From 062178678f5374b09f00d70796f6e692e8775aca Mon Sep 17 00:00:00 2001 From: Emilia Kasper Date: Tue, 22 Sep 2015 15:20:26 +0200 Subject: Refactor ClientHello extension parsing 1) Simplify code with better PACKET methods. 2) Make broken SNI parsing explicit. SNI was intended to be extensible to new name types but RFC 4366 defined the syntax inextensibly, and OpenSSL has never parsed SNI in a way that would allow adding a new name type. RFC 6066 fixed the definition but due to broken implementations being widespread, it appears impossible to ever extend SNI. 3) Annotate resumption behaviour. OpenSSL doesn't currently handle all extensions correctly upon resumption. Annotate for further clean-up. 4) Send an alert on ALPN protocol mismatch. Reviewed-by: Kurt Roeckx --- ssl/t1_enc.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'ssl/t1_enc.c') diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c index 1b2820bff9..21eb3283da 100644 --- a/ssl/t1_enc.c +++ b/ssl/t1_enc.c @@ -792,6 +792,8 @@ int tls1_alert_code(int code) return (TLS1_AD_UNKNOWN_PSK_IDENTITY); case SSL_AD_INAPPROPRIATE_FALLBACK: return (TLS1_AD_INAPPROPRIATE_FALLBACK); + case SSL_AD_NO_APPLICATION_PROTOCOL: + return (TLS1_AD_NO_APPLICATION_PROTOCOL); default: return (-1); } -- cgit v1.2.3