Support a user-provided string for the TLS ALPN extension.

webrtc/rtc_base/openssladapter.cc

 /*
  *  Copyright 2008 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 268 matching lines @@
     : SSLAdapter(socket),
       factory_(factory),
       state_(SSL_NONE),
       role_(SSL_CLIENT),
       ssl_read_needs_write_(false),
       ssl_write_needs_read_(false),
       restartable_(false),
       ssl_(nullptr),
       ssl_ctx_(nullptr),
       ssl_mode_(SSL_MODE_TLS),
+      ignore_bad_cert_(false),
       custom_verification_succeeded_(false) {
   // If a factory is used, take a reference on the factory's SSL_CTX.
   // Otherwise, we'll create our own later.
   // Either way, we'll release our reference via SSL_CTX_free() in Cleanup().
   if (factory_) {
     ssl_ctx_ = factory_->ssl_ctx();
     RTC_DCHECK(ssl_ctx_);
     // Note: if using OpenSSL, requires version 1.1.0 or later.
     SSL_CTX_up_ref(ssl_ctx_);
   }
 }
 
 OpenSSLAdapter::~OpenSSLAdapter() {
   Cleanup();
 }
 
-void OpenSSLAdapter::SetMode(SSLMode mode) {
+void OpenSSLAdapter::SetIgnoreBadCert(bool ignore) {
+  ignore_bad_cert_ = ignore;
+}
+
+void OpenSSLAdapter::SetAlpnProtocols(const std::vector<std::string>& protos) {
+  alpn_protocols_ = protos;
+}
+
+void
+OpenSSLAdapter::SetMode(SSLMode mode) {
   RTC_DCHECK(!ssl_ctx_);
   RTC_DCHECK(state_ == SSL_NONE);
   ssl_mode_ = mode;
 }
 
 void OpenSSLAdapter::SetIdentity(SSLIdentity* identity) {
   RTC_DCHECK(!identity_);
   identity_.reset(static_cast<OpenSSLIdentity*>(identity));
 }
 
 void OpenSSLAdapter::SetRole(SSLRole role) {
   role_ = role;
 }
 
 AsyncSocket* OpenSSLAdapter::Accept(SocketAddress* paddr) {
   RTC_DCHECK(role_ == SSL_SERVER);
   AsyncSocket* socket = SSLAdapter::Accept(paddr);
   if (!socket) {
     return nullptr;
   }
 
   SSLAdapter* adapter = SSLAdapter::Create(socket);
   adapter->SetIdentity(identity_->GetReference());
   adapter->SetRole(rtc::SSL_SERVER);
-  adapter->set_ignore_bad_cert(ignore_bad_cert());
+  adapter->SetIgnoreBadCert(ignore_bad_cert_);
   adapter->StartSSL("", false);
   return adapter;
 }
 
 int OpenSSLAdapter::StartSSL(const char* hostname, bool restartable) {
   if (state_ != SSL_NONE)
     return -1;
 
   ssl_host_name_ = hostname;
   restartable_ = restartable;
@@ skipping 76 matching lines @@
           goto ssl_error;
         }
 
         LOG(LS_INFO) << "Attempting to resume SSL session to "
                      << ssl_host_name_;
       }
     }
   }
 
   // Set a couple common TLS extensions; even though we don't use them yet.
-  // TODO(emadomara) Add ALPN extension.
   SSL_enable_ocsp_stapling(ssl_);
   SSL_enable_signed_cert_timestamps(ssl_);
 
+  if (!alpn_protocols_.empty()) {
+    std::string tls_alpn_string = TransformAlpnProtocols(alpn_protocols_);
+    if (!tls_alpn_string.empty()) {
+      SSL_set_alpn_protos(ssl_,
+        reinterpret_cast<const unsigned char *>(tls_alpn_string.data()),
+        tls_alpn_string.size());
+    }
+  }
+
   // Now that the initial config is done, transfer ownership of |bio| to the
   // SSL object. If ContinueSSL() fails, the bio will be freed in Cleanup().
   SSL_set_bio(ssl_, bio, bio);
   bio = nullptr;
 
   // Do the connect.
   err = ContinueSSL();
   if (err != 0)
     goto ssl_error;
 
@@ skipping 479 matching lines @@
   if (!ok && ignore_bad_cert) {
     LOG(LS_WARNING) << "TLS certificate check FAILED.  "
       << "Allowing connection anyway.";
     ok = true;
   }
 
   return ok;
 }
 
 bool OpenSSLAdapter::SSLPostConnectionCheck(SSL* ssl, const char* host) {
-  bool ok = VerifyServerName(ssl, host, ignore_bad_cert());
+  bool ok = VerifyServerName(ssl, host, ignore_bad_cert_);
 
   if (ok) {
     ok = (SSL_get_verify_result(ssl) == X509_V_OK ||
           custom_verification_succeeded_);
   }
 
-  if (!ok && ignore_bad_cert()) {
+  if (!ok && ignore_bad_cert_) {
     LOG(LS_INFO) << "Other TLS post connection checks failed.";
     ok = true;
   }
 
   return ok;
 }
 
 #if !defined(NDEBUG)
 
 // We only use this for tracing and so it is only needed in debug mode
@@ skipping 54 matching lines @@
     void* cert =
         reinterpret_cast<void*>(X509_STORE_CTX_get_current_cert(store));
     if (custom_verify_callback_(cert)) {
       stream->custom_verification_succeeded_ = true;
       LOG(LS_INFO) << "validated certificate using custom callback";
       ok = true;
     }
   }
 
   // Should only be used for debugging and development.
-  if (!ok && stream->ignore_bad_cert()) {
+  if (!ok && stream->ignore_bad_cert_) {
     LOG(LS_WARNING) << "Ignoring cert error while verifying cert chain";
     ok = 1;
   }
 
   return ok;
 }
 
 int OpenSSLAdapter::NewSSLSessionCallback(SSL* ssl, SSL_SESSION* session) {
   OpenSSLAdapter* stream =
       reinterpret_cast<OpenSSLAdapter*>(SSL_get_app_data(ssl));
@@ skipping 66 matching lines @@
   }
 
   if (enable_cache) {
     SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT);
     SSL_CTX_sess_set_new_cb(ctx, &OpenSSLAdapter::NewSSLSessionCallback);
   }
 
   return ctx;
 }
 
+std::string TransformAlpnProtocols(
+    const std::vector<std::string>& alpn_protocols) {
+  // Transforms the alpn_protocols list to the format expected by
+  // Open/BoringSSL. This requires joining the protocols into a single string
+  // and prepending a character with the size of the protocol string before
+  // each protocol.
+  std::string transformed_alpn;
+  for (const std::string& proto : alpn_protocols) {
+    if (proto.size() == 0 || proto.size() > 0xFF) {
+      LOG(LS_ERROR) << "OpenSSLAdapter::Error("
+                    << "TransformAlpnProtocols received proto with size "
+                    << proto.size() << ")";
+      return "";
+    }
+    transformed_alpn += static_cast<char>(proto.size());
+    transformed_alpn += proto;
+    LOG(LS_VERBOSE) << "TransformAlpnProtocols: Adding proto: " << proto;
+  }
+  return transformed_alpn;
+}
+
 //////////////////////////////////////////////////////////////////////
 // OpenSSLAdapterFactory
 //////////////////////////////////////////////////////////////////////
 
 OpenSSLAdapterFactory::OpenSSLAdapterFactory()
     : ssl_mode_(SSL_MODE_TLS), ssl_ctx_(nullptr) {}
 
 OpenSSLAdapterFactory::~OpenSSLAdapterFactory() {
   for (auto it : sessions_) {
     SSL_SESSION_free(it.second);
@@ skipping 24 matching lines @@
 }
 
 void OpenSSLAdapterFactory::AddSession(const std::string& hostname,
                                        SSL_SESSION* new_session) {
   SSL_SESSION* old_session = LookupSession(hostname);
   SSL_SESSION_free(old_session);
   sessions_[hostname] = new_session;
 }
 
 } // namespace rtc