<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style='--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;'>
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";'>
<div class="content">
<p class="details" style="font-style: italic; color: #737278;">
<a href="https://gitlab.com/sei-jmattson">Jeff Mattson</a> created a merge request: <a href="https://gitlab.com/gnutls/gnutls/-/merge_requests/1877">!1877</a>
</p>
<div class="branch">
Project:Branches: sei-jmattson/gnutls:fix-ocsp-checking-when-multiple-records to gnutls/gnutls:master
</div>
<div class="author">
Author: Jeff Mattson
</div>
<div class="assignee">
Assignees:
</div>
<div class="reviewer">
Reviewers:
</div>
<div class="approvers">
</div>
<div class="md gl-mt-5" style="position: relative; z-index: 1; color: #28272d; word-wrap: break-word; margin-top: 1rem;">
<ul dir="auto" style="text-align: initial; list-style-type: disc; margin: 0 0 16px; padding: 0;">
<li style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px;">check all ocsp response records for cert serial number</li>
</ul>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">Signed-off-by: Jeff Mattson <a href="mailto:jmattson@sei.cmu.edu" style="margin-top: 0;">jmattson@sei.cmu.edu</a></p>
<h2 dir="auto" style="font-size: 1.5em; font-weight: 600; padding-bottom: .3em; border-bottom-width: 1px; border-bottom-color: #bfbfc3; border-bottom-style: solid; color: #28272d; margin: 24px 0 16px;" align="initial">
<a href="#checklist" aria-hidden="true" class="anchor" id="user-content-checklist" style="margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Checklist</h2>
<ul class="task-list" dir="auto" style="text-align: initial; list-style-type: disc; margin: 0 0 16px; padding: 0;">
<li class="task-list-item" style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" checked disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> Commits have <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-family: "GitLab Mono","JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; vertical-align: bottom; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 2px 4px;'>Signed-off-by:</code> with name/author being identical to the commit author</li>
<li class="task-list-item" style="line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" checked disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> Code modified for feature</li>
<li class="task-list-item" style="line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> Test suite updated with functionality tests</li>
<li class="task-list-item" style="line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> Test suite updated with negative tests</li>
<li class="task-list-item" style="line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" checked disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> Documentation updated / NEWS entry present (for non-trivial changes)</li>
<li class="task-list-item" style="line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> CI timeout is 2h or higher (see Settings/CICD/General pipelines/Timeout)</li>
</ul>
<h2 dir="auto" style="font-size: 1.5em; font-weight: 600; padding-bottom: .3em; border-bottom-width: 1px; border-bottom-color: #bfbfc3; border-bottom-style: solid; color: #28272d; margin: 24px 0 16px;" align="initial">
<a href="#reviewers-checklist" aria-hidden="true" class="anchor" id="user-content-reviewers-checklist" style="margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Reviewer's checklist:</h2>
<ul class="task-list" dir="auto" style="text-align: initial; list-style-type: disc; margin: 0 0 16px; padding: 0;">
<li class="task-list-item" style="margin-top: 0; line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> Any issues marked for closing are addressed</li>
<li class="task-list-item" style="line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> There is a test suite reasonably covering new functionality or modifications</li>
<li class="task-list-item" style="line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> Function naming, parameters, return values, types, etc., are consistent and according to <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-family: "GitLab Mono","JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; vertical-align: bottom; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 2px 4px;'>CONTRIBUTION.md</code>
</li>
<li class="task-list-item" style="line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> This feature/change has adequate documentation added</li>
<li class="task-list-item" style="line-height: 1.6em; margin-left: 25px; padding-left: 3px; list-style-type: none; position: relative; min-height: 22px; padding-inline-start: 28px; margin-inline-start: 0 !important;">
<task-button style="margin-top: 0;"></task-button><input type="checkbox" class="task-list-item-checkbox" disabled style="position: absolute; inset-inline-start: 8px; inset-block-start: 5px;"> No obvious mistakes in the code</li>
</ul>
<h2 dir="auto" style="font-size: 1.5em; font-weight: 600; padding-bottom: .3em; border-bottom-width: 1px; border-bottom-color: #bfbfc3; border-bottom-style: solid; color: #28272d; margin: 24px 0 16px;" align="initial">
<a href="#discussion" aria-hidden="true" class="anchor" id="user-content-discussion" style="margin-top: 0; float: left; margin-left: -20px; text-decoration: none; outline: none;"></a>Discussion</h2>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">OCSP verification fails when the certificate in question does not match the first response record of a stapled OCSP response.</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">Some servers return a stapled ocsp response with multiple certificate status records, and this codebase only compares the certificate with the first response record.</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">Since Ubuntu builds <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0; font-weight: inherit; font-family: "GitLab Mono","JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; vertical-align: bottom; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 2px 4px;'>git</code> with <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; font-family: "GitLab Mono","JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; vertical-align: bottom; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 2px 4px;'>gnuTLS</code>, this leaves a large population needing to rebuild git with OpenSSL or turning off ssl verification in order to work with some (well established) server's that staple multiple cert status in an OSCP response.</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">This MR changes the ocsp checking behavior by ignoring the <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0; font-weight: inherit; font-family: "GitLab Mono","JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; vertical-align: bottom; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 2px 4px;'>indx</code> parameter (which in this codebase is always set to 0) and instead iterating through the responses for a record with a matching certificate serial number.</p>
<p dir="auto" style="color: #28272d; margin: 0 0 16px;" align="initial">The <code style='font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0; font-weight: inherit; font-family: "GitLab Mono","JetBrains Mono","Menlo","DejaVu Sans Mono","Liberation Mono","Consolas","Ubuntu Mono","Courier New","andale mono","lucida console",monospace; vertical-align: bottom; white-space: pre-wrap; overflow-wrap: break-word; word-break: keep-all; padding: 2px 4px;'>indx</code> parameter remains in order to preserve the api, but ignoring it is not a breaking change since the new behavior matches the previous behavior (where it was working). For external clients of this api that do actually pass in an index, it might cost negligible performance iterating to find the same index that was passed in.</p>
<p dir="auto" style="color: #28272d; margin: 0;" align="initial">This issue was also reported in <a href="https://gitlab.com/gnutls/gnutls/-/issues/1372" data-reference-type="issue" data-original="#1372" data-link="false" data-link-reference="false" data-issue="108832813" data-project="179611" data-iid="1372" data-namespace-path="gnutls/gnutls" data-project-path="gnutls/gnutls" data-issue-type="issue" data-container="body" data-placement="top" title="Check all OCSP responses" class="gfm gfm-issue" style="margin-top: 0;">#1372</a>.</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #737278;">
—
<br>
Reply to this email directly or <a href="https://gitlab.com/gnutls/gnutls/-/merge_requests/1877">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.com">gitlab.com</a>. <a href="https://gitlab.com/-/sent_notifications/770cd552c23f95a29348ee81990917b4/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.com/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.com/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Merge request","url":"https://gitlab.com/gnutls/gnutls/-/merge_requests/1877"}}</script>
</p>
</div>
</body>
</html>