This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new 974257b717 Implement stricter ALPN matching for Connectors using FFM.
974257b717 is described below
commit 974257b717aca7626af3cb3fc7b6e4e425c0b164
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Sep 2 15:32:16 2026 +0100
Implement stricter ALPN matching for Connectors using FFM.
---
.../util/net/openssl/panama/OpenSSLContext.java | 35 +++++++++++-----------
webapps/docs/changelog.xml | 3 ++
2 files changed, 20 insertions(+), 18 deletions(-)
diff --git a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
index c27265ff24..516baec515 100644
--- a/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
+++ b/java/org/apache/tomcat/util/net/openssl/panama/OpenSSLContext.java
@@ -762,25 +762,24 @@ public class OpenSSLContext implements
org.apache.tomcat.util.net.SSLContext {
MemorySegment inSeg = in.reinterpret(inlen, localArena, null);
byte[] advertisedBytes = inSeg.toArray(ValueLayout.JAVA_BYTE);
for (byte[] negotiableProtocolBytes : negotiableProtocols) {
- for (int i = 0; i <= advertisedBytes.length -
negotiableProtocolBytes.length; i++) {
- if (advertisedBytes[i] == negotiableProtocolBytes[0]) {
- for (int j = 0; j <
negotiableProtocolBytes.length; j++) {
- if (advertisedBytes[i + j] ==
negotiableProtocolBytes[j]) {
- if (j == negotiableProtocolBytes.length -
1) {
- // Match
- MemorySegment outSeg =
-
out.reinterpret(ValueLayout.ADDRESS.byteSize(), localArena, null);
- outSeg.set(ValueLayout.ADDRESS, 0,
inSeg.asSlice(i));
- MemorySegment outlenSeg =
-
outlen.reinterpret(ValueLayout.JAVA_BYTE.byteSize(), localArena, null);
- outlenSeg.set(ValueLayout.JAVA_BYTE,
0, (byte) negotiableProtocolBytes.length);
- return SSL_TLSEXT_ERR_OK();
- }
- } else {
- break;
- }
- }
+ int protocolStart = 0;
+ while (protocolStart < advertisedBytes.length) {
+ int protocolLength = advertisedBytes[protocolStart] &
0xFF;
+ protocolStart++;
+ if (protocolLength == 0 || protocolLength >
advertisedBytes.length - protocolStart) {
+ return SSL_TLSEXT_ERR_NOACK();
+ }
+ if (Arrays.equals(advertisedBytes, protocolStart,
protocolStart + protocolLength,
+ negotiableProtocolBytes, 0,
negotiableProtocolBytes.length)) {
+ MemorySegment outSeg =
+
out.reinterpret(ValueLayout.ADDRESS.byteSize(), localArena, null);
+ outSeg.set(ValueLayout.ADDRESS, 0,
inSeg.asSlice(protocolStart));
+ MemorySegment outlenSeg =
+
outlen.reinterpret(ValueLayout.JAVA_BYTE.byteSize(), localArena, null);
+ outlenSeg.set(ValueLayout.JAVA_BYTE, 0, (byte)
negotiableProtocolBytes.length);
+ return SSL_TLSEXT_ERR_OK();
}
+ protocolStart += protocolLength;
}
}
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index c34e8b1ef5..7fc1e0996c 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -205,6 +205,9 @@
<fix>
Fix max connections enforcement after an enpoint resume. (remm)
</fix>
+ <fix>
+ Implement stricter ALPN matching for Connectors using FFM. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
