Skip to content

Backport of Validate OCSP response is signed by expected issuer into release/1.16.x #26096

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Mar 22, 2024
Merged

Backport of Validate OCSP response is signed by expected issuer into release/1.16.x #26096

merged 1 commit into from
Mar 22, 2024

Conversation

@hc-github-team-secure-vault-core
Copy link
Collaborator

@hc-github-team-secure-vault-core hc-github-team-secure-vault-core commented Mar 22, 2024

Backport

This PR is auto-generated from #26091 to be assessed for backporting due to the inclusion of the label backport/1.16.x.

The below text is copied from the body of the original PR.

  • There was a bug in the OCSP response signature logic, it properly verified but kept around the ocspRes object around so we ignored the errors found and passed the response object back up the stack.
  • Now extract the verification logic into a dedicated function, if it returns an error, blank the ocspRes response as we can't trust it.
  • Address an issue that the OCSP requests from multiple servers were clobbering each others responses as the index loop variable was not properly captured.
  • Add a missing validation that the response was for the serial number we requested
Overview of commits

@hc-github-team-secure-vault-core hc-github-team-secure-vault-core force-pushed the backport/stevendpclark/vault-24879-ocsp-response-validation/seriously-electric-crab branch from 66e8b99 to 4c87ec0 Compare March 22, 2024 13:28
@github-actions github-actions bot added the hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed label Mar 22, 2024
@stevendpclark stevendpclark self-assigned this Mar 22, 2024
@stevendpclark stevendpclark added backport auth/cert Authentication - certificates labels Mar 22, 2024
@stevendpclark stevendpclark added this to the 1.16.0 milestone Mar 22, 2024
@stevendpclark stevendpclark enabled auto-merge (squash) March 22, 2024 13:32
@github-actions
Copy link

github-actions bot commented Mar 22, 2024 •
edited
Loading

CI Results:
All Go tests succeeded! ✅

@github-actions
Copy link

github-actions bot commented Mar 22, 2024 •
edited
Loading

Build Results:
All builds succeeded! ✅

@stevendpclark stevendpclark merged commit a895187 into release/1.16.x Mar 22, 2024
@stevendpclark stevendpclark deleted the backport/stevendpclark/vault-24879-ocsp-response-validation/seriously-electric-crab branch March 22, 2024 14:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@stevendpclark stevendpclark stevendpclark approved these changes

Assignees

@stevendpclark stevendpclark

Labels

auth/cert Authentication - certificates backport hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed

Projects

None yet

Milestone

1.16.0

Development

Successfully merging this pull request may close these issues.

2 participants

@hc-github-team-secure-vault-core @stevendpclark