Allow Multiple Wildcard Prefix Server Names of the Same Length in SNI Configuration (#41402)

Author: Tratcher

src/Servers/Kestrel/Core/src/Internal/SniOptionsSelector.cs

@@ -225,7 +225,17 @@ private LongestStringFirstComparer()
             public int Compare(string? x, string? y)
             {
                 // Flip x and y to put the longest instead of the shortest string first in the SortedList.
-                return y!.Length.CompareTo(x!.Length);
+                // SortedList does not support duplicate entries, so fall back to
+                // StringComparison.OrdinalIgnoreCase behavior for equal length strings.
+                var lengthResult = y!.Length.CompareTo(x!.Length);
+                if (lengthResult != 0)
+                {
+                    return lengthResult;
+                }
+                else
+                {
+                    return string.Compare(x, y, StringComparison.OrdinalIgnoreCase);
+                }
             }
         }
     }

src/Servers/Kestrel/Core/test/SniOptionsSelectorTests.cs

@@ -186,6 +186,91 @@ public void ServerNameMatchingIsCaseInsensitive()
             Assert.Equal("WildcardPrefix", pathDictionary[aSubdomainOptions.ServerCertificate]);
         }
 
+        [Fact]
+        public void MultipleWildcardPrefixServerNamesOfSameLengthAreAllowed()
+        {
+            var sniDictionary = new Dictionary<string, SniConfig>
+                {
+                    {
+                        "*.a.example.org",
+                        new SniConfig
+                        {
+                            Certificate = new CertificateConfig
+                            {
+                                Path = "a"
+                            }
+                        }
+                    },
+                    {
+                        "*.b.example.org",
+                        new SniConfig
+                        {
+                            Certificate = new CertificateConfig
+                            {
+                                Path = "b"
+                            }
+                        }
+                    }
+                };
+
+            var mockCertificateConfigLoader = new MockCertificateConfigLoader();
+            var pathDictionary = mockCertificateConfigLoader.CertToPathDictionary;
+
+            var sniOptionsSelector = new SniOptionsSelector(
+                "TestEndpointName",
+                sniDictionary,
+                mockCertificateConfigLoader,
+                fallbackHttpsOptions: new HttpsConnectionAdapterOptions(),
+                fallbackHttpProtocols: HttpProtocols.Http1AndHttp2,
+                logger: Mock.Of<ILogger<HttpsConnectionMiddleware>>());
+
+            var (aSubdomainOptions, _) = sniOptionsSelector.GetOptions(new MockConnectionContext(), "c.a.example.org");
+            Assert.Equal("a", pathDictionary[aSubdomainOptions.ServerCertificate]);
+
+            var (bSubdomainOptions, _) = sniOptionsSelector.GetOptions(new MockConnectionContext(), "c.b.example.org");
+            Assert.Equal("b", pathDictionary[bSubdomainOptions.ServerCertificate]);
+        }
+
+        [Fact]
+        public void DuplicateWildcardPrefixServerNamesThrowsArgumentException()
+        {
+            var sniDictionary = new Dictionary<string, SniConfig>
+                {
+                    {
+                        "*.example.org",
+                        new SniConfig
+                        {
+                            Certificate = new CertificateConfig
+                            {
+                                Path = "a"
+                            }
+                        }
+                    },
+                    {
+                        "*.EXAMPLE.org",
+                        new SniConfig
+                        {
+                            Certificate = new CertificateConfig
+                            {
+                                Path = "b"
+                            }
+                        }
+                    }
+                };
+
+            var mockCertificateConfigLoader = new MockCertificateConfigLoader();
+            var pathDictionary = mockCertificateConfigLoader.CertToPathDictionary;
+
+            var exception = Assert.Throws<ArgumentException>(() => new SniOptionsSelector(
+                 "TestEndpointName",
+                 sniDictionary,
+                 mockCertificateConfigLoader,
+                 fallbackHttpsOptions: new HttpsConnectionAdapterOptions(),
+                 fallbackHttpProtocols: HttpProtocols.Http1AndHttp2,
+                 logger: Mock.Of<ILogger<HttpsConnectionMiddleware>>()));
+            Assert.Equal("An item with the same key has already been added. Key: .EXAMPLE.org (Parameter 'key')", exception.Message);
+        }
+
         [Fact]
         public void GetOptionsThrowsAnAuthenticationExceptionIfThereIsNoMatchingSniSection()
         {