(tomcat-native) branch 1.3.x updated: Fallback as intended if ALPN negotiation fails.

This is an automated email from the ASF dual-hosted git repository.

markt-asf pushed a commit to branch 1.3.x
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git


The following commit(s) were added to refs/heads/1.3.x by this push:
     new 9b199ce42 Fallback as intended if ALPN negotiation fails.
9b199ce42 is described below

commit 9b199ce42333684c4e13786552b1f002d56cb3c5
Author: Mark Thomas <[email protected]>
AuthorDate: Wed Aug 26 13:35:59 2026 +0100

    Fallback as intended if ALPN negotiation fails.
---
 native/src/sslutils.c             | 9 +++++----
 xdocs/miscellaneous/changelog.xml | 5 +++++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index 7a9fd0fef..100bdfda3 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -497,12 +497,13 @@ int select_next_proto(SSL *ssl, const unsigned char **out, unsigned char *outlen
     }
 
     if (supported_protos_len > 0 && inlen > 0 && failure_behavior == SSL_SELECTOR_FAILURE_CHOOSE_MY_LAST_PROTOCOL) {
-         // There were no match but we just select our last protocol and hope the other peer support it.
+         // There was no match so select our last protocol and hope the peer supports it.
          //
-         // decrement the pointer again so the pointer points to the start of the protocol.
-         p -= proto_len;
+         // Switch the pointer to our list and decrement by the length of the last entry so the pointer points to the
+         // start of the protocol.
+         p = supported_protos - target_proto_len;
          *out = p;
-         *outlen = proto_len;
+         *outlen = target_proto_len;
          return SSL_TLSEXT_ERR_OK;
     }
     // TODO: OpenSSL currently not support to fail with fatal error. Once this changes we can also support it here.
diff --git a/xdocs/miscellaneous/changelog.xml b/xdocs/miscellaneous/changelog.xml
index e70d40bc6..60108f558 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -41,6 +41,11 @@
     <fix>
       Fix a potential crash when negotiating ALPN. (markt)
     </fix>
+    <fix>
+      If ALPN negotiation fails and failure is configured to use the last server
+      protocol in the list, use it rather than the last protocol offered by the
+      client. (markt)
+    </fix>
   </changelog>
 </section>
 <section name="1.3.8" rtext="2026-06-15">