diff options
| author | tb <> | 2026-08-29 05:12:51 +0000 |
|---|---|---|
| committer | tb <> | 2026-08-29 05:12:51 +0000 |
| commit | c2b41b2fdcfd4ba238da69ff7b5976aa1c4e2dbb (patch) | |
| tree | 3883cbb70d3cda040a107b076036c9870efe2ff2 /src/lib/libcrypto/objects | |
| parent | c087cfb4dd519b837fdf6897a81c00d4bf2fa78e (diff) | |
| download | openbsd-c2b41b2fdcfd4ba238da69ff7b5976aa1c4e2dbb.tar.gz openbsd-c2b41b2fdcfd4ba238da69ff7b5976aa1c4e2dbb.tar.bz2 openbsd-c2b41b2fdcfd4ba238da69ff7b5976aa1c4e2dbb.zip | |
libssl: ensure server selected ALPN was advertised
Per RFC 7301, section 3.2, "In the event that the server supports no
protocols that the client advertises, then the server SHALL respond
with a fatal "no_application_protocol" alert.
If a server does not do that and chooses a protocol that we have not
advertised, we should abort the handshake. The RFC does not specify
an alert for this case. BoringSSL chose illegal_parameter and OpenSSL
decode_error. I slightly prefer illegal_parameter, so went with that.
Reported by Acts1631 with a similar diff.
ok jsing kenjiro
Diffstat (limited to 'src/lib/libcrypto/objects')
0 files changed, 0 insertions, 0 deletions