This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
commit 035249cc49b5f00fb1e457e504abae5bbc9c1345 Author: Mark Thomas <[email protected]> AuthorDate: Wed Aug 26 13:35:59 2026 +0100 Fallback as intended if ALPN negotiation fails. --- native/src/sslutils.c | 9 +++++---- xdocs/miscellaneous/changelog.xml | 5 +++++ 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/native/src/sslutils.c b/native/src/sslutils.c index 857244d01..a4b9e2cea 100644 --- a/native/src/sslutils.c +++ b/native/src/sslutils.c @@ -476,12 +476,13 @@ int select_next_proto(SSL *ssl, const unsigned char **out, unsigned char *outlen } if (supported_protos_len > 0 && inlen > 0 && failure_behavior == SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL) { - // There were no match but we just select our last protocol and hope the other peer support it. + // There was no match so select our last protocol and hope the peer supports it. // - // decrement the pointer again so the pointer points to the start of the protocol. - p -= proto_len; + // Switch the pointer to our list and decrement by the length of the last entry so the pointer points to the + // start of the protocol. + p = supported_protos - target_proto_len; *out = p; - *outlen = proto_len; + *outlen = target_proto_len; return SSL_TLSEXT_ERR_OK; } // TODO: OpenSSL currently not support to fail with fatal error. Once this changes we can also support it here. diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml index a20e6996c..50ca0dae9 100644 --- a/xdocs/miscellaneous/changelog.xml +++ b/xdocs/miscellaneous/changelog.xml @@ -50,6 +50,11 @@ <fix> Fix a potential crash when negotiating ALPN. (markt) </fix> + <fix> + If ALPN negotiation fails and failure is configured to use the last server + protocol in the list, use it rather than the last protocol offered by the + client. (markt) + </fix> </changelog> </section> <section name="2.0.15" rtext="2026-06-15"> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
