-
- Context
- `_ocsp_callback` calls `load_der_ocsp_response` unguarded in stapled response and responder fetchh.
- Malformed DER (Distinguished Encoding Rules — the ASN.1 binary encoding for OCSP responses) raises `ValueError` that escapes into `do_handshake` through PyOpenSSL's C callback. This isundefined behavior that could lead to disruption or a crash.
- This gap was found while investigating
PYTHON-6128.
-
- Definition of done
- Treat unparseable stapled bytes as an absent response. Must-staple certs still hard-fail, otherwise query the OCSP endpoint, soft-failing if no definitive status.
- For enparseable endpoint payload: debug log, skip URI (return `None`), soft-fail.
- Add a catch-all (log + fail-closed) so nothing escapes into OpenSSL.
-
- Pitfalls
- Parsed-but-invalid stapled responses still hard-fail (OCSP spec item 2, existing tests)
- Route unparseable bytes through the no-staple logic so must-staple still hard-fails (spec item 1)
- The callback runs in OpenSSL's C frame, never let an exception propagate.
- is related to
-
PYTHON-6128 SIGSEGV in PyOpenSSL do_handshake from a synchronous Monitor thread (pyopenssl_context.wrap_socket) shortly after MongoClient creation
-
- Closed
-