grommunio /
grommunio-web
| Total Complexity | 54 |
| Total Lines | 373 |
| Duplicated Lines | 0 % |
| Changes | 0 | ||
Complex classes like Certificate often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use Certificate, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 50 | class Certificate { |
||
| 51 | private $cert; |
||
| 52 | private $data; |
||
| 53 | |||
| 54 | public function __construct($cert, $issuer = '') { |
||
| 55 | // XXX: error handling |
||
| 56 | $this->data = openssl_x509_parse($cert); |
||
| 57 | $this->cert = $cert; |
||
| 58 | $this->issuer = $issuer; |
||
| 59 | } |
||
| 60 | |||
| 61 | /** |
||
| 62 | * The name of the certificate in DN notation. |
||
| 63 | * |
||
| 64 | * @return string the name of the certificate |
||
| 65 | */ |
||
| 66 | public function getName() { |
||
| 67 | return $this->data['name']; |
||
| 68 | } |
||
| 69 | |||
| 70 | /** |
||
| 71 | * Issuer of the certificate. |
||
| 72 | * |
||
| 73 | * @return string The issuer of the certificate in DN notation |
||
| 74 | */ |
||
| 75 | public function getIssuerName() { |
||
| 76 | $issuer = ''; |
||
| 77 | foreach ($this->data['issuer'] as $key => $value) { |
||
| 78 | $issuer .= "/{$key}={$value}"; |
||
| 79 | } |
||
| 80 | |||
| 81 | return $issuer; |
||
| 82 | } |
||
| 83 | |||
| 84 | /** |
||
| 85 | * Converts X509 DER format string to PEM format. |
||
| 86 | * |
||
| 87 | * @param string X509 Certificate in DER format |
||
| 88 | * @param mixed $cert |
||
| 89 | * |
||
| 90 | * @return string X509 Certificate in PEM format |
||
| 91 | */ |
||
| 92 | protected function der2pem($cert) { |
||
| 93 | return "-----BEGIN CERTIFICATE-----\n" . chunk_split(base64_encode((string) $cert), 64, "\n") . "-----END CERTIFICATE-----\n"; |
||
| 94 | } |
||
| 95 | |||
| 96 | /** |
||
| 97 | * Converts X509 PEM format string to DER format. |
||
| 98 | * |
||
| 99 | * @param string X509 Certificate in PEM format |
||
| 100 | * @param mixed $pem_data |
||
| 101 | * |
||
| 102 | * @return string X509 Certificate in DER format |
||
| 103 | */ |
||
| 104 | protected function pem2der($pem_data) { |
||
| 105 | $begin = "CERTIFICATE-----"; |
||
| 106 | $end = "-----END"; |
||
| 107 | $pem_data = substr((string) $pem_data, strpos((string) $pem_data, $begin) + strlen($begin)); |
||
| 108 | $pem_data = substr($pem_data, 0, strpos($pem_data, $end)); |
||
| 109 | |||
| 110 | return base64_decode($pem_data); |
||
| 111 | } |
||
| 112 | |||
| 113 | /** |
||
| 114 | * The subject/emailAddress or subjectAltName. |
||
| 115 | * |
||
| 116 | * @return string The email address belonging to the certificate |
||
| 117 | */ |
||
| 118 | public function emailAddress() { |
||
| 119 | $certEmailAddress = ""; |
||
| 120 | // If subject/emailAddress is not set, try subjectAltName |
||
| 121 | if (isset($this->data['subject']['emailAddress'])) { |
||
| 122 | $certEmailAddress = $this->data['subject']['emailAddress']; |
||
| 123 | } |
||
| 124 | elseif (isset($this->data['extensions'], $this->data['extensions']['subjectAltName']) |
||
| 125 | ) { |
||
| 126 | // Example [subjectAltName] => email:[email protected] |
||
| 127 | $tmp = explode('email:', $this->data['extensions']['subjectAltName']); |
||
| 128 | // Only get the first match |
||
| 129 | if (isset($tmp[1]) && !empty($tmp[1])) { |
||
| 130 | $certEmailAddress = $tmp[1]; |
||
| 131 | } |
||
| 132 | } |
||
| 133 | |||
| 134 | return $certEmailAddress; |
||
| 135 | } |
||
| 136 | |||
| 137 | /** |
||
| 138 | * Return the certificate in DER format. |
||
| 139 | * |
||
| 140 | * @return string certificate in DER format |
||
| 141 | */ |
||
| 142 | public function der() { |
||
| 143 | return $this->pem2der($this->cert); |
||
| 144 | } |
||
| 145 | |||
| 146 | /** |
||
| 147 | * Return the certificate in PEM format. |
||
| 148 | * |
||
| 149 | * @return string certificate in PEM format |
||
| 150 | */ |
||
| 151 | public function pem() { |
||
| 152 | return $this->cert; |
||
| 153 | } |
||
| 154 | |||
| 155 | /** |
||
| 156 | * The beginning of the valid period of the certificate. |
||
| 157 | * |
||
| 158 | * @return int timestamp from which the certificate is valid |
||
| 159 | */ |
||
| 160 | public function validFrom() { |
||
| 161 | return $this->data['validFrom_time_t']; |
||
| 162 | } |
||
| 163 | |||
| 164 | /** |
||
| 165 | * The end of the valid period of the certificate. |
||
| 166 | * |
||
| 167 | * @return int timestamp from which the certificate is invalid |
||
| 168 | */ |
||
| 169 | public function validTo() { |
||
| 170 | return $this->data['validTo_time_t']; |
||
| 171 | } |
||
| 172 | |||
| 173 | /** |
||
| 174 | * Determines if the certificate is valid. |
||
| 175 | * |
||
| 176 | * @return bool the valid status |
||
| 177 | */ |
||
| 178 | public function valid() { |
||
| 179 | $time = time(); |
||
| 180 | |||
| 181 | return $time > $this->validFrom() && $time < $this->validTo(); |
||
| 182 | } |
||
| 183 | |||
| 184 | /** |
||
| 185 | * The caURL of the certififcate. |
||
| 186 | * |
||
| 187 | * @return string return an empty string or the CA URL |
||
| 188 | */ |
||
| 189 | public function caURL() { |
||
| 190 | $authorityInfoAccess = $this->authorityInfoAccess(); |
||
| 191 | if (preg_match("/CA Issuers - URI:(.*)/", $authorityInfoAccess, $matches)) { |
||
| 192 | return array_pop($matches); |
||
| 193 | } |
||
| 194 | |||
| 195 | return ''; |
||
| 196 | } |
||
| 197 | |||
| 198 | /** |
||
| 199 | * The OCSP URL of the certificate. |
||
| 200 | * |
||
| 201 | * @return string return an empty string or the OCSP URL |
||
| 202 | */ |
||
| 203 | public function ocspURL() { |
||
| 204 | $authorityInfoAccess = $this->authorityInfoAccess(); |
||
| 205 | if (preg_match("/OCSP - URI:(.*)/", $authorityInfoAccess, $matches)) { |
||
| 206 | return array_pop($matches); |
||
| 207 | } |
||
| 208 | |||
| 209 | return ''; |
||
| 210 | } |
||
| 211 | |||
| 212 | /** |
||
| 213 | * Internal helper to obtain the authorityInfoAccess information. |
||
| 214 | * |
||
| 215 | * @return string authorityInfoAccess if set |
||
| 216 | */ |
||
| 217 | protected function authorityInfoAccess() { |
||
| 218 | if (!isset($this->data['extensions'])) { |
||
| 219 | return ''; |
||
| 220 | } |
||
| 221 | |||
| 222 | if (!isset($this->data['extensions']['authorityInfoAccess'])) { |
||
| 223 | return ''; |
||
| 224 | } |
||
| 225 | |||
| 226 | return $this->data['extensions']['authorityInfoAccess']; |
||
| 227 | } |
||
| 228 | |||
| 229 | /** |
||
| 230 | * The fingerprint (hash) of the certificate body. |
||
| 231 | * |
||
| 232 | * @param string hash_algorithm either sha1 or md5 |
||
| 233 | * @param mixed $hash_algorithm |
||
| 234 | * |
||
| 235 | * @return string the hash of the certificate's body |
||
| 236 | */ |
||
| 237 | public function fingerprint($hash_algorithm = "md5") { |
||
| 238 | $body = str_replace('-----BEGIN CERTIFICATE-----', '', $this->cert); |
||
| 239 | $body = str_replace('-----END CERTIFICATE-----', '', $body); |
||
| 240 | $body = base64_decode($body); |
||
| 241 | if ($hash_algorithm === 'sha1') { |
||
| 242 | $fingerprint = sha1($body); |
||
| 243 | } |
||
| 244 | else { |
||
| 245 | $fingerprint = md5($body); |
||
| 246 | } |
||
| 247 | |||
| 248 | // Format 1000AB as 10:00:AB |
||
| 249 | return strtoupper(implode(':', str_split($fingerprint, 2))); |
||
| 250 | } |
||
| 251 | |||
| 252 | /** |
||
| 253 | * The issuer of this certificate. |
||
| 254 | * |
||
| 255 | * @return Certificate the issuer certificate |
||
| 256 | */ |
||
| 257 | public function issuer() { |
||
| 258 | if (!empty($this->issuer)) { |
||
| 259 | return $this->issuer; |
||
| 260 | } |
||
| 261 | $cert = ''; |
||
| 262 | $ch = curl_init(); |
||
| 263 | curl_setopt($ch, CURLOPT_URL, $this->caURL()); |
||
| 264 | curl_setopt($ch, CURLOPT_FAILONERROR, true); |
||
| 265 | curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); |
||
| 266 | |||
| 267 | // HTTP Proxy settings |
||
| 268 | if (defined('PLUGIN_SMIME_PROXY') && PLUGIN_SMIME_PROXY != '') { |
||
| 269 | curl_setopt($ch, CURLOPT_PROXY, PLUGIN_SMIME_PROXY); |
||
| 270 | } |
||
| 271 | if (defined('PLUGIN_SMIME_PROXY_PORT') && PLUGIN_SMIME_PROXY_PORT != '') { |
||
| 272 | curl_setopt($ch, CURLOPT_PROXYPORT, PLUGIN_SMIME_PROXY_PORT); |
||
| 273 | } |
||
| 274 | if (defined('PLUGIN_SMIME_PROXY_USERPWD') && PLUGIN_SMIME_PROXY_USERPWD != '') { |
||
| 275 | curl_setopt($ch, CURLOPT_PROXYUSERPWD, PLUGIN_SMIME_PROXY_USERPWD); |
||
| 276 | } |
||
| 277 | |||
| 278 | $output = curl_exec($ch); |
||
| 279 | $http_status = curl_getinfo($ch, CURLINFO_HTTP_CODE); |
||
| 280 | $curl_error = curl_error($ch); |
||
| 281 | if (!$curl_error && $http_status === 200) { |
||
| 282 | $cert = $this->der2pem($output); |
||
| 283 | } |
||
| 284 | else { |
||
| 285 | Log::Write(LOGLEVEL_ERROR, sprintf("[smime] Error when downloading internmediate certificate '%s', http status: '%s'", $curl_error, $http_status)); |
||
| 286 | } |
||
| 287 | curl_close($ch); |
||
| 288 | |||
| 289 | return new Certificate($cert); |
||
| 290 | } |
||
| 291 | |||
| 292 | /** |
||
| 293 | * Set the issuer of a certificate. |
||
| 294 | * |
||
| 295 | * @param string the issuer certificate |
||
| 296 | * @param mixed $issuer |
||
| 297 | */ |
||
| 298 | public function setIssuer($issuer) { |
||
| 301 | } |
||
| 302 | } |
||
| 303 | |||
| 304 | /** |
||
| 305 | * Verify the certificate status using OCSP. |
||
| 306 | * |
||
| 307 | * @return bool verification succeeded or failed |
||
| 308 | */ |
||
| 309 | public function verify() { |
||
| 310 | $message = []; |
||
| 311 | |||
| 312 | if (!$this->valid()) { |
||
| 313 | throw new OCSPException('Certificate expired', OCSP_CERT_EXPIRED); |
||
| 314 | } |
||
| 315 | |||
| 316 | $issuer = $this->issuer(); |
||
| 317 | if (!is_object($issuer)) { |
||
| 426 |
Loading history...
This check looks for parameters that have been defined for a function or method, but which are not used in the method body.