Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix leaf client connection failing in OCSP setups #3964

Merged
merged 2 commits into from Mar 15, 2023
Merged

Fix leaf client connection failing in OCSP setups #3964

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f891478
Fix leaf client connection failing in ocsp setup
wallyqs Mar 14, 2023
da7a8b6
Reword ocsp routes/gateways terminology to 'peers' instead
wallyqs Mar 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
27 changes: 13 additions & 14 deletions server/ocsp.go
View file
Open in desktop
Expand Up @@ -433,18 +433,18 @@ func (srv *Server) NewOCSPMonitor(config *tlsConfigKind) (*tls.Config, *OCSPMoni
}, nil
}

// Check whether need to verify staples from a client connection depending on the type.
// Check whether need to verify staples from a peer router or gateway connection.
switch kind {
case kindStringMap[ROUTER], kindStringMap[GATEWAY], kindStringMap[LEAF]:
case kindStringMap[ROUTER], kindStringMap[GATEWAY]:
tc.VerifyConnection = func(s tls.ConnectionState) error {
oresp := s.OCSPResponse
if oresp == nil {
return fmt.Errorf("%s client missing OCSP Staple", kind)
return fmt.Errorf("%s peer missing OCSP Staple", kind)
}

// Client route connections will verify the response of the staple.
// Peer connections will verify the response of the staple.
if len(s.VerifiedChains) == 0 {
return fmt.Errorf("%s client missing TLS verified chains", kind)
return fmt.Errorf("%s peer missing TLS verified chains", kind)
}

chain := s.VerifiedChains[0]
Expand All @@ -453,7 +453,7 @@ func (srv *Server) NewOCSPMonitor(config *tlsConfigKind) (*tls.Config, *OCSPMoni

resp, err := ocsp.ParseResponseForCert(oresp, leaf, parent)
if err != nil {
return fmt.Errorf("failed to parse OCSP response from %s client: %w", kind, err)
return fmt.Errorf("failed to parse OCSP response from %s peer: %w", kind, err)
}
if resp.Certificate == nil {
if err := resp.CheckSignatureFrom(parent); err != nil {
Expand All @@ -475,13 +475,13 @@ func (srv *Server) NewOCSPMonitor(config *tlsConfigKind) (*tls.Config, *OCSPMoni
}
}
if resp.Status != ocsp.Good {
return fmt.Errorf("bad status for OCSP Staple from %s client: %s", kind, ocspStatusString(resp.Status))
return fmt.Errorf("bad status for OCSP Staple from %s peer: %s", kind, ocspStatusString(resp.Status))
}

return nil
}

// When server makes a client connection, need to also present an OCSP Staple.
// When server makes a peer connection, need to also present an OCSP Staple.
tc.GetClientCertificate = func(info *tls.CertificateRequestInfo) (*tls.Certificate, error) {
raw, _, err := mon.getStatus()
if err != nil {
Expand Down Expand Up @@ -558,12 +558,12 @@ func (s *Server) configureOCSP() []*tlsConfigKind {
tlsConfig: config,
tlsOpts: opts,
apply: func(tc *tls.Config) {

// RequireAndVerifyClientCert is used to tell a client that it
// should send the client cert to the server.
tc.ClientAuth = tls.RequireAndVerifyClientCert
// GetClientCertificate is used by a client to send the client cert
// to a server. We're a server, so we must not set this.
if opts.Verify {
tbeets marked this conversation as resolved.
Show resolved Hide resolved
tc.ClientAuth = tls.RequireAndVerifyClientCert
}
// We're a leaf hub server, so we must not set this.
tc.GetClientCertificate = nil
tbeets marked this conversation as resolved.
Show resolved Hide resolved
sopts.LeafNode.TLSConfig = tc
},
Expand All @@ -580,8 +580,7 @@ func (s *Server) configureOCSP() []*tlsConfigKind {
tlsConfig: config,
tlsOpts: opts,
apply: func(tc *tls.Config) {
// GetCertificate is used by a server to send the server cert to a
// client. We're a client, so we must not set this.
// We're a leaf client, so we must not set this.
tc.GetCertificate = nil
r.TLSConfig = tc
},
Expand Down