Skip to content

Commit 63c029f

Browse files
mrtsmrts
committed
WIP: Use plaform OCSP by default
Signed-off-by: Mart Somermaa <[email protected]>
1 parent 4379d59 commit 63c029f

28 files changed

+268
-243
lines changed

src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java renamed to src/main/java/eu/webeid/ocsp/DigestCalculatorImpl.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
2626
import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers;

src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java renamed to src/main/java/eu/webeid/ocsp/OcspClient.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import org.bouncycastle.cert.ocsp.OCSPReq;
2626
import org.bouncycastle.cert.ocsp.OCSPResp;

src/main/java/eu/webeid/security/validator/ocsp/OcspClientImpl.java renamed to src/main/java/eu/webeid/ocsp/OcspClientImpl.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import org.bouncycastle.cert.ocsp.OCSPReq;
2626
import org.bouncycastle.cert.ocsp.OCSPResp;

src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java renamed to src/main/java/eu/webeid/ocsp/OcspRequestBuilder.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import org.bouncycastle.asn1.DEROctetString;
2626
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;

src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java renamed to src/main/java/eu/webeid/ocsp/OcspResponseValidator.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import eu.webeid.security.exceptions.OCSPCertificateException;
2626
import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;

src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java renamed to src/main/java/eu/webeid/ocsp/OcspServiceProvider.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import eu.webeid.security.exceptions.AuthTokenException;
26-
import eu.webeid.security.validator.ocsp.service.AiaOcspService;
27-
import eu.webeid.security.validator.ocsp.service.AiaOcspServiceConfiguration;
28-
import eu.webeid.security.validator.ocsp.service.DesignatedOcspService;
29-
import eu.webeid.security.validator.ocsp.service.DesignatedOcspServiceConfiguration;
30-
import eu.webeid.security.validator.ocsp.service.OcspService;
26+
import eu.webeid.ocsp.service.AiaOcspService;
27+
import eu.webeid.ocsp.service.AiaOcspServiceConfiguration;
28+
import eu.webeid.ocsp.service.DesignatedOcspService;
29+
import eu.webeid.ocsp.service.DesignatedOcspServiceConfiguration;
30+
import eu.webeid.ocsp.service.OcspService;
3131

3232
import java.security.cert.CertificateEncodingException;
3333
import java.security.cert.X509Certificate;

src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java renamed to src/main/java/eu/webeid/ocsp/OcspUrl.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import org.bouncycastle.asn1.ASN1String;
2626
import org.bouncycastle.asn1.x509.AccessDescription;

src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java renamed to src/main/java/eu/webeid/ocsp/certvalidators/SubjectCertificateNotRevokedValidator.java

Lines changed: 20 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,20 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.certvalidators;
23+
package eu.webeid.ocsp.certvalidators;
2424

2525
import eu.webeid.security.exceptions.AuthTokenException;
2626
import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;
2727
import eu.webeid.security.util.DateAndTime;
28-
import eu.webeid.security.validator.ocsp.DigestCalculatorImpl;
29-
import eu.webeid.security.validator.ocsp.OcspClient;
30-
import eu.webeid.security.validator.ocsp.OcspRequestBuilder;
31-
import eu.webeid.security.validator.ocsp.OcspResponseValidator;
32-
import eu.webeid.security.validator.ocsp.OcspServiceProvider;
33-
import eu.webeid.security.validator.ocsp.service.OcspService;
28+
import eu.webeid.ocsp.DigestCalculatorImpl;
29+
import eu.webeid.ocsp.OcspClient;
30+
import eu.webeid.ocsp.OcspRequestBuilder;
31+
import eu.webeid.ocsp.OcspResponseValidator;
32+
import eu.webeid.ocsp.OcspServiceProvider;
33+
import eu.webeid.ocsp.service.OcspService;
34+
import eu.webeid.security.validator.certvalidators.SubjectCertificateTrustedValidator;
35+
import eu.webeid.security.validator.revocationcheck.OcspCertificateRevocationChecker;
36+
import eu.webeid.security.validator.revocationcheck.RevocationInfo;
3437
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
3538
import org.bouncycastle.asn1.ocsp.OCSPResponseStatus;
3639
import org.bouncycastle.asn1.x509.Extension;
@@ -57,11 +60,12 @@
5760
import java.util.Date;
5861
import java.util.Objects;
5962

60-
public final class SubjectCertificateNotRevokedValidator {
63+
import static java.util.Objects.requireNonNull;
64+
65+
public final class SubjectCertificateNotRevokedValidator implements OcspCertificateRevocationChecker {
6166

6267
private static final Logger LOG = LoggerFactory.getLogger(SubjectCertificateNotRevokedValidator.class);
6368

64-
private final SubjectCertificateTrustedValidator trustValidator;
6569
private final OcspClient ocspClient;
6670
private final OcspServiceProvider ocspServiceProvider;
6771
private final Duration allowedOcspResponseTimeSkew;
@@ -71,12 +75,10 @@ public final class SubjectCertificateNotRevokedValidator {
7175
Security.addProvider(new BouncyCastleProvider());
7276
}
7377

74-
public SubjectCertificateNotRevokedValidator(SubjectCertificateTrustedValidator trustValidator,
75-
OcspClient ocspClient,
78+
public SubjectCertificateNotRevokedValidator(OcspClient ocspClient,
7679
OcspServiceProvider ocspServiceProvider,
7780
Duration allowedOcspResponseTimeSkew,
7881
Duration maxOcspResponseThisUpdateAge) {
79-
this.trustValidator = trustValidator;
8082
this.ocspClient = ocspClient;
8183
this.ocspServiceProvider = ocspServiceProvider;
8284
this.allowedOcspResponseTimeSkew = allowedOcspResponseTimeSkew;
@@ -89,12 +91,11 @@ public SubjectCertificateNotRevokedValidator(SubjectCertificateTrustedValidator
8991
* @param subjectCertificate user certificate to be validated
9092
* @throws AuthTokenException when user certificate is revoked or revocation check fails.
9193
*/
92-
public void validateCertificateNotRevoked(X509Certificate subjectCertificate) throws AuthTokenException {
94+
public RevocationInfo validateCertificateNotRevoked(X509Certificate subjectCertificate, X509Certificate issuerCertificate) throws AuthTokenException {
9395
try {
9496
OcspService ocspService = ocspServiceProvider.getService(subjectCertificate);
9597

96-
final CertificateID certificateId = getCertificateId(subjectCertificate,
97-
Objects.requireNonNull(trustValidator.getSubjectCertificateIssuerCertificate()));
98+
final CertificateID certificateId = getCertificateId(subjectCertificate, requireNonNull(issuerCertificate));
9899

99100
final OCSPReq request = new OcspRequestBuilder()
100101
.withCertificateId(certificateId)
@@ -106,7 +107,7 @@ public void validateCertificateNotRevoked(X509Certificate subjectCertificate) th
106107
}
107108

108109
LOG.debug("Sending OCSP request");
109-
final OCSPResp response = Objects.requireNonNull(ocspClient.request(ocspService.getAccessLocation(), request));
110+
final OCSPResp response = requireNonNull(ocspClient.request(ocspService.getAccessLocation(), request));
110111
if (response.getStatus() != OCSPResponseStatus.SUCCESSFUL) {
111112
throw new UserCertificateOCSPCheckFailedException("Response status: " + ocspStatusToString(response.getStatus()));
112113
}
@@ -122,6 +123,8 @@ public void validateCertificateNotRevoked(X509Certificate subjectCertificate) th
122123
} catch (OCSPException | CertificateException | OperatorCreationException | IOException e) {
123124
throw new UserCertificateOCSPCheckFailedException(e);
124125
}
126+
// FIXME:
127+
return null;
125128
}
126129

127130
private void verifyOcspResponse(BasicOCSPResp basicResponse, OcspService ocspService, CertificateID requestCertificateId) throws AuthTokenException, OCSPException, CertificateException, OperatorCreationException {
@@ -198,7 +201,7 @@ private static CertificateID getCertificateId(X509Certificate subjectCertificate
198201
final BigInteger serial = subjectCertificate.getSerialNumber();
199202
final DigestCalculator digestCalculator = DigestCalculatorImpl.sha1();
200203
return new CertificateID(digestCalculator,
201-
new X509CertificateHolder(issuerCertificate.getEncoded()), serial);
204+
new X509CertificateHolder(issuerCertificate.getEncoded()), serial);
202205
}
203206

204207
private static String ocspStatusToString(int status) {

src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java renamed to src/main/java/eu/webeid/ocsp/service/AiaOcspService.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp.service;
23+
package eu.webeid.ocsp.service;
2424

2525
import eu.webeid.security.certificate.CertificateValidator;
2626
import eu.webeid.security.exceptions.AuthTokenException;
2727
import eu.webeid.security.exceptions.OCSPCertificateException;
2828
import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;
29-
import eu.webeid.security.validator.ocsp.OcspResponseValidator;
29+
import eu.webeid.ocsp.OcspResponseValidator;
3030
import org.bouncycastle.cert.X509CertificateHolder;
3131
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
3232

@@ -39,7 +39,7 @@
3939
import java.util.Objects;
4040
import java.util.Set;
4141

42-
import static eu.webeid.security.validator.ocsp.OcspUrl.getOcspUri;
42+
import static eu.webeid.ocsp.OcspUrl.getOcspUri;
4343

4444
/**
4545
* An OCSP service that uses the responders from the Certificates' Authority Information Access (AIA) extension.
@@ -77,7 +77,7 @@ public void validateResponderCertificate(X509CertificateHolder cert, Date now) t
7777
CertificateValidator.certificateIsValidOnDate(certificate, now, "AIA OCSP responder");
7878
// Trusted certificates' validity has been already verified in validateCertificateExpiry().
7979
OcspResponseValidator.validateHasSigningExtension(certificate);
80-
CertificateValidator.validateIsSignedByTrustedCA(certificate, trustedCACertificateAnchors, trustedCACertificateCertStore, now);
80+
CertificateValidator.validateIsSignedByTrustedCA(certificate, trustedCACertificateAnchors, trustedCACertificateCertStore, now, true, null);
8181
} catch (CertificateException e) {
8282
throw new OCSPCertificateException("Invalid responder certificate", e);
8383
}

src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspServiceConfiguration.java renamed to src/main/java/eu/webeid/ocsp/service/AiaOcspServiceConfiguration.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp.service;
23+
package eu.webeid.ocsp.service;
2424

2525
import java.net.URI;
2626
import java.security.cert.CertStore;

0 commit comments

Comments
 (0)