Add support for ALPN.

Based on OpenSSL and BoringSSL.

ok bcook@

10 files changed, 594 insertions, 16 deletions

diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index f2d2cb040d..9897fba6c5 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.85 2014/11/18 05:33:43 miod Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.86 2014/12/10 14:58:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1905,6 +1905,8 @@ ssl3_free(SSL *s)
                 sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
         BIO_free(s->s3->handshake_buffer);
         ssl3_free_digest_list(s);
+        free(s->s3->alpn_selected);
+
         OPENSSL_cleanse(s->s3, sizeof *s->s3);
         free(s->s3);
         s->s3 = NULL;
@@ -1939,6 +1941,9 @@ ssl3_clear(SSL *s)
 
         ssl3_free_digest_list(s);
 
+        free(s->s3->alpn_selected);
+        s->s3->alpn_selected = NULL;
+
         memset(s->s3, 0, sizeof *s->s3);
         s->s3->rbuf.buf = rp;
         s->s3->wbuf.buf = wp;
diff --git a/src/lib/libssl/src/ssl/s3_lib.c b/src/lib/libssl/src/ssl/s3_lib.c
index f2d2cb040d..9897fba6c5 100644
--- a/src/lib/libssl/src/ssl/s3_lib.c
+++ b/src/lib/libssl/src/ssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.85 2014/11/18 05:33:43 miod Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.86 2014/12/10 14:58:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1905,6 +1905,8 @@ ssl3_free(SSL *s)
                 sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
         BIO_free(s->s3->handshake_buffer);
         ssl3_free_digest_list(s);
+        free(s->s3->alpn_selected);
+
         OPENSSL_cleanse(s->s3, sizeof *s->s3);
         free(s->s3);
         s->s3 = NULL;
@@ -1939,6 +1941,9 @@ ssl3_clear(SSL *s)
 
         ssl3_free_digest_list(s);
 
+        free(s->s3->alpn_selected);
+        s->s3->alpn_selected = NULL;
+
         memset(s->s3, 0, sizeof *s->s3);
         s->s3->rbuf.buf = rp;
         s->s3->wbuf.buf = wp;
diff --git a/src/lib/libssl/src/ssl/ssl.h b/src/lib/libssl/src/ssl/ssl.h
index e8388923a4..0059da6791 100644
--- a/src/lib/libssl/src/ssl/ssl.h
+++ b/src/lib/libssl/src/ssl/ssl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl.h,v 1.74 2014/12/10 14:51:00 bcook Exp $ */
+/* $OpenBSD: ssl.h,v 1.75 2014/12/10 14:58:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -861,9 +861,33 @@ struct ssl_ctx_st {
             unsigned int inlen, void *arg);
         void *next_proto_select_cb_arg;
 # endif
+
+        /*
+         * ALPN information
+         * (we are in the process of transitioning from NPN to ALPN).
+         */
+
+        /*
+         * Server callback function that allows the server to select the
+         * protocol for the connection.
+         *   out: on successful return, this must point to the raw protocol
+         *       name (without the length prefix).
+         *   outlen: on successful return, this contains the length of out.
+         *   in: points to the client's list of supported protocols in
+         *       wire-format.
+         *   inlen: the length of in.
+         */
+        int (*alpn_select_cb)(SSL *s, const unsigned char **out,
+            unsigned char *outlen, const unsigned char *in, unsigned int inlen,
+            void *arg);
+        void *alpn_select_cb_arg;
+
+        /* Client list of supported protocols in wire format. */
+        unsigned char *alpn_client_proto_list;
+        unsigned int alpn_client_proto_list_len;
+
         /* SRTP profiles we are willing to do from RFC 5764 */
         STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
-
 };
 
 #endif
@@ -954,6 +978,15 @@ void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data,
 #define OPENSSL_NPN_NO_OVERLAP  2
 #endif
 
+int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
+    unsigned int protos_len);
+int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,
+    unsigned int protos_len);
+void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
+    int (*cb)(SSL *ssl, const unsigned char **out, unsigned char *outlen,
+    const unsigned char *in, unsigned int inlen, void *arg), void *arg);
+void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
+    unsigned int *len);
 
 #define SSL_NOTHING     1
 #define SSL_WRITING     2
@@ -1187,6 +1220,10 @@ struct ssl_st {
         unsigned int tlsext_hb_pending; /* Indicates if a HeartbeatRequest is in flight */
         unsigned int tlsext_hb_seq;     /* HeartbeatRequest sequence number */
 
+        /* Client list of supported protocols in wire format. */
+        unsigned char *alpn_client_proto_list;
+        unsigned int alpn_client_proto_list_len;
+
         int renegotiate;/* 1 if we are renegotiating.
                          * 2 if we are a server and are inside a handshake
                          * (i.e. not just sending a HelloRequest) */
diff --git a/src/lib/libssl/src/ssl/ssl3.h b/src/lib/libssl/src/ssl/ssl3.h
index 5b9e31754b..2055f0f834 100644
--- a/src/lib/libssl/src/ssl/ssl3.h
+++ b/src/lib/libssl/src/ssl/ssl3.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl3.h,v 1.29 2014/11/18 05:33:43 miod Exp $ */
+/* $OpenBSD: ssl3.h,v 1.30 2014/12/10 14:58:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -497,6 +497,20 @@ typedef struct ssl3_state_st {
         int next_proto_neg_seen;
 #endif
 
+        /*
+         * ALPN information
+         * (we are in the process of transitioning from NPN to ALPN).
+         */
+
+        /*
+         * In a server these point to the selected ALPN protocol after the
+         * ClientHello has been processed. In a client these contain the
+         * protocol that the server selected once the ServerHello has been
+         * processed.
+         */
+        unsigned char *alpn_selected;
+        unsigned int alpn_selected_len;
+
         /* This is set to true if we believe that this is a version of Safari
          * running on OS X 10.6 or newer. We wish to know this because Safari
          * on 10.8 .. 10.8.3 has broken ECDHE-ECDSA support. */
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index bdd47ff87f..a03ee735ad 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.90 2014/11/16 14:12:47 jsing Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.91 2014/12/10 14:58:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -337,6 +337,18 @@ SSL_new(SSL_CTX *ctx)
         s->next_proto_negotiated = NULL;
 # endif
 
+        if (s->ctx->alpn_client_proto_list != NULL) {
+                s->alpn_client_proto_list =
+                    malloc(s->ctx->alpn_client_proto_list_len);
+                if (s->alpn_client_proto_list == NULL)
+                        goto err;
+                memcpy(s->alpn_client_proto_list,
+                    s->ctx->alpn_client_proto_list,
+                    s->ctx->alpn_client_proto_list_len);
+                s->alpn_client_proto_list_len =
+                    s->ctx->alpn_client_proto_list_len;
+        }
+
         s->verify_result = X509_V_OK;
 
         s->method = ctx->method;
@@ -551,6 +563,7 @@ SSL_free(SSL *s)
 #ifndef OPENSSL_NO_NEXTPROTONEG
         free(s->next_proto_negotiated);
 #endif
+        free(s->alpn_client_proto_list);
 
 #ifndef OPENSSL_NO_SRTP
         if (s->srtp_profiles)
@@ -1629,6 +1642,75 @@ SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s,
 }
 # endif
 
+/*
+ * SSL_CTX_set_alpn_protos sets the ALPN protocol list to the specified
+ * protocols, which must be in wire-format (i.e. a series of non-empty,
+ * 8-bit length-prefixed strings). Returns 0 on success.
+ */
+int
+SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
+    unsigned int protos_len)
+{
+        free(ctx->alpn_client_proto_list);
+        if ((ctx->alpn_client_proto_list = malloc(protos_len)) == NULL)
+                return (1);
+        memcpy(ctx->alpn_client_proto_list, protos, protos_len);
+        ctx->alpn_client_proto_list_len = protos_len;
+
+        return (0);
+}
+
+/*
+ * SSL_set_alpn_protos sets the ALPN protocol list to the specified
+ * protocols, which must be in wire-format (i.e. a series of non-empty,
+ * 8-bit length-prefixed strings). Returns 0 on success.
+ */
+int
+SSL_set_alpn_protos(SSL *ssl, const unsigned char* protos,
+    unsigned int protos_len)
+{
+        free(ssl->alpn_client_proto_list);
+        if ((ssl->alpn_client_proto_list = malloc(protos_len)) == NULL)
+                return (1);
+        memcpy(ssl->alpn_client_proto_list, protos, protos_len);
+        ssl->alpn_client_proto_list_len = protos_len;
+
+        return (0);
+}
+
+/*
+ * SSL_CTX_set_alpn_select_cb sets a callback function that is called during
+ * ClientHello processing in order to select an ALPN protocol from the
+ * client's list of offered protocols.
+ */
+void
+SSL_CTX_set_alpn_select_cb(SSL_CTX* ctx,
+    int (*cb) (SSL *ssl, const unsigned char **out, unsigned char *outlen,
+    const unsigned char *in, unsigned int inlen, void *arg), void *arg)
+{
+        ctx->alpn_select_cb = cb;
+        ctx->alpn_select_cb_arg = arg;
+}
+
+/*
+ * SSL_get0_alpn_selected gets the selected ALPN protocol (if any). On return
+ * it sets data to point to len bytes of protocol name (not including the
+ * leading length-prefix byte). If the server didn't respond with* a negotiated
+ * protocol then len will be zero.
+ */
+void
+SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
+    unsigned *len)
+{
+        *data = NULL;
+        *len = 0;
+
+        if (ssl->s3 != NULL) {
+                *data = ssl->s3->alpn_selected;
+                *len = ssl->s3->alpn_selected_len;
+        }
+}
+
 int
 SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
     const char *label, size_t llen, const unsigned char *p, size_t plen,
@@ -1894,6 +1976,8 @@ SSL_CTX_free(SSL_CTX *a)
                 ENGINE_finish(a->client_cert_engine);
 #endif
 
+        free(a->alpn_client_proto_list);
+
         free(a);
 }
 
diff --git a/src/lib/libssl/src/ssl/t1_lib.c b/src/lib/libssl/src/ssl/t1_lib.c
index 8a7553e3e7..5df45ab359 100644
--- a/src/lib/libssl/src/ssl/t1_lib.c
+++ b/src/lib/libssl/src/ssl/t1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_lib.c,v 1.71 2014/12/06 13:51:06 jsing Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.72 2014/12/10 14:58:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -878,6 +878,18 @@ skip_ext:
         }
 #endif
 
+        if (s->alpn_client_proto_list != NULL &&
+            s->s3->tmp.finish_md_len == 0) {
+                if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
+                        return (NULL);
+                s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
+                s2n(2 + s->alpn_client_proto_list_len, ret);
+                s2n(s->alpn_client_proto_list_len, ret);
+                memcpy(ret, s->alpn_client_proto_list,
+                    s->alpn_client_proto_list_len);
+                ret += s->alpn_client_proto_list_len;
+        }
+
 #ifndef OPENSSL_NO_SRTP
         if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)) {
                 int el;
@@ -1107,6 +1119,20 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
         }
 #endif
 
+        if (s->s3->alpn_selected != NULL) {
+                const unsigned char *selected = s->s3->alpn_selected;
+                unsigned int len = s->s3->alpn_selected_len;
+
+                if ((long)(limit - ret - 4 - 2 - 1 - len) < 0)
+                        return (NULL);
+                s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
+                s2n(3 + len, ret);
+                s2n(1 + len, ret);
+                *ret++ = len;
+                memcpy(ret, selected, len);
+                ret += len;
+        }
+
         if ((extdatalen = ret - p - 2) == 0)
                 return p;
 
@@ -1114,6 +1140,76 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
         return ret;
 }
 
+/*
+ * tls1_alpn_handle_client_hello is called to process the ALPN extension in a
+ * ClientHello.
+ *   data: the contents of the extension, not including the type and length.
+ *   data_len: the number of bytes in data.
+ *   al: a pointer to the alert value to send in the event of a non-zero
+ *       return.
+ *   returns: 1 on success.
+ */
+static int
+tls1_alpn_handle_client_hello(SSL *s, const unsigned char *data,
+    unsigned int data_len, int *al)
+{
+        const unsigned char *selected;
+        unsigned char selected_len;
+        unsigned int proto_len;
+        unsigned int i;
+        int r;
+
+        if (s->ctx->alpn_select_cb == NULL)
+                return (1);
+
+        if (data_len < 2)
+                goto parse_error;
+
+        /*
+         * data should contain a uint16 length followed by a series of 8-bit,
+         * length-prefixed strings.
+         */
+        i = ((unsigned int)data[0]) << 8 | ((unsigned int)data[1]);
+        data_len -= 2;
+        data += 2;
+        if (data_len != i)
+                goto parse_error;
+
+        if (data_len < 2)
+                goto parse_error;
+
+        for (i = 0; i < data_len; ) {
+                proto_len = data[i];
+                i++;
+
+                if (proto_len == 0)
+                        goto parse_error;
+
+                if (i + proto_len < i || i + proto_len > data_len)
+                        goto parse_error;
+
+                i += proto_len;
+        }
+
+        r = s->ctx->alpn_select_cb(s, &selected, &selected_len,
+            data, data_len, s->ctx->alpn_select_cb_arg);
+        if (r == SSL_TLSEXT_ERR_OK) {
+                free(s->s3->alpn_selected);
+                if ((s->s3->alpn_selected = malloc(selected_len)) == NULL) {
+                        *al = SSL_AD_INTERNAL_ERROR;
+                        return (-1);
+                }
+                memcpy(s->s3->alpn_selected, selected, selected_len);
+                s->s3->alpn_selected_len = selected_len;
+        }
+
+        return (1);
+
+parse_error:
+        *al = SSL_AD_DECODE_ERROR;
+        return (0);
+}
+
 /* ssl_check_for_safari attempts to fingerprint Safari using OS X
  * SecureTransport using the TLS extension block in |d|, of length |n|.
  * Safari, since 10.6, sends exactly these extensions, in this order:
@@ -1211,6 +1307,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 #ifndef OPENSSL_NO_NEXTPROTONEG
         s->s3->next_proto_neg_seen = 0;
 #endif
+        free(s->s3->alpn_selected);
+        s->s3->alpn_selected = NULL;
 
         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
                 ssl_check_for_safari(s, data, d, n);
@@ -1520,7 +1618,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                 }
 #ifndef OPENSSL_NO_NEXTPROTONEG
                 else if (type == TLSEXT_TYPE_next_proto_neg &&
-                    s->s3->tmp.finish_md_len == 0) {
+                    s->s3->tmp.finish_md_len == 0 &&
+                    s->s3->alpn_selected == NULL) {
                         /* We shouldn't accept this extension on a
                          * renegotiation.
                          *
@@ -1539,6 +1638,16 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                         s->s3->next_proto_neg_seen = 1;
                 }
 #endif
+                else if (type ==
+                    TLSEXT_TYPE_application_layer_protocol_negotiation &&
+                    s->ctx->alpn_select_cb != NULL &&
+                    s->s3->tmp.finish_md_len == 0) {
+                        if (tls1_alpn_handle_client_hello(s, data,
+                            size, al) != 1)
+                                return (0);
+                        /* ALPN takes precedence over NPN. */
+                        s->s3->next_proto_neg_seen = 0;
+                }
 
                 /* session ticket processed earlier */
 #ifndef OPENSSL_NO_SRTP
@@ -1601,6 +1710,8 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 #ifndef OPENSSL_NO_NEXTPROTONEG
         s->s3->next_proto_neg_seen = 0;
 #endif
+        free(s->s3->alpn_selected);
+        s->s3->alpn_selected = NULL;
 
         if (data >= (d + n - 2))
                 goto ri_check;
@@ -1716,7 +1827,45 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                         s->s3->next_proto_neg_seen = 1;
                 }
 #endif
-                else if (type == TLSEXT_TYPE_renegotiate) {
+                else if (type ==
+                    TLSEXT_TYPE_application_layer_protocol_negotiation) {
+                        unsigned int len;
+
+                        /* We must have requested it. */
+                        if (s->alpn_client_proto_list == NULL) {
+                                *al = TLS1_AD_UNSUPPORTED_EXTENSION;
+                                return 0;
+                        }
+                        if (size < 4) {
+                                *al = TLS1_AD_DECODE_ERROR;
+                                return (0);
+                        }
+
+                        /* The extension data consists of:
+                         *   uint16 list_length
+                         *   uint8 proto_length;
+                         *   uint8 proto[proto_length]; */
+                        len = ((unsigned int)data[0]) << 8 |
+                            ((unsigned int)data[1]);
+                        if (len != (unsigned int)size - 2) {
+                                *al = TLS1_AD_DECODE_ERROR;
+                                return (0);
+                        }
+                        len = data[2];
+                        if (len != (unsigned int)size - 3) {
+                                *al = TLS1_AD_DECODE_ERROR;
+                                return (0);
+                        }
+                        free(s->s3->alpn_selected);
+                        s->s3->alpn_selected = malloc(len);
+                        if (s->s3->alpn_selected == NULL) {
+                                *al = TLS1_AD_INTERNAL_ERROR;
+                                return (0);
+                        }
+                        memcpy(s->s3->alpn_selected, data + 3, len);
+                        s->s3->alpn_selected_len = len;
+
+                } else if (type == TLSEXT_TYPE_renegotiate) {
                         if (!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
                                 return 0;
                         renegotiate_seen = 1;
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index e8388923a4..0059da6791 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl.h,v 1.74 2014/12/10 14:51:00 bcook Exp $ */
+/* $OpenBSD: ssl.h,v 1.75 2014/12/10 14:58:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -861,9 +861,33 @@ struct ssl_ctx_st {
             unsigned int inlen, void *arg);
         void *next_proto_select_cb_arg;
 # endif
+
+        /*
+         * ALPN information
+         * (we are in the process of transitioning from NPN to ALPN).
+         */
+
+        /*
+         * Server callback function that allows the server to select the
+         * protocol for the connection.
+         *   out: on successful return, this must point to the raw protocol
+         *       name (without the length prefix).
+         *   outlen: on successful return, this contains the length of out.
+         *   in: points to the client's list of supported protocols in
+         *       wire-format.
+         *   inlen: the length of in.
+         */
+        int (*alpn_select_cb)(SSL *s, const unsigned char **out,
+            unsigned char *outlen, const unsigned char *in, unsigned int inlen,
+            void *arg);
+        void *alpn_select_cb_arg;
+
+        /* Client list of supported protocols in wire format. */
+        unsigned char *alpn_client_proto_list;
+        unsigned int alpn_client_proto_list_len;
+
         /* SRTP profiles we are willing to do from RFC 5764 */
         STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
-
 };
 
 #endif
@@ -954,6 +978,15 @@ void SSL_get0_next_proto_negotiated(const SSL *s, const unsigned char **data,
 #define OPENSSL_NPN_NO_OVERLAP  2
 #endif
 
+int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
+    unsigned int protos_len);
+int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,
+    unsigned int protos_len);
+void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
+    int (*cb)(SSL *ssl, const unsigned char **out, unsigned char *outlen,
+    const unsigned char *in, unsigned int inlen, void *arg), void *arg);
+void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
+    unsigned int *len);
 
 #define SSL_NOTHING     1
 #define SSL_WRITING     2
@@ -1187,6 +1220,10 @@ struct ssl_st {
         unsigned int tlsext_hb_pending; /* Indicates if a HeartbeatRequest is in flight */
         unsigned int tlsext_hb_seq;     /* HeartbeatRequest sequence number */
 
+        /* Client list of supported protocols in wire format. */
+        unsigned char *alpn_client_proto_list;
+        unsigned int alpn_client_proto_list_len;
+
         int renegotiate;/* 1 if we are renegotiating.
                          * 2 if we are a server and are inside a handshake
                          * (i.e. not just sending a HelloRequest) */
diff --git a/src/lib/libssl/ssl3.h b/src/lib/libssl/ssl3.h
index 5b9e31754b..2055f0f834 100644
--- a/src/lib/libssl/ssl3.h
+++ b/src/lib/libssl/ssl3.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl3.h,v 1.29 2014/11/18 05:33:43 miod Exp $ */
+/* $OpenBSD: ssl3.h,v 1.30 2014/12/10 14:58:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -497,6 +497,20 @@ typedef struct ssl3_state_st {
         int next_proto_neg_seen;
 #endif
 
+        /*
+         * ALPN information
+         * (we are in the process of transitioning from NPN to ALPN).
+         */
+
+        /*
+         * In a server these point to the selected ALPN protocol after the
+         * ClientHello has been processed. In a client these contain the
+         * protocol that the server selected once the ServerHello has been
+         * processed.
+         */
+        unsigned char *alpn_selected;
+        unsigned int alpn_selected_len;
+
         /* This is set to true if we believe that this is a version of Safari
          * running on OS X 10.6 or newer. We wish to know this because Safari
          * on 10.8 .. 10.8.3 has broken ECDHE-ECDSA support. */
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index bdd47ff87f..a03ee735ad 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.90 2014/11/16 14:12:47 jsing Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.91 2014/12/10 14:58:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -337,6 +337,18 @@ SSL_new(SSL_CTX *ctx)
         s->next_proto_negotiated = NULL;
 # endif
 
+        if (s->ctx->alpn_client_proto_list != NULL) {
+                s->alpn_client_proto_list =
+                    malloc(s->ctx->alpn_client_proto_list_len);
+                if (s->alpn_client_proto_list == NULL)
+                        goto err;
+                memcpy(s->alpn_client_proto_list,
+                    s->ctx->alpn_client_proto_list,
+                    s->ctx->alpn_client_proto_list_len);
+                s->alpn_client_proto_list_len =
+                    s->ctx->alpn_client_proto_list_len;
+        }
+
         s->verify_result = X509_V_OK;
 
         s->method = ctx->method;
@@ -551,6 +563,7 @@ SSL_free(SSL *s)
 #ifndef OPENSSL_NO_NEXTPROTONEG
         free(s->next_proto_negotiated);
 #endif
+        free(s->alpn_client_proto_list);
 
 #ifndef OPENSSL_NO_SRTP
         if (s->srtp_profiles)
@@ -1629,6 +1642,75 @@ SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s,
 }
 # endif
 
+/*
+ * SSL_CTX_set_alpn_protos sets the ALPN protocol list to the specified
+ * protocols, which must be in wire-format (i.e. a series of non-empty,
+ * 8-bit length-prefixed strings). Returns 0 on success.
+ */
+int
+SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
+    unsigned int protos_len)
+{
+        free(ctx->alpn_client_proto_list);
+        if ((ctx->alpn_client_proto_list = malloc(protos_len)) == NULL)
+                return (1);
+        memcpy(ctx->alpn_client_proto_list, protos, protos_len);
+        ctx->alpn_client_proto_list_len = protos_len;
+
+        return (0);
+}
+
+/*
+ * SSL_set_alpn_protos sets the ALPN protocol list to the specified
+ * protocols, which must be in wire-format (i.e. a series of non-empty,
+ * 8-bit length-prefixed strings). Returns 0 on success.
+ */
+int
+SSL_set_alpn_protos(SSL *ssl, const unsigned char* protos,
+    unsigned int protos_len)
+{
+        free(ssl->alpn_client_proto_list);
+        if ((ssl->alpn_client_proto_list = malloc(protos_len)) == NULL)
+                return (1);
+        memcpy(ssl->alpn_client_proto_list, protos, protos_len);
+        ssl->alpn_client_proto_list_len = protos_len;
+
+        return (0);
+}
+
+/*
+ * SSL_CTX_set_alpn_select_cb sets a callback function that is called during
+ * ClientHello processing in order to select an ALPN protocol from the
+ * client's list of offered protocols.
+ */
+void
+SSL_CTX_set_alpn_select_cb(SSL_CTX* ctx,
+    int (*cb) (SSL *ssl, const unsigned char **out, unsigned char *outlen,
+    const unsigned char *in, unsigned int inlen, void *arg), void *arg)
+{
+        ctx->alpn_select_cb = cb;
+        ctx->alpn_select_cb_arg = arg;
+}
+
+/*
+ * SSL_get0_alpn_selected gets the selected ALPN protocol (if any). On return
+ * it sets data to point to len bytes of protocol name (not including the
+ * leading length-prefix byte). If the server didn't respond with* a negotiated
+ * protocol then len will be zero.
+ */
+void
+SSL_get0_alpn_selected(const SSL *ssl, const unsigned char **data,
+    unsigned *len)
+{
+        *data = NULL;
+        *len = 0;
+
+        if (ssl->s3 != NULL) {
+                *data = ssl->s3->alpn_selected;
+                *len = ssl->s3->alpn_selected_len;
+        }
+}
+
 int
 SSL_export_keying_material(SSL *s, unsigned char *out, size_t olen,
     const char *label, size_t llen, const unsigned char *p, size_t plen,
@@ -1894,6 +1976,8 @@ SSL_CTX_free(SSL_CTX *a)
                 ENGINE_finish(a->client_cert_engine);
 #endif
 
+        free(a->alpn_client_proto_list);
+
         free(a);
 }
 
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 8a7553e3e7..5df45ab359 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_lib.c,v 1.71 2014/12/06 13:51:06 jsing Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.72 2014/12/10 14:58:56 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -878,6 +878,18 @@ skip_ext:
         }
 #endif
 
+        if (s->alpn_client_proto_list != NULL &&
+            s->s3->tmp.finish_md_len == 0) {
+                if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
+                        return (NULL);
+                s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
+                s2n(2 + s->alpn_client_proto_list_len, ret);
+                s2n(s->alpn_client_proto_list_len, ret);
+                memcpy(ret, s->alpn_client_proto_list,
+                    s->alpn_client_proto_list_len);
+                ret += s->alpn_client_proto_list_len;
+        }
+
 #ifndef OPENSSL_NO_SRTP
         if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)) {
                 int el;
@@ -1107,6 +1119,20 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
         }
 #endif
 
+        if (s->s3->alpn_selected != NULL) {
+                const unsigned char *selected = s->s3->alpn_selected;
+                unsigned int len = s->s3->alpn_selected_len;
+
+                if ((long)(limit - ret - 4 - 2 - 1 - len) < 0)
+                        return (NULL);
+                s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
+                s2n(3 + len, ret);
+                s2n(1 + len, ret);
+                *ret++ = len;
+                memcpy(ret, selected, len);
+                ret += len;
+        }
+
         if ((extdatalen = ret - p - 2) == 0)
                 return p;
 
@@ -1114,6 +1140,76 @@ ssl_add_serverhello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
         return ret;
 }
 
+/*
+ * tls1_alpn_handle_client_hello is called to process the ALPN extension in a
+ * ClientHello.
+ *   data: the contents of the extension, not including the type and length.
+ *   data_len: the number of bytes in data.
+ *   al: a pointer to the alert value to send in the event of a non-zero
+ *       return.
+ *   returns: 1 on success.
+ */
+static int
+tls1_alpn_handle_client_hello(SSL *s, const unsigned char *data,
+    unsigned int data_len, int *al)
+{
+        const unsigned char *selected;
+        unsigned char selected_len;
+        unsigned int proto_len;
+        unsigned int i;
+        int r;
+
+        if (s->ctx->alpn_select_cb == NULL)
+                return (1);
+
+        if (data_len < 2)
+                goto parse_error;
+
+        /*
+         * data should contain a uint16 length followed by a series of 8-bit,
+         * length-prefixed strings.
+         */
+        i = ((unsigned int)data[0]) << 8 | ((unsigned int)data[1]);
+        data_len -= 2;
+        data += 2;
+        if (data_len != i)
+                goto parse_error;
+
+        if (data_len < 2)
+                goto parse_error;
+
+        for (i = 0; i < data_len; ) {
+                proto_len = data[i];
+                i++;
+
+                if (proto_len == 0)
+                        goto parse_error;
+
+                if (i + proto_len < i || i + proto_len > data_len)
+                        goto parse_error;
+
+                i += proto_len;
+        }
+
+        r = s->ctx->alpn_select_cb(s, &selected, &selected_len,
+            data, data_len, s->ctx->alpn_select_cb_arg);
+        if (r == SSL_TLSEXT_ERR_OK) {
+                free(s->s3->alpn_selected);
+                if ((s->s3->alpn_selected = malloc(selected_len)) == NULL) {
+                        *al = SSL_AD_INTERNAL_ERROR;
+                        return (-1);
+                }
+                memcpy(s->s3->alpn_selected, selected, selected_len);
+                s->s3->alpn_selected_len = selected_len;
+        }
+
+        return (1);
+
+parse_error:
+        *al = SSL_AD_DECODE_ERROR;
+        return (0);
+}
+
 /* ssl_check_for_safari attempts to fingerprint Safari using OS X
  * SecureTransport using the TLS extension block in |d|, of length |n|.
  * Safari, since 10.6, sends exactly these extensions, in this order:
@@ -1211,6 +1307,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 #ifndef OPENSSL_NO_NEXTPROTONEG
         s->s3->next_proto_neg_seen = 0;
 #endif
+        free(s->s3->alpn_selected);
+        s->s3->alpn_selected = NULL;
 
         if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)
                 ssl_check_for_safari(s, data, d, n);
@@ -1520,7 +1618,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                 }
 #ifndef OPENSSL_NO_NEXTPROTONEG
                 else if (type == TLSEXT_TYPE_next_proto_neg &&
-                    s->s3->tmp.finish_md_len == 0) {
+                    s->s3->tmp.finish_md_len == 0 &&
+                    s->s3->alpn_selected == NULL) {
                         /* We shouldn't accept this extension on a
                          * renegotiation.
                          *
@@ -1539,6 +1638,16 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                         s->s3->next_proto_neg_seen = 1;
                 }
 #endif
+                else if (type ==
+                    TLSEXT_TYPE_application_layer_protocol_negotiation &&
+                    s->ctx->alpn_select_cb != NULL &&
+                    s->s3->tmp.finish_md_len == 0) {
+                        if (tls1_alpn_handle_client_hello(s, data,
+                            size, al) != 1)
+                                return (0);
+                        /* ALPN takes precedence over NPN. */
+                        s->s3->next_proto_neg_seen = 0;
+                }
 
                 /* session ticket processed earlier */
 #ifndef OPENSSL_NO_SRTP
@@ -1601,6 +1710,8 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 #ifndef OPENSSL_NO_NEXTPROTONEG
         s->s3->next_proto_neg_seen = 0;
 #endif
+        free(s->s3->alpn_selected);
+        s->s3->alpn_selected = NULL;
 
         if (data >= (d + n - 2))
                 goto ri_check;
@@ -1716,7 +1827,45 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                         s->s3->next_proto_neg_seen = 1;
                 }
 #endif
-                else if (type == TLSEXT_TYPE_renegotiate) {
+                else if (type ==
+                    TLSEXT_TYPE_application_layer_protocol_negotiation) {
+                        unsigned int len;
+
+                        /* We must have requested it. */
+                        if (s->alpn_client_proto_list == NULL) {
+                                *al = TLS1_AD_UNSUPPORTED_EXTENSION;
+                                return 0;
+                        }
+                        if (size < 4) {
+                                *al = TLS1_AD_DECODE_ERROR;
+                                return (0);
+                        }
+
+                        /* The extension data consists of:
+                         *   uint16 list_length
+                         *   uint8 proto_length;
+                         *   uint8 proto[proto_length]; */
+                        len = ((unsigned int)data[0]) << 8 |
+                            ((unsigned int)data[1]);
+                        if (len != (unsigned int)size - 2) {
+                                *al = TLS1_AD_DECODE_ERROR;
+                                return (0);
+                        }
+                        len = data[2];
+                        if (len != (unsigned int)size - 3) {
+                                *al = TLS1_AD_DECODE_ERROR;
+                                return (0);
+                        }
+                        free(s->s3->alpn_selected);
+                        s->s3->alpn_selected = malloc(len);
+                        if (s->s3->alpn_selected == NULL) {
+                                *al = TLS1_AD_INTERNAL_ERROR;
+                                return (0);
+                        }
+                        memcpy(s->s3->alpn_selected, data + 3, len);
+                        s->s3->alpn_selected_len = len;
+
+                } else if (type == TLSEXT_TYPE_renegotiate) {
                         if (!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
                                 return 0;
                         renegotiate_seen = 1;