|
| 1 | +/* |
| 2 | + * Copyright (c) 2020-2025 Estonian Information System Authority |
| 3 | + * |
| 4 | + * Permission is hereby granted, free of charge, to any person obtaining a copy |
| 5 | + * of this software and associated documentation files (the "Software"), to deal |
| 6 | + * in the Software without restriction, including without limitation the rights |
| 7 | + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
| 8 | + * copies of the Software, and to permit persons to whom the Software is |
| 9 | + * furnished to do so, subject to the following conditions: |
| 10 | + * |
| 11 | + * The above copyright notice and this permission notice shall be included in all |
| 12 | + * copies or substantial portions of the Software. |
| 13 | + * |
| 14 | + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 15 | + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 16 | + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
| 17 | + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
| 18 | + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
| 19 | + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
| 20 | + * SOFTWARE. |
| 21 | + */ |
| 22 | + |
| 23 | +package eu.webeid.resilientocsp; |
| 24 | + |
| 25 | +import eu.webeid.ocsp.OcspCertificateRevocationChecker; |
| 26 | +import eu.webeid.ocsp.client.OcspClient; |
| 27 | +import eu.webeid.ocsp.exceptions.UserCertificateOCSPCheckFailedException; |
| 28 | +import eu.webeid.ocsp.exceptions.UserCertificateRevokedException; |
| 29 | +import eu.webeid.ocsp.protocol.OcspRequestBuilder; |
| 30 | +import eu.webeid.ocsp.service.OcspService; |
| 31 | +import eu.webeid.ocsp.service.OcspServiceProvider; |
| 32 | +import eu.webeid.security.exceptions.AuthTokenException; |
| 33 | +import eu.webeid.security.validator.revocationcheck.RevocationInfo; |
| 34 | +import io.github.resilience4j.circuitbreaker.CallNotPermittedException; |
| 35 | +import io.github.resilience4j.circuitbreaker.CircuitBreaker; |
| 36 | +import io.github.resilience4j.circuitbreaker.CircuitBreakerConfig; |
| 37 | +import io.github.resilience4j.circuitbreaker.CircuitBreakerRegistry; |
| 38 | +import io.github.resilience4j.decorators.Decorators; |
| 39 | +import io.github.resilience4j.retry.Retry; |
| 40 | +import io.github.resilience4j.retry.RetryConfig; |
| 41 | +import io.github.resilience4j.retry.RetryRegistry; |
| 42 | +import io.vavr.CheckedFunction0; |
| 43 | +import io.vavr.control.Try; |
| 44 | +import org.bouncycastle.asn1.ocsp.OCSPResponseStatus; |
| 45 | +import org.bouncycastle.cert.ocsp.BasicOCSPResp; |
| 46 | +import org.bouncycastle.cert.ocsp.CertificateID; |
| 47 | +import org.bouncycastle.cert.ocsp.OCSPException; |
| 48 | +import org.bouncycastle.cert.ocsp.OCSPReq; |
| 49 | +import org.bouncycastle.cert.ocsp.OCSPResp; |
| 50 | +import org.bouncycastle.operator.OperatorCreationException; |
| 51 | +import org.slf4j.Logger; |
| 52 | +import org.slf4j.LoggerFactory; |
| 53 | + |
| 54 | +import java.io.IOException; |
| 55 | +import java.net.URI; |
| 56 | +import java.security.cert.CertificateException; |
| 57 | +import java.security.cert.X509Certificate; |
| 58 | +import java.time.Duration; |
| 59 | +import java.util.List; |
| 60 | +import java.util.Map; |
| 61 | + |
| 62 | +import static java.util.Objects.requireNonNull; |
| 63 | + |
| 64 | +public class ResilientOcspCertificateRevocationChecker extends OcspCertificateRevocationChecker { |
| 65 | + |
| 66 | + private static final Logger LOG = LoggerFactory.getLogger(ResilientOcspCertificateRevocationChecker.class); |
| 67 | + |
| 68 | + private final CircuitBreakerRegistry circuitBreakerRegistry; |
| 69 | + private final RetryRegistry retryRegistry; |
| 70 | + |
| 71 | + public ResilientOcspCertificateRevocationChecker(OcspClient ocspClient, |
| 72 | + OcspServiceProvider ocspServiceProvider, |
| 73 | + CircuitBreakerConfig circuitBreakerConfig, |
| 74 | + RetryConfig retryConfig, |
| 75 | + Duration allowedOcspResponseTimeSkew, |
| 76 | + Duration maxOcspResponseThisUpdateAge) { |
| 77 | + super(ocspClient, ocspServiceProvider, allowedOcspResponseTimeSkew, maxOcspResponseThisUpdateAge); |
| 78 | + this.circuitBreakerRegistry = CircuitBreakerRegistry.custom() |
| 79 | + .withCircuitBreakerConfig(getCircuitBreakerConfig(circuitBreakerConfig)) |
| 80 | + .build(); |
| 81 | + this.retryRegistry = retryConfig != null ? RetryRegistry.custom() |
| 82 | + .withRetryConfig(getRetryConfigConfig(retryConfig)) |
| 83 | + .build() : null; |
| 84 | + if (!LOG.isDebugEnabled()) { |
| 85 | + return; |
| 86 | + } |
| 87 | + this.circuitBreakerRegistry.getEventPublisher() |
| 88 | + .onEntryAdded(entryAddedEvent -> { |
| 89 | + CircuitBreaker circuitBreaker = entryAddedEvent.getAddedEntry(); |
| 90 | + LOG.debug("CircuitBreaker {} added", circuitBreaker.getName()); |
| 91 | + circuitBreaker.getEventPublisher() |
| 92 | + .onEvent(event -> LOG.debug(event.toString())); |
| 93 | + }); |
| 94 | + } |
| 95 | + |
| 96 | + @Override |
| 97 | + public List<RevocationInfo> validateCertificateNotRevoked(X509Certificate subjectCertificate, |
| 98 | + X509Certificate issuerCertificate) throws AuthTokenException { |
| 99 | + OcspService ocspService; |
| 100 | + try { |
| 101 | + ocspService = getOcspServiceProvider().getService(subjectCertificate); |
| 102 | + } catch (CertificateException e) { |
| 103 | + throw new UserCertificateOCSPCheckFailedException(e, null); |
| 104 | + } |
| 105 | + final OcspService fallbackOcspService = ocspService.getFallbackService(); |
| 106 | + if (fallbackOcspService == null) { |
| 107 | + return List.of(request(ocspService, subjectCertificate, issuerCertificate)); |
| 108 | + } |
| 109 | + |
| 110 | + CircuitBreaker circuitBreaker = circuitBreakerRegistry.circuitBreaker(ocspService.getAccessLocation().toASCIIString()); |
| 111 | + CheckedFunction0<RevocationInfo> primarySupplier = () -> request(ocspService, subjectCertificate, issuerCertificate); |
| 112 | + CheckedFunction0<RevocationInfo> fallbackSupplier = () -> request(ocspService.getFallbackService(), subjectCertificate, issuerCertificate); |
| 113 | + Decorators.DecorateCheckedSupplier<RevocationInfo> decorateCheckedSupplier = Decorators.ofCheckedSupplier(primarySupplier); |
| 114 | + if (retryRegistry != null) { |
| 115 | + Retry retry = retryRegistry.retry(ocspService.getAccessLocation().toASCIIString()); |
| 116 | + decorateCheckedSupplier.withRetry(retry); |
| 117 | + } |
| 118 | + decorateCheckedSupplier.withCircuitBreaker(circuitBreaker) |
| 119 | + .withFallback(List.of(UserCertificateOCSPCheckFailedException.class, CallNotPermittedException.class), e -> fallbackSupplier.apply()); |
| 120 | + |
| 121 | + CheckedFunction0<RevocationInfo> decoratedSupplier = decorateCheckedSupplier.decorate(); |
| 122 | + |
| 123 | + // TODO Collect the intermediate results |
| 124 | + return List.of(Try.of(decoratedSupplier).getOrElseThrow(throwable -> { |
| 125 | + if (throwable instanceof AuthTokenException) { |
| 126 | + return (AuthTokenException) throwable; |
| 127 | + } |
| 128 | + return new UserCertificateOCSPCheckFailedException(throwable, null); |
| 129 | + })); |
| 130 | + } |
| 131 | + |
| 132 | + private RevocationInfo request(OcspService ocspService, X509Certificate subjectCertificate, X509Certificate issuerCertificate) throws AuthTokenException { |
| 133 | + URI ocspResponderUri = null; |
| 134 | + try { |
| 135 | + ocspResponderUri = requireNonNull(ocspService.getAccessLocation(), "ocspResponderUri"); |
| 136 | + |
| 137 | + final CertificateID certificateId = getCertificateId(subjectCertificate, issuerCertificate); |
| 138 | + final OCSPReq request = new OcspRequestBuilder() |
| 139 | + .withCertificateId(certificateId) |
| 140 | + .enableOcspNonce(ocspService.doesSupportNonce()) |
| 141 | + .build(); |
| 142 | + |
| 143 | + if (!ocspService.doesSupportNonce()) { |
| 144 | + LOG.debug("Disabling OCSP nonce extension"); |
| 145 | + } |
| 146 | + |
| 147 | + LOG.debug("Sending OCSP request"); |
| 148 | + OCSPResp response = requireNonNull(getOcspClient().request(ocspResponderUri, request)); // TODO: This should trigger fallback? |
| 149 | + if (response.getStatus() != OCSPResponseStatus.SUCCESSFUL) { |
| 150 | + throw new UserCertificateOCSPCheckFailedException("Response status: " + ocspStatusToString(response.getStatus()), ocspResponderUri); |
| 151 | + } |
| 152 | + |
| 153 | + final BasicOCSPResp basicResponse = (BasicOCSPResp) response.getResponseObject(); |
| 154 | + if (basicResponse == null) { |
| 155 | + throw new UserCertificateOCSPCheckFailedException("Missing Basic OCSP Response", ocspResponderUri); |
| 156 | + } |
| 157 | + LOG.debug("OCSP response received successfully"); |
| 158 | + |
| 159 | + verifyOcspResponse(basicResponse, ocspService, certificateId); |
| 160 | + if (ocspService.doesSupportNonce()) { |
| 161 | + checkNonce(request, basicResponse, ocspResponderUri); |
| 162 | + } |
| 163 | + LOG.debug("OCSP response verified successfully"); |
| 164 | + |
| 165 | + return new RevocationInfo(ocspResponderUri, Map.ofEntries( |
| 166 | + Map.entry(RevocationInfo.KEY_OCSP_REQUEST, request), |
| 167 | + Map.entry(RevocationInfo.KEY_OCSP_RESPONSE, response) |
| 168 | + )); |
| 169 | + } catch (OCSPException | CertificateException | OperatorCreationException | IOException e) { |
| 170 | + throw new UserCertificateOCSPCheckFailedException(e, ocspResponderUri); |
| 171 | + } |
| 172 | + } |
| 173 | + |
| 174 | + private static CircuitBreakerConfig getCircuitBreakerConfig(CircuitBreakerConfig circuitBreakerConfig) { |
| 175 | + return CircuitBreakerConfig.from(circuitBreakerConfig) |
| 176 | + // Users must not be able to modify these three values. |
| 177 | + .slidingWindowType(CircuitBreakerConfig.SlidingWindowType.COUNT_BASED) |
| 178 | + .ignoreExceptions(UserCertificateRevokedException.class) |
| 179 | + .automaticTransitionFromOpenToHalfOpenEnabled(true) |
| 180 | + .build(); |
| 181 | + } |
| 182 | + |
| 183 | + private static RetryConfig getRetryConfigConfig(RetryConfig retryConfig) { |
| 184 | + return RetryConfig.from(retryConfig) |
| 185 | + // Users must not be able to modify this value. |
| 186 | + .ignoreExceptions(UserCertificateRevokedException.class) |
| 187 | + .build(); |
| 188 | + } |
| 189 | +} |
0 commit comments