Fixes #6624 - Non-domain SNI on java17 #6634
Merged
+37
−14
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Java 17 only allows letter|digit|hyphen characters for SNI names. While we could bypass this restriction on the client, when the SNI bytes arrive to the server they will be verified and if not allowed the TLS handshake will fail. Signed-off-by: Simone Bordet <simone.bordet@gmail.com>
gregw
requested changes
Aug 17, 2021
| // Must use the byte[] constructor, because the character ':' is forbidden when | ||
| // using the String constructor (but typically present in IPv6 addresses). | ||
| // Since Java 17, only letter|digit|hyphen characters are allowed, even by the byte[] constructor. |
There was a problem hiding this comment.
This is still not a proper fix. If : is never allowed, then why are we using the byte[] version? Shouldn't we just revert to the string version and remove this comment?
| /* TODO Fix. See #6624 | ||
| if (Net.isIpv6InterfaceAvailable()) | ||
| @Test | ||
| @EnabledForJreRange(max = JRE.JAVA_16, disabledReason = "Since Java 17, SNI host names can only have letter|digit|hyphen characters.") |
There was a problem hiding this comment.
This does not feel right. We are relying on implementation knowledge that an arg check is left out of one version of a method in java < 17. There is no reason that this arg check might not be added to a dot release of java 8-16.
gregw
approved these changes
Aug 18, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Java 17 only allows letter|digit|hyphen characters for SNI names.
While we could bypass this restriction on the client, when the SNI bytes arrive to the server they will be verified and if not allowed the TLS handshake will fail.
Signed-off-by: Simone Bordet simone.bordet@gmail.com