Do not ignore SSL_TLSEXT_ERR_FATAL from the ALPN callback

As reported by Jeremy Harris, we inherited a strange behavior from
OpenSSL, in that we ignore the SSL_TLSEXT_ERR_FATAL return from the
ALPN callback. RFC 7301, 3.2 states: 'In the event that the server
supports no protocols that the client advertises, then the server
SHALL respond with a fatal "no_application_protocol" alert.'

Honor this requirement and succeed only on SSL_TLSEXT_ERR_{OK,NOACK}
which is the current behavior of OpenSSL. The documentation change
is taken from OpenSSL 1.1.1 as well.

As pointed out by jsing, there is more to be fixed here:
- ensure that the same protocol is selected on session resumption
- should the callback be called even if no ALPN extension was sent?
- ensure for TLSv1.2 and earlier that the SNI has already been processed

ok beck jsing

1 files changed, 4 insertions, 1 deletions

diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index 7da3658d3f..fba9ea243f 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl.h,v 1.201 2021/09/10 08:59:56 tb Exp $ */
+/* $OpenBSD: ssl.h,v 1.202 2021/09/10 09:25:29 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1995,6 +1995,9 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_MISSING_VERIFY_MESSAGE                     174
 #define SSL_R_MULTIPLE_SGC_RESTARTS                      346
 #define SSL_R_NON_SSLV2_INITIAL_PACKET                   175
+#if defined(LIBRESSL_INTERNAL)
+#define SSL_R_NO_APPLICATION_PROTOCOL                    235
+#endif
 #define SSL_R_NO_CERTIFICATES_RETURNED                   176
 #define SSL_R_NO_CERTIFICATE_ASSIGNED                    177
 #define SSL_R_NO_CERTIFICATE_RETURNED                    178