-
-
Notifications
You must be signed in to change notification settings - Fork 15.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Using underscore character('_') as part of SNI leads JVM crash #8144
Comments
interesting... Let me investigate |
@normanmaurer I have tested this case on netty 4.1.27.Final and netty-tcnative-boringssl-static 2.0.12.Final, the process would not crash any more. It seems that the latest version of boringssl have fixed this issue. Then the validation actually takes place in the io.netty.handler.ssl. ReferenceCountedOpenSslEngine#checkSniHostnameMatch() and it blocks me since underscore character is not allowed in definition of host name in rfc 1123 (which is based on rfc 952).
But I‘m just curious about the JDK that provided the abstract class SNIMatcher which used |
Motivation: We should allow to also validate sni hostname which contains for example underscore when using our native SSL impl. The JDK implementation does this as well. Modifications: - Construct the SNIHostName via byte[] and not String. - Add unit test Result: Fixes #8144.
@normanmaurer I have verified this on branch
I have also verified outbound data and the client sni has successfully been sent out for negotiation.
|
Motivation: We should allow to also validate sni hostname which contains for example underscore when using our native SSL impl. The JDK implementation does this as well. Modifications: - Construct the SNIHostName via byte[] and not String. - Add unit test Result: Fixes #8144.
Hello guys, we use Netty as our network implementation of microservices framework. We plan to support https and thus enable authentication on both client side and server side. But we encounter a problem when we want to use underscore character('_') in TLS SNI.
Steps to reproduce
1. Netty Server implementation:
2. Openssl Client test:
As we can see from the command, we used
rb8hx3pww30y3tvw0mwy.v1_1
as snistdout of JVM process when crash:
Please note that if we use sni which excluded underscore character(e.g.
rb8hx3pww30y3tvw0mwy.v1
), everything works fine, I can see sni logs in MySNIMatcher.Netty version
Netty: 4.1.14.Final
Boringssl: netty-tcnative-boringssl-static:2.0.5.Final
Openssl Version
1.0.2o
JVM version (e.g.
java -version
)java version "1.8.0_112"
Java(TM) SE Runtime Environment (build 1.8.0_112-b16)
Java HotSpot(TM) 64-Bit Server VM (build 25.112-b16, mixed mode)
OS version (e.g.
uname -a
)macOS High Sierra 10.13.5
Darwin Kernel Version 17.6.0
The text was updated successfully, but these errors were encountered: