
| 280 | - exec(\config\Master::PATHS['openssl'] . " s_client -connect " . $escapedHost . " -CApath " . ROOT . "/config/ca-certs/$this->consortium/ $arg 2>&1", $opensslbabble, $result);  | 
                                                        |
| 280 | + exec(\config\Master::PATHS['openssl']." s_client -connect ".$escapedHost." -CApath ".ROOT."/config/ca-certs/$this->consortium/ $arg 2>&1", $opensslbabble, $result);  | 
                                                        |
| 281 | 281 | $time_stop = microtime(true);  | 
                                                        
| 282 | 282 | $testresults['time_millisec'] = floor(($time_stop - $time_start) * 1000);  | 
                                                        
| 283 | 283 | $testresults['returncode'] = $result;  | 
                                                        
@@ -399,7 +399,7 @@ discard block  | 
                                                    ||
| 399 | 399 | private function propertyCheckPolicy($cert)  | 
                                                        
| 400 | 400 |      { | 
                                                        
| 401 | 401 | $oids = [];  | 
                                                        
| 402 | -        if (isset($cert['extensions']['certificatePolicies']) &&  $cert['extensions']['certificatePolicies']) { | 
                                                        |
| 402 | +        if (isset($cert['extensions']['certificatePolicies']) && $cert['extensions']['certificatePolicies']) { | 
                                                        |
| 403 | 403 |              foreach (\config\Diagnostics::RADIUSTESTS['TLS-acceptableOIDs'] as $key => $oid) { | 
                                                        
| 404 | 404 |                  if (preg_match("/Policy: $oid/", $cert['extensions']['certificatePolicies'])) { | 
                                                        
| 405 | 405 | $oids[$key] = $oid;  | 
                                                        
@@ -8,7 +8,7 @@ discard block  | 
                                                    ||
| 8 | 8 | * License: see the web/copyright.php file in the file structure  | 
                                                        
| 9 | 9 | * ******************************************************************************  | 
                                                        
| 10 | 10 | */  | 
                                                        
| 11 | -require_once dirname(dirname(__FILE__)) . "/config/_config.php";  | 
                                                        |
| 11 | +require_once dirname(dirname(__FILE__))."/config/_config.php";  | 
                                                        |
| 12 | 12 | |
| 13 | 13 | /**  | 
                                                        
| 14 | 14 | * The sctipt will be called from crontab  | 
                                                        
@@ -28,7 +28,7 @@ discard block  | 
                                                    ||
| 28 | 28 | }  | 
                                                        
| 29 | 29 | |
| 30 | 30 | |
| 31 | -while ( $row = mysqli_fetch_object(/** @scrutinizer ignore-type */ $allOpenRoamingProfiles)) { | 
                                                        |
| 31 | +while ($row = mysqli_fetch_object(/** @scrutinizer ignore-type */ $allOpenRoamingProfiles)) { | 
                                                        |
| 32 | 32 | $profileId = $row->profile_id;  | 
                                                        
| 33 | 33 | $profile = \core\ProfileFactory::instantiate($profileId);  | 
                                                        
| 34 | 34 | $res = $profile->openroamingRedinessTest();  |