This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 4dec7b0e5956d737ced13911c734a675ab249698 Author: Mark Thomas <[email protected]> AuthorDate: Wed Sep 2 19:00:24 2026 +0100 Align OCSP URL parsing with Tomcat Native --- java/org/apache/tomcat/util/buf/Asn1Parser.java | 13 +++++++ .../util/net/openssl/panama/OpenSSLEngine.java | 44 +++++++++++----------- webapps/docs/changelog.xml | 4 ++ 3 files changed, 38 insertions(+), 23 deletions(-) diff --git a/java/org/apache/tomcat/util/buf/Asn1Parser.java b/java/org/apache/tomcat/util/buf/Asn1Parser.java index defa1141be..62a8153b35 100644 --- a/java/org/apache/tomcat/util/buf/Asn1Parser.java +++ b/java/org/apache/tomcat/util/buf/Asn1Parser.java @@ -130,6 +130,19 @@ public class Asn1Parser { } + /** + * Is the parser at the expected end of a sequence (based on the stated length of the sequence). + * + * @return {@code true} if the parser is at the expected end of the sequence, otherwise {@code false} + */ + public boolean isAtEndOfSequence() { + if (!nestedSequenceEndPositions.isEmpty() && nestedSequenceEndPositions.peekLast().intValue() == pos) { + return true; + } + return false; + } + + /** * Parses and validates an expected tag. * diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java index cf9d38f19b..5d34674168 100644 --- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java +++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java @@ -1274,41 +1274,39 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn return ocspResponse; } - private static final int ASN1_SEQUENCE = 0x30; private static final int ASN1_OID = 0x06; private static final int ASN1_STRING = 0x86; private static final byte[] OCSP_OID = { 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01 }; private static void parseOCSPURLs(Asn1Parser parser, ArrayList<String> urls) { + ArrayList<String> result = new ArrayList<>(); // See RFC 5280, section 4.2.2.1 for format // Outer sequence - int tag = parser.peekTag(); - if (tag == ASN1_SEQUENCE) { - parser.parseTag(ASN1_SEQUENCE); - parser.parseFullLength(); - } + parser.parseTagSequence(); + parser.parseFullLength(); // Iterate over nested sequences while (!parser.eof()) { - tag = parser.peekTag(); - if (tag == ASN1_SEQUENCE) { - parser.parseTag(ASN1_SEQUENCE); - parser.parseLength(); - } else if (tag == ASN1_OID) { - parser.parseTag(ASN1_OID); - int oidLen = parser.parseLength(); - byte[] oid = new byte[oidLen]; - parser.parseBytes(oid); - if (Arrays.compareUnsigned(oid, 0, oidLen, OCSP_OID, 0, OCSP_OID.length) == 0) { - parser.parseTag(ASN1_STRING); - int urlLen = parser.parseLength(); - byte[] url = new byte[urlLen]; - parser.parseBytes(url); - urls.add(new String(url)); - } - } else { + parser.parseTagSequence(); + if (parser.getNestedSequenceLevel() != 2) { return; } + parser.parseLength(); + parser.parseTag(ASN1_OID); + int oidLen = parser.parseLength(); + byte[] oid = new byte[oidLen]; + parser.parseBytes(oid); + parser.parseTag(ASN1_STRING); + int urlLen = parser.parseLength(); + byte[] url = new byte[urlLen]; + parser.parseBytes(url); + if (!parser.isAtEndOfSequence()) { + return; + } + if (Arrays.compareUnsigned(oid, 0, oidLen, OCSP_OID, 0, OCSP_OID.length) == 0) { + result.add(new String(url)); + } } + urls.addAll(result); } private static int processOCSPRequest(EngineState state, URL url, MemorySegment issuer, MemorySegment x509, diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index c511f32320..b44b87cd88 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -369,6 +369,10 @@ <fix> Make FFM certificate verification more robust. (markt) </fix> + <fix> + Align FFM OCSP URL parsing with Tomcat Native and treat a parsing + failure as if no usable OCSP URLs were present. (markt) + </fix> </changelog> </subsection> <subsection name="Jasper"> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
