Skip to content

Commit 2e509e3

Browse files
edewataedewata
committed
Update OCSPServlet response on internal error
The OCSPServlet has been updated to return a proper response status if there is an internal error (e.g. missing CRL data) as defined in RFC 6960: https://datatracker.ietf.org/doc/html/rfc6960#section-2.3 > The response "internalError" indicates that the OCSP responder > reached an inconsistent internal state. The query should be > retried, potentially with another responder. The OCSP clients have been updated to check for error status before processing the response bytes and generate a more intelligible error message. The OCSP tests have been updated to expect the new error message.
1 parent 946bff2 commit 2e509e3

6 files changed

Lines changed: 58 additions & 31 deletions

File tree

‎.github/workflows/ocsp-basic-test.yml‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -591,7 +591,7 @@ jobs:
591591
592592
# responder should fail since there's no CRLs
593593
cat > expected << EOF
594-
ERROR: Unable to submit OCSP request: Incorrect tag: expected [UNIVERSAL 16], found [UNIVERSAL 28]
594+
ERROR: OCSPResponseStatus: INTERNAL_ERROR
595595
EOF
596596
597597
diff expected stderr
@@ -613,7 +613,7 @@ jobs:
613613
614614
# responder should fail since there's no CRLs
615615
cat > expected << EOF
616-
SEVERE: InvalidBERException: Incorrect tag: expected [UNIVERSAL 16], found [UNIVERSAL 28]
616+
SEVERE: CLIException: OCSPResponseStatus: INTERNAL_ERROR
617617
EOF
618618
619619
diff expected actual
@@ -627,22 +627,14 @@ jobs:
627627
-CAfile ca_signing.crt \
628628
-issuer ca_signing.crt \
629629
-serial $CERT_ID \
630-
> >(tee stdout) 2> >(tee stderr >&2) || true
631-
632-
# remove the random parts of stderr so it can be compared
633-
sed -i "s/^[^:]*:error:/error:/g" stderr
634-
635-
# remove file names and line numbers so it can be compared
636-
sed -i "s/^\([^:]*:[^:]*:[^:]*:[^:]*:[^:]*:\)[^:]*:[^:]*:/\1/" stderr
630+
| tee output
637631
638632
# responder should fail since there's no CRLs
639633
cat > expected << EOF
640-
Error querying OCSP responder
641-
error:1E800076:HTTP routines:OSSL_HTTP_REQ_CTX_nbio:unexpected content type:expected=application/ocsp-response, actual=text/html
642-
error:1E800067:HTTP routines:OSSL_HTTP_REQ_CTX_exchange:error receiving:server=http://pki.example.com:8080
634+
Responder Error: internalerror (2)
643635
EOF
644636
645-
diff expected stderr
637+
diff expected output
646638
647639
- name: Prepare revoked cert
648640
run: |

‎.github/workflows/ocsp-crl-direct-test.yml‎

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -273,9 +273,13 @@ jobs:
273273
--serial $CERT_ID \
274274
> >(tee stdout) 2> >(tee stderr >&2) || true
275275
276-
# the responder should fail
277-
sed -n "s/^SEVERE:\s*\(\S*\)/\1/p" stderr > actual
278-
echo "InvalidBERException: Incorrect tag: expected [UNIVERSAL 16], found [UNIVERSAL 28]" > expected
276+
sed -n "/^SEVERE:/p" stderr > actual
277+
278+
# responder should fail since there's no CRLs
279+
cat > expected << EOF
280+
SEVERE: CLIException: OCSPResponseStatus: INTERNAL_ERROR
281+
EOF
282+
279283
diff expected actual
280284
281285
# check cert status using OpenSSL
@@ -284,20 +288,14 @@ jobs:
284288
-CAfile ${SHARED}/ca_signing.crt \
285289
-issuer ${SHARED}/ca_signing.crt \
286290
-serial $CERT_ID \
287-
> >(tee stdout) 2> >(tee stderr >&2) || true
288-
289-
# remove the random parts of stderr so it can be compared
290-
sed -i "s/^[^:]*:error:/error:/g" stderr
291-
292-
# remove file names and line numbers so it can be compared
293-
sed -i "s/^\([^:]*:[^:]*:[^:]*:[^:]*:[^:]*:\)[^:]*:[^:]*:/\1/" stderr
291+
| tee output
294292
295-
# the responder should fail
296-
echo "Error querying OCSP responder" > expected
297-
echo "error:1E800076:HTTP routines:OSSL_HTTP_REQ_CTX_nbio:unexpected content type:expected=application/ocsp-response, actual=text/html" >> expected
298-
echo "error:1E800067:HTTP routines:OSSL_HTTP_REQ_CTX_exchange:error receiving:server=http://ocsp.example.com:8080" >> expected
293+
# responder should fail since there's no CRLs
294+
cat > expected << EOF
295+
Responder Error: internalerror (2)
296+
EOF
299297
300-
diff expected stderr
298+
diff expected output
301299
302300
- name: Check OCSP responder with initial CRL
303301
run: |

‎base/common/src/main/java/com/netscape/cmsutil/ocsp/OCSPResponseStatus.java‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,12 +63,34 @@ public class OCSPResponseStatus implements ASN1Value {
6363

6464
private ENUMERATED responseStatus;
6565

66+
public OCSPResponseStatus(long val) {
67+
responseStatus = new ENUMERATED(val);
68+
}
69+
6670
public long getValue() {
6771
return responseStatus.getValue();
6872
}
6973

70-
public OCSPResponseStatus(long val) {
71-
responseStatus = new ENUMERATED(val);
74+
public String getName() throws IllegalArgumentException, IllegalAccessException {
75+
76+
int value = (int) getValue();
77+
78+
switch (value) {
79+
case 0:
80+
return "SUCCESSFUL";
81+
case 1:
82+
return "MALFORMED_REQUEST";
83+
case 2:
84+
return "INTERNAL_ERROR";
85+
case 3:
86+
return "TRY_LATER";
87+
case 5:
88+
return "SIG_REQUIRED";
89+
case 6:
90+
return "UNAUTHORIZED";
91+
default:
92+
return "UNKNOWN (" + value + ")";
93+
}
7294
}
7395

7496
///////////////////////////////////////////////////////////////////////

‎base/server/src/main/java/com/netscape/cms/servlet/ocsp/OCSPServlet.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
import com.netscape.cmsutil.ocsp.BasicOCSPResponse;
4646
import com.netscape.cmsutil.ocsp.OCSPRequest;
4747
import com.netscape.cmsutil.ocsp.OCSPResponse;
48+
import com.netscape.cmsutil.ocsp.OCSPResponseStatus;
4849
import com.netscape.cmsutil.ocsp.ResponseBytes;
4950
import com.netscape.cmsutil.ocsp.ResponseData;
5051
import com.netscape.cmsutil.ocsp.SingleResponse;
@@ -250,8 +251,9 @@ protected void process(CMSRequest cmsReq) throws EBaseException {
250251
}
251252

252253
} catch (Exception e) {
253-
logger.warn("OCSPServlet: " + e.getMessage(), e);
254+
logger.error("OCSPServlet: " + e.getMessage(), e);
254255
auditor.log(OCSPGenerationEvent.createFailureEvent(auditSubjectID(), e.getMessage()));
256+
response = new OCSPResponse(OCSPResponseStatus.INTERNAL_ERROR, null);
255257
}
256258

257259
if (response != null) {

‎base/tools/src/main/java/com/netscape/cmstools/OCSPClient.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
import org.apache.commons.cli.DefaultParser;
3131
import org.apache.commons.cli.Option;
3232
import org.apache.commons.cli.Options;
33+
import org.dogtagpki.cli.CLIException;
3334
import org.dogtagpki.util.logging.PKILogger;
3435
import org.mozilla.jss.CryptoManager;
3536

@@ -39,6 +40,7 @@
3940
import com.netscape.cmsutil.ocsp.OCSPProcessor;
4041
import com.netscape.cmsutil.ocsp.OCSPRequest;
4142
import com.netscape.cmsutil.ocsp.OCSPResponse;
43+
import com.netscape.cmsutil.ocsp.OCSPResponseStatus;
4244
import com.netscape.cmsutil.ocsp.ResponseBytes;
4345
import com.netscape.cmsutil.ocsp.ResponseData;
4446
import com.netscape.cmsutil.ocsp.SingleResponse;
@@ -197,6 +199,11 @@ public void execute(String args[]) throws Exception {
197199
logger.info("Submitting OCSP request");
198200
response = processor.submitRequest(url, request);
199201

202+
OCSPResponseStatus status = response.getResponseStatus();
203+
if (status.getValue() != 0) {
204+
throw new CLIException("OCSPResponseStatus: " + status.getName());
205+
}
206+
200207
ResponseBytes bytes = response.getResponseBytes();
201208
BasicOCSPResponse basic = (BasicOCSPResponse)BasicOCSPResponse.getTemplate().decode(
202209
new ByteArrayInputStream(bytes.getResponse().toByteArray()));

‎base/tools/src/main/java/com/netscape/cmstools/ocsp/OCSPCertVerifyCLI.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import com.netscape.cmsutil.ocsp.OCSPProcessor;
2727
import com.netscape.cmsutil.ocsp.OCSPRequest;
2828
import com.netscape.cmsutil.ocsp.OCSPResponse;
29+
import com.netscape.cmsutil.ocsp.OCSPResponseStatus;
2930
import com.netscape.cmsutil.ocsp.ResponseData;
3031
import com.netscape.cmsutil.ocsp.RevokedInfo;
3132
import com.netscape.cmsutil.ocsp.SingleResponse;
@@ -138,6 +139,11 @@ public void execute(CommandLine cmd) throws Exception {
138139
throw new CLIException("Unable to submit OCSP request: " + e.getMessage());
139140
}
140141

142+
OCSPResponseStatus status = response.getResponseStatus();
143+
if (status.getValue() != 0) {
144+
throw new CLIException("OCSPResponseStatus: " + status.getName());
145+
}
146+
141147
logger.info("Parsing OCSP response");
142148
byte[] bytes = response.getResponseBytes().getResponse().toByteArray();
143149
BasicOCSPResponse basic;

0 commit comments

Comments
 (0)