DeviceChromebook::eapBlock() - Code Metrics - Inspection of "update lock file to current versions" - GEANT/CAT - Measure and Improve Code Quality continuously with Scrutinizer

Test Failed

Push — master ( 83b526...bd639c )

by Stefan

created 2023-11-14 14:20 UTC

DeviceChromebook::eapBlock() C

↳ Parent: DeviceChromebook

Complexity

Conditions	10
Paths	256

Size

Total Lines	46
Code Lines	26

Duplication

Lines	0
Ratio	0 %

Importance

Changes	2
Bugs	0	Features	0

Metric	Value
eloc	26
c	2
b	0
f	0
dl	0
loc	46
rs	6.1333
cc	10
nc	256
nop	1

How to fix Complexity

<?php

/*
 * *****************************************************************************
 * Contributions to this work were made on behalf of the GÉANT project, a 
 * project that has received funding from the European Union’s Framework 
 * Programme 7 under Grant Agreements No. 238875 (GN3) and No. 605243 (GN3plus),
 * Horizon 2020 research and innovation programme under Grant Agreements No. 
 * 691567 (GN4-1) and No. 731122 (GN4-2).
 * On behalf of the aforementioned projects, GEANT Association is the sole owner
 * of the copyright in all material which was developed by a member of the GÉANT
 * project. GÉANT Vereniging (Association) is registered with the Chamber of 
 * Commerce in Amsterdam with registration number 40535155 and operates in the 
 * UK as a branch of GÉANT Vereniging.
 * 
 * Registered office: Hoekenrode 3, 1102BR Amsterdam, The Netherlands. 
 * UK branch address: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK
 *
 * License: see the web/copyright.inc.php file in the file structure or
 *          <base_url>/copyright.php after deploying the software
 */

/**
 * This file contains the DeviceChromebook class, for generating installers
 * on ChromeOS.
 *
 * We follow the specification at: https://chromium.googlesource.com/chromium/src/+/refs/heads/main/components/onc/docs/onc_spec.md
 *  
 * @package ModuleWriting
 */

namespace devices\chromebook;

use Exception;

/**
 * This is the main implementation class of the ChromeOS module
 *
 * @package ModuleWriting
 */
class DeviceChromebook extends \core\DeviceConfig
{

    /**
     * Number of iterations for the PBKDF2 function. 
     * 20000 is the minimum as per ChromeOS ONC spec
     * 500000 is the maximum as per Chromium source code
     * https://cs.chromium.org/chromium/src/chromeos/network/onc/onc_utils.cc?sq=package:chromium&dr=CSs&rcl=1482394814&l=110
     */
    const PBKDF2_ITERATIONS = 20000;

    /**
     * Constructs a Device object.
     *
     * @final not to be redefined
     */
    final public function __construct()
    {
        parent::__construct();
        $this->setSupportedEapMethods([\core\common\EAP::EAPTYPE_PEAP_MSCHAP2, \core\common\EAP::EAPTYPE_TTLS_PAP, \core\common\EAP::EAPTYPE_TTLS_MSCHAP2, \core\common\EAP::EAPTYPE_TLS, \core\common\EAP::EAPTYPE_SILVERBULLET]);
        $this->specialities['media:openroaming'] = _("This device does not support provisioning of OpenRoaming.");
        $this->specialities['media:consortium_OI'] = _("This device does not support provisioning of Passpoint networks.");
    }

    /**
     * encrypts the entire configuration. Only used in SB to protect the client
     * credential
     * 
     * @param string $clearJson the cleartext JSON string to encrypt
     * @param string $password  the import PIN we told the user
     * @return string
     */
    private function encryptConfig($clearJson, $password)
    {
        $salt = \core\common\Entity::randomString(12);
        $encryptionKey = hash_pbkdf2("sha1", $password, $salt, DeviceChromebook::PBKDF2_ITERATIONS, 32, TRUE); // the spec is not clear about the algo. Source code in Chromium makes clear it's SHA1.
        $strong = FALSE; // should become TRUE if strong crypto is available like it should.
        $initVector = openssl_random_pseudo_bytes(16, $strong);
        if ($strong === FALSE) {
            $this->loggerInstance->debug(1, "WARNING: OpenSSL reports that a random value was generated with a weak cryptographic algorithm (DeviceChromebook::writeInstaller()). You should investigate the reason for this!");
        }
        $cryptoJson = openssl_encrypt($clearJson, 'AES-256-CBC', $encryptionKey, OPENSSL_RAW_DATA, $initVector);
        $hmac = hash_hmac("sha1", $cryptoJson, $encryptionKey, TRUE);

        $this->loggerInstance->debug(4, "Clear = $clearJson\nSalt = $salt\nPW = " . $password . "\nb(IV) = " . base64_encode($initVector) . "\nb(Cipher) = " . base64_encode($cryptoJson) . "\nb(HMAC) = " . base64_encode($hmac));

        // now, generate the container that holds all the crypto data
        $finalArray = [
            "Cipher" => "AES256",
            "Ciphertext" => base64_encode($cryptoJson),
            "HMAC" => base64_encode($hmac), // again by reading source code! And why?
            "HMACMethod" => "SHA1",
            "Salt" => base64_encode($salt), // this is B64 encoded, but had to read Chromium source code to find out! Not in the spec!
            "Stretch" => "PBKDF2",
            "Iterations" => DeviceChromebook::PBKDF2_ITERATIONS,
            "IV" => base64_encode($initVector),
            "Type" => "EncryptedConfiguration",
        ];
        return json_encode($finalArray);
    }

    /**
     * Creates a WiFi block (SSID based only, no support for Passpoint)
     * @param string $ssid       the SSID to configure
     * @param array  $eapdetails the EAP sub-block as derived from EapBlock()
     * @return array
     */
    private function wifiBlock($ssid, $eapdetails)
    {
        return [
            "GUID" => \core\common\Entity::uuid('', $ssid),
            "Name" => "$ssid",
            "Remove" => false,
            "Type" => "WiFi",
            "WiFi" => [
                "AutoConnect" => true,
                "EAP" => $eapdetails,
                "HiddenSSID" => false,
                "SSID" => $ssid,
                "Security" => "WPA-EAP",
            ],
            "ProxySettings" => $this->proxySettings(),
        ];
    }

    /**
     * Creates the ProxySettings block
     * 
     * @return array
     */
    protected function proxySettings()
    {
        if (isset($this->attributes['media:force_proxy'])) {
            // find the port delimiter. In case of IPv6, there are multiple ':' 
            // characters, so we have to find the LAST one
            $serverAndPort = explode(':', strrev($this->attributes['media:force_proxy'][0]), 2);
            // characters are still reversed, invert on use!
            return ["Type" => "Manual",
                "Manual" => [
                    "SecureHTTPProxy" => [
                        "Host" => strrev($serverAndPort[1]),
                        "Port" => strrev($serverAndPort[0])
                    ]
                ]
            ];
        }
        return ["Type" => "WPAD"];
    }

    /**
     * Creates a configuration block for wired Ethernet
     * 
     * @param array $eapdetails the EAP configuration as created with eapBlock()
     * @return array
     */
    private function wiredBlock($eapdetails)
    {
        return [
            "GUID" => \core\common\Entity::uuid('', "wired-dot1x-ethernet") . "}",
            "Name" => "eduroam configuration (wired network)",
            "Remove" => false,
            "Type" => "Ethernet",
            "Ethernet" => [
                "Authentication" => "8021X",
                "EAP" => $eapdetails,
            ],
            "ProxySettings" => ["Type" => "WPAD"],
        ];
    }

    /**
     * Creates the EAP configuration sub-block
     * 
     * @param array $caRefs list of strings with CA references
     * @return array
     */
    private function eapBlock($caRefs)
    {
        $selectedEap = $this->selectedEap;
        $outerId = $this->determineOuterIdString();
        $eapPrettyprint = \core\common\EAP::eapDisplayName($selectedEap);
        // ONC has its own enums, and guess what, they don't always match
        if ($eapPrettyprint["INNER"] == "MSCHAPV2") {
            $eapPrettyprint["INNER"] = "MSCHAPv2";
        }
        if ($eapPrettyprint["OUTER"] == "TTLS") {
            $eapPrettyprint["OUTER"] = "EAP-TTLS";
        }
        if ($eapPrettyprint["OUTER"] == "TLS") {
            $eapPrettyprint["OUTER"] = "EAP-TLS";
        }

        // define EAP properties

        $eaparray = [];

        // if silverbullet, we deliver the client cert inline

        if ($selectedEap == \core\common\EAP::EAPTYPE_SILVERBULLET) {
            $eaparray['ClientCertRef'] = "[" . $this->clientCert['GUID'] . "]";
            $eaparray['ClientCertType'] = "Ref";
        }

        $eaparray["Outer"] = $eapPrettyprint["OUTER"];
        if ($eapPrettyprint["INNER"] == "MSCHAPv2" || $eapPrettyprint["INNER"] == "PAP") {
            $eaparray["Inner"] = $eapPrettyprint["INNER"];
        }
        $eaparray["SaveCredentials"] = true;
        $eaparray["ServerCARefs"] = $caRefs; // maybe takes just one CA?
        $eaparray["UseSystemCAs"] = false;
        // enumerate the server names to check against with SubjectAlternativeNameMatch
        foreach ($this->attributes['eap:server_name'] as $oneName) {
            $eaparray["SubjectAlternativeNameMatch"][] = ["Type" => "DNS", "Value" => $oneName];
        }

        if ($outerId !== NULL) {
            $eaparray["AnonymousIdentity"] = $outerId;
        }
        if ($selectedEap == \core\common\EAP::EAPTYPE_SILVERBULLET) {
            $eaparray["Identity"] = $this->clientCert["certObject"]->username;
        }
        return $eaparray;
    }

    /**
     * prepare a ONC file
     *
     * @return string installer path name
     * @throws Exception
     */
    public function writeInstaller()
    {
        $this->loggerInstance->debug(4, "Chromebook Installer start\n");
        $caRefs = [];
        // we don't do per-user encrypted containers
        $jsonArray = ["Type" => "UnencryptedConfiguration"];

        foreach ($this->attributes['internal:CAs'][0] as $ca) {
            $caRefs[] = "{" . $ca['uuid'] . "}";
        }
        // define CA certificates
        foreach ($this->attributes['internal:CAs'][0] as $ca) {
            // strip -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----
            $this->loggerInstance->debug(3, $ca['pem']);
            $caSanitized1 = substr($ca['pem'], 27, strlen($ca['pem']) - 27 - 25 - 1);
            if ($caSanitized1 === FALSE) {
                throw new Exception("Error cropping PEM data at its BEGIN marker.");
            }
            $this->loggerInstance->debug(4, $caSanitized1 . "\n");
            // remove \n
            $caSanitized = str_replace("\n", "", $caSanitized1);
            $jsonArray["Certificates"][] = ["GUID" => "{" . $ca['uuid'] . "}", "Remove" => false, "Type" => "Authority", "X509" => $caSanitized];
            $this->loggerInstance->debug(3, $caSanitized . "\n");
        }
        // if we are doing silverbullet, include the unencrypted(!) P12 as a client certificate
        if ($this->selectedEap == \core\common\EAP::EAPTYPE_SILVERBULLET) {
            $jsonArray["Certificates"][] = ["GUID" => "[" . $this->clientCert['GUID'] . "]", "PKCS12" => base64_encode($this->clientCert['certdataclear']), "Remove" => false, "Type" => "Client"];
        }
        $eaparray = $this->eapBlock($caRefs);
        // define Wi-Fi networks
        foreach ($this->attributes['internal:networks'] as $netDefinition) {
            foreach ($netDefinition['ssid'] as $ssid) {
                $jsonArray["NetworkConfigurations"][] = $this->wifiBlock($ssid, $eaparray);
            }
        }
        // are we also configuring wired?
        if (isset($this->attributes['media:wired'])) {
            $jsonArray["NetworkConfigurations"][] = $this->wiredBlock($eaparray);
        }

        $clearJson = json_encode($jsonArray, JSON_PRETTY_PRINT);
        $finalJson = $clearJson;
        // if we are doing silverbullet we should also encrypt the entire structure(!) with the import password and embed it into a EncryptedConfiguration
        if ($this->selectedEap == \core\common\EAP::EAPTYPE_SILVERBULLET) {
            $finalJson = $this->encryptConfig($clearJson, $this->clientCert['importPassword']);
        }

        file_put_contents('installer_profile', $finalJson);

        $fileName = $this->installerBasename . '.onc';

        if (!$this->sign) {
            rename("installer_profile", $fileName);
            return $fileName;
        }

        // still here? We are signing. That actually can't be - ONC does not
        // have the notion of signing
        // but if they ever change their mind, we are prepared

        $outputFromSigning = system($this->sign . " installer_profile '$fileName' > /dev/null");
        if ($outputFromSigning === FALSE) {
            $this->loggerInstance->debug(2, "Signing the ONC installer $fileName FAILED!\n");
        }

        return $fileName;
    }

    /**
     * prepare module description and usage information
     * 
     * @return string HTML text to be displayed in the information window
     */
    public function writeDeviceInfo()
    {
        \core\common\Entity::intoThePotatoes();
        $out = "<p>";
        $out .= _("The installer is a file with the extension '.onc'. Please download it, open Chrome, and navigate to the URL <a href='chrome://network'>chrome://network</a>. Then, use the 'Import ONC file' button. The import is silent; the new network definitions will be added to the preferred networks.");
        \core\common\Entity::outOfThePotatoes();
        return $out;
    }
}


1			<?php
2
3			/*
4			* *****************************************************************************
5			* Contributions to this work were made on behalf of the GÉANT project, a
6			* project that has received funding from the European Union’s Framework
7			* Programme 7 under Grant Agreements No. 238875 (GN3) and No. 605243 (GN3plus),
8			* Horizon 2020 research and innovation programme under Grant Agreements No.
9			* 691567 (GN4-1) and No. 731122 (GN4-2).
10			* On behalf of the aforementioned projects, GEANT Association is the sole owner
11			* of the copyright in all material which was developed by a member of the GÉANT
12			* project. GÉANT Vereniging (Association) is registered with the Chamber of
13			* Commerce in Amsterdam with registration number 40535155 and operates in the
14			* UK as a branch of GÉANT Vereniging.
15			*
16			* Registered office: Hoekenrode 3, 1102BR Amsterdam, The Netherlands.
17			* UK branch address: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK
18			*
19			* License: see the web/copyright.inc.php file in the file structure or
20			* <base_url>/copyright.php after deploying the software
21			*/
22
23			/**
24			* This file contains the DeviceChromebook class, for generating installers
25			* on ChromeOS.
26			*
27			* We follow the specification at: https://chromium.googlesource.com/chromium/src/+/refs/heads/main/components/onc/docs/onc_spec.md
28			*
29			* @package ModuleWriting
30			*/
31
32			namespace devices\chromebook;
33
34			use Exception;
35
36			/**
37			* This is the main implementation class of the ChromeOS module
38			*
39			* @package ModuleWriting
40			*/
41			class DeviceChromebook extends \core\DeviceConfig
42			{
43
44			/**
45			* Number of iterations for the PBKDF2 function.
46			* 20000 is the minimum as per ChromeOS ONC spec
47			* 500000 is the maximum as per Chromium source code
48			* https://cs.chromium.org/chromium/src/chromeos/network/onc/onc_utils.cc?sq=package:chromium&dr=CSs&rcl=1482394814&l=110
49			*/
50			const PBKDF2_ITERATIONS = 20000;
51
52			/**
53			* Constructs a Device object.
54			*
55			* @final not to be redefined
56			*/
57			final public function __construct()
58			{
59			parent::__construct();
60			$this->setSupportedEapMethods([\core\common\EAP::EAPTYPE_PEAP_MSCHAP2, \core\common\EAP::EAPTYPE_TTLS_PAP, \core\common\EAP::EAPTYPE_TTLS_MSCHAP2, \core\common\EAP::EAPTYPE_TLS, \core\common\EAP::EAPTYPE_SILVERBULLET]);
61			$this->specialities['media:openroaming'] = _("This device does not support provisioning of OpenRoaming.");
62			$this->specialities['media:consortium_OI'] = _("This device does not support provisioning of Passpoint networks.");
63			}
64
65			/**
66			* encrypts the entire configuration. Only used in SB to protect the client
67			* credential
68			*
69			* @param string $clearJson the cleartext JSON string to encrypt
70			* @param string $password the import PIN we told the user
71			* @return string
72			*/
73			private function encryptConfig($clearJson, $password)
74			{
75			$salt = \core\common\Entity::randomString(12);
76			$encryptionKey = hash_pbkdf2("sha1", $password, $salt, DeviceChromebook::PBKDF2_ITERATIONS, 32, TRUE); // the spec is not clear about the algo. Source code in Chromium makes clear it's SHA1.
77			$strong = FALSE; // should become TRUE if strong crypto is available like it should.
78			$initVector = openssl_random_pseudo_bytes(16, $strong);
79			if ($strong === FALSE) {
80			$this->loggerInstance->debug(1, "WARNING: OpenSSL reports that a random value was generated with a weak cryptographic algorithm (DeviceChromebook::writeInstaller()). You should investigate the reason for this!");
81			}
82			$cryptoJson = openssl_encrypt($clearJson, 'AES-256-CBC', $encryptionKey, OPENSSL_RAW_DATA, $initVector);
83			$hmac = hash_hmac("sha1", $cryptoJson, $encryptionKey, TRUE);
84
85			$this->loggerInstance->debug(4, "Clear = $clearJson\nSalt = $salt\nPW = " . $password . "\nb(IV) = " . base64_encode($initVector) . "\nb(Cipher) = " . base64_encode($cryptoJson) . "\nb(HMAC) = " . base64_encode($hmac));
86
87			// now, generate the container that holds all the crypto data
88			$finalArray = [
89			"Cipher" => "AES256",
90			"Ciphertext" => base64_encode($cryptoJson),
91			"HMAC" => base64_encode($hmac), // again by reading source code! And why?
92			"HMACMethod" => "SHA1",
93			"Salt" => base64_encode($salt), // this is B64 encoded, but had to read Chromium source code to find out! Not in the spec!
94			"Stretch" => "PBKDF2",
95			"Iterations" => DeviceChromebook::PBKDF2_ITERATIONS,
96			"IV" => base64_encode($initVector),
97			"Type" => "EncryptedConfiguration",
98			];
99			return json_encode($finalArray);
100			}
101
102			/**
103			* Creates a WiFi block (SSID based only, no support for Passpoint)
104			* @param string $ssid the SSID to configure
105			* @param array $eapdetails the EAP sub-block as derived from EapBlock()
106			* @return array
107			*/
108			private function wifiBlock($ssid, $eapdetails)
109			{
110			return [
111			"GUID" => \core\common\Entity::uuid('', $ssid),
112			"Name" => "$ssid",
113			"Remove" => false,
114			"Type" => "WiFi",
115			"WiFi" => [
116			"AutoConnect" => true,
117			"EAP" => $eapdetails,
118			"HiddenSSID" => false,
119			"SSID" => $ssid,
120			"Security" => "WPA-EAP",
121			],
122			"ProxySettings" => $this->proxySettings(),
123			];
124			}
125
126			/**
127			* Creates the ProxySettings block
128			*
129			* @return array
130			*/
131			protected function proxySettings()
132			{
133			if (isset($this->attributes['media:force_proxy'])) {
134			// find the port delimiter. In case of IPv6, there are multiple ':'
135			// characters, so we have to find the LAST one
136			$serverAndPort = explode(':', strrev($this->attributes['media:force_proxy'][0]), 2);
137			// characters are still reversed, invert on use!
138			return ["Type" => "Manual",
139			"Manual" => [
140			"SecureHTTPProxy" => [
141			"Host" => strrev($serverAndPort[1]),
142			"Port" => strrev($serverAndPort[0])
143			]
144			]
145			];
146			}
147			return ["Type" => "WPAD"];
148			}
149
150			/**
151			* Creates a configuration block for wired Ethernet
152			*
153			* @param array $eapdetails the EAP configuration as created with eapBlock()
154			* @return array
155			*/
156			private function wiredBlock($eapdetails)
157			{
158			return [
159			"GUID" => \core\common\Entity::uuid('', "wired-dot1x-ethernet") . "}",
160			"Name" => "eduroam configuration (wired network)",
161			"Remove" => false,
162			"Type" => "Ethernet",
163			"Ethernet" => [
164			"Authentication" => "8021X",
165			"EAP" => $eapdetails,
166			],
167			"ProxySettings" => ["Type" => "WPAD"],
168			];
169			}
170
171			/**
172			* Creates the EAP configuration sub-block
173			*
174			* @param array $caRefs list of strings with CA references
175			* @return array
176			*/
177			private function eapBlock($caRefs)
178			{
179			$selectedEap = $this->selectedEap;
180			$outerId = $this->determineOuterIdString();
181			$eapPrettyprint = \core\common\EAP::eapDisplayName($selectedEap);
182			// ONC has its own enums, and guess what, they don't always match
183			if ($eapPrettyprint["INNER"] == "MSCHAPV2") {
184			$eapPrettyprint["INNER"] = "MSCHAPv2";
185			}
186			if ($eapPrettyprint["OUTER"] == "TTLS") {
187			$eapPrettyprint["OUTER"] = "EAP-TTLS";
188			}
189			if ($eapPrettyprint["OUTER"] == "TLS") {
190			$eapPrettyprint["OUTER"] = "EAP-TLS";
191			}
192
193			// define EAP properties
194
195			$eaparray = [];
196
197			// if silverbullet, we deliver the client cert inline
198
199			if ($selectedEap == \core\common\EAP::EAPTYPE_SILVERBULLET) {
200			$eaparray['ClientCertRef'] = "[" . $this->clientCert['GUID'] . "]";
201			$eaparray['ClientCertType'] = "Ref";
202			}
203
204			$eaparray["Outer"] = $eapPrettyprint["OUTER"];
205			if ($eapPrettyprint["INNER"] == "MSCHAPv2" \|\| $eapPrettyprint["INNER"] == "PAP") {
206			$eaparray["Inner"] = $eapPrettyprint["INNER"];
207			}
208			$eaparray["SaveCredentials"] = true;
209			$eaparray["ServerCARefs"] = $caRefs; // maybe takes just one CA?
210			$eaparray["UseSystemCAs"] = false;
211			// enumerate the server names to check against with SubjectAlternativeNameMatch
212			foreach ($this->attributes['eap:server_name'] as $oneName) {
213			$eaparray["SubjectAlternativeNameMatch"][] = ["Type" => "DNS", "Value" => $oneName];
214			}
215
216			if ($outerId !== NULL) {
217			$eaparray["AnonymousIdentity"] = $outerId;
218			}
219			if ($selectedEap == \core\common\EAP::EAPTYPE_SILVERBULLET) {
220			$eaparray["Identity"] = $this->clientCert["certObject"]->username;
221			}
222			return $eaparray;
223			}
224
225			/**
226			* prepare a ONC file
227			*
228			* @return string installer path name
229			* @throws Exception
230			*/
231			public function writeInstaller()
232			{
233			$this->loggerInstance->debug(4, "Chromebook Installer start\n");
234			$caRefs = [];
235			// we don't do per-user encrypted containers
236			$jsonArray = ["Type" => "UnencryptedConfiguration"];
237
238			foreach ($this->attributes['internal:CAs'][0] as $ca) {
239			$caRefs[] = "{" . $ca['uuid'] . "}";
240			}
241			// define CA certificates
242			foreach ($this->attributes['internal:CAs'][0] as $ca) {
243			// strip -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----
244			$this->loggerInstance->debug(3, $ca['pem']);
245			$caSanitized1 = substr($ca['pem'], 27, strlen($ca['pem']) - 27 - 25 - 1);
246			if ($caSanitized1 === FALSE) {
247			throw new Exception("Error cropping PEM data at its BEGIN marker.");
248			}
249			$this->loggerInstance->debug(4, $caSanitized1 . "\n");
250			// remove \n
251			$caSanitized = str_replace("\n", "", $caSanitized1);
252			$jsonArray["Certificates"][] = ["GUID" => "{" . $ca['uuid'] . "}", "Remove" => false, "Type" => "Authority", "X509" => $caSanitized];
253			$this->loggerInstance->debug(3, $caSanitized . "\n");
254			}
255			// if we are doing silverbullet, include the unencrypted(!) P12 as a client certificate
256			if ($this->selectedEap == \core\common\EAP::EAPTYPE_SILVERBULLET) {
257			$jsonArray["Certificates"][] = ["GUID" => "[" . $this->clientCert['GUID'] . "]", "PKCS12" => base64_encode($this->clientCert['certdataclear']), "Remove" => false, "Type" => "Client"];
258			}
259			$eaparray = $this->eapBlock($caRefs);
260			// define Wi-Fi networks
261			foreach ($this->attributes['internal:networks'] as $netDefinition) {
262			foreach ($netDefinition['ssid'] as $ssid) {
263			$jsonArray["NetworkConfigurations"][] = $this->wifiBlock($ssid, $eaparray);
264			}
265			}
266			// are we also configuring wired?
267			if (isset($this->attributes['media:wired'])) {
268			$jsonArray["NetworkConfigurations"][] = $this->wiredBlock($eaparray);
269			}
270
271			$clearJson = json_encode($jsonArray, JSON_PRETTY_PRINT);
272			$finalJson = $clearJson;
273			// if we are doing silverbullet we should also encrypt the entire structure(!) with the import password and embed it into a EncryptedConfiguration
274			if ($this->selectedEap == \core\common\EAP::EAPTYPE_SILVERBULLET) {
275			$finalJson = $this->encryptConfig($clearJson, $this->clientCert['importPassword']);
276			}
277
278			file_put_contents('installer_profile', $finalJson);
279
280			$fileName = $this->installerBasename . '.onc';
281
282			if (!$this->sign) {
283			rename("installer_profile", $fileName);
284			return $fileName;
285			}
286
287			// still here? We are signing. That actually can't be - ONC does not
288			// have the notion of signing
289			// but if they ever change their mind, we are prepared
290
291			$outputFromSigning = system($this->sign . " installer_profile '$fileName' > /dev/null");
292			if ($outputFromSigning === FALSE) {
293			$this->loggerInstance->debug(2, "Signing the ONC installer $fileName FAILED!\n");
294			}
295
296			return $fileName;
297			}
298
299			/**
300			* prepare module description and usage information
301			*
302			* @return string HTML text to be displayed in the information window
303			*/
304			public function writeDeviceInfo()
305			{
306			\core\common\Entity::intoThePotatoes();
307			$out = "<p>";
308			$out .= _("The installer is a file with the extension '.onc'. Please download it, open Chrome, and navigate to the URL <a href='chrome://network'>chrome://network</a>. Then, use the 'Import ONC file' button. The import is silent; the new network definitions will be added to the preferred networks.");
309			\core\common\Entity::outOfThePotatoes();
310			return $out;
311			}
312			}
313

GEANT / CAT

Push — master ( 83b526...bd639c )

DeviceChromebook::eapBlock() C

Complexity

Size

Duplication

Importance

How to fix Complexity

Long Method

Duplication Side-by-Side

Filter issues like