/*
* Copyright (c) 2015, 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package sun.security.testlibrary;
import java.io.*;
import java.net.*;
import java.security.*;
import java.security.cert.CRLReason;
import java.security.cert.X509Certificate;
import java.security.cert.Extension;
import java.security.cert.CertificateException;
import java.security.cert.CertificateEncodingException;
import java.security.Signature;
import java.util.*;
import java.util.concurrent.*;
import java.text.SimpleDateFormat;
import java.math.BigInteger;
import sun.security.x509.*;
import sun.security.x509.PKIXExtensions;
import sun.security.provider.certpath.ResponderId;
import sun.security.provider.certpath.CertId;
import sun.security.provider.certpath.OCSPResponse;
import sun.security.provider.certpath.OCSPResponse.ResponseStatus;
import sun.security.util.Debug;
import sun.security.util.DerInputStream;
import sun.security.util.DerOutputStream;
import sun.security.util.DerValue;
import sun.security.util.ObjectIdentifier;
/**
* This is a simple OCSP server designed to listen and respond to incoming
* requests.
*/
public class SimpleOCSPServer {
private final Debug debug = Debug.getInstance("oserv");
private static final ObjectIdentifier OCSP_BASIC_RESPONSE_OID =
ObjectIdentifier.newInternal(
new int[] { 1, 3, 6, 1, 5, 5, 7, 48, 1, 1});
private static final SimpleDateFormat utcDateFmt =
new SimpleDateFormat("MMM dd yyyy, HH:mm:ss z");
static final int FREE_PORT = 0;
// CertStatus values
public static enum CertStatus {
CERT_STATUS_GOOD,
CERT_STATUS_REVOKED,
CERT_STATUS_UNKNOWN,
}
// Fields used for the networking portion of the responder
private ServerSocket servSocket;
private InetAddress listenAddress;
private int listenPort;
// Keystore information (certs, keys, etc.)
private KeyStore keystore;
private X509Certificate issuerCert;
private X509Certificate signerCert;
private PrivateKey signerKey;
// Fields used for the operational portions of the server
private boolean logEnabled = false;
private ExecutorService threadPool;
private volatile boolean started = false;
private volatile boolean serverReady = false;
private volatile boolean receivedShutdown = false;
private volatile boolean acceptConnections = true;
private volatile long delayMsec = 0;
// Fields used in the generation of responses
private long nextUpdateInterval = -1;
private Date nextUpdate = null;
private ResponderId respId;
private AlgorithmId sigAlgId;
private Map<CertId, CertStatusInfo> statusDb =
Collections.synchronizedMap(new HashMap<>());
/**
* Construct a SimpleOCSPServer using keystore, password, and alias
* parameters.
*
* @param ks the keystore to be used
* @param password the password to access key material in the keystore
* @param issuerAlias the alias of the issuer certificate
* @param signerAlias the alias of the signer certificate and key. A
* value of {@code null} means that the {@code issuerAlias} will be used
* to look up the signer key.
*
* @throws GeneralSecurityException if there are problems accessing the
* keystore or finding objects within the keystore.
* @throws IOException if a {@code ResponderId} cannot be generated from
* the signer certificate.
*/
public SimpleOCSPServer(KeyStore ks, String password, String issuerAlias,
String signerAlias) throws GeneralSecurityException, IOException {
this(null, FREE_PORT, ks, password, issuerAlias, signerAlias);
}
/**
* Construct a SimpleOCSPServer using specific network parameters,
* keystore, password, and alias.
*
* @param addr the address to bind the server to. A value of {@code null}
* means the server will bind to all interfaces.
* @param port the port to listen on. A value of {@code 0} will mean that
* the server will randomly pick an open ephemeral port to bind to.
* @param ks the keystore to be used
* @param password the password to access key material in the keystore
* @param issuerAlias the alias of the issuer certificate
* @param signerAlias the alias of the signer certificate and key. A
* value of {@code null} means that the {@code issuerAlias} will be used
* to look up the signer key.
*
* @throws GeneralSecurityException if there are problems accessing the
* keystore or finding objects within the keystore.
* @throws IOException if a {@code ResponderId} cannot be generated from
* the signer certificate.
*/
public SimpleOCSPServer(InetAddress addr, int port, KeyStore ks,
String password, String issuerAlias, String signerAlias)
throws GeneralSecurityException, IOException {
Objects.requireNonNull(ks, "Null keystore provided");
Objects.requireNonNull(issuerAlias, "Null issuerName provided");
utcDateFmt.setTimeZone(TimeZone.getTimeZone("GMT"));
keystore = ks;
issuerCert = (X509Certificate)ks.getCertificate(issuerAlias);
if (issuerCert == null) {
throw new IllegalArgumentException("Certificate for alias " +
issuerAlias + " not found");
}
if (signerAlias != null) {
signerCert = (X509Certificate)ks.getCertificate(signerAlias);
if (signerCert == null) {
throw new IllegalArgumentException("Certificate for alias " +
signerAlias + " not found");
}
signerKey = (PrivateKey)ks.getKey(signerAlias,
password.toCharArray());
if (signerKey == null) {
throw new IllegalArgumentException("PrivateKey for alias " +
signerAlias + " not found");
}
} else {
signerCert = issuerCert;
signerKey = (PrivateKey)ks.getKey(issuerAlias,
password.toCharArray());
if (signerKey == null) {
throw new IllegalArgumentException("PrivateKey for alias " +
issuerAlias + " not found");
}
}
sigAlgId = AlgorithmId.get("Sha256withRSA");
respId = new ResponderId(signerCert.getSubjectX500Principal());
listenAddress = addr;
listenPort = port;
}
/**
* Start the server. The server will bind to the specified network
* address and begin listening for incoming connections.
*
* @throws IOException if any number of things go wonky.
*/
public synchronized void start() throws IOException {
// You cannot start the server twice.
if (started) {
log("Server has already been started");
return;
} else {
started = true;
}
// Create and start the thread pool
threadPool = Executors.newFixedThreadPool(32, new ThreadFactory() {
@Override
public Thread newThread(Runnable r) {
Thread t = Executors.defaultThreadFactory().newThread(r);
t.setDaemon(true);
return t;
}
});
threadPool.submit(new Runnable() {
@Override
public void run() {
try (ServerSocket sSock = new ServerSocket()) {
servSocket = sSock;
servSocket.setReuseAddress(true);
servSocket.setSoTimeout(500);
servSocket.bind(new InetSocketAddress(listenAddress,
listenPort), 128);
log("Listening on " + servSocket.getLocalSocketAddress());
// Singal ready
serverReady = true;
// Update the listenPort with the new port number. If
// the server is restarted, it will bind to the same
// port rather than picking a new one.
listenPort = servSocket.getLocalPort();
// Main dispatch loop
while (!receivedShutdown) {
try {
Socket newConnection = servSocket.accept();
if (!acceptConnections) {
try {
log("Reject connection");
newConnection.close();
} catch (IOException e) {
// ignore
}
continue;
}
threadPool.submit(new OcspHandler(newConnection));
} catch (SocketTimeoutException timeout) {
// Nothing to do here. If receivedShutdown
// has changed to true then the loop will
// exit on its own.
} catch (IOException ioe) {
// Something bad happened, log and force a shutdown
log("Unexpected Exception: " + ioe);
stop();
}
}
log("Shutting down...");
threadPool.shutdown();
} catch (IOException ioe) {
err(ioe);
} finally {
// Reset state variables so the server can be restarted
receivedShutdown = false;
started = false;
serverReady = false;
}
}
});
}
/**
* Make the OCSP server reject incoming connections.
*/
public synchronized void rejectConnections() {
log("Reject OCSP connections");
acceptConnections = false;
}
/**
* Make the OCSP server accept incoming connections.
*/
public synchronized void acceptConnections() {
log("Accept OCSP connections");
acceptConnections = true;
}
/**
* Stop the OCSP server.
*/
public synchronized void stop() {
if (started) {
receivedShutdown = true;
log("Received shutdown notification");
}
}
/**
* Print {@code SimpleOCSPServer} operating parameters.
*
* @return the {@code SimpleOCSPServer} operating parameters in
* {@code String} form.
*/
@Override
public String toString() {
StringBuilder sb = new StringBuilder();
sb.append("OCSP Server:\n");
sb.append("----------------------------------------------\n");
sb.append("issuer: ").append(issuerCert.getSubjectX500Principal()).
append("\n");
sb.append("signer: ").append(signerCert.getSubjectX500Principal()).
append("\n");
sb.append("ResponderId: ").append(respId).append("\n");
sb.append("----------------------------------------------");
return sb.toString();
}
/**
* Helpful debug routine to hex dump byte arrays.
*
* @param data the array of bytes to dump to stdout.
*
* @return the hexdump of the byte array
*/
private static String dumpHexBytes(byte[] data) {
return dumpHexBytes(data, 16, "\n", " ");
}
/**
*
* @param data the array of bytes to dump to stdout.
* @param itemsPerLine the number of bytes to display per line
* if the {@code lineDelim} character is blank then all bytes will be
* printed on a single line.
* @param lineDelim the delimiter between lines
* @param itemDelim the delimiter between bytes
*
* @return The hexdump of the byte array
*/
private static String dumpHexBytes(byte[] data, int itemsPerLine,
String lineDelim, String itemDelim) {
StringBuilder sb = new StringBuilder();
if (data != null) {
for (int i = 0; i < data.length; i++) {
if (i % itemsPerLine == 0 && i != 0) {
sb.append(lineDelim);
}
sb.append(String.format("%02X", data[i])).append(itemDelim);
}
}
return sb.toString();
}
/**
* Enable or disable the logging feature.
*
* @param enable {@code true} to enable logging, {@code false} to
* disable it. The setting must be activated before the server calls
* its start method. Any calls after that have no effect.
*/
public void enableLog(boolean enable) {
if (!started) {
logEnabled = enable;
}
}
/**
* Sets the nextUpdate interval. Intervals will be calculated relative
* to the server startup time. When first set, the nextUpdate date is
* calculated based on the current time plus the interval. After that,
* calls to getNextUpdate() will return this date if it is still
* later than current time. If not, the Date will be updated to the
* next interval that is later than current time. This value must be set
* before the server has had its start method called. Calls made after
* the server has been started have no effect.
*
* @param interval the recurring time interval in seconds used to
* calculate nextUpdate times. A value less than or equal to 0 will
* disable the nextUpdate feature.
*/
public synchronized void setNextUpdateInterval(long interval) {
if (!started) {
if (interval <= 0) {
nextUpdateInterval = -1;
nextUpdate = null;
log("nexUpdate support has been disabled");
} else {
nextUpdateInterval = interval * 1000;
nextUpdate = new Date(System.currentTimeMillis() +
nextUpdateInterval);
log("nextUpdate set to " + nextUpdate);
}
}
}
/**
* Return the nextUpdate {@code Date} object for this server. If the
* nextUpdate date has already passed, set a new nextUpdate based on
* the nextUpdate interval and return that date.
*
* @return a {@code Date} object set to the nextUpdate field for OCSP
* responses.
*/
private synchronized Date getNextUpdate() {
if (nextUpdate != null && nextUpdate.before(new Date())) {
long nuEpochTime = nextUpdate.getTime();
long currentTime = System.currentTimeMillis();
// Keep adding nextUpdate intervals until you reach a date
// that is later than current time.
while (currentTime >= nuEpochTime) {
nuEpochTime += nextUpdateInterval;
}
// Set the nextUpdate for future threads
nextUpdate = new Date(nuEpochTime);
log("nextUpdate updated to new value: " + nextUpdate);
}
return nextUpdate;
}
/**
* Add entries into the responder's status database.
*
* @param newEntries a map of {@code CertStatusInfo} objects, keyed on
* their serial number (as a {@code BigInteger}). All serial numbers
* are assumed to have come from this responder's issuer certificate.
*
* @throws IOException if a CertId cannot be generated.
*/
public void updateStatusDb(Map<BigInteger, CertStatusInfo> newEntries)
throws IOException {
if (newEntries != null) {
for (BigInteger serial : newEntries.keySet()) {
CertStatusInfo info = newEntries.get(serial);
if (info != null) {
CertId cid = new CertId(issuerCert,
new SerialNumber(serial));
statusDb.put(cid, info);
log("Added entry for serial " + serial + "(" +
info.getType() + ")");
}
}
}
}
/**
* Check the status database for revocation information one one or more
* certificates.
*
* @param reqList the list of {@code LocalSingleRequest} objects taken
* from the incoming OCSP request.
*
* @return a {@code Map} of {@code CertStatusInfo} objects keyed by their
* {@code CertId} values, for each single request passed in. Those
* CertIds not found in the statusDb will have returned List members with
* a status of UNKNOWN.
*/
private Map<CertId, CertStatusInfo> checkStatusDb(
List<LocalOcspRequest.LocalSingleRequest> reqList) {
// TODO figure out what, if anything to do with request extensions
Map<CertId, CertStatusInfo> returnMap = new HashMap<>();
for (LocalOcspRequest.LocalSingleRequest req : reqList) {
CertId cid = req.getCertId();
CertStatusInfo info = statusDb.get(cid);
if (info != null) {
log("Status for SN " + cid.getSerialNumber() + ": " +
info.getType());
returnMap.put(cid, info);
} else {
log("Status for SN " + cid.getSerialNumber() +
" not found, using CERT_STATUS_UNKNOWN");
returnMap.put(cid,
new CertStatusInfo(CertStatus.CERT_STATUS_UNKNOWN));
}
}
return Collections.unmodifiableMap(returnMap);
}
/**
* Set the digital signature algorithm used to sign OCSP responses.
*
* @param algName The algorithm name
*
* @throws NoSuchAlgorithmException if the algorithm name is invalid.
*/
public void setSignatureAlgorithm(String algName)
throws NoSuchAlgorithmException {
if (!started) {
sigAlgId = AlgorithmId.get(algName);
}
}
/**
* Get the port the OCSP server is running on.
*
* @return the port that the OCSP server is running on, or -1 if the
* server has not yet been bound to a port.
*/
public int getPort() {
if (serverReady) {
InetSocketAddress inetSock =
(InetSocketAddress)servSocket.getLocalSocketAddress();
return inetSock.getPort();
} else {
return -1;
}
}
/**
* Use to check if OCSP server is ready to accept connection.
*
* @return true if server ready, false otherwise
*/
public boolean isServerReady() {
return serverReady;
}
/**
* Set a delay between the reception of the request and production of
* the response.
*
* @param delayMillis the number of milliseconds to wait before acting
* on the incoming request.
*/
public void setDelay(long delayMillis) {
delayMsec = delayMillis > 0 ? delayMillis : 0;
if (delayMsec > 0) {
log("OCSP latency set to " + delayMsec + " milliseconds.");
} else {
log("OCSP latency disabled");
}
}
/**
* Log a message to stdout.
*
* @param message the message to log
*/
private synchronized void log(String message) {
if (logEnabled || debug != null) {
System.out.println("[" + Thread.currentThread().getName() + "]: " +
message);
}
}
/**
* Log an error message on the stderr stream.
*
* @param message the message to log
*/
private static synchronized void err(String message) {
System.out.println("[" + Thread.currentThread().getName() + "]: " +
message);
}
/**
* Log exception information on the stderr stream.
*
* @param exc the exception to dump information about
*/
private static synchronized void err(Throwable exc) {
System.out.print("[" + Thread.currentThread().getName() +
"]: Exception: ");
exc.printStackTrace(System.out);
}
/**
* The {@code CertStatusInfo} class defines an object used to return
* information from the internal status database. The data in this
* object may be used to construct OCSP responses.
*/
public static class CertStatusInfo {
private CertStatus certStatusType;
private CRLReason reason;
private Date revocationTime;
/**
* Create a Certificate status object by providing the status only.
* If the status is {@code REVOKED} then current time is assumed
* for the revocation time.
*
* @param statType the status for this entry.
*/
public CertStatusInfo(CertStatus statType) {
this(statType, null, null);
}
/**
* Create a CertStatusInfo providing both type and revocation date
* (if applicable).
*
* @param statType the status for this entry.
* @param revDate if applicable, the date that revocation took place.
* A value of {@code null} indicates that current time should be used.
* If the value of {@code statType} is not {@code CERT_STATUS_REVOKED},
* then the {@code revDate} parameter is ignored.
*/
public CertStatusInfo(CertStatus statType, Date revDate) {
this(statType, revDate, null);
}
/**
* Create a CertStatusInfo providing type, revocation date
* (if applicable) and revocation reason.
*
* @param statType the status for this entry.
* @param revDate if applicable, the date that revocation took place.
* A value of {@code null} indicates that current time should be used.
* If the value of {@code statType} is not {@code CERT_STATUS_REVOKED},
* then the {@code revDate} parameter is ignored.
* @param revReason the reason the certificate was revoked. A value of
* {@code null} means that no reason was provided.
*/
public CertStatusInfo(CertStatus statType, Date revDate,
CRLReason revReason) {
Objects.requireNonNull(statType, "Cert Status must be non-null");
certStatusType = statType;
switch (statType) {
case CERT_STATUS_GOOD:
case CERT_STATUS_UNKNOWN:
revocationTime = null;
break;
case CERT_STATUS_REVOKED:
revocationTime = revDate != null ? (Date)revDate.clone() :
new Date();
break;
default:
throw new IllegalArgumentException("Unknown status type: " +
statType);
}
}
/**
* Get the cert status type
*
* @return the status applied to this object (e.g.
* {@code CERT_STATUS_GOOD}, {@code CERT_STATUS_UNKNOWN}, etc.)
*/
public CertStatus getType() {
return certStatusType;
}
/**
* Get the revocation time (if applicable).
*
* @return the revocation time as a {@code Date} object, or
* {@code null} if not applicable (i.e. if the certificate hasn't been
* revoked).
*/
public Date getRevocationTime() {
return (revocationTime != null ? (Date)revocationTime.clone() :
null);
}
/**
* Get the revocation reason.
*
* @return the revocation reason, or {@code null} if one was not
* provided.
*/
public CRLReason getRevocationReason() {
return reason;
}
}
/**
* Runnable task that handles incoming OCSP Requests and returns
* responses.
*/
private class OcspHandler implements Runnable {
private final Socket sock;
InetSocketAddress peerSockAddr;
/**
* Construct an {@code OcspHandler}.
*
* @param incomingSocket the socket the server created on accept()
*/
private OcspHandler(Socket incomingSocket) {
sock = incomingSocket;
}
/**
* Run the OCSP Request parser and construct a response to be sent
* back to the client.
*/
@Override
public void run() {
// If we have implemented a delay to simulate network latency
// wait out the delay here before any other processing.
try {
if (delayMsec > 0) {
Thread.sleep(delayMsec);
}
} catch (InterruptedException ie) {
// Just log the interrupted sleep
log("Delay of " + delayMsec + " milliseconds was interrupted");
}
try (Socket ocspSocket = sock;
InputStream in = ocspSocket.getInputStream();
OutputStream out = ocspSocket.getOutputStream()) {
peerSockAddr =
(InetSocketAddress)ocspSocket.getRemoteSocketAddress();
log("Received incoming connection from " + peerSockAddr);
String[] headerTokens = readLine(in).split(" ");
LocalOcspRequest ocspReq = null;
LocalOcspResponse ocspResp = null;
ResponseStatus respStat = ResponseStatus.INTERNAL_ERROR;
try {
if (headerTokens[0] != null) {
switch (headerTokens[0]) {
case "POST":
ocspReq = parseHttpOcspPost(in);
break;
case "GET":
// req = parseHttpOcspGet(in);
// TODO implement the GET parsing
throw new IOException("GET method unsupported");
default:
respStat = ResponseStatus.MALFORMED_REQUEST;
throw new IOException("Not a GET or POST");
}
} else {
respStat = ResponseStatus.MALFORMED_REQUEST;
throw new IOException("Unable to get HTTP method");
}
if (ocspReq != null) {
log(ocspReq.toString());
// Get responses for all CertIds in the request
Map<CertId, CertStatusInfo> statusMap =
checkStatusDb(ocspReq.getRequests());
if (statusMap.isEmpty()) {
respStat = ResponseStatus.UNAUTHORIZED;
} else {
ocspResp = new LocalOcspResponse(
ResponseStatus.SUCCESSFUL, statusMap,
ocspReq.getExtensions());
}
} else {
respStat = ResponseStatus.MALFORMED_REQUEST;
throw new IOException("Found null request");
}
} catch (IOException | RuntimeException exc) {
err(exc);
}
if (ocspResp == null) {
ocspResp = new LocalOcspResponse(respStat);
}
sendResponse(out, ocspResp);
} catch (IOException | CertificateException exc) {
err(exc);
}
}
/**
* Send an OCSP response on an {@code OutputStream}.
*
* @param out the {@code OutputStream} on which to send the response.
* @param resp the OCSP response to send.
*
* @throws IOException if an encoding error occurs.
*/
public void sendResponse(OutputStream out, LocalOcspResponse resp)
throws IOException {
StringBuilder sb = new StringBuilder();
byte[] respBytes;
try {
respBytes = resp.getBytes();
} catch (RuntimeException re) {
err(re);
return;
}
sb.append("HTTP/1.0 200 OK\r\n");
sb.append("Content-Type: application/ocsp-response\r\n");
sb.append("Content-Length: ").append(respBytes.length);
sb.append("\r\n\r\n");
out.write(sb.toString().getBytes("UTF-8"));
out.write(respBytes);
log(resp.toString());
}
/**
* Parse the incoming HTTP POST of an OCSP Request.
*
* @param inStream the input stream from the socket bound to this
* {@code OcspHandler}.
*
* @return the OCSP Request as a {@code LocalOcspRequest}
*
* @throws IOException if there are network related issues or problems
* occur during parsing of the OCSP request.
* @throws CertificateException if one or more of the certificates in
* the OCSP request cannot be read/parsed.
*/
private LocalOcspRequest parseHttpOcspPost(InputStream inStream)
throws IOException, CertificateException {
boolean endOfHeader = false;
boolean properContentType = false;
int length = -1;
while (!endOfHeader) {
String[] lineTokens = readLine(inStream).split(" ");
if (lineTokens[0].isEmpty()) {
endOfHeader = true;
} else if (lineTokens[0].equalsIgnoreCase("Content-Type:")) {
if (lineTokens[1] == null ||
!lineTokens[1].equals(
"application/ocsp-request")) {
log("Unknown Content-Type: " +
(lineTokens[1] != null ?
lineTokens[1] : "<NULL>"));
return null;
} else {
properContentType = true;
log("Content-Type = " + lineTokens[1]);
}
} else if (lineTokens[0].equalsIgnoreCase("Content-Length:")) {
if (lineTokens[1] != null) {
length = Integer.parseInt(lineTokens[1]);
log("Content-Length = " + length);
}
}
}
// Okay, make sure we got what we needed from the header, then
// read the remaining OCSP Request bytes
if (properContentType && length >= 0) {
byte[] ocspBytes = new byte[length];
inStream.read(ocspBytes);
return new LocalOcspRequest(ocspBytes);
} else {
return null;
}
}
/**
* Read a line of text that is CRLF-delimited.
*
* @param is the {@code InputStream} tied to the socket
* for this {@code OcspHandler}
*
* @return a {@code String} consisting of the line of text
* read from the stream with the CRLF stripped.
*
* @throws IOException if any I/O error occurs.
*/
private String readLine(InputStream is) throws IOException {
PushbackInputStream pbis = new PushbackInputStream(is);
ByteArrayOutputStream bos = new ByteArrayOutputStream();
boolean done = false;
while (!done) {
byte b = (byte)pbis.read();
if (b == '\r') {
byte bNext = (byte)pbis.read();
if (bNext == '\n' || bNext == -1) {
done = true;
} else {
pbis.unread(bNext);
bos.write(b);
}
} else if (b == -1) {
done = true;
} else {
bos.write(b);
}
}
return new String(bos.toByteArray(), "UTF-8");
}
}
/**
* Simple nested class to handle OCSP requests without making
* changes to sun.security.provider.certpath.OCSPRequest
*/
public class LocalOcspRequest {
private byte[] nonce;
private byte[] signature = null;
private AlgorithmId algId = null;
private int version = 0;
private GeneralName requestorName = null;
private Map<String, Extension> extensions = Collections.emptyMap();
private final List<LocalSingleRequest> requestList = new ArrayList<>();
private final List<X509Certificate> certificates = new ArrayList<>();
/**
* Construct a {@code LocalOcspRequest} from its DER encoding.
*
* @param requestBytes the DER-encoded bytes
*
* @throws IOException if decoding errors occur
* @throws CertificateException if certificates are found in the
* OCSP request and they do not parse correctly.
*/
private LocalOcspRequest(byte[] requestBytes) throws IOException,
CertificateException {
Objects.requireNonNull(requestBytes, "Received null input");
DerInputStream dis = new DerInputStream(requestBytes);
// Parse the top-level structure, it should have no more than
// two elements.
DerValue[] topStructs = dis.getSequence(2);
for (DerValue dv : topStructs) {
if (dv.tag == DerValue.tag_Sequence) {
parseTbsRequest(dv);
} else if (dv.isContextSpecific((byte)0)) {
parseSignature(dv);
} else {
throw new IOException("Unknown tag at top level: " +
dv.tag);
}
}
}
/**
* Parse the signature block from an OCSP request
*
* @param sigSequence a {@code DerValue} containing the signature
* block at the outer sequence datum.
*
* @throws IOException if any non-certificate-based parsing errors occur
* @throws CertificateException if certificates are found in the
* OCSP request and they do not parse correctly.
*/
private void parseSignature(DerValue sigSequence)
throws IOException, CertificateException {
DerValue[] sigItems = sigSequence.data.getSequence(3);
if (sigItems.length != 3) {
throw new IOException("Invalid number of signature items: " +
"expected 3, got " + sigItems.length);
}
algId = AlgorithmId.parse(sigItems[0]);
signature = sigItems[1].getBitString();
if (sigItems[2].isContextSpecific((byte)0)) {
DerValue[] certDerItems = sigItems[2].data.getSequence(4);
int i = 0;
for (DerValue dv : certDerItems) {
X509Certificate xc = new X509CertImpl(dv);
certificates.add(xc);
}
} else {
throw new IOException("Invalid tag in signature block: " +
sigItems[2].tag);
}
}
/**
* Parse the to-be-signed request data
*
* @param tbsReqSeq a {@code DerValue} object containing the to-be-
* signed OCSP request at the outermost SEQUENCE tag.
* @throws IOException if any parsing errors occur
*/
private void parseTbsRequest(DerValue tbsReqSeq) throws IOException {
while (tbsReqSeq.data.available() > 0) {
DerValue dv = tbsReqSeq.data.getDerValue();
if (dv.isContextSpecific((byte)0)) {
// The version was explicitly called out
version = dv.data.getInteger();
} else if (dv.isContextSpecific((byte)1)) {
// A GeneralName was provided
requestorName = new GeneralName(dv.data.getDerValue());
} else if (dv.isContextSpecific((byte)2)) {
// Parse the extensions
DerValue[] extItems = dv.data.getSequence(2);
extensions = parseExtensions(extItems);
} else if (dv.tag == DerValue.tag_Sequence) {
while (dv.data.available() > 0) {
requestList.add(new LocalSingleRequest(dv.data));
}
}
}
}
/**
* Parse a SEQUENCE of extensions. This routine is used both
* at the overall request level and down at the singleRequest layer.
*
* @param extDerItems an array of {@code DerValue} items, each one
* consisting of a DER-encoded extension.
*
* @return a {@code Map} of zero or more extensions,
* keyed by its object identifier in {@code String} form.
*
* @throws IOException if any parsing errors occur.
*/
private Map<String, Extension> parseExtensions(DerValue[] extDerItems)
throws IOException {
Map<String, Extension> extMap = new HashMap<>();
if (extDerItems != null && extDerItems.length != 0) {
for (DerValue extDerVal : extDerItems) {
sun.security.x509.Extension ext =
new sun.security.x509.Extension(extDerVal);
extMap.put(ext.getId(), ext);
}
}
return extMap;
}
/**
* Return the list of single request objects in this OCSP request.
*
* @return an unmodifiable {@code List} of zero or more requests.
*/
private List<LocalSingleRequest> getRequests() {
return Collections.unmodifiableList(requestList);
}
/**
* Return the list of X.509 Certificates in this OCSP request.
*
* @return an unmodifiable {@code List} of zero or more
* {@cpde X509Certificate} objects.
*/
private List<X509Certificate> getCertificates() {
return Collections.unmodifiableList(certificates);
}
/**
* Return the map of OCSP request extensions.
*
* @return an unmodifiable {@code Map} of zero or more
* {@code Extension} objects, keyed by their object identifiers
* in {@code String} form.
*/
private Map<String, Extension> getExtensions() {
return Collections.unmodifiableMap(extensions);
}
/**
* Display the {@code LocalOcspRequest} in human readable form.
*
* @return a {@code String} representation of the
* {@code LocalOcspRequest}
*/
@Override
public String toString() {
StringBuilder sb = new StringBuilder();
sb.append(String.format("OCSP Request: Version %d (0x%X)",
version + 1, version)).append("\n");
if (requestorName != null) {
sb.append("Requestor Name: ").append(requestorName).
append("\n");
}
int requestCtr = 0;
for (LocalSingleRequest lsr : requestList) {
sb.append("Request [").append(requestCtr++).append("]\n");
sb.append(lsr).append("\n");
}
if (!extensions.isEmpty()) {
sb.append("Extensions (").append(extensions.size()).
append(")\n");
for (Extension ext : extensions.values()) {
sb.append("\t").append(ext).append("\n");
}
}
if (signature != null) {
sb.append("Signature: ").append(algId).append("\n");
sb.append(dumpHexBytes(signature)).append("\n");
int certCtr = 0;
for (X509Certificate cert : certificates) {
sb.append("Certificate [").append(certCtr++).append("]").
append("\n");
sb.append("\tSubject: ");
sb.append(cert.getSubjectX500Principal()).append("\n");
sb.append("\tIssuer: ");
sb.append(cert.getIssuerX500Principal()).append("\n");
sb.append("\tSerial: ").append(cert.getSerialNumber());
}
}
return sb.toString();
}
/**
* Inner class designed to handle the decoding/representation of
* single requests within a {@code LocalOcspRequest} object.
*/
public class LocalSingleRequest {
private final CertId cid;
private Map<String, Extension> extensions = Collections.emptyMap();
private LocalSingleRequest(DerInputStream dis)
throws IOException {
DerValue[] srItems = dis.getSequence(2);
// There should be 1, possibly 2 DerValue items
if (srItems.length == 1 || srItems.length == 2) {
// The first parsable item should be the mandatory CertId
cid = new CertId(srItems[0].data);
if (srItems.length == 2) {
if (srItems[1].isContextSpecific((byte)0)) {
DerValue[] extDerItems = srItems[1].data.getSequence(2);
extensions = parseExtensions(extDerItems);
} else {
throw new IOException("Illegal tag in Request " +
"extensions: " + srItems[1].tag);
}
}
} else {
throw new IOException("Invalid number of items in " +
"Request (" + srItems.length + ")");
}
}
/**
* Get the {@code CertId} for this single request.
*
* @return the {@code CertId} for this single request.
*/
private CertId getCertId() {
return cid;
}
/**
* Return the map of single request extensions.
*
* @return an unmodifiable {@code Map} of zero or more
* {@code Extension} objects, keyed by their object identifiers
* in {@code String} form.
*/
private Map<String, Extension> getExtensions() {
return Collections.unmodifiableMap(extensions);
}
/**
* Display the {@code LocalSingleRequest} in human readable form.
*
* @return a {@code String} representation of the
* {@code LocalSingleRequest}
*/
@Override
public String toString() {
StringBuilder sb = new StringBuilder();
sb.append("CertId, Algorithm = ");
sb.append(cid.getHashAlgorithm()).append("\n");
sb.append("\tIssuer Name Hash: ");
sb.append(dumpHexBytes(cid.getIssuerNameHash(), 256, "", ""));
sb.append("\n");
sb.append("\tIssuer Key Hash: ");
sb.append(dumpHexBytes(cid.getIssuerKeyHash(), 256, "", ""));
sb.append("\n");
sb.append("\tSerial Number: ").append(cid.getSerialNumber());
if (!extensions.isEmpty()) {
sb.append("Extensions (").append(extensions.size()).
append(")\n");
for (Extension ext : extensions.values()) {
sb.append("\t").append(ext).append("\n");
}
}
return sb.toString();
}
}
}
/**
* Simple nested class to handle OCSP requests without making
* changes to sun.security.provider.certpath.OCSPResponse
*/
public class LocalOcspResponse {
private final int version = 0;
private final OCSPResponse.ResponseStatus responseStatus;
private final Map<CertId, CertStatusInfo> respItemMap;
private final Date producedAtDate;
private final List<LocalSingleResponse> singleResponseList =
new ArrayList<>();
private final Map<String, Extension> responseExtensions;
private byte[] signature;
private final List<X509Certificate> certificates;
private final byte[] encodedResponse;
/**
* Constructor for the generation of non-successful responses
*
* @param respStat the OCSP response status.
*
* @throws IOException if an error happens during encoding
* @throws NullPointerException if {@code respStat} is {@code null}
* or {@code respStat} is successful.
*/
public LocalOcspResponse(OCSPResponse.ResponseStatus respStat)
throws IOException {
this(respStat, null, null);
}
/**
* Construct a response from a list of certificate
* status objects and extensions.
*
* @param respStat the status of the entire response
* @param itemMap a {@code Map} of {@code CertId} objects and their
* respective revocation statuses from the server's response DB.
* @param reqExtensions a {@code Map} of request extensions
*
* @throws IOException if an error happens during encoding
* @throws NullPointerException if {@code respStat} is {@code null}
* or {@code respStat} is successful, and a {@code null} {@code itemMap}
* has been provided.
*/
public LocalOcspResponse(OCSPResponse.ResponseStatus respStat,
Map<CertId, CertStatusInfo> itemMap,
Map<String, Extension> reqExtensions) throws IOException {
responseStatus = Objects.requireNonNull(respStat,
"Illegal null response status");
if (responseStatus == ResponseStatus.SUCCESSFUL) {
respItemMap = Objects.requireNonNull(itemMap,
"SUCCESSFUL responses must have a response map");
producedAtDate = new Date();
// Turn the answerd from the response DB query into a list
// of single responses.
for (CertId id : itemMap.keySet()) {
singleResponseList.add(
new LocalSingleResponse(id, itemMap.get(id)));
}
responseExtensions = setResponseExtensions(reqExtensions);
certificates = new ArrayList<>();
if (signerCert != issuerCert) {
certificates.add(signerCert);
}
certificates.add(issuerCert);
} else {
respItemMap = null;
producedAtDate = null;
responseExtensions = null;
certificates = null;
}
encodedResponse = this.getBytes();
}
/**
* Set the response extensions based on the request extensions
* that were received. Right now, this is limited to the
* OCSP nonce extension.
*
* @param reqExts a {@code Map} of zero or more request extensions
*
* @return a {@code Map} of zero or more response extensions, keyed
* by the extension object identifier in {@code String} form.
*/
private Map<String, Extension> setResponseExtensions(
Map<String, Extension> reqExts) {
Map<String, Extension> respExts = new HashMap<>();
String ocspNonceStr = PKIXExtensions.OCSPNonce_Id.toString();
if (reqExts != null) {
for (String id : reqExts.keySet()) {
if (id.equals(ocspNonceStr)) {
// We found a nonce, add it into the response extensions
Extension ext = reqExts.get(id);
if (ext != null) {
respExts.put(id, ext);
log("Added OCSP Nonce to response");
} else {
log("Error: Found nonce entry, but found null " +
"value. Skipping");
}
}
}
}
return respExts;
}
/**
* Get the DER-encoded response bytes for this response
*
* @return a byte array containing the DER-encoded bytes for
* the response
*
* @throws IOException if any encoding errors occur
*/
private byte[] getBytes() throws IOException {
DerOutputStream outerSeq = new DerOutputStream();
DerOutputStream responseStream = new DerOutputStream();
responseStream.putEnumerated(responseStatus.ordinal());
if (responseStatus == ResponseStatus.SUCCESSFUL &&
respItemMap != null) {
encodeResponseBytes(responseStream);
}
// Commit the outermost sequence bytes
outerSeq.write(DerValue.tag_Sequence, responseStream);
return outerSeq.toByteArray();
}
private void encodeResponseBytes(DerOutputStream responseStream)
throws IOException {
DerOutputStream explicitZero = new DerOutputStream();
DerOutputStream respItemStream = new DerOutputStream();
respItemStream.putOID(OCSP_BASIC_RESPONSE_OID);
byte[] basicOcspBytes = encodeBasicOcspResponse();
respItemStream.putOctetString(basicOcspBytes);
explicitZero.write(DerValue.tag_Sequence, respItemStream);
responseStream.write(DerValue.createTag(DerValue.TAG_CONTEXT,
true, (byte)0), explicitZero);
}
private byte[] encodeBasicOcspResponse() throws IOException {
DerOutputStream outerSeq = new DerOutputStream();
DerOutputStream basicORItemStream = new DerOutputStream();
// Encode the tbsResponse
byte[] tbsResponseBytes = encodeTbsResponse();
basicORItemStream.write(tbsResponseBytes);
try {
sigAlgId.derEncode(basicORItemStream);
// Create the signature
Signature sig = Signature.getInstance(sigAlgId.getName());
sig.initSign(signerKey);
sig.update(tbsResponseBytes);
signature = sig.sign();
basicORItemStream.putBitString(signature);
} catch (GeneralSecurityException exc) {
err(exc);
throw new IOException(exc);
}
// Add certificates
try {
DerOutputStream certStream = new DerOutputStream();
ArrayList<DerValue> certList = new ArrayList<>();
if (signerCert != issuerCert) {
certList.add(new DerValue(signerCert.getEncoded()));
}
certList.add(new DerValue(issuerCert.getEncoded()));
DerValue[] dvals = new DerValue[certList.size()];
certStream.putSequence(certList.toArray(dvals));
basicORItemStream.write(DerValue.createTag(DerValue.TAG_CONTEXT,
true, (byte)0), certStream);
} catch (CertificateEncodingException cex) {
err(cex);
throw new IOException(cex);
}
// Commit the outermost sequence bytes
outerSeq.write(DerValue.tag_Sequence, basicORItemStream);
return outerSeq.toByteArray();
}
private byte[] encodeTbsResponse() throws IOException {
DerOutputStream outerSeq = new DerOutputStream();
DerOutputStream tbsStream = new DerOutputStream();
// Note: We're not going explicitly assert the version
tbsStream.write(respId.getEncoded());
tbsStream.putGeneralizedTime(producedAtDate);
// Sequence of responses
encodeSingleResponses(tbsStream);
// TODO: add response extension support
encodeExtensions(tbsStream);
outerSeq.write(DerValue.tag_Sequence, tbsStream);
return outerSeq.toByteArray();
}
private void encodeSingleResponses(DerOutputStream tbsStream)
throws IOException {
DerValue[] srDerVals = new DerValue[singleResponseList.size()];
int srDvCtr = 0;
for (LocalSingleResponse lsr : singleResponseList) {
srDerVals[srDvCtr++] = new DerValue(lsr.getBytes());
}
tbsStream.putSequence(srDerVals);
}
private void encodeExtensions(DerOutputStream tbsStream)
throws IOException {
DerOutputStream extSequence = new DerOutputStream();
DerOutputStream extItems = new DerOutputStream();
for (Extension ext : responseExtensions.values()) {
ext.encode(extItems);
}
extSequence.write(DerValue.tag_Sequence, extItems);
tbsStream.write(DerValue.createTag(DerValue.TAG_CONTEXT, true,
(byte)1), extSequence);
}
@Override
public String toString() {
StringBuilder sb = new StringBuilder();
sb.append("OCSP Response: ").append(responseStatus).append("\n");
if (responseStatus == ResponseStatus.SUCCESSFUL) {
sb.append("Response Type: ").
append(OCSP_BASIC_RESPONSE_OID.toString()).append("\n");
sb.append(String.format("Version: %d (0x%X)", version + 1,
version)).append("\n");
sb.append("Responder Id: ").append(respId.toString()).
append("\n");
sb.append("Produced At: ").
append(utcDateFmt.format(producedAtDate)).append("\n");
int srCtr = 0;
for (LocalSingleResponse lsr : singleResponseList) {
sb.append("SingleResponse [").append(srCtr++).append("]\n");
sb.append(lsr);
}
if (!responseExtensions.isEmpty()) {
sb.append("Extensions (").append(responseExtensions.size()).
append(")\n");
for (Extension ext : responseExtensions.values()) {
sb.append("\t").append(ext).append("\n");
}
} else {
sb.append("\n");
}
if (signature != null) {
sb.append("Signature: ").append(sigAlgId).append("\n");
sb.append(dumpHexBytes(signature)).append("\n");
int certCtr = 0;
for (X509Certificate cert : certificates) {
sb.append("Certificate [").append(certCtr++).append("]").
append("\n");
sb.append("\tSubject: ");
sb.append(cert.getSubjectX500Principal()).append("\n");
sb.append("\tIssuer: ");
sb.append(cert.getIssuerX500Principal()).append("\n");
sb.append("\tSerial: ").append(cert.getSerialNumber());
sb.append("\n");
}
}
}
return sb.toString();
}
private class LocalSingleResponse {
private final CertId certId;
private final CertStatusInfo csInfo;
private final Date thisUpdate;
private final Date lsrNextUpdate;
private final Map<String, Extension> singleExtensions;
public LocalSingleResponse(CertId cid, CertStatusInfo info) {
certId = Objects.requireNonNull(cid, "CertId must be non-null");
csInfo = Objects.requireNonNull(info,
"CertStatusInfo must be non-null");
// For now, we'll keep things simple and make the thisUpdate
// field the same as the producedAt date.
thisUpdate = producedAtDate;
lsrNextUpdate = getNextUpdate();
// TODO Add extensions support
singleExtensions = Collections.emptyMap();
}
@Override
public String toString() {
StringBuilder sb = new StringBuilder();
sb.append("Certificate Status: ").append(csInfo.getType());
sb.append("\n");
if (csInfo.getType() == CertStatus.CERT_STATUS_REVOKED) {
sb.append("Revocation Time: ");
sb.append(utcDateFmt.format(csInfo.getRevocationTime()));
sb.append("\n");
if (csInfo.getRevocationReason() != null) {
sb.append("Revocation Reason: ");
sb.append(csInfo.getRevocationReason()).append("\n");
}
}
sb.append("CertId, Algorithm = ");
sb.append(certId.getHashAlgorithm()).append("\n");
sb.append("\tIssuer Name Hash: ");
sb.append(dumpHexBytes(certId.getIssuerNameHash(), 256, "", ""));
sb.append("\n");
sb.append("\tIssuer Key Hash: ");
sb.append(dumpHexBytes(certId.getIssuerKeyHash(), 256, "", ""));
sb.append("\n");
sb.append("\tSerial Number: ").append(certId.getSerialNumber());
sb.append("\n");
sb.append("This Update: ");
sb.append(utcDateFmt.format(thisUpdate)).append("\n");
if (lsrNextUpdate != null) {
sb.append("Next Update: ");
sb.append(utcDateFmt.format(lsrNextUpdate)).append("\n");
}
if (!singleExtensions.isEmpty()) {
sb.append("Extensions (").append(singleExtensions.size()).
append(")\n");
for (Extension ext : singleExtensions.values()) {
sb.append("\t").append(ext).append("\n");
}
}
return sb.toString();
}
public byte[] getBytes() throws IOException {
byte[] nullData = { };
DerOutputStream responseSeq = new DerOutputStream();
DerOutputStream srStream = new DerOutputStream();
// Encode the CertId
certId.encode(srStream);
// Next, encode the CertStatus field
CertStatus csiType = csInfo.getType();
switch (csiType) {
case CERT_STATUS_GOOD:
srStream.write(DerValue.createTag(DerValue.TAG_CONTEXT,
false, (byte)0), nullData);
break;
case CERT_STATUS_REVOKED:
DerOutputStream revInfo = new DerOutputStream();
revInfo.putGeneralizedTime(csInfo.getRevocationTime());
CRLReason revReason = csInfo.getRevocationReason();
if (revReason != null) {
byte[] revDer = new byte[3];
revDer[0] = DerValue.tag_Enumerated;
revDer[1] = 1;
revDer[2] = (byte)revReason.ordinal();
revInfo.write(DerValue.createTag(
DerValue.TAG_CONTEXT, true, (byte)0),
revDer);
}
srStream.write(DerValue.createTag(
DerValue.TAG_CONTEXT, true, (byte)1),
revInfo);
break;
case CERT_STATUS_UNKNOWN:
srStream.write(DerValue.createTag(DerValue.TAG_CONTEXT,
false, (byte)2), nullData);
break;
default:
throw new IOException("Unknown CertStatus: " + csiType);
}
// Add the necessary dates
srStream.putGeneralizedTime(thisUpdate);
if (lsrNextUpdate != null) {
DerOutputStream nuStream = new DerOutputStream();
nuStream.putGeneralizedTime(lsrNextUpdate);
srStream.write(DerValue.createTag(DerValue.TAG_CONTEXT,
true, (byte)0), nuStream);
}
// TODO add singleResponse Extension support
// Add the single response to the response output stream
responseSeq.write(DerValue.tag_Sequence, srStream);
return responseSeq.toByteArray();
}
}
}
}