Missing getters for alpn_protos

[tiran]

OpenSSL 1.1.0 has no getter to retrieve alpn_client_proto_list from SSL* and SSL_CTX*. Getters would be useful for introspection of context or SSL connection, see https://bugs.python.org/issue32359

I can create a PR after we have decided how the API should look like. Would you prefer:

unsigned SSL_CTX_get_alpn_protos(SSL_CTX *ctx, const unsigned char **protos)
{
    *protos = ctx->alpn_client_proto_list;
    return ctx->alpn_client_proto_list_len;
}

or

int SSL_CTX_get_alpn_protos(SSL_CTX *ctx, const unsigned char **protos, unsigned *protos_len)
{
    *protos = ctx->alpn_client_proto_list;
    *protos_len = ctx->alpn_client_proto_list_len;
    return 0;
}

[richsalz]

My preference is for the second.

[ekasper]

The second also aligns better with SSL_get0_alpn_selected. Use size_t for length instead of unsigned.

If you use an int rather than a void return (which is perhaps prudent to acommodate potential error conditions), please note that the convention (even though old OpenSSL APIs sometimes get it wrong) is 1 for success and 0 for error.

[tiran]

SGTM,

do you prefer a paranoid implementation? Or can I safely assume that the caller is not going to pass NULL to the getter and that alpn_client_proto_list_len is always 0 when alpn_client_proto_list is NULL?

int SSL_CTX_get_alpn_protos(SSL_CTX *ctx, const unsigned char **protos, size_t *protos_len)
{
    if (ctx == NULL) {
        *protos = NULL;
        *protos_len = 0;
        return 0;
    }
    *protos = ctx->alpn_client_proto_list;
    if (*protos == NULL)
        *protos_len = 0;
    else
        *protos_len = (size_t)ctx->alpn_client_proto_list_len;
    return 1;
}

[richsalz]

It should be "get0" because you are passing pointers from an internal data structure. And it's simpler to document that both values are required (nudge, documentation). And if both are required, do NOT do the NULL check.

[mattcaswell]

@tiran - what is the status of this?

[mdebski]

Hi,
any updates?
I'm also interested in that, for TLS-ALPN validation method [0] in ACME protocol (i.e. Let's Encrypt certs)
I may consider implementing it myself if nobody is working on that, and if deemed necessary for my project.

[0] https://github.com/rolandshoemaker/acme-tls-alpn

[mattcaswell]

Not a 1.1.1 specific issue so removing that milestone.