This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 23b9f2560f91965a57ff6c2cf5fd128e017245ef Author: Mark Thomas <[email protected]> AuthorDate: Wed Aug 12 21:46:44 2026 +0100 Fix OpenSSL-FFM with client certs with multiple OCSP responders --- .../apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 12 ++++++++++-- webapps/docs/changelog.xml | 4 ++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index 1b08739421..596f6d82ae 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -1277,11 +1277,19 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn private static final byte[] OCSP_OID = { 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01 }; private static void parseOCSPURLs(Asn1Parser parser, ArrayList<String> urls) { + // See RFC 5280, section 4.2.2.1 for format + // Outer sequence + int tag = parser.peekTag(); + if (tag == ASN1_SEQUENCE) { + parser.parseTag(ASN1_SEQUENCE); + parser.parseFullLength(); + } + // Iterate over nested sequences while (!parser.eof()) { - int tag = parser.peekTag(); + tag = parser.peekTag(); if (tag == ASN1_SEQUENCE) { parser.parseTag(ASN1_SEQUENCE); - parser.parseFullLength(); + parser.parseLength(); } else if (tag == ASN1_OID) { parser.parseTag(ASN1_OID); int oidLen = parser.parseLength(); diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index da1e59fc60..596821fbbb 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -273,6 +273,10 @@ Remove support for HTTP 0.9. (markt) </update> <!-- Entries for backport and removal before 12.0.0-M1 below this line --> + <fix> + Fix parsing of client certificates that specify more than one OCSP + responder for configurations that use OpenSSL-FFM. (markt) + </fix> </changelog> </subsection> <subsection name="Jasper"> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
