Skip to content

Commit

Permalink
MDL-64723 tool_mobile: workaround for invalid certificate parsing.
Browse files Browse the repository at this point in the history
This is to account for specific server configuration that are affected
by one of the following issues, which results in certificate signature
algorithms being incorrectly parsed:

 * https://bugs.php.net/bug.php?id=77548
 * curl/curl#3706
  • Loading branch information
paulholden committed Oct 26, 2020
1 parent aed0ee0 commit e5fa5c3
Showing 1 changed file with 14 additions and 1 deletion.
15 changes: 14 additions & 1 deletion admin/tool/mobile/classes/api.php
Original file line number Diff line number Diff line change
Expand Up @@ -603,8 +603,21 @@ public static function get_potential_config_issues() {
$timenow = time();
$expectedissuer = null;
foreach ($info['certinfo'] as $cert) {

// Due to a bug in certain curl/openssl versions the signature algorithm isn't always correctly parsed.
// See https://github.com/curl/curl/issues/3706 for reference.
if (!array_key_exists('Signature Algorithm', $cert)) {
// The malformed field that does contain the algorithm we're looking for looks like the following:
// <WHITESPACE>Signature Algorithm: <ALGORITHM><CRLF><ALGORITHM>.
preg_match('/\s+Signature Algorithm: (?<algorithm>[^\s]+)/', $cert['Public Key Algorithm'], $matches);

$signaturealgorithm = $matches['algorithm'] ?? '';
} else {
$signaturealgorithm = $cert['Signature Algorithm'];
}

// Check if the signature algorithm is weak (Android won't work with SHA-1).
if ($cert['Signature Algorithm'] == 'sha1WithRSAEncryption' || $cert['Signature Algorithm'] == 'sha1WithRSA') {
if ($signaturealgorithm == 'sha1WithRSAEncryption' || $signaturealgorithm == 'sha1WithRSA') {
$warnings[] = ['insecurealgorithmwarning', 'tool_mobile'];
}
// Check certificate start date.
Expand Down

0 comments on commit e5fa5c3

Please sign in to comment.