Project

General

Profile

1
<?php
2

    
3
/*
4
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
5
 *
6
 * This program is free software: you can redistribute it and/or modify
7
 * it under the terms of the GNU General Public License as published by
8
 * the Free Software Foundation, either version 3 of the License, or
9
 * (at your option) any later version.
10
 *
11
 * This program is distributed in the hope that it will be useful,
12
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14
 * GNU General Public License for more details.
15
 *
16
 * You should have received a copy of the GNU General Public License
17
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
18
 */
19

    
20
/**
21
 * SecureTokens.php
22
 *
23
 * @category      Core
24
 * @package       Core_Security
25
 * @subpackage    WB-2.8.4 and up
26
 * @copyright     Manuela v.d.Decken <manuela@isteam.de>
27
 * @author        Manuela v.d.Decken <manuela@isteam.de>
28
 * @license       http://www.gnu.org/licenses/gpl.html   GPL License
29
 * @
30
 * @version       0.1.2
31
 * @revision      $Revision: $
32
 * @link          $HeadURL: $
33
 * @lastmodified $Date: $
34
 * @since         File available since 12.09.2015
35
 * @description
36
 * This class is a replacement for the former class SecureForm using the SecureTokensInterface
37
 *
38
 * Settings for this class
39
 * TYPE    KONSTANTE                    REGISTY-VAR                       DEFAULTWERT
40
 * boolean SEC_TOKEN_FINGERPRINT        ($oReg->SecTokenFingerprint)      [default=true]
41
 * integer SEC_TOKEN_IPV4_NETMASK       ($oReg->SecTokenIpv4Netmask)      0-255 [default=24]
42
 * integer SEC_TOKEN_IPV6_PREFIX_LENGTH ($oReg->SecTokenIpv6PrefixLength) 0-128 [default=64]
43
 * integer SEC_TOKEN_LIFE_TIME          ($oReg->SecTokenLifeTime)         1800 | 2700 | 3600[default] | 7200
44
*/
45

    
46
class SecureTokens
47
{
48
/**
49
 * possible settings for TokenLifeTime in seconds
50
 * @description seconds for 30min / 45min / 1h / 75min / 90min / 105min / 2h
51
 */
52
/** minimum lifetime in seconds */
53
    const LIFETIME_MIN  = 1800; // 30min
54
/** maximum lifetime in seconds */
55
    const LIFETIME_MAX  = 7200; // 120min (2h)
56
/** stepwidth between min and max */
57
    const LIFETIME_STEP =  900; // 15min
58
/** lifetime in seconds to use in DEBUG mode if negative value is given (-1) */
59
    const DEBUG_LIFETIME = 300; // 5
60
/** array to hold all tokens from the session */
61
    private $aTokens = array(
62
        'default' => array('value' => 0, 'expire' => 0, 'instance' => 0)
63
    );
64
/** the salt for this instance */
65
    private $sSalt            = '';
66
/** fingerprint of the current connection */
67
    private $sFingerprint     = '';
68
/** the FTAN token which is valid for this instance */
69
    private $aLastCreatedFtan = null;
70
/** the time when tokens expired if they created in this instance */
71
    private $iExpireTime      = 0;
72
/** remove selected tokens only and update all others */
73
    private $bPreserveAllOtherTokens = false;
74
/** id of the current instance */
75
    private $sCurrentInstance  = null;
76
/** id of the instance to remove */
77
    private $sInstanceToDelete = null;
78
/** id of the instance to update expire time */
79
    private $sInstanceToUpdate = null;
80
/* --- settings for SecureTokens ------------------------------------------------------ */
81
/** use fingerprinting to encode */
82
    private $bUseFingerprint = true;
83
/** maximum lifetime of a token in seconds */
84
    private $iTokenLifeTime   = 1800; // between LIFETIME_MIN and LIFETIME_MAX (default = 30min)
85
/** bit length of the IPv4 Netmask (0-32 // 0 = off  default = 24) */
86
    private $iNetmaskLengthV4 = 0;
87
/** bit length of the IPv6 Netmask (0-128 // 0 = off  default = 64) */
88
    private $iNetmaskLengthV6 = 0;
89

    
90
/**
91
 * constructor
92
 * @param (void)
93
 */
94
    protected function __construct()
95
    {
96
    // load settings if available
97
        $this->getSettings();
98
    // generate salt for calculations in this instance
99
        $this->sSalt        = $this->generateSalt();
100
    // generate fingerprint for the current connection
101
        $this->sFingerprint = $this->buildFingerprint();
102
    // define the expiretime for this instance
103
        $this->iExpireTime  = time() + $this->iTokenLifeTime;
104
    // calculate the instance id for this instance
105
        $this->sCurrentInstance = $this->encodeHash(md5($this->iExpireTime.$this->sSalt));
106
    // load array of tokens from session
107
        $this->loadTokens();
108
    // at first of all remove expired tokens
109
        $this->removeExpiredTokens();
110
    }
111

    
112
/**
113
 * destructor
114
 */
115
    final public function __destruct()
116
    {
117
        foreach ($this->aTokens as $sKey => $aToken) {
118
            if ($aToken['instance'] == $this->sInstanceToUpdate) {
119
                $this->aTokens[$sKey]['instance'] = $this->sCurrentInstance;
120
                $this->aTokens[$sKey]['expire']   = $this->iExpireTime;
121
            } elseif ($aToken['instance'] == $this->sInstanceToDelete) {
122
                unset($this->aTokens[$sKey]);
123
            }
124
        }
125
        $this->saveTokens();
126
    }
127

    
128
/**
129
 * returns all TokenLifeTime values
130
 * @return array
131
 */
132
    final public function getTokenLifeTime()
133
    {
134
        return array(
135
            'min'   => self::LIFETIME_MIN,
136
            'max'   => self::LIFETIME_MAX,
137
            'step'  => self::LIFETIME_STEP,
138
            'value' => $this->iTokenLifeTime
139
        );
140
    }
141

    
142
/**
143
 * Dummy method for backward compatibility
144
 * @return void
145
 * @deprecated from WB-2.8.3-SP5
146
 */
147
    final public function createFTAN()
148
    {
149
        trigger_error('Deprecated function call: '.__CLASS__.'::'.__METHOD__, E_USER_DEPRECATED);
150
    } // do nothing
151

    
152
/**
153
 * Dummy method for backward compatibility
154
 * @return void
155
 * @deprecated from WB-2.8.3-SP5
156
 */
157
    final public function clearIDKEY()
158
    {
159
        trigger_error('Deprecated function call: '.__CLASS__.'::'.__METHOD__, E_USER_DEPRECATED);
160
    } // do nothing
161

    
162
/**
163
 * returns the current FTAN
164
 * @param bool $mode: true or POST returns a complete prepared, hidden HTML-Input-Tag (default)
165
 *                     false or GET returns an GET argument 'key=value'
166
 * @return mixed:     array or string
167
 * @deprecated the param $mMode is set deprecated
168
 *              string retvals are set deprecated. From versions after 2.8.4 retval will be array only
169
 */
170
    final public function getFTAN($mMode = 'POST')
171
    {
172
        if (is_null($this->aLastCreatedFtan)) {
173
            $sFtan = md5($this->sSalt);
174
            $this->aLastCreatedFtan = $this->addToken(
175
                substr($sFtan, rand(0,15), 16),
176
                substr($sFtan, rand(0,15), 16)
177
            );
178
        }
179
        $aFtan = $this->aTokens[$this->aLastCreatedFtan];
180
        $aFtan['name']  = $this->aLastCreatedFtan;
181
        $aFtan['value'] = $this->encodeHash(md5($aFtan['value'].$this->sFingerprint));
182
        if (is_string($mMode)) {
183
            $mMode = strtoupper($mMode);
184
        } else {
185
            $mMode = $mMode === true ? 'POST' : 'GET';
186
        }
187
        switch ($mMode):
188
            case 'POST':
189
                return '<input type="hidden" name="'.$aFtan['name'].'" value="'
190
                      .$aFtan['value'].'" title="">';
191
                break;
192
            case 'GET':
193
                return $aFtan['name'].'='.$aFtan['value'];
194
                break;
195
            default:
196
                return array('name' => $aFtan['name'], 'value' => $aFtan['value']);
197
        endswitch;
198
    }
199

    
200
/**
201
 * checks received form-transactionnumbers against session-stored one
202
 * @param string $mode: requestmethode POST(default) or GET
203
 * @param bool $bPreserve (default=false)
204
 * @return bool:    true if numbers matches against stored ones
205
 *
206
 * requirements: an active session must be available
207
 * this check will prevent from multiple sending a form. history.back() also will never work
208
 */
209
    final public function checkFTAN($mMode = 'POST', $bPreserve = false)
210
    {
211
        $bRetval = false;
212
        $this->bPreserveAllOtherTokens = $bPreserve ?: $this->bPreserveAllOtherTokens;
213
        // get the POST/GET arguments
214
        $aArguments = (strtoupper($mMode) == 'POST' ? $_POST : $_GET);
215
        // encode the value of all matching tokens
216
        $aMatchingTokens = array_map(
217
            function ($aToken) {
218
                return $this->encodeHash(md5($aToken['value'].$this->sFingerprint));
219
            },
220
            // extract all matching tokens from $this->aTokens
221
            array_intersect_key($this->aTokens, $aArguments)
222
        );
223
        // extract all matching arguments from $aArguments
224
        $aMatchingArguments = array_intersect_key($aArguments, $this->aTokens);
225
        // get all tokens with matching values from match lists
226
        $aHits = array_intersect($aMatchingTokens, $aMatchingArguments);
227
        foreach ($aHits as $sTokenName => $sValue) {
228
            $bRetval = true;
229
            $this->removeToken($sTokenName);
230
        }
231
        return $bRetval;
232
    }
233
/**
234
 * store value in session and returns an accesskey to it
235
 * @param mixed $mValue can be numeric, string or array
236
 * @return string
237
 */
238
    final public function getIDKEY($mValue)
239
    {
240
        if (is_array($mValue) == true) {
241
            // serialize value, if it's an array
242
            $mValue = serialize($mValue);
243
        }
244
        // crypt value with salt into md5-hash and return a 16-digit block from random start position
245
        $sTokenName = $this->addToken(
246
            substr(md5($this->sSalt.(string)$mValue), rand(0,15), 16),
247
            $mValue
248
        );
249
        return $sTokenName;
250
    }
251

    
252
/*
253
 * search for key in session and returns the original value
254
 * @param string $sFieldname: name of the POST/GET-Field containing the key or hex-key itself
255
 * @param mixed $mDefault: returnvalue if key not exist (default 0)
256
 * @param string $sRequest: requestmethode can be POST or GET or '' (default POST)
257
 * @param bool $bPreserve (default=false)
258
 * @return mixed: the original value (string, numeric, array) or DEFAULT if request fails
259
 * @description: each IDKEY can be checked only once. Unused Keys stay in list until they expire
260
 */
261
    final public function checkIDKEY($sFieldname, $mDefault = 0, $sRequest = 'POST', $bPreserve = false)
262
    {
263
        $mReturnValue = $mDefault; // set returnvalue to default
264
        $this->bPreserveAllOtherTokens = $bPreserve ?: $this->bPreserveAllOtherTokens;
265
        $sRequest = strtoupper($sRequest);
266
        switch ($sRequest) {
267
            case 'POST':
268
            case 'GET':
269
                $sTokenName = @$GLOBALS['_'.$sRequest][$sFieldname] ?: $sFieldname;
270
                break;
271
            default:
272
                $sTokenName = $sFieldname;
273
        }
274
        if (preg_match('/[0-9a-f]{16}$/i', $sTokenName)) {
275
        // key must be a 16-digit hexvalue
276
            if (array_key_exists($sTokenName, $this->aTokens)) {
277
            // check if key is stored in IDKEYs-list
278
                $mReturnValue = $this->aTokens[$sTokenName]['value']; // get stored value
279
                $this->removeToken($sTokenName);   // remove from list to prevent multiuse
280
                if (preg_match('/.*(?<!\{).*(\d:\{.*;\}).*(?!\}).*/', $mReturnValue)) {
281
                // if value is a serialized array, then deserialize it
282
                    $mReturnValue = unserialize($mReturnValue);
283
                }
284
            }
285
        }
286
        return $mReturnValue;
287
    }
288

    
289
/**
290
 * make a valid LifeTime value from given integer on the rules of class SecureTokens
291
 * @param integer  $iLifeTime
292
 * @return integer
293
 */
294
    final public function sanitizeLifeTime($iLifeTime)
295
    {
296
        $iLifeTime = intval($iLifeTime);
297
        for ($i = self::LIFETIME_MIN; $i <= self::LIFETIME_MAX; $i += self::LIFETIME_STEP) {
298
            $aLifeTimes[] = $i;
299
        }
300
        $iRetval = array_pop($aLifeTimes);
301
        foreach ($aLifeTimes as $iValue) {
302
            if ($iLifeTime <= $iValue) {
303
                $iRetval = $iValue;
304
                break;
305
            }
306
        }
307
        return $iRetval;
308
    }
309
/* ************************************************************************************ */
310
/* *** from here private methods only                                               *** */
311
/* ************************************************************************************ */
312
/**
313
 * load all tokens from session
314
 */
315
    private function loadTokens()
316
    {
317
        if (isset($_SESSION['TOKENS'])) {
318
            $this->aTokens = unserialize($_SESSION['TOKENS']);
319
        } else {
320
            $this->saveTokens();
321
        }
322
    }
323

    
324
/**
325
 * save all tokens into session
326
 */
327
    private function saveTokens()
328
    {
329
        $_SESSION['TOKENS'] = serialize($this->aTokens);
330
    }
331

    
332
/**
333
 * add new token to the list
334
 * @param string $sTokenName
335
 * @param string $sValue
336
 * @return string  name(index) of the token
337
 */
338
    private function addToken($sTokenName, $sValue)
339
    {
340
        $sTokenName = substr($sTokenName, 0, 16);
341
        $sTokenName[0] = dechex(10 + (hexdec($sTokenName[0]) % 5));
342
        while (isset($this->aTokens[$sTokenName])) {
343
            $sTokenName = sprintf('%16x', hexdec($sTokenName)+1);
344
        }
345
        $this->aTokens[$sTokenName] = array(
346
            'value'    => $sValue,
347
            'expire'   => $this->iExpireTime,
348
            'instance' => $this->sCurrentInstance
349
        );
350
        return $sTokenName;
351
    }
352

    
353
/**
354
 * remove the token, called sTokenName from list
355
 * @param type $sTokenName
356
 */
357
    private function removeToken($sTokenName)
358
    {
359
        if (isset($this->aTokens[$sTokenName])) {
360
            if ($this->bPreserveAllOtherTokens) {
361
                if ($this->sInstanceToDelete) {
362
                    $this->sInstanceToUpdate = $this->sInstanceToDelete;
363
                    $this->sInstanceToDelete = null;
364
                } else {
365
                    $this->sInstanceToUpdate = $this->aTokens[$sTokenName]['instance'];
366
                }
367
            } else {
368
                $this->sInstanceToDelete = $this->aTokens[$sTokenName]['instance'];
369
            }
370
            unset($this->aTokens[$sTokenName]);
371
        }
372
    }
373

    
374
/**
375
 * remove all expired tokens from list
376
 */
377
    private function removeExpiredTokens()
378
    {
379
        $iTimestamp = time();
380
        foreach ($this->aTokens as $sTokenName => $aToken) {
381
            if ($aToken['expire'] <= $iTimestamp && $aToken['expire'] != 0){
382
                unset($this->aTokens[$sTokenName]);
383
            }
384
        }
385
    }
386

    
387
/**
388
 * generate a runtime depended hash
389
 * @return string  md5 hash
390
 */
391
    private function generateSalt()
392
    {
393
        list($fUsec, $fSec) = explode(" ", microtime());
394
        $sSalt = (string)rand(10000, 99999)
395
               . (string)((float)$fUsec + (float)$fSec)
396
               . (string)rand(10000, 99999);
397
        return md5($sSalt);
398
    }
399

    
400
/**
401
 * build a simple fingerprint
402
 * @return string
403
 */
404
    private function buildFingerprint()
405
    {
406
        if (!$this->bUseFingerprint) { return md5('this_is_a_dummy_only'); }
407
        $sClientIp = '127.0.0.1';
408
        if (array_key_exists('HTTP_X_FORWARDED_FOR', $_SERVER)){
409
            $sClientIp = array_pop(preg_split('/\s*?,\s*?/', $_SERVER['HTTP_X_FORWARDED_FOR'], null, PREG_SPLIT_NO_EMPTY));
410
        }else if (array_key_exists('REMOTE_ADDR', $_SERVER)) {
411
            $sClientIp = $_SERVER['REMOTE_ADDR'];
412
        }else if (array_key_exists('HTTP_CLIENT_IP', $_SERVER)) {
413
            $sClientIp = $_SERVER['HTTP_CLIENT_IP'];
414
        }
415
        return
416
            __FILE__.PHP_VERSION
417
          . isset($_SERVER['SERVER_SIGNATURE']) ? $_SERVER['SERVER_SIGNATURE'] : 'unknown'
418
          . isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : 'AGENT'
419
          . $this->calcClientIpHash($sClientIp)
420
        ;
421
    }
422

    
423
/**
424
 * mask IPv4 as well IPv6 addresses with netmask and make a md5 hash from
425
 * @param string $sClientIp IP as string from $_SERVER['REMOTE_ADDR']
426
 * @return md5 value of masked ip
427
 * @description this method does not accept the IPv6/IPv4 mixed format
428
 *               like "2222:3333:4444:5555:6666:7777:192.168.1.200"
429
 */
430
    private function calcClientIpHash($sRawIp)
431
    {
432
        // clean address from netmask/prefix and port
433
        $sPattern = '/^\[?([.:a-f0-9]*)(?:\/[0-1]*)?(?:\]?.*)$/im';
434
        $sRawIp = preg_replace($sPattern, '$1', $sRawIp);
435
        if (strpos($sRawIp, ':') === false) {
436
// sanitize IPv4 ---------------------------------------------------------------------- //
437
            $iIpV4 = ip2long($sRawIp);
438
            // calculate netmask
439
            $iMask = ($this->iNetmaskLengthV4 < 1)
440
                ? 0
441
                : bindec(
442
                    str_repeat('1', $this->iNetmaskLengthV4).
443
                    str_repeat('0', 32 - $this->iNetmaskLengthV4)
444
                );
445
            // apply mask and reformat to IPv4 string notation.
446
            $sIp = long2ip($iIpV4 & $iMask);
447
        } else {
448
// sanitize IPv6 ---------------------------------------------------------------------- //
449
            // check if IP includes a IPv4 part and convert this into IPv6 format
450
            $sPattern = '/^([:a-f0-9]*?)\:([0-9]{1,3}(?:\.[0-9]{1,3}){3})$/is';
451
            if (preg_match($sPattern, $sRawIp, $aMatches)) {
452
                $sIpV4Bin = str_pad((string)decbin(ip2long($aMatches[2])), 32, '0', STR_PAD_LEFT) ;
453
                $aIpV6Hex = str_split($sIpV4Bin, 16);
454
                $sRawIp = $aMatches[1].':'.dechex(bindec($aIpV6Hex[0])).':'.dechex(bindec($aIpV6Hex[1]));
455
            }
456
            // calculate number of missing words
457
            $iWords = 8 - count(preg_split('/:/', $sRawIp, null, PREG_SPLIT_NO_EMPTY));
458
            // build replacement for '::'
459
            $sReplacement = $iWords ? implode(':', array_fill(0, $iWords, '0000')) : '';
460
            // insert replacements and remove trailing/leading ':'
461
            $sClientIp = trim(preg_replace('/\:\:/', ':'.$sReplacement.':', $sRawIp), ':');
462
            // split all 8 parts from IP into an array
463
            $aIpV6 = array_map(
464
                function($sPart) {
465
                    // expand all parts to 4 hex digits using leading '0'
466
                    return str_pad($sPart, 4, '0', STR_PAD_LEFT);
467
                },
468
                preg_split('/:/', $sClientIp)
469
            );
470
            // build binary netmask from iNetmaskLengthV6
471
            // and split all 8 parts into an array
472
            if ($this->iNetmaskLengthV6 < 1) {
473
                $aMask = array_fill(0, 8, str_repeat('0', 16));
474
            } else {
475
                $aMask = str_split(
476
                    str_repeat('1', $this->iNetmaskLengthV6).
477
                    str_repeat('0', 128 - $this->iNetmaskLengthV6),
478
                    16
479
                );
480
            }
481
            // iterate all IP parts, apply its mask and reformat to IPv6 string notation.
482
            array_walk(
483
                $aIpV6,
484
                function(&$sWord, $iIndex) use ($aMask) {
485
                    $sWord = sprintf('%04x', hexdec($sWord) & bindec($aMask[$iIndex]));
486
                }
487
            );
488
            // reformat to IPv6 string notation.
489
            $sIp = implode(':', $aIpV6);
490
// ------------------------------------------------------------------------------------ //
491
        }
492
        return md5($sIp); // return the hashed IP string
493
    }
494

    
495
/**
496
 * encode a hex string into a 64char based string
497
 * @param string $sMd5Hash
498
 * @return string
499
 * @description reduce the 32char length of a MD5 to 22 chars
500
 */
501
    private function encodeHash($sMd5Hash)
502
    {
503
        return rtrim(base64_encode(pack('h*',$sMd5Hash)), '+-= ');
504
    }
505

    
506
/**
507
 * read settings if available
508
 */
509
    private function getSettings()
510
    {
511
        $this->bUseFingerprint  = isset($this->oReg->SecTokenFingerprint)
512
                                  ? $this->oReg->SecTokenFingerprint
513
                                  : $this->bUseFingerprint;
514
        $this->iNetmaskLengthV4 = isset($this->oReg->SecTokenNetmask4)
515
                                  ? $this->oReg->SecTokenNetmask4
516
                                  : $this->iNetmaskLengthV4;
517
        $this->iNetmaskLengthV6 = isset($this->oReg->SecTokenNetmask6)
518
                                  ? $this->oReg->SecTokenNetmask6
519
                                  : $this->iNetmaskLengthV6;
520
        $this->iTokenLifeTime   = isset($this->oReg->SecTokenLifeTime)
521
                                  ? $this->oReg->SecTokenLifeTime
522
                                  : $this->iTokenLifeTime;
523
        $this->iNetmaskLengthV4 = ($this->iNetmaskLengthV4 < 1 || $this->iNetmaskLengthV4 > 32)
524
                                  ? 0 :$this->iNetmaskLengthV4;
525
        $this->iNetmaskLengthV6 = ($this->iNetmaskLengthV6 < 1 || $this->iNetmaskLengthV6 > 128)
526
                                  ? 0 :$this->iNetmaskLengthV6;
527
        $this->iTokenLifeTime   = $this->sanitizeLifeTime($this->iTokenLifeTime);
528
        if ($this->iTokenLifeTime <= self::LIFETIME_MIN && DEBUG) {
529
            $this->iTokenLifeTime = self::DEBUG_LIFETIME;
530
        }
531
    }
532

    
533

    
534
} // end of class SecureTokens
(11-11/40)