Add support for TLS Next Protocol Negotiation:

* modules/ssl/mod_ssl.c, modules/ssl/mod_ssl.h: Add and implement new
  hooks for next protocol advertisement/discovery.

* modules/ssl/ssl_engine_init.c (ssl_init_ctx_callbacks): Enable
  NPN advertisement callback in handshake.

* modules/ssl/ssl_engine_io.c (ssl_io_filter_input): Invoke
  next-protocol discovery hook.

* modules/ssl/ssl_engine_kernel.c (ssl_callback_AdvertiseNextProtos): 
  New callback.

* modules/ssl/ssl_private.h: Add prototype.

Submitted by: Matthew Steele <mdsteele google.com>
  with slight tweaks by jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1332643 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 24 insertions, 0 deletions

diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c
index 510e16060d..205a4b3617 100644
--- a/modules/ssl/ssl_engine_io.c
+++ b/modules/ssl/ssl_engine_io.c
@@ -28,6 +28,7 @@
                                   core keeps dumping.''
                                             -- Unknown    */
 #include "ssl_private.h"
+#include "mod_ssl.h"
 #include "apr_date.h"
 
 /*  _________________________________________________________________
@@ -297,6 +298,7 @@ typedef struct {
     apr_pool_t *pool;
     char buffer[AP_IOBUFSIZE];
     ssl_filter_ctx_t *filter_ctx;
+    int npn_finished;  /* 1 if NPN has finished, 0 otherwise */
 } bio_filter_in_ctx_t;
 
 /*
@@ -1374,6 +1376,27 @@ static apr_status_t ssl_io_filter_input(ap_filter_t *f,
         APR_BRIGADE_INSERT_TAIL(bb, bucket);
     }
 
+#ifdef HAVE_TLS_NPN
+    /* By this point, Next Protocol Negotiation (NPN) should be completed (if
+     * our version of OpenSSL supports it).  If we haven't already, find out
+     * which protocol was decided upon and inform other modules by calling
+     * npn_proto_negotiated_hook. */
+    if (!inctx->npn_finished) {
+        const unsigned char *next_proto = NULL;
+        unsigned next_proto_len = 0;
+
+        SSL_get0_next_proto_negotiated(
+            inctx->ssl, &next_proto, &next_proto_len);
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c,
+                      "SSL NPN negotiated protocol: '%s'",
+                      apr_pstrmemdup(f->c->pool, (const char*)next_proto,
+                                     next_proto_len));
+        modssl_run_npn_proto_negotiated_hook(
+            f->c, (const char*)next_proto, next_proto_len);
+        inctx->npn_finished = 1;
+    }
+#endif
+
     return APR_SUCCESS;
 }
 
@@ -1855,6 +1878,7 @@ static void ssl_io_input_add_filter(ssl_filter_ctx_t *filter_ctx, conn_rec *c,
     inctx->block = APR_BLOCK_READ;
     inctx->pool = c->pool;
     inctx->filter_ctx = filter_ctx;
+    inctx->npn_finished = 0;
 }
 
 /* The request_rec pointer is passed in here only to ensure that the