Add resilient OCSP certificate revocation checker

pom.xml

@@ -18,6 +18,7 @@
         <bouncycastle.version>1.86</bouncycastle.version>
         <jackson.version>2.22.2</jackson.version>
         <slf4j.version>2.0.19</slf4j.version>
+        <resilience4j.version>2.3.0</resilience4j.version>
         <junit-jupiter.version>5.14.4</junit-jupiter.version>
         <assertj.version>3.27.7</assertj.version>
         <mockito.version>5.23.0</mockito.version>
@@ -67,6 +68,34 @@
             <artifactId>bcpkix-jdk18on</artifactId>
             <version>${bouncycastle.version}</version>
         </dependency>
+        <dependency>
+            <groupId>io.github.resilience4j</groupId>
+            <artifactId>resilience4j-all</artifactId>
+            <version>${resilience4j.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>io.github.resilience4j</groupId>
+                    <artifactId>resilience4j-bulkhead</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.github.resilience4j</groupId>
+                    <artifactId>resilience4j-cache</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.github.resilience4j</groupId>
+                    <artifactId>resilience4j-ratelimiter</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>io.github.resilience4j</groupId>
+                    <artifactId>resilience4j-timelimiter</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>io.github.resilience4j</groupId>
+            <artifactId>resilience4j-vavr</artifactId>
+            <version>${resilience4j.version}</version>
+        </dependency>
 
         <dependency>
             <groupId>org.junit.jupiter</groupId>

src/main/java/eu/webeid/ocsp/OcspCertificateRevocationChecker.java

@@ -4,7 +4,7 @@
 package eu.webeid.ocsp;
 
 import eu.webeid.ocsp.client.OcspClient;
-import eu.webeid.ocsp.exceptions.UserCertificateRevokedException;
+import eu.webeid.ocsp.exceptions.OCSPClientException;
 import eu.webeid.ocsp.protocol.DigestCalculatorImpl;
 import eu.webeid.ocsp.protocol.OcspRequestBuilder;
 import eu.webeid.ocsp.protocol.OcspResponseValidator;
@@ -46,7 +46,7 @@
 import static eu.webeid.security.util.DateAndTime.requirePositiveDuration;
 import static java.util.Objects.requireNonNull;
 
-public final class OcspCertificateRevocationChecker implements CertificateRevocationChecker {
+public class OcspCertificateRevocationChecker implements CertificateRevocationChecker {
 
     public static final Duration DEFAULT_TIME_SKEW = Duration.ofMinutes(15);
     public static final Duration DEFAULT_THIS_UPDATE_AGE = Duration.ofMinutes(2);
@@ -113,20 +113,20 @@ public List<RevocationInfo> validateCertificateNotRevoked(X509Certificate subjec
             }
             LOG.debug("OCSP response received successfully");
 
-            verifyOcspResponse(basicResponse, ocspService, certificateId, issuerCertificate);
+            verifyOcspResponse(basicResponse, ocspService, certificateId, issuerCertificate, maxOcspResponseThisUpdateAge);
             if (ocspService.doesSupportNonce()) {
                 checkNonce(request, basicResponse, ocspResponderUri);
             }
             LOG.debug("OCSP response verified successfully");
 
             return List.of(new RevocationInfo(ocspResponderUri, Map.of(RevocationInfo.KEY_OCSP_RESPONSE, response)));
 
-        } catch (OCSPException | CertificateException | OperatorCreationException | IOException e) {
+        } catch (OCSPException | CertificateException | OperatorCreationException | IOException | OCSPClientException e) {
             throw new UserCertificateOCSPCheckFailedException(e, ocspResponderUri);
         }
     }
 
-    private void verifyOcspResponse(BasicOCSPResp basicResponse, OcspService ocspService, CertificateID requestCertificateId, X509Certificate issuerCertificate) throws UserCertificateOCSPCheckFailedException, UserCertificateRevokedException, OCSPException, CertificateException, OperatorCreationException {
+    protected void verifyOcspResponse(BasicOCSPResp basicResponse, OcspService ocspService, CertificateID requestCertificateId, X509Certificate issuerCertificate, Duration maxOcspResponseThisUpdateAge) throws AuthTokenException, OCSPException, CertificateException, OperatorCreationException {
         // The verification algorithm follows RFC 2560, https://www.ietf.org/rfc/rfc2560.txt.
         //
         // 3.2.  Signed Response Acceptance Requirements
@@ -189,7 +189,7 @@ private void verifyOcspResponse(BasicOCSPResp basicResponse, OcspService ocspSer
         LOG.debug("OCSP check result is GOOD");
     }
 
-    private static void checkNonce(OCSPReq request, BasicOCSPResp response, URI ocspResponderUri) throws UserCertificateOCSPCheckFailedException {
+    protected static void checkNonce(OCSPReq request, BasicOCSPResp response, URI ocspResponderUri) throws UserCertificateOCSPCheckFailedException {
         final Extension requestNonce = request.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
         final Extension responseNonce = response.getExtension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce);
         if (requestNonce == null || responseNonce == null) {
@@ -202,14 +202,14 @@ private static void checkNonce(OCSPReq request, BasicOCSPResp response, URI ocsp
         }
     }
 
-    private static CertificateID getCertificateId(X509Certificate subjectCertificate, X509Certificate issuerCertificate) throws CertificateEncodingException, IOException, OCSPException {
+    protected static CertificateID getCertificateId(X509Certificate subjectCertificate, X509Certificate issuerCertificate) throws CertificateEncodingException, IOException, OCSPException {
         final BigInteger serial = subjectCertificate.getSerialNumber();
         final DigestCalculator digestCalculator = DigestCalculatorImpl.sha1();
         return new CertificateID(digestCalculator,
             new X509CertificateHolder(issuerCertificate.getEncoded()), serial);
     }
 
-    private static String ocspStatusToString(int status) {
+    protected static String ocspStatusToString(int status) {
         return switch (status) {
             case OCSPResp.MALFORMED_REQUEST -> "malformed request";
             case OCSPResp.INTERNAL_ERROR -> "internal error";
@@ -220,4 +220,15 @@ private static String ocspStatusToString(int status) {
         };
     }
 
+    protected OcspClient getOcspClient() {
+        return ocspClient;
+    }
+
+    protected OcspServiceProvider getOcspServiceProvider() {
+        return ocspServiceProvider;
+    }
+
+    protected Duration getMaxOcspResponseThisUpdateAge() {
+        return maxOcspResponseThisUpdateAge;
+    }
 }

src/main/java/eu/webeid/ocsp/client/OcspClient.java

@@ -3,14 +3,14 @@
 
 package eu.webeid.ocsp.client;
 
+import eu.webeid.ocsp.exceptions.OCSPClientException;
 import org.bouncycastle.cert.ocsp.OCSPReq;
 import org.bouncycastle.cert.ocsp.OCSPResp;
 
-import java.io.IOException;
 import java.net.URI;
 
 public interface OcspClient {
 
-    OCSPResp request(URI url, OCSPReq request) throws IOException;
+    OCSPResp request(URI url, OCSPReq request) throws OCSPClientException;
 
 }

src/main/java/eu/webeid/ocsp/client/OcspClientImpl.java

@@ -3,6 +3,7 @@
 
 package eu.webeid.ocsp.client;
 
+import eu.webeid.ocsp.exceptions.OCSPClientException;
 import org.bouncycastle.cert.ocsp.OCSPReq;
 import org.bouncycastle.cert.ocsp.OCSPResp;
 import org.slf4j.Logger;
@@ -43,15 +44,21 @@ public static OcspClient build(Duration ocspRequestTimeout) {
      * @param uri     OCSP server URL
      * @param ocspReq OCSP request
      * @return OCSP response from the server
-     * @throws IOException if the request could not be executed due to cancellation, a connectivity problem or timeout,
+     * @throws OCSPClientException if the request could not be executed due to cancellation, a connectivity problem or timeout,
      *                     or if the response status is not successful, or if response has wrong content type.
      */
     @Override
-    public OCSPResp request(URI uri, OCSPReq ocspReq) throws IOException {
+    public OCSPResp request(URI uri, OCSPReq ocspReq) throws OCSPClientException {
+        byte[] encodedOcspReq;
+        try {
+            encodedOcspReq = ocspReq.getEncoded();
+        } catch (IOException e) {
+            throw new OCSPClientException(e);
+        }
         final HttpRequest request = HttpRequest.newBuilder()
             .uri(uri)
             .header(CONTENT_TYPE, OCSP_REQUEST_TYPE)
-            .POST(HttpRequest.BodyPublishers.ofByteArray(ocspReq.getEncoded()))
+            .POST(HttpRequest.BodyPublishers.ofByteArray(encodedOcspReq))
             .timeout(ocspRequestTimeout)
             .build();
 
@@ -60,19 +67,28 @@ public OCSPResp request(URI uri, OCSPReq ocspReq) throws IOException {
             response = httpClient.send(request, HttpResponse.BodyHandlers.ofByteArray());
         } catch (InterruptedException e) {
             Thread.currentThread().interrupt();
-            throw new IOException("Interrupted while sending OCSP request", e);
+            throw new OCSPClientException("Interrupted while sending OCSP request", e);
+        } catch (IOException e) {
+            throw new OCSPClientException(e);
         }
 
         if (response.statusCode() != 200) {
-            throw new IOException("OCSP request was not successful, response: " + response);
+            throw new OCSPClientException("OCSP request was not successful", response.body(), response.statusCode());
         } else {
             LOG.debug("OCSP response: {}", response);
         }
         final String contentType = response.headers().firstValue(CONTENT_TYPE).orElse("");
         if (!contentType.startsWith(OCSP_RESPONSE_TYPE)) {
-            throw new IOException("OCSP response content type is not " + OCSP_RESPONSE_TYPE);
+            throw new OCSPClientException("OCSP response content type is not " + OCSP_RESPONSE_TYPE);
+        }
+
+        OCSPResp ocspResp;
+        try {
+            ocspResp = new OCSPResp(response.body());
+        } catch (IOException e) {
+            throw new OCSPClientException(e);
         }
-        return new OCSPResp(response.body());
+        return ocspResp;
     }
 
     public OcspClientImpl(HttpClient httpClient, Duration ocspRequestTimeout) {

src/main/java/eu/webeid/ocsp/exceptions/OCSPClientException.java

@@ -0,0 +1,45 @@
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
+
+package eu.webeid.ocsp.exceptions;
+
+public class OCSPClientException extends Exception {
+
+    private final byte[] responseBody;
+
+    private final Integer statusCode;
+
+    public OCSPClientException() {
+        this(null, null);
+    }
+
+    public OCSPClientException(String message) {
+        this(message, null, null);
+    }
+
+    public OCSPClientException(Throwable cause) {
+        this(null, cause, null, null);
+    }
+
+    public OCSPClientException(String message, Throwable cause) {
+        this(message, cause, null, null);
+    }
+
+    public OCSPClientException(String message, byte[] responseBody, Integer statusCode) {
+        this(message, null, responseBody, statusCode);
+    }
+
+    public OCSPClientException(String message, Throwable cause, byte[] responseBody, Integer statusCode) {
+        super(message, cause);
+        this.responseBody = responseBody;
+        this.statusCode = statusCode;
+    }
+
+    public byte[] getResponseBody() {
+        return responseBody;
+    }
+
+    public Integer getStatusCode() {
+        return statusCode;
+    }
+}

src/main/java/eu/webeid/ocsp/exceptions/UserCertificateOCSPCheckFailedException.java

@@ -14,6 +14,10 @@
  */
 public class UserCertificateOCSPCheckFailedException extends CertificateRevocationCheckFailedException {
 
+    public UserCertificateOCSPCheckFailedException() {
+        super("User certificate revocation check has failed");
+    }
+
     public UserCertificateOCSPCheckFailedException(Throwable cause, URI ocspResponderUri) {
         super(appendResponderUri("User certificate revocation check has failed", ocspResponderUri), cause);
     }

src/main/java/eu/webeid/ocsp/exceptions/UserCertificateRevokedException.java

@@ -33,6 +33,10 @@
  */
 public class UserCertificateRevokedException extends CertificateRevokedException {
 
+    public UserCertificateRevokedException() {
+        super("User certificate has been revoked");
+    }
+
     public UserCertificateRevokedException(URI ocspResponderUri) {
         super(appendResponderUri("User certificate has been revoked", ocspResponderUri));
     }

src/main/java/eu/webeid/ocsp/protocol/IssuerDistinguishedName.java

@@ -0,0 +1,21 @@
+// SPDX-FileCopyrightText: Estonian Information System Authority
+// SPDX-License-Identifier: MIT
+
+package eu.webeid.ocsp.protocol;
+
+import org.bouncycastle.asn1.x500.X500Name;
+
+import java.security.cert.X509Certificate;
+import java.util.Objects;
+
+public class IssuerDistinguishedName {
+
+    public static X500Name getIssuerDistinguishedName(X509Certificate certificate) {
+        Objects.requireNonNull(certificate, "certificate");
+        return X500Name.getInstance(certificate.getIssuerX500Principal().getEncoded());
+    }
+
+    private IssuerDistinguishedName() {
+        throw new IllegalStateException("Utility class");
+    }
+}

src/main/java/eu/webeid/ocsp/service/AiaOcspService.java

@@ -9,6 +9,7 @@
 import eu.webeid.ocsp.exceptions.UserCertificateOCSPCheckFailedException;
 import eu.webeid.ocsp.protocol.OcspResponseValidator;
 import eu.webeid.security.validator.revocationcheck.RevocationMode;
+import org.bouncycastle.asn1.x500.X500Name;
 import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
 
@@ -19,8 +20,10 @@
 import java.security.cert.X509Certificate;
 import java.util.Date;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
 
+import static eu.webeid.ocsp.protocol.IssuerDistinguishedName.getIssuerDistinguishedName;
 import static eu.webeid.ocsp.protocol.OcspUrl.getOcspUri;
 
 /**
@@ -33,13 +36,16 @@ public class AiaOcspService implements OcspService {
     private final CertStore trustedCACertificateCertStore;
     private final URI url;
     private final boolean supportsNonce;
+    private final FallbackOcspService fallbackOcspService;
 
-    public AiaOcspService(AiaOcspServiceConfiguration configuration, X509Certificate certificate) throws AuthTokenException {
+    public AiaOcspService(AiaOcspServiceConfiguration configuration, X509Certificate certificate, FallbackOcspService fallbackOcspService) throws AuthTokenException {
         Objects.requireNonNull(configuration);
         this.trustedCACertificateAnchors = configuration.getTrustedCACertificateAnchors();
         this.trustedCACertificateCertStore = configuration.getTrustedCACertificateCertStore();
         this.url = getOcspAiaUrlFromCertificate(Objects.requireNonNull(certificate));
-        this.supportsNonce = !configuration.getNonceDisabledOcspUrls().contains(this.url);
+        this.fallbackOcspService = fallbackOcspService;
+        X500Name issuerDN = getIssuerDistinguishedName(certificate);
+        this.supportsNonce = !configuration.getNonceDisabledIssuerDNs().contains(issuerDN);
     }
 
     @Override
@@ -52,6 +58,11 @@ public URI getAccessLocation() {
         return url;
     }
 
+    @Override
+    public Optional<FallbackOcspService> getFallbackService() {
+        return Optional.ofNullable(fallbackOcspService);
+    }
+
     @Override
     public void validateResponderCertificate(X509CertificateHolder cert, X509Certificate issuerCertificate, Date now) throws AuthTokenException {
         try {

src/main/java/eu/webeid/ocsp/service/AiaOcspServiceConfiguration.java

@@ -3,7 +3,8 @@
 
 package eu.webeid.ocsp.service;
 
-import java.net.URI;
+import org.bouncycastle.asn1.x500.X500Name;
+
 import java.security.cert.CertStore;
 import java.security.cert.TrustAnchor;
 import java.util.Collection;
@@ -12,18 +13,18 @@
 
 public class AiaOcspServiceConfiguration {
 
-    private final Collection<URI> nonceDisabledOcspUrls;
+    private final Collection<X500Name> nonceDisabledIssuerDNs;
     private final Set<TrustAnchor> trustedCACertificateAnchors;
     private final CertStore trustedCACertificateCertStore;
 
-    public AiaOcspServiceConfiguration(Collection<URI> nonceDisabledOcspUrls, Set<TrustAnchor> trustedCACertificateAnchors, CertStore trustedCACertificateCertStore) {
-        this.nonceDisabledOcspUrls = Set.copyOf(nonceDisabledOcspUrls);
+    public AiaOcspServiceConfiguration(Collection<X500Name> nonceDisabledIssuerDNs, Set<TrustAnchor> trustedCACertificateAnchors, CertStore trustedCACertificateCertStore) {
+        this.nonceDisabledIssuerDNs = Set.copyOf(nonceDisabledIssuerDNs);
         this.trustedCACertificateAnchors = Set.copyOf(trustedCACertificateAnchors);
         this.trustedCACertificateCertStore = Objects.requireNonNull(trustedCACertificateCertStore);
     }
 
-    public Collection<URI> getNonceDisabledOcspUrls() {
-        return nonceDisabledOcspUrls;
+    public Collection<X500Name> getNonceDisabledIssuerDNs() {
+        return nonceDisabledIssuerDNs;
     }
 
     public Set<TrustAnchor> getTrustedCACertificateAnchors() {