@@ -46,8 +46,8 @@ discard block |
||
46 | 46 | $keyBytes, |
47 | 47 | $text) |
48 | 48 | { |
49 | - $hash = hash_hmac ($crypto, $text, $keyBytes); |
|
50 | - return $hash; |
|
49 | + $hash = hash_hmac ($crypto, $text, $keyBytes); |
|
50 | + return $hash; |
|
51 | 51 | } |
52 | 52 | |
53 | 53 | /** |
@@ -83,12 +83,12 @@ discard block |
||
83 | 83 | * {@link truncationDigits} digits |
84 | 84 | */ |
85 | 85 | static function generateOCRA($ocraSuite, |
86 | - $key, |
|
87 | - $counter, |
|
88 | - $question, |
|
89 | - $password, |
|
90 | - $sessionInformation, |
|
91 | - $timeStamp) |
|
86 | + $key, |
|
87 | + $counter, |
|
88 | + $question, |
|
89 | + $password, |
|
90 | + $sessionInformation, |
|
91 | + $timeStamp) |
|
92 | 92 | { |
93 | 93 | $codeDigits = 0; |
94 | 94 | $crypto = ""; |
@@ -29,8 +29,8 @@ |
||
29 | 29 | * @param string $message exception message |
30 | 30 | * @param Exception $parent parent exception |
31 | 31 | */ |
32 | - public function __construct($message, $parent=null) |
|
33 | - { |
|
34 | - parent::__construct($message, 0, $parent); |
|
35 | - } |
|
32 | + public function __construct($message, $parent=null) |
|
33 | + { |
|
34 | + parent::__construct($message, 0, $parent); |
|
35 | + } |
|
36 | 36 | } |
37 | 37 | \ No newline at end of file |
@@ -2,295 +2,295 @@ |
||
2 | 2 | |
3 | 3 | class OATH_OCRAParser { |
4 | 4 | |
5 | - private $key = NULL; |
|
6 | - |
|
7 | - private $OCRASuite = NULL; |
|
8 | - |
|
9 | - private $OCRAVersion = NULL; |
|
10 | - |
|
11 | - private $CryptoFunctionType = NULL; |
|
12 | - private $CryptoFunctionHash = NULL; |
|
13 | - private $CryptoFunctionHashLength = NULL; |
|
14 | - private $CryptoFunctionTruncation = NULL; |
|
15 | - |
|
16 | - private $C = FALSE; |
|
17 | - private $Q = FALSE; |
|
18 | - private $QType = 'N'; |
|
19 | - private $QLength = 8; |
|
20 | - |
|
21 | - private $P = FALSE; |
|
22 | - private $PType = 'SHA1'; |
|
23 | - private $PLength = 20; |
|
24 | - |
|
25 | - private $S = FALSE; |
|
26 | - private $SLength = 64; |
|
27 | - |
|
28 | - private $T = FALSE; |
|
29 | - private $TLength = 60; // 1M |
|
30 | - private $TPeriods = array('H' => 3600, 'M' => 60, 'S' => 1); |
|
31 | - |
|
32 | - private $supportedHashFunctions = array('SHA1' => 20, 'SHA256' => 32, 'SHA512' => 64); |
|
33 | - |
|
34 | - |
|
35 | - public function __construct($ocraSuite) { |
|
36 | - $this->parseOCRASuite($ocraSuite); |
|
37 | - } |
|
38 | - |
|
39 | - /** |
|
40 | - * Inspired by https://github.com/bdauvergne/python-oath |
|
41 | - */ |
|
42 | - private function parseOCRASuite($ocraSuite) { |
|
43 | - if (!is_string($ocraSuite)) { |
|
44 | - throw new Exception('OCRASuite not in string format: ' . var_export($ocraSuite, TRUE)); |
|
45 | - } |
|
46 | - |
|
47 | - $ocraSuite = strtoupper($ocraSuite); |
|
48 | - $this->OCRASuite = $ocraSuite; |
|
49 | - |
|
50 | - $s = explode(':', $ocraSuite); |
|
51 | - if (count($s) != 3) { |
|
52 | - throw new Exception('Invalid OCRASuite format: ' . var_export($ocraSuite, TRUE)); |
|
53 | - } |
|
54 | - |
|
55 | - $algo = explode('-', $s[0]); |
|
56 | - if (count($algo) != 2) { |
|
57 | - throw new Exception('Invalid OCRA version: ' . var_export($s[0], TRUE)); |
|
58 | - } |
|
59 | - |
|
60 | - if ($algo[0] !== 'OCRA') { |
|
61 | - throw new Exception('Unsupported OCRA algorithm: ' . var_export($algo[0], TRUE)); |
|
62 | - } |
|
63 | - |
|
64 | - if ($algo[1] !== '1') { |
|
65 | - throw new Exception('Unsupported OCRA version: ' . var_export($algo[1], TRUE)); |
|
66 | - } |
|
67 | - $this->OCRAVersion = $algo[1]; |
|
68 | - |
|
69 | - $cf = explode('-', $s[1]); |
|
70 | - if (count($cf) != 3) { |
|
71 | - throw new Exception('Invalid OCRA suite crypto function: ' . var_export($s[1], TRUE)); |
|
72 | - } |
|
73 | - |
|
74 | - if ($cf[0] !== 'HOTP') { |
|
75 | - throw new Exception('Unsupported OCRA suite crypto function: ' . var_export($cf[0], TRUE)); |
|
76 | - } |
|
77 | - $this->CryptoFunctionType = $cf[0]; |
|
78 | - |
|
79 | - if (!array_key_exists($cf[1], $this->supportedHashFunctions)) { |
|
80 | - throw new Exception('Unsupported hash function in OCRA suite crypto function: ' . var_export($cf[1], TRUE)); |
|
81 | - } |
|
82 | - $this->CryptoFunctionHash = $cf[1]; |
|
83 | - $this->CryptoFunctionHashLength = $this->supportedHashFunctions[$cf[1]]; |
|
84 | - |
|
85 | - if (!preg_match('/^\d+$/', $cf[2]) || (($cf[2] < 4 || $cf[2] > 10) && $cf[2] != 0)) { |
|
86 | - throw new Exception('Invalid OCRA suite crypto function truncation length: ' . var_export($cf[2], TRUE)); |
|
87 | - } |
|
88 | - $this->CryptoFunctionTruncation = intval($cf[2]); |
|
89 | - |
|
90 | - $di = explode('-', $s[2]); |
|
91 | - if (count($cf) == 0) { |
|
92 | - throw new Exception('Invalid OCRA suite data input: ' . var_export($s[2], TRUE)); |
|
93 | - } |
|
94 | - |
|
95 | - $data_input = array(); |
|
96 | - foreach($di as $elem) { |
|
97 | - $letter = $elem[0]; |
|
98 | - if (array_key_exists($letter, $data_input)) { |
|
99 | - throw new Exception('Duplicate field in OCRA suite data input: ' . var_export($elem, TRUE)); |
|
100 | - } |
|
101 | - $data_input[$letter] = 1; |
|
102 | - |
|
103 | - if ($letter === 'C' && strlen($elem) == 1) { |
|
104 | - $this->C = TRUE; |
|
105 | - } elseif ($letter === 'Q') { |
|
106 | - if (strlen($elem) == 1) { |
|
107 | - $this->Q = TRUE; |
|
108 | - } elseif (preg_match('/^Q([AHN])(\d+)$/', $elem, $match)) { |
|
109 | - $q_len = intval($match[2]); |
|
110 | - if ($q_len < 4 || $q_len > 64) { |
|
111 | - throw new Exception('Invalid OCRA suite data input question length: ' . var_export($q_len, TRUE)); |
|
112 | - } |
|
113 | - $this->Q = TRUE; |
|
114 | - $this->QType = $match[1]; |
|
115 | - $this->QLength = $q_len; |
|
116 | - } else { |
|
117 | - throw new Exception('Invalid OCRA suite data input question: ' . var_export($elem, TRUE)); |
|
118 | - } |
|
119 | - } elseif ($letter === 'P') { |
|
120 | - if (strlen($elem) == 1) { |
|
121 | - $this->P = TRUE; |
|
122 | - } else { |
|
123 | - $p_algo = substr($elem, 1); |
|
124 | - if (!array_key_exists($p_algo, $this->supportedHashFunctions)) { |
|
125 | - throw new Exception('Unsupported OCRA suite PIN hash function: ' . var_export($elem, TRUE)); |
|
126 | - } |
|
127 | - $this->P = TRUE; |
|
128 | - $this->PType = $p_algo; |
|
129 | - $this->PLength = $this->supportedHashFunctions[$p_algo]; |
|
130 | - } |
|
131 | - } elseif ($letter === 'S') { |
|
132 | - if (strlen($elem) == 1) { |
|
133 | - $this->S = TRUE; |
|
134 | - } elseif (preg_match('/^S(\d+)$/', $elem, $match)) { |
|
135 | - $s_len = intval($match[1]); |
|
136 | - if ($s_len <= 0 || $s_len > 512) { |
|
137 | - throw new Exception('Invalid OCRA suite data input session information length: ' . var_export($s_len, TRUE)); |
|
138 | - } |
|
139 | - |
|
140 | - $this->S = TRUE; |
|
141 | - $this->SLength = $s_len; |
|
142 | - } else { |
|
143 | - throw new Exception('Invalid OCRA suite data input session information length: ' . var_export($elem, TRUE)); |
|
144 | - } |
|
145 | - } elseif ($letter === 'T') { |
|
146 | - if (strlen($elem) == 1) { |
|
147 | - $this->T = TRUE; |
|
148 | - } elseif (preg_match('/^T(\d+[HMS])+$/', $elem)) { |
|
149 | - preg_match_all('/(\d+)([HMS])/', $elem, $match); |
|
150 | - |
|
151 | - if (count($match[1]) !== count(array_unique($match[2]))) { |
|
152 | - throw new Exception('Duplicate definitions in OCRA suite data input timestamp: ' . var_export($elem, TRUE)); |
|
153 | - } |
|
154 | - |
|
155 | - $length = 0; |
|
156 | - for ($i = 0; $i < count($match[1]); $i++) { |
|
157 | - $length += intval($match[1][$i]) * $this->TPeriods[$match[2][$i]]; |
|
158 | - } |
|
159 | - if ($length <= 0) { |
|
160 | - throw new Exception('Invalid OCRA suite data input timestamp: ' . var_export($elem, TRUE)); |
|
161 | - } |
|
162 | - |
|
163 | - $this->T = TRUE; |
|
164 | - $this->TLength = $length; |
|
165 | - } else { |
|
166 | - throw new Exception('Invalid OCRA suite data input timestamp: ' . var_export($elem, TRUE)); |
|
167 | - } |
|
168 | - } else { |
|
169 | - throw new Exception('Unsupported OCRA suite data input field: ' . var_export($elem, TRUE)); |
|
170 | - } |
|
171 | - } |
|
172 | - |
|
173 | - if (!$this->Q) { |
|
174 | - throw new Exception('OCRA suite data input question not defined: ' . var_export($s[2], TRUE)); |
|
175 | - } |
|
176 | - } |
|
177 | - |
|
178 | - public function generateChallenge() { |
|
179 | - $q_length = $this->QLength; |
|
180 | - $q_type = $this->QType; |
|
181 | - |
|
182 | - $bytes = self::generateRandomBytes($q_length); |
|
183 | - |
|
184 | - switch($q_type) { |
|
185 | - case 'A': |
|
186 | - $challenge = base64_encode($bytes); |
|
187 | - $tr = implode("", unpack('H*', $bytes)); |
|
188 | - $challenge = rtrim(strtr($challenge, '+/', $tr), '='); |
|
189 | - break; |
|
190 | - case 'H': |
|
191 | - $challenge = implode("", unpack('H*', $bytes)); |
|
192 | - break; |
|
193 | - case 'N': |
|
194 | - $challenge = implode("", unpack('N*', $bytes)); |
|
195 | - break; |
|
196 | - default: |
|
197 | - throw new Exception('Unsupported OCRASuite challenge type: ' . var_export($q_type, TRUE)); |
|
198 | - break; |
|
199 | - } |
|
200 | - |
|
201 | - $challenge = substr($challenge, 0, $q_length); |
|
202 | - |
|
203 | - return $challenge; |
|
204 | - } |
|
205 | - |
|
206 | - |
|
207 | - public function generateSessionInformation() { |
|
208 | - if (!$this->S) { |
|
209 | - throw new Exception('Session information not defined in OCRASuite: ' . var_export($this->OCRASuite, TRUE)); |
|
210 | - } |
|
211 | - |
|
212 | - $s_length = $this->SLength; |
|
213 | - $bytes = self::generateRandomBytes($s_length); |
|
214 | - |
|
215 | - // The OCRA spec doesn't specify that the session data should be hexadecimal. |
|
216 | - // However the reference implementation in the RFC does treat it as hex. |
|
217 | - $session = bin2hex($bytes); |
|
5 | + private $key = NULL; |
|
6 | + |
|
7 | + private $OCRASuite = NULL; |
|
8 | + |
|
9 | + private $OCRAVersion = NULL; |
|
10 | + |
|
11 | + private $CryptoFunctionType = NULL; |
|
12 | + private $CryptoFunctionHash = NULL; |
|
13 | + private $CryptoFunctionHashLength = NULL; |
|
14 | + private $CryptoFunctionTruncation = NULL; |
|
15 | + |
|
16 | + private $C = FALSE; |
|
17 | + private $Q = FALSE; |
|
18 | + private $QType = 'N'; |
|
19 | + private $QLength = 8; |
|
20 | + |
|
21 | + private $P = FALSE; |
|
22 | + private $PType = 'SHA1'; |
|
23 | + private $PLength = 20; |
|
24 | + |
|
25 | + private $S = FALSE; |
|
26 | + private $SLength = 64; |
|
27 | + |
|
28 | + private $T = FALSE; |
|
29 | + private $TLength = 60; // 1M |
|
30 | + private $TPeriods = array('H' => 3600, 'M' => 60, 'S' => 1); |
|
31 | + |
|
32 | + private $supportedHashFunctions = array('SHA1' => 20, 'SHA256' => 32, 'SHA512' => 64); |
|
33 | + |
|
34 | + |
|
35 | + public function __construct($ocraSuite) { |
|
36 | + $this->parseOCRASuite($ocraSuite); |
|
37 | + } |
|
38 | + |
|
39 | + /** |
|
40 | + * Inspired by https://github.com/bdauvergne/python-oath |
|
41 | + */ |
|
42 | + private function parseOCRASuite($ocraSuite) { |
|
43 | + if (!is_string($ocraSuite)) { |
|
44 | + throw new Exception('OCRASuite not in string format: ' . var_export($ocraSuite, TRUE)); |
|
45 | + } |
|
46 | + |
|
47 | + $ocraSuite = strtoupper($ocraSuite); |
|
48 | + $this->OCRASuite = $ocraSuite; |
|
49 | + |
|
50 | + $s = explode(':', $ocraSuite); |
|
51 | + if (count($s) != 3) { |
|
52 | + throw new Exception('Invalid OCRASuite format: ' . var_export($ocraSuite, TRUE)); |
|
53 | + } |
|
54 | + |
|
55 | + $algo = explode('-', $s[0]); |
|
56 | + if (count($algo) != 2) { |
|
57 | + throw new Exception('Invalid OCRA version: ' . var_export($s[0], TRUE)); |
|
58 | + } |
|
59 | + |
|
60 | + if ($algo[0] !== 'OCRA') { |
|
61 | + throw new Exception('Unsupported OCRA algorithm: ' . var_export($algo[0], TRUE)); |
|
62 | + } |
|
63 | + |
|
64 | + if ($algo[1] !== '1') { |
|
65 | + throw new Exception('Unsupported OCRA version: ' . var_export($algo[1], TRUE)); |
|
66 | + } |
|
67 | + $this->OCRAVersion = $algo[1]; |
|
68 | + |
|
69 | + $cf = explode('-', $s[1]); |
|
70 | + if (count($cf) != 3) { |
|
71 | + throw new Exception('Invalid OCRA suite crypto function: ' . var_export($s[1], TRUE)); |
|
72 | + } |
|
73 | + |
|
74 | + if ($cf[0] !== 'HOTP') { |
|
75 | + throw new Exception('Unsupported OCRA suite crypto function: ' . var_export($cf[0], TRUE)); |
|
76 | + } |
|
77 | + $this->CryptoFunctionType = $cf[0]; |
|
78 | + |
|
79 | + if (!array_key_exists($cf[1], $this->supportedHashFunctions)) { |
|
80 | + throw new Exception('Unsupported hash function in OCRA suite crypto function: ' . var_export($cf[1], TRUE)); |
|
81 | + } |
|
82 | + $this->CryptoFunctionHash = $cf[1]; |
|
83 | + $this->CryptoFunctionHashLength = $this->supportedHashFunctions[$cf[1]]; |
|
84 | + |
|
85 | + if (!preg_match('/^\d+$/', $cf[2]) || (($cf[2] < 4 || $cf[2] > 10) && $cf[2] != 0)) { |
|
86 | + throw new Exception('Invalid OCRA suite crypto function truncation length: ' . var_export($cf[2], TRUE)); |
|
87 | + } |
|
88 | + $this->CryptoFunctionTruncation = intval($cf[2]); |
|
89 | + |
|
90 | + $di = explode('-', $s[2]); |
|
91 | + if (count($cf) == 0) { |
|
92 | + throw new Exception('Invalid OCRA suite data input: ' . var_export($s[2], TRUE)); |
|
93 | + } |
|
94 | + |
|
95 | + $data_input = array(); |
|
96 | + foreach($di as $elem) { |
|
97 | + $letter = $elem[0]; |
|
98 | + if (array_key_exists($letter, $data_input)) { |
|
99 | + throw new Exception('Duplicate field in OCRA suite data input: ' . var_export($elem, TRUE)); |
|
100 | + } |
|
101 | + $data_input[$letter] = 1; |
|
102 | + |
|
103 | + if ($letter === 'C' && strlen($elem) == 1) { |
|
104 | + $this->C = TRUE; |
|
105 | + } elseif ($letter === 'Q') { |
|
106 | + if (strlen($elem) == 1) { |
|
107 | + $this->Q = TRUE; |
|
108 | + } elseif (preg_match('/^Q([AHN])(\d+)$/', $elem, $match)) { |
|
109 | + $q_len = intval($match[2]); |
|
110 | + if ($q_len < 4 || $q_len > 64) { |
|
111 | + throw new Exception('Invalid OCRA suite data input question length: ' . var_export($q_len, TRUE)); |
|
112 | + } |
|
113 | + $this->Q = TRUE; |
|
114 | + $this->QType = $match[1]; |
|
115 | + $this->QLength = $q_len; |
|
116 | + } else { |
|
117 | + throw new Exception('Invalid OCRA suite data input question: ' . var_export($elem, TRUE)); |
|
118 | + } |
|
119 | + } elseif ($letter === 'P') { |
|
120 | + if (strlen($elem) == 1) { |
|
121 | + $this->P = TRUE; |
|
122 | + } else { |
|
123 | + $p_algo = substr($elem, 1); |
|
124 | + if (!array_key_exists($p_algo, $this->supportedHashFunctions)) { |
|
125 | + throw new Exception('Unsupported OCRA suite PIN hash function: ' . var_export($elem, TRUE)); |
|
126 | + } |
|
127 | + $this->P = TRUE; |
|
128 | + $this->PType = $p_algo; |
|
129 | + $this->PLength = $this->supportedHashFunctions[$p_algo]; |
|
130 | + } |
|
131 | + } elseif ($letter === 'S') { |
|
132 | + if (strlen($elem) == 1) { |
|
133 | + $this->S = TRUE; |
|
134 | + } elseif (preg_match('/^S(\d+)$/', $elem, $match)) { |
|
135 | + $s_len = intval($match[1]); |
|
136 | + if ($s_len <= 0 || $s_len > 512) { |
|
137 | + throw new Exception('Invalid OCRA suite data input session information length: ' . var_export($s_len, TRUE)); |
|
138 | + } |
|
139 | + |
|
140 | + $this->S = TRUE; |
|
141 | + $this->SLength = $s_len; |
|
142 | + } else { |
|
143 | + throw new Exception('Invalid OCRA suite data input session information length: ' . var_export($elem, TRUE)); |
|
144 | + } |
|
145 | + } elseif ($letter === 'T') { |
|
146 | + if (strlen($elem) == 1) { |
|
147 | + $this->T = TRUE; |
|
148 | + } elseif (preg_match('/^T(\d+[HMS])+$/', $elem)) { |
|
149 | + preg_match_all('/(\d+)([HMS])/', $elem, $match); |
|
150 | + |
|
151 | + if (count($match[1]) !== count(array_unique($match[2]))) { |
|
152 | + throw new Exception('Duplicate definitions in OCRA suite data input timestamp: ' . var_export($elem, TRUE)); |
|
153 | + } |
|
154 | + |
|
155 | + $length = 0; |
|
156 | + for ($i = 0; $i < count($match[1]); $i++) { |
|
157 | + $length += intval($match[1][$i]) * $this->TPeriods[$match[2][$i]]; |
|
158 | + } |
|
159 | + if ($length <= 0) { |
|
160 | + throw new Exception('Invalid OCRA suite data input timestamp: ' . var_export($elem, TRUE)); |
|
161 | + } |
|
162 | + |
|
163 | + $this->T = TRUE; |
|
164 | + $this->TLength = $length; |
|
165 | + } else { |
|
166 | + throw new Exception('Invalid OCRA suite data input timestamp: ' . var_export($elem, TRUE)); |
|
167 | + } |
|
168 | + } else { |
|
169 | + throw new Exception('Unsupported OCRA suite data input field: ' . var_export($elem, TRUE)); |
|
170 | + } |
|
171 | + } |
|
172 | + |
|
173 | + if (!$this->Q) { |
|
174 | + throw new Exception('OCRA suite data input question not defined: ' . var_export($s[2], TRUE)); |
|
175 | + } |
|
176 | + } |
|
177 | + |
|
178 | + public function generateChallenge() { |
|
179 | + $q_length = $this->QLength; |
|
180 | + $q_type = $this->QType; |
|
181 | + |
|
182 | + $bytes = self::generateRandomBytes($q_length); |
|
183 | + |
|
184 | + switch($q_type) { |
|
185 | + case 'A': |
|
186 | + $challenge = base64_encode($bytes); |
|
187 | + $tr = implode("", unpack('H*', $bytes)); |
|
188 | + $challenge = rtrim(strtr($challenge, '+/', $tr), '='); |
|
189 | + break; |
|
190 | + case 'H': |
|
191 | + $challenge = implode("", unpack('H*', $bytes)); |
|
192 | + break; |
|
193 | + case 'N': |
|
194 | + $challenge = implode("", unpack('N*', $bytes)); |
|
195 | + break; |
|
196 | + default: |
|
197 | + throw new Exception('Unsupported OCRASuite challenge type: ' . var_export($q_type, TRUE)); |
|
198 | + break; |
|
199 | + } |
|
200 | + |
|
201 | + $challenge = substr($challenge, 0, $q_length); |
|
202 | + |
|
203 | + return $challenge; |
|
204 | + } |
|
205 | + |
|
206 | + |
|
207 | + public function generateSessionInformation() { |
|
208 | + if (!$this->S) { |
|
209 | + throw new Exception('Session information not defined in OCRASuite: ' . var_export($this->OCRASuite, TRUE)); |
|
210 | + } |
|
211 | + |
|
212 | + $s_length = $this->SLength; |
|
213 | + $bytes = self::generateRandomBytes($s_length); |
|
214 | + |
|
215 | + // The OCRA spec doesn't specify that the session data should be hexadecimal. |
|
216 | + // However the reference implementation in the RFC does treat it as hex. |
|
217 | + $session = bin2hex($bytes); |
|
218 | 218 | |
219 | - $session = substr($session, 0, $s_length); |
|
219 | + $session = substr($session, 0, $s_length); |
|
220 | 220 | |
221 | - return $session; |
|
222 | - } |
|
223 | - |
|
224 | - /** |
|
225 | - * Borrowed from SimpleSAMLPHP http://simplesamlphp.org/ |
|
226 | - */ |
|
227 | - public static function generateRandomBytesMTrand($length) { |
|
228 | - |
|
229 | - /* Use mt_rand to generate $length random bytes. */ |
|
230 | - $data = ''; |
|
231 | - for($i = 0; $i < $length; $i++) { |
|
232 | - $data .= chr(mt_rand(0, 255)); |
|
233 | - } |
|
234 | - |
|
235 | - return $data; |
|
236 | - } |
|
237 | - |
|
238 | - |
|
239 | - /** |
|
240 | - * Borrowed from SimpleSAMLPHP http://simplesamlphp.org/ |
|
241 | - */ |
|
242 | - public static function generateRandomBytes($length, $fallback = TRUE) { |
|
243 | - static $fp = NULL; |
|
244 | - |
|
245 | - if (function_exists('openssl_random_pseudo_bytes')) { |
|
246 | - return openssl_random_pseudo_bytes($length); |
|
247 | - } |
|
248 | - |
|
249 | - if($fp === NULL) { |
|
250 | - if (@file_exists('/dev/urandom')) { |
|
251 | - $fp = @fopen('/dev/urandom', 'rb'); |
|
252 | - } else { |
|
253 | - $fp = FALSE; |
|
254 | - } |
|
255 | - } |
|
256 | - |
|
257 | - if($fp !== FALSE) { |
|
258 | - /* Read random bytes from /dev/urandom. */ |
|
259 | - $data = fread($fp, $length); |
|
260 | - if($data === FALSE) { |
|
261 | - throw new Exception('Error reading random data.'); |
|
262 | - } |
|
263 | - if(strlen($data) != $length) { |
|
264 | - if ($fallback) { |
|
265 | - $data = self::generateRandomBytesMTrand($length); |
|
266 | - } else { |
|
267 | - throw new Exception('Did not get requested number of bytes from random source. Requested (' . $length . ') got (' . strlen($data) . ')'); |
|
268 | - } |
|
269 | - } |
|
270 | - } else { |
|
271 | - /* Use mt_rand to generate $length random bytes. */ |
|
272 | - $data = self::generateRandomBytesMTrand($length); |
|
273 | - } |
|
274 | - |
|
275 | - return $data; |
|
276 | - } |
|
277 | - |
|
278 | - |
|
279 | - /** |
|
280 | - * Constant time string comparison, see http://codahale.com/a-lesson-in-timing-attacks/ |
|
281 | - */ |
|
282 | - public static function constEqual($s1, $s2) { |
|
283 | - if (strlen($s1) != strlen($s2)) { |
|
284 | - return FALSE; |
|
285 | - } |
|
286 | - |
|
287 | - $result = TRUE; |
|
288 | - $length = strlen($s1); |
|
289 | - for ($i = 0; $i < $length; $i++) { |
|
290 | - $result &= ($s1[$i] == $s2[$i]); |
|
291 | - } |
|
292 | - |
|
293 | - return (boolean)$result; |
|
294 | - } |
|
221 | + return $session; |
|
222 | + } |
|
223 | + |
|
224 | + /** |
|
225 | + * Borrowed from SimpleSAMLPHP http://simplesamlphp.org/ |
|
226 | + */ |
|
227 | + public static function generateRandomBytesMTrand($length) { |
|
228 | + |
|
229 | + /* Use mt_rand to generate $length random bytes. */ |
|
230 | + $data = ''; |
|
231 | + for($i = 0; $i < $length; $i++) { |
|
232 | + $data .= chr(mt_rand(0, 255)); |
|
233 | + } |
|
234 | + |
|
235 | + return $data; |
|
236 | + } |
|
237 | + |
|
238 | + |
|
239 | + /** |
|
240 | + * Borrowed from SimpleSAMLPHP http://simplesamlphp.org/ |
|
241 | + */ |
|
242 | + public static function generateRandomBytes($length, $fallback = TRUE) { |
|
243 | + static $fp = NULL; |
|
244 | + |
|
245 | + if (function_exists('openssl_random_pseudo_bytes')) { |
|
246 | + return openssl_random_pseudo_bytes($length); |
|
247 | + } |
|
248 | + |
|
249 | + if($fp === NULL) { |
|
250 | + if (@file_exists('/dev/urandom')) { |
|
251 | + $fp = @fopen('/dev/urandom', 'rb'); |
|
252 | + } else { |
|
253 | + $fp = FALSE; |
|
254 | + } |
|
255 | + } |
|
256 | + |
|
257 | + if($fp !== FALSE) { |
|
258 | + /* Read random bytes from /dev/urandom. */ |
|
259 | + $data = fread($fp, $length); |
|
260 | + if($data === FALSE) { |
|
261 | + throw new Exception('Error reading random data.'); |
|
262 | + } |
|
263 | + if(strlen($data) != $length) { |
|
264 | + if ($fallback) { |
|
265 | + $data = self::generateRandomBytesMTrand($length); |
|
266 | + } else { |
|
267 | + throw new Exception('Did not get requested number of bytes from random source. Requested (' . $length . ') got (' . strlen($data) . ')'); |
|
268 | + } |
|
269 | + } |
|
270 | + } else { |
|
271 | + /* Use mt_rand to generate $length random bytes. */ |
|
272 | + $data = self::generateRandomBytesMTrand($length); |
|
273 | + } |
|
274 | + |
|
275 | + return $data; |
|
276 | + } |
|
277 | + |
|
278 | + |
|
279 | + /** |
|
280 | + * Constant time string comparison, see http://codahale.com/a-lesson-in-timing-attacks/ |
|
281 | + */ |
|
282 | + public static function constEqual($s1, $s2) { |
|
283 | + if (strlen($s1) != strlen($s2)) { |
|
284 | + return FALSE; |
|
285 | + } |
|
286 | + |
|
287 | + $result = TRUE; |
|
288 | + $length = strlen($s1); |
|
289 | + for ($i = 0; $i < $length; $i++) { |
|
290 | + $result &= ($s1[$i] == $s2[$i]); |
|
291 | + } |
|
292 | + |
|
293 | + return (boolean)$result; |
|
294 | + } |
|
295 | 295 | |
296 | 296 | } |
@@ -46,8 +46,8 @@ discard block |
||
46 | 46 | $keyBytes, |
47 | 47 | $text) |
48 | 48 | { |
49 | - $hash = hash_hmac ($crypto, $text, $keyBytes); |
|
50 | - return $hash; |
|
49 | + $hash = hash_hmac ($crypto, $text, $keyBytes); |
|
50 | + return $hash; |
|
51 | 51 | } |
52 | 52 | |
53 | 53 | /** |
@@ -83,12 +83,12 @@ discard block |
||
83 | 83 | * {@link truncationDigits} digits |
84 | 84 | */ |
85 | 85 | static function generateOCRA($ocraSuite, |
86 | - $key, |
|
87 | - $counter, |
|
88 | - $question, |
|
89 | - $password, |
|
90 | - $sessionInformation, |
|
91 | - $timeStamp) |
|
86 | + $key, |
|
87 | + $counter, |
|
88 | + $question, |
|
89 | + $password, |
|
90 | + $sessionInformation, |
|
91 | + $timeStamp) |
|
92 | 92 | { |
93 | 93 | $codeDigits = 0; |
94 | 94 | $crypto = ""; |
@@ -57,7 +57,7 @@ |
||
57 | 57 | } |
58 | 58 | |
59 | 59 | /** |
60 | - * Decrypts the given data. |
|
60 | + * Decrypts the given data. |
|
61 | 61 | * |
62 | 62 | * @param String $data Data to decrypt. |
63 | 63 | * |
@@ -97,9 +97,9 @@ |
||
97 | 97 | |
98 | 98 | // Wait and retry once in case of a 502 Bad Gateway error |
99 | 99 | if ($statusCode === 502 && !($retry)) { |
100 | - sleep(2); |
|
101 | - $this->_sendFirebase($deviceToken, $alert, $challenge, $apiKey, true); |
|
102 | - return; |
|
100 | + sleep(2); |
|
101 | + $this->_sendFirebase($deviceToken, $alert, $challenge, $apiKey, true); |
|
102 | + return; |
|
103 | 103 | } |
104 | 104 | |
105 | 105 | if ($statusCode !== 200) { |
@@ -538,17 +538,17 @@ discard block |
||
538 | 538 | } |
539 | 539 | |
540 | 540 | $metadata = array("service"=> |
541 | - array("displayName" => $this->_name, |
|
542 | - "identifier" => $this->_identifier, |
|
543 | - "logoUrl" => $this->_logoUrl, |
|
544 | - "infoUrl" => $this->_infoUrl, |
|
545 | - "authenticationUrl" => $authenticationUrl, |
|
546 | - "ocraSuite" => $this->_ocraSuite, |
|
547 | - "enrollmentUrl" => $enrollmentUrl |
|
548 | - ), |
|
549 | - "identity"=> |
|
550 | - array("identifier" =>$data["userId"], |
|
551 | - "displayName"=>$data["displayName"])); |
|
541 | + array("displayName" => $this->_name, |
|
542 | + "identifier" => $this->_identifier, |
|
543 | + "logoUrl" => $this->_logoUrl, |
|
544 | + "infoUrl" => $this->_infoUrl, |
|
545 | + "authenticationUrl" => $authenticationUrl, |
|
546 | + "ocraSuite" => $this->_ocraSuite, |
|
547 | + "enrollmentUrl" => $enrollmentUrl |
|
548 | + ), |
|
549 | + "identity"=> |
|
550 | + array("identifier" =>$data["userId"], |
|
551 | + "displayName"=>$data["displayName"])); |
|
552 | 552 | |
553 | 553 | $this->_stateStorage->unsetValue(self::PREFIX_ENROLLMENT . $enrollmentKey); |
554 | 554 | |
@@ -571,18 +571,18 @@ discard block |
||
571 | 571 | */ |
572 | 572 | public function getEnrollmentSecret($enrollmentKey) |
573 | 573 | { |
574 | - $data = $this->_stateStorage->getValue(self::PREFIX_ENROLLMENT . $enrollmentKey); |
|
575 | - $secret = $this->_uniqueSessionKey(self::PREFIX_ENROLLMENT_SECRET); |
|
576 | - $enrollmentData = [ |
|
577 | - "userId" => $data["userId"], |
|
578 | - "sessionId" => $data["sessionId"] |
|
579 | - ]; |
|
580 | - $this->_stateStorage->setValue( |
|
581 | - self::PREFIX_ENROLLMENT_SECRET . $secret, |
|
582 | - $enrollmentData, |
|
583 | - self::ENROLLMENT_EXPIRE |
|
584 | - ); |
|
585 | - return $secret; |
|
574 | + $data = $this->_stateStorage->getValue(self::PREFIX_ENROLLMENT . $enrollmentKey); |
|
575 | + $secret = $this->_uniqueSessionKey(self::PREFIX_ENROLLMENT_SECRET); |
|
576 | + $enrollmentData = [ |
|
577 | + "userId" => $data["userId"], |
|
578 | + "sessionId" => $data["sessionId"] |
|
579 | + ]; |
|
580 | + $this->_stateStorage->setValue( |
|
581 | + self::PREFIX_ENROLLMENT_SECRET . $secret, |
|
582 | + $enrollmentData, |
|
583 | + self::ENROLLMENT_EXPIRE |
|
584 | + ); |
|
585 | + return $secret; |
|
586 | 586 | } |
587 | 587 | |
588 | 588 | /** |
@@ -597,13 +597,13 @@ discard block |
||
597 | 597 | */ |
598 | 598 | public function validateEnrollmentSecret($enrollmentSecret) |
599 | 599 | { |
600 | - $data = $this->_stateStorage->getValue(self::PREFIX_ENROLLMENT_SECRET.$enrollmentSecret); |
|
601 | - if (is_array($data)) { |
|
602 | - // Secret is valid, application may accept the user secret. |
|
603 | - $this->_setEnrollmentStatus($data["sessionId"], self::ENROLLMENT_STATUS_PROCESSED); |
|
604 | - return $data["userId"]; |
|
605 | - } |
|
606 | - return false; |
|
600 | + $data = $this->_stateStorage->getValue(self::PREFIX_ENROLLMENT_SECRET.$enrollmentSecret); |
|
601 | + if (is_array($data)) { |
|
602 | + // Secret is valid, application may accept the user secret. |
|
603 | + $this->_setEnrollmentStatus($data["sessionId"], self::ENROLLMENT_STATUS_PROCESSED); |
|
604 | + return $data["userId"]; |
|
605 | + } |
|
606 | + return false; |
|
607 | 607 | } |
608 | 608 | |
609 | 609 | /** |
@@ -620,13 +620,13 @@ discard block |
||
620 | 620 | */ |
621 | 621 | public function finalizeEnrollment($enrollmentSecret) |
622 | 622 | { |
623 | - $data = $this->_stateStorage->getValue(self::PREFIX_ENROLLMENT_SECRET.$enrollmentSecret); |
|
624 | - if (is_array($data)) { |
|
625 | - // Enrollment is finalized, destroy our session data. |
|
626 | - $this->_setEnrollmentStatus($data["sessionId"], self::ENROLLMENT_STATUS_FINALIZED); |
|
627 | - $this->_stateStorage->unsetValue(self::PREFIX_ENROLLMENT_SECRET.$enrollmentSecret); |
|
628 | - } |
|
629 | - return true; |
|
623 | + $data = $this->_stateStorage->getValue(self::PREFIX_ENROLLMENT_SECRET.$enrollmentSecret); |
|
624 | + if (is_array($data)) { |
|
625 | + // Enrollment is finalized, destroy our session data. |
|
626 | + $this->_setEnrollmentStatus($data["sessionId"], self::ENROLLMENT_STATUS_FINALIZED); |
|
627 | + $this->_stateStorage->unsetValue(self::PREFIX_ENROLLMENT_SECRET.$enrollmentSecret); |
|
628 | + } |
|
629 | + return true; |
|
630 | 630 | } |
631 | 631 | |
632 | 632 | /** |
@@ -662,7 +662,7 @@ discard block |
||
662 | 662 | |
663 | 663 | $challengeUserId = NULL; |
664 | 664 | if (isset($state["userId"])) { |
665 | - $challengeUserId = $state["userId"]; |
|
665 | + $challengeUserId = $state["userId"]; |
|
666 | 666 | } |
667 | 667 | // Check if we're dealing with a second factor |
668 | 668 | if ($challengeUserId!=NULL && ($userId != $challengeUserId)) { |
@@ -801,6 +801,6 @@ discard block |
||
801 | 801 | */ |
802 | 802 | protected function _setEnrollmentStatus($sessionId, $status) |
803 | 803 | { |
804 | - $this->_stateStorage->setValue("enrollstatus".$sessionId, $status, self::ENROLLMENT_EXPIRE); |
|
804 | + $this->_stateStorage->setValue("enrollstatus".$sessionId, $status, self::ENROLLMENT_EXPIRE); |
|
805 | 805 | } |
806 | 806 | } |
@@ -1,100 +1,100 @@ |
||
1 | 1 | <?php |
2 | 2 | class Tiqr_AutoLoader { |
3 | 3 | |
4 | - protected static $instance; |
|
5 | - |
|
6 | - protected $tiqrPath; |
|
7 | - protected $qrcodePath; |
|
8 | - protected $zendPath; |
|
9 | - |
|
10 | - protected function __construct($options) { |
|
11 | - if ($options !== NULL) { |
|
12 | - $this->setOptions($options); |
|
13 | - } |
|
14 | - spl_autoload_register(array(__CLASS__, 'autoload')); |
|
15 | - } |
|
16 | - |
|
17 | - public static function getInstance($options = NULL) { |
|
18 | - if (null === self::$instance) { |
|
19 | - self::$instance = new self($options); |
|
20 | - } |
|
21 | - |
|
22 | - return self::$instance; |
|
23 | - } |
|
24 | - |
|
25 | - public static function autoload($className) { |
|
26 | - if($className === NULL) { |
|
27 | - return; |
|
28 | - } |
|
29 | - |
|
30 | - $self = self::getInstance(); |
|
31 | - |
|
32 | - $substr5 = substr($className, 0, 5); |
|
33 | - |
|
34 | - if ($substr5 === 'Tiqr_' || $substr5 === 'OATH_') { |
|
35 | - $file = $self->tiqrPath . DIRECTORY_SEPARATOR . str_replace('_', DIRECTORY_SEPARATOR, $className) . '.php'; |
|
36 | - } elseif ($className === 'QRcode') { |
|
37 | - $file = $self->qrcodePath . DIRECTORY_SEPARATOR . 'qrlib.php'; |
|
38 | - } elseif ($substr5 === 'Zend_') { |
|
39 | - $file = $self->zendPath . DIRECTORY_SEPARATOR . str_replace('_', DIRECTORY_SEPARATOR, $className) . '.php'; |
|
40 | - } else { |
|
41 | - return; |
|
42 | - } |
|
43 | - |
|
44 | - if (file_exists($file)) { |
|
45 | - require_once($file); |
|
46 | - } |
|
47 | - } |
|
48 | - |
|
49 | - public function setOptions($options) { |
|
50 | - if (isset($options["tiqr.path"])) { |
|
51 | - $tiqr_dir = $options["tiqr.path"]; |
|
52 | - $tiqr_path = realpath($tiqr_dir); |
|
53 | - } else { |
|
54 | - $tiqr_dir = dirname(__FILE__); |
|
55 | - $tiqr_path = $tiqr_dir; |
|
56 | - } |
|
57 | - if (is_dir($tiqr_path)) { |
|
58 | - $this->tiqrPath = $tiqr_path; |
|
59 | - } else { |
|
60 | - throw new Exception('Directory not found: ' . var_export($tiqr_dir, TRUE)); |
|
61 | - } |
|
62 | - |
|
63 | - if (isset($options["phpqrcode.path"])) { |
|
64 | - $qrcode_dir = $options["phpqrcode.path"]; |
|
65 | - $qrcode_path = realpath($qrcode_dir); |
|
66 | - } else { |
|
67 | - $qrcode_dir = dirname(dirname(dirname(__FILE__))) . '/phpqrcode'; |
|
68 | - $qrcode_path = $qrcode_dir; |
|
69 | - } |
|
70 | - |
|
71 | - if (is_dir($qrcode_path)) { |
|
72 | - $this->qrcodePath = $qrcode_path; |
|
73 | - } else { |
|
74 | - throw new Exception('Directory not found: ' . var_export($qrcode_dir, TRUE)); |
|
75 | - } |
|
76 | - |
|
77 | - if (isset($options["zend.path"])) { |
|
78 | - $zend_dir = $options["zend.path"]; |
|
79 | - $zend_path = realpath($zend_dir); |
|
80 | - } else { |
|
81 | - $zend_dir = dirname(dirname(dirname(__FILE__))) . "/zend"; |
|
82 | - $zend_path = $zend_dir; |
|
83 | - } |
|
84 | - if (is_dir($zend_path)) { |
|
85 | - $this->zendPath = $zend_path; |
|
86 | - } else { |
|
87 | - throw new Exception('Directory not found: ' . var_export($zend_dir, TRUE)); |
|
88 | - } |
|
89 | - } |
|
90 | - |
|
91 | - |
|
92 | - public function setIncludePath() { |
|
93 | - set_include_path(implode(PATH_SEPARATOR, array( |
|
94 | - $this->tiqrPath, |
|
95 | - $this->zendPath, |
|
96 | - $this->qrcodePath, |
|
97 | - get_include_path(), |
|
98 | - ))); |
|
99 | - } |
|
4 | + protected static $instance; |
|
5 | + |
|
6 | + protected $tiqrPath; |
|
7 | + protected $qrcodePath; |
|
8 | + protected $zendPath; |
|
9 | + |
|
10 | + protected function __construct($options) { |
|
11 | + if ($options !== NULL) { |
|
12 | + $this->setOptions($options); |
|
13 | + } |
|
14 | + spl_autoload_register(array(__CLASS__, 'autoload')); |
|
15 | + } |
|
16 | + |
|
17 | + public static function getInstance($options = NULL) { |
|
18 | + if (null === self::$instance) { |
|
19 | + self::$instance = new self($options); |
|
20 | + } |
|
21 | + |
|
22 | + return self::$instance; |
|
23 | + } |
|
24 | + |
|
25 | + public static function autoload($className) { |
|
26 | + if($className === NULL) { |
|
27 | + return; |
|
28 | + } |
|
29 | + |
|
30 | + $self = self::getInstance(); |
|
31 | + |
|
32 | + $substr5 = substr($className, 0, 5); |
|
33 | + |
|
34 | + if ($substr5 === 'Tiqr_' || $substr5 === 'OATH_') { |
|
35 | + $file = $self->tiqrPath . DIRECTORY_SEPARATOR . str_replace('_', DIRECTORY_SEPARATOR, $className) . '.php'; |
|
36 | + } elseif ($className === 'QRcode') { |
|
37 | + $file = $self->qrcodePath . DIRECTORY_SEPARATOR . 'qrlib.php'; |
|
38 | + } elseif ($substr5 === 'Zend_') { |
|
39 | + $file = $self->zendPath . DIRECTORY_SEPARATOR . str_replace('_', DIRECTORY_SEPARATOR, $className) . '.php'; |
|
40 | + } else { |
|
41 | + return; |
|
42 | + } |
|
43 | + |
|
44 | + if (file_exists($file)) { |
|
45 | + require_once($file); |
|
46 | + } |
|
47 | + } |
|
48 | + |
|
49 | + public function setOptions($options) { |
|
50 | + if (isset($options["tiqr.path"])) { |
|
51 | + $tiqr_dir = $options["tiqr.path"]; |
|
52 | + $tiqr_path = realpath($tiqr_dir); |
|
53 | + } else { |
|
54 | + $tiqr_dir = dirname(__FILE__); |
|
55 | + $tiqr_path = $tiqr_dir; |
|
56 | + } |
|
57 | + if (is_dir($tiqr_path)) { |
|
58 | + $this->tiqrPath = $tiqr_path; |
|
59 | + } else { |
|
60 | + throw new Exception('Directory not found: ' . var_export($tiqr_dir, TRUE)); |
|
61 | + } |
|
62 | + |
|
63 | + if (isset($options["phpqrcode.path"])) { |
|
64 | + $qrcode_dir = $options["phpqrcode.path"]; |
|
65 | + $qrcode_path = realpath($qrcode_dir); |
|
66 | + } else { |
|
67 | + $qrcode_dir = dirname(dirname(dirname(__FILE__))) . '/phpqrcode'; |
|
68 | + $qrcode_path = $qrcode_dir; |
|
69 | + } |
|
70 | + |
|
71 | + if (is_dir($qrcode_path)) { |
|
72 | + $this->qrcodePath = $qrcode_path; |
|
73 | + } else { |
|
74 | + throw new Exception('Directory not found: ' . var_export($qrcode_dir, TRUE)); |
|
75 | + } |
|
76 | + |
|
77 | + if (isset($options["zend.path"])) { |
|
78 | + $zend_dir = $options["zend.path"]; |
|
79 | + $zend_path = realpath($zend_dir); |
|
80 | + } else { |
|
81 | + $zend_dir = dirname(dirname(dirname(__FILE__))) . "/zend"; |
|
82 | + $zend_path = $zend_dir; |
|
83 | + } |
|
84 | + if (is_dir($zend_path)) { |
|
85 | + $this->zendPath = $zend_path; |
|
86 | + } else { |
|
87 | + throw new Exception('Directory not found: ' . var_export($zend_dir, TRUE)); |
|
88 | + } |
|
89 | + } |
|
90 | + |
|
91 | + |
|
92 | + public function setIncludePath() { |
|
93 | + set_include_path(implode(PATH_SEPARATOR, array( |
|
94 | + $this->tiqrPath, |
|
95 | + $this->zendPath, |
|
96 | + $this->qrcodePath, |
|
97 | + get_include_path(), |
|
98 | + ))); |
|
99 | + } |
|
100 | 100 | } |