Skip to content

Commit f19a6a7

Browse files
Mikk BachmannMikk Bachmann
Mikk Bachmann
authored and
Mikk Bachmann
committed
feat: As a Security Server Administrator I want the diagnostics information available for global configuration and TSA to be improved so that I can more easily figure out issus with it
ocsp refs: XRDDEV-2921
1 parent 98be346 commit f19a6a7

File tree

6 files changed

+48
-123
lines changed

6 files changed

+48
-123
lines changed

‎src/lib/globalconf-core/src/main/java/org/niis/xroad/globalconf/status/OcspResponderStatus.java‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,23 +25,27 @@
2525
*/
2626
package org.niis.xroad.globalconf.status;
2727

28+
import ee.ria.xroad.common.DiagnosticStatus;
29+
2830
import lombok.AccessLevel;
31+
import lombok.Data;
2932
import lombok.NoArgsConstructor;
3033
import lombok.RequiredArgsConstructor;
31-
import lombok.Value;
34+
import org.niis.xroad.common.core.exception.ErrorCode;
3235

3336
import java.io.Serializable;
3437
import java.time.OffsetDateTime;
3538

3639
/**
3740
* Diagnostics status for single OCSP responder
3841
*/
39-
@Value
42+
@Data
4043
@NoArgsConstructor(force = true, access = AccessLevel.PRIVATE)
4144
@RequiredArgsConstructor
4245
public class OcspResponderStatus implements Serializable {
43-
int status;
44-
String url;
45-
OffsetDateTime prevUpdate;
46-
OffsetDateTime nextUpdate;
46+
private final DiagnosticStatus diagnosticStatus;
47+
private final String url;
48+
private final OffsetDateTime prevUpdate;
49+
private final OffsetDateTime nextUpdate;
50+
private ErrorCode errorCode;
4751
}

‎src/security-server/admin-service/application/src/main/java/org/niis/xroad/securityserver/restapi/converter/OcspResponderDiagnosticConverter.java‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,17 +26,16 @@
2626
*/
2727
package org.niis.xroad.securityserver.restapi.converter;
2828

29+
import ee.ria.xroad.common.DiagnosticsStatus;
30+
2931
import com.google.common.collect.Streams;
30-
import org.niis.xroad.globalconf.status.DiagnosticsStatus;
3132
import org.niis.xroad.securityserver.restapi.dto.OcspResponderDiagnosticsStatus;
32-
import org.niis.xroad.securityserver.restapi.openapi.model.DiagnosticStatusClassDto;
33+
import org.niis.xroad.securityserver.restapi.openapi.model.CodeWithDetailsDto;
3334
import org.niis.xroad.securityserver.restapi.openapi.model.OcspResponderDiagnosticsDto;
3435
import org.niis.xroad.securityserver.restapi.openapi.model.OcspResponderDto;
35-
import org.niis.xroad.securityserver.restapi.openapi.model.OcspStatusDto;
3636
import org.springframework.stereotype.Component;
3737

3838
import java.util.List;
39-
import java.util.Optional;
4039
import java.util.Set;
4140
import java.util.stream.Collectors;
4241

@@ -65,12 +64,11 @@ public Set<OcspResponderDiagnosticsDto> convert(Iterable<OcspResponderDiagnostic
6564
private OcspResponderDto convertOcspResponder(DiagnosticsStatus diagnosticsStatus) {
6665
OcspResponderDto ocspResponder = new OcspResponderDto();
6766
ocspResponder.setUrl(diagnosticsStatus.getDescription());
68-
Optional<OcspStatusDto> statusCode = OcspStatusMapping.map(
69-
diagnosticsStatus.getReturnCode());
70-
ocspResponder.setStatusCode(statusCode.orElse(null));
71-
Optional<DiagnosticStatusClassDto> statusClass = DiagnosticStatusClassMapping.map(
72-
diagnosticsStatus.getReturnCode());
73-
ocspResponder.setStatusClass(statusClass.orElse(null));
67+
if (diagnosticsStatus.getErrorCode() != null) {
68+
ocspResponder.setError(new CodeWithDetailsDto(diagnosticsStatus.getErrorCode().code())
69+
.metadata(diagnosticsStatus.getErrorCodeMetadata()));
70+
}
71+
ocspResponder.setStatusClass(DiagnosticStatusClassMapping.map(diagnosticsStatus.getStatus()));
7472
if (diagnosticsStatus.getPrevUpdate() != null) {
7573
ocspResponder.setPrevUpdateAt(diagnosticsStatus.getPrevUpdate());
7674
}

‎src/security-server/admin-service/application/src/main/java/org/niis/xroad/securityserver/restapi/converter/OcspStatusMapping.java‎

Lines changed: 0 additions & 83 deletions
This file was deleted.

‎src/security-server/admin-service/application/src/main/java/org/niis/xroad/securityserver/restapi/dto/OcspResponderDiagnosticsStatus.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,9 @@
2525
*/
2626
package org.niis.xroad.securityserver.restapi.dto;
2727

28+
import ee.ria.xroad.common.DiagnosticsStatus;
29+
2830
import lombok.Data;
29-
import org.niis.xroad.globalconf.status.DiagnosticsStatus;
3031

3132
import java.util.List;
3233

‎src/service/signer/signer-core/src/main/java/org/niis/xroad/signer/core/certmanager/OcspClientWorker.java‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
package org.niis.xroad.signer.core.certmanager;
2727

2828
import ee.ria.xroad.common.CodedException;
29-
import ee.ria.xroad.common.DiagnosticsErrorCodes;
29+
import ee.ria.xroad.common.DiagnosticStatus;
3030
import ee.ria.xroad.common.crypto.identifier.SignAlgorithm;
3131
import ee.ria.xroad.common.util.CertUtils;
3232
import ee.ria.xroad.common.util.CryptoUtils;
@@ -36,6 +36,7 @@
3636
import lombok.extern.slf4j.Slf4j;
3737
import org.bouncycastle.cert.ocsp.OCSPException;
3838
import org.bouncycastle.cert.ocsp.OCSPResp;
39+
import org.niis.xroad.common.core.exception.ErrorCode;
3940
import org.niis.xroad.globalconf.GlobalConfProvider;
4041
import org.niis.xroad.globalconf.cert.CertChain;
4142
import org.niis.xroad.globalconf.impl.ocsp.OcspVerifier;
@@ -265,7 +266,7 @@ OCSPResp queryCertStatus(X509Certificate subject, OcspVerifierOptions verifierOp
265266
final OffsetDateTime prevUpdate = TimeUtils.offsetDateTimeNow();
266267
final OffsetDateTime nextUpdate = prevUpdate
267268
.plusSeconds(globalConfProvider.getGlobalConfExtensions().getOcspFetchInterval());
268-
int errorCode = DiagnosticsErrorCodes.ERROR_CODE_OCSP_RESPONSE_INVALID;
269+
ErrorCode errorCode = null;
269270

270271
try {
271272
log.debug("Fetching response from: {}", responderURI);
@@ -277,35 +278,38 @@ OCSPResp queryCertStatus(X509Certificate subject, OcspVerifierOptions verifierOp
277278
verifier.verifyValidity(response, subject, issuer);
278279
log.debug("Verified OCSP response for certificate '{}'", subject.getSubjectX500Principal());
279280

280-
reportOcspDiagnostics(issuer, responderURI, DiagnosticsErrorCodes.RETURN_SUCCESS, prevUpdate,
281-
nextUpdate);
281+
reportOcspDiagnostics(issuer, responderURI, DiagnosticStatus.OK, prevUpdate,
282+
nextUpdate, null);
282283

283284
return response;
284285
}
285286
} catch (OCSPException e) {
286287
log.error("Parsing OCSP response from {} failed", responderURI, e);
287-
errorCode = DiagnosticsErrorCodes.ERROR_CODE_OCSP_RESPONSE_INVALID;
288+
errorCode = ErrorCode.OCSP_RESPONSE_PARSING_FAILURE;
288289
} catch (IOException e) {
289290
log.error("Unable to connect to responder at {}", responderURI, e);
290-
errorCode = DiagnosticsErrorCodes.ERROR_CODE_OCSP_CONNECTION_ERROR;
291+
errorCode = ErrorCode.OCSP_CONNECTION_ERROR;
291292
} catch (CodedException e) {
292293
log.warn("Received OCSP response that failed verification", e);
293-
errorCode = DiagnosticsErrorCodes.ERROR_CODE_OCSP_RESPONSE_UNVERIFIED;
294+
errorCode = ErrorCode.OCSP_RESPONSE_VERIFICATION_FAILURE;
294295
} catch (Exception e) {
295296
log.error("Unable to fetch response from responder at {}", responderURI, e);
296-
errorCode = DiagnosticsErrorCodes.ERROR_CODE_OCSP_RESPONSE_INVALID;
297+
errorCode = ErrorCode.OCSP_FAILED;
297298
}
298299

299-
reportOcspDiagnostics(issuer, responderURI, errorCode, prevUpdate, nextUpdate);
300+
reportOcspDiagnostics(issuer, responderURI, DiagnosticStatus.ERROR, prevUpdate, nextUpdate, errorCode);
300301
}
301302

302303
return null;
303304
}
304305

305-
private void reportOcspDiagnostics(X509Certificate issuer, String responderURI, int statusCode,
306-
OffsetDateTime prevUpdate, OffsetDateTime nextUpdate) {
306+
private void reportOcspDiagnostics(X509Certificate issuer, String responderURI, DiagnosticStatus statusCode,
307+
OffsetDateTime prevUpdate, OffsetDateTime nextUpdate, ErrorCode errorCode) {
307308

308309
OcspResponderStatus responderStatus = new OcspResponderStatus(statusCode, responderURI, prevUpdate, nextUpdate);
310+
if (errorCode != null) {
311+
responderStatus.setErrorCode(errorCode);
312+
}
309313

310314
String subjectName = issuer.getSubjectDN().toString();
311315

@@ -393,13 +397,13 @@ private void initializeDiagnostics() {
393397

394398
final Collection<X509Certificate> caCerts = globalConfProvider.getAllCaCerts();
395399
serviceStatusMap.keySet().retainAll(caCerts.stream()
396-
.map(X509Certificate::getSubjectDN)
400+
.map(X509Certificate::getSubjectX500Principal)
397401
.map(Principal::toString)
398402
.collect(Collectors.toSet()));
399403

400404
for (X509Certificate caCertificate : caCerts) {
401405
try {
402-
final String key = caCertificate.getSubjectDN().toString();
406+
final String key = caCertificate.getSubjectX500Principal().toString();
403407
final CertificationServiceStatus serviceStatus = serviceStatusMap
404408
.computeIfAbsent(key, CertificationServiceStatus::new);
405409

@@ -408,7 +412,7 @@ private void initializeDiagnostics() {
408412
responderStatusMap.keySet().retainAll(addresses);
409413

410414
addresses.forEach(responderURI -> responderStatusMap.computeIfAbsent(responderURI,
411-
uri -> new OcspResponderStatus(DiagnosticsErrorCodes.ERROR_CODE_OCSP_UNINITIALIZED, uri, null,
415+
uri -> new OcspResponderStatus(DiagnosticStatus.UNINITIALIZED, uri, null,
412416
TimeUtils.offsetDateTimeNow().plusSeconds(fetchInterval))));
413417
} catch (Exception e) {
414418
log.error("Error while initializing diagnostics", e);

‎src/service/signer/signer-core/src/main/java/org/niis/xroad/signer/core/certmanager/OcspResponseManager.java‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -129,25 +129,26 @@ public void init() {
129129
public GetOcspResponsesResponse handleGetOcspResponses(GetOcspResponses message) throws Exception {
130130
log.trace("handleGetOcspResponses()");
131131

132-
String[] base64EncodedResponses = new String[message.getCertHash().length];
133-
for (int i = 0; i < message.getCertHash().length; i++) {
134-
OCSPResp ocspResponse = getResponse(message.getCertHash()[i]);
132+
String[] certHashes = message.getCertHash();
133+
String[] base64EncodedResponses = new String[certHashes.length];
134+
for (int i = 0; i < certHashes.length; i++) {
135+
OCSPResp ocspResponse = getResponse(certHashes[i]);
135136
if (ocspResponse == null) {
136-
log.debug("No cached OCSP response available for cert {}", message.getCertHash()[i]);
137+
log.debug("No cached OCSP response available for cert {}", certHashes[i]);
137138
// if the response is not in local cache, download it
138-
ocspResponse = downloadOcspResponse(message.getCertHash()[i]);
139+
ocspResponse = downloadOcspResponse(certHashes[i]);
139140
if (ocspResponse != null) {
140-
setResponse(message.getCertHash()[i], ocspResponse);
141+
setResponse(certHashes[i], ocspResponse);
141142
}
142143
} else {
143-
log.debug("Found a cached OCSP response for cert {}", message.getCertHash()[i]);
144+
log.debug("Found a cached OCSP response for cert {}", certHashes[i]);
144145
}
145146

146147
if (ocspResponse != null) {
147-
log.debug("Acquired an OCSP response for certificate {}", message.getCertHash()[i]);
148+
log.debug("Acquired an OCSP response for certificate {}", certHashes[i]);
148149
base64EncodedResponses[i] = encodeBase64(ocspResponse.getEncoded());
149150
} else {
150-
log.warn("Could not acquire an OCSP response for certificate {}", message.getCertHash()[i]);
151+
log.warn("Could not acquire an OCSP response for certificate {}", certHashes[i]);
151152
}
152153
}
153154

0 commit comments

Comments
 (0)