sprints work.

2026-01-20 00:45:38 +02:00
parent b34bde89fa
commit 4903395618
275 changed files with 52785 additions and 79 deletions
--- a/src/__Libraries/StellaOps.Cryptography.CertificateStatus/OcspClient.cs
+++ b/src/__Libraries/StellaOps.Cryptography.CertificateStatus/OcspClient.cs
@@ -0,0 +1,443 @@
+// -----------------------------------------------------------------------------
+// OcspClient.cs
+// Sprint: SPRINT_20260119_008 Certificate Status Provider
+// Task: CSP-002 - OCSP Client Implementation
+// Description: RFC 6960 OCSP client with request generation and response parsing.
+// -----------------------------------------------------------------------------
+
+using System.Formats.Asn1;
+using System.Net.Http.Headers;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging;
+using StellaOps.Cryptography.CertificateStatus.Abstractions;
+
+namespace StellaOps.Cryptography.CertificateStatus;
+
+/// <summary>
+/// OCSP client implementation following RFC 6960.
+/// </summary>
+public sealed class OcspClient
+{
+    private const string OcspRequestContentType = "application/ocsp-request";
+    private const string OcspResponseContentType = "application/ocsp-response";
+    private const int MaxGetRequestSize = 255;
+
+    private readonly IHttpClientFactory _httpClientFactory;
+    private readonly IMemoryCache _cache;
+    private readonly ILogger<OcspClient> _logger;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="OcspClient"/> class.
+    /// </summary>
+    public OcspClient(
+        IHttpClientFactory httpClientFactory,
+        IMemoryCache cache,
+        ILogger<OcspClient> logger)
+    {
+        _httpClientFactory = httpClientFactory;
+        _cache = cache;
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Checks the revocation status of a certificate via OCSP.
+    /// </summary>
+    public async Task<CertificateStatusResult> CheckStatusAsync(
+        X509Certificate2 certificate,
+        X509Certificate2 issuer,
+        CertificateStatusOptions options,
+        CancellationToken cancellationToken = default)
+    {
+        // Get OCSP responder URL from certificate
+        var ocspUrl = GetOcspResponderUrl(certificate);
+        if (string.IsNullOrEmpty(ocspUrl))
+        {
+            return CertificateStatusResult.Unavailable("No OCSP responder URL in certificate");
+        }
+
+        // Check cache first
+        var cacheKey = $"ocsp:{certificate.Thumbprint}";
+        if (options.EnableCaching && _cache.TryGetValue(cacheKey, out CertificateStatusResult? cached))
+        {
+            if (cached!.IsFresh)
+            {
+                _logger.LogDebug("OCSP cache hit for {Thumbprint}", certificate.Thumbprint);
+                return cached;
+            }
+        }
+
+        try
+        {
+            // Generate OCSP request
+            var nonce = options.IncludeOcspNonce ? GenerateNonce() : null;
+            var ocspRequest = GenerateOcspRequest(certificate, issuer, nonce);
+
+            // Send request
+            var responseBytes = await SendOcspRequestAsync(
+                ocspUrl, ocspRequest, options.RequestTimeout, cancellationToken);
+
+            // Parse response
+            var result = ParseOcspResponse(responseBytes, certificate, nonce, ocspUrl);
+
+            // Cache successful responses
+            if (options.EnableCaching && result.Status == RevocationStatus.Good && result.NextUpdate.HasValue)
+            {
+                var expiry = result.NextUpdate.Value - DateTimeOffset.UtcNow;
+                if (expiry > TimeSpan.Zero && expiry <= options.MaxOcspAge)
+                {
+                    _cache.Set(cacheKey, result, expiry);
+                }
+            }
+
+            return result;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "OCSP check failed for {Thumbprint}", certificate.Thumbprint);
+            return CertificateStatusResult.Unavailable($"OCSP request failed: {ex.Message}");
+        }
+    }
+
+    /// <summary>
+    /// Parses a pre-fetched OCSP response.
+    /// </summary>
+    public CertificateStatusResult ParseStapledResponse(
+        ReadOnlyMemory<byte> responseBytes,
+        X509Certificate2 certificate)
+    {
+        return ParseOcspResponse(responseBytes.ToArray(), certificate, null, null);
+    }
+
+    private async Task<byte[]> SendOcspRequestAsync(
+        string url,
+        byte[] request,
+        TimeSpan timeout,
+        CancellationToken cancellationToken)
+    {
+        var client = _httpClientFactory.CreateClient("OCSP");
+        client.Timeout = timeout;
+
+        HttpResponseMessage response;
+
+        // Use GET for small requests, POST for larger ones
+        if (request.Length <= MaxGetRequestSize)
+        {
+            var base64Url = Convert.ToBase64String(request)
+                .Replace('+', '-')
+                .Replace('/', '_')
+                .TrimEnd('=');
+            var getUrl = $"{url.TrimEnd('/')}/{Uri.EscapeDataString(base64Url)}";
+
+            response = await client.GetAsync(getUrl, cancellationToken);
+        }
+        else
+        {
+            var content = new ByteArrayContent(request);
+            content.Headers.ContentType = new MediaTypeHeaderValue(OcspRequestContentType);
+            response = await client.PostAsync(url, content, cancellationToken);
+        }
+
+        response.EnsureSuccessStatusCode();
+
+        var contentType = response.Content.Headers.ContentType?.MediaType;
+        if (contentType != OcspResponseContentType)
+        {
+            _logger.LogWarning("Unexpected OCSP response content type: {ContentType}", contentType);
+        }
+
+        return await response.Content.ReadAsByteArrayAsync(cancellationToken);
+    }
+
+    private byte[] GenerateOcspRequest(
+        X509Certificate2 certificate,
+        X509Certificate2 issuer,
+        byte[]? nonce)
+    {
+        var writer = new AsnWriter(AsnEncodingRules.DER);
+
+        // OCSPRequest ::= SEQUENCE { tbsRequest TBSRequest, ... }
+        using (writer.PushSequence())
+        {
+            // TBSRequest ::= SEQUENCE { version, requestorName, requestList, extensions }
+            using (writer.PushSequence())
+            {
+                // requestList SEQUENCE OF Request
+                using (writer.PushSequence())
+                {
+                    // Request ::= SEQUENCE { reqCert CertID, ... }
+                    using (writer.PushSequence())
+                    {
+                        WriteCertId(writer, certificate, issuer);
+                    }
+                }
+
+                // extensions [2] EXPLICIT Extensions OPTIONAL
+                if (nonce is not null)
+                {
+                    using (writer.PushSequence(new Asn1Tag(TagClass.ContextSpecific, 2)))
+                    {
+                        using (writer.PushSequence())
+                        {
+                            // Extension for nonce
+                            using (writer.PushSequence())
+                            {
+                                writer.WriteObjectIdentifier("1.3.6.1.5.5.7.48.1.2"); // id-pkix-ocsp-nonce
+                                writer.WriteOctetString(nonce);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        return writer.Encode();
+    }
+
+    private static void WriteCertId(AsnWriter writer, X509Certificate2 certificate, X509Certificate2 issuer)
+    {
+        // CertID ::= SEQUENCE { hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber }
+        using (writer.PushSequence())
+        {
+            // hashAlgorithm AlgorithmIdentifier (SHA-256)
+            using (writer.PushSequence())
+            {
+                writer.WriteObjectIdentifier("2.16.840.1.101.3.4.2.1"); // SHA-256
+                writer.WriteNull();
+            }
+
+            // issuerNameHash OCTET STRING
+            var issuerNameHash = SHA256.HashData(issuer.SubjectName.RawData);
+            writer.WriteOctetString(issuerNameHash);
+
+            // issuerKeyHash OCTET STRING
+            var issuerKeyHash = SHA256.HashData(GetSubjectPublicKeyInfo(issuer));
+            writer.WriteOctetString(issuerKeyHash);
+
+            // serialNumber CertificateSerialNumber
+            var serialBytes = certificate.SerialNumberBytes.ToArray();
+            // Reverse for big-endian
+            Array.Reverse(serialBytes);
+            writer.WriteIntegerUnsigned(serialBytes);
+        }
+    }
+
+    private static byte[] GetSubjectPublicKeyInfo(X509Certificate2 certificate)
+    {
+        // Extract the public key bytes from the certificate
+        var publicKey = certificate.PublicKey;
+        return publicKey.EncodedKeyValue.RawData;
+    }
+
+    private CertificateStatusResult ParseOcspResponse(
+        byte[] responseBytes,
+        X509Certificate2 certificate,
+        byte[]? expectedNonce,
+        string? responderUrl)
+    {
+        try
+        {
+            var reader = new AsnReader(responseBytes, AsnEncodingRules.DER);
+            var responseSequence = reader.ReadSequence();
+
+            // OCSPResponse ::= SEQUENCE { responseStatus, responseBytes }
+            var statusValue = responseSequence.ReadEnumeratedBytes();
+            var status = (OcspResponseStatus)statusValue.Span[0];
+
+            if (status != OcspResponseStatus.Successful)
+            {
+                return CertificateStatusResult.Unavailable($"OCSP responder returned status: {status}");
+            }
+
+            if (!responseSequence.HasData)
+            {
+                return CertificateStatusResult.Unavailable("OCSP response has no response bytes");
+            }
+
+            // responseBytes [0] EXPLICIT ResponseBytes
+            var responseBytesWrapper = responseSequence.ReadSequence(new Asn1Tag(TagClass.ContextSpecific, 0));
+            var responseType = responseBytesWrapper.ReadObjectIdentifier();
+
+            if (responseType != "1.3.6.1.5.5.7.48.1.1") // id-pkix-ocsp-basic
+            {
+                return CertificateStatusResult.Unknown(RevocationSource.Ocsp, $"Unknown OCSP response type: {responseType}");
+            }
+
+            var basicResponseBytes = responseBytesWrapper.ReadOctetString();
+            return ParseBasicOcspResponse(basicResponseBytes, certificate, expectedNonce, responderUrl, responseBytes);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to parse OCSP response");
+            return CertificateStatusResult.Unavailable($"Failed to parse OCSP response: {ex.Message}");
+        }
+    }
+
+    private CertificateStatusResult ParseBasicOcspResponse(
+        byte[] basicResponseBytes,
+        X509Certificate2 certificate,
+        byte[]? expectedNonce,
+        string? responderUrl,
+        byte[] rawResponse)
+    {
+        var reader = new AsnReader(basicResponseBytes, AsnEncodingRules.DER);
+        var basicResponse = reader.ReadSequence();
+
+        // tbsResponseData
+        var tbsResponseData = basicResponse.ReadSequence();
+
+        // Skip version if present [0]
+        if (tbsResponseData.PeekTag().TagClass == TagClass.ContextSpecific && tbsResponseData.PeekTag().TagValue == 0)
+        {
+            tbsResponseData.ReadSequence(new Asn1Tag(TagClass.ContextSpecific, 0));
+        }
+
+        // responderID (skip)
+        tbsResponseData.ReadEncodedValue();
+
+        // producedAt GeneralizedTime
+        var producedAt = tbsResponseData.ReadGeneralizedTime();
+
+        // responses SEQUENCE OF SingleResponse
+        var responses = tbsResponseData.ReadSequence();
+
+        while (responses.HasData)
+        {
+            var singleResponse = responses.ReadSequence();
+
+            // certID CertID (skip for now, assume single cert)
+            singleResponse.ReadSequence();
+
+            // certStatus CHOICE
+            var certStatusTag = singleResponse.PeekTag();
+            RevocationStatus revocationStatus;
+            DateTimeOffset? revocationTime = null;
+            RevocationReason? revocationReason = null;
+
+            if (certStatusTag.TagValue == 0) // good [0] IMPLICIT NULL
+            {
+                singleResponse.ReadNull(new Asn1Tag(TagClass.ContextSpecific, 0));
+                revocationStatus = RevocationStatus.Good;
+            }
+            else if (certStatusTag.TagValue == 1) // revoked [1] IMPLICIT RevokedInfo
+            {
+                var revokedInfo = singleResponse.ReadSequence(new Asn1Tag(TagClass.ContextSpecific, 1));
+                revocationTime = revokedInfo.ReadGeneralizedTime();
+                if (revokedInfo.HasData)
+                {
+                    var reasonTag = revokedInfo.PeekTag();
+                    if (reasonTag.TagClass == TagClass.ContextSpecific && reasonTag.TagValue == 0)
+                    {
+                        var reasonBytes = revokedInfo.ReadEnumeratedBytes(new Asn1Tag(TagClass.ContextSpecific, 0));
+                        revocationReason = (RevocationReason)reasonBytes.Span[0];
+                    }
+                }
+                revocationStatus = RevocationStatus.Revoked;
+            }
+            else // unknown [2] IMPLICIT NULL
+            {
+                singleResponse.ReadNull(new Asn1Tag(TagClass.ContextSpecific, 2));
+                revocationStatus = RevocationStatus.Unknown;
+            }
+
+            // thisUpdate GeneralizedTime
+            var thisUpdate = singleResponse.ReadGeneralizedTime();
+
+            // nextUpdate [0] EXPLICIT GeneralizedTime OPTIONAL
+            DateTimeOffset? nextUpdate = null;
+            if (singleResponse.HasData && singleResponse.PeekTag().TagClass == TagClass.ContextSpecific)
+            {
+                var nextUpdateWrapper = singleResponse.ReadSequence(new Asn1Tag(TagClass.ContextSpecific, 0));
+                nextUpdate = nextUpdateWrapper.ReadGeneralizedTime();
+            }
+
+            if (revocationStatus == RevocationStatus.Revoked)
+            {
+                return CertificateStatusResult.Revoked(
+                    RevocationSource.Ocsp,
+                    revocationTime ?? DateTimeOffset.UtcNow,
+                    revocationReason ?? Abstractions.RevocationReason.Unspecified);
+            }
+
+            return new CertificateStatusResult
+            {
+                Status = revocationStatus,
+                Source = RevocationSource.Ocsp,
+                ProducedAt = producedAt,
+                ThisUpdate = thisUpdate,
+                NextUpdate = nextUpdate,
+                ResponderUrl = responderUrl,
+                RawOcspResponse = rawResponse
+            };
+        }
+
+        return CertificateStatusResult.Unknown(RevocationSource.Ocsp, "No matching response found");
+    }
+
+    private static string? GetOcspResponderUrl(X509Certificate2 certificate)
+    {
+        const string authorityInfoAccessOid = "1.3.6.1.5.5.7.1.1";
+        const string ocspOid = "1.3.6.1.5.5.7.48.1";
+
+        foreach (var extension in certificate.Extensions)
+        {
+            if (extension.Oid?.Value != authorityInfoAccessOid)
+                continue;
+
+            try
+            {
+                var reader = new AsnReader(extension.RawData, AsnEncodingRules.DER);
+                var sequence = reader.ReadSequence();
+
+                while (sequence.HasData)
+                {
+                    var accessDescription = sequence.ReadSequence();
+                    var method = accessDescription.ReadObjectIdentifier();
+
+                    if (method == ocspOid)
+                    {
+                        // accessLocation is [6] IA5String for URI
+                        var tag = accessDescription.PeekTag();
+                        if (tag.TagClass == TagClass.ContextSpecific && tag.TagValue == 6)
+                        {
+                            var urlBytes = accessDescription.ReadCharacterString(
+                                UniversalTagNumber.IA5String,
+                                new Asn1Tag(TagClass.ContextSpecific, 6));
+                            return urlBytes;
+                        }
+                    }
+
+                    // Skip remaining access location
+                    if (accessDescription.HasData)
+                    {
+                        accessDescription.ReadEncodedValue();
+                    }
+                }
+            }
+            catch
+            {
+                // Ignore parse errors
+            }
+        }
+
+        return null;
+    }
+
+    private static byte[] GenerateNonce()
+    {
+        var nonce = new byte[16];
+        RandomNumberGenerator.Fill(nonce);
+        return nonce;
+    }
+
+    private enum OcspResponseStatus
+    {
+        Successful = 0,
+        MalformedRequest = 1,
+        InternalError = 2,
+        TryLater = 3,
+        SigRequired = 5,
+        Unauthorized = 6
+    }
+}