This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new ee42d7e6a2 Align OCSP URL parsing with Tomcat Native
ee42d7e6a2 is described below
commit ee42d7e6a281880d1d6856abb48ad8a93bbc27c5
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Sep 2 19:00:24 2026 +0100
Align OCSP URL parsing with Tomcat Native
---
java/org/apache/tomcat/util/buf/Asn1Parser.java | 13 +++++++
.../util/net/openssl/panama/OpenSSLEngine.java | 44 +++++++++++-----------
webapps/docs/changelog.xml | 4 ++
3 files changed, 38 insertions(+), 23 deletions(-)
diff --git a/java/org/apache/tomcat/util/buf/Asn1Parser.java
b/java/org/apache/tomcat/util/buf/Asn1Parser.java
index defa1141be..62a8153b35 100644
--- a/java/org/apache/tomcat/util/buf/Asn1Parser.java
+++ b/java/org/apache/tomcat/util/buf/Asn1Parser.java
@@ -130,6 +130,19 @@ public class Asn1Parser {
}
+ /**
+ * Is the parser at the expected end of a sequence (based on the stated
length of the sequence).
+ *
+ * @return {@code true} if the parser is at the expected end of the
sequence, otherwise {@code false}
+ */
+ public boolean isAtEndOfSequence() {
+ if (!nestedSequenceEndPositions.isEmpty() &&
nestedSequenceEndPositions.peekLast().intValue() == pos) {
+ return true;
+ }
+ return false;
+ }
+
+
/**
* Parses and validates an expected tag.
*
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index f8d88beec2..1fb899cc27 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -1274,41 +1274,39 @@ public final class OpenSSLEngine extends SSLEngine
implements SSLUtil.ProtocolIn
return ocspResponse;
}
- private static final int ASN1_SEQUENCE = 0x30;
private static final int ASN1_OID = 0x06;
private static final int ASN1_STRING = 0x86;
private static final byte[] OCSP_OID = { 0x2b, 0x06, 0x01, 0x05, 0x05,
0x07, 0x30, 0x01 };
private static void parseOCSPURLs(Asn1Parser parser, ArrayList<String>
urls) {
+ ArrayList<String> result = new ArrayList<>();
// See RFC 5280, section 4.2.2.1 for format
// Outer sequence
- int tag = parser.peekTag();
- if (tag == ASN1_SEQUENCE) {
- parser.parseTag(ASN1_SEQUENCE);
- parser.parseFullLength();
- }
+ parser.parseTagSequence();
+ parser.parseFullLength();
// Iterate over nested sequences
while (!parser.eof()) {
- tag = parser.peekTag();
- if (tag == ASN1_SEQUENCE) {
- parser.parseTag(ASN1_SEQUENCE);
- parser.parseLength();
- } else if (tag == ASN1_OID) {
- parser.parseTag(ASN1_OID);
- int oidLen = parser.parseLength();
- byte[] oid = new byte[oidLen];
- parser.parseBytes(oid);
- if (Arrays.compareUnsigned(oid, 0, oidLen, OCSP_OID, 0,
OCSP_OID.length) == 0) {
- parser.parseTag(ASN1_STRING);
- int urlLen = parser.parseLength();
- byte[] url = new byte[urlLen];
- parser.parseBytes(url);
- urls.add(new String(url));
- }
- } else {
+ parser.parseTagSequence();
+ if (parser.getNestedSequenceLevel() != 2) {
return;
}
+ parser.parseLength();
+ parser.parseTag(ASN1_OID);
+ int oidLen = parser.parseLength();
+ byte[] oid = new byte[oidLen];
+ parser.parseBytes(oid);
+ parser.parseTag(ASN1_STRING);
+ int urlLen = parser.parseLength();
+ byte[] url = new byte[urlLen];
+ parser.parseBytes(url);
+ if (!parser.isAtEndOfSequence()) {
+ return;
+ }
+ if (Arrays.compareUnsigned(oid, 0, oidLen, OCSP_OID, 0,
OCSP_OID.length) == 0) {
+ result.add(new String(url));
+ }
}
+ urls.addAll(result);
}
private static int processOCSPRequest(EngineState state, URL url,
MemorySegment issuer, MemorySegment x509,
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index e7bc27c5e5..e480108076 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -222,6 +222,10 @@
<fix>
Make FFM certificate verification more robust. (markt)
</fix>
+ <fix>
+ Align FFM OCSP URL parsing with Tomcat Native and treat a parsing
+ failure as if no usable OCSP URLs were present. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
