Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

 1                        if (!(current.after(response.getThisUpdate()) &&
 2                                current.before(response.getNextUpdate()))) {
 3                            ctx.fireExceptionCaught(new IllegalStateException("OCSP Response is out-of-date"));
 4                        }

 1   5. The time at which the status being indicated is known to be
 2      correct (thisUpdate) is sufficiently recent;
 3 
 4   6. When available, the time at or before which newer information will
 5      be available about the status of the certificate (nextUpdate) is
 6      greater than the current time.

 1    @Test
 2    void staleOcspResponseIsRejected() throws Exception {
 3        X509Bundle caRoot = new CertificateBuilder()
 4                .algorithm(CertificateBuilder.Algorithm.rsa2048)
 5                .subject("CN=TrustedRootCA")
 6                .setIsCertificateAuthority(true)
 7                .buildSelfSigned();
 8 
 9        GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, "http://localhost/");
10        AuthorityInformationAccess aia = new AuthorityInformationAccess(
11                new AccessDescription(AccessDescription.id_ad_ocsp, ocspName));
12        X509Bundle targetCert = new CertificateBuilder()
13                .algorithm(CertificateBuilder.Algorithm.rsa2048)
14                .subject("CN=TargetServer")
15                .addExtensionOctetString("1.3.6.1.5.5.7.1.1", false, aia.getEncoded())
16                .buildIssuedBy(caRoot);
17 
18        Date past = new Date(System.currentTimeMillis() - TimeUnit.DAYS.toMillis(7));
19        CertificateID certId = new CertificateID(
20                new JcaDigestCalculatorProviderBuilder().build().get(CertificateID.HASH_SHA1),
21                new JcaX509CertificateHolder(caRoot.getCertificate()),
22                targetCert.getCertificate().getSerialNumber());
23        BasicOCSPRespBuilder respBuilder = new BasicOCSPRespBuilder(
24                new RespID(new JcaX509CertificateHolder(caRoot.getCertificate()).getSubject()));
25        respBuilder.addResponse(certId, CertificateStatus.GOOD, past, past);
26        BasicOCSPResp expiredBasicResp = respBuilder.build(
27                new JcaContentSignerBuilder("SHA256withRSA").build(caRoot.getKeyPair().getPrivate()),
28                new X509CertificateHolder[0],
29                past);
30        final byte[] responseEncoded = new OCSPRespBuilder()
31                .build(OCSPRespBuilder.SUCCESSFUL, expiredBasicResp).getEncoded();
32 
33        IoTransport defaultTransport = createDefaultTransport();
34        IoTransport mockTransport = IoTransport.create(defaultTransport.eventLoop(), () -> {
35                NioSocketChannel channel = new NioSocketChannel();
36                channel.pipeline().addFirst(new ChannelOutboundHandlerAdapter() {
37                    @Override
38                    public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress,
39                                        SocketAddress localAddress, ChannelPromise promise) {
40                        promise.setSuccess();
41                        ctx.executor().execute(() -> {
42                            ctx.pipeline().fireChannelActive();
43                            DefaultFullHttpResponse httpResponse = new DefaultFullHttpResponse(
44                                    HttpVersion.HTTP_1_1, HttpResponseStatus.OK,
45                                    Unpooled.wrappedBuffer(responseEncoded));
46                            httpResponse.headers().set(HttpHeaderNames.CONTENT_TYPE, "application/ocsp-response");
47                            httpResponse.headers().set(HttpHeaderNames.CONTENT_LENGTH,
48                                    httpResponse.content().readableBytes());
49                            ctx.pipeline().fireChannelRead(httpResponse);
50                        });
51                    }
52                });
53                return channel;
54            }, defaultTransport.datagramChannel());
55 
56            SslContext serverSslCtx = SslContextBuilder
57                    .forServer(targetCert.getKeyPair().getPrivate(),
58                            targetCert.getCertificate(), caRoot.getCertificate())
59                    .build();
60            Channel serverChannel = new ServerBootstrap()
61                    .group(defaultTransport.eventLoop())
62                    .channel(NioServerSocketChannel.class)
63                    .childHandler(new ChannelInitializer<SocketChannel>() {
64                        @Override
65                        protected void initChannel(SocketChannel ch) {
66                            ch.pipeline().addLast(serverSslCtx.newHandler(ch.alloc()));
67                        }
68                    })
69                    .bind(0).sync().channel();
70 
71            int serverPort = ((InetSocketAddress) serverChannel.localAddress()).getPort();
72 
73            AtomicBoolean validEventFired = new AtomicBoolean();
74            AtomicReference<Throwable> caughtException = new AtomicReference<>();
75            CountDownLatch latch = new CountDownLatch(1);
76 
77            DnsNameResolver resolver = OcspServerCertificateValidator.createDefaultResolver(mockTransport);
78            SslContext clientSslCtx = SslContextBuilder.forClient()
79                    .trustManager(InsecureTrustManagerFactory.INSTANCE)
80                    .build();
81            new Bootstrap()
82                    .group(defaultTransport.eventLoop())
83                    .channel(NioSocketChannel.class)
84                    .handler(new ChannelInitializer<SocketChannel>() {
85                        @Override
86                        protected void initChannel(SocketChannel ch) {
87                            ch.pipeline().addLast(clientSslCtx.newHandler(ch.alloc(), "127.0.0.1", serverPort));
88                            ch.pipeline().addLast(
89                                    new OcspServerCertificateValidator(true, false, mockTransport, resolver));
90                            ch.pipeline().addLast(new ChannelInboundHandlerAdapter() {
91                                @Override
92                                public void userEventTriggered(ChannelHandlerContext ctx, Object evt) {
93                                    if (evt instanceof OcspValidationEvent &&
94                                            ((OcspValidationEvent) evt).response().status() ==
95                                                    OcspResponse.Status.VALID) {
96                                        validEventFired.set(true);
97                                    }
98                                    ctx.fireUserEventTriggered(evt);
99                                }
100 
101                                @Override
102                                public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) {
103                                    caughtException.compareAndSet(null, cause);
104                                    ctx.channel().close();
105                                    latch.countDown();
106                                }
107                            });
108                        }
109                    })
110                    .connect("127.0.0.1", serverPort).sync();
111 
112            assertTrue(latch.await(5, TimeUnit.SECONDS));
113            assertFalse(validEventFired.get(),
114                    "OcspValidationEvent(VALID) must not be emitted for a stale OCSP response");
115            assertNotNull(caughtException.get());
116            assertInstanceOf(IllegalStateException.class, caughtException.get());
117 
118            serverChannel.close().sync();
119            resolver.close();
120    }