Merge remote-tracking branch 'agl/1.0.2alpn' into agl-alpn

[openssl.git] / apps / s_server.c

diff --git a/apps/s_server.c b/apps/s_server.c
index 2c83a6654bc752b7649623ffbb9ef2c34b557918..8fd47c4c3f29145bec0e7f97cccde4bac63f3c57 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -579,6 +579,7 @@ static void sv_usage(void)
        BIO_printf(bio_err," -nextprotoneg arg - set the advertised protocols for the NPN extension (comma-separated list)\n");
 # endif
         BIO_printf(bio_err," -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
+       BIO_printf(bio_err," -alpn arg  - set the advertised protocols for the ALPN extension (comma-separated list)\n");
 #endif
        BIO_printf(bio_err," -keymatexport label   - Export keying material using label\n");
        BIO_printf(bio_err," -keymatexportlen len  - Export len bytes of keying material (default 20)\n");
@@ -934,8 +935,47 @@ static int next_proto_cb(SSL *s, const unsigned char **data, unsigned int *len,
        }
 # endif  /* ndef OPENSSL_NO_NEXTPROTONEG */
 
+/* This the context that we pass to alpn_cb */
+typedef struct tlsextalpnctx_st {
+       unsigned char *data;
+       unsigned short len;
+} tlsextalpnctx;
 
-#endif
+static int alpn_cb(SSL *s, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)
+       {
+       tlsextalpnctx *alpn_ctx = arg;
+
+       if (!s_quiet)
+               {
+               /* We can assume that |in| is syntactically valid. */
+               unsigned i;
+               BIO_printf(bio_s_out, "ALPN protocols advertised by the client: ");
+               for (i = 0; i < inlen; )
+                       {
+                       if (i)
+                               BIO_write(bio_s_out, ", ", 2);
+                       BIO_write(bio_s_out, &in[i + 1], in[i]);
+                       i += in[i] + 1;
+                       }
+               BIO_write(bio_s_out, "\n", 1);
+               }
+
+       if (SSL_select_next_proto((unsigned char**) out, outlen, alpn_ctx->data, alpn_ctx->len, in, inlen) !=
+           OPENSSL_NPN_NEGOTIATED)
+               {
+               return SSL_TLSEXT_ERR_NOACK;
+               }
+
+       if (!s_quiet)
+               {
+               BIO_printf(bio_s_out, "ALPN protocols selected: ");
+               BIO_write(bio_s_out, *out, *outlen);
+               BIO_write(bio_s_out, "\n", 1);
+               }
+
+       return SSL_TLSEXT_ERR_OK;
+       }
+#endif  /* ndef OPENSSL_NO_TLSEXT */
 
 int MAIN(int, char **);
 
@@ -984,7 +1024,9 @@ int MAIN(int argc, char *argv[])
         tlsextctx tlsextcbp = {NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING};
 # ifndef OPENSSL_NO_NEXTPROTONEG
        const char *next_proto_neg_in = NULL;
-       tlsextnextprotoctx next_proto;
+       tlsextnextprotoctx next_proto = { NULL, 0};
+       const char *alpn_in = NULL;
+       tlsextalpnctx alpn_ctx = { NULL, 0};
 # endif
 #endif
 #ifndef OPENSSL_NO_PSK
@@ -1435,6 +1477,11 @@ int MAIN(int argc, char *argv[])
                        if (--argc < 1) goto bad;
                        next_proto_neg_in = *(++argv);
                        }
+               else if (strcmp(*argv,"-alpn") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       alpn_in = *(++argv);
+                       }
 # endif
 #endif
 #if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
@@ -1562,7 +1609,8 @@ bad:
 #endif /* OPENSSL_NO_TLSEXT */
                }
 
-#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG) 
+#if !defined(OPENSSL_NO_TLSEXT)
+# if !defined(OPENSSL_NO_NEXTPROTONEG) 
        if (next_proto_neg_in)
                {
                unsigned short len;
@@ -1575,6 +1623,16 @@ bad:
                {
                next_proto.data = NULL;
                }
+# endif
+       alpn_ctx.data = NULL;
+       if (alpn_in)
+               {
+               unsigned short len;
+               alpn_ctx.data = next_protos_parse(&len, alpn_in);
+               if (alpn_ctx.data == NULL)
+                       goto end;
+               alpn_ctx.len = len;
+               }
 #endif
 
        if (crl_file)
@@ -1812,6 +1870,8 @@ bad:
        if (next_proto.data)
                SSL_CTX_set_next_protos_advertised_cb(ctx, next_proto_cb, &next_proto);
 # endif
+       if (alpn_ctx.data)
+               SSL_CTX_set_alpn_select_cb(ctx, alpn_cb, &alpn_ctx);
 #endif 
 
 #ifndef OPENSSL_NO_DH
@@ -2041,6 +2101,10 @@ end:
                BIO_free(authz_in);
        if (serverinfo_in != NULL)
                BIO_free(serverinfo_in);
+       if (next_proto.data)
+               OPENSSL_free(next_proto.data);
+       if (alpn_ctx.data)
+               OPENSSL_free(alpn_ctx.data);
 #endif
        ssl_excert_free(exc);
        if (ssl_args)