NPN / ALPN extensions callbacks don't allow handshake failure about openssl HOT 15 CLOSED

@richsalz did this ever land in openssl ? I am trying to find the changeset but no luck so far :/

from openssl.

@richsalz - FYI this is to continue our discussion about the ALPN / NPN failure behavior. The OpenJDK based implementations (jetty-alpn and jetty-npn) have been updated to support controlling the behavior at the granularity of each handshake (so not just a compile time flag or system property). I think this is equivalent to adding an additional return value to the openssl callbacks?

In the case of ALPN we used the no_application_protocol(120) alert and in the case of NPN we used the handshake_failure(40) alert to fail the handshake (if callbacks indicated a failure was desired).

from openssl.

Any updates or thoughts on this?

from openssl.

Now that HTTP/2 has been published as an RFC (and ALPN is already an RFC)....is there any chance of this getting re-prioritized?

from openssl.

yeah, it probably should be. can you bring it up on openssl-dev?

from openssl.

@richsalz - Done. Haven't received feedback that the post went through yet though. Not sure if I'm required to join before posting or if the post has to be reviewed before it makes it to the archives.

from openssl.

ah, yeah, you have to be a member of the list to post. i think nabble has a UI that lets you post

from openssl.

@richsalz - Join request sent.

from openssl.

Question posted to mailing list http://marc.info/?l=openssl-dev&m=143285528815940&w=2

from openssl.

See also http://rt.openssl.org/Ticket/Display.html?id=3463 (user/pass guest/guest)

from openssl.

@richsalz - I checked out the patch and it looks good. The only thing from your point of view is whether you want to make the fatal alert failure behavior in s_server optional or not. This would be to preserve existing behavior, even though it goes against the spec.

What is the timeline on evaluating / merging / targeting this for a release?

from openssl.

Finally closing this in 1.1; we'll send the alert. code to land in repo shortly.

from openssl.

@richsalz - Thanks for the update! So this will not land in a 1.0.2 release?

from openssl.

nope. sorry.

from openssl.

It was done in 1.1.0 and later. not backported as faras i know.

from openssl.