core\diag\RADIUSTests::extractIncomingCertsfromEAP()

Complexity

Conditions	18
Paths	218

Size

Total Lines	94
Code Lines	53

Duplication

Lines	6
Ratio	6.38 %

Importance

Changes

0

<?php
    private function extractIncomingCertsfromEAP(&$testresults, $tmpDir) {

        /*
         *  EAP's house rules:
         * 1) it is unnecessary to include the root CA itself (adding it has
         *    detrimental effects on performance)
         * 2) TLS Web Server OID presence (Windows OSes need that)
         * 3) MD5 signature algorithm disallowed (iOS barks if so)
         * 4) CDP URL (Windows Phone 8 barks if not present)
         * 5) there should be exactly one server cert in the chain
         */

        $x509 = new \core\common\X509();
        $eapCertArray = [];
// $eap_certarray holds all certs received in EAP conversation
        $incomingData = file_get_contents($tmpDir . "/serverchain.pem");
        if ($incomingData !== FALSE) {
            $eapCertArray = $x509->splitCertificate($incomingData);
        }
        $numberServer = 0;
        $eapIntermediates = [];
        $eapIntermediateCRLs = [];
        $servercert = FALSE;
        $intermOdditiesEAP = [];

        $testresults['certdata'] = [];


        foreach ($eapCertArray as $certPem) {
            $cert = $x509->processCertificate($certPem);
            if ($cert == FALSE) {
                continue;
            }
// consider the certificate a server cert 
// a) if it is not a CA and is not a self-signed root
// b) if it is a CA, and self-signed, and it is the only cert in
//    the incoming cert chain
//    (meaning the self-signed is itself the server cert)
            switch ($this->determineCertificateType($cert, count($eapCertArray))) {
                case RADIUSTests::SERVER_NO_CA_EXTENSION: // both are handled same, fall-through
                case RADIUSTests::SERVER_CA_SELFSIGNED:
                    $numberServer = $numberServer + 1;

                    $servercert = $cert;
                    if ($numberServer == 1) {
                        if (file_put_contents($tmpDir . "/incomingserver.pem", $certPem . "\n") === FALSE) {
                            $this->loggerInstance->debug(4, "The (first) server certificate could not be written to $tmpDir/incomingserver.pem!\n");
                        }
                        $this->loggerInstance->debug(4, "This is the (first) server certificate, with CRL content if applicable: " . print_r($servercert, true));
                    }
                    if ($numberServer > 1 && !in_array(RADIUSTests::CERTPROB_TOO_MANY_SERVER_CERTS, $testresults['cert_oddities'])) {
                        $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_TOO_MANY_SERVER_CERTS;
                    }
                    break;
                case RADIUSTests::CA_ROOT:
                    if (!in_array(RADIUSTests::CERTPROB_ROOT_INCLUDED, $testresults['cert_oddities'])) {
                        $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_ROOT_INCLUDED;
                    }
// do not save the root CA, it serves no purpose
// chain checks need to be against the UPLOADED CA of the
// IdP/profile, not against an EAP-discovered CA
                    break;
                case RADIUSTests::CA_INTERMEDIATE:
                    $intermOdditiesEAP = array_merge($intermOdditiesEAP, $this->propertyCheckIntermediate($cert));
                    $eapIntermediates[] = $certPem;

                    if (isset($cert['CRL']) && isset($cert['CRL'][0])) {
                        $eapIntermediateCRLs[] = $cert['CRL'][0];
                    }
                    break;
                default:
                    throw new Exception("Status of certificate could not be determined!");
            }
            $testresults['certdata'][] = $cert['full_details'];
        }

        if ($numberServer == 0) {
            $testresults['cert_oddities'][] = RADIUSTests::CERTPROB_NO_SERVER_CERT;
        }
// check server cert properties
        if ($numberServer > 0) {
            if ($servercert === FALSE) {
                throw new Exception("We incremented the numberServer counter and added a certificate. Now it's gone?!");
            }
            $testresults['cert_oddities'] = array_merge($testresults['cert_oddities'], $this->propertyCheckServercert($servercert));
            $testresults['incoming_server_names'] = $servercert['incoming_server_names'];
        }
        return [
            "SERVERCERT" => $servercert,
            "INTERMEDIATE_CA" => $eapIntermediates,
            "INTERMEDIATE_CRL" => $eapIntermediateCRLs,
            "INTERMEDIATE_OBSERVED_ODDITIES" => $intermOdditiesEAP,
        ];
    }