From c087cfb4dd519b837fdf6897a81c00d4bf2fa78e Mon Sep 17 00:00:00 2001 From: tb <> Date: Sat, 29 Aug 2026 05:12:47 +0000 Subject: tlsext: check we reject unadvertised selected protocol This test currently fails and will be fixed in ssl_tlsect.c r1.168 --- src/regress/lib/libssl/tlsext/tlsexttest.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/regress/lib/libssl/tlsext/tlsexttest.c b/src/regress/lib/libssl/tlsext/tlsexttest.c index 9c4c0f55a1..29b348154f 100644 --- a/src/regress/lib/libssl/tlsext/tlsexttest.c +++ b/src/regress/lib/libssl/tlsext/tlsexttest.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tlsexttest.c,v 1.97 2026/04/03 07:37:52 jsing Exp $ */ +/* $OpenBSD: tlsexttest.c,v 1.98 2026/08/29 05:12:47 tb Exp $ */ /* * Copyright (c) 2017 Joel Sing * Copyright (c) 2017 Doug Hogan @@ -153,6 +153,14 @@ const uint8_t tlsext_alpn_single_proto[] = { 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31 }; +const uint8_t tlsext_alpn_single_proto_unadvertised[] = { + /* ProtocolName protocol_name_list<2..2^16-1> -- ALPN names */ + 0x00, 0x09, /* len of all names */ + /* opaque ProtocolName<1..2^8-1> -- 'http/1.2' */ + 0x08, /* len */ + 0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x32 +}; + #define TLSEXT_TYPE_alpn TLSEXT_TYPE_application_layer_protocol_negotiation static int @@ -334,6 +342,21 @@ test_tlsext_alpn_client(void) goto err; } + /* Make sure we don't accept a protocol we did not advertise. */ + + CBS_init(&cbs, tlsext_alpn_single_proto_unadvertised, + sizeof(tlsext_alpn_single_proto_unadvertised)); + + if (client_funcs->process(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) { + FAIL("failed to reject unadvertised ALPN protocol\n"); + goto err; + } + if (alert != SSL_AD_ILLEGAL_PARAMETER) { + FAIL("unadvertised ALPN: want illegal_parameter, got %s\n", + SSL_alert_desc_string_long(alert)); + goto err; + } + /* Make sure we can remove the list and avoid ALPN */ free(ssl->alpn_client_proto_list); -- cgit v1.2.3-55-g6feb