// Revoked returns a bool indicating if any revocation claims exist against this
// PublicKey
546590
func (pks *PublicKeySegment) Revoked() bool {
	for _, claim := range pks.Claims {
		if claim.Body.ClaimType == primitive.RevocationClaimType {
			return true
		}
	}

	return false
}
1073457
func (wfe *WebFrontEndImpl) RevokeCertificate(ctx context.Context, logEvent *web.RequestEvent, response http.ResponseWriter, request *http.Request) {
	// We don't ask verifyPOST to verify there is a corresponding registration,
	// because anyone with the right private key can revoke a certificate.
	body, requestKey, registration, prob := wfe.verifyPOST(ctx, logEvent, request, false, core.ResourceRevokeCert)
	addRequesterHeader(response, logEvent.Requester)
	if prob != nil {
		// verifyPOST handles its own setting of logEvent.Errors
		wfe.sendError(response, logEvent, prob, nil)
		return
	}

	type RevokeRequest struct {
		CertificateDER core.JSONBuffer    `json:"certificate"`
		Reason         *revocation.Reason `json:"reason"`
	}
	var revokeRequest RevokeRequest
	if err := json.Unmarshal(body, &revokeRequest); err != nil {
		wfe.sendError(response, logEvent, probs.Malformed("Unable to JSON parse revoke request"), err)
		return
	}
	providedCert, err := x509.ParseCertificate(revokeRequest.CertificateDER)
	if err != nil {
		wfe.sendError(response, logEvent, probs.Malformed("Unable to parse revoke certificate DER"), err)
		return
	}

	serial := core.SerialToString(providedCert.SerialNumber)
	logEvent.Extra["ProvidedCertificateSerial"] = serial
	cert, err := wfe.SA.GetCertificate(ctx, serial)
	// TODO(#991): handle db errors better
	if err != nil || !bytes.Equal(cert.DER, revokeRequest.CertificateDER) {
		wfe.sendError(response, logEvent, probs.NotFound("No such certificate"), err)
		return
	}
	parsedCertificate, err := x509.ParseCertificate(cert.DER)
	if err != nil {
		// InternalServerError because this is a failure to decode from our DB.
		wfe.sendError(response, logEvent, probs.ServerInternal("invalid parse of stored certificate"), err)
		return
	}
	if parsedCertificate.NotAfter.Before(wfe.clk.Now()) {
		wfe.sendError(response, logEvent, probs.Unauthorized("Certificate is expired"), nil)
		return
	}
	logEvent.Extra["RetrievedCertificateSerial"] = core.SerialToString(parsedCertificate.SerialNumber)
	logEvent.Extra["RetrievedCertificateDNSNames"] = parsedCertificate.DNSNames
	logEvent.Extra["RetrievedCertificateEmailAddresses"] = parsedCertificate.EmailAddresses
	logEvent.Extra["RetrievedCertificateIPAddresses"] = parsedCertificate.IPAddresses

	certStatus, err := wfe.SA.GetCertificateStatus(ctx, serial)
	if err != nil {
		// TODO(#991): handle db errors
		wfe.sendError(response, logEvent, probs.NotFound("Certificate status not yet available"), err)
		return
	}
	logEvent.Extra["CertificateStatus"] = certStatus.Status

	if certStatus.Status == core.OCSPStatusRevoked {
		wfe.sendError(response, logEvent, probs.Conflict("Certificate already revoked"), nil)
		return
	}

	if !(core.KeyDigestEquals(requestKey, parsedCertificate.PublicKey) || registration.ID == cert.RegistrationID) {
		valid, err := wfe.regHoldsAuthorizations(ctx, registration.ID, parsedCertificate.DNSNames)
		if err != nil {
			wfe.sendError(response, logEvent, probs.ServerInternal("Failed to retrieve authorizations for names in certificate"), err)
			return
		}
		if !valid {
			wfe.sendError(response, logEvent,
				probs.Unauthorized("Revocation request must be signed by private key of cert to be revoked, by the "+
					"account key of the account that issued it, or by the account key of an account that holds valid "+
					"authorizations for all names in the certificate."),
				nil)
			return
		}
	}

	reason := revocation.Reason(0)
	if revokeRequest.Reason != nil && wfe.AcceptRevocationReason {
		if _, present := revocation.UserAllowedReasons[*revokeRequest.Reason]; !present {
			wfe.sendError(response, logEvent, probs.Malformed("unsupported revocation reason code provided"), nil)
			return
		}
		reason = *revokeRequest.Reason
	}

	err = wfe.RA.RevokeCertificateWithReg(ctx, *parsedCertificate, reason, registration.ID)
	if err != nil {
		wfe.sendError(response, logEvent, web.ProblemDetailsForError(err, "Failed to revoke certificate"), err)
	} else {
		wfe.log.Debugf("Revoked %v", serial)
		response.WriteHeader(http.StatusOK)
	}
}
371833
func (k *KeyringSectionV2) HasRevocations() bool {
	for _, claim := range k.Claims {
		if claim.Body.ClaimType == primitive.RevocationClaimType {
			return true
		}
	}
	return false
}
405763
func RevokeRequest(path string, secret *Secret, data map[string]interface{}) *Request {
	return &Request{
		Operation: RevokeOperation,
		Path:      path,
		Data:      data,
		Secret:    secret,
	}
}
1282335
func (*Revocation) Verify(pk *ecdsa.PublicKey, criRaw []byte, epoch int, alg bccsp.RevocationAlgorithm) (err error) {
	defer func() {
		if r := recover(); r != nil {
			err = errors.Errorf("failure [%s]", r)
		}
	}()

	cri := &cryptolib.CredentialRevocationInformation{}
	err = proto.Unmarshal(criRaw, cri)
	if err != nil {
		return err
	}

	return cryptolib.VerifyEpochPK(
		pk,
		cri.EpochPk,
		cri.EpochPkSig,
		int(cri.Epoch),
		cryptolib.RevocationAlgorithm(cri.RevocationAlg),
	)
}
888388
func (c *Client) RevokeCredential(tag names.CloudCredentialTag) error {
	var results params.ErrorResults

	if c.facade.BestAPIVersion() < 3 {
		args := params.Entities{
			Entities: []params.Entity{{
				Tag: tag.String(),
			}},
		}
		if err := c.facade.FacadeCall("RevokeCredentials", args, &results); err != nil {
			return errors.Trace(err)
		}
		return results.OneError()
	}

	args := params.RevokeCredentialArgs{
		Credentials: []params.RevokeCredentialArg{
			{Tag: tag.String()},
		},
	}
	if err := c.facade.FacadeCall("RevokeCredentialsCheckModels", args, &results); err != nil {
		return errors.Trace(err)
	}
	return results.OneError()
}
332628
func (ra *RegistrationAuthorityImpl) RevokeCertificateWithReg(ctx context.Context, cert x509.Certificate, revocationCode revocation.Reason, regID int64) error {
	serialString := core.SerialToString(cert.SerialNumber)
	var err error
	if features.Enabled(features.RevokeAtRA) {
		err = ra.revokeCertificate(ctx, cert, revocationCode)
	} else {
		err = ra.SA.MarkCertificateRevoked(ctx, serialString, revocationCode)
	}

	state := "Failure"
	defer func() {
		// Needed:
		//   Serial
		//   CN
		//   DNS names
		//   Revocation reason
		//   Registration ID of requester
		//   Error (if there was one)
		ra.log.AuditInfof("%s, Request by registration ID: %d",
			revokeEvent(state, serialString, cert.Subject.CommonName, cert.DNSNames, revocationCode),
			regID)
	}()

	if err != nil {
		state = fmt.Sprintf("Failure -- %s", err)
		return err
	}

	state = "Success"
	ra.stats.Inc("RevokedCertificates", 1)
	return nil
}
420833
func (c *Client) RevokeModel(user, access string, modelUUIDs ...string) error {
	return c.modifyModelUser(params.RevokeModelAccess, user, access, modelUUIDs)
}
363193
func RevokableSetenv(envKey, envValue string) (func() error, error) {
	origValue := os.Getenv(envKey)
	revokeFn := func() error {
		return os.Setenv(envKey, origValue)
	}

	return revokeFn, os.Setenv(envKey, envValue)
}
1056449
func VerifyCertificate(cert *x509.Certificate) (revoked, ok bool) {
	revoked, ok, _ = VerifyCertificateError(cert)
	return revoked, ok
}
791330
func (c *Cassandra) RevokeUser(ctx context.Context, statements dbplugin.Statements, username string) error {
	// Grab the lock
	c.Lock()
	defer c.Unlock()

	statements = dbutil.StatementCompatibilityHelper(statements)

	session, err := c.getConnection(ctx)
	if err != nil {
		return err
	}

	revocationCQL := statements.Revocation
	if len(revocationCQL) == 0 {
		revocationCQL = []string{defaultUserDeletionCQL}
	}

	var result *multierror.Error
	for _, stmt := range revocationCQL {
		for _, query := range strutil.ParseArbitraryStringSlice(stmt, ";") {
			query = strings.TrimSpace(query)
			if len(query) == 0 {
				continue
			}

			err := session.Query(dbutil.QueryHelper(query, map[string]string{
				"username": username,
			})).Exec()

			result = multierror.Append(result, err)
		}
	}

	return result.ErrorOrNil()
}
734726
func (e *Engine) RevokeKeypairs(ctx context.Context, notifier *observer.Notifier,
	orgID *identity.ID) error {

	n := notifier.Notifier(5)

	keypairs, err := e.client.KeyPairs.List(ctx, orgID)
	if err != nil {
		log.Printf("Error retrieving keypairs: %s", err)
		return err
	}

	encKP, err := keypairs.Select(orgID, primitive.EncryptionKeyType)
	if err == registry.ErrMissingValidKeypair {
		log.Printf("No keys to revoke, can't find encryption keypair")
		return nil
	}
	if err != nil {
		log.Printf("Could not find encryption keypair: %s", err)
		return err
	}

	sigKP, err := keypairs.Select(orgID, primitive.SigningKeyType)
	if err == registry.ErrMissingValidKeypair {
		log.Printf("No keys to revoke, can't find signing keypair")
		return nil
	}
	if err != nil {
		log.Printf("Could not find signing keypair: %s", err)
		return err
	}

	n.Notify(observer.Progress, "Keypairs retrieved", true)

	sigID := sigKP.PublicKey.ID
	kp := bundleKeypairs(sigKP, encKP)

	if encKP != nil { // the encryption keypair might already be revoked
		encID := encKP.PublicKey.ID

		prevEncClaim, err := encKP.HeadClaim()
		if err != nil {
			return err
		}

		encBody := primitive.NewClaim(orgID, e.session.AuthID(), prevEncClaim.ID,
			encID, primitive.RevocationClaimType)
		encclaim, err := e.crypto.SignedClaim(ctx, encBody, sigID, &kp.Signature)
		if err != nil {
			log.Printf("Error creating revocation claim for encryption key: %s", err)
			return err
		}

		n.Notify(observer.Progress, "Encryption keys revoked", true)

		_, err = e.client.Claims.Create(ctx, encclaim)
		if err != nil {
			log.Printf("Error uploading encryption keypair revocation: %s", err)
			return err
		}

		n.Notify(observer.Progress, "Encryption key revocation uploaded", true)
	}

	prevSigClaim, err := sigKP.HeadClaim()
	if err != nil {
		return err
	}

	sigBody := primitive.NewClaim(orgID, e.session.AuthID(), prevSigClaim.ID,
		sigID, primitive.RevocationClaimType)
	sigclaim, err := e.crypto.SignedClaim(ctx, sigBody, sigID, &kp.Signature)
	if err != nil {
		log.Printf("Error creating revocation claim for signing key: %s", err)
		return err
	}

	n.Notify(observer.Progress, "Signing keys revoked", true)

	_, err = e.client.Claims.Create(ctx, sigclaim)
	if err != nil {
		log.Printf("Error uploading signature keypair revocation: %s", err)
		return err
	}

	n.Notify(observer.Progress, "Signing key revocation uploaded", true)

	return nil
}
774168
func NewRevokeDeviceSessionBatchResult(RevokeDevicesStatus []*RevokeDeviceSessionStatus) *RevokeDeviceSessionBatchResult {
	s := new(RevokeDeviceSessionBatchResult)
	s.RevokeDevicesStatus = RevokeDevicesStatus
	return s
}
95796
func (c *Client) RevokeController(user, access string) error {
	return c.modifyControllerUser(params.RevokeControllerAccess, user, access)
}
42702
func ToRevoke(username string, perm chronograf.Permission) string {
	return ToInfluxQL("REVOKE", "FROM", username, perm)
}
627106
func NewRevokeDeviceSessionStatus(Success bool) *RevokeDeviceSessionStatus {
	s := new(RevokeDeviceSessionStatus)
	s.Success = Success
	return s
}
575792
func (role *StdRole) Revoke(p Permission) error {
	role.Lock()
	delete(role.permissions, p.ID())
	role.Unlock()
	return nil
}