kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Group NPN functions in their own section.

Browse Source 
Existing documentation was moved to the header, very slightly tweaked.

Change-Id: Ife3c2351e2d7e6a335854284f996918039414446
Reviewed-on: https://boringssl-review.googlesource.com/5897
Reviewed-by: Adam Langley <agl@google.com>
This commit is contained in:
David Benjamin 2015-09-16 00:25:52 -04:00 committed by Adam Langley
parent 8984f1f6e5
commit 977547b6f9
2 changed files with 102 additions and 94 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

114
include/openssl/ssl.h
View File

@ -1601,6 +1601,91 @@ OPENSSL_EXPORT void SSL_get0_alpn_selected(const SSL *ssl,
unsigned *out_len); unsigned *out_len);
/* Next protocol negotiation.
*
* The NPN extension (draft-agl-tls-nextprotoneg-03) is the predecessor to ALPN
* and deprecated in favor of it. */
/* SSL_CTX_set_next_protos_advertised_cb sets a callback that is called when a
* TLS server needs a list of supported protocols for Next Protocol
* Negotiation. The returned list must be in wire format. The list is returned
* by setting |*out| to point to it and |*out_len| to its length. This memory
* will not be modified, but one should assume that |ssl| keeps a reference to
* it.
*
* The callback should return |SSL_TLSEXT_ERR_OK| if it wishes to advertise.
* Otherwise, no such extension will be included in the ServerHello. */
OPENSSL_EXPORT void SSL_CTX_set_next_protos_advertised_cb(
SSL_CTX *ctx,
int (*cb)(SSL *ssl, const uint8_t **out, unsigned *out_len, void *arg),
void *arg);
/* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a client
* needs to select a protocol from the server's provided list. |*out| must be
* set to point to the selected protocol (which may be within |in|). The length
* of the protocol name must be written into |*out_len|. The server's advertised
* protocols are provided in |in| and |in_len|. The callback can assume that
* |in| is syntactically valid.
*
* The client must select a protocol. It is fatal to the connection if this
* callback returns a value other than |SSL_TLSEXT_ERR_OK|.
*
* Configuring this callback enables NPN on a client. */
OPENSSL_EXPORT void SSL_CTX_set_next_proto_select_cb(
SSL_CTX *ctx, int (*cb)(SSL *ssl, uint8_t **out, uint8_t *out_len,
const uint8_t *in, unsigned in_len, void *arg),
void *arg);
/* SSL_get0_next_proto_negotiated sets |*out_data| and |*out_len| to point to
* the client's requested protocol for this connection. If the client didn't
* request any protocol, then |*out_data| is set to NULL.
*
* Note that the client can request any protocol it chooses. The value returned
* from this function need not be a member of the list of supported protocols
* provided by the server. */
OPENSSL_EXPORT void SSL_get0_next_proto_negotiated(const SSL *ssl,
const uint8_t **out_data,
unsigned *out_len);
/* SSL_select_next_proto implements the standard protocol selection. It is
* expected that this function is called from the callback set by
* |SSL_CTX_set_next_proto_select_cb|.
*
* The protocol data is assumed to be a vector of 8-bit, length prefixed byte
* strings. The length byte itself is not included in the length. A byte
* string of length 0 is invalid. No byte string may be truncated.
*
* The current, but experimental algorithm for selecting the protocol is:
*
* 1) If the server doesn't support NPN then this is indicated to the
* callback. In this case, the client application has to abort the connection
* or have a default application level protocol.
*
* 2) If the server supports NPN, but advertises an empty list then the
* client selects the first protcol in its list, but indicates via the
* API that this fallback case was enacted.
*
* 3) Otherwise, the client finds the first protocol in the server's list
* that it supports and selects this protocol. This is because it's
* assumed that the server has better information about which protocol
* a client should use.
*
* 4) If the client doesn't support any of the server's advertised
* protocols, then this is treated the same as case 2.
*
* It returns either |OPENSSL_NPN_NEGOTIATED| if a common protocol was found, or
* |OPENSSL_NPN_NO_OVERLAP| if the fallback case was reached. */
OPENSSL_EXPORT int SSL_select_next_proto(uint8_t **out, uint8_t *out_len,
const uint8_t *server,
unsigned server_len,
const uint8_t *client,
unsigned client_len);
#define OPENSSL_NPN_UNSUPPORTED 0
#define OPENSSL_NPN_NEGOTIATED 1
#define OPENSSL_NPN_NO_OVERLAP 2
/* DTLS-SRTP. /* DTLS-SRTP.
* *
* See RFC 5764. */ * See RFC 5764. */
@ -2000,27 +2085,6 @@ OPENSSL_EXPORT void SSL_get0_signed_cert_timestamp_list(const SSL *ssl,
OPENSSL_EXPORT void SSL_get0_ocsp_response(const SSL *ssl, const uint8_t **out, OPENSSL_EXPORT void SSL_get0_ocsp_response(const SSL *ssl, const uint8_t **out,
size_t *out_len); size_t *out_len);
OPENSSL_EXPORT void SSL_CTX_set_next_protos_advertised_cb(
SSL_CTX *s,
int (*cb)(SSL *ssl, const uint8_t **out, unsigned int *outlen, void *arg),
void *arg);
OPENSSL_EXPORT void SSL_CTX_set_next_proto_select_cb(
SSL_CTX *s, int (*cb)(SSL *ssl, uint8_t **out, uint8_t *outlen,
const uint8_t *in, unsigned int inlen, void *arg),
void *arg);
OPENSSL_EXPORT void SSL_get0_next_proto_negotiated(const SSL *s,
const uint8_t **data,
unsigned *len);
OPENSSL_EXPORT int SSL_select_next_proto(uint8_t **out, uint8_t *outlen,
const uint8_t *in, unsigned int inlen,
const uint8_t *client,
unsigned int client_len);
#define OPENSSL_NPN_UNSUPPORTED 0
#define OPENSSL_NPN_NEGOTIATED 1
#define OPENSSL_NPN_NO_OVERLAP 2
/* SSL_set_reject_peer_renegotiations controls whether renegotiation attempts by /* SSL_set_reject_peer_renegotiations controls whether renegotiation attempts by
* the peer are rejected. It may be set at any point in a connection's lifetime * the peer are rejected. It may be set at any point in a connection's lifetime
* to control future renegotiations programmatically. By default, renegotiations * to control future renegotiations programmatically. By default, renegotiations
@ -2943,13 +3007,13 @@ struct ssl_ctx_st {
/* For a server, this contains a callback function by which the set of /* For a server, this contains a callback function by which the set of
* advertised protocols can be provided. */ * advertised protocols can be provided. */
int (*next_protos_advertised_cb)(SSL *s, const uint8_t **buf, int (*next_protos_advertised_cb)(SSL *ssl, const uint8_t **out,
unsigned int *len, void *arg); unsigned *out_len, void *arg);
void *next_protos_advertised_cb_arg; void *next_protos_advertised_cb_arg;
/* For a client, this contains a callback function that selects the /* For a client, this contains a callback function that selects the
* next protocol from the list provided by the server. */ * next protocol from the list provided by the server. */
int (*next_proto_select_cb)(SSL *s, uint8_t **out, uint8_t *outlen, int (*next_proto_select_cb)(SSL *ssl, uint8_t **out, uint8_t *out_len,
const uint8_t *in, unsigned int inlen, void *arg); const uint8_t *in, unsigned in_len, void *arg);
void *next_proto_select_cb_arg; void *next_proto_select_cb_arg;
/* ALPN information /* ALPN information

82
ssl/ssl_lib.c
View File

@ -1706,39 +1706,9 @@ int SSL_CTX_set_ocsp_response(SSL_CTX *ctx, const uint8_t *response,
return 1; return 1;
} }
/* SSL_select_next_proto implements the standard protocol selection. It is int SSL_select_next_proto(uint8_t **out, uint8_t *out_len,
* expected that this function is called from the callback set by const uint8_t *server, unsigned server_len,
* SSL_CTX_set_next_proto_select_cb. const uint8_t *client, unsigned client_len) {
*
* The protocol data is assumed to be a vector of 8-bit, length prefixed byte
* strings. The length byte itself is not included in the length. A byte
* string of length 0 is invalid. No byte string may be truncated.
*
* The current, but experimental algorithm for selecting the protocol is:
*
* 1) If the server doesn't support NPN then this is indicated to the
* callback. In this case, the client application has to abort the connection
* or have a default application level protocol.
*
* 2) If the server supports NPN, but advertises an empty list then the
* client selects the first protcol in its list, but indicates via the
* API that this fallback case was enacted.
*
* 3) Otherwise, the client finds the first protocol in the server's list
* that it supports and selects this protocol. This is because it's
* assumed that the server has better information about which protocol
* a client should use.
*
* 4) If the client doesn't support any of the server's advertised
* protocols, then this is treated the same as case 2.
*
* It returns either
* OPENSSL_NPN_NEGOTIATED if a common protocol was found, or
* OPENSSL_NPN_NO_OVERLAP if the fallback case was reached.
*/
int SSL_select_next_proto(uint8_t **out, uint8_t *outlen, const uint8_t *server,
unsigned int server_len, const uint8_t *client,
unsigned int client_len) {
unsigned int i, j; unsigned int i, j;
const uint8_t *result; const uint8_t *result;
int status = OPENSSL_NPN_UNSUPPORTED; int status = OPENSSL_NPN_UNSUPPORTED;
@ -1766,57 +1736,31 @@ int SSL_select_next_proto(uint8_t **out, uint8_t *outlen, const uint8_t *server,
found: found:
*out = (uint8_t *)result + 1; *out = (uint8_t *)result + 1;
*outlen = result[0]; *out_len = result[0];
return status; return status;
} }
/* SSL_get0_next_proto_negotiated sets *data and *len to point to the client's void SSL_get0_next_proto_negotiated(const SSL *ssl, const uint8_t **out_data,
* requested protocol for this connection and returns 0. If the client didn't unsigned *out_len) {
* request any protocol, then *data is set to NULL. *out_data = ssl->next_proto_negotiated;
* if (*out_data == NULL) {
* Note that the client can request any protocol it chooses. The value returned *out_len = 0;
* from this function need not be a member of the list of supported protocols
* provided by the callback. */
void SSL_get0_next_proto_negotiated(const SSL *s, const uint8_t **data,
unsigned *len) {
*data = s->next_proto_negotiated;
if (!*data) {
*len = 0;
} else { } else {
*len = s->next_proto_negotiated_len; *out_len = ssl->next_proto_negotiated_len;
} }
} }
/* SSL_CTX_set_next_protos_advertised_cb sets a callback that is called when a
* TLS server needs a list of supported protocols for Next Protocol
* Negotiation. The returned list must be in wire format. The list is returned
* by setting |out| to point to it and |outlen| to its length. This memory will
* not be modified, but one should assume that the SSL* keeps a reference to
* it.
*
* The callback should return SSL_TLSEXT_ERR_OK if it wishes to advertise.
* Otherwise, no such extension will be included in the ServerHello. */
void SSL_CTX_set_next_protos_advertised_cb( void SSL_CTX_set_next_protos_advertised_cb(
SSL_CTX *ctx, SSL_CTX *ctx,
int (*cb)(SSL *ssl, const uint8_t **out, unsigned int *outlen, void *arg), int (*cb)(SSL *ssl, const uint8_t **out, unsigned *out_len, void *arg),
void *arg) { void *arg) {
ctx->next_protos_advertised_cb = cb; ctx->next_protos_advertised_cb = cb;
ctx->next_protos_advertised_cb_arg = arg; ctx->next_protos_advertised_cb_arg = arg;
} }
/* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a
* client needs to select a protocol from the server's provided list. |out|
* must be set to point to the selected protocol (which may be within |in|).
* The length of the protocol name must be written into |outlen|. The server's
* advertised protocols are provided in |in| and |inlen|. The callback can
* assume that |in| is syntactically valid.
*
* The client must select a protocol. It is fatal to the connection if this
* callback returns a value other than SSL_TLSEXT_ERR_OK.
*/
void SSL_CTX_set_next_proto_select_cb( void SSL_CTX_set_next_proto_select_cb(
SSL_CTX *ctx, int (*cb)(SSL *s, uint8_t **out, uint8_t *outlen, SSL_CTX *ctx, int (*cb)(SSL *ssl, uint8_t **out, uint8_t *out_len,
const uint8_t *in, unsigned int inlen, void *arg), const uint8_t *in, unsigned in_len, void *arg),
void *arg) { void *arg) {
ctx->next_proto_select_cb = cb; ctx->next_proto_select_cb = cb;
ctx->next_proto_select_cb_arg = arg; ctx->next_proto_select_cb_arg = arg;