`ERR_reason_error_string()` returns `NULL` for `no_application_protocol` alert about openssl HOT 5 CLOSED

Ok, fair enough, can you open a PR with the changes reference for review please?

from openssl.

The alert message seems to be correct to me. From the TLS 1.3 RFC

The alert message is one of the values (1,2) (representing warning, fatal), concatenated with the actual message value, in this case no application protocol (defined as 120, both in the rfc, and in the code as TLS1_AD_NO_APPLICATION_PROTOCOL). this matches the value reported in the error you see in your report

The 1 in the 1120 values you are referencing I believe are pre-concatenated values showing both the severity value and the alert value

I believe SSL_R_NO_APPLICATION_PROTOCOL is a library internal error encoding value.

As to the reason this got reported, there is only one reason: The peer on your connection sent an alert message with that value in the alert field. Its a bit odd that you would receive that message while doing an ssl_read, as nominally the ALPN is exchanged as part of the client hello message during the handshake. I suppose its feasible that a peer would allow for no ALPN to be negotiated during the handshake and then error out when none is established during data exchange, but again, odd.

Edit: As for the lack of reason string with the error, it appears there is not number->string mapping that exists inlibssl. there is one in one of the test libraries, but generally speaking tls alerts appear to be reported in the error stack as their numerical values.

from openssl.

Edit: As for the lack of reason string with the error,

Right, this is the focus of my report.

it appears there is not number->string mapping that exists inlibssl.

As far as I can tell, many other alerts get correctly mapped to their reason strings. My patch appears to fix that for this case. (But whether the fix is the correct approach, I don't know.)

from openssl.

@nhorman Done; I've moved my open questions into that PR. Thanks!

from openssl.

Thanks everybody!

from openssl.