feat(inputs.x509_cert): Add OCSP stapling information for leaf certificates (#10550)

[jjh74]

Required for all PRs

• Updated associated README.md.
• Wrote appropriate unit tests.
• Pull request title or commits are in conventional commit format

resolves #10550

This PR adds OCSP stapling information from tls connectionstate(https://pkg.go.dev/crypto/tls#ConnectionState) (https://pkg.go.dev/golang.org/x/crypto/ocsp#ParseResponse). OCSPResponse signature is not checked against issuer certificate.

New fields: ocsp_status(Good=0,Revoked=1,Unknown=2), ocsp_produced_at, ocsp_this_update, ocsp_next_update and ocsp_revoked_at (when ocsp_status=2).
New tags: ocsp_stapled yes/no

[srebhan]

@jjh74 can you please run make tidy to make CI happy!?

[srebhan]

@jjh74 thanks for looking into this! I have one concern regarding the assumed order of certificates in the answer returned by the server. Currently, we assume (and also you do it) that we always receive the leaf certificate as the first entry. However, I do not see any guarantee for that order, neither by RFC2459 nor by RFC5280 nor by the Golang code.
So IMO we need to order the certs, i.e. construct the trust-path(s)/tree and then determine the leaf nodes instead of blindly use index zero...

What do you think?

[srebhan]

Nice update @jjh74! Only two small comments left. Please also resolve the merge conflict...

[srebhan]

@jjh74 any news on this PR?

[jjh74]

@jjh74 any news on this PR?

I tried to do the go.mod require merge + moved import "golang.org/x/crypto/ocsp". I hope I got it right.
(circleci complains about make check-deps (LICENSE_OF_DEPENDENCIES.md), is this something I should try to fix ?)

I realized that ocsp.ParseResponse(*ocspresp, nil) doesn't verify the ocsp stapling response signature against issuer certificate (https://pkg.go.dev/golang.org/x/crypto/ocsp#ParseResponse). I can try to see if it's possible to figure out issuer cert and verify ocsp stapling response or if this PR looks good now I can work on ocsp response verify on different PR ?

[srebhan]

Yeah I noticed that. It seems like you are adding those new libs as dependencies. Maybe try to rebase on latest master to fix the merge conflicts and see if the issue is gone. If not, you need to add the two entries to the docs/LICENSE_OF_DEPENDENCIES.md file...

[jjh74]

Yeah I noticed that. It seems like you are adding those new libs as dependencies. Maybe try to rebase on latest master to fix the merge conflicts and see if the issue is gone. If not, you need to add the two entries to the docs/LICENSE_OF_DEPENDENCIES.md file...

I rebased to master and that seemed to work.

After rebase I added two more commits:

1. If server sends certificate chain, try to figure out issuer certificate and verify ocsp stapling response with issuer cert. If verification fails retry ocsp.ParseResponse w/out issuer cert.
2. Updated README.md with ocsp tags/fields (run-readme-linter seems to fail (but AFAIK on different plugin/README))

[powersj]

@jjh74 I pushed a few commits to your PR. Namely, I rebased on master and fixed the conflicts and one linter issue. This should hopefully get us nearly there. I can do a review in a bit.

[telegraf-tiger]

Download PR build artifacts for linux_amd64.tar.gz, darwin_amd64.tar.gz, and windows_amd64.zip.
Downloads for additional architectures and packages are available below.

☺️ This pull request doesn't significantly change the Telegraf binary size (less than 1%)

📦 Click here to get additional PR build artifacts

Artifact URLs

DEB	RPM	TAR GZ	ZIP
amd64.deb	aarch64.rpm	darwin_amd64.tar.gz	windows_amd64.zip
arm64.deb	armel.rpm	darwin_arm64.tar.gz	windows_arm64.zip
armel.deb	armv6hl.rpm	freebsd_amd64.tar.gz	windows_i386.zip
armhf.deb	i386.rpm	freebsd_armv7.tar.gz
i386.deb	ppc64le.rpm	freebsd_i386.tar.gz
mips.deb	riscv64.rpm	linux_amd64.tar.gz
mipsel.deb	s390x.rpm	linux_arm64.tar.gz
ppc64el.deb	x86_64.rpm	linux_armel.tar.gz
riscv64.deb		linux_armhf.tar.gz
s390x.deb		linux_i386.tar.gz
		linux_mips.tar.gz
		linux_mipsel.tar.gz
		linux_ppc64le.tar.gz
		linux_riscv64.tar.gz
		linux_s390x.tar.gz

[srebhan]

Looks good to me. Thanks @jjh74 for the contribution and thanks @powersj for driving this over the finish line.

[xoxys]

Thanks everyone for the implementation!