core\SilverbulletCertificate::revokeCertificate()

Complexity

Conditions	9
Paths	35

Size

Total Lines	55
Code Lines	35

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function revokeCertificate() {
        $nowSql = (new \DateTime())->format("Y-m-d H:i:s");
        // regardless if embedded or not, always keep local state in our own DB
        $this->databaseHandle->exec("UPDATE silverbullet_certificate SET revocation_status = 'REVOKED', revocation_time = ? WHERE serial_number = ?", "si", $nowSql, $this->serial);
        $this->loggerInstance->debug(2, "Certificate revocation status for $this->serial updated, about to call triggerNewOCSPStatement().\n");
        // newly instantiate us, DB content has changed...
        $certObject = new SilverbulletCertificate($this->serial);
        // embedded CA does "nothing special" for revocation: the DB change was the entire thing to do
        // but for external CAs, we need to notify explicitly that the cert is now revoked
        switch (CONFIG_CONFASSISTANT['SILVERBULLET']['CA']['type']) {
            case "embedded":
                break;
            case "eduPKI":
                try {
                    $soap = SilverbulletCertificate::initEduPKISoapSession();
                    $soapRevocationSerial = $soap->newRevocationRequest($this->serial, "");
                    if ($soapRevocationSerial == 0) {
                        throw new Exception("Unable to create revocation request, serial number was zero.");
                    }
                    // retrieve the raw request to prepare for signature and approval
                    $soapRawRevRequest = $soap->getRawRevocationRequest($soapRevocationSerial);
                    if (strlen($soapRawRevRequest) < 10) { // very basic error handling
                        throw new Exception("Suspiciously short data to sign!");
                    }
                    // for obnoxious reasons, we have to dump the request into a file and let pkcs7_sign read from the file
                    // rather than just using the string. Grr.
                    $tempdir = \core\common\Entity::createTemporaryDirectory("test");
                    file_put_contents($tempdir['dir'] . "/content.txt", $soapRawRevRequest);
                    // retrieve our RA cert from filesystem
                    $raCertFile = file_get_contents(ROOT . "../edupki-test-ra.pem");
                    $raCert = openssl_x509_read($raCertFile);
                    $raKey = openssl_pkey_get_private("file://" . ROOT . "../edupki-test-ra.clearkey");
                    // sign the data
                    if (openssl_pkcs7_sign($tempdir['dir'] . "/content.txt", $tempdir['dir'] . "/signature.txt", $raCert, $raKey) === FALSE) {

The call to openssl_pkcs7_sign() has too few arguments starting with headers.

                        throw new Exception("Unable to sign the revocation approval data!");
                    }
                    // and get the signature blob back from the filesystem
                    $detachedSig = file_get_contents($tempdir['dir'] . "/signature.txt");
                    $soapIssueRev = $soap->approveRevocationRequest($soapRevocationSerial, $soapRawRevRequest, $detachedSig);
                    if ($soapIssueRev === FALSE) {
                        throw new Exception("The locally approved revocation request was NOT processed by the CA.");
                    }
                } catch (Exception $e) {
                    // PHP 7.1 can do this much better
                    if (is_soap_fault($e)) {
                        throw new Exception("Error when sending SOAP request: " . "{$e->faultcode}: {$e->faultstring}\n");
                    }
                    throw new Exception("Something odd happened while doing the SOAP request:", $e->getMessage());

$e->getMessage() of type string is incompatible with the type integer expected by parameter $code of Exception::__construct().

                }
                break;
            default:
                throw new Exception("Unknown type of CA requested!");
        }
        // what happens wrt OCSP etc. is really something for the following function to decide. We just call it.
        $certObject->triggerNewOCSPStatement();
    }