scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-30 18:17:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Return the proper serial number in OCSP verification errors (#27696)

Browse Source 
* Return the proper serial number in OCSP verification errors

 - We returned the issuer's certificate number instead of the serial
   number of the actual certificate we validated from an OCSP request.

 - The problematic serial number within the error are never shown
   currently in Vault. The only user of this library is cert-auth
   which swallows errors around revoked certificates and returns
   a boolean false instead of the actual error message.

* Add cl

* Use previously formatted serial in error msg
This commit is contained in:
Steven Clark
2024-07-09 09:03:34 -04:00
committed by GitHub
parent a2e78ebbab
commit 054f5b182a
3 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
builtin/logical/pki/integration_test.go
View File

@@ -718,6 +718,7 @@ func TestIntegrationOCSPClientWithPKI(t *testing.T) {
err = ocspClient.VerifyLeafCertificate(context.Background(), cert, issuer, conf) err = ocspClient.VerifyLeafCertificate(context.Background(), cert, issuer, conf)
require.Error(t, err) require.Error(t, err)
require.Contains(t, err.Error(), serialNumber, "Expected revoked serial number to appear in err")
} }
} }

3
changelog/27696.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:bug
auth/cert: Use subject's serial number, not issuer's within error message text in OCSP request errors
```

4
sdk/helper/ocsp/client.go
View File

@@ -702,12 +702,12 @@ func (c *Client) VerifyLeafCertificate(ctx context.Context, subject, issuer *x50
if results.code == ocspStatusGood { if results.code == ocspStatusGood {
return nil return nil
} else { } else {
serial := issuer.SerialNumber serial := subject.SerialNumber
serialHex := strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":")) serialHex := strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":"))
if results.code == ocspStatusRevoked { if results.code == ocspStatusRevoked {
return fmt.Errorf("certificate with serial number %s has been revoked", serialHex) return fmt.Errorf("certificate with serial number %s has been revoked", serialHex)
} else if conf.OcspFailureMode == FailOpenFalse { } else if conf.OcspFailureMode == FailOpenFalse {
return fmt.Errorf("unknown OCSP status for cert with serial number %s", strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":"))) return fmt.Errorf("unknown OCSP status for cert with serial number %s", serialHex)
} else { } else {
c.Logger().Warn("could not validate OCSP status for cert, but continuing in fail open mode", "serial", serialHex) c.Logger().Warn("could not validate OCSP status for cert, but continuing in fail open mode", "serial", serialHex)
} }