upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-02-03 20:40:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

Return the proper serial number in OCSP verification errors (#27696)

Browse source 
* Return the proper serial number in OCSP verification errors

 - We returned the issuer's certificate number instead of the serial
   number of the actual certificate we validated from an OCSP request.

 - The problematic serial number within the error are never shown
   currently in Vault. The only user of this library is cert-auth
   which swallows errors around revoked certificates and returns
   a boolean false instead of the actual error message.

* Add cl

* Use previously formatted serial in error msg
This commit is contained in:
Steven Clark 2024-07-09 09:03:34 -04:00 committed by GitHub
parent a2e78ebbab
commit 054f5b182a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
builtin/logical/pki/integration_test.go
View file

@ -718,6 +718,7 @@ func TestIntegrationOCSPClientWithPKI(t *testing.T) {
err = ocspClient.VerifyLeafCertificate(context.Background(), cert, issuer, conf) err = ocspClient.VerifyLeafCertificate(context.Background(), cert, issuer, conf)
require.Error(t, err) require.Error(t, err)
require.Contains(t, err.Error(), serialNumber, "Expected revoked serial number to appear in err")
} }
} }

3
changelog/27696.txt Normal file
View file

@ -0,0 +1,3 @@
```release-note:bug
auth/cert: Use subject's serial number, not issuer's within error message text in OCSP request errors
```

4
sdk/helper/ocsp/client.go
View file

@ -702,12 +702,12 @@ func (c *Client) VerifyLeafCertificate(ctx context.Context, subject, issuer *x50
if results.code == ocspStatusGood { if results.code == ocspStatusGood {
return nil return nil
} else { } else {
serial := issuer.SerialNumber serial := subject.SerialNumber
serialHex := strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":")) serialHex := strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":"))
if results.code == ocspStatusRevoked { if results.code == ocspStatusRevoked {
return fmt.Errorf("certificate with serial number %s has been revoked", serialHex) return fmt.Errorf("certificate with serial number %s has been revoked", serialHex)
} else if conf.OcspFailureMode == FailOpenFalse { } else if conf.OcspFailureMode == FailOpenFalse {
return fmt.Errorf("unknown OCSP status for cert with serial number %s", strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":"))) return fmt.Errorf("unknown OCSP status for cert with serial number %s", serialHex)
} else { } else {
c.Logger().Warn("could not validate OCSP status for cert, but continuing in fail open mode", "serial", serialHex) c.Logger().Warn("could not validate OCSP status for cert, but continuing in fail open mode", "serial", serialHex)
} }