core\SilverbulletCertificate::signCsr()

Complexity

Conditions	17
Paths	119

Size

Total Lines	170
Code Lines	122

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    private static function signCsr($csr, $expiryDays) {
        $loggerInstance = new common\Logging();
        $databaseHandle = DBConnection::handle("INST");
        switch (CONFIG_CONFASSISTANT['SILVERBULLET']['CA']['type']) {
            case "embedded":
                $rootCaPem = file_get_contents(ROOT . "/config/SilverbulletClientCerts/rootca.pem");
                $raCertFile = file_get_contents(ROOT . "/config/SilverbulletClientCerts/real.pem");
                $raCert = openssl_x509_read($raCertFile);
                $raKey = openssl_pkey_get_private("file://" . ROOT . "/config/SilverbulletClientCerts/real.key");
                $nonDupSerialFound = FALSE;
                do {
                    $serial = random_int(1000000000, PHP_INT_MAX);
                    $dupeQuery = $databaseHandle->exec("SELECT serial_number FROM silverbullet_certificate WHERE serial_number = ?", "i", $serial);
                    // SELECT -> resource, not boolean
                    if (mysqli_num_rows(/** @scrutinizer ignore-type */$dupeQuery) == 0) {
                        $nonDupSerialFound = TRUE;
                    }
                } while (!$nonDupSerialFound);
                $loggerInstance->debug(5, "generateCertificate: signing imminent with unique serial $serial.\n");
                return [
                    "CERT" => openssl_csr_sign($csr["CSR"], $raCert, $raKey, $expiryDays, ['digest_alg' => 'sha256'], $serial),
                    "SERIAL" => $serial,
                    "ISSUER" => $raCertFile,
                    "ROOT" => $rootCaPem,
                ];
            case "eduPKI":
                // initialse connection to eduPKI CA / eduroam RA and send the request to them
                try {
                    $altArray = [# Array mit den Subject Alternative Names
                        "email:" . $csr["USERNAME"]
                    ];
                    $soapPub = SilverbulletCertificate::initEduPKISoapSession("PUBLIC");
                    $loggerInstance->debug(5, "FIRST ACTUAL SOAP REQUEST (Public, newRequest)!\n");
                    $loggerInstance->debug(5, "PARAM_1: " . SilverbulletCertificate::EDUPKI_RA_ID . "\n");
                    $loggerInstance->debug(5, "PARAM_2: " . $csr["CSR"] . "\n");
                    $loggerInstance->debug(5, "PARAM_3: ");
                    $loggerInstance->debug(5, $altArray);
                    $loggerInstance->debug(5, "PARAM_4: " . SilverbulletCertificate::EDUPKI_CERT_PROFILE . "\n");
                    $loggerInstance->debug(5, "PARAM_5: " . sha1("notused") . "\n");
                    $loggerInstance->debug(5, "PARAM_6: " . $csr["USERNAME"] . "\n");
                    $loggerInstance->debug(5, "PARAM_7: " . $csr["USERNAME"] . "\n");
                    $loggerInstance->debug(5, "PARAM_8: " . ProfileSilverbullet::PRODUCTNAME . "\n");
                    $loggerInstance->debug(5, "PARAM_9: false\n");
                    $soapNewRequest = $soapPub->newRequest(
                            SilverbulletCertificate::EDUPKI_RA_ID, # RA-ID
                            $csr["CSR"], # Request im PEM-Format
                            $altArray, # altNames
                            SilverbulletCertificate::EDUPKI_CERT_PROFILE, # Zertifikatprofil
                            sha1("notused"), # PIN
                            $csr["USERNAME"], # Name des Antragstellers
                            $csr["USERNAME"], # Kontakt-E-Mail
                            ProfileSilverbullet::PRODUCTNAME, # Organisationseinheit des Antragstellers
                            false                   # Veröffentlichen des Zertifikats?
                    );
                    $loggerInstance->debug(5, $soapPub->__getLastRequest());
                    $loggerInstance->debug(5, $soapPub->__getLastResponse());
                    if ($soapNewRequest == 0) {
                        throw new Exception("Error when sending SOAP request (request serial number was zero). No further details available.");
                    }
                    $soapReqnum = intval($soapNewRequest);
                } catch (Exception $e) {
                    // PHP 7.1 can do this much better
                    if (is_soap_fault($e)) {
                        throw new Exception("Error when sending SOAP request: " . "{$e->faultcode}: {$e->faultstring}\n");
                    }
                    throw new Exception("Something odd happened while doing the SOAP request:" . $e->getMessage());
                }
                try {
                    $soap = SilverbulletCertificate::initEduPKISoapSession("RA");
                    // tell the CA the desired expiry date of the new certificate
                    $expiry = new \DateTime();
                    $expiry->modify("+$expiryDays day");
                    $expiry->setTimezone(new \DateTimeZone("UTC"));
                    $soapExpiryChange = $soap->setRequestParameters(
                            $soapReqnum, [
                        "RaID" => SilverbulletCertificate::EDUPKI_RA_ID,
                        "Role" => SilverbulletCertificate::EDUPKI_CERT_PROFILE,
                        "Subject" => "DC=eduroam,DC=test,DC=test,C=" . $csr["FED"] . ",O=" . CONFIG_CONFASSISTANT['CONSORTIUM']['name'] . ",OU=" . $csr["FED"] . ",CN=" . $csr['USERNAME'] . ",emailAddress=" . $csr['USERNAME'],
                        "SubjectAltNames" => ["email:" . $csr["USERNAME"]],
                        "NotBefore" => (new \DateTime())->format('c'),
                        "NotAfter" => $expiry->format('c'),
                            ]
                    );
                    if ($soapExpiryChange === FALSE) {
                        throw new Exception("Error when sending SOAP request (unable to change expiry date).");
                    }
                    // retrieve the raw request to prepare for signature and approval
                    // this seems to come out base64-decoded already; maybe PHP
                    // considers this "convenience"? But we need it as sent on
                    // the wire, so re-encode it!
                    $soapCleartext = $soap->getRawRequest($soapReqnum);
                    
                    $loggerInstance->debug(5, "Actual received SOAP resonse for getRawRequest was:\n\n");
                    $loggerInstance->debug(5, $soap->__getLastResponse());
                    // for obnoxious reasons, we have to dump the request into a file and let pkcs7_sign read from the file
                    // rather than just using the string. Grr.
                    $tempdir = \core\common\Entity::createTemporaryDirectory("test");
                    file_put_contents($tempdir['dir'] . "/content.txt", $soapCleartext);
                    // retrieve our RA cert from filesystem
                    $raCertFile = file_get_contents(ROOT . "/config/SilverbulletClientCerts/edupki-test-ra.pem");
                    $raCert = openssl_x509_read($raCertFile);

The assignment to $raCert is dead and can be removed.

                    $raKey = openssl_pkey_get_private("file://" . ROOT . "/config/SilverbulletClientCerts/edupki-test-ra.clearkey");

The assignment to $raKey is dead and can be removed.

                    // sign the data, using cmdline because openssl_pkcs7_sign produces strange results
                    // -binary didn't help, nor switch -md to sha1 sha256 or sha512
                    $loggerInstance->debug(5, "Actual content to be signed is this:\n$soapCleartext\n");
                    $execCmd = CONFIG['PATHS']['openssl'] . " smime -sign -in " . $tempdir['dir'] . "/content.txt -out " . $tempdir['dir'] . "/signature.txt -outform pem -inkey " . ROOT . "/config/SilverbulletClientCerts/edupki-test-ra.clearkey -signer " . ROOT . "/config/SilverbulletClientCerts/edupki-test-ra.pem";
                    $loggerInstance->debug(2, "Calling openssl smime with following cmdline: $execCmd\n");
                    $output = [];
                    $return = 999;
                    exec($execCmd, $output, $return);
                    if ($return !== 0) {
                        throw new Exception("Non-zero return value from openssl smime!");
                    }
                    // and get the signature blob back from the filesystem
                    $detachedSig = trim(file_get_contents($tempdir['dir'] . "/signature.txt"));
                    $loggerInstance->debug(5, "Request for server approveRequest has parameters:\n");
                    $loggerInstance->debug(5, $soapReqnum . "\n");
                    $loggerInstance->debug(5, $soapCleartext . "\n"); // PHP magically encodes this as base64 while sending!
                    $loggerInstance->debug(5, $detachedSig . "\n");
                    $soapIssueCert = $soap->approveRequest($soapReqnum, $soapCleartext, $detachedSig);
                    $loggerInstance->debug(5,"approveRequest Request was: \n".$soap->__getLastRequest());
                    $loggerInstance->debug(5,"approveRequest Response was: \n".$soap->__getLastResponse());
                    if ($soapIssueCert === FALSE) {
                        throw new Exception("The locally approved request was NOT processed by the CA.");
                    }
                    // now, get the actual cert from the CA
                    $soapCert = $soap->getCertificateByRequestSerial($soapReqnum);
                    $x509 = new common\X509();
                    $parsedCert = $x509->processCertificate($soapCert);
                    if (!is_array($parsedCert)) {

The condition is_array($parsedCert) is always false.

                        throw new Exception("We did not actually get a certificate.");
                    }
                    // let's get the CA certificate chain
                    $caInfo = $soap->getCAInfo();
                    $certList = $x509->splitCertificate($caInfo['CAChain']);
                    // find the root
                    $theRoot = "";
                    foreach ($certList as $oneCert) {
                        $content = $x509->processCertificate($oneCert);
                        if ($content['root'] == 1) {
                            $theRoot = $content;
                        }
                    }
                    if ($theRoot == "") {
                        throw new Exception("CAInfo has no root certificate for us!");
                    }
                } catch (SoapFault $e) {
                    throw new Exception("SoapFault: Error when sending or receiving SOAP message: " . "{$e->faultcode}: {$e->faultname}: {$e->faultstring}: {$e->faultactor}: {$e->detail}: {$e->headerfault}\n");
                } catch (Exception $e) {
                    throw new Exception("Exception: Something odd happened between the SOAP requests:" . $e->getMessage());
                }
                return [
                    "CERT" => openssl_x509_read($parsedCert['pem']),
                    "SERIAL" => $parsedCert['serial'],
                    "ISSUER" => $raCertFile, // change this to the actual eduPKI Issuer CA
                    "ROOT" => $theRoot, // change this to the actual eduPKI Root CA
                ];
            default:
                /* HTTP POST the CSR to the CA with the $expiryDays as parameter
                 * on successful execution, gets back a PEM file which is the
                 * certificate (structure TBD)
                 * $httpResponse = httpRequest("https://clientca.hosted.eduroam.org/issue/", ["csr" => $csr, "expiry" => $expiryDays ] );
                 *
                 * The result of this if clause has to be a certificate in PHP's 
                 * "openssl_object" style (like the one that openssl_csr_sign would 
                 * produce), to be stored in the variable $cert; we also need the
                 * serial - which can be extracted from the received cert and has
                 * to be stored in $serial.
                 */
                throw new Exception("External silverbullet CA is not implemented yet!");
        }