Tiqr / tiqr-server-libphp

library/tiqr/Tiqr/OATH/OCRA.php

Spacing +75 added lines, -75 removed lines

@@ -58,18 +58,18 @@ 
     private static function _hexStr2Bytes(string $hex, int $maxBytes, string $parameterName) : string
     {
         $len = strlen($hex);
-        if ( ($len !== 0) && (! ctype_xdigit($hex)) ) {
+        if (($len !== 0) && (!ctype_xdigit($hex))) {
             throw new InvalidArgumentException("Parameter '$parameterName' contains non hex digits");
         }
-        if ( $len % 2 !== 0 ) {
+        if ($len % 2 !== 0) {
             throw new InvalidArgumentException("Parameter '$parameterName' contains odd number of hex digits");
         }
-        if ( $len > $maxBytes * 2) {
+        if ($len > $maxBytes * 2) {
             throw new InvalidArgumentException("Parameter '$parameterName' too long");
         }
         // hex2bin logs PHP warnings when $hex contains invalid characters or has uneven length. Because we
         // check for these conditions above hex2bin() should always be silent
-        $res=hex2bin($hex);
+        $res = hex2bin($hex);
         if (false === $res) {
             throw new InvalidArgumentException("Parameter '$parameterName' could not be decoded");
         }
@@ -125,83 +125,83 @@ 
         $cryptoFunction = $components[1];
         $dataInput = strtolower($components[2]); // lower here so we can do case insensitive comparisons
 
-        if(stripos($cryptoFunction, "hotp-sha1")!==false)
+        if (stripos($cryptoFunction, "hotp-sha1") !== false)
             $crypto = "sha1";
-        elseif(stripos($cryptoFunction, "hotp-sha256")!==false)
+        elseif (stripos($cryptoFunction, "hotp-sha256") !== false)
             $crypto = "sha256";
-        elseif(stripos($cryptoFunction, "hotp-sha512")!==false)
+        elseif (stripos($cryptoFunction, "hotp-sha512") !== false)
             $crypto = "sha512";
         else {
             throw new InvalidArgumentException('Unsupported OCRA CryptoFunction');
         }
 
         // The Cryptofucntion must ha a truncation of 0, 4-10
-        $codeDigits_str = substr($cryptoFunction, strrpos($cryptoFunction, "-")+1);
-        if (! ctype_digit($codeDigits_str)) {
+        $codeDigits_str = substr($cryptoFunction, strrpos($cryptoFunction, "-") + 1);
+        if (!ctype_digit($codeDigits_str)) {
             throw new InvalidArgumentException('Unsupported OCRA CryptoFunction');
         }
-        $codeDigits = (integer)$codeDigits_str;
+        $codeDigits = (integer) $codeDigits_str;
         if (($codeDigits != 0) && (($codeDigits < 4) || ($codeDigits > 10))) {
             throw new InvalidArgumentException('Unsupported OCRA CryptoFunction');
         }
                 
         // The size of the byte array message to be encrypted
         // Counter
-        if($dataInput[0] == "c" ) {
+        if ($dataInput[0] == "c") {
             // Fix the length of the HEX string
-            while(strlen($counter) < 16)
-                $counter = "0" . $counter;
-            $counterLength=8;
+            while (strlen($counter) < 16)
+                $counter = "0".$counter;
+            $counterLength = 8;
         }
         // Question
-        if($dataInput[0] == "q" ||
-                stripos($dataInput, "-q")!==false) {
-            while(strlen($question) < 256)
-                $question = $question . "0";
-            $questionLength=128;
+        if ($dataInput[0] == "q" ||
+                stripos($dataInput, "-q") !== false) {
+            while (strlen($question) < 256)
+                $question = $question."0";
+            $questionLength = 128;
         }
 
         // Password
-        if(stripos($dataInput, "psha1")!==false) {
-            while(strlen($password) < 40)
-                $password = "0" . $password;
-            $passwordLength=20;
+        if (stripos($dataInput, "psha1") !== false) {
+            while (strlen($password) < 40)
+                $password = "0".$password;
+            $passwordLength = 20;
         }
     
-        if(stripos($dataInput, "psha256")!==false) {
-            while(strlen($password) < 64)
-                $password = "0" . $password;
-            $passwordLength=32;
+        if (stripos($dataInput, "psha256") !== false) {
+            while (strlen($password) < 64)
+                $password = "0".$password;
+            $passwordLength = 32;
         }
         
-        if(stripos($dataInput, "psha512")!==false) {
-            while(strlen($password) < 128)
-                $password = "0" . $password;
-            $passwordLength=64;
+        if (stripos($dataInput, "psha512") !== false) {
+            while (strlen($password) < 128)
+                $password = "0".$password;
+            $passwordLength = 64;
         }
         
         // sessionInformation
-        if(stripos($dataInput, "s064") !==false) {
-            while(strlen($sessionInformation) < 128)
-                $sessionInformation = "0" . $sessionInformation;
+        if (stripos($dataInput, "s064") !== false) {
+            while (strlen($sessionInformation) < 128)
+                $sessionInformation = "0".$sessionInformation;
 
-            $sessionInformationLength=64;
-        } else if(stripos($dataInput, "s128") !==false) {
-            while(strlen($sessionInformation) < 256)
-                $sessionInformation = "0" . $sessionInformation;
+            $sessionInformationLength = 64;
+        } else if (stripos($dataInput, "s128") !== false) {
+            while (strlen($sessionInformation) < 256)
+                $sessionInformation = "0".$sessionInformation;
         
-            $sessionInformationLength=128;
-        } else if(stripos($dataInput, "s256") !==false) {
-            while(strlen($sessionInformation) < 512)
-                $sessionInformation = "0" . $sessionInformation;
+            $sessionInformationLength = 128;
+        } else if (stripos($dataInput, "s256") !== false) {
+            while (strlen($sessionInformation) < 512)
+                $sessionInformation = "0".$sessionInformation;
         
-            $sessionInformationLength=256;
-        } else if(stripos($dataInput, "s512") !==false) {
-            while(strlen($sessionInformation) < 128)
-                $sessionInformation = "0" . $sessionInformation;
+            $sessionInformationLength = 256;
+        } else if (stripos($dataInput, "s512") !== false) {
+            while (strlen($sessionInformation) < 128)
+                $sessionInformation = "0".$sessionInformation;
         
-            $sessionInformationLength=64;
-        } else if (stripos($dataInput, "-s") !== false ) {
+            $sessionInformationLength = 64;
+        } else if (stripos($dataInput, "-s") !== false) {
             // deviation from spec. Officially 's' without a length indicator is not in the reference implementation.
             // RFC is ambigious. However we have supported this in Tiqr since day 1, so we continue to support it.
 
@@ -210,27 +210,27 @@ 
             // to prevent matching the "s" in the password input e.g. "psha1".
             // [C] | QFxx | [PH | Snnn | TG] : Challenge-Response computation
             // [C] | QFxx | [PH | TG] : Plain Signature computation
-            while(strlen($sessionInformation) < 128)
-                $sessionInformation = "0" . $sessionInformation;
+            while (strlen($sessionInformation) < 128)
+                $sessionInformation = "0".$sessionInformation;
             
-            $sessionInformationLength=64;
+            $sessionInformationLength = 64;
         }
         
         
              
         // TimeStamp
-        if($dataInput[0] == "t" ||
+        if ($dataInput[0] == "t" ||
                 stripos($dataInput, "-t") !== false) {
-            while(strlen($timeStamp) < 16)
-                $timeStamp = "0" . $timeStamp;
-            $timeStampLength=8;
+            while (strlen($timeStamp) < 16)
+                $timeStamp = "0".$timeStamp;
+            $timeStampLength = 8;
         }
 
         // Put the bytes of "ocraSuite" parameters into the message
         
-        $msg = array_fill(0,$ocraSuiteLength+$counterLength+$questionLength+$passwordLength+$sessionInformationLength+$timeStampLength+1, 0);
+        $msg = array_fill(0, $ocraSuiteLength + $counterLength + $questionLength + $passwordLength + $sessionInformationLength + $timeStampLength + 1, 0);
                 
-        for($i=0;$i<strlen($ocraSuite);$i++) {
+        for ($i = 0; $i < strlen($ocraSuite); $i++) {
             $msg[$i] = $ocraSuite[$i];
         }
         
@@ -239,9 +239,9 @@ 
 
         // Put the bytes of "Counter" to the message
         // Input is HEX encoded
-        if($counterLength > 0 ) {
+        if ($counterLength > 0) {
             $bArray = self::_hexStr2Bytes($counter, $counterLength, 'counter');
-            for ($i=0;$i<strlen($bArray);$i++) {
+            for ($i = 0; $i < strlen($bArray); $i++) {
                 $msg [$i + $ocraSuiteLength + 1] = $bArray[$i];
             }
         }
@@ -249,41 +249,41 @@ 
 
         // Put the bytes of "question" to the message
         // Input is text encoded
-        if($questionLength > 0 ) {
+        if ($questionLength > 0) {
             $bArray = self::_hexStr2Bytes($question, $questionLength, 'question');
-            for ($i=0;$i<strlen($bArray);$i++) {
+            for ($i = 0; $i < strlen($bArray); $i++) {
                 $msg [$i + $ocraSuiteLength + 1 + $counterLength] = $bArray[$i];
             }
         }
 
         // Put the bytes of "password" to the message
         // Input is HEX encoded
-        if($passwordLength > 0){
+        if ($passwordLength > 0) {
             $bArray = self::_hexStr2Bytes($password, $passwordLength, 'password');
-            for ($i=0;$i<strlen($bArray);$i++) {
+            for ($i = 0; $i < strlen($bArray); $i++) {
                 $msg [$i + $ocraSuiteLength + 1 + $counterLength + $questionLength] = $bArray[$i];
             }
         }
 
         // Put the bytes of "sessionInformation" to the message
         // Input is HEX encoded
-        if($sessionInformationLength > 0 ){
+        if ($sessionInformationLength > 0) {
             $bArray = self::_hexStr2Bytes($sessionInformation, $sessionInformationLength, 'sessionInformation');
-            for ($i=0;$i<strlen($bArray);$i++) {
+            for ($i = 0; $i < strlen($bArray); $i++) {
                 $msg [$i + $ocraSuiteLength + 1 + $counterLength + $questionLength + $passwordLength] = $bArray[$i];
             }
         }
 
         // Put the bytes of "time" to the message
         // Input is HEX encoded value of minutes
-        if($timeStampLength > 0){
+        if ($timeStampLength > 0) {
             $bArray = self::_hexStr2Bytes($timeStamp, $timeStampLength, 'timeStamp');
-            for ($i=0;$i<strlen($bArray);$i++) {
+            for ($i = 0; $i < strlen($bArray); $i++) {
                 $msg [$i + $ocraSuiteLength + 1 + $counterLength + $questionLength + $passwordLength + $sessionInformationLength] = $bArray[$i];
             }
         }
         
-        $byteKey = self::_hexStr2Bytes($key, strlen($key)/2, 'key');
+        $byteKey = self::_hexStr2Bytes($key, strlen($key) / 2, 'key');
               
         $msg = implode("", $msg);
 
@@ -308,23 +308,23 @@ 
     static function _oath_truncate(string $hash, int $length = 6) : string
     {
         // Convert to dec
-        foreach(str_split($hash,2) as $hex)
+        foreach (str_split($hash, 2) as $hex)
         {
-            $hmac_result[]=hexdec($hex);
+            $hmac_result[] = hexdec($hex);
         }
     
         // Find offset
         $offset = $hmac_result[count($hmac_result) - 1] & 0xf;
     
         $v = strval(
-            (($hmac_result[$offset+0] & 0x7f) << 24 ) |
-            (($hmac_result[$offset+1] & 0xff) << 16 ) |
-            (($hmac_result[$offset+2] & 0xff) << 8 ) |
-            ($hmac_result[$offset+3] & 0xff)
+            (($hmac_result[$offset + 0] & 0x7f) << 24) |
+            (($hmac_result[$offset + 1] & 0xff) << 16) |
+            (($hmac_result[$offset + 2] & 0xff) << 8) |
+            ($hmac_result[$offset + 3] & 0xff)
         );
 
         // Prefix truncated string with 0's to ensure it always has the required length
-        $v=str_pad($v, $length, "0", STR_PAD_LEFT);
+        $v = str_pad($v, $length, "0", STR_PAD_LEFT);
 
         $v = substr($v, strlen($v) - $length);
         return $v;

Braces +45 added lines, -33 removed lines

@@ -125,13 +125,13 @@ 
         $cryptoFunction = $components[1];
         $dataInput = strtolower($components[2]); // lower here so we can do case insensitive comparisons
 
-        if(stripos($cryptoFunction, "hotp-sha1")!==false)
-            $crypto = "sha1";
-        elseif(stripos($cryptoFunction, "hotp-sha256")!==false)
-            $crypto = "sha256";
-        elseif(stripos($cryptoFunction, "hotp-sha512")!==false)
-            $crypto = "sha512";
-        else {
+        if(stripos($cryptoFunction, "hotp-sha1")!==false) {
+                    $crypto = "sha1";
+        } elseif(stripos($cryptoFunction, "hotp-sha256")!==false) {
+                    $crypto = "sha256";
+        } elseif(stripos($cryptoFunction, "hotp-sha512")!==false) {
+                    $crypto = "sha512";
+        } else {
             throw new InvalidArgumentException('Unsupported OCRA CryptoFunction');
         }
 
@@ -149,56 +149,65 @@ 
         // Counter
         if($dataInput[0] == "c" ) {
             // Fix the length of the HEX string
-            while(strlen($counter) < 16)
-                $counter = "0" . $counter;
+            while(strlen($counter) < 16) {
+                            $counter = "0" . $counter;
+            }
             $counterLength=8;
         }
         // Question
         if($dataInput[0] == "q" ||
                 stripos($dataInput, "-q")!==false) {
-            while(strlen($question) < 256)
-                $question = $question . "0";
+            while(strlen($question) < 256) {
+                            $question = $question . "0";
+            }
             $questionLength=128;
         }
 
         // Password
         if(stripos($dataInput, "psha1")!==false) {
-            while(strlen($password) < 40)
-                $password = "0" . $password;
+            while(strlen($password) < 40) {
+                            $password = "0" . $password;
+            }
             $passwordLength=20;
         }
     
         if(stripos($dataInput, "psha256")!==false) {
-            while(strlen($password) < 64)
-                $password = "0" . $password;
+            while(strlen($password) < 64) {
+                            $password = "0" . $password;
+            }
             $passwordLength=32;
         }
         
         if(stripos($dataInput, "psha512")!==false) {
-            while(strlen($password) < 128)
-                $password = "0" . $password;
+            while(strlen($password) < 128) {
+                            $password = "0" . $password;
+            }
             $passwordLength=64;
         }
         
         // sessionInformation
         if(stripos($dataInput, "s064") !==false) {
-            while(strlen($sessionInformation) < 128)
-                $sessionInformation = "0" . $sessionInformation;
+            while(strlen($sessionInformation) < 128) {
+                            $sessionInformation = "0" . $sessionInformation;
+            }
 
             $sessionInformationLength=64;
         } else if(stripos($dataInput, "s128") !==false) {
-            while(strlen($sessionInformation) < 256)
-                $sessionInformation = "0" . $sessionInformation;
+            while(strlen($sessionInformation) < 256) {
+                            $sessionInformation = "0" . $sessionInformation;
+            }
         
             $sessionInformationLength=128;
         } else if(stripos($dataInput, "s256") !==false) {
-            while(strlen($sessionInformation) < 512)
-                $sessionInformation = "0" . $sessionInformation;
+            while(strlen($sessionInformation) < 512) {
+                            $sessionInformation = "0" . $sessionInformation;
+            }
         
             $sessionInformationLength=256;
         } else if(stripos($dataInput, "s512") !==false) {
-            while(strlen($sessionInformation) < 128)
-                $sessionInformation = "0" . $sessionInformation;
+            while(strlen($sessionInformation) < 128) {
+                            $sessionInformation = "0" . $sessionInformation;
+            }
         
             $sessionInformationLength=64;
         } else if (stripos($dataInput, "-s") !== false ) {
@@ -210,8 +219,9 @@ 
             // to prevent matching the "s" in the password input e.g. "psha1".
             // [C] | QFxx | [PH | Snnn | TG] : Challenge-Response computation
             // [C] | QFxx | [PH | TG] : Plain Signature computation
-            while(strlen($sessionInformation) < 128)
-                $sessionInformation = "0" . $sessionInformation;
+            while(strlen($sessionInformation) < 128) {
+                            $sessionInformation = "0" . $sessionInformation;
+            }
             
             $sessionInformationLength=64;
         }
@@ -221,8 +231,9 @@ 
         // TimeStamp
         if($dataInput[0] == "t" ||
                 stripos($dataInput, "-t") !== false) {
-            while(strlen($timeStamp) < 16)
-                $timeStamp = "0" . $timeStamp;
+            while(strlen($timeStamp) < 16) {
+                            $timeStamp = "0" . $timeStamp;
+            }
             $timeStampLength=8;
         }
 
@@ -289,10 +300,11 @@ 
 
         $hash = self::_hmac($crypto, $byteKey, $msg);
 
-        if ($codeDigits == 0)
-            $result = $hash;
-        else
-            $result = self::_oath_truncate($hash, $codeDigits);
+        if ($codeDigits == 0) {
+                    $result = $hash;
+        } else {
+                    $result = self::_oath_truncate($hash, $codeDigits);
+        }
              
         return $result;
     }

library/tiqr/Tiqr/OATH/OCRAParser.php

Indentation +201 added lines, -201 removed lines

@@ -2,32 +2,32 @@ 
 
 class OATH_OCRAParser {
 
-	private $OCRASuite = NULL;
+    private $OCRASuite = NULL;
 
-	private $OCRAVersion = NULL;
+    private $OCRAVersion = NULL;
 
-	private $CryptoFunctionType = NULL;
-	private $CryptoFunctionHash = NULL;
-	private $CryptoFunctionHashLength = NULL;
-	private $CryptoFunctionTruncation = NULL;
+    private $CryptoFunctionType = NULL;
+    private $CryptoFunctionHash = NULL;
+    private $CryptoFunctionHashLength = NULL;
+    private $CryptoFunctionTruncation = NULL;
 
-	private $C = FALSE;
-	private $Q = FALSE;
-	private $QType = 'N';
-	private $QLength = 8;
+    private $C = FALSE;
+    private $Q = FALSE;
+    private $QType = 'N';
+    private $QLength = 8;
 
-	private $P = FALSE;
-	private $PType = 'SHA1';
-	private $PLength = 20;
+    private $P = FALSE;
+    private $PType = 'SHA1';
+    private $PLength = 20;
 
-	private $S = FALSE;
-	private $SLength = 64;
+    private $S = FALSE;
+    private $SLength = 64;
 
-	private $T = FALSE;
-	private $TLength = 60; // 1M
-	private $TPeriods = array('H' => 3600, 'M' => 60, 'S' => 1);
+    private $T = FALSE;
+    private $TLength = 60; // 1M
+    private $TPeriods = array('H' => 3600, 'M' => 60, 'S' => 1);
 
-	private $supportedHashFunctions = array('SHA1' => 20, 'SHA256' => 32, 'SHA512' => 64);
+    private $supportedHashFunctions = array('SHA1' => 20, 'SHA256' => 32, 'SHA512' => 64);
 
 
     /**
@@ -35,149 +35,149 @@ 
      * @throws Exception
      */
     public function __construct(String $ocraSuite) {
-		$this->parseOCRASuite($ocraSuite);
-	}
+        $this->parseOCRASuite($ocraSuite);
+    }
 
-	/**
-	 * Inspired by https://github.com/bdauvergne/python-oath
+    /**
+     * Inspired by https://github.com/bdauvergne/python-oath
      *
      * @throws Exception
-	 */
-	private function parseOCRASuite($ocraSuite) {
-		if (!is_string($ocraSuite)) {
-			throw new Exception('OCRASuite not in string format: ' . var_export($ocraSuite, TRUE));
-		}
-
-		$ocraSuite = strtoupper($ocraSuite);
-		$this->OCRASuite = $ocraSuite;
-
-		$s = explode(':', $ocraSuite);
-		if (count($s) != 3) {
-			throw new Exception('Invalid OCRASuite format: ' . var_export($ocraSuite, TRUE));
-		}
-
-		$algo = explode('-', $s[0]);
-		if (count($algo) != 2) {
-			throw new Exception('Invalid OCRA version: ' . var_export($s[0], TRUE));
-		}
-
-		if ($algo[0] !== 'OCRA') {
-			throw new Exception('Unsupported OCRA algorithm: ' . var_export($algo[0], TRUE));
-		}
-
-		if ($algo[1] !== '1') {
-			throw new Exception('Unsupported OCRA version: ' . var_export($algo[1], TRUE));
-		}
-		$this->OCRAVersion = $algo[1];
-
-		$cf = explode('-', $s[1]);
-		if (count($cf) != 3) {
-			throw new Exception('Invalid OCRA suite crypto function: ' . var_export($s[1], TRUE));
-		}
-
-		if ($cf[0] !== 'HOTP') {
-			throw new Exception('Unsupported OCRA suite crypto function: ' . var_export($cf[0], TRUE));
-		}
-		$this->CryptoFunctionType = $cf[0];
-
-		if (!array_key_exists($cf[1], $this->supportedHashFunctions)) {
-			throw new Exception('Unsupported hash function in OCRA suite crypto function: ' . var_export($cf[1], TRUE));
-		}
-		$this->CryptoFunctionHash = $cf[1];
-		$this->CryptoFunctionHashLength = $this->supportedHashFunctions[$cf[1]];
-
-		if (!preg_match('/^\d+$/', $cf[2]) || (($cf[2] < 4 || $cf[2] > 10) && $cf[2] != 0)) {
-			throw new Exception('Invalid OCRA suite crypto function truncation length: ' . var_export($cf[2], TRUE));
-		}
-		$this->CryptoFunctionTruncation = intval($cf[2]);
-
-		$di = explode('-', $s[2]);
-		if (count($cf) == 0) {
-			throw new Exception('Invalid OCRA suite data input: ' . var_export($s[2], TRUE));
-		}
-
-		$data_input = array();
-		foreach($di as $elem) {
-			$letter = $elem[0];
-			if (array_key_exists($letter, $data_input)) {
-				throw new Exception('Duplicate field in OCRA suite data input: ' . var_export($elem, TRUE));
-			}
-			$data_input[$letter] = 1;
-
-			if ($letter === 'C' && strlen($elem) == 1) {
-				$this->C = TRUE;
-			} elseif ($letter === 'Q') {
-				if (strlen($elem) == 1) {
-					$this->Q = TRUE;
-				} elseif (preg_match('/^Q([AHN])(\d+)$/', $elem, $match)) {
-					$q_len = intval($match[2]);
-					if ($q_len < 4 || $q_len > 64) {
-						throw new Exception('Invalid OCRA suite data input question length: ' . var_export($q_len, TRUE));
-					}
-					$this->Q = TRUE;
-					$this->QType = $match[1];
-					$this->QLength = $q_len;
-				} else {
-					throw new Exception('Invalid OCRA suite data input question: ' . var_export($elem, TRUE));
-				}
-			} elseif ($letter === 'P') {
-				if (strlen($elem) == 1) {
-					$this->P = TRUE;
-				} else {
-					$p_algo = substr($elem, 1);
-					if (!array_key_exists($p_algo, $this->supportedHashFunctions)) {
-						throw new Exception('Unsupported OCRA suite PIN hash function: ' . var_export($elem, TRUE));
-					}
-					$this->P = TRUE;
-					$this->PType = $p_algo;
-					$this->PLength = $this->supportedHashFunctions[$p_algo];
-				}
-			} elseif ($letter === 'S') {
-				if (strlen($elem) == 1) {
-					$this->S = TRUE;
-				} elseif (preg_match('/^S(\d+)$/', $elem, $match)) {
-					$s_len = intval($match[1]);
-					if ($s_len <= 0 || $s_len > 512) {
-						throw new Exception('Invalid OCRA suite data input session information length: ' . var_export($s_len, TRUE));
-					}
-
-					$this->S = TRUE;
-					$this->SLength = $s_len;
-				} else {
-					throw new Exception('Invalid OCRA suite data input session information length: ' . var_export($elem, TRUE));
-				}
-			} elseif ($letter === 'T') {
-				if (strlen($elem) == 1) {
-					$this->T = TRUE;
-				} elseif (preg_match('/^T(\d+[HMS])+$/', $elem)) {
-					preg_match_all('/(\d+)([HMS])/', $elem, $match);
-
-					if (count($match[1]) !== count(array_unique($match[2]))) {
-						throw new Exception('Duplicate definitions in OCRA suite data input timestamp: ' . var_export($elem, TRUE));
-					}
-
-					$length = 0;
-					for ($i = 0; $i < count($match[1]); $i++) {
-						$length += intval($match[1][$i]) * $this->TPeriods[$match[2][$i]];
-					}
-					if ($length <= 0) {
-						throw new Exception('Invalid OCRA suite data input timestamp: ' . var_export($elem, TRUE));
-					}
-
-					$this->T = TRUE;
-					$this->TLength = $length;
-				} else {
-					throw new Exception('Invalid OCRA suite data input timestamp: ' . var_export($elem, TRUE));
-				}
-			} else {
-				throw new Exception('Unsupported OCRA suite data input field: ' . var_export($elem, TRUE));
-			}
-		}
-
-		if (!$this->Q) {
-			throw new Exception('OCRA suite data input question not defined: ' . var_export($s[2], TRUE));
-		}
-	}
+     */
+    private function parseOCRASuite($ocraSuite) {
+        if (!is_string($ocraSuite)) {
+            throw new Exception('OCRASuite not in string format: ' . var_export($ocraSuite, TRUE));
+        }
+
+        $ocraSuite = strtoupper($ocraSuite);
+        $this->OCRASuite = $ocraSuite;
+
+        $s = explode(':', $ocraSuite);
+        if (count($s) != 3) {
+            throw new Exception('Invalid OCRASuite format: ' . var_export($ocraSuite, TRUE));
+        }
+
+        $algo = explode('-', $s[0]);
+        if (count($algo) != 2) {
+            throw new Exception('Invalid OCRA version: ' . var_export($s[0], TRUE));
+        }
+
+        if ($algo[0] !== 'OCRA') {
+            throw new Exception('Unsupported OCRA algorithm: ' . var_export($algo[0], TRUE));
+        }
+
+        if ($algo[1] !== '1') {
+            throw new Exception('Unsupported OCRA version: ' . var_export($algo[1], TRUE));
+        }
+        $this->OCRAVersion = $algo[1];
+
+        $cf = explode('-', $s[1]);
+        if (count($cf) != 3) {
+            throw new Exception('Invalid OCRA suite crypto function: ' . var_export($s[1], TRUE));
+        }
+
+        if ($cf[0] !== 'HOTP') {
+            throw new Exception('Unsupported OCRA suite crypto function: ' . var_export($cf[0], TRUE));
+        }
+        $this->CryptoFunctionType = $cf[0];
+
+        if (!array_key_exists($cf[1], $this->supportedHashFunctions)) {
+            throw new Exception('Unsupported hash function in OCRA suite crypto function: ' . var_export($cf[1], TRUE));
+        }
+        $this->CryptoFunctionHash = $cf[1];
+        $this->CryptoFunctionHashLength = $this->supportedHashFunctions[$cf[1]];
+
+        if (!preg_match('/^\d+$/', $cf[2]) || (($cf[2] < 4 || $cf[2] > 10) && $cf[2] != 0)) {
+            throw new Exception('Invalid OCRA suite crypto function truncation length: ' . var_export($cf[2], TRUE));
+        }
+        $this->CryptoFunctionTruncation = intval($cf[2]);
+
+        $di = explode('-', $s[2]);
+        if (count($cf) == 0) {
+            throw new Exception('Invalid OCRA suite data input: ' . var_export($s[2], TRUE));
+        }
+
+        $data_input = array();
+        foreach($di as $elem) {
+            $letter = $elem[0];
+            if (array_key_exists($letter, $data_input)) {
+                throw new Exception('Duplicate field in OCRA suite data input: ' . var_export($elem, TRUE));
+            }
+            $data_input[$letter] = 1;
+
+            if ($letter === 'C' && strlen($elem) == 1) {
+                $this->C = TRUE;
+            } elseif ($letter === 'Q') {
+                if (strlen($elem) == 1) {
+                    $this->Q = TRUE;
+                } elseif (preg_match('/^Q([AHN])(\d+)$/', $elem, $match)) {
+                    $q_len = intval($match[2]);
+                    if ($q_len < 4 || $q_len > 64) {
+                        throw new Exception('Invalid OCRA suite data input question length: ' . var_export($q_len, TRUE));
+                    }
+                    $this->Q = TRUE;
+                    $this->QType = $match[1];
+                    $this->QLength = $q_len;
+                } else {
+                    throw new Exception('Invalid OCRA suite data input question: ' . var_export($elem, TRUE));
+                }
+            } elseif ($letter === 'P') {
+                if (strlen($elem) == 1) {
+                    $this->P = TRUE;
+                } else {
+                    $p_algo = substr($elem, 1);
+                    if (!array_key_exists($p_algo, $this->supportedHashFunctions)) {
+                        throw new Exception('Unsupported OCRA suite PIN hash function: ' . var_export($elem, TRUE));
+                    }
+                    $this->P = TRUE;
+                    $this->PType = $p_algo;
+                    $this->PLength = $this->supportedHashFunctions[$p_algo];
+                }
+            } elseif ($letter === 'S') {
+                if (strlen($elem) == 1) {
+                    $this->S = TRUE;
+                } elseif (preg_match('/^S(\d+)$/', $elem, $match)) {
+                    $s_len = intval($match[1]);
+                    if ($s_len <= 0 || $s_len > 512) {
+                        throw new Exception('Invalid OCRA suite data input session information length: ' . var_export($s_len, TRUE));
+                    }
+
+                    $this->S = TRUE;
+                    $this->SLength = $s_len;
+                } else {
+                    throw new Exception('Invalid OCRA suite data input session information length: ' . var_export($elem, TRUE));
+                }
+            } elseif ($letter === 'T') {
+                if (strlen($elem) == 1) {
+                    $this->T = TRUE;
+                } elseif (preg_match('/^T(\d+[HMS])+$/', $elem)) {
+                    preg_match_all('/(\d+)([HMS])/', $elem, $match);
+
+                    if (count($match[1]) !== count(array_unique($match[2]))) {
+                        throw new Exception('Duplicate definitions in OCRA suite data input timestamp: ' . var_export($elem, TRUE));
+                    }
+
+                    $length = 0;
+                    for ($i = 0; $i < count($match[1]); $i++) {
+                        $length += intval($match[1][$i]) * $this->TPeriods[$match[2][$i]];
+                    }
+                    if ($length <= 0) {
+                        throw new Exception('Invalid OCRA suite data input timestamp: ' . var_export($elem, TRUE));
+                    }
+
+                    $this->T = TRUE;
+                    $this->TLength = $length;
+                } else {
+                    throw new Exception('Invalid OCRA suite data input timestamp: ' . var_export($elem, TRUE));
+                }
+            } else {
+                throw new Exception('Unsupported OCRA suite data input field: ' . var_export($elem, TRUE));
+            }
+        }
+
+        if (!$this->Q) {
+            throw new Exception('OCRA suite data input question not defined: ' . var_export($s[2], TRUE));
+        }
+    }
 
     /** Generate an OCRA challenge question according to the ocra suite specified in the constructor
      * @return String: The randomly generated OCRA question
@@ -190,50 +190,50 @@ 
      * Note that the question string is the exact question string a specified in the OCRA strandard (RFC 6287)
      * The challenge is not yet hex encoded as expected by OCRA::generateOCRA()
      */
-	public function generateChallenge() : String {
-		$q_length = $this->QLength;
-		$q_type = $this->QType;
+    public function generateChallenge() : String {
+        $q_length = $this->QLength;
+        $q_type = $this->QType;
 
         $bytes = Tiqr_Random::randomBytes($q_length);
 
-		switch($q_type) {
-			case 'A':
-				$challenge = base64_encode($bytes);
-				$tr = implode("", unpack('H*', $bytes));
-				$challenge = rtrim(strtr($challenge, '+/', $tr), '=');
-				break;
-			case 'H':
-				$challenge = implode("", unpack('H*', $bytes));
-				break;
-			case 'N':
-				$challenge = implode("", unpack('N*', $bytes));
-				break;
-			default:
-				throw new Exception('Unsupported OCRASuite challenge type: ' . var_export($q_type, TRUE));
-				break;
-		}
-
-		$challenge = substr($challenge, 0, $q_length);
-
-		return $challenge;
-	}
-
-
-	/**
-	 * Constant time string comparison, see http://codahale.com/a-lesson-in-timing-attacks/
-	 */
-	public static function constEqual(string $s1, string $s2): bool {
-		if (strlen($s1) != strlen($s2)) {
-			return FALSE;
-		}
-
-		$result = TRUE;
-		$length = strlen($s1);
-		for ($i = 0; $i < $length; $i++) {
-			$result &= ($s1[$i] == $s2[$i]);
-		}
-
-		return (boolean)$result;
-	}
+        switch($q_type) {
+            case 'A':
+                $challenge = base64_encode($bytes);
+                $tr = implode("", unpack('H*', $bytes));
+                $challenge = rtrim(strtr($challenge, '+/', $tr), '=');
+                break;
+            case 'H':
+                $challenge = implode("", unpack('H*', $bytes));
+                break;
+            case 'N':
+                $challenge = implode("", unpack('N*', $bytes));
+                break;
+            default:
+                throw new Exception('Unsupported OCRASuite challenge type: ' . var_export($q_type, TRUE));
+                break;
+        }
+
+        $challenge = substr($challenge, 0, $q_length);
+
+        return $challenge;
+    }
+
+
+    /**
+     * Constant time string comparison, see http://codahale.com/a-lesson-in-timing-attacks/
+     */
+    public static function constEqual(string $s1, string $s2): bool {
+        if (strlen($s1) != strlen($s2)) {
+            return FALSE;
+        }
+
+        $result = TRUE;
+        $length = strlen($s1);
+        for ($i = 0; $i < $length; $i++) {
+            $result &= ($s1[$i] == $s2[$i]);
+        }
+
+        return (boolean)$result;
+    }
 
 }

library/tiqr/Tiqr/Message/APNS2.php

Spacing +19 added lines, -19 removed lines

@@ -20,11 +20,11 @@ 
         $options = $this->getOptions();
         if (isset($options['apns.proxy_host_url'])) {
             // Override CURL options to connect to a HTTP/1.1 to HTTP/2 proxy
-            $curl_options[CURLOPT_URL] = $options['apns.proxy_host_url'] . '/3/device/' . $this->getAddress();
+            $curl_options[CURLOPT_URL] = $options['apns.proxy_host_url'].'/3/device/'.$this->getAddress();
             $curl_options[CURLOPT_PORT] = $options['apns.proxy_host_port'] ?? 443;
             // Use HTTP/1.1 instead of HTTP/2
             $curl_options[CURLOPT_HTTP_VERSION] = CURL_HTTP_VERSION_1_1;
-            $this->logger->notice(sprintf('Using HTTP/1.1 CURL Proxy URL: "%s" and port "%s"',  $curl_options[CURLOPT_URL], $curl_options[CURLOPT_URL]));
+            $this->logger->notice(sprintf('Using HTTP/1.1 CURL Proxy URL: "%s" and port "%s"', $curl_options[CURLOPT_URL], $curl_options[CURLOPT_URL]));
         }
         else {
             $version_info = curl_version();
@@ -35,7 +35,7 @@ 
 
         // Get the UID from the client certificate we use for authentication, this
         // is set to the bundle ID.
-        $options=$this->getOptions();
+        $options = $this->getOptions();
         $cert_filename = $options['apns.certificate'];
         if (strlen($cert_filename) == 0) {
             throw new RuntimeException('apns.certificate option not set');
@@ -47,7 +47,7 @@ 
             );
         }
 
-        $cert=openssl_x509_parse( $cert_file_contents );
+        $cert = openssl_x509_parse($cert_file_contents);
         if (false === $cert) {
             throw new RuntimeException('Error parsing APNS client certificate');
         }
@@ -72,42 +72,42 @@ 
         $authProvider = AuthProvider\Certificate::create($authProviderOptions);
 
         // Create the push message
-        $alert=Alert::create();
+        $alert = Alert::create();
         $alert->setBody($this->getText());
         // Note: It is possible to specify a title and a subtitle: $alert->setTitle() && $alert->setSubtitle()
         //       The tiqr service currently does not implement this.
-        $payload=Payload::create()->setAlert($alert);
+        $payload = Payload::create()->setAlert($alert);
         $payload->setSound('default');
         foreach ($this->getCustomProperties() as $name => $value) {
             $payload->setCustomValue($name, $value);
         }
         $this->logger->debug(sprintf('JSON Payload: %s', $payload->toJson()));
-        $notification=new Notification($payload, $this->getAddress());
+        $notification = new Notification($payload, $this->getAddress());
         // Set expiration to 30 seconds from now, same as Message_APNS
         $now = new DateTime();
-        $expirationInstant=$now->add(new DateInterval('PT30S'));
+        $expirationInstant = $now->add(new DateInterval('PT30S'));
         $notification->setExpirationAt($expirationInstant);
 
         // Send the push message
         $client = new Client($authProvider, $options['apns.environment'] == 'production', $curl_options);
         $client->addNotification($notification);
-        $responses=$client->push();
-        if ( sizeof($responses) != 1) {
-            $this->logger->warning(sprintf('Unexpected number responses. Expected 1, got %d', sizeof($responses)) );
+        $responses = $client->push();
+        if (sizeof($responses) != 1) {
+            $this->logger->warning(sprintf('Unexpected number responses. Expected 1, got %d', sizeof($responses)));
             if (sizeof($responses) == 0) {
                 $this->logger->warning('Could not determine whether the notification was sent');
                 return;
             }
         }
         /** @var \Pushok\Response $response */
-        $response = reset($responses);  // Get first response from the array
-        $deviceToken=$response->getDeviceToken() ?? '';
+        $response = reset($responses); // Get first response from the array
+        $deviceToken = $response->getDeviceToken() ?? '';
         // A canonical UUID that is the unique ID for the notification. E.g. 123e4567-e89b-12d3-a456-4266554400a0
-        $apnsId=$response->getApnsId() ?? '';
+        $apnsId = $response->getApnsId() ?? '';
         // Status code. E.g. 200 (Success), 410 (The device token is no longer active for the topic.)
-        $statusCode=$response->getStatusCode();
+        $statusCode = $response->getStatusCode();
         $this->logger->info(sprintf('Got response with ApnsId "%s", status %s for deviceToken "%s"', $apnsId, $statusCode, $deviceToken));
-        if ( strcasecmp($deviceToken, $this->getAddress()) ) {
+        if (strcasecmp($deviceToken, $this->getAddress())) {
         $this->logger->warning(sprintf('Unexpected deviceToken in response. Expected: "%s"; got: "%s"', $this->getAddress(), $deviceToken));
         }
         if ($statusCode == 200) {
@@ -115,9 +115,9 @@ 
             return;
         }
 
-        $reasonPhrase=$response->getReasonPhrase(); // E.g. The device token is no longer active for the topic.
-        $errorReason=$response->getErrorReason(); // E.g. Unregistered
-        $errorDescription=$response->getErrorDescription(); // E.g. The device token is inactive for the specified topic.
+        $reasonPhrase = $response->getReasonPhrase(); // E.g. The device token is no longer active for the topic.
+        $errorReason = $response->getErrorReason(); // E.g. Unregistered
+        $errorDescription = $response->getErrorDescription(); // E.g. The device token is inactive for the specified topic.
 
         $this->logger->error(sprintf('Error sending APNS2 push notification. APNS ID: "%s"; deviceToken: "%s"; Error: "%s" "%s" "%s"', $apnsId, $deviceToken, $reasonPhrase, $errorReason, $errorDescription));
         throw new RuntimeException(