GH787: Fix ALPN

* Perform ALPN after the SNI callback; the SSL_CTX may change due to
  that processing
* Add flags to indicate that we actually sent ALPN, to properly error
  out if unexpectedly received.
* clean up ssl3_free() no need to explicitly clear when doing memset
* document ALPN functions

Signed-off-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Emilia Käsper <emilia@openssl.org>

1 files changed, 50 insertions, 14 deletions

diff --git a/test/recipes/80-test_ssl.t b/test/recipes/80-test_ssl.t
index 37237dc087..5412cb6832 100644
--- a/test/recipes/80-test_ssl.t
+++ b/test/recipes/80-test_ssl.t
@@ -64,7 +64,7 @@ my $P2intermediate="tmp_intP2.ss";
 plan tests =>
     1				# For testss
     + 1				# For ssltest -test_cipherlist
-    + 11			# For the first testssl
+    + 13			# For the first testssl
     + 16			# For the first testsslproxy
     + 16			# For the second testsslproxy
     ;
@@ -603,10 +603,29 @@ sub testssl {
 	}
     };
 
+    subtest 'SNI tests' => sub {
+
+	plan tests => 7;
+
+      SKIP: {
+	  skip "TLSv1.x is not supported by this OpenSSL build", 7
+	      if $no_tls1 && $no_tls1_1 && $no_tls1_2;
+
+	  ok(run(test([@ssltest, "-bio_pair", "-sn_client", "foo"])));
+	  ok(run(test([@ssltest, "-bio_pair", "-sn_server1", "foo"])));
+	  ok(run(test([@ssltest, "-bio_pair", "-sn_client", "foo", "-sn_server1", "foo", "-sn_expect1"])));
+	  ok(run(test([@ssltest, "-bio_pair", "-sn_client", "foo", "-sn_server1", "bar", "-sn_expect1"])));
+	  ok(run(test([@ssltest, "-bio_pair", "-sn_client", "foo", "-sn_server1", "foo", "-sn_server2", "bar", "-sn_expect1"])));
+	  ok(run(test([@ssltest, "-bio_pair", "-sn_client", "bar", "-sn_server1", "foo", "-sn_server2", "bar", "-sn_expect2"])));
+	  # Negative test - make sure it doesn't crash, and doesn't switch contexts
+	  ok(run(test([@ssltest, "-bio_pair", "-sn_client", "foobar", "-sn_server1", "foo", "-sn_server2", "bar", "-sn_expect1"])));
+	}
+    };
+
     subtest 'ALPN tests' => sub {
 	######################################################################
 
-	plan tests => 14;
+	plan tests => 12;
 
       SKIP: {
 	  skip "TLSv1.0 is not supported by this OpenSSL build", 12
@@ -626,22 +645,39 @@ sub testssl {
 	  is(run(test([@ssltest, "-bio_pair", "-tls1", "-alpn_client", "baz", "-alpn_server", "bar,foo"])), 0,
              "Testing ALPN with protocol mismatch, expecting failure");
 
-	SKIP: {
-	    skip "skipping SRP tests", 4
-		if $no_srp;
+	  # ALPN + SNI
+	  ok(run(test([@ssltest, "-bio_pair",
+		       "-alpn_client", "foo,bar", "-sn_client", "alice",
+		       "-alpn_server1", "foo,123", "-sn_server1", "alice",
+		       "-alpn_server2", "bar,456", "-sn_server2", "bob",
+		       "-alpn_expected", "foo"])));
+	  ok(run(test([@ssltest, "-bio_pair",
+		       "-alpn_client", "foo,bar", "-sn_client", "bob",
+		       "-alpn_server1", "foo,123", "-sn_server1", "alice",
+		       "-alpn_server2", "bar,456", "-sn_server2", "bob",
+		       "-alpn_expected", "bar"])));
+	}
+    };
 
-	    ok(run(test([@ssltest, "-tls1", "-cipher", "SRP", "-srpuser", "test", "-srppass", "abc123"])),
-	       'test tls1 with SRP');
+    subtest 'SRP tests' => sub {
 
-	    ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "SRP", "-srpuser", "test", "-srppass", "abc123"])),
-	       'test tls1 with SRP via BIO pair');
+	plan tests => 4;
 
-	    ok(run(test([@ssltest, "-tls1", "-cipher", "aSRP", "-srpuser", "test", "-srppass", "abc123"])),
-		 'test tls1 with SRP auth');
+      SKIP: {
+	  skip "skipping SRP tests", 4
+	      if $no_srp;
 
-	    ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "aSRP", "-srpuser", "test", "-srppass", "abc123"])),
-	       'test tls1 with SRP auth via BIO pair');
-	  }
+	  ok(run(test([@ssltest, "-tls1", "-cipher", "SRP", "-srpuser", "test", "-srppass", "abc123"])),
+	     'test tls1 with SRP');
+
+	  ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "SRP", "-srpuser", "test", "-srppass", "abc123"])),
+	     'test tls1 with SRP via BIO pair');
+
+	  ok(run(test([@ssltest, "-tls1", "-cipher", "aSRP", "-srpuser", "test", "-srppass", "abc123"])),
+	     'test tls1 with SRP auth');
+
+	  ok(run(test([@ssltest, "-bio_pair", "-tls1", "-cipher", "aSRP", "-srpuser", "test", "-srppass", "abc123"])),
+	     'test tls1 with SRP auth via BIO pair');
 	}
     };