foxhunt/services/api_gateway/src/auth/mtls/revocation.rs

//! Certificate Revocation Checking (CRL and OCSP)
//!
//! Provides certificate revocation status checking via:
//! - CRL (Certificate Revocation List) - RFC 5280
//! - OCSP (Online Certificate Status Protocol) - RFC 6960

use anyhow::{Context, Result};
use x509_parser::certificate::X509Certificate;
use tracing::{debug, warn, info, error};

/// Certificate revocation checker
#[derive(Debug, Clone)]
pub struct RevocationChecker {
    /// CRL distribution point URL (optional)
    pub crl_url: Option<String>,
    /// OCSP responder URL (optional)
    pub ocsp_url: Option<String>,
}

impl RevocationChecker {
    /// Create new revocation checker with optional CRL URL
    pub fn new(crl_url: Option<String>) -> Self {
        Self {
            crl_url,
            ocsp_url: None,
        }
    }

    /// Check certificate revocation status via CRL or OCSP
    pub async fn check_revocation(&self, cert: &X509Certificate<'_>) -> Result<()> {
        // Check if certificate has CRL Distribution Points or OCSP extensions
        let mut crl_urls = Vec::<String>::new();
        let mut ocsp_urls = Vec::<String>::new();

        for ext in cert.extensions() {
            // Check for CRL Distribution Points (OID: 2.5.29.31)
            if ext.oid.to_id_string() == "2.5.29.31" {
                // Parse CRL Distribution Points
                // This is a simplified extraction - full implementation would parse the ASN.1 structure
                debug!("Certificate has CRL Distribution Points extension");

                // Add configured CRL URL if available
                if let Some(ref url) = self.crl_url {
                    crl_urls.push(url.clone());
                }
            }

            // Check for Authority Information Access (OID: 1.3.6.1.5.5.7.1.1) for OCSP
            if ext.oid.to_id_string() == "1.3.6.1.5.5.7.1.1" {
                debug!("Certificate has Authority Information Access extension (OCSP)");
                // OCSP URL extraction would go here
                if let Some(ref url) = self.ocsp_url {
                    ocsp_urls.push(url.clone());
                }
            }
        }

        // Perform CRL check if URLs are available
        if !crl_urls.is_empty() {
            for crl_url in &crl_urls {
                match self.check_crl_revocation(cert, crl_url).await {
                    Ok(is_revoked) => {
                        if is_revoked {
                            return Err(anyhow::anyhow!(
                                "Certificate has been revoked (CRL check against: {})",
                                crl_url
                            ));
                        }
                        info!("Certificate CRL check passed: {}", crl_url);
                        return Ok(()); // Successful check, certificate not revoked
                    },
                    Err(e) => {
                        warn!("CRL check failed for {}: {}", crl_url, e);
                        // Continue to next CRL URL or OCSP
                    }
                }
            }
        }

        // Perform OCSP check if URLs are available and CRL failed
        if !ocsp_urls.is_empty() {
            for ocsp_url in &ocsp_urls {
                match self.check_ocsp_revocation(cert, ocsp_url).await {
                    Ok(is_revoked) => {
                        if is_revoked {
                            return Err(anyhow::anyhow!(
                                "Certificate has been revoked (OCSP check against: {})",
                                ocsp_url
                            ));
                        }
                        info!("Certificate OCSP check passed: {}", ocsp_url);
                        return Ok(()); // Successful check, certificate not revoked
                    },
                    Err(e) => {
                        warn!("OCSP check failed for {}: {}", ocsp_url, e);
                    }
                }
            }
        }

        // If revocation checking is enabled but no methods succeeded
        if crl_urls.is_empty() && ocsp_urls.is_empty() {
            warn!(
                "Certificate revocation checking enabled but no CRL or OCSP URLs available"
            );
            // In strict mode, this would be an error
            // For now, we allow it with a warning
        }

        Ok(())
    }

    /// Check certificate against CRL (Certificate Revocation List)
    async fn check_crl_revocation(&self, cert: &X509Certificate<'_>, crl_url: &str) -> Result<bool> {
        debug!("Checking certificate revocation via CRL: {}", crl_url);

        // Download CRL from URL
        let client = reqwest::Client::builder()
            .timeout(std::time::Duration::from_secs(10))
            .build()
            .context("Failed to create HTTP client for CRL download")?;

        let crl_response = client.get(crl_url)
            .send()
            .await
            .context("Failed to download CRL")?;

        let crl_bytes = crl_response.bytes()
            .await
            .context("Failed to read CRL response")?;

        // Parse CRL (x509-parser 0.16 API)
        let (_, crl) = x509_parser::certificate::CertificateRevocationList::from_der(&crl_bytes)
            .map_err(|e| anyhow::anyhow!("Failed to parse CRL: {}", e))?;

        // Check if certificate serial number is in revoked list
        for revoked_cert in crl.iter_revoked_certificates() {
            if revoked_cert.raw_serial() == cert.raw_serial() {
                error!(
                    "Certificate REVOKED! Serial: {:X}, Revocation date: {:?}",
                    cert.serial,
                    revoked_cert.revocation_date
                );
                return Ok(true); // Certificate is revoked
            }
        }

        Ok(false) // Certificate not found in CRL, not revoked
    }

    /// Check certificate via OCSP (Online Certificate Status Protocol)
    async fn check_ocsp_revocation(&self, _cert: &X509Certificate<'_>, ocsp_url: &str) -> Result<bool> {
        debug!("Checking certificate revocation via OCSP: {}", ocsp_url);

        // TODO: Implement OCSP checking
        // This requires building OCSP requests and parsing responses
        // Consider using the 'ocsp' crate or implementing RFC 6960

        Err(anyhow::anyhow!("OCSP checking not yet implemented"))
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_revocation_checker_creation() {
        let checker = RevocationChecker::new(Some("http://crl.example.com/ca.crl".to_string()));
        assert!(checker.crl_url.is_some());
        assert!(checker.ocsp_url.is_none());

        let checker_no_url = RevocationChecker::new(None);
        assert!(checker_no_url.crl_url.is_none());
    }
}