Netty: TOCTOU in OcspServerCertificateValidator

    @Test
    public void test() throws Exception {
        EventLoopGroup group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory());
        try {
            OCSPRespBuilder respBuilder = new OCSPRespBuilder();
            OCSPResp response = respBuilder.build(OCSPRespBuilder.INTERNAL_ERROR, null);
            byte[] responseEncoded = response.getEncoded();

            IoTransport mockTransport = IoTransport.create(group.next(), () -> {
                NioSocketChannel channel = new NioSocketChannel();
                channel.pipeline().addFirst(new ChannelOutboundHandlerAdapter() {
                    @Override
                    public void connect(ChannelHandlerContext ctx, SocketAddress remoteAddress, SocketAddress localAddress, ChannelPromise promise) {
                        promise.setSuccess();

                        ctx.executor().schedule(() -> {
                            ctx.pipeline().fireChannelActive();

                            DefaultFullHttpResponse httpResponse = new DefaultFullHttpResponse(
                                    HttpVersion.HTTP_1_1, HttpResponseStatus.OK, Unpooled.wrappedBuffer(responseEncoded));
                            httpResponse.headers().set(HttpHeaderNames.CONTENT_TYPE, "application/ocsp-response");
                            httpResponse.headers().set(HttpHeaderNames.CONTENT_LENGTH, httpResponse.content().readableBytes());

                            ctx.pipeline().fireChannelRead(httpResponse);
                        }, 500, TimeUnit.MILLISECONDS);
                    }
                });
                return channel;
            }, NioDatagramChannel::new);

            X509Bundle caRoot = new CertificateBuilder()
                    .algorithm(CertificateBuilder.Algorithm.rsa2048)
                    .subject("CN=TrustedRootCA")
                    .setIsCertificateAuthority(true)
                    .buildSelfSigned();

            GeneralName ocspName = new GeneralName(GeneralName.uniformResourceIdentifier, "http://localhost/");
            AuthorityInformationAccess aia = new AuthorityInformationAccess(new AccessDescription(AccessDescription.id_ad_ocsp, ocspName));
            X509Bundle targetCert = new CertificateBuilder()
                    .algorithm(CertificateBuilder.Algorithm.rsa2048)
                    .subject("CN=TargetServer")
                    .addExtensionOctetString("1.3.6.1.5.5.7.1.1", false, aia.getEncoded())
                    .buildIssuedBy(caRoot);

            SslContext serverSslCtx = SslContextBuilder.forServer(targetCert.getKeyPair().getPrivate(), targetCert.getCertificate()).build();

            CopyOnWriteArrayList<String> receivedData = new CopyOnWriteArrayList<>();
            CountDownLatch dataReceivedLatch = new CountDownLatch(1);

            new ServerBootstrap()
                    .group(group)
                    .channel(NioServerSocketChannel.class)
                    .childHandler(new ChannelInitializer<SocketChannel>() {
                        @Override
                        protected void initChannel(SocketChannel ch) {
                            ch.pipeline().addLast(serverSslCtx.newHandler(ch.alloc()));
                            ch.pipeline().addLast(new SimpleChannelInboundHandler<ByteBuf>() {
                                @Override
                                protected void channelRead0(ChannelHandlerContext ctx, ByteBuf msg) {
                                    receivedData.add(msg.toString(CharsetUtil.UTF_8));
                                    dataReceivedLatch.countDown();
                                }
                            });
                        }
                    })
                    .bind(8080)
                    .sync()
                    .channel();

            SslContext clientSslCtx = SslContextBuilder.forClient()
                    .trustManager(InsecureTrustManagerFactory.INSTANCE)
                    .build();

            DnsNameResolver resolver = OcspServerCertificateValidator.createDefaultResolver(mockTransport);
            Channel clientChannel = new Bootstrap()
                    .group(group)
                    .channel(NioSocketChannel.class)
                    .handler(new ChannelInitializer<SocketChannel>() {
                        @Override
                        protected void initChannel(SocketChannel ch) {
                            ch.pipeline().addLast(clientSslCtx.newHandler(ch.alloc(), "127.0.0.1", 8080));
                            ch.pipeline().addLast(new OcspServerCertificateValidator(true, false, mockTransport, resolver));
                            ch.pipeline().addLast(new ChannelInboundHandlerAdapter() {
                                @Override
                                public void userEventTriggered(ChannelHandlerContext ctx, Object evt) {
                                    if (evt instanceof SslHandshakeCompletionEvent) {
                                        SslHandshakeCompletionEvent sslEvent = (SslHandshakeCompletionEvent) evt;
                                        if (sslEvent.isSuccess()) {
                                            ctx.writeAndFlush(Unpooled.copiedBuffer("SECRET_DATA", CharsetUtil.UTF_8));
                                        }
                                    }
                                    ctx.fireUserEventTriggered(evt);
                                }
                            });
                        }
                    })
                    .connect("127.0.0.1", 8080)
                    .sync()
                    .channel();

            assertTrue(clientChannel.closeFuture().await(5, TimeUnit.SECONDS));

            Thread.sleep(200);

            assertFalse(receivedData.contains("SECRET_DATA"), "Server should not receive the data.");
        } finally {
            group.shutdownGracefully();
        }
    }