ConnectionsModule::connect() - Code Metrics - eduVPN/vpn-server-api - Measure and Improve Code Quality continuously with Scrutinizer

ConnectionsModule::connect() A
last analyzed 2017-07-23 14:51 UTC

↳ Parent: ConnectionsModule

Complexity

Conditions	2
Paths	2

Size

Total Lines	16
Code Lines	10

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	16
rs	9.4285
c	0
b	0
f	0
cc	2
eloc	10
nc	2
nop	1

<?php

/**
 * eduVPN - End-user friendly VPN.
 *
 * Copyright: 2016-2017, The Commons Conservancy eduVPN Programme
 * SPDX-License-Identifier: AGPL-3.0+
 */

namespace SURFnet\VPN\Server\Api;

use DateTime;
use SURFnet\VPN\Common\Config;
use SURFnet\VPN\Common\Http\ApiErrorResponse;
use SURFnet\VPN\Common\Http\ApiResponse;
use SURFnet\VPN\Common\Http\AuthUtils;
use SURFnet\VPN\Common\Http\InputValidation;
use SURFnet\VPN\Common\Http\Request;
use SURFnet\VPN\Common\Http\Service;
use SURFnet\VPN\Common\Http\ServiceModuleInterface;
use SURFnet\VPN\Common\ProfileConfig;
use SURFnet\VPN\Server\Exception\TotpException;
use SURFnet\VPN\Server\Exception\YubiKeyException;
use SURFnet\VPN\Server\Storage;
use SURFnet\VPN\Server\Totp;
use SURFnet\VPN\Server\YubiKey;

class ConnectionsModule implements ServiceModuleInterface
{
    /** @var \SURFnet\VPN\Common\Config */
    private $config;

    /** @var \SURFnet\VPN\Server\Storage */
    private $storage;

    /** @var array */
    private $groupProviders;

    public function __construct(Config $config, Storage $storage, array $groupProviders)
    {
        $this->config = $config;
        $this->storage = $storage;
        $this->groupProviders = $groupProviders;
    }

    public function init(Service $service)
    {
        $service->post(
            '/connect',
            function (Request $request, array $hookData) {
                AuthUtils::requireUser($hookData, ['vpn-server-node']);

                return $this->connect($request);
            }
        );

        $service->post(
            '/disconnect',
            function (Request $request, array $hookData) {
                AuthUtils::requireUser($hookData, ['vpn-server-node']);

                return $this->disconnect($request);
            }
        );

        $service->post(
            '/verify_two_factor',
            function (Request $request, array $hookData) {
                AuthUtils::requireUser($hookData, ['vpn-server-node']);

                return $this->verifyTwoFactor($request);
            }
        );
    }

    public function connect(Request $request)
    {
        $profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
        $commonName = InputValidation::commonName($request->getPostParameter('common_name'));
        $ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
        $ip6 = InputValidation::ip6($request->getPostParameter('ip6'));
        $connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));

        if (true !== $response = $this->verifyConnection($profileId, $commonName)) {
            return $response;
        }

        $this->storage->clientConnect($profileId, $commonName, $ip4, $ip6, new DateTime(sprintf('@%d', $connectedAt)));

        return new ApiResponse('connect');
    }

    public function disconnect(Request $request)
    {
        $profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
        $commonName = InputValidation::commonName($request->getPostParameter('common_name'));
        $ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
        $ip6 = InputValidation::ip6($request->getPostParameter('ip6'));

        $connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));
        $disconnectedAt = InputValidation::disconnectedAt($request->getPostParameter('disconnected_at'));
        $bytesTransferred = InputValidation::bytesTransferred($request->getPostParameter('bytes_transferred'));

        $this->storage->clientDisconnect($profileId, $commonName, $ip4, $ip6, new DateTime(sprintf('@%d', $connectedAt)), new DateTime(sprintf('@%d', $disconnectedAt)), $bytesTransferred);

        return new ApiResponse('disconnect');
    }

    public function verifyTwoFactor(Request $request)
    {
        $commonName = InputValidation::commonName($request->getPostParameter('common_name'));
        $twoFactorType = InputValidation::twoFactorType($request->getPostParameter('two_factor_type'));

        $certInfo = $this->storage->getUserCertificateInfo($commonName);
        $userId = $certInfo['user_id'];

        switch ($twoFactorType) {
            case 'yubi':
                $yubiKeyOtp = InputValidation::yubiKeyOtp($request->getPostParameter('two_factor_value'));
                // XXX make sure user has a yubiKeyId first!
                $yubiKeyId = $this->storage->getYubiKeyId($userId);
                try {
                    $yubiKey = new YubiKey();
                    $yubiKey->verify($userId, $yubiKeyOtp, $yubiKeyId);
                } catch (YubiKeyException $e) {
                    $this->storage->addUserMessage($userId, 'notification', sprintf('[VPN] YubiKey OTP validation failed: %s', $e->getMessage()));

                    return new ApiErrorResponse('verify_two_factor', $e->getMessage());
                }
                break;
            case 'totp':
                $totpKey = InputValidation::totpKey($request->getPostParameter('two_factor_value'));
                try {
                    $totp = new Totp($this->storage);
                    $totp->verify($userId, $totpKey);
                } catch (TotpException $e) {
                    $this->storage->addUserMessage($userId, 'notification', sprintf('[VPN] TOTP validation failed: %s', $e->getMessage()));

                    return new ApiErrorResponse('verify_two_factor', $e->getMessage());
                }
                break;
            default:
                return new ApiErrorResponse('verify_two_factor', 'invalid two factor type');
        }

        return new ApiResponse('verify_two_factor');
    }

    private function verifyConnection($profileId, $commonName)
    {
        // verify status of certificate/user
        if (false === $result = $this->storage->getUserCertificateInfo($commonName)) {
            // if a certificate does no longer exist, we cannot figure out the user
            return new ApiErrorResponse('connect', 'user or certificate does not exist');
        }

        if ($result['user_is_disabled']) {

            $msg = '[VPN] unable to connect, account is disabled';
            $this->storage->addUserMessage($result['user_id'], 'notification', $msg);

            return new ApiErrorResponse('connect', $msg);
        }

        if ($result['certificate_is_disabled']) {

            $msg = sprintf('[VPN] unable to connect, certificate "%s" is disabled', $result['display_name']);
            $this->storage->addUserMessage($result['user_id'], 'notification', $msg);

            return new ApiErrorResponse('connect', $msg);
        }

        return $this->verifyAcl($profileId, $result['user_id']);
    }

    private function verifyAcl($profileId, $externalUserId)
    {
        // verify ACL
        $profileConfig = new ProfileConfig($this->config->getSection('vpnProfiles')->getSection($profileId)->toArray());
        if ($profileConfig->getItem('enableAcl')) {
            // ACL enabled
            $userGroups = [];
            foreach ($this->groupProviders as $groupProvider) {
                $userGroups = array_merge($userGroups, $groupProvider->getGroups($externalUserId));
            }

            if (false === self::isMember($userGroups, $profileConfig->getSection('aclGroupList')->toArray())) {
                $msg = '[VPN] unable to connect, account not a member of required group';
                $this->storage->addUserMessage($externalUserId, 'notification', $msg);

                return new ApiErrorResponse('connect', $msg);
            }
        }

        return true;
    }

    private static function isMember(array $memberOf, array $aclGroupList)
    {
        //        var_dump($aclGroupList);

        // one of the groups must be listed in the profile ACL list
        foreach ($memberOf as $memberGroup) {
            if (in_array($memberGroup['id'], $aclGroupList)) {
                return true;
            }
        }

        return false;
    }
}


1		<?php
2
3		/**
4		* eduVPN - End-user friendly VPN.
5		*
6		* Copyright: 2016-2017, The Commons Conservancy eduVPN Programme
7		* SPDX-License-Identifier: AGPL-3.0+
8		*/
9
10		namespace SURFnet\VPN\Server\Api;
11
12		use DateTime;
13		use SURFnet\VPN\Common\Config;
14		use SURFnet\VPN\Common\Http\ApiErrorResponse;
15		use SURFnet\VPN\Common\Http\ApiResponse;
16		use SURFnet\VPN\Common\Http\AuthUtils;
17		use SURFnet\VPN\Common\Http\InputValidation;
18		use SURFnet\VPN\Common\Http\Request;
19		use SURFnet\VPN\Common\Http\Service;
20		use SURFnet\VPN\Common\Http\ServiceModuleInterface;
21		use SURFnet\VPN\Common\ProfileConfig;
22		use SURFnet\VPN\Server\Exception\TotpException;
23		use SURFnet\VPN\Server\Exception\YubiKeyException;
24		use SURFnet\VPN\Server\Storage;
25		use SURFnet\VPN\Server\Totp;
26		use SURFnet\VPN\Server\YubiKey;
27
28		class ConnectionsModule implements ServiceModuleInterface
29		{
30		/** @var \SURFnet\VPN\Common\Config */
31		private $config;
32
33		/** @var \SURFnet\VPN\Server\Storage */
34		private $storage;
35
36		/** @var array */
37		private $groupProviders;
38
39		public function __construct(Config $config, Storage $storage, array $groupProviders)
40		{
41		$this->config = $config;
42		$this->storage = $storage;
43		$this->groupProviders = $groupProviders;
44		}
45
46		public function init(Service $service)
47		{
48		$service->post(
49		'/connect',
50		function (Request $request, array $hookData) {
51		AuthUtils::requireUser($hookData, ['vpn-server-node']);
52
53		return $this->connect($request);
54		}
55		);
56
57		$service->post(
58		'/disconnect',
59		function (Request $request, array $hookData) {
60		AuthUtils::requireUser($hookData, ['vpn-server-node']);
61
62		return $this->disconnect($request);
63		}
64		);
65
66		$service->post(
67		'/verify_two_factor',
68		function (Request $request, array $hookData) {
69		AuthUtils::requireUser($hookData, ['vpn-server-node']);
70
71		return $this->verifyTwoFactor($request);
72		}
73		);
74		}
75
76		public function connect(Request $request)
77		{
78		$profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
79		$commonName = InputValidation::commonName($request->getPostParameter('common_name'));
80		$ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
81		$ip6 = InputValidation::ip6($request->getPostParameter('ip6'));
82		$connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));
83
84		if (true !== $response = $this->verifyConnection($profileId, $commonName)) {
85		return $response;
86		}
87
88		$this->storage->clientConnect($profileId, $commonName, $ip4, $ip6, new DateTime(sprintf('@%d', $connectedAt)));
89
90		return new ApiResponse('connect');
91		}
92
93		public function disconnect(Request $request)
94		{
95		$profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
96		$commonName = InputValidation::commonName($request->getPostParameter('common_name'));
97		$ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
98		$ip6 = InputValidation::ip6($request->getPostParameter('ip6'));
99
100		$connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));
101		$disconnectedAt = InputValidation::disconnectedAt($request->getPostParameter('disconnected_at'));
102		$bytesTransferred = InputValidation::bytesTransferred($request->getPostParameter('bytes_transferred'));
103
104		$this->storage->clientDisconnect($profileId, $commonName, $ip4, $ip6, new DateTime(sprintf('@%d', $connectedAt)), new DateTime(sprintf('@%d', $disconnectedAt)), $bytesTransferred);
105
106		return new ApiResponse('disconnect');
107		}
108
109		public function verifyTwoFactor(Request $request)
110		{
111		$commonName = InputValidation::commonName($request->getPostParameter('common_name'));
112		$twoFactorType = InputValidation::twoFactorType($request->getPostParameter('two_factor_type'));
113
114		$certInfo = $this->storage->getUserCertificateInfo($commonName);
115		$userId = $certInfo['user_id'];
116
117		switch ($twoFactorType) {
118		case 'yubi':
119		$yubiKeyOtp = InputValidation::yubiKeyOtp($request->getPostParameter('two_factor_value'));
120		// XXX make sure user has a yubiKeyId first!
121		$yubiKeyId = $this->storage->getYubiKeyId($userId);
122		try {
123		$yubiKey = new YubiKey();
124		$yubiKey->verify($userId, $yubiKeyOtp, $yubiKeyId);
125		} catch (YubiKeyException $e) {
126		$this->storage->addUserMessage($userId, 'notification', sprintf('[VPN] YubiKey OTP validation failed: %s', $e->getMessage()));
127
128		return new ApiErrorResponse('verify_two_factor', $e->getMessage());
129		}
130		break;
131		case 'totp':
132		$totpKey = InputValidation::totpKey($request->getPostParameter('two_factor_value'));
133		try {
134		$totp = new Totp($this->storage);
135		$totp->verify($userId, $totpKey);
136		} catch (TotpException $e) {
137		$this->storage->addUserMessage($userId, 'notification', sprintf('[VPN] TOTP validation failed: %s', $e->getMessage()));
138
139		return new ApiErrorResponse('verify_two_factor', $e->getMessage());
140		}
141		break;
142		default:
143		return new ApiErrorResponse('verify_two_factor', 'invalid two factor type');
144		}
145
146		return new ApiResponse('verify_two_factor');
147		}
148
149		private function verifyConnection($profileId, $commonName)
150		{
151		// verify status of certificate/user
152		if (false === $result = $this->storage->getUserCertificateInfo($commonName)) {
153		// if a certificate does no longer exist, we cannot figure out the user
154		return new ApiErrorResponse('connect', 'user or certificate does not exist');
155		}
156
157	View Code Duplication	if ($result['user_is_disabled']) {
		0 ignored issues – show Duplication introduced 2016-11-29 22:01 UTC by Report Bug Copy Issue Report This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
158		$msg = '[VPN] unable to connect, account is disabled';
159		$this->storage->addUserMessage($result['user_id'], 'notification', $msg);
160
161		return new ApiErrorResponse('connect', $msg);
162		}
163
164	View Code Duplication	if ($result['certificate_is_disabled']) {
		0 ignored issues – show Duplication introduced 2016-11-29 22:01 UTC by Report Bug Copy Issue Report This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
165		$msg = sprintf('[VPN] unable to connect, certificate "%s" is disabled', $result['display_name']);
166		$this->storage->addUserMessage($result['user_id'], 'notification', $msg);
167
168		return new ApiErrorResponse('connect', $msg);
169		}
170
171		return $this->verifyAcl($profileId, $result['user_id']);
172		}
173
174		private function verifyAcl($profileId, $externalUserId)
175		{
176		// verify ACL
177		$profileConfig = new ProfileConfig($this->config->getSection('vpnProfiles')->getSection($profileId)->toArray());
178		if ($profileConfig->getItem('enableAcl')) {
179		// ACL enabled
180		$userGroups = [];
181		foreach ($this->groupProviders as $groupProvider) {
182		$userGroups = array_merge($userGroups, $groupProvider->getGroups($externalUserId));
183		}
184
185		if (false === self::isMember($userGroups, $profileConfig->getSection('aclGroupList')->toArray())) {
186		$msg = '[VPN] unable to connect, account not a member of required group';
187		$this->storage->addUserMessage($externalUserId, 'notification', $msg);
188
189		return new ApiErrorResponse('connect', $msg);
190		}
191		}
192
193		return true;
194		}
195
196		private static function isMember(array $memberOf, array $aclGroupList)
197		{
198		// var_dump($aclGroupList);
		0 ignored issues – show Unused Code Comprehensibility introduced 2017-01-03 16:06 UTC by Report Bug Copy Issue Report `67%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
199		// one of the groups must be listed in the profile ACL list
200		foreach ($memberOf as $memberGroup) {
201		if (in_array($memberGroup['id'], $aclGroupList)) {
202		return true;
203		}
204		}
205
206		return false;
207		}
208		}
209

eduVPN / vpn-server-api

GitHub Access Token became invalid

ConnectionsModule::connect() A last analyzed 2017-07-23 14:51 UTC

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like

ConnectionsModule::connect() A
last analyzed 2017-07-23 14:51 UTC