core\SilverbulletCertificate::revokeCertificate()

Complexity

Conditions	9
Paths	35

Size

Total Lines	57
Code Lines	38

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function revokeCertificate() {
        $nowSql = (new \DateTime())->format("Y-m-d H:i:s");
        // regardless if embedded or not, always keep local state in our own DB
        $this->databaseHandle->exec("UPDATE silverbullet_certificate SET revocation_status = 'REVOKED', revocation_time = ? WHERE serial_number = ? AND ca_type = ?", "sis", $nowSql, $this->serial, $this->ca_type);
        $this->loggerInstance->debug(2, "Certificate revocation status for $this->serial updated, about to call triggerNewOCSPStatement().\n");
        // newly instantiate us, DB content has changed...
        $certObject = new SilverbulletCertificate((string) $this->serial, $this->ca_type);
        // embedded CA does "nothing special" for revocation: the DB change was the entire thing to do
        // but for external CAs, we need to notify explicitly that the cert is now revoked
        switch (CONFIG_CONFASSISTANT['SILVERBULLET']['CA']['type']) {
            case "embedded":
                $certObject->triggerNewOCSPStatement();
                break;
            case "eduPKI":
                try {
                    $soap = SilverbulletCertificate::initEduPKISoapSession("RA");
                    $soapRevocationSerial = $soap->newRevocationRequest(["Serial", $certObject->serial], "");
                    if ($soapRevocationSerial == 0) {
                        throw new Exception("Unable to create revocation request, serial number was zero.");
                    }
                    // retrieve the raw request to prepare for signature and approval
                    $soapRawRevRequest = $soap->getRawRevocationRequest($soapRevocationSerial);
                    if (strlen($soapRawRevRequest) < 10) { // very basic error handling
                        throw new Exception("Suspiciously short data to sign!");
                    }
                    // for obnoxious reasons, we have to dump the request into a file and let pkcs7_sign read from the file
                    // rather than just using the string. Grr.
                    $tempdir = \core\common\Entity::createTemporaryDirectory("test");
                    file_put_contents($tempdir['dir'] . "/content.txt", $soapRawRevRequest);
                    // retrieve our RA cert from filesystem
                    // sign the data, using cmdline because openssl_pkcs7_sign produces strange results
                    // -binary didn't help, nor switch -md to sha1 sha256 or sha512
                    $this->loggerInstance->debug(5, "Actual content to be signed is this:\n$soapRawRevRequest\n");
                    $execCmd = CONFIG['PATHS']['openssl'] . " smime -sign -binary -in " . $tempdir['dir'] . "/content.txt -out " . $tempdir['dir'] . "/signature.txt -outform pem -inkey " . ROOT . "/config/SilverbulletClientCerts/edupki-test-ra.clearkey -signer " . ROOT . "/config/SilverbulletClientCerts/edupki-test-ra.pem";
                    $this->loggerInstance->debug(2, "Calling openssl smime with following cmdline: $execCmd\n");
                    $output = [];
                    $return = 999;
                    exec($execCmd, $output, $return);
                    if ($return !== 0) {
                        throw new Exception("Non-zero return value from openssl smime!");
                    }
                    // and get the signature blob back from the filesystem
                    $detachedSig = trim(file_get_contents($tempdir['dir'] . "/signature.txt"));
                    $soapIssueRev = $soap->approveRevocationRequest($soapRevocationSerial, $soapRawRevRequest, $detachedSig);
                    if ($soapIssueRev === FALSE) {
                        throw new Exception("The locally approved revocation request was NOT processed by the CA.");
                    }
                } catch (Exception $e) {
                    // PHP 7.1 can do this much better
                    if (is_soap_fault($e)) {
                        throw new Exception("Error when sending SOAP request: " . "{$e->faultcode}: {$e->faultstring}\n");
                    }
                    throw new Exception("Something odd happened while doing the SOAP request:" . $e->getMessage());
                }
                break;
            default:
                throw new Exception("Unknown type of CA requested!");
        }