Limit the size of SNI parsed from ClientHello - #133361
Merged
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The behavioral change is narrowly scoped, preserves frame completeness semantics, and is covered by targeted boundary tests.
Pull request overview
This PR hardens System.Net.Security TLS ClientHello parsing by capping Server Name Indication (SNI) hostname decoding at 255 bytes, avoiding unnecessary managed string allocations for malformed / oversized peer input while still treating the TLS frame as complete.
Changes:
- Add a 255-byte maximum for SNI hostname decoding during ClientHello parsing (
TlsFrameHelper), returningnullSNI when exceeded. - Add boundary coverage for 255-byte (accepted) and 256-byte (rejected) SNI payloads in
TlsFrameHelperTests, including ensuringTryGetFrameInfostill returnstrue(frame complete).
File summaries
| File | Description |
|---|---|
| src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs | Adds a maximum-length guard to skip SNI decoding for oversized hostnames while keeping parsing successful. |
| src/libraries/System.Net.Security/tests/FunctionalTests/TlsFrameHelperTests.cs | Adds tests and a helper to generate ClientHello frames validating 255/256-byte SNI behavior and frame completeness. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
wfurt
approved these changes
Sep 7, 2026
MihaZupan
approved these changes
Sep 7, 2026
This was referenced Sep 7, 2026
This was referenced Sep 7, 2026
Member
Author
|
/ba-g Test failures are unrelated |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ClientHello SNI payloads carry a 16-bit length, but DNS hostnames are limited to 255 encoded bytes. Decoding larger peer-controlled values creates unnecessary managed strings for malformed input.
Cap managed SNI decoding at 255 bytes and treat larger values as unavailable SNI. The frame remains classified as complete so
TlsSessiondoes not incorrectly wait for more input. Boundary tests cover accepted 255-byte and rejected 256-byte payloads, including frame-completeness behavior.Tests:
TlsFrameHelperTests: 4,060 passedSystem.Net.Security.Unit.Tests: 117 passed, 4 skippedFixes: #133348
Note
This pull request description was generated by GitHub Copilot.