Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add per-issuer AIA URI information to PKI secrets engine #16563

Merged
merged 11 commits into from
Aug 19, 2022
Prev Previous commit
Next Next commit
Rename getURLs -> getGlobalAIAURLs
Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
  • Loading branch information
cipherboy committed Aug 18, 2022
commit dbaa745d8109ca37d91739cc6cc14efc37ed6018
4 changes: 2 additions & 2 deletions builtin/logical/pki/cert_util.go
Original file line number Diff line number Diff line change
Expand Up @@ -676,7 +676,7 @@ func generateCert(sc *storageContext,
if data.SigningBundle == nil {
// Generating a self-signed root certificate. Since we have no
// issuer entry yet, we default to the global URLs.
entries, err := getURLs(ctx, sc.Storage)
entries, err := getGlobalAIAURLs(ctx, sc.Storage)
if err != nil {
return nil, errutil.InternalError{Err: fmt.Sprintf("unable to fetch URL information: %v", err)}
}
Expand Down Expand Up @@ -1396,7 +1396,7 @@ func generateCreationBundle(b *backend, data *inputBundle, caSign *certutil.CAIn
return creation, nil
}

// This will have been read in from the getURLs function
// This will have been read in from the getGlobalAIAURLs function
creation.Params.URLs = caSign.URLs

// If the max path length in the role is not nil, it was specified at
Expand Down
6 changes: 3 additions & 3 deletions builtin/logical/pki/path_config_urls.go
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ func validateURLs(urls []string) string {
return ""
}

func getURLs(ctx context.Context, storage logical.Storage) (*certutil.URLEntries, error) {
func getGlobalAIAURLs(ctx context.Context, storage logical.Storage) (*certutil.URLEntries, error) {
entry, err := storage.Get(ctx, "urls")
if err != nil {
return nil, err
Expand Down Expand Up @@ -98,7 +98,7 @@ func writeURLs(ctx context.Context, storage logical.Storage, entries *certutil.U
}

func (b *backend) pathReadURL(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
entries, err := getURLs(ctx, req.Storage)
entries, err := getGlobalAIAURLs(ctx, req.Storage)
if err != nil {
return nil, err
}
Expand All @@ -115,7 +115,7 @@ func (b *backend) pathReadURL(ctx context.Context, req *logical.Request, _ *fram
}

func (b *backend) pathWriteURL(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
entries, err := getURLs(ctx, req.Storage)
entries, err := getGlobalAIAURLs(ctx, req.Storage)
if err != nil {
return nil, err
}
Expand Down
2 changes: 1 addition & 1 deletion builtin/logical/pki/path_intermediate.go
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ func (b *backend) pathGenerateIntermediate(ctx context.Context, req *logical.Req
Data: map[string]interface{}{},
}

entries, err := getURLs(ctx, req.Storage)
entries, err := getGlobalAIAURLs(ctx, req.Storage)
if err == nil && len(entries.OCSPServers) == 0 && len(entries.IssuingCertificates) == 0 && len(entries.CRLDistributionPoints) == 0 {
// If the operator hasn't configured any of the URLs prior to
// generating this issuer, we should add a warning to the response,
Expand Down
2 changes: 1 addition & 1 deletion builtin/logical/pki/path_manage_issuers.go
Original file line number Diff line number Diff line change
Expand Up @@ -300,7 +300,7 @@ func (b *backend) pathImportIssuers(ctx context.Context, req *logical.Request, d
// Also while we're here, we should let the user know the next steps.
// In particular, if there's no default AIA URLs configuration, we should
// tell the user that's probably next.
if entries, err := getURLs(ctx, req.Storage); err == nil && len(entries.IssuingCertificates) == 0 && len(entries.CRLDistributionPoints) == 0 && len(entries.OCSPServers) == 0 {
if entries, err := getGlobalAIAURLs(ctx, req.Storage); err == nil && len(entries.IssuingCertificates) == 0 && len(entries.CRLDistributionPoints) == 0 && len(entries.OCSPServers) == 0 {
response.AddWarning("This mount hasn't configured any authority access information (AIA) fields; this may make it harder for systems to find missing certificates in the chain or to validate revocation status of certificates. Consider updating /config/urls or the newly generated issuer with this information.")
}

Expand Down
2 changes: 1 addition & 1 deletion builtin/logical/pki/storage.go
Original file line number Diff line number Diff line change
Expand Up @@ -485,7 +485,7 @@ func (i issuerEntry) GetAIAURLs(sc *storageContext) (urls *certutil.URLEntries,
// If none are set (either due to a nil entry or because no URLs have
// been provided), fall back to the global AIA URL config.
if urls == nil || (len(urls.IssuingCertificates) == 0 && len(urls.CRLDistributionPoints) == 0 && len(urls.OCSPServers) == 0) {
urls, err = getURLs(sc.Context, sc.Storage)
urls, err = getGlobalAIAURLs(sc.Context, sc.Storage)
}

return urls, err
Expand Down