scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-11-01 11:08:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

backport of commit 249c472b5b (#20203)

Browse Source 
Co-authored-by: Alexander Scheel <alex.scheel@hashicorp.com>
This commit is contained in:
hc-github-team-secure-vault-core
2023-04-17 13:06:31 -04:00
committed by GitHub
parent b8997a73ce
commit d7c9d2b3d4
3 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
builtin/logical/pki/path_ocsp.go
View File

@@ -462,13 +462,19 @@ func genResponse(cfg *crlConfig, caBundle *certutil.ParsedCertBundle, info *ocsp
revSigAlg = x509.SHA512WithRSA revSigAlg = x509.SHA512WithRSA
} }
// Due to a bug in Go's ocsp.ParseResponse(...), we do not provision
// Certificate any more on the response to help Go based OCSP clients.
// This was technically unnecessary, as the Certificate given here
// both signed the OCSP response and issued the leaf cert, and so
// should already be trusted by the client.
//
// See also: https://github.com/golang/go/issues/59641
template := ocsp.Response{ template := ocsp.Response{
IssuerHash: reqHash, IssuerHash: reqHash,
Status: info.ocspStatus, Status: info.ocspStatus,
SerialNumber: info.serialNumber, SerialNumber: info.serialNumber,
ThisUpdate: curTime, ThisUpdate: curTime,
NextUpdate: curTime.Add(duration), NextUpdate: curTime.Add(duration),
Certificate: caBundle.Certificate,
ExtraExtensions: []pkix.Extension{}, ExtraExtensions: []pkix.Extension{},
SignatureAlgorithm: revSigAlg, SignatureAlgorithm: revSigAlg,
} }

6
builtin/logical/pki/path_ocsp_test.go
View File

@@ -359,7 +359,6 @@ func TestOcsp_MultipleMatchingIssuersOneWithoutSigningUsage(t *testing.T) {
require.Equal(t, crypto.SHA1, ocspResp.IssuerHash) require.Equal(t, crypto.SHA1, ocspResp.IssuerHash)
require.Equal(t, 0, ocspResp.RevocationReason) require.Equal(t, 0, ocspResp.RevocationReason)
require.Equal(t, testEnv.leafCertIssuer1.SerialNumber, ocspResp.SerialNumber) require.Equal(t, testEnv.leafCertIssuer1.SerialNumber, ocspResp.SerialNumber)
require.Equal(t, rotatedCert, ocspResp.Certificate)
requireOcspSignatureAlgoForKey(t, rotatedCert.SignatureAlgorithm, ocspResp.SignatureAlgorithm) requireOcspSignatureAlgoForKey(t, rotatedCert.SignatureAlgorithm, ocspResp.SignatureAlgorithm)
requireOcspResponseSignedBy(t, ocspResp, rotatedCert) requireOcspResponseSignedBy(t, ocspResp, rotatedCert)
@@ -436,7 +435,6 @@ func TestOcsp_HigherLevel(t *testing.T) {
require.NoError(t, err, "parsing ocsp get response") require.NoError(t, err, "parsing ocsp get response")
require.Equal(t, ocsp.Revoked, ocspResp.Status) require.Equal(t, ocsp.Revoked, ocspResp.Status)
require.Equal(t, issuerCert, ocspResp.Certificate)
require.Equal(t, certToRevoke.SerialNumber, ocspResp.SerialNumber) require.Equal(t, certToRevoke.SerialNumber, ocspResp.SerialNumber)
// Test OCSP Get request for ocsp // Test OCSP Get request for ocsp
@@ -457,7 +455,6 @@ func TestOcsp_HigherLevel(t *testing.T) {
require.NoError(t, err, "parsing ocsp get response") require.NoError(t, err, "parsing ocsp get response")
require.Equal(t, ocsp.Revoked, ocspResp.Status) require.Equal(t, ocsp.Revoked, ocspResp.Status)
require.Equal(t, issuerCert, ocspResp.Certificate)
require.Equal(t, certToRevoke.SerialNumber, ocspResp.SerialNumber) require.Equal(t, certToRevoke.SerialNumber, ocspResp.SerialNumber)
} }
@@ -521,7 +518,6 @@ func runOcspRequestTest(t *testing.T, requestType string, caKeyType string, caKe
require.Equal(t, ocsp.Good, ocspResp.Status) require.Equal(t, ocsp.Good, ocspResp.Status)
require.Equal(t, requestHash, ocspResp.IssuerHash) require.Equal(t, requestHash, ocspResp.IssuerHash)
require.Equal(t, testEnv.issuer1, ocspResp.Certificate)
require.Equal(t, 0, ocspResp.RevocationReason) require.Equal(t, 0, ocspResp.RevocationReason)
require.Equal(t, testEnv.leafCertIssuer1.SerialNumber, ocspResp.SerialNumber) require.Equal(t, testEnv.leafCertIssuer1.SerialNumber, ocspResp.SerialNumber)
@@ -546,7 +542,6 @@ func runOcspRequestTest(t *testing.T, requestType string, caKeyType string, caKe
require.Equal(t, ocsp.Revoked, ocspResp.Status) require.Equal(t, ocsp.Revoked, ocspResp.Status)
require.Equal(t, requestHash, ocspResp.IssuerHash) require.Equal(t, requestHash, ocspResp.IssuerHash)
require.Equal(t, testEnv.issuer1, ocspResp.Certificate)
require.Equal(t, 0, ocspResp.RevocationReason) require.Equal(t, 0, ocspResp.RevocationReason)
require.Equal(t, testEnv.leafCertIssuer1.SerialNumber, ocspResp.SerialNumber) require.Equal(t, testEnv.leafCertIssuer1.SerialNumber, ocspResp.SerialNumber)
@@ -566,7 +561,6 @@ func runOcspRequestTest(t *testing.T, requestType string, caKeyType string, caKe
require.Equal(t, ocsp.Good, ocspResp.Status) require.Equal(t, ocsp.Good, ocspResp.Status)
require.Equal(t, requestHash, ocspResp.IssuerHash) require.Equal(t, requestHash, ocspResp.IssuerHash)
require.Equal(t, testEnv.issuer2, ocspResp.Certificate)
require.Equal(t, 0, ocspResp.RevocationReason) require.Equal(t, 0, ocspResp.RevocationReason)
require.Equal(t, testEnv.leafCertIssuer2.SerialNumber, ocspResp.SerialNumber) require.Equal(t, testEnv.leafCertIssuer2.SerialNumber, ocspResp.SerialNumber)

3
changelog/20201.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:improvement
secrets/pki: Decrease size and improve compatibility of OCSP responses by removing issuer certificate.
```