websocket error: idna: disallowed rune U+002A

[lidel]

random error printed to terminal by ipfs daemon while testing #10954:

ts=2025-10-17T22:18:26.643+02:00 level=error source=net/http/server.go:3677 msg="http: TLS handshake error from 156.67.62.51:54496: idna: disallowed rune U+002A" logger=websocket-transport
ts=2025-10-17T22:18:26.796+02:00 level=error source=net/http/server.go:3677 msg="http: TLS handshake error from 95.81.34.125:46602: idna: disallowed rune U+002A" logger=websocket-transport
ts=2025-10-17T22:18:26.975+02:00 level=error source=net/http/server.go:3677 msg="http: TLS handshake error from 207.32.217.235:34718: idna: disallowed rune U+002A" logger=websocket-transport

This indicates that the asterisk (*) character is not allowed in the domain name something is trying to use. TBD if its kubo/boxo code or some third-party code incorrectly handling *.peerid.libp2p.direct certificates

[lidel]

It seems that the remote peers are sending an invalid TLS SNI (Server Name Indication) that contains a literal asterisk (*) character during their TLS ClientHello.

The error idna: disallowed rune U+002A means Go's TLS implementation is correctly rejecting these invalid domain names per IDNA specifications.

The problem is, this produces ERROR which is logged by default on every occurrence.

I'll look into this, but suspecting it was always happening, but the logging regression printing this operational noise was introduced in:

• feat: Migrate to log/slog libp2p/go-libp2p#3364

[lidel]

Fixed in

• fix(go-log@2.9/go-libp2p@0.45): dynamic log level control and tail #11039
• fix(websocket): use debug level for operational noise errors libp2p/go-libp2p#3413