Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ELY-434 [Preview] OCSP Stapling Support #2144

Open
wants to merge 3 commits into
base: 2.x
Choose a base branch
from
Open

ELY-434 [Preview] OCSP Stapling Support #2144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
657ba2b
Bump enytron client schema from 1.7 to 1.8
Aug 19, 2024
f171c96
ELY-434 [Preview] OCSP Stapling Support
May 10, 2024
05fc2b9
Renamed the schema to include the stability level in it
Aug 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 76 additions & 1 deletion auth/client/src/main/java/org/wildfly/security/auth/client/ElytronXmlParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,8 @@ private enum Version {
VERSION_1_4("urn:elytron:client:1.4", VERSION_1_3),
VERSION_1_5("urn:elytron:client:1.5", VERSION_1_4),
VERSION_1_6("urn:elytron:client:1.6", VERSION_1_5),
VERSION_1_7("urn:elytron:client:1.7", VERSION_1_6);
VERSION_1_7("urn:elytron:client:1.7", VERSION_1_6),
VERSION_1_8_PREVIEW("urn:elytron:client:preview:1.8", VERSION_1_7);

final String namespace;

Expand Down Expand Up @@ -465,6 +466,7 @@ private static void parseSslContextType(final ConfigurationXMLStreamReader reade
ExceptionSupplier<KeyStore, ConfigXMLParseException> trustStoreSupplier = null;
DeferredSupplier<Provider[]> providersSupplier = new DeferredSupplier<>(providers);
TrustManagerBuilder trustManagerBuilder = new TrustManagerBuilder(providersSupplier, location);
boolean acceptOcspStapling = false;

while (reader.hasNext()) {
final int tag = reader.nextTag();
Expand Down Expand Up @@ -536,6 +538,13 @@ private static void parseSslContextType(final ConfigurationXMLStreamReader reade
parseCertificateRevocationLists(reader, trustManagerBuilder, xmlVersion);
break;
}
case "accept-ocsp-stapling": {
if (isSet(foundBits, 10)) throw reader.unexpectedElement();
foundBits = setBit(foundBits, 10);
if (!xmlVersion.isAtLeast(Version.VERSION_1_8_PREVIEW)) throw reader.unexpectedElement();
acceptOcspStapling = parseOcspStaplingType(reader, trustManagerBuilder, xmlVersion, keyStoresMap);
break;
}
default: throw reader.unexpectedElement();
}
} else if (tag != END_ELEMENT) {
Expand All @@ -549,6 +558,8 @@ private static void parseSslContextType(final ConfigurationXMLStreamReader reade
final ExceptionSupplier<X509ExtendedKeyManager, ConfigXMLParseException> finalKeyManagerSupplier = keyManagerSupplier;
final ExceptionSupplier<KeyStore, ConfigXMLParseException> finalTrustStoreSupplier = trustStoreSupplier;
final boolean initTrustManager = finalTrustStoreSupplier != null || isSet(foundBits, 7);
final boolean finalAcceptOcspStapling = acceptOcspStapling;

sslContextsMap.putIfAbsent(name, () -> {
final SSLContextBuilder sslContextBuilder = new SSLContextBuilder();
sslContextBuilder.setClientMode(true);
Expand All @@ -574,6 +585,7 @@ private static void parseSslContextType(final ConfigurationXMLStreamReader reade
sslContextBuilder.setProviderName(finalProviderName);
sslContextBuilder.setProviderSupplier(finalProvidersSupplier);
sslContextBuilder.setUseCipherSuitesOrder(true);
sslContextBuilder.setAcceptOCSPStapling(finalAcceptOcspStapling);
return sslContextBuilder.build();
});
return;
Expand All @@ -582,6 +594,56 @@ private static void parseSslContextType(final ConfigurationXMLStreamReader reade
throw reader.unexpectedDocumentEnd();
}

private static boolean parseOcspStaplingType(ConfigurationXMLStreamReader reader, TrustManagerBuilder builder, Version xmlVersion, Map<String, ExceptionSupplier<KeyStore, ConfigXMLParseException>> keyStoresMap) throws ConfigXMLParseException {
final int attributeCount = reader.getAttributeCount();
boolean acceptOcspStapling = false;
boolean softFail = false;
boolean gotResponderCertAlias = false;
boolean gotResponderKeystore = false;

for (int i = 0; i < attributeCount; i ++) {
checkAttributeNamespace(reader, i);
switch (reader.getAttributeLocalName(i)) {
case "accept-ocsp": {
if (acceptOcspStapling) throw reader.unexpectedAttribute(i);
if (!xmlVersion.isAtLeast(Version.VERSION_1_8_PREVIEW)) throw reader.unexpectedAttribute(i);
acceptOcspStapling = reader.getBooleanAttributeValueResolved(i);
builder.setOcspStapling(acceptOcspStapling);
break;
}
case "soft-fail": {
if (softFail) throw reader.unexpectedAttribute(i);
if (!xmlVersion.isAtLeast(Version.VERSION_1_8_PREVIEW)) throw reader.unexpectedAttribute(i);
softFail = reader.getBooleanAttributeValueResolved(i);
builder.setSoftFail(softFail);
break;
}
case "responder-certificate": {
if (gotResponderCertAlias) throw reader.unexpectedAttribute(i);
builder.setOcspRescponderCertAlias(reader.getAttributeValueResolved(i));
gotResponderCertAlias = true;
break;
}
case "responder-keystore": {
if (gotResponderKeystore) throw reader.unexpectedAttribute(i);
builder.setOcspResponderCertKeystoreSupplier(keyStoresMap.get(reader.getAttributeValueResolved(i)));
gotResponderKeystore = true;
break;
}
default: throw reader.unexpectedAttribute(i);
}
}
while (reader.hasNext()) {
final int tag = reader.nextTag();
if (tag == END_ELEMENT) {
return acceptOcspStapling;
} else {
throw reader.unexpectedContent();
}
}
throw reader.unexpectedDocumentEnd();
}

private static class TrustManagerBuilder {
final Supplier<Provider[]> providers;
final Location xmlLocation;
Expand All @@ -592,6 +654,7 @@ private static class TrustManagerBuilder {
List<InputStream> crlStreams = new ArrayList<>();
int maxCertPath = 5;
boolean ocsp = false;
boolean ocspStapling = false;
boolean preferCrls = false;
boolean onlyLeafCert = false;
boolean softFail = false;
Expand Down Expand Up @@ -638,6 +701,9 @@ boolean isMaxCertPathSet() {
public void setOcsp() {
this.ocsp = true;
}
public void setOcspStapling(boolean ocspStapling) {
this.ocspStapling = ocspStapling;
}

public void setPreferCrls(boolean preferCrls) {
this.preferCrls = preferCrls;
Expand Down Expand Up @@ -697,6 +763,15 @@ X509TrustManager build() throws NoSuchAlgorithmException, KeyStoreException, Con
revocationBuilder.setOcspResponderCert((X509Certificate) responderStore.getCertificate(responderCertAlias));
}

return revocationBuilder.build();
} else if (ocspStapling) {
X509RevocationTrustManager.Builder revocationBuilder = X509RevocationTrustManager.builder();
revocationBuilder.setTrustManagerFactory(trustManagerFactory);
revocationBuilder.setTrustStore(trustStore);
revocationBuilder.setCheckRevocation(true);
revocationBuilder.setSoftFail(softFail);
KeyStore responderStore = responderStoreSupplier != null ? responderStoreSupplier.get() : trustStore;
revocationBuilder.setOcspResponderCert((X509Certificate) responderStore.getCertificate(responderCertAlias));
return revocationBuilder.build();
} else {
trustManagerFactory.init(trustStore);
Expand Down
Loading
Loading