* Fix a bug that caused timeslices to be returned instead of the intended timeslice

* Upped version

.travis.yml

@@ -1,18 +1,15 @@
 language: php
 
-dist: trusty
-matrix:
-  include:
-    - php: 5.3
-      dist: precise
-
 php:
   - 5.4
   - 5.5
   - 5.6
   - 7.0
   - 7.1
-  - hhvm
+  - 7.2
+
+before_script:
+  - composer install
 
 script:
-  - if [[ "$TRAVIS_PHP_VERSION" == '5.6' ]]; then phpunit --coverage-text tests ; fi
+  - vendor/bin/phpunit --coverage-text tests

README.md

@@ -1,6 +1,6 @@
 # ![Logo](https://raw.githubusercontent.com/RobThree/TwoFactorAuth/master/logo.png) PHP library for Two Factor Authentication
 
-[![Build status](https://img.shields.io/travis/RobThree/TwoFactorAuth.svg?style=flat-square)](https://travis-ci.org/RobThree/TwoFactorAuth/) [![Latest Stable Version](https://img.shields.io/packagist/v/robthree/twofactorauth.svg?style=flat-square)](https://packagist.org/packages/robthree/twofactorauth) [![License](https://img.shields.io/packagist/l/robthree/twofactorauth.svg?style=flat-square)](LICENSE) [![Downloads](https://img.shields.io/packagist/dt/robthree/twofactorauth.svg?style=flat-square)](https://packagist.org/packages/robthree/twofactorauth) [![HHVM Status](https://img.shields.io/hhvm/RobThree/TwoFactorAuth.svg?style=flat-square)](http://hhvm.h4cc.de/package/robthree/twofactorauth) [![Code Climate](https://img.shields.io/codeclimate/github/RobThree/TwoFactorAuth.svg?style=flat-square)](https://codeclimate.com/github/RobThree/TwoFactorAuth) [![PayPal donate button](http://img.shields.io/badge/paypal-donate-orange.svg?style=flat-square)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=6MB5M2SQLP636 "Keep me off the streets")
+[![Build status](https://img.shields.io/travis/RobThree/TwoFactorAuth.svg?style=flat-square)](https://travis-ci.org/RobThree/TwoFactorAuth/) [![Latest Stable Version](https://img.shields.io/packagist/v/robthree/twofactorauth.svg?style=flat-square)](https://packagist.org/packages/robthree/twofactorauth) [![License](https://img.shields.io/packagist/l/robthree/twofactorauth.svg?style=flat-square)](LICENSE) [![Downloads](https://img.shields.io/packagist/dt/robthree/twofactorauth.svg?style=flat-square)](https://packagist.org/packages/robthree/twofactorauth) [![Code Climate](https://img.shields.io/codeclimate/github/RobThree/TwoFactorAuth.svg?style=flat-square)](https://codeclimate.com/github/RobThree/TwoFactorAuth) [![PayPal donate button](http://img.shields.io/badge/paypal-donate-orange.svg?style=flat-square)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=6MB5M2SQLP636 "Keep me off the streets")
 
 PHP library for [two-factor (or multi-factor) authentication](http://en.wikipedia.org/wiki/Multi-factor_authentication) using [TOTP](http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm) and [QR-codes](http://en.wikipedia.org/wiki/QR_code). Inspired by, based on but most importantly an *improvement* on '[PHPGangsta/GoogleAuthenticator](https://github.com/PHPGangsta/GoogleAuthenticator)'. There's a [.Net implementation](https://github.com/RobThree/TwoFactorAuth.Net) of this library as well.
 
@@ -10,7 +10,7 @@ PHP library for [two-factor (or multi-factor) authentication](http://en.wikipedi
 
 ## Requirements
 
-* Tested on PHP 5.3, 5.4, 5.5 and 5.6, 7.0, 7.1 and HHVM
+* Tested on PHP 5.4 up to 7.2
 * [cURL](http://php.net/manual/en/book.curl.php) when using the provided `GoogleQRCodeProvider` (default), `QRServerProvider` or `QRicketProvider` but you can also provide your own QR-code provider.
 * [random_bytes()](http://php.net/manual/en/function.random-bytes.php), [MCrypt](http://php.net/manual/en/book.mcrypt.php), [OpenSSL](http://php.net/manual/en/book.openssl.php) or [Hash](http://php.net/manual/en/book.hash.php) depending on which built-in RNG you use (TwoFactorAuth will try to 'autodetect' and use the best available); however: feel free to provide your own (CS)RNG.
 
@@ -180,11 +180,11 @@ You can easily implement your own `RNGProvider` by simply implementing the `IRNG
 
 ### Time providers
 
-Another set of providers in this library are the Time Providers; this library provides three 'built-in' ones. The default Time Provider used is the [`LocalMachineTimeProvider`](lib/Providers/Time/LocalMachineTimeProvider.php); this provider simply returns the output of `Time()` and is *highly recommended* as default provider. The [`HttpTimeProvider`](lib/Providers/Time/HttpTimeProvider.php) executes a `HEAD` request against a given webserver (default: google.com) and tries to extract the `Date:`-HTTP header and returns it's date. Other url's/domains can be used by specifying the url in the constructor. The final Time Provider is the [`ConvertUnixTimeDotComTimeProvider`](lib/Providers/Time/ConvertUnixTimeDotComTimeProvider.php) which does a HTTP request to `convert-unix-time.com/api` and decodes the `JSON` result to retrieve the time.
+Another set of providers in this library are the Time Providers; this library provides three 'built-in' ones. The default Time Provider used is the [`LocalMachineTimeProvider`](lib/Providers/Time/LocalMachineTimeProvider.php); this provider simply returns the output of `Time()` and is *highly recommended* as default provider. The [`HttpTimeProvider`](lib/Providers/Time/HttpTimeProvider.php) executes a `HEAD` request against a given webserver (default: google.com) and tries to extract the `Date:`-HTTP header and returns it's date. Other url's/domains can be used by specifying the url in the constructor. The final Time Provider is the [`NTPTimeProvider`](lib/Providers/Time/NTPTimeProvider.php) which does an NTP request to a specified NTP server.
 
 You can easily implement your own `TimeProvider` by simply implementing the `ITimeProvider` interface.
 
-As to *why* these Time Providers are implemented: it allows the TwoFactorAuth library to ensure the hosts time is correct (or rather: within a margin). You can use the `ensureCorrectTime()` method to ensure the hosts time is correct. By default this method will compare the hosts time (returned by calling `time()` on the `LocalMachineTimeProvider`) to Google's and convert-unix-time.com's current time. You can pass an array of `ITimeProvider`s and specify the `leniency` (second argument) allowed (default: 5 seconds). The method will throw when the TwoFactorAuth's timeprovider (which can be any `ITimeProvider`, see constructor) differs more than the given amount of seconds from any of the given `ITimeProviders`. We advise to call this method sparingly when relying on 3rd parties (which both the `HttpTimeProvider` and `ConvertUnixTimeDotComTimeProvider` do) or, if you need to ensure time is correct on a (very) regular basis to implement an `ITimeProvider` that is more efficient than the 'built-in' ones (like use a GPS signal). The `ensureCorrectTime()` method is mostly to be used to make sure the server is configured correctly.
+As to *why* these Time Providers are implemented: it allows the TwoFactorAuth library to ensure the hosts time is correct (or rather: within a margin). You can use the `ensureCorrectTime()` method to ensure the hosts time is correct. By default this method will compare the hosts time (returned by calling `time()` on the `LocalMachineTimeProvider`) to Google's and convert-unix-time.com's current time. You can pass an array of `ITimeProvider`s and specify the `leniency` (second argument) allowed (default: 5 seconds). The method will throw when the TwoFactorAuth's timeprovider (which can be any `ITimeProvider`, see constructor) differs more than the given amount of seconds from any of the given `ITimeProviders`. We advise to call this method sparingly when relying on 3rd parties (which both the `HttpTimeProvider` and `NTPTimeProvider` do) or, if you need to ensure time is correct on a (very) regular basis to implement an `ITimeProvider` that is more efficient than the 'built-in' ones (like use a GPS signal). The `ensureCorrectTime()` method is mostly to be used to make sure the server is configured correctly.
 
 ## Integrations
 

TwoFactorAuth.phpproj

@@ -38,10 +38,10 @@
     <Compile Include="lib\Providers\Rng\OpenSSLRNGProvider.php" />
     <Compile Include="lib\Providers\Rng\HashRNGProvider.php" />
     <Compile Include="lib\Providers\Rng\RNGException.php" />
-    <Compile Include="lib\Providers\Time\ConvertUnixTimeDotComTimeProvider.php" />
     <Compile Include="lib\Providers\Time\HttpTimeProvider.php" />
     <Compile Include="lib\Providers\Time\ITimeProvider.php" />
     <Compile Include="lib\Providers\Time\LocalMachineTimeProvider.php" />
+    <Compile Include="lib\Providers\Time\NTPTimeProvider.php" />
     <Compile Include="lib\Providers\Time\TimeException.php" />
     <Compile Include="lib\TwoFactorAuth.php" />
     <Compile Include=".gitignore" />
@@ -65,5 +65,6 @@
     <Content Include="logo.png" />
     <Content Include="multifactorauthforeveryone.png" />
     <Content Include="LICENSE" />
+    <Content Include="phpunit.xml" />
   </ItemGroup>
 </Project>

composer.json

@@ -1,7 +1,7 @@
 {
     "name": "robthree/twofactorauth",
     "description": "Two Factor Authentication",
-    "version": "1.6.1",
+    "version": "1.6.4",
     "type": "library",
     "keywords": [ "Authentication", "Two Factor Authentication", "Multi Factor Authentication", "TFA", "MFA", "PHP", "Authenticator", "Authy" ],
     "homepage": "https://github.com/RobThree/TwoFactorAuth",

lib/Providers/Rng/HashRNGProvider.php

@@ -17,7 +17,7 @@ class HashRNGProvider implements IRNGProvider
         $hash = mt_rand();
         for ($i = 0; $i < $bytecount; $i++) {
             $hash = hash($this->algorithm, $hash.mt_rand(), true);
-            $result .= $hash[mt_rand(0, sizeof($hash))];
+            $result .= $hash[mt_rand(0, strlen($hash)-1)];
         }
         return $result;
     }

lib/Providers/Rng/MCryptRNGProvider.php

@@ -11,7 +11,7 @@ class MCryptRNGProvider implements IRNGProvider
     }
     
     public function getRandomBytes($bytecount) {
-        $result = mcrypt_create_iv($bytecount, $this->source);
+        $result = @mcrypt_create_iv($bytecount, $this->source);
         if ($result === false)
             throw new \RNGException('mcrypt_create_iv returned an invalid value');
         return $result;

lib/Providers/Time/ConvertUnixTimeDotComTimeProvider.php

@@ -1,15 +0,0 @@
-<?php
-
-namespace RobThree\Auth\Providers\Time;
-
-class ConvertUnixTimeDotComTimeProvider implements ITimeProvider
-{
-    public function getTime() {
-        $json = @json_decode(
-            @file_get_contents('http://www.convert-unix-time.com/api?timestamp=now&r=' . uniqid(null, true))
-        );
-        if ($json === null || !is_int($json->timestamp))
-            throw new \TimeException('Unable to retrieve time from convert-unix-time.com');
-        return $json->timestamp;
-    }
-}

lib/Providers/Time/NTPTimeProvider.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace RobThree\Auth\Providers\Time;
+
+/**
+ * Takes the time from any NTP server
+ */
+class NTPTimeProvider implements ITimeProvider
+{
+    public $host;
+    public $port;
+    public $timeout;
+
+    function __construct($host = 'pool.ntp.org', $port = 123, $timeout = 1)
+    {
+        $this->host = $host;
+
+        if (!is_int($port) || $port <= 0 || $port > 65535)
+            throw new \TimeException('Port must be 0 < port < 65535');
+        $this->port = $port;
+
+        if (!is_int($timeout) || $timeout < 0)
+            throw new \TimeException('Timeout must be >= 0');
+        $this->timeout = $timeout;
+    }
+
+    public function getTime() {
+        try {
+            /* Create a socket and connect to NTP server */
+            $sock = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
+            socket_connect($sock, $this->host, $this->port);
+
+            /* Send request */
+            $msg = "\010" . str_repeat("\0", 47);
+            socket_send($sock, $msg, strlen($msg), 0);
+
+            /* Receive response and close socket */
+            socket_recv($sock, $recv, 48, MSG_WAITALL);
+            socket_close($sock);
+
+            /* Interpret response */
+            $data = unpack('N12', $recv);
+            $timestamp = sprintf('%u', $data[9]);
+
+            /* NTP is number of seconds since 0000 UT on 1 January 1900 Unix time is seconds since 0000 UT on 1 January 1970 */
+            return $timestamp - 2208988800;
+        }
+        catch (Exception $ex) {
+            throw new \TimeException(sprintf('Unable to retrieve time from %s (%s)', $this->host, $ex->getMessage()));
+        }
+    }
+}

lib/TwoFactorAuth.php

@@ -79,16 +79,18 @@ class TwoFactorAuth
     /**
      * Check if the code is correct. This will accept codes starting from ($discrepancy * $period) sec ago to ($discrepancy * period) sec from now
      */
-    public function verifyCode($secret, $code, $discrepancy = 1, $time = null)
+    public function verifyCode($secret, $code, $discrepancy = 1, $time = null, &$timeslice = 0)
     {
-        $result = false;
         $timetamp = $this->getTime($time);
 
         // To keep safe from timing-attachs we iterate *all* possible codes even though we already may have verified a code is correct
-        for ($i = -$discrepancy; $i <= $discrepancy; $i++)
-            $result |= $this->codeEquals($this->getCode($secret, $timetamp + ($i * $this->period)), $code);
+        for ($i = -$discrepancy; $i <= $discrepancy; $i++) {
+            $ts = $timetamp + ($i * $this->period);
+            $slice = $this->getTimeSlice($ts);
+            $timeslice += $this->codeEquals($this->getCode($secret, $ts), $code) ? $slice : 0;
+        }
 
-        return (bool)$result;
+        return $timeslice > 0;
     }
 
     /**
@@ -134,7 +136,7 @@ class TwoFactorAuth
 
         if ($timeproviders == null)
             $timeproviders = array(
-                new Providers\Time\ConvertUnixTimeDotComTimeProvider(),
+                new Providers\Time\NTPTimeProvider(),
                 new Providers\Time\HttpTimeProvider()
             );
 

phpunit.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit backupGlobals="false"
+         backupStaticAttributes="false"
+         colors="true"
+         convertErrorsToExceptions="true"
+         convertNoticesToExceptions="true"
+         convertWarningsToExceptions="true"
+         processIsolation="false"
+         stopOnFailure="false">
+  <testsuites>
+    <testsuite name="Unit">
+      <directory suffix="Test.php">./tests</directory>
+    </testsuite>
+  </testsuites>
+  <filter>
+    <whitelist processUncoveredFilesFromWhitelist="true">
+      <directory suffix=".php">./lib</directory>
+    </whitelist>
+  </filter>
+</phpunit>

tests/TwoFactorAuthTest.php

@@ -18,7 +18,7 @@ require_once 'lib/Providers/Rng/RNGException.php';
 require_once 'lib/Providers/Time/ITimeProvider.php';
 require_once 'lib/Providers/Time/LocalMachineTimeProvider.php';
 require_once 'lib/Providers/Time/HttpTimeProvider.php';
-require_once 'lib/Providers/Time/ConvertUnixTimeDotComTimeProvider.php';
+require_once 'lib/Providers/Time/NTPTimeProvider.php';
 require_once 'lib/Providers/Time/TimeException.php';
 
 use RobThree\Auth\TwoFactorAuth;
@@ -124,7 +124,8 @@ class TwoFactorAuthTest extends PHPUnit_Framework_TestCase
     public function testEnsureAllTimeProvidersReturnCorrectTime() {
         $tfa = new TwoFactorAuth('Test', 6, 30, 'sha1');
         $tfa->ensureCorrectTime(array(
-            new RobThree\Auth\Providers\Time\ConvertUnixTimeDotComTimeProvider(),
+            new RobThree\Auth\Providers\Time\NTPTimeProvider(),                         // Uses pool.ntp.org by default
+            //new RobThree\Auth\Providers\Time\NTPTimeProvider('time.google.com'),      // Somehow time.google.com and time.windows.com make travis timeout??
             new RobThree\Auth\Providers\Time\HttpTimeProvider(),                        // Uses google.com by default
             new RobThree\Auth\Providers\Time\HttpTimeProvider('https://github.com'),
             new RobThree\Auth\Providers\Time\HttpTimeProvider('https://yahoo.com'),
@@ -150,6 +151,27 @@ class TwoFactorAuthTest extends PHPUnit_Framework_TestCase
         $this->assertEquals(true , $tfa->verifyCode('VMR466AB62ZBOKHE', '543160', 2, 1426847205 - 65));	//Test discrepancy
     }
 
+    public function testVerifyCorrectTimeSliceIsReturned() {
+        $tfa = new TwoFactorAuth('Test', 6, 30);
+
+        // We test with discrepancy 3 (so total of 7 codes: c-3, c-2, c-1, c, c+1, c+2, c+3
+        // Ensure each corresponding timeslice is returned correctly
+        $this->assertEquals(true, $tfa->verifyCode('VMR466AB62ZBOKHE', '534113', 3, 1426847190, $timeslice1));
+        $this->assertEquals(47561570, $timeslice1);
+        $this->assertEquals(true, $tfa->verifyCode('VMR466AB62ZBOKHE', '819652', 3, 1426847190, $timeslice2));
+        $this->assertEquals(47561571, $timeslice2);
+        $this->assertEquals(true, $tfa->verifyCode('VMR466AB62ZBOKHE', '915954', 3, 1426847190, $timeslice3));
+        $this->assertEquals(47561572, $timeslice3);
+        $this->assertEquals(true, $tfa->verifyCode('VMR466AB62ZBOKHE', '543160', 3, 1426847190, $timeslice4));
+        $this->assertEquals(47561573, $timeslice4);
+        $this->assertEquals(true, $tfa->verifyCode('VMR466AB62ZBOKHE', '348401', 3, 1426847190, $timeslice5));
+        $this->assertEquals(47561574, $timeslice5);
+        $this->assertEquals(true, $tfa->verifyCode('VMR466AB62ZBOKHE', '648525', 3, 1426847190, $timeslice6));
+        $this->assertEquals(47561575, $timeslice6);
+        $this->assertEquals(true, $tfa->verifyCode('VMR466AB62ZBOKHE', '170645', 3, 1426847190, $timeslice7));
+        $this->assertEquals(47561576, $timeslice7);
+    }
+
     public function testTotpUriIsCorrect() {
         $qr = new TestQrProvider();
 
@@ -295,10 +317,12 @@ class TwoFactorAuthTest extends PHPUnit_Framework_TestCase
      * @requires function mcrypt_create_iv
      */
     public function testMCryptRNGProvidersReturnExpectedNumberOfBytes() {
-        $rng = new \RobThree\Auth\Providers\Rng\MCryptRNGProvider();
-        foreach ($this->getRngTestLengths() as $l)
-            $this->assertEquals($l, strlen($rng->getRandomBytes($l)));
-        $this->assertEquals(true, $rng->isCryptographicallySecure());
+        if (function_exists('mcrypt_create_iv')) {
+            $rng = new \RobThree\Auth\Providers\Rng\MCryptRNGProvider();
+            foreach ($this->getRngTestLengths() as $l)
+                $this->assertEquals($l, strlen($rng->getRandomBytes($l)));
+            $this->assertEquals(true, $rng->isCryptographicallySecure());
+        }
     }
 
     /**