s_server: Properly indicate ALPN protocol mismatch
authorTomas Mraz <tmraz@fedoraproject.org>
Thu, 26 Mar 2020 14:59:00 +0000 (15:59 +0100)
committerTomas Mraz <tmraz@fedoraproject.org>
Fri, 27 Mar 2020 16:24:42 +0000 (17:24 +0100)
Return SSL_TLSEXT_ERR_ALERT_FATAL from alpn_select_cb so that
an alert is sent to the client on ALPN protocol mismatch.

Fixes: #2708

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/11415)

apps/s_server.c

index bcc83e5..591c6c1 100644 (file)
@@ -707,7 +707,7 @@ static int alpn_cb(SSL *s, const unsigned char **out, unsigned char *outlen,
     if (SSL_select_next_proto
         ((unsigned char **)out, outlen, alpn_ctx->data, alpn_ctx->len, in,
          inlen) != OPENSSL_NPN_NEGOTIATED) {
-        return SSL_TLSEXT_ERR_NOACK;
+        return SSL_TLSEXT_ERR_ALERT_FATAL;
     }
 
     if (!s_quiet) {