This is an automated email from the ASF dual-hosted git repository. markt-asf pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 4abfd0e1e639003962cfc319c1c0c3780732fe15 Author: Mark Thomas <[email protected]> AuthorDate: Mon Oct 26 12:14:27 2026 +0000 Reject invalid SNI values --- java/org/apache/tomcat/util/net/LocalStrings.properties | 1 + java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/java/org/apache/tomcat/util/net/LocalStrings.properties b/java/org/apache/tomcat/util/net/LocalStrings.properties index a68def2300..3fd39fede6 100644 --- a/java/org/apache/tomcat/util/net/LocalStrings.properties +++ b/java/org/apache/tomcat/util/net/LocalStrings.properties @@ -143,6 +143,7 @@ endpoint.warn.unlockAcceptorFailed=Acceptor thread [{0}] failed to unlock. Forci sniExtractor.clientHelloInvalid=The ClientHello message was not correctly formatted sniExtractor.clientHelloTooBig=The ClientHello was not presented in a single TLS record so no SNI information could be extracted +sniExtractor.host.invalid.trailingPeriod=The SNI provided host name [{0}] is not valid as per RFC 6066. It should not include a trailing period. sniExtractor.tooEarly=It is illegal to call this method before the client hello has been parsed socket.closed=The socket associated with this connection has been closed. diff --git a/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java b/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java index 02ed78d54d..0e275abd0f 100644 --- a/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java +++ b/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java @@ -466,7 +466,11 @@ public class TLSClientHelloExtractor { char serverNameSize = bb.getChar(); byte[] serverNameBytes = new byte[serverNameSize]; bb.get(serverNameBytes); - return new String(serverNameBytes, StandardCharsets.UTF_8).toLowerCase(Locale.ENGLISH); + String result = new String(serverNameBytes, StandardCharsets.UTF_8).toLowerCase(Locale.ENGLISH); + if (result.endsWith(".")) { + throw new IllegalArgumentException(sm.getString("sniExtractor.host.invalid.trailingPeriod", result)); + } + return result; } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
