You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2026/08/26 12:43:23 UTC
(tomcat-native) 02/02: Fallback as intended if ALPN negotiation fails.
This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
commit 035249cc49b5f00fb1e457e504abae5bbc9c1345
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Wed Aug 26 13:35:59 2026 +0100
Fallback as intended if ALPN negotiation fails.
---
native/src/sslutils.c | 9 +++++----
xdocs/miscellaneous/changelog.xml | 5 +++++
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index 857244d01..a4b9e2cea 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -476,12 +476,13 @@ int select_next_proto(SSL *ssl, const unsigned char **out, unsigned char *outlen
}
if (supported_protos_len > 0 && inlen > 0 && failure_behavior == SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL) {
- // There were no match but we just select our last protocol and hope the other peer support it.
+ // There was no match so select our last protocol and hope the peer supports it.
//
- // decrement the pointer again so the pointer points to the start of the protocol.
- p -= proto_len;
+ // Switch the pointer to our list and decrement by the length of the last entry so the pointer points to the
+ // start of the protocol.
+ p = supported_protos - target_proto_len;
*out = p;
- *outlen = proto_len;
+ *outlen = target_proto_len;
return SSL_TLSEXT_ERR_OK;
}
// TODO: OpenSSL currently not support to fail with fatal error. Once this changes we can also support it here.
diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml
index a20e6996c..50ca0dae9 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -50,6 +50,11 @@
<fix>
Fix a potential crash when negotiating ALPN. (markt)
</fix>
+ <fix>
+ If ALPN negotiation fails and failure is configured to use the last server
+ protocol in the list, use it rather than the last protocol offered by the
+ client. (markt)
+ </fix>
</changelog>
</section>
<section name="2.0.15" rtext="2026-06-15">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org