Merge pull request #32 from Unity-Technologies/alpn_support_exp

Add ALPN support via UnityTLS

Author: BorisShir

lib/vtls/unitytls.c

@@ -32,6 +32,9 @@ struct ssl_backend_data {
   unitytls_x509list* clicert;
   unitytls_key* pk;
   unitytls_tlsctx* ctx;
+#ifdef HAS_ALPN
+  const char *protocols[ALPN_ENTRIES_MAX + 1];
+#endif
 };
 
 /*
@@ -455,6 +458,26 @@ static CURLcode unitytls_connect_step1(struct Curl_cfilter *cf, struct Curl_easy
     return CURLE_SSL_CONNECT_ERROR;
   }
 
+#ifdef HAS_ALPN
+  if (connssl->alpn) {
+    struct alpn_proto_buf proto;
+    // mbedtls_ssl_conf_alpn_protocols does not clone the protocols array, which is why we need to keep it inside backend struct
+    size_t i;
+    DEBUGASSERT(connssl->alpn->count <= ALPN_ENTRIES_MAX);
+    for (i = 0; i < connssl->alpn->count; ++i) {
+      backend->protocols[i] = connssl->alpn->entries[i];
+    }
+    backend->protocols[connssl->alpn->count] = NULL; // the protocols array must be null-terminated
+    unitytls->unitytls_tlsctx_set_alpn_protocols(backend->ctx, &backend->protocols[0], &err);
+    if(err.code != UNITYTLS_SUCCESS) {
+      failf(data, "Failed setting APLN protocols: %i", err.code);
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+    Curl_alpn_to_proto_str(&proto, connssl->alpn);
+    infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
+  }
+#endif
+
   /* give application a chance to interfere with SSL set up. */
   if(data->set.ssl.fsslctx) {
     CURLcode result = (*data->set.ssl.fsslctx)(data, backend->ctx, data->set.ssl.fsslctxp);
@@ -469,7 +492,7 @@ static CURLcode unitytls_connect_step1(struct Curl_cfilter *cf, struct Curl_easy
   return CURLE_OK;
 }
 
-static CURLcode unitytls_connect_step2(struct Curl_easy* data, struct ssl_connect_data* connssl)
+static CURLcode unitytls_connect_step2(struct Curl_cfilter* cf, struct Curl_easy* data, struct ssl_connect_data* connssl)
 {
   struct ssl_backend_data* backend = connssl->backend;
 
@@ -510,6 +533,13 @@ static CURLcode unitytls_connect_step2(struct Curl_easy* data, struct ssl_connec
     }
   }
 
+#ifdef HAS_ALPN
+  if (connssl->alpn) {
+    const char *proto = unitytls->unitytls_tlsctx_get_alpn_protocol(backend->ctx);
+    Curl_alpn_set_negotiated(cf, data, (const unsigned char *)proto, proto ? strlen(proto) : 0);
+  }
+#endif
+
   /* We almost certainly have a verifyresult!=UNITYTLS_X509VERIFY_SUCCESS as well, but in theory it is still possible to hit this code. */
   if (err.code == UNITYTLS_SUCCESS) {
     connssl->connecting_state = ssl_connect_3;
@@ -567,7 +597,7 @@ static CURLcode unitytls_connect_common(struct Curl_cfilter *cf, struct Curl_eas
       return CURLE_OPERATION_TIMEDOUT;
     }
 
-    retcode = unitytls_connect_step2(data, connssl);
+    retcode = unitytls_connect_step2(cf, data, connssl);
     if(retcode != CURLE_OK || (nonblocking && ssl_connect_2 == connssl->connecting_state))
       return retcode;
   } /* repeat step2 until all transactions are done. */

lib/vtls/unitytls_interface.h

@@ -1,6 +1,11 @@
 #ifndef HEADER_CURL_UNITYTLS_INTERFACE_H
 #define HEADER_CURL_UNITYTLS_INTERFACE_H
 
+/* ALPN for http2 */
+#ifdef USE_HTTP2
+#define HAS_ALPN
+#endif
+
 #include <stdint.h>
 
 typedef int8_t      SInt8;
@@ -264,6 +269,11 @@ typedef void                        (*unitytls_tlsctx_set_certificate_callback_t
 
 typedef void                        (*unitytls_random_generate_bytes_t)(UInt8* buffer, size_t bufferLen, unitytls_errorstate* errorState);
 
+#ifdef HAS_ALPN
+typedef void                        (*unitytls_tlsctx_set_alpn_protocols_t)(unitytls_tlsctx* ctx, const char **protocols, unitytls_errorstate * errorState);
+typedef const char*                 (*unitytls_tlsctx_get_alpn_protocol_t)(unitytls_tlsctx* ctx);
+#endif
+
 /* Interface struct used to integrate UnityTLS into external libraries. */
 /* See InterfaceStruct.cpp in UnityTLS. */
 typedef struct unitytls_interface_struct
@@ -311,6 +321,11 @@ typedef struct unitytls_interface_struct
 
     unitytls_x509verify_result_to_string_t unitytls_x509verify_result_to_string;
     unitytls_tlsctx_set_trace_level_t unitytls_tlsctx_set_trace_level;
+
+#ifdef HAS_ALPN
+    unitytls_tlsctx_set_alpn_protocols_t unitytls_tlsctx_set_alpn_protocols;
+    unitytls_tlsctx_get_alpn_protocol_t unitytls_tlsctx_get_alpn_protocol;
+#endif
 } unitytls_interface_struct;