backport of commit 042dd57 (#21295)

Co-authored-by: Steven Clark <steven.clark@hashicorp.com>

builtin/logical/pki/path_acme_test.go

@@ -1074,9 +1074,7 @@ func TestAcmeWithCsrIncludingBasicConstraintExtension(t *testing.T) {
 	}
 }
 
-func markAuthorizationSuccess(t *testing.T, client *api.Client, acmeClient *acme.Client, acct *acme.Account,
-	order *acme.Order,
-) {
+func markAuthorizationSuccess(t *testing.T, client *api.Client, acmeClient *acme.Client, acct *acme.Account, order *acme.Order) {
 	testCtx := context.Background()
 
 	pkiMount := findStorageMountUuid(t, client, "pki")
@@ -1090,8 +1088,15 @@ func markAuthorizationSuccess(t *testing.T, client *api.Client, acmeClient *acme
 		for _, authURI := range order.AuthzURLs {
 			authId := authURI[strings.LastIndex(authURI, "/"):]
 
-			rawPath := path.Join("/sys/raw/logical/", pkiMount, getAuthorizationPath(accountId, authId))
-			resp, err := client.Logical().ReadWithContext(testCtx, rawPath)
+			// sys/raw does not work with namespaces
+			baseClient := client.WithNamespace("")
+
+			values, err := baseClient.Logical().ListWithContext(testCtx, "sys/raw/logical/")
+			require.NoError(t, err)
+			require.True(t, true, "values: %v", values)
+
+			rawPath := path.Join("sys/raw/logical/", pkiMount, getAuthorizationPath(accountId, authId))
+			resp, err := baseClient.Logical().ReadWithContext(testCtx, rawPath)
 			require.NoError(t, err, "failed looking up authorization storage")
 			require.NotNil(t, resp, "sys raw response was nil")
 			require.NotEmpty(t, resp.Data["value"], "no value field in sys raw response")
@@ -1106,7 +1111,7 @@ func markAuthorizationSuccess(t *testing.T, client *api.Client, acmeClient *acme
 
 			encodeJSON, err := jsonutil.EncodeJSON(authz)
 			require.NoError(t, err, "failed encoding authz json")
-			_, err = client.Logical().WriteWithContext(testCtx, rawPath, map[string]interface{}{
+			_, err = baseClient.Logical().WriteWithContext(testCtx, rawPath, map[string]interface{}{
 				"value":    base64.StdEncoding.EncodeToString(encodeJSON),
 				"encoding": "base64",
 			})
@@ -1144,16 +1149,18 @@ func markAuthorizationSuccess(t *testing.T, client *api.Client, acmeClient *acme
 func deleteCvEntries(t *testing.T, client *api.Client, pkiMount string) bool {
 	testCtx := context.Background()
 
-	cvPath := path.Join("/sys/raw/logical/", pkiMount, acmeValidationPrefix)
-	resp, err := client.Logical().ListWithContext(testCtx, cvPath)
+	baseClient := client.WithNamespace("")
+
+	cvPath := path.Join("sys/raw/logical/", pkiMount, acmeValidationPrefix)
+	resp, err := baseClient.Logical().ListWithContext(testCtx, cvPath)
 	require.NoError(t, err, "failed listing cv path items")
 
 	deletedEntries := false
 	if resp != nil {
 		cvEntries := resp.Data["keys"].([]interface{})
 		for _, cvEntry := range cvEntries {
 			cvEntryPath := path.Join(cvPath, cvEntry.(string))
-			_, err = client.Logical().DeleteWithContext(testCtx, cvEntryPath)
+			_, err = baseClient.Logical().DeleteWithContext(testCtx, cvEntryPath)
 			require.NoError(t, err, "failed to delete cv entry")
 			deletedEntries = true
 		}
@@ -1205,7 +1212,7 @@ func setupAcmeBackendOnClusterAtPath(t *testing.T, cluster *vault.TestCluster, c
 		require.NoError(t, err, "failed to mount new PKI instance at "+mount)
 	}
 
-	err := client.Sys().TuneMountWithContext(ctx, mountName, api.MountConfigInput{
+	err := client.Sys().TuneMountWithContext(ctx, mount, api.MountConfigInput{
 		DefaultLeaseTTL: "3000h",
 		MaxLeaseTTL:     "600000h",
 	})
@@ -1585,6 +1592,9 @@ func getAcmeClientForCluster(t *testing.T, cluster *vault.TestCluster, baseUrl s
 	if !strings.HasPrefix(baseUrl, "v1/") {
 		baseUrl = "v1/" + baseUrl
 	}
+	if !strings.HasSuffix(baseUrl, "/") {
+		baseUrl = baseUrl + "/"
+	}
 	baseAcmeURL := fmt.Sprintf("https://%s/%s", coreAddr.String(), baseUrl)
 	return &acme.Client{
 		Key:          key,

builtin/logical/pki/path_ocsp_test.go

@@ -710,19 +710,3 @@ func sendOcspPostRequest(b *backend, s logical.Storage, ocspRequest []byte) (*lo
 
 	return resp, err
 }
-
-func generateRequest(t *testing.T, requestHash crypto.Hash, cert *x509.Certificate, issuer *x509.Certificate) []byte {
-	t.Helper()
-
-	opts := &ocsp.RequestOptions{Hash: requestHash}
-	ocspRequestDer, err := ocsp.CreateRequest(cert, issuer, opts)
-	require.NoError(t, err, "Failed generating OCSP request")
-	return ocspRequestDer
-}
-
-func requireOcspResponseSignedBy(t *testing.T, ocspResp *ocsp.Response, issuer *x509.Certificate) {
-	t.Helper()
-
-	err := ocspResp.CheckSignatureFrom(issuer)
-	require.NoError(t, err, "Failed signature verification of ocsp response: %w", err)
-}

builtin/logical/pki/test_helpers.go

@@ -16,6 +16,7 @@ import (
 	"io"
 	"math"
 	"math/big"
+	http2 "net/http"
 	"strings"
 	"testing"
 	"time"
@@ -24,6 +25,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ocsp"
 )
 
 // Setup helpers
@@ -393,3 +395,44 @@ func summarizeCrl(t *testing.T, crl pkix.TBSCertificateList) string {
 		"Revoked Serial Count: %d\n"+
 		"Revoked Serials: %v", version, crl.ThisUpdate, crl.NextUpdate, len(serials), serials)
 }
+
+// OCSP helpers
+func generateRequest(t *testing.T, requestHash crypto.Hash, cert *x509.Certificate, issuer *x509.Certificate) []byte {
+	t.Helper()
+
+	opts := &ocsp.RequestOptions{Hash: requestHash}
+	ocspRequestDer, err := ocsp.CreateRequest(cert, issuer, opts)
+	require.NoError(t, err, "Failed generating OCSP request")
+	return ocspRequestDer
+}
+
+func requireOcspResponseSignedBy(t *testing.T, ocspResp *ocsp.Response, issuer *x509.Certificate) {
+	t.Helper()
+
+	err := ocspResp.CheckSignatureFrom(issuer)
+	require.NoError(t, err, "Failed signature verification of ocsp response: %w", err)
+}
+
+func performOcspPost(t *testing.T, cert *x509.Certificate, issuerCert *x509.Certificate, client *api.Client, ocspPath string) *ocsp.Response {
+	t.Helper()
+
+	baseClient := client.WithNamespace("")
+
+	ocspReq := generateRequest(t, crypto.SHA256, cert, issuerCert)
+	ocspPostReq := baseClient.NewRequest(http2.MethodPost, ocspPath)
+	ocspPostReq.Headers.Set("Content-Type", "application/ocsp-request")
+	ocspPostReq.BodyBytes = ocspReq
+	rawResp, err := baseClient.RawRequest(ocspPostReq)
+	require.NoError(t, err, "failed sending unified-ocsp post request")
+
+	require.Equal(t, 200, rawResp.StatusCode)
+	require.Equal(t, ocspResponseContentType, rawResp.Header.Get("Content-Type"))
+	bodyReader := rawResp.Body
+	respDer, err := io.ReadAll(bodyReader)
+	bodyReader.Close()
+	require.NoError(t, err, "failed reading response body")
+
+	ocspResp, err := ocsp.ParseResponse(respDer, issuerCert)
+	require.NoError(t, err, "parsing ocsp get response")
+	return ocspResp
+}