TimeStampSimpleHttpClient.java

/* ====================================================================
   Licensed to the Apache Software Foundation (ASF) under one or more
   contributor license agreements.  See the NOTICE file distributed with
   this work for additional information regarding copyright ownership.
   The ASF licenses this file to You under the Apache License, Version 2.0
   (the "License"); you may not use this file except in compliance with
   the License.  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
==================================================================== */

package org.apache.poi.poifs.crypt.dsig.services;

import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.Proxy;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import java.security.GeneralSecurityException;
import java.security.cert.X509Certificate;
import java.util.Base64;
import java.util.HashMap;
import java.util.Locale;
import java.util.Map;

import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

import org.apache.logging.log4j.Logger;
import org.apache.poi.logging.PoiLogManager;
import org.apache.poi.poifs.crypt.dsig.SignatureConfig;
import org.apache.poi.util.IOUtils;
import org.apache.poi.util.RandomSingleton;

/**
 * This default implementation is used to decouple the timestamp service logic from
 * the actual downloading code and to provide a base for user code
 * using a different http client implementation
 */
public class TimeStampSimpleHttpClient implements TimeStampHttpClient {
    protected static final String CONTENT_TYPE = "Content-Type";
    protected static final String USER_AGENT = "User-Agent";
    protected static final String BASIC_AUTH = "Authorization";
    protected static final String REDIRECT_LOCATION = "Location";

    private static final Logger LOG = PoiLogManager.getLogger(TimeStampSimpleHttpClient.class);

    // how large a timestamp response is expected to be
    // can be overwritten via IOUtils.setByteArrayMaxOverride()
    private static final int DEFAULT_TIMESTAMP_RESPONSE_SIZE = 10_000_000;
    private static int MAX_TIMESTAMP_RESPONSE_SIZE = DEFAULT_TIMESTAMP_RESPONSE_SIZE;

    /**
     * @param maxTimestampResponseSize the max timestamp response size allowed
     */
    public static void setMaxTimestampResponseSize(int maxTimestampResponseSize) {
        MAX_TIMESTAMP_RESPONSE_SIZE = maxTimestampResponseSize;
    }

    /**
     * @return the max timestamp response size allowed
     */
    public static int getMaxTimestampResponseSize() {
        final int ioMaxSize = IOUtils.getByteArrayMaxOverride();
        return ioMaxSize < 0 ? MAX_TIMESTAMP_RESPONSE_SIZE : Math.min(MAX_TIMESTAMP_RESPONSE_SIZE, ioMaxSize);
    }


    private static class TimeStampSimpleHttpClientResponse implements TimeStampHttpClientResponse {
        private final int responseCode;
        private final byte[] responseBytes;

        public TimeStampSimpleHttpClientResponse(int responseCode, byte[] responseBytes) {
            this.responseCode = responseCode;
            this.responseBytes = responseBytes;
        }

        @Override
        public int getResponseCode() {
            return responseCode;
        }

        @Override
        public byte[] getResponseBytes() {
            return responseBytes;
        }


    }

    protected SignatureConfig config;
    protected Proxy proxy = Proxy.NO_PROXY;
    protected final Map<String,String> header = new HashMap<>();
    protected String contentTypeOut = null;
    protected boolean ignoreHttpsCertificates = false;
    protected boolean followRedirects = false;

    @Override
    public void init(SignatureConfig config) {
        this.config = config;
        header.clear();

        header.put(USER_AGENT, config.getUserAgent());

        contentTypeOut = null;
        // don't reset followRedirects/ignoreHttpsCertificates, as they aren't contained in SignatureConfig by design
        // followRedirects = false;
        // ignoreHttpsCertificates = false;

        setProxy(config.getProxyUrl());
        setBasicAuthentication(config.getTspUser(), config.getTspPass());
    }

    public void setProxy(String proxyUrl) {
        if (proxyUrl == null || proxyUrl.isEmpty()) {
            proxy = Proxy.NO_PROXY;
        } else {
            try {
                URL pUrl = new URI(proxyUrl).toURL();
                String host = pUrl.getHost();
                int port = pUrl.getPort();
                proxy = new Proxy(Proxy.Type.HTTP, new InetSocketAddress(InetAddress.getByName(host), (port == -1 ? 80 : port)));
            } catch (IOException | URISyntaxException ignored) {
            }
        }
    }

    public Proxy getProxy() {
        return proxy;
    }

    @Override
    public void setContentTypeIn(String contentType) {
        header.put(CONTENT_TYPE, contentType);
    }

    @Override
    public void setContentTypeOut(String contentType) {
        contentTypeOut = contentType;
    }

    @Override
    public void setBasicAuthentication(String username, String password) {
        if (username == null || username.isEmpty() || password == null || password.isEmpty()) {
            header.remove(BASIC_AUTH);
        } else {
            String userPassword = username + ":" + password;
            String encoding = Base64.getEncoder().encodeToString(userPassword.getBytes(StandardCharsets.ISO_8859_1));
            header.put(BASIC_AUTH, "Basic " + encoding);
        }

    }

    @Override
    public boolean isIgnoreHttpsCertificates() {
        return ignoreHttpsCertificates;
    }

    @Override
    public void setIgnoreHttpsCertificates(boolean ignoreHttpsCertificates) {
        this.ignoreHttpsCertificates = ignoreHttpsCertificates;
    }

    @Override
    public boolean isFollowRedirects() {
        return followRedirects;
    }

    @Override
    public void setFollowRedirects(boolean followRedirects) {
        this.followRedirects = followRedirects;
    }

    @Override
    public TimeStampHttpClientResponse post(String url, byte[] payload) throws IOException {
        MethodHandler handler = (huc) -> {
            huc.setRequestMethod("POST");
            huc.setDoOutput(true);
            try (OutputStream hucOut = huc.getOutputStream()) {
                hucOut.write(payload);
            }
        };
        return handleRedirect(url, handler, isFollowRedirects());
    }

    @Override
    public TimeStampHttpClientResponse get(String url)  throws IOException {
        // connection is by default a GET call
        return handleRedirect(url, (huc) -> {}, isFollowRedirects());
    }

    protected interface MethodHandler {
        void handle(HttpURLConnection huc) throws IOException;
    }

    protected TimeStampHttpClientResponse handleRedirect(String url, MethodHandler handler, boolean followRedirect) throws IOException {
        return handleRedirect(url, handler, followRedirect, true);
    }

    /**
     * @param url the url to connect to
     * @param handler sets the request method and payload on the connection
     * @param followRedirect if true, a single redirect is followed
     * @param sendAuth if false, the basic authentication header is not sent, e.g. when following
     *                 a redirect to another origin
     * @return the response
     * @throws IOException if the request fails
     * @since 6.1.0
     */
    protected TimeStampHttpClientResponse handleRedirect(String url, MethodHandler handler, boolean followRedirect, boolean sendAuth) throws IOException {
        final HttpURLConnection huc;
        try {
            huc = (HttpURLConnection)new URI(url).toURL().openConnection(proxy);
        } catch (URISyntaxException e) {
            throw new IOException(e);
        }
        if (ignoreHttpsCertificates) {
            recklessConnection(huc);
        }
        huc.setConnectTimeout(20000);
        huc.setReadTimeout(20000);
        // redirects are handled below, so that followRedirects and the credential checks apply
        huc.setInstanceFollowRedirects(false);

        header.forEach((name, value) -> {
            if (sendAuth || !BASIC_AUTH.equals(name)) {
                huc.setRequestProperty(name, value);
            }
        });

        try {
            handler.handle(huc);

            huc.connect();

            final int responseCode = huc.getResponseCode();
            final byte[] responseBytes;

            switch (responseCode) {
                case HttpURLConnection.HTTP_MOVED_TEMP:
                case HttpURLConnection.HTTP_MOVED_PERM:
                case HttpURLConnection.HTTP_SEE_OTHER:
                    String newUrl = huc.getHeaderField(REDIRECT_LOCATION);
                    if (newUrl != null && followRedirect) {
                        // the Location header may be relative to the request url
                        try {
                            newUrl = new URI(url).resolve(newUrl).toString();
                        } catch (URISyntaxException | IllegalArgumentException e) {
                            throw new IOException("Invalid redirect location: " + newUrl, e);
                        }
                        LOG.atWarn().log("Received redirect: {} -> {}", url, newUrl);
                        // don't send the TSP credentials to another origin or downgrade them to http
                        return handleRedirect(newUrl, handler, false, sendAuth && isAuthForwardable(url, newUrl));
                    }

                    LOG.atWarn().log("Redirect ignored - giving up: {} -> {}", url, newUrl);
                    responseBytes = null;
                    break;
                case HttpURLConnection.HTTP_OK:
                    // HTTP input validation
                    String contentType = huc.getHeaderField(CONTENT_TYPE);
                    if (contentTypeOut != null && !contentTypeOut.equals(contentType)) {
                        throw new IOException("Content-Type mismatch - expected `" + contentTypeOut + "', received '" + contentType + "'");
                    }

                    try (InputStream is = huc.getInputStream()) {
                        responseBytes = IOUtils.toByteArrayWithMaxLength(is, getMaxTimestampResponseSize());
                    }
                    break;
                default:
                    final String message = "Error contacting TSP server " + url +
                        ", had status code " + responseCode + "/" + huc.getResponseMessage();
                    LOG.atError().log(message);
                    throw new IOException(message);
            }

            return new TimeStampSimpleHttpClientResponse(responseCode, responseBytes);
        } finally {
            huc.disconnect();
        }
    }

    /**
     * Credentials are only resent to the same host, either on the same scheme and port or
     * on an http to https upgrade with default ports.
     */
    static boolean isAuthForwardable(String fromUrl, String toUrl) {
        final URI from, to;
        try {
            from = new URI(fromUrl);
            to = new URI(toUrl);
        } catch (URISyntaxException e) {
            return false;
        }
        if (from.getHost() == null || !from.getHost().equalsIgnoreCase(to.getHost())) {
            return false;
        }
        final String fromScheme = String.valueOf(from.getScheme()).toLowerCase(Locale.ROOT);
        final String toScheme = String.valueOf(to.getScheme()).toLowerCase(Locale.ROOT);
        final int fromPort = effectivePort(from.getPort(), fromScheme);
        final int toPort = effectivePort(to.getPort(), toScheme);
        if (fromScheme.equals(toScheme)) {
            return fromPort == toPort;
        }
        return "http".equals(fromScheme) && "https".equals(toScheme)
            && fromPort == 80 && toPort == 443;
    }

    private static int effectivePort(int port, String scheme) {
        if (port != -1) {
            return port;
        }
        switch (scheme) {
            case "http": return 80;
            case "https": return 443;
            default: return -1;
        }
    }

    protected void recklessConnection(HttpURLConnection conn) throws IOException {
        if (!(conn instanceof HttpsURLConnection conns)) {
            return;
        }

        try {
            SSLContext sc = SSLContext.getInstance("TLS");
            sc.init(null, new TrustManager[]{new UnsafeTrustManager()}, RandomSingleton.getInstance());
            conns.setSSLSocketFactory(sc.getSocketFactory());
            conns.setHostnameVerifier((hostname, session) -> true);
        } catch (GeneralSecurityException e) {
            throw new IOException("Unable to reckless wrap connection.", e);
        }
    }

    private static class UnsafeTrustManager implements X509TrustManager {
        @Override
        public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; }
        @Override
        public void checkClientTrusted(X509Certificate[] certs, String authType) { }
        @Override
        public void checkServerTrusted(X509Certificate[] certs, String authType) { }
    }
}