ConnectionsModule::disconnect() - Code Metrics - Inspection of "make OTP checking more robust, limit number of att..." - eduVPN/vpn-server-api - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — master ( c87823...3d2057 )

by François

created 2016-12-07 09:48 UTC

ConnectionsModule::disconnect() A

↳ Parent: ConnectionsModule

Complexity

Conditions	2
Paths	2

Size

Total Lines	17
Code Lines	11

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
dl	0
loc	17
rs	9.4285
c	0
b	0
f	0
cc	2
eloc	11
nc	2
nop	1

<?php
/**
 *  Copyright (C) 2016 SURFnet.
 *
 *  This program is free software: you can redistribute it and/or modify
 *  it under the terms of the GNU Affero General Public License as
 *  published by the Free Software Foundation, either version 3 of the
 *  License, or (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU Affero General Public License for more details.
 *
 *  You should have received a copy of the GNU Affero General Public License
 *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

namespace SURFnet\VPN\Server\Api;

use DateTime;
use SURFnet\VPN\Common\Config;
use SURFnet\VPN\Common\Http\ApiErrorResponse;
use SURFnet\VPN\Common\Http\ApiResponse;
use SURFnet\VPN\Common\Http\AuthUtils;
use SURFnet\VPN\Common\Http\InputValidation;
use SURFnet\VPN\Common\Http\Request;
use SURFnet\VPN\Common\Http\Service;
use SURFnet\VPN\Common\Http\ServiceModuleInterface;
use SURFnet\VPN\Common\ProfileConfig;
use SURFnet\VPN\Server\Exception\TwoFactorException;
use SURFnet\VPN\Server\Storage;
use SURFnet\VPN\Server\TwoFactor;

class ConnectionsModule implements ServiceModuleInterface
{
    /** @var \SURFnet\VPN\Common\Config */
    private $config;

    /** @var \SURFnet\VPN\Server\Storage */
    private $storage;

    /** @var array */
    private $groupProviders;

    public function __construct(Config $config, Storage $storage, array $groupProviders)
    {
        $this->config = $config;
        $this->storage = $storage;
        $this->groupProviders = $groupProviders;
    }

    public function init(Service $service)
    {
        $service->post(
            '/connect',
            function (Request $request, array $hookData) {
                AuthUtils::requireUser($hookData, ['vpn-server-node']);

                return $this->connect($request);
            }
        );

        $service->post(
            '/disconnect',
            function (Request $request, array $hookData) {
                AuthUtils::requireUser($hookData, ['vpn-server-node']);

                return $this->disconnect($request);
            }
        );

        $service->post(
            '/verify_otp',
            function (Request $request, array $hookData) {
                AuthUtils::requireUser($hookData, ['vpn-server-node']);

                return $this->verifyOtp($request);
            }
        );
    }

    public function connect(Request $request)
    {
        $profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
        $commonName = InputValidation::commonName($request->getPostParameter('common_name'));
        $ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
        $ip6 = InputValidation::ip6($request->getPostParameter('ip6'));
        $connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));

        if (true !== $response = $this->verifyConnection($profileId, $commonName)) {
            return $response;
        }

        if (false == $this->storage->clientConnect($profileId, $commonName, $ip4, $ip6, $connectedAt)) {

            return new ApiErrorResponse('connect', 'unable to write connect event to log');
        }

        return new ApiResponse('connect');
    }

    public function disconnect(Request $request)
    {
        $profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
        $commonName = InputValidation::commonName($request->getPostParameter('common_name'));
        $ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
        $ip6 = InputValidation::ip6($request->getPostParameter('ip6'));

        $connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));
        $disconnectedAt = InputValidation::disconnectedAt($request->getPostParameter('disconnected_at'));
        $bytesTransferred = InputValidation::bytesTransferred($request->getPostParameter('bytes_transferred'));

        if (false === $this->storage->clientDisconnect($profileId, $commonName, $ip4, $ip6, $connectedAt, $disconnectedAt, $bytesTransferred)) {
            return new ApiErrorResponse('disconnect', 'unable to write disconnect event to log');
        }

        return new ApiResponse('disconnect');
    }

    public function verifyOtp(Request $request)

    {
        $commonName = InputValidation::commonName($request->getPostParameter('common_name'));
        // we do not need 'otp_type', as only 'totp' is supported at the moment
        InputValidation::otpType($request->getPostParameter('otp_type'));
        $totpKey = InputValidation::totpKey($request->getPostParameter('totp_key'));

        $certInfo = $this->storage->getUserCertificateInfo($commonName);
        $userId = $certInfo['user_id'];

        $twoFactor = new TwoFactor($this->storage, new DateTime('now'));
        try {
            $twoFactor->verifyTotp($userId, $totpKey);
        } catch (TwoFactorException $e) {
            return new ApiErrorResponse('verify_otp', $e->getMessage());
        }

        return new ApiResponse('verify_otp');
    }

    private function verifyConnection($profileId, $commonName)
    {
        // verify status of certificate/user
        if (false === $result = $this->storage->getUserCertificateInfo($commonName)) {
            return new ApiErrorResponse('connect', 'user or certificate does not exist');
        }

        if ($result['user_is_disabled']) {
            return new ApiErrorResponse('connect', 'user is disabled');
        }

        if ($result['certificate_is_disabled']) {
            return new ApiErrorResponse('connect', 'certificate is disabled');
        }

        return $this->verifyAcl($profileId, $result['user_id']);
    }

    private function verifyAcl($profileId, $externalUserId)
    {
        // verify ACL
        $profileConfig = new ProfileConfig($this->config->v('vpnProfiles', $profileId));
        if ($profileConfig->v('enableAcl')) {
            // ACL enabled
            $userGroups = [];
            foreach ($this->groupProviders as $groupProvider) {
                $userGroups = array_merge($userGroups, $groupProvider->getGroups($externalUserId));
            }

            if (false === self::isMember($userGroups, $profileConfig->v('aclGroupList'))) {
                return new ApiErrorResponse('connect', 'user not in ACL');
            }
        }

        return true;
    }

    private static function isMember(array $memberOf, array $aclGroupList)
    {
        // one of the groups must be listed in the profile ACL list
        foreach ($memberOf as $memberGroup) {
            if (in_array($memberGroup['id'], $aclGroupList)) {
                return true;
            }
        }

        return false;
    }
}


1		<?php
2		/**
3		* Copyright (C) 2016 SURFnet.
4		*
5		* This program is free software: you can redistribute it and/or modify
6		* it under the terms of the GNU Affero General Public License as
7		* published by the Free Software Foundation, either version 3 of the
8		* License, or (at your option) any later version.
9		*
10		* This program is distributed in the hope that it will be useful,
11		* but WITHOUT ANY WARRANTY; without even the implied warranty of
12		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13		* GNU Affero General Public License for more details.
14		*
15		* You should have received a copy of the GNU Affero General Public License
16		* along with this program. If not, see <http://www.gnu.org/licenses/>.
17		*/
18
19		namespace SURFnet\VPN\Server\Api;
20
21		use DateTime;
22		use SURFnet\VPN\Common\Config;
23		use SURFnet\VPN\Common\Http\ApiErrorResponse;
24		use SURFnet\VPN\Common\Http\ApiResponse;
25		use SURFnet\VPN\Common\Http\AuthUtils;
26		use SURFnet\VPN\Common\Http\InputValidation;
27		use SURFnet\VPN\Common\Http\Request;
28		use SURFnet\VPN\Common\Http\Service;
29		use SURFnet\VPN\Common\Http\ServiceModuleInterface;
30		use SURFnet\VPN\Common\ProfileConfig;
31		use SURFnet\VPN\Server\Exception\TwoFactorException;
32		use SURFnet\VPN\Server\Storage;
33		use SURFnet\VPN\Server\TwoFactor;
34
35		class ConnectionsModule implements ServiceModuleInterface
36		{
37		/** @var \SURFnet\VPN\Common\Config */
38		private $config;
39
40		/** @var \SURFnet\VPN\Server\Storage */
41		private $storage;
42
43		/** @var array */
44		private $groupProviders;
45
46		public function __construct(Config $config, Storage $storage, array $groupProviders)
47		{
48		$this->config = $config;
49		$this->storage = $storage;
50		$this->groupProviders = $groupProviders;
51		}
52
53		public function init(Service $service)
54		{
55		$service->post(
56		'/connect',
57		function (Request $request, array $hookData) {
58		AuthUtils::requireUser($hookData, ['vpn-server-node']);
59
60		return $this->connect($request);
61		}
62		);
63
64		$service->post(
65		'/disconnect',
66		function (Request $request, array $hookData) {
67		AuthUtils::requireUser($hookData, ['vpn-server-node']);
68
69		return $this->disconnect($request);
70		}
71		);
72
73		$service->post(
74		'/verify_otp',
75		function (Request $request, array $hookData) {
76		AuthUtils::requireUser($hookData, ['vpn-server-node']);
77
78		return $this->verifyOtp($request);
79		}
80		);
81		}
82
83		public function connect(Request $request)
84		{
85		$profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
86		$commonName = InputValidation::commonName($request->getPostParameter('common_name'));
87		$ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
88		$ip6 = InputValidation::ip6($request->getPostParameter('ip6'));
89		$connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));
90
91		if (true !== $response = $this->verifyConnection($profileId, $commonName)) {
92		return $response;
93		}
94
95		if (false == $this->storage->clientConnect($profileId, $commonName, $ip4, $ip6, $connectedAt)) {
		0 ignored issues – show Coding Style Best Practice introduced 2016-10-26 14:01 UTC by Report Bug Copy Issue Report It seems like you are loosely comparing two booleans. Considering using the strict comparison `===` instead. When comparing two booleans, it is generally considered safer to use the strict comparison operator. Loading history...
96		return new ApiErrorResponse('connect', 'unable to write connect event to log');
97		}
98
99		return new ApiResponse('connect');
100		}
101
102		public function disconnect(Request $request)
103		{
104		$profileId = InputValidation::profileId($request->getPostParameter('profile_id'));
105		$commonName = InputValidation::commonName($request->getPostParameter('common_name'));
106		$ip4 = InputValidation::ip4($request->getPostParameter('ip4'));
107		$ip6 = InputValidation::ip6($request->getPostParameter('ip6'));
108
109		$connectedAt = InputValidation::connectedAt($request->getPostParameter('connected_at'));
110		$disconnectedAt = InputValidation::disconnectedAt($request->getPostParameter('disconnected_at'));
111		$bytesTransferred = InputValidation::bytesTransferred($request->getPostParameter('bytes_transferred'));
112
113		if (false === $this->storage->clientDisconnect($profileId, $commonName, $ip4, $ip6, $connectedAt, $disconnectedAt, $bytesTransferred)) {
114		return new ApiErrorResponse('disconnect', 'unable to write disconnect event to log');
115		}
116
117		return new ApiResponse('disconnect');
118		}
119
120	View Code Duplication	public function verifyOtp(Request $request)
		0 ignored issues – show Duplication introduced 2016-12-07 09:50 UTC by Report Bug Copy Issue Report This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
121		{
122		$commonName = InputValidation::commonName($request->getPostParameter('common_name'));
123		// we do not need 'otp_type', as only 'totp' is supported at the moment
124		InputValidation::otpType($request->getPostParameter('otp_type'));
125		$totpKey = InputValidation::totpKey($request->getPostParameter('totp_key'));
126
127		$certInfo = $this->storage->getUserCertificateInfo($commonName);
128		$userId = $certInfo['user_id'];
129
130		$twoFactor = new TwoFactor($this->storage, new DateTime('now'));
131		try {
132		$twoFactor->verifyTotp($userId, $totpKey);
133		} catch (TwoFactorException $e) {
134		return new ApiErrorResponse('verify_otp', $e->getMessage());
135		}
136
137		return new ApiResponse('verify_otp');
138		}
139
140		private function verifyConnection($profileId, $commonName)
141		{
142		// verify status of certificate/user
143		if (false === $result = $this->storage->getUserCertificateInfo($commonName)) {
144		return new ApiErrorResponse('connect', 'user or certificate does not exist');
145		}
146
147		if ($result['user_is_disabled']) {
148		return new ApiErrorResponse('connect', 'user is disabled');
149		}
150
151		if ($result['certificate_is_disabled']) {
152		return new ApiErrorResponse('connect', 'certificate is disabled');
153		}
154
155		return $this->verifyAcl($profileId, $result['user_id']);
156		}
157
158		private function verifyAcl($profileId, $externalUserId)
159		{
160		// verify ACL
161		$profileConfig = new ProfileConfig($this->config->v('vpnProfiles', $profileId));
162		if ($profileConfig->v('enableAcl')) {
163		// ACL enabled
164		$userGroups = [];
165		foreach ($this->groupProviders as $groupProvider) {
166		$userGroups = array_merge($userGroups, $groupProvider->getGroups($externalUserId));
167		}
168
169		if (false === self::isMember($userGroups, $profileConfig->v('aclGroupList'))) {
170		return new ApiErrorResponse('connect', 'user not in ACL');
171		}
172		}
173
174		return true;
175		}
176
177		private static function isMember(array $memberOf, array $aclGroupList)
178		{
179		// one of the groups must be listed in the profile ACL list
180		foreach ($memberOf as $memberGroup) {
181		if (in_array($memberGroup['id'], $aclGroupList)) {
182		return true;
183		}
184		}
185
186		return false;
187		}
188		}
189

eduVPN / vpn-server-api

GitHub Access Token became invalid

Push — master ( c87823...3d2057 )

ConnectionsModule::disconnect() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like