|
| 1 | +local user_agent = require "apicast.user_agent" |
| 2 | +local http_ng = require "resty.http_ng" |
| 3 | +local resty_env = require "resty.env" |
| 4 | +local tls = require "resty.tls" |
| 5 | +local ngx_ssl = require "ngx.ssl" |
| 6 | +local ocsp = require "ngx.ocsp" |
| 7 | + |
| 8 | +local _M = {} |
| 9 | +local ocsp_shm = ngx.shared.ocsp_cache |
| 10 | + |
| 11 | +local function do_ocsp_request(ocsp_url, ocsp_request) |
| 12 | + -- TODO: set default timeout |
| 13 | + local http_client = http_ng.new{ |
| 14 | + options = { |
| 15 | + headers = { |
| 16 | + ['User-Agent'] = user_agent() |
| 17 | + }, |
| 18 | + ssl = { verify = resty_env.enabled('OPENSSL_VERIFY') } |
| 19 | + } |
| 20 | + } |
| 21 | + local res, err = http_client.post{ |
| 22 | + ocsp_url, |
| 23 | + ocsp_request, |
| 24 | + headers= { |
| 25 | + ["Content-Type"] = "application/ocsp-request" |
| 26 | + }} |
| 27 | + if err then |
| 28 | + return nil, err |
| 29 | + end |
| 30 | + |
| 31 | + ngx.log(ngx.INFO, "fetching OCSP response from ", ocsp_url) |
| 32 | + |
| 33 | + if not res then |
| 34 | + return nil, "failed to send request to OCSP responder: " .. tostring(err) |
| 35 | + end |
| 36 | + |
| 37 | + if res.status ~= 200 then |
| 38 | + return nil, "unexpected OCSP responder status code: " .. res.status |
| 39 | + end |
| 40 | + |
| 41 | + return res.body |
| 42 | +end |
| 43 | + |
| 44 | +function _M.check_revocation_status(ocsp_responder_url, digest, ttl) |
| 45 | + -- Nginx supports leaf mode, that is only verify the client ceritificate, however |
| 46 | + -- until we have a way to detect which CA certificate is being used to verify the |
| 47 | + -- client certificate we need to get the full certificate chain here to construct |
| 48 | + -- the OCSP request. |
| 49 | + local cert_chain, err = tls.get_full_client_certificate_chain() |
| 50 | + if not cert_chain then |
| 51 | + return nil, err or "no client certificate" |
| 52 | + end |
| 53 | + |
| 54 | + local der_cert |
| 55 | + der_cert, err = ngx_ssl.cert_pem_to_der(cert_chain) |
| 56 | + if not der_cert then |
| 57 | + return nil, "failed to convert certificate chain from PEM to DER " .. err |
| 58 | + end |
| 59 | + |
| 60 | + local ocsp_resp |
| 61 | + ocsp_resp = ocsp_shm:get(digest) |
| 62 | + |
| 63 | + if ocsp_resp == nil then |
| 64 | + ngx.log(ngx.INFO, "no ocsp resp cache found, fetch from ocsp responder") |
| 65 | + |
| 66 | + |
| 67 | + -- TODO: check response cache |
| 68 | + local ocsp_url |
| 69 | + if ocsp_responder_url and ocsp_responder_url ~= "" then |
| 70 | + ocsp_url = ocsp_responder_url |
| 71 | + else |
| 72 | + ocsp_url, err = ocsp.get_ocsp_responder_from_der_chain(der_cert) |
| 73 | + if not ocsp_url then |
| 74 | + return nil, err or ("could not extract OCSP responder URL, the client " .. |
| 75 | + "certificate may be missing the required extensions") |
| 76 | + end |
| 77 | + end |
| 78 | + |
| 79 | + if not ocsp_url or ocsp_url == "" then |
| 80 | + return nil, " invalid OCSP responder URL" |
| 81 | + end |
| 82 | + |
| 83 | + local ocsp_req |
| 84 | + ocsp_req, err = ocsp.create_ocsp_request(der_cert) |
| 85 | + if not ocsp_req then |
| 86 | + return nil, "failed to create OCSP request: " .. err |
| 87 | + end |
| 88 | + |
| 89 | + ocsp_resp, err = do_ocsp_request(ocsp_url, ocsp_req) |
| 90 | + if not ocsp_resp or #ocsp_resp == 0 then |
| 91 | + return nil, "unexpected response from OCSP responder: empty body" |
| 92 | + end |
| 93 | + |
| 94 | + -- Use ttl, normally this should be (nextUpdate - thisUpdate), but current version |
| 95 | + -- of openresty API does not expose those attributes. Support for this was added |
| 96 | + -- in openrest-core v0.1.31, we either need to backport or upgrade the openresty |
| 97 | + -- version. |
| 98 | + local ok |
| 99 | + ok, err = ocsp_shm:set(digest, ocsp_resp, ttl) |
| 100 | + if not ok then |
| 101 | + ngx.log(ngx.ERR, "could not save ocsp response to cache: ", err) |
| 102 | + end |
| 103 | + else |
| 104 | + ngx.log(ngx.INFO, "using ocsp from cache") |
| 105 | + end |
| 106 | + |
| 107 | + local ok |
| 108 | + ok, err = ocsp.validate_ocsp_response(ocsp_resp, der_cert) |
| 109 | + if not ok then |
| 110 | + return false, "failed to validate OCSP response: " .. err |
| 111 | + end |
| 112 | + |
| 113 | + return true |
| 114 | +end |
| 115 | + |
| 116 | +return _M |
0 commit comments