(tomcat) 07/23: Validate the protocol of OCSP URLs from a client certificate AIA extension

[re...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rmaucher pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git

commit e5cb820aaa2766417efeccf13414806f65c59349
Author: opencode <re...@apache.org>
AuthorDate: Fri Oct 16 10:43:03 2026 +0200

    Validate the protocol of OCSP URLs from a client certificate AIA extension
    
    The FFM OpenSSL implementation accepted any protocol that has a URL
    stream handler registered in the JVM (for example file: or jar:) when
    building OCSP requests from the URLs found in the OCSP No Check AIA
    extension of a client certificate. Setting requestAttempted to true
    before the URLConnection was cast to HttpURLConnection meant that the
    resulting ClassCastException was reported as a non-soft-failable
    X509_V_ERR_APPLICATION_VERIFICATION error, causing the handshake to
    fail even when ocspSoftFail was enabled (the default).
    
    Now the protocol is checked before a request is attempted. A URL with
    a protocol other than http or https is logged as invalid and skipped,
    matching the handling of syntactically invalid URLs at the same place
    and the behaviour of the JNI/tomcat-native implementation, where
    OSSL_HTTP_parse_url() rejects non-HTTP URLs and no request is made.
    
    The other elements of the original report were rejected: the DER
    length claims used by the OCSP URL parser are bounded by
    Asn1Parser.parseLength() against the real remaining data before any
    array is allocated, so no oversized allocation is possible; and
    bounding the number of responder URLs or the aggregate wait time would
    change the behaviour of the opt-in OCSP feature beyond what the JNI
    implementation offers for an exposure limited to certificates signed
    by trusted CAs.
---
 .../org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
index 84e13bc83f..da255ab0b2 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java
@@ -1277,6 +1277,15 @@ public final class OpenSSLEngine extends SSLEngine implements SSLUtil.ProtocolIn
                                     for (String urlString : urls) {
                                         try {
                                             URL url = (new URI(urlString)).toURL();
+                                            String protocol = url.getProtocol();
+                                            if (!"http".equals(protocol) && !"https".equals(protocol)) {
+                                                // OpenSSLEngine can only talk HTTP/HTTPS to OCSP responders. Other
+                                                // protocol handlers (e.g. file) trigger a ClassCastException below so
+                                                // treat them as invalid and skip to the next URL, as the JNI
+                                                // implementation does when OCSP URL parsing fails.
+                                                log.warn(sm.getString("engine.invalidOCSPURL", urlString));
+                                                continue;
+                                            }
                                             requestAttempted = true;
                                             ocspResponse =
                                                     processOCSPRequest(state, url, issuer, x509, x509ctx, localArena);


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org