Skip to content

Commit 00e4ecd

Browse files
mrtsmrts
committed
feat(ocsp): switch to Java 11 to use the built-in HttpClient
Signed-off-by: Mart Somermaa <[email protected]>
1 parent 9fd984c commit 00e4ecd

File tree

11 files changed

+126
-139
lines changed

11 files changed

+126
-139
lines changed

‎.github/workflows/coverity-analysis.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
- uses: actions/setup-java@v3
2121
with:
2222
distribution: zulu
23-
java-version: 8
23+
java-version: 11
2424

2525
- name: Cache Maven packages
2626
uses: actions/cache@v3

‎.github/workflows/maven-build.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
- uses: actions/setup-java@v3
1313
with:
1414
distribution: zulu
15-
java-version: 8
15+
java-version: 11
1616

1717
- name: Cache Maven packages
1818
uses: actions/cache@v3

‎.github/workflows/maven-deploy.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
- uses: actions/setup-java@v3
1515
with:
1616
distribution: zulu
17-
java-version: 8
17+
java-version: 11
1818

1919
- name: Cache Maven packages
2020
uses: actions/cache@v3

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ Add the following lines to Maven `pom.xml` to include the Web eID authentication
2525
<dependency>
2626
<groupId>eu.webeid.security</groupId>
2727
<artifactId>authtoken-validation</artifactId>
28-
<version>2.1.1</version>
28+
<version>3.0.0</version>
2929
</dependency>
3030
</dependencies>
3131

‎pom.xml

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,19 @@
55
<modelVersion>4.0.0</modelVersion>
66
<artifactId>authtoken-validation</artifactId>
77
<groupId>org.webeid.security</groupId>
8-
<version>2.1.2</version>
8+
<version>3.0.0</version>
99
<packaging>jar</packaging>
1010
<name>authtoken-validation</name>
1111
<description>Web eID authentication token validation library for Java</description>
1212

1313
<properties>
1414
<maven.version>3.3.9</maven.version>
1515
<maven-surefire-plugin.version>2.22.2</maven-surefire-plugin.version>
16-
<java.version>1.8</java.version>
16+
<java.version>11</java.version>
1717
<jjwt.version>0.11.5</jjwt.version>
1818
<jackson.version>2.13.4.2</jackson.version>
1919
<slf4j.version>1.7.36</slf4j.version>
2020
<bouncycastle.version>1.70</bouncycastle.version>
21-
<okhttp.version>4.10.0</okhttp.version>
2221
<junit-jupiter.version>5.8.2</junit-jupiter.version>
2322
<assertj.version>3.23.1</assertj.version>
2423
<mockito.version>4.6.1</mockito.version>
@@ -64,11 +63,6 @@
6463
<artifactId>bcpkix-jdk15on</artifactId>
6564
<version>${bouncycastle.version}</version>
6665
</dependency>
67-
<dependency>
68-
<groupId>com.squareup.okhttp3</groupId>
69-
<artifactId>okhttp</artifactId>
70-
<version>${okhttp.version}</version>
71-
</dependency>
7266

7367
<dependency>
7468
<groupId>org.junit.jupiter</groupId>

‎src/main/java/eu/webeid/security/util/DateAndTime.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ public static class DefaultClock implements Clock {
4747

4848
public static final Clock INSTANCE = new DefaultClock();
4949

50+
@Override
5051
public Date now() {
5152
return new Date();
5253
}

‎src/main/java/eu/webeid/security/validator/AuthTokenValidatorBuilder.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424

2525
import eu.webeid.security.exceptions.JceException;
2626
import eu.webeid.security.validator.ocsp.OcspClient;
27-
import eu.webeid.security.validator.ocsp.OkHttpOcspClient;
27+
import eu.webeid.security.validator.ocsp.OcspClientImpl;
2828
import eu.webeid.security.validator.ocsp.service.DesignatedOcspServiceConfiguration;
2929
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
3030
import org.slf4j.Logger;
@@ -180,7 +180,7 @@ public AuthTokenValidatorBuilder withOcspClient(OcspClient ocspClient) {
180180
public AuthTokenValidator build() throws NullPointerException, IllegalArgumentException, JceException {
181181
configuration.validate();
182182
if (configuration.isUserCertificateRevocationCheckWithOcspEnabled() && ocspClient == null) {
183-
ocspClient = OkHttpOcspClient.build(configuration.getOcspRequestTimeout());
183+
ocspClient = OcspClientImpl.build(configuration.getOcspRequestTimeout());
184184
}
185185
return new AuthTokenValidatorImpl(configuration, ocspClient);
186186
}

‎src/main/java/eu/webeid/security/validator/ocsp/OkHttpOcspClient.java renamed to ‎src/main/java/eu/webeid/security/validator/ocsp/OcspClientImpl.java

Lines changed: 39 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -22,41 +22,38 @@
2222

2323
package eu.webeid.security.validator.ocsp;
2424

25-
import okhttp3.MediaType;
26-
import okhttp3.OkHttpClient;
27-
import okhttp3.Request;
28-
import okhttp3.RequestBody;
29-
import okhttp3.Response;
30-
import okhttp3.ResponseBody;
3125
import org.bouncycastle.cert.ocsp.OCSPReq;
3226
import org.bouncycastle.cert.ocsp.OCSPResp;
3327
import org.slf4j.Logger;
3428
import org.slf4j.LoggerFactory;
3529

3630
import java.io.IOException;
3731
import java.net.URI;
32+
import java.net.http.HttpClient;
33+
import java.net.http.HttpRequest;
34+
import java.net.http.HttpResponse;
3835
import java.time.Duration;
39-
import java.util.Objects;
4036

41-
public class OkHttpOcspClient implements OcspClient {
37+
public class OcspClientImpl implements OcspClient {
4238

43-
private static final Logger LOG = LoggerFactory.getLogger(OkHttpOcspClient.class);
44-
private static final MediaType OCSP_REQUEST_TYPE = MediaType.get("application/ocsp-request");
45-
private static final MediaType OCSP_RESPONSE_TYPE = MediaType.get("application/ocsp-response");
39+
private static final Logger LOG = LoggerFactory.getLogger(OcspClientImpl.class);
40+
private static final String OCSP_REQUEST_TYPE = "application/ocsp-request";
41+
private static final String OCSP_RESPONSE_TYPE = "application/ocsp-response";
42+
public static final String CONTENT_TYPE = "Content-Type";
4643

47-
private final OkHttpClient httpClient;
44+
private final HttpClient httpClient;
45+
private final Duration ocspRequestTimeout;
4846

4947
public static OcspClient build(Duration ocspRequestTimeout) {
50-
return new OkHttpOcspClient(
51-
new OkHttpClient.Builder()
48+
return new OcspClientImpl(
49+
HttpClient.newBuilder()
5250
.connectTimeout(ocspRequestTimeout)
53-
.callTimeout(ocspRequestTimeout)
54-
.build()
55-
);
51+
.build(),
52+
ocspRequestTimeout);
5653
}
5754

5855
/**
59-
* Use OkHttpClient to fetch the OCSP response from the OCSP responder service.
56+
* Use the built-in HttpClient to fetch the OCSP response from the OCSP responder service.
6057
*
6158
* @param uri OCSP server URL
6259
* @param ocspReq OCSP request
@@ -66,31 +63,36 @@ public static OcspClient build(Duration ocspRequestTimeout) {
6663
*/
6764
@Override
6865
public OCSPResp request(URI uri, OCSPReq ocspReq) throws IOException {
69-
final RequestBody requestBody = RequestBody.create(ocspReq.getEncoded(), OCSP_REQUEST_TYPE);
70-
final Request request = new Request.Builder()
71-
.url(uri.toURL())
72-
.post(requestBody)
66+
final HttpRequest request = HttpRequest.newBuilder()
67+
.uri(uri)
68+
.header(CONTENT_TYPE, OCSP_REQUEST_TYPE)
69+
.POST(HttpRequest.BodyPublishers.ofByteArray(ocspReq.getEncoded()))
70+
.timeout(ocspRequestTimeout)
7371
.build();
7472

75-
try (final Response response = httpClient.newCall(request).execute()) {
76-
if (!response.isSuccessful()) {
77-
throw new IOException("OCSP request was not successful, response: " + response);
78-
} else {
79-
LOG.debug("OCSP response: {}", response);
80-
}
81-
try (final ResponseBody responseBody = Objects.requireNonNull(response.body(), "response body")) {
82-
Objects.requireNonNull(responseBody.contentType(), "response content type");
83-
if (!OCSP_RESPONSE_TYPE.type().equals(responseBody.contentType().type()) ||
84-
!OCSP_RESPONSE_TYPE.subtype().equals(responseBody.contentType().subtype())) {
85-
throw new IOException("OCSP response content type is not " + OCSP_RESPONSE_TYPE);
86-
}
87-
return new OCSPResp(responseBody.bytes());
88-
}
73+
final HttpResponse<byte[]> response;
74+
try {
75+
response = httpClient.send(request, HttpResponse.BodyHandlers.ofByteArray());
76+
} catch (InterruptedException e) {
77+
Thread.currentThread().interrupt();
78+
throw new IOException("Interrupted while sending OCSP request", e);
8979
}
80+
81+
if (response.statusCode() != 200) {
82+
throw new IOException("OCSP request was not successful, response: " + response);
83+
} else {
84+
LOG.debug("OCSP response: {}", response);
85+
}
86+
final String contentType = response.headers().firstValue(CONTENT_TYPE).orElse("");
87+
if (!contentType.startsWith(OCSP_RESPONSE_TYPE)) {
88+
throw new IOException("OCSP response content type is not " + OCSP_RESPONSE_TYPE);
89+
}
90+
return new OCSPResp(response.body());
9091
}
9192

92-
public OkHttpOcspClient(OkHttpClient httpClient) {
93+
public OcspClientImpl(HttpClient httpClient, Duration ocspRequestTimeout) {
9394
this.httpClient = httpClient;
95+
this.ocspRequestTimeout = ocspRequestTimeout;
9496
}
9597

9698
}

‎src/test/java/eu/webeid/security/testutil/OcspServiceMaker.java

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,9 @@
2525
import eu.webeid.security.certificate.CertificateValidator;
2626
import eu.webeid.security.exceptions.JceException;
2727
import eu.webeid.security.exceptions.OCSPCertificateException;
28+
import eu.webeid.security.validator.ocsp.OcspServiceProvider;
2829
import eu.webeid.security.validator.ocsp.service.AiaOcspServiceConfiguration;
2930
import eu.webeid.security.validator.ocsp.service.DesignatedOcspServiceConfiguration;
30-
import org.jetbrains.annotations.NotNull;
31-
import eu.webeid.security.validator.ocsp.OcspServiceProvider;
3231

3332
import java.io.IOException;
3433
import java.net.URI;
@@ -37,7 +36,9 @@
3736
import java.util.Arrays;
3837
import java.util.List;
3938

40-
import static eu.webeid.security.testutil.Certificates.*;
39+
import static eu.webeid.security.testutil.Certificates.getTestEsteid2015CA;
40+
import static eu.webeid.security.testutil.Certificates.getTestEsteid2018CA;
41+
import static eu.webeid.security.testutil.Certificates.getTestSkOcspResponder2020;
4142
import static eu.webeid.security.util.Collections.newHashSet;
4243
import static eu.webeid.security.validator.ocsp.OcspUrl.AIA_ESTEID_2015;
4344

@@ -55,22 +56,18 @@ public class OcspServiceMaker {
5556
}
5657
}
5758

58-
@NotNull
5959
public static OcspServiceProvider getAiaOcspServiceProvider() throws JceException {
6060
return new OcspServiceProvider(null, getAiaOcspServiceConfiguration());
6161
}
6262

63-
@NotNull
6463
public static OcspServiceProvider getDesignatedOcspServiceProvider() throws CertificateException, IOException, OCSPCertificateException, JceException {
6564
return new OcspServiceProvider(getDesignatedOcspServiceConfiguration(), getAiaOcspServiceConfiguration());
6665
}
6766

68-
@NotNull
6967
public static OcspServiceProvider getDesignatedOcspServiceProvider(boolean doesSupportNonce) throws CertificateException, IOException, JceException, OCSPCertificateException {
7068
return new OcspServiceProvider(getDesignatedOcspServiceConfiguration(doesSupportNonce), getAiaOcspServiceConfiguration());
7169
}
7270

73-
@NotNull
7471
public static OcspServiceProvider getDesignatedOcspServiceProvider(String ocspServiceAccessLocation) throws CertificateException, IOException, OCSPCertificateException, JceException {
7572
return new OcspServiceProvider(getDesignatedOcspServiceConfiguration(true, ocspServiceAccessLocation), getAiaOcspServiceConfiguration());
7673
}

0 commit comments

Comments
 (0)