Allow NPN enable on a per-SSL connection basis...

openssl/ssl/ssl_lib.c

 /*! \file ssl/ssl_lib.c
  *  \brief Version independent SSL functions.
  */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
  * 
@@ skipping 306 matching lines @@
         s->tlsext_ticket_expected = 0;
         s->tlsext_status_type = -1;
         s->tlsext_status_expected = 0;
         s->tlsext_ocsp_ids = NULL;
         s->tlsext_ocsp_exts = NULL;
         s->tlsext_ocsp_resp = NULL;
         s->tlsext_ocsp_resplen = -1;
         CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
         s->initial_ctx=ctx;
         s->next_proto_negotiated = NULL;
+        s->next_proto_negotiated_len = 0;
+        s->next_proto_select_cb = ctx->next_proto_select_cb;
+        s->next_proto_select_cb_arg     = ctx->next_proto_select_cb_arg;
 #endif
         s->verify_result=X509_V_OK;
 
         s->method=ctx->method;
 
         if (!s->method->ssl_new(s))
                 goto err;
 
         s->references=1;
         s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1;
@@ skipping 2526 matching lines @@
         ctx->next_protos_advertised_cb = cb;
         ctx->next_protos_advertised_cb_arg = arg;
         }
 
 /* SSL_CTX_set_next_proto_select_cb sets a callback that is called when a
  * client needs to select a protocol from the server's provided list. |out|
  * must be set to point to the selected protocol (which may be within |in|).
  * The length of the protocol name must be written into |outlen|. The server's
  * advertised protocols are provided in |in| and |inlen|. The callback can
  * assume that |in| is syntactically valid.
+ * A side effect of calling this method with a non-NULL |cb| is to enable NPN
+ * for all SSLs subsequently created from this CTX. Passing a NULL |cb| resets
+ * the CTX so future connections will not use NPN.
  *
- * The client must select a protocol. It is fatal to the connection if this
- * callback returns a value other than SSL_TLSEXT_ERR_OK.
+ * When enabled, the client must select a protocol. It is fatal to the
+ * connection if this callback returns a value other than SSL_TLSEXT_ERR_OK.
  */
 void SSL_CTX_set_next_proto_select_cb(SSL_CTX *ctx, int (*cb) (SSL *s, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg), void *arg)
         {
         ctx->next_proto_select_cb = cb;
         ctx->next_proto_select_cb_arg = arg;
         }
 
+/* SSL_set_next_proto_select_cb is a per-connection alternative to
+ * SSL_CTX_set_next_proto_select_cb, see that function for full description of
+ * the parameters.
+ * This method may also be used to modify a CTX default, for example disable
+ * NPN by passing a NULL |cb| or modify the callback argument by passing a
+ * valid |cb| and an updated |arg|.
+ */
+void SSL_set_next_proto_select_cb(SSL *s, int (*cb) (SSL *ssl, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg), void *arg)
+  {
+        s->next_proto_select_cb = cb;
+        s->next_proto_select_cb_arg = arg;
+  }
+
 /* SSL_CTX_set_snap_start_orbit sets the orbit value which will be echoed back
  * to the client and enables Snap Start for this context.
  *
  * An orbit value can be used to spatially partition the state needed to support
  * Snap Start. See the comments above SSL_set_suggested_server_random_validity
  * (below).  */
 void SSL_CTX_set_snap_start_orbit(SSL_CTX *ctx, const unsigned char orbit[8])
         {
         memcpy(ctx->snap_start_orbit, orbit, sizeof(ctx->snap_start_orbit));
         ctx->snap_start_orbit_valid = 1;
@@ skipping 55 matching lines @@
                 (s->state == SSL3_ST_CR_SESSION_TICKET_A ||                 /* ready to write app-data*/
                         s->state == SSL3_ST_CR_FINISHED_A));
         }
 
 #if defined(_WINDLL) && defined(OPENSSL_SYS_WIN16)
 #include "../crypto/bio/bss_file.c"
 #endif
 
 IMPLEMENT_STACK_OF(SSL_CIPHER)
 IMPLEMENT_STACK_OF(SSL_COMP)