upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-02-03 20:40:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Dont add the error from validating via issuer signature if the subsequent verification from extraCas succeeds (#28597)

Browse source 
* Dont add the error from validating via issuer signature if the subsequent verification from extraCas succeeds

* changelog
This commit is contained in:
Scott Miller 2024-10-04 13:59:40 -05:00 committed by GitHub
parent aeca0cdee6
commit bae00721d2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 15 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
changelog/28597.txt Normal file
View file

@ -0,0 +1,3 @@
```release-note:bug
auth/cert: When using ocsp_ca_certificates, an error was produced though extra certs validation succeeded.
```

20
sdk/helper/ocsp/client.go
View file

@ -495,15 +495,19 @@ func validateOCSPParsedResponse(ocspRes *ocsp.Response, subject, issuer *x509.Ce
var matchedCA *x509.Certificate
// Assumption 1 failed, try 2
if err := ocspRes.Certificate.CheckSignatureFrom(issuer); err != nil {
// Assumption 2 failed, try 3
overallErr = multierror.Append(overallErr, err)
m, err := verifySignature(ocspRes, extraCas)
if err != nil {
overallErr = multierror.Append(overallErr, err)
if sigFromIssuerErr := ocspRes.Certificate.CheckSignatureFrom(issuer); sigFromIssuerErr != nil {
if len(extraCas) > 0 {
// Assumption 2 failed, try 3
m, err := verifySignature(ocspRes, extraCas)
if err != nil {
overallErr = multierror.Append(overallErr, sigFromIssuerErr)
overallErr = multierror.Append(overallErr, err)
} else {
overallErr = nil
matchedCA = m
}
} else {
matchedCA = m
overallErr = multierror.Append(overallErr, sigFromIssuerErr)
}
} else {
matchedCA = ocspRes.Certificate