OCSPReq req = null;
try {
req = new OCSPReq(reqBytes);
} catch (Exception e) {
// When not being able to parse the request, we want to send a MalformedRequest back
throw new MalformedRequestException(e);
}
if (req.getRequestorName() == null) {
m_log.debug("Requestorname is null");
} else {
if (m_log.isDebugEnabled()) {
m_log.debug("Requestorname is: "+req.getRequestorName().toString());
}
transactionLogger.paramPut(ITransactionLogger.REQ_NAME, req.getRequestorName().toString());
}
// Make sure our signature keys are updated
loadPrivateKeys(this.data.m_adm, null);
/**
* check the signature if contained in request.
* if the request does not contain a signature
* and the servlet is configured in the way
* the a signature is required we send back
* 'sigRequired' response.
*/
if (m_log.isDebugEnabled()) {
m_log.debug("Incoming OCSP request is signed : " + req.isSigned());
}
if (req.isSigned()) {
X509Certificate signercert = OCSPUtil.checkRequestSignature(request.getRemoteAddr(), req, this.data.m_caCertCache);
String signercertIssuerName = CertTools.getIssuerDN(signercert);
BigInteger signercertSerNo = CertTools.getSerialNumber(signercert);
String signercertSubjectName = CertTools.getSubjectDN(signercert);
transactionLogger.paramPut(ITransactionLogger.SIGN_ISSUER_NAME_DN, signercertIssuerName);
transactionLogger.paramPut(ITransactionLogger.SIGN_SERIAL_NO, signercert.getSerialNumber().toByteArray());
transactionLogger.paramPut(ITransactionLogger.SIGN_SUBJECT_NAME, signercertSubjectName);
transactionLogger.paramPut(IPatternLogger.REPLY_TIME, ITransactionLogger.REPLY_TIME);
if (OcspConfiguration.getEnforceRequestSigning()) {
// If it verifies OK, check if it is revoked
final CertificateStatus status = this.data.certificateStoreSession.getStatus(CertTools.getIssuerDN(signercert), CertTools.getSerialNumber(signercert));
// If rci == null it means the certificate does not exist in database, we then treat it as ok,
// because it may be so that only revoked certificates is in the (external) OCSP database.
if ( status.equals(CertificateStatus.REVOKED) ) {
String serno = signercertSerNo.toString(16);
String infoMsg = intres.getLocalizedMessage("ocsp.infosigner.revoked", signercertSubjectName, signercertIssuerName, serno);
m_log.info(infoMsg);
throw new SignRequestSignatureException(infoMsg);
}
if (m_reqRestrictSignatures) {
loadTrustDir();
if ( m_reqRestrictMethod == OcspConfiguration.RESTRICTONSIGNER) {
if (!OCSPUtil.checkCertInList(signercert, mTrustedReqSigSigners)) {
String infoMsg = intres.getLocalizedMessage("ocsp.infosigner.notallowed", signercertSubjectName, signercertIssuerName, signercertSerNo.toString(16));
m_log.info(infoMsg);
throw new SignRequestSignatureException(infoMsg);
}
} else if (m_reqRestrictMethod == OcspConfiguration.RESTRICTONISSUER) {
X509Certificate signerca = this.data.m_caCertCache.findLatestBySubjectDN(HashID.getFromDN(signercertIssuerName));
if ((signerca == null) || (!OCSPUtil.checkCertInList(signerca, mTrustedReqSigIssuers)) ) {
String infoMsg = intres.getLocalizedMessage("ocsp.infosigner.notallowed", signercertSubjectName, signercertIssuerName, signercertSerNo.toString(16));
m_log.info(infoMsg);
throw new SignRequestSignatureException(infoMsg);
}
} else {
throw new Exception("m_reqRestrictMethod="+m_reqRestrictMethod); // there must be an internal error. We do not want to send a response, just to be safe.
}
}
}
} else {
if (OcspConfiguration.getEnforceRequestSigning()) {
// Signature required
throw new SignRequestException("Signature required");
}
}
// Get the certificate status requests that are inside this OCSP req
Req[] requests = req.getRequestList();
transactionLogger.paramPut(ITransactionLogger.NUM_CERT_ID, requests.length);
if (requests.length <= 0) {
String infoMsg = intres.getLocalizedMessage("ocsp.errornoreqentities");
m_log.info(infoMsg);
{
// All this just so we can create an error response
cacert = this.data.m_caCertCache.findLatestBySubjectDN(HashID.getFromDN(this.data.m_defaultResponderId));
}
throw new MalformedRequestException(infoMsg);
}
int maxRequests = 100;
if (requests.length > maxRequests) {
String infoMsg = intres.getLocalizedMessage("ocsp.errortoomanyreqentities", maxRequests);
m_log.info(infoMsg);
{
// All this just so we can create an error response
cacert = this.data.m_caCertCache.findLatestBySubjectDN(HashID.getFromDN(this.data.m_defaultResponderId));
}
throw new MalformedRequestException(infoMsg);
}
if (m_log.isDebugEnabled()) {
m_log.debug("The OCSP request contains " + requests.length + " simpleRequests.");
}