This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit db9022ca7e69f4425f7a3dcb6b5ee8c5fc568f84 Author: Mark Thomas <[email protected]> AuthorDate: Tue Oct 20 18:00:06 2026 +0100 Follow-up to "Fix broken SNI fallback for ClientHello values larger..." Port fix to NIO2. --- java/org/apache/tomcat/util/net/SecureNio2Channel.java | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/java/org/apache/tomcat/util/net/SecureNio2Channel.java b/java/org/apache/tomcat/util/net/SecureNio2Channel.java index 4cbb2610c9..89e238b4ad 100644 --- a/java/org/apache/tomcat/util/net/SecureNio2Channel.java +++ b/java/org/apache/tomcat/util/net/SecureNio2Channel.java @@ -407,6 +407,8 @@ public class SecureNio2Channel extends Nio2Channel { String hostName = null; List<Cipher> clientRequestedCiphers = null; List<String> clientRequestedApplicationProtocols = null; + List<String> clientRequestedProtocols = null; + List<String> clientRequestedCipherNames = null; List<Group> clientSupportedGroups = null; List<SignatureScheme> clientSignatureSchemes = null; switch (extractor.getResult()) { @@ -417,6 +419,8 @@ public class SecureNio2Channel extends Nio2Channel { //$FALL-THROUGH$ to set the client requested ciphers case NOT_PRESENT: clientRequestedCiphers = extractor.getClientRequestedCiphers(); + clientRequestedProtocols = extractor.getClientRequestedProtocols(); + clientRequestedCipherNames = extractor.getClientRequestedCipherNames(); clientSupportedGroups = extractor.getClientSupportedGroups(); clientSignatureSchemes = extractor.getClientSignatureSchemes(); break; @@ -431,6 +435,11 @@ public class SecureNio2Channel extends Nio2Channel { } hostName = endpoint.getDefaultSSLHostConfigName(); clientRequestedCiphers = Collections.emptyList(); + clientRequestedApplicationProtocols = Collections.emptyList(); + clientRequestedProtocols = Collections.emptyList(); + clientRequestedCipherNames = Collections.emptyList(); + clientSupportedGroups = Collections.emptyList(); + clientSignatureSchemes = Collections.emptyList(); break; case NON_SECURE: netOutBuffer.clear(); @@ -445,7 +454,7 @@ public class SecureNio2Channel extends Nio2Channel { } try { - AbstractJsseEndpoint.clientRequestedProtocolsThreadLocal.set(extractor.getClientRequestedProtocols()); + AbstractJsseEndpoint.clientRequestedProtocolsThreadLocal.set(clientRequestedProtocols); AbstractJsseEndpoint.clientSupportedGroupsThreadLocal.set(clientSupportedGroups); AbstractJsseEndpoint.clientSignatureSchemesThreadLocal.set(clientSignatureSchemes); sslEngine = endpoint.createSSLEngine(hostName, clientRequestedCiphers, clientRequestedApplicationProtocols); @@ -457,9 +466,8 @@ public class SecureNio2Channel extends Nio2Channel { // Populate additional TLS attributes obtained from the handshake that // aren't available from the session - additionalTlsAttributes.put(SSLSupport.REQUESTED_PROTOCOL_VERSIONS_KEY, - extractor.getClientRequestedProtocols()); - additionalTlsAttributes.put(SSLSupport.REQUESTED_CIPHERS_KEY, extractor.getClientRequestedCipherNames()); + additionalTlsAttributes.put(SSLSupport.REQUESTED_PROTOCOL_VERSIONS_KEY, clientRequestedProtocols); + additionalTlsAttributes.put(SSLSupport.REQUESTED_CIPHERS_KEY, clientRequestedCipherNames); // Ensure the application buffers (which have to be created earlier) are // big enough. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
