Skip to content

Commit b45675c

Browse files
mrtsmrts
committed
Use plaform OCSP implementation by default
WE2-1030 Signed-off-by: Mart Somermaa <[email protected]>
1 parent 4379d59 commit b45675c

30 files changed

+361
-370
lines changed

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
<description>Web eID authentication token validation library for Java</description>
1212

1313
<properties>
14-
<java.version>11</java.version>
14+
<java.version>17</java.version>
1515
<jjwt.version>0.12.6</jjwt.version>
1616
<bouncycastle.version>1.81</bouncycastle.version>
1717
<jackson.version>2.19.1</jackson.version>

src/main/java/eu/webeid/security/validator/ocsp/DigestCalculatorImpl.java renamed to src/main/java/eu/webeid/ocsp/DigestCalculatorImpl.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
2626
import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers;

src/main/java/eu/webeid/security/validator/ocsp/OcspClient.java renamed to src/main/java/eu/webeid/ocsp/OcspClient.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import org.bouncycastle.cert.ocsp.OCSPReq;
2626
import org.bouncycastle.cert.ocsp.OCSPResp;

src/main/java/eu/webeid/security/validator/ocsp/OcspClientImpl.java renamed to src/main/java/eu/webeid/ocsp/OcspClientImpl.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import org.bouncycastle.cert.ocsp.OCSPReq;
2626
import org.bouncycastle.cert.ocsp.OCSPResp;

src/main/java/eu/webeid/security/validator/ocsp/OcspRequestBuilder.java renamed to src/main/java/eu/webeid/ocsp/OcspRequestBuilder.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import org.bouncycastle.asn1.DEROctetString;
2626
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;

src/main/java/eu/webeid/security/validator/ocsp/OcspResponseValidator.java renamed to src/main/java/eu/webeid/ocsp/OcspResponseValidator.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import eu.webeid.security.exceptions.OCSPCertificateException;
2626
import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;

src/main/java/eu/webeid/security/validator/ocsp/OcspServiceProvider.java renamed to src/main/java/eu/webeid/ocsp/OcspServiceProvider.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,14 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import eu.webeid.security.exceptions.AuthTokenException;
26-
import eu.webeid.security.validator.ocsp.service.AiaOcspService;
27-
import eu.webeid.security.validator.ocsp.service.AiaOcspServiceConfiguration;
28-
import eu.webeid.security.validator.ocsp.service.DesignatedOcspService;
29-
import eu.webeid.security.validator.ocsp.service.DesignatedOcspServiceConfiguration;
30-
import eu.webeid.security.validator.ocsp.service.OcspService;
26+
import eu.webeid.ocsp.service.AiaOcspService;
27+
import eu.webeid.ocsp.service.AiaOcspServiceConfiguration;
28+
import eu.webeid.ocsp.service.DesignatedOcspService;
29+
import eu.webeid.ocsp.service.DesignatedOcspServiceConfiguration;
30+
import eu.webeid.ocsp.service.OcspService;
3131

3232
import java.security.cert.CertificateEncodingException;
3333
import java.security.cert.X509Certificate;

src/main/java/eu/webeid/security/validator/ocsp/OcspUrl.java renamed to src/main/java/eu/webeid/ocsp/OcspUrl.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp;
23+
package eu.webeid.ocsp;
2424

2525
import org.bouncycastle.asn1.ASN1String;
2626
import org.bouncycastle.asn1.x509.AccessDescription;

src/main/java/eu/webeid/security/validator/certvalidators/SubjectCertificateNotRevokedValidator.java renamed to src/main/java/eu/webeid/ocsp/certvalidators/SubjectCertificateNotRevokedValidator.java

Lines changed: 26 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,19 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.certvalidators;
23+
package eu.webeid.ocsp.certvalidators;
2424

2525
import eu.webeid.security.exceptions.AuthTokenException;
2626
import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;
2727
import eu.webeid.security.util.DateAndTime;
28-
import eu.webeid.security.validator.ocsp.DigestCalculatorImpl;
29-
import eu.webeid.security.validator.ocsp.OcspClient;
30-
import eu.webeid.security.validator.ocsp.OcspRequestBuilder;
31-
import eu.webeid.security.validator.ocsp.OcspResponseValidator;
32-
import eu.webeid.security.validator.ocsp.OcspServiceProvider;
33-
import eu.webeid.security.validator.ocsp.service.OcspService;
28+
import eu.webeid.ocsp.DigestCalculatorImpl;
29+
import eu.webeid.ocsp.OcspClient;
30+
import eu.webeid.ocsp.OcspRequestBuilder;
31+
import eu.webeid.ocsp.OcspResponseValidator;
32+
import eu.webeid.ocsp.OcspServiceProvider;
33+
import eu.webeid.ocsp.service.OcspService;
34+
import eu.webeid.security.validator.revocationcheck.OcspCertificateRevocationChecker;
35+
import eu.webeid.security.validator.revocationcheck.RevocationInfo;
3436
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
3537
import org.bouncycastle.asn1.ocsp.OCSPResponseStatus;
3638
import org.bouncycastle.asn1.x509.Extension;
@@ -55,13 +57,13 @@
5557
import java.security.cert.X509Certificate;
5658
import java.time.Duration;
5759
import java.util.Date;
58-
import java.util.Objects;
5960

60-
public final class SubjectCertificateNotRevokedValidator {
61+
import static java.util.Objects.requireNonNull;
62+
63+
public final class SubjectCertificateNotRevokedValidator implements OcspCertificateRevocationChecker {
6164

6265
private static final Logger LOG = LoggerFactory.getLogger(SubjectCertificateNotRevokedValidator.class);
6366

64-
private final SubjectCertificateTrustedValidator trustValidator;
6567
private final OcspClient ocspClient;
6668
private final OcspServiceProvider ocspServiceProvider;
6769
private final Duration allowedOcspResponseTimeSkew;
@@ -71,12 +73,10 @@ public final class SubjectCertificateNotRevokedValidator {
7173
Security.addProvider(new BouncyCastleProvider());
7274
}
7375

74-
public SubjectCertificateNotRevokedValidator(SubjectCertificateTrustedValidator trustValidator,
75-
OcspClient ocspClient,
76+
public SubjectCertificateNotRevokedValidator(OcspClient ocspClient,
7677
OcspServiceProvider ocspServiceProvider,
7778
Duration allowedOcspResponseTimeSkew,
7879
Duration maxOcspResponseThisUpdateAge) {
79-
this.trustValidator = trustValidator;
8080
this.ocspClient = ocspClient;
8181
this.ocspServiceProvider = ocspServiceProvider;
8282
this.allowedOcspResponseTimeSkew = allowedOcspResponseTimeSkew;
@@ -89,12 +89,11 @@ public SubjectCertificateNotRevokedValidator(SubjectCertificateTrustedValidator
8989
* @param subjectCertificate user certificate to be validated
9090
* @throws AuthTokenException when user certificate is revoked or revocation check fails.
9191
*/
92-
public void validateCertificateNotRevoked(X509Certificate subjectCertificate) throws AuthTokenException {
92+
public RevocationInfo validateCertificateNotRevoked(X509Certificate subjectCertificate, X509Certificate issuerCertificate) throws AuthTokenException {
9393
try {
9494
OcspService ocspService = ocspServiceProvider.getService(subjectCertificate);
9595

96-
final CertificateID certificateId = getCertificateId(subjectCertificate,
97-
Objects.requireNonNull(trustValidator.getSubjectCertificateIssuerCertificate()));
96+
final CertificateID certificateId = getCertificateId(subjectCertificate, requireNonNull(issuerCertificate));
9897

9998
final OCSPReq request = new OcspRequestBuilder()
10099
.withCertificateId(certificateId)
@@ -106,7 +105,7 @@ public void validateCertificateNotRevoked(X509Certificate subjectCertificate) th
106105
}
107106

108107
LOG.debug("Sending OCSP request");
109-
final OCSPResp response = Objects.requireNonNull(ocspClient.request(ocspService.getAccessLocation(), request));
108+
final OCSPResp response = requireNonNull(ocspClient.request(ocspService.getAccessLocation(), request));
110109
if (response.getStatus() != OCSPResponseStatus.SUCCESSFUL) {
111110
throw new UserCertificateOCSPCheckFailedException("Response status: " + ocspStatusToString(response.getStatus()));
112111
}
@@ -122,6 +121,8 @@ public void validateCertificateNotRevoked(X509Certificate subjectCertificate) th
122121
} catch (OCSPException | CertificateException | OperatorCreationException | IOException e) {
123122
throw new UserCertificateOCSPCheckFailedException(e);
124123
}
124+
// FIXME:
125+
return null;
125126
}
126127

127128
private void verifyOcspResponse(BasicOCSPResp basicResponse, OcspService ocspService, CertificateID requestCertificateId) throws AuthTokenException, OCSPException, CertificateException, OperatorCreationException {
@@ -202,20 +203,14 @@ private static CertificateID getCertificateId(X509Certificate subjectCertificate
202203
}
203204

204205
private static String ocspStatusToString(int status) {
205-
switch (status) {
206-
case OCSPResp.MALFORMED_REQUEST:
207-
return "malformed request";
208-
case OCSPResp.INTERNAL_ERROR:
209-
return "internal error";
210-
case OCSPResp.TRY_LATER:
211-
return "service unavailable";
212-
case OCSPResp.SIG_REQUIRED:
213-
return "request signature missing";
214-
case OCSPResp.UNAUTHORIZED:
215-
return "unauthorized";
216-
default:
217-
return "unknown";
218-
}
206+
return switch (status) {
207+
case OCSPResp.MALFORMED_REQUEST -> "malformed request";
208+
case OCSPResp.INTERNAL_ERROR -> "internal error";
209+
case OCSPResp.TRY_LATER -> "service unavailable";
210+
case OCSPResp.SIG_REQUIRED -> "request signature missing";
211+
case OCSPResp.UNAUTHORIZED -> "unauthorized";
212+
default -> "unknown";
213+
};
219214
}
220215

221216
}

src/main/java/eu/webeid/security/validator/ocsp/service/AiaOcspService.java renamed to src/main/java/eu/webeid/ocsp/service/AiaOcspService.java

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,14 @@
2020
* SOFTWARE.
2121
*/
2222

23-
package eu.webeid.security.validator.ocsp.service;
23+
package eu.webeid.ocsp.service;
2424

2525
import eu.webeid.security.certificate.CertificateValidator;
2626
import eu.webeid.security.exceptions.AuthTokenException;
2727
import eu.webeid.security.exceptions.OCSPCertificateException;
2828
import eu.webeid.security.exceptions.UserCertificateOCSPCheckFailedException;
29-
import eu.webeid.security.validator.ocsp.OcspResponseValidator;
29+
import eu.webeid.ocsp.OcspResponseValidator;
30+
import eu.webeid.security.validator.revocationcheck.RevocationMode;
3031
import org.bouncycastle.cert.X509CertificateHolder;
3132
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
3233

@@ -39,7 +40,7 @@
3940
import java.util.Objects;
4041
import java.util.Set;
4142

42-
import static eu.webeid.security.validator.ocsp.OcspUrl.getOcspUri;
43+
import static eu.webeid.ocsp.OcspUrl.getOcspUri;
4344

4445
/**
4546
* An OCSP service that uses the responders from the Certificates' Authority Information Access (AIA) extension.
@@ -77,7 +78,15 @@ public void validateResponderCertificate(X509CertificateHolder cert, Date now) t
7778
CertificateValidator.certificateIsValidOnDate(certificate, now, "AIA OCSP responder");
7879
// Trusted certificates' validity has been already verified in validateCertificateExpiry().
7980
OcspResponseValidator.validateHasSigningExtension(certificate);
80-
CertificateValidator.validateIsSignedByTrustedCA(certificate, trustedCACertificateAnchors, trustedCACertificateCertStore, now);
81+
CertificateValidator.validateIsSignedByTrustedCA(
82+
certificate,
83+
trustedCACertificateAnchors,
84+
trustedCACertificateCertStore,
85+
now,
86+
RevocationMode.DISABLED,
87+
null,
88+
null
89+
);
8190
} catch (CertificateException e) {
8291
throw new OCSPCertificateException("Invalid responder certificate", e);
8392
}

0 commit comments

Comments
 (0)