fix(tls): fix encoding error when multiple ALPS extensions are present

src/tls/conn/ext.rs

@@ -1,8 +1,4 @@
-use boring2::{
-    error::ErrorStack,
-    ssl::{ConnectConfiguration, SslConnectorBuilder, SslSessionRef, SslVerifyMode},
-};
-use bytes::Bytes;
+use boring2::ssl::{SslConnectorBuilder, SslVerifyMode};
 
 use crate::{
     Error,
@@ -29,22 +25,6 @@ pub trait SslConnectorBuilderExt {
     ) -> crate::Result<SslConnectorBuilder>;
 }
 
-/// ConnectConfigurationExt trait for `ConnectConfiguration`.
-pub trait ConnectConfigurationExt {
-    /// Configure the session for the given `ConnectConfiguration`.
-    fn set_seesion2(&mut self, session: &SslSessionRef) -> Result<(), ErrorStack>;
-
-    /// Configure the ALPS for the given `ConnectConfiguration`.
-    fn set_alps_protos(
-        &mut self,
-        alps: Option<Bytes>,
-        use_new_codepoint: bool,
-    ) -> Result<(), ErrorStack>;
-
-    /// Configure the random aes hardware override for the given `ConnectConfiguration`.
-    fn set_random_aes_hw_override(&mut self, enable: bool);
-}
-
 impl SslConnectorBuilderExt for SslConnectorBuilder {
     #[inline]
     fn set_cert_store(mut self, store: Option<&CertStore>) -> crate::Result<SslConnectorBuilder> {
@@ -98,40 +78,3 @@ impl SslConnectorBuilderExt for SslConnectorBuilder {
         Ok(self)
     }
 }
-
-impl ConnectConfigurationExt for ConnectConfiguration {
-    #[inline]
-    fn set_alps_protos(
-        &mut self,
-        alps: Option<Bytes>,
-        use_new_codepoint: bool,
-    ) -> Result<(), ErrorStack> {
-        if let Some(alps) = alps {
-            self.add_application_settings(&alps)?;
-
-            // By default, the old endpoint is used. Avoid unnecessary FFI calls.
-            if use_new_codepoint {
-                self.set_alps_use_new_codepoint(use_new_codepoint);
-            }
-        }
-
-        Ok(())
-    }
-
-    #[inline]
-    fn set_random_aes_hw_override(&mut self, enable: bool) {
-        if enable {
-            let random_bool = (crate::util::fast_random() % 2) == 0;
-            self.set_aes_hw_override(random_bool);
-        }
-    }
-
-    #[inline]
-    fn set_seesion2(&mut self, session: &SslSessionRef) -> Result<(), ErrorStack> {
-        unsafe {
-            self.set_session(session)?;
-        }
-
-        Ok(())
-    }
-}

src/tls/conn/mod.rs

@@ -40,7 +40,7 @@ use crate::{
     sync::Mutex,
     tls::{
         AlpnProtocol, AlpsProtocol, CertStore, Identity, KeyLogPolicy, TlsOptions, TlsVersion,
-        conn::ext::{ConnectConfigurationExt, SslConnectorBuilderExt},
+        conn::ext::SslConnectorBuilderExt,
     },
 };
 
@@ -218,17 +218,23 @@ impl Inner {
         // Set ECH grease
         cfg.set_enable_ech_grease(self.config.enable_ech_grease);
 
-        // Set AES hardware override
-        cfg.set_random_aes_hw_override(self.config.random_aes_hw_override);
+        // Set random AES hardware override
+        if self.config.random_aes_hw_override {
+            let random = (crate::util::fast_random() & 1) == 0;
+            cfg.set_aes_hw_override(random);
+        }
 
         // Set ALPS protos
-        cfg.set_alps_protos(
-            self.config
-                .alps_protocols
-                .as_deref()
-                .map(AlpsProtocol::encode_sequence),
-            self.config.alps_use_new_codepoint,
-        )?;
+        if let Some(ref alps_values) = self.config.alps_protocols {
+            for alps in alps_values.iter() {
+                cfg.add_application_settings(alps.value())?;
+            }
+
+            // By default, the old endpoint is used.
+            if !alps_values.is_empty() && self.config.alps_use_new_codepoint {
+                cfg.set_alps_use_new_codepoint(true);
+            }
+        }
 
         // Set ALPN protocols
         if let Some(alpn) = req.metadata().alpn_protocol() {
@@ -245,7 +251,7 @@ impl Inner {
             // If the session cache is enabled, we try to retrieve the session
             // associated with the key. If it exists, we set it in the SSL configuration.
             if let Some(session) = cache.lock().get(&key) {
-                cfg.set_seesion2(&session)?;
+                unsafe { cfg.set_session(&session) }?;
 
                 if self.config.no_ticket {
                     cfg.set_options(SslOptions::NO_TICKET)?;

src/tls/types.rs

@@ -67,15 +67,8 @@ impl AlpsProtocol {
     pub const HTTP3: AlpsProtocol = AlpsProtocol(b"h3");
 
     #[inline]
-    pub(crate) fn encode_sequence<'a, I>(items: I) -> Bytes
-    where
-        I: IntoIterator<Item = &'a AlpsProtocol>,
-    {
-        let mut buf = BytesMut::new();
-        for item in items {
-            buf.extend_from_slice(item.0);
-        }
-        buf.freeze()
+    pub(crate) const fn value(self) -> &'static [u8] {
+        self.0
     }
 }