This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 3c880131d1 Reject invalid SNI values
3c880131d1 is described below
commit 3c880131d13a4de17439f1da342a48772f5cd155
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Oct 26 12:14:27 2026 +0000
Reject invalid SNI values
---
java/org/apache/tomcat/util/net/LocalStrings.properties | 1 +
java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java | 6 +++++-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/java/org/apache/tomcat/util/net/LocalStrings.properties
b/java/org/apache/tomcat/util/net/LocalStrings.properties
index 591ac94273..d1a2ad094a 100644
--- a/java/org/apache/tomcat/util/net/LocalStrings.properties
+++ b/java/org/apache/tomcat/util/net/LocalStrings.properties
@@ -168,6 +168,7 @@ endpoint.warn.unlockAcceptorFailed=Acceptor thread [{0}]
failed to unlock. Forci
sniExtractor.clientHelloInvalid=The ClientHello message was not correctly
formatted
sniExtractor.clientHelloTooBig=The ClientHello was not presented in a single
TLS record so no SNI information could be extracted
+sniExtractor.host.invalid.trailingPeriod=The SNI provided host name [{0}] is
not valid as per RFC 6066. It should not include a trailing period.
sniExtractor.tooEarly=It is illegal to call this method before the client
hello has been parsed
socket.apr.clientAbort=The client aborted the connection.
diff --git a/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java
b/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java
index add8a9df6d..7934ef06d3 100644
--- a/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java
+++ b/java/org/apache/tomcat/util/net/TLSClientHelloExtractor.java
@@ -477,7 +477,11 @@ public class TLSClientHelloExtractor {
char serverNameSize = bb.getChar();
byte[] serverNameBytes = new byte[serverNameSize];
bb.get(serverNameBytes);
- return new String(serverNameBytes,
StandardCharsets.UTF_8).toLowerCase(Locale.ENGLISH);
+ String result = new String(serverNameBytes,
StandardCharsets.UTF_8).toLowerCase(Locale.ENGLISH);
+ if (result.endsWith(".")) {
+ throw new
IllegalArgumentException(sm.getString("sniExtractor.host.invalid.trailingPeriod",
result));
+ }
+ return result;
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
