This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new 7bcb055716 Reject invalid SNI values
7bcb055716 is described below
commit 7bcb0557163ca23858b0190f27bb7a04443fd56f
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Oct 26 12:14:27 2026 +0000
Reject invalid SNI values
---
java/org/apache/tomcat/util/net/LocalStrings.properties | 1 +
java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java | 6 +++++-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/java/org/apache/tomcat/util/net/LocalStrings.properties
b/java/org/apache/tomcat/util/net/LocalStrings.properties
index b6fee25844..e16d2fb032 100644
--- a/java/org/apache/tomcat/util/net/LocalStrings.properties
+++ b/java/org/apache/tomcat/util/net/LocalStrings.properties
@@ -150,6 +150,7 @@ endpoint.warn.unlockAcceptorFailed=Acceptor thread [{0}]
failed to unlock. Forci
sniExtractor.clientHelloInvalid=The ClientHello message was not correctly
formatted
sniExtractor.clientHelloTooBig=The ClientHello was not presented in a single
TLS record so no SNI information could be extracted
+sniExtractor.host.invalid.trailingPeriod=The SNI provided host name [{0}] is
not valid as per RFC 6066. It should not include a trailing period.
sniExtractor.tooEarly=It is illegal to call this method before the client
hello has been parsed
socket.closed=The socket associated with this connection has been closed.
diff --git a/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java
b/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java
index 02ed78d54d..0e275abd0f 100644
--- a/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java
+++ b/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java
@@ -466,7 +466,11 @@ public class TLSClientHelloExtractor {
char serverNameSize = bb.getChar();
byte[] serverNameBytes = new byte[serverNameSize];
bb.get(serverNameBytes);
- return new String(serverNameBytes,
StandardCharsets.UTF_8).toLowerCase(Locale.ENGLISH);
+ String result = new String(serverNameBytes,
StandardCharsets.UTF_8).toLowerCase(Locale.ENGLISH);
+ if (result.endsWith(".")) {
+ throw new
IllegalArgumentException(sm.getString("sniExtractor.host.invalid.trailingPeriod",
result));
+ }
+ return result;
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
