Skip to content

1.19.0

Choose a tag to compare

View all tags
@freitasjca freitasjca released this 18 Sep 13:56
· 25 commits to main since this release
1.19.0
b87d8fc

Added

B5 — a no-overlap ALPN refusal now explains itself, identically on every
OpenSSL version.

A peer sharing no ALPN protocol with this client sends a fatal
no_application_protocol alert (alert 120, RFC 7301 §3.2). The handshake fails,
and the client used to report whatever prose the local OpenSSL had for reason
1120:

OpenSSL 3.0.13   ERR=error:0A000460:SSL routines::reason(1120)
OpenSSL 3.6.0    ERR=error:0A000460:SSL routines::tlsv1 alert no application protocol

Same error code, different text. Neither names ALPN, neither names h2, neither
names the endpoint — and the two disagree, so a message seen on one machine is
unsearchable from another.

The refusal is now recognised by its reason code, never its text, and
reported as:

ALPN: 127.0.0.1:19313 refused the handshake - it shares no ALPN protocol with
this client, which offers "h2" only and has no HTTP/1.1 fallback. The peer sent
a fatal no_application_protocol alert (alert 120, RFC 7301 3.2), so the
connection never completed. Use an HTTP/2 server, or h2c (no TlsContext) if the
endpoint is cleartext HTTP/2.

The raw OpenSSL string is retained as evidence rather than discarded.

New public API — all additive

  • NghttpsslLastErrorEx(out ACode): string — text and code from one pop.
    ERR_get_error consumes the entry, so two calls cannot get both.
  • NghttpsslReasonOf(ACode): Cardinal — the version-stable reason field.
  • SSL_R_TLSV1_ALERT_NO_APPLICATION_PROTOCOL = 1120
  • ENghttp2TlsAlpnRefused = class(ENghttp2Tls) — a subclass, so existing
    on E: ENghttp2Tls handlers keep working unchanged.

Upgrading

Nothing that compiled before stops compiling. NghttpsslLastError is unchanged
for its existing callers. The only break is code that matched the text of
this particular failure — and that text was never stable across OpenSSL
versions, which is precisely the defect fixed here.

Verification

Nghttp2AlpnMismatch's nooverlap arm went from 1 assertion to 6, now
demanding the same diagnostic quality as the noalpn arm: ALPN, host, port,
alert 120, and the no-shared-protocol explanation.

The cross-version pair is the evidence: FPC 3.3.1 against OpenSSL 3.0.13 and
Delphi 12 against 3.6.0 render different raw text and produce the identical
diagnosis. noalpn stays at 7 passed, unchanged.

Assets 2
Loading