fix: restore OCSP support

diennea · Oct 9, 2024 · 16c6b5c · 16c6b5c
1 parent 46c16f8
commit 16c6b5c
Show file tree

Hide file tree

Showing 5 changed files with 87 additions and 74 deletions.
diff --git a/carapace-server/src/main/java/org/carapaceproxy/core/Listeners.java b/carapace-server/src/main/java/org/carapaceproxy/core/Listeners.java
@@ -189,7 +189,11 @@ private void bootListener(final NetworkListenerConfiguration config) throws Inte
                 .protocol(config.protocols().toArray(HttpProtocol[]::new));
         if (config.ssl()) {
             httpServer = httpServer.secure(sslContextSpec -> {
-                final var sslContextBuilder = sslContextSpec.sslContext(listeningChannel.defaultSslContext());
+                final var sslCtx = listeningChannel.defaultSslContext();
+                final var sslContextBuilder = sslContextSpec.sslContext(sslCtx);
+                if (listeningChannel.isOcspEnabled()) {
+                    sslContextBuilder.handlerConfigurator(new OcspSslHandler(sslCtx, parent.getOcspStaplingManager()));
+                }
                 for (final var certificate : this.currentConfiguration.getCertificates().values()) {
                     final var id = certificate.getId();
                     listeningChannel.applySslContext(id, sslContextBuilder);
@@ -215,11 +219,6 @@ private void bootListener(final NetworkListenerConfiguration config) throws Inte
                 .doOnChannelInit((observer, channel, remoteAddress) -> {
                     final var idle = new IdleStateHandler(0, 0, currentConfiguration.getClientsIdleTimeoutSeconds());
                     channel.pipeline().addFirst("idleStateHandler", idle);
-                    // todo re-enable OCSP
-                    /* if (config.ssl()) {
-                        final var sni = new ListenersSniHandler(currentConfiguration, parent, listeningChannel);
-                        channel.pipeline().addFirst(sni);
-                    } */
                 })
                 .doOnConnection(conn -> {
                     CURRENT_CONNECTED_CLIENTS_GAUGE.inc();

diff --git a/carapace-server/src/main/java/org/carapaceproxy/core/ListenersSniHandler.java b/carapace-server/src/main/java/org/carapaceproxy/core/ListenersSniHandler.java
diff --git a/carapace-server/src/main/java/org/carapaceproxy/core/ListeningChannel.java b/carapace-server/src/main/java/org/carapaceproxy/core/ListeningChannel.java
@@ -211,9 +211,17 @@ public void applySslContext(final String sniHostname, final reactor.netty.tcp.Ss
         try {
             // #map should cache the certificate after the first search of the different SANs of the same certificate
             final SslContext sslContext = map(sniHostname);
+            if (isOcspEnabled()) {
+                sslContextBuilder.handlerConfigurator(new OcspSslHandler(sslContext, parent.getOcspStaplingManager()));
+            }
             sslContextBuilder.addSniMapping(sniHostname, spec -> spec.sslContext(sslContext));
         } catch (final ConfigurationNotValidException e) {
             throw new RuntimeException(e);
         }
     }
+
+    public boolean isOcspEnabled() {
+        return currentConfiguration.isOcspEnabled() && OpenSsl.isOcspSupported();
+    }
+
 }
diff --git a/carapace-server/src/main/java/org/carapaceproxy/core/OcspSslHandler.java b/carapace-server/src/main/java/org/carapaceproxy/core/OcspSslHandler.java
@@ -0,0 +1,40 @@
+package org.carapaceproxy.core;
+
+import io.netty.handler.ssl.ReferenceCountedOpenSslEngine;
+import io.netty.handler.ssl.SslContext;
+import io.netty.handler.ssl.SslHandler;
+import io.netty.util.AttributeKey;
+import java.io.IOException;
+import java.security.cert.Certificate;
+import java.util.function.Consumer;
+import org.carapaceproxy.server.certificates.ocsp.OcspStaplingManager;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class OcspSslHandler implements Consumer<SslHandler> {
+    private static final Logger LOG = LoggerFactory.getLogger(OcspSslHandler.class);
+    private static final AttributeKey<Certificate> ATTRIBUTE = AttributeKey.valueOf(Listeners.OCSP_CERTIFICATE_CHAIN);
+
+    private final SslContext sslContext;
+    private final OcspStaplingManager ocspStaplingManager;
+
+    public OcspSslHandler(final SslContext sslContext, final OcspStaplingManager ocspStaplingManager1) {
+        this.sslContext = sslContext;
+        this.ocspStaplingManager = ocspStaplingManager1;
+    }
+
+    @Override
+    public void accept(final SslHandler sslHandler) {
+        final var cert = sslContext.attributes().attr(ATTRIBUTE).get();
+        if (cert == null) {
+            LOG.error("Cannot set OCSP response without the certificate");
+            return;
+        }
+        try {
+            final var engine = (ReferenceCountedOpenSslEngine) sslHandler.engine();
+            engine.setOcspResponse(ocspStaplingManager.getOcspResponseForCertificate(cert));
+        } catch (IOException ex) {
+            LOG.error("Error setting OCSP response.", ex);
+        }
+    }
+}
diff --git a/carapace-server/src/test/java/org/carapaceproxy/listeners/SSLSNITest.java b/carapace-server/src/test/java/org/carapaceproxy/listeners/SSLSNITest.java
@@ -27,6 +27,7 @@
 import static org.carapaceproxy.server.config.NetworkListenerConfiguration.DEFAULT_SSL_PROTOCOLS;
 import static org.carapaceproxy.server.config.SSLCertificateConfiguration.CertificateMode.STATIC;
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static reactor.netty.http.HttpProtocol.HTTP11;
@@ -74,7 +75,7 @@ public void testSelectCertWithoutSNI() throws Exception {
         TestEndpointMapper mapper = new TestEndpointMapper("localhost", wireMockRule.port(), true);
         wireMockRule.port();
 
-        try (HttpProxyServer server = new HttpProxyServer(mapper, tmpDir.getRoot());) {
+        try (HttpProxyServer server = new HttpProxyServer(mapper, tmpDir.getRoot())) {
             server.addCertificate(new SSLCertificateConfiguration(nonLocalhost, null, certificate, "testproxy", STATIC));
             server.addListener(new NetworkListenerConfiguration(nonLocalhost, 0, true, null, nonLocalhost /* default */, DEFAULT_SSL_PROTOCOLS, 128, true, 300, 60, 8, 1000, DEFAULT_FORWARDED_STRATEGY, Set.of(), Set.of(HTTP11), new DefaultChannelGroup(new DefaultEventExecutor())));
             server.start();
@@ -93,7 +94,7 @@ public void testSelectCertWithoutSNI() throws Exception {
     public void testChooseCertificate() throws Exception {
         TestEndpointMapper mapper = new TestEndpointMapper("localhost", wireMockRule.port(), true);
 
-        try (HttpProxyServer server = new HttpProxyServer(mapper, tmpDir.getRoot());) {
+        try (HttpProxyServer server = new HttpProxyServer(mapper, tmpDir.getRoot())) {
 
             server.addCertificate(new SSLCertificateConfiguration("other", null, "cert", "pwd", STATIC));
             server.addCertificate(new SSLCertificateConfiguration("*.example.com", Set.of("example.com", "*.example2.com"), "cert", "pwd", STATIC));
@@ -103,53 +104,63 @@ public void testChooseCertificate() throws Exception {
 
 
             // client requests bad SNI, bad default in listener
-            assertNull(CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "no", "no-default"));
+            assertNull(chooseCert(server, "no", "no-default"));
 
-            assertEquals("*.qatest.pexample.it", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "test2.qatest.pexample.it", "no-default").getId());
+            assertEquals("*.qatest.pexample.it", chooseCertId(server, "test2.qatest.pexample.it", "no-default"));
             // client requests SNI, bad default in listener
-            assertEquals("other", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "other", "no-default").getId());
+            assertEquals("other", chooseCertId(server, "other", "no-default"));
 
-            assertEquals("www.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "unkn-other", "www.example.com").getId());
+            assertEquals("www.example.com", chooseCertId(server, "unkn-other", "www.example.com"));
             // client without SNI
-            assertEquals("www.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), null, "www.example.com").getId());
+            assertEquals("www.example.com", chooseCertId(server, null, "www.example.com"));
             // exact match
-            assertEquals("www.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "www.example.com", "no-default").getId());
+            assertEquals("www.example.com", chooseCertId(server, "www.example.com", "no-default"));
             // wildcard
-            assertEquals("*.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "test.example.com", "no-default").getId());
+            assertEquals("*.example.com", chooseCertId(server, "test.example.com", "no-default"));
             // san
-            assertEquals("*.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "example.com", "no-default").getId());
-            assertEquals("*.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "test.example2.com", "no-default").getId());
+            assertEquals("*.example.com", chooseCertId(server, "example.com", "no-default"));
+            assertEquals("*.example.com", chooseCertId(server, "test.example2.com", "no-default"));
 
             // full wildcard
             server.addCertificate(new SSLCertificateConfiguration("*", null, "cert", "pwd", STATIC));
             // full wildcard has not to hide more specific wildcard one
-            assertEquals("*.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "test.example.com", "no-default").getId());
+            assertEquals("*.example.com", chooseCertId(server, "test.example.com", "no-default"));
             // san
-            assertEquals("*.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "example.com", "no-default").getId());
-            assertEquals("*.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "test.example2.com", "no-default").getId());
+            assertEquals("*.example.com", chooseCertId(server, "example.com", "no-default"));
+            assertEquals("*.example.com", chooseCertId(server, "test.example2.com", "no-default"));
 
             // more specific wildcard
             server.addCertificate(new SSLCertificateConfiguration("*.test.example.com", null, "cert", "pwd", STATIC));
             // more specific wildcard has to hide less specific one (*.example.com)
-            assertEquals("*.test.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "pippo.test.example.com", "no-default").getId());
+            assertEquals("*.test.example.com", chooseCertId(server, "pippo.test.example.com", "no-default"));
             // san
-            assertEquals("*.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "example.com", "no-default").getId());
-            assertEquals("*.example.com", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "test.example2.com", "no-default").getId());
+            assertEquals("*.example.com", chooseCertId(server, "example.com", "no-default"));
+            assertEquals("*.example.com", chooseCertId(server, "test.example2.com", "no-default"));
         }
 
-        try (HttpProxyServer server = new HttpProxyServer(mapper, tmpDir.getRoot());) {
+        try (HttpProxyServer server = new HttpProxyServer(mapper, tmpDir.getRoot())) {
 
             // full wildcard
             server.addCertificate(new SSLCertificateConfiguration("*", null, "cert", "pwd", STATIC));
 
-            assertEquals("*", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), null, "www.example.com").getId());
-            assertEquals("*", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "www.example.com", null).getId());
-            assertEquals("*", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), null, null).getId());
-            assertEquals("*", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), "", null).getId());
-            assertEquals("*", CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), null, "").getId());
+            assertEquals("*", chooseCertId(server, null, "www.example.com"));
+            assertEquals("*", chooseCertId(server, "www.example.com", null));
+            assertEquals("*", chooseCertId(server, null, null));
+            assertEquals("*", chooseCertId(server, "", null));
+            assertEquals("*", chooseCertId(server, null, ""));
         }
     }
 
+    private static SSLCertificateConfiguration chooseCert(final HttpProxyServer server, final String sniHostname, final String defaultCertificate) {
+        return CertificatesUtils.chooseCertificate(server.getListeners().getCurrentConfiguration(), sniHostname, defaultCertificate);
+    }
+
+    private static String chooseCertId(final HttpProxyServer server, final String sniHostname, final String defaultCertificate) {
+        final var certificate = chooseCert(server, sniHostname, defaultCertificate);
+        assertNotNull(certificate);
+        return certificate.getId();
+    }
+
     @Test
     public void testTLSVersion() throws Exception {
         String nonLocalhost = InetAddress.getLocalHost().getCanonicalHostName();