Merge branch 'ia/ssl/npn/OTP-10361'

* ia/ssl/npn/OTP-10361:
  ssl: Shorten test case names to workaround ct shortcomings on windows
  ssl: SSL 3.0 does not support next protocol negotiation
  ssl: Dialyzer fixes and code cleaning
  ssl: Changed default behaviour of next protocol negotiation to make more "sense" (be true to the specification).
  ssl: Update SSL docs for SSL Next Protocol Support
  ssl: Support for SSL Next Protocol Negotiation * http://technotes.googlecode.com/git/nextprotoneg.html

1 files changed, 101 insertions, 6 deletions

diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 40d933a256..9a562aa5a8 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -31,13 +31,15 @@
 	 controlling_process/2, listen/2, pid/1, peername/1, peercert/1,
 	 recv/2, recv/3, send/2, getopts/2, setopts/2, sockname/1,
 	 versions/0, session_info/1, format_error/1,
-	 renegotiate/1, prf/5, clear_pem_cache/0, random_bytes/1]).
+	 renegotiate/1, prf/5, clear_pem_cache/0, random_bytes/1, negotiated_next_protocol/1]).
+
 
 -deprecated({pid, 1, next_major_release}).
 
 -include("ssl_internal.hrl").
 -include("ssl_record.hrl").
 -include("ssl_cipher.hrl").
+-include("ssl_handshake.hrl").
 
 -include_lib("public_key/include/public_key.hrl"). 
 
@@ -65,7 +67,9 @@
                         {keyfile, path()} | {password, string()} | {cacerts, [Der::binary()]} |
                         {cacertfile, path()} | {dh, Der::binary()} | {dhfile, path()} |
                         {ciphers, ciphers()} | {ssl_imp, ssl_imp()} | {reuse_sessions, boolean()} |
-                        {reuse_session, fun()} | {hibernate_after, integer()|undefined}.
+                        {reuse_session, fun()} | {hibernate_after, integer()|undefined} |
+                        {next_protocols_advertised, list(binary())} |
+                        {client_preferred_next_protocols, binary(), client | server, list(binary())}.
 
 -type verify_type()  :: verify_none | verify_peer.
 -type path()         :: string().
@@ -314,6 +318,14 @@ suite_definition(S) ->
     {KeyExchange, Cipher, Hash}.
 
 %%--------------------------------------------------------------------
+-spec negotiated_next_protocol(#sslsocket{}) -> {ok, binary()} | {error, reason()}.
+%%
+%% Description: Returns the next protocol that has been negotiated. If no
+%% protocol has been negotiated will return {error, next_protocol_not_negotiated}
+%%--------------------------------------------------------------------
+negotiated_next_protocol(#sslsocket{fd = new_ssl, pid = Pid}) ->
+    ssl_connection:negotiated_next_protocol(Pid).
+
 -spec cipher_suites() -> [erl_cipher_suite()].
 -spec cipher_suites(erlang | openssl) -> [erl_cipher_suite()] | [string()].
 			   
@@ -594,7 +606,9 @@ handle_options(Opts0, _Role) ->
       renegotiate_at = handle_option(renegotiate_at, Opts, ?DEFAULT_RENEGOTIATE_AT),
       debug      = handle_option(debug, Opts, []),
       hibernate_after = handle_option(hibernate_after, Opts, undefined),
-      erl_dist = handle_option(erl_dist, Opts, false)
+      erl_dist = handle_option(erl_dist, Opts, false),
+      next_protocols_advertised = handle_option(next_protocols_advertised, Opts, undefined),
+      next_protocol_selector = make_next_protocol_selector(handle_option(client_preferred_next_protocols, Opts, undefined))
      },
 
     CbInfo  = proplists:get_value(cb_info, Opts, {gen_tcp, tcp, tcp_closed, tcp_error}),    
@@ -603,7 +617,8 @@ handle_options(Opts0, _Role) ->
 		  depth, cert, certfile, key, keyfile,
 		  password, cacerts, cacertfile, dh, dhfile, ciphers,
 		  debug, reuse_session, reuse_sessions, ssl_imp,
-		  cb_info, renegotiate_at, secure_renegotiate, hibernate_after, erl_dist],
+		  cb_info, renegotiate_at, secure_renegotiate, hibernate_after, erl_dist, next_protocols_advertised,
+		  client_preferred_next_protocols],
     
     SockOpts = lists:foldl(fun(Key, PropList) -> 
 				   proplists:delete(Key, PropList)
@@ -728,12 +743,64 @@ validate_option(hibernate_after, undefined) ->
     undefined;
 validate_option(hibernate_after, Value) when is_integer(Value), Value >= 0 ->
     Value;
-validate_option(erl_dist,Value) when Value == true; 
+validate_option(erl_dist,Value) when Value == true;
 				     Value == false ->
     Value;
+validate_option(client_preferred_next_protocols = Opt, {Precedence, PreferredProtocols} = Value)
+  when is_list(PreferredProtocols) ->
+    case ssl_record:highest_protocol_version([]) of
+	{3,0} ->
+	    throw({error, {eoptions, {not_supported_in_sslv3, {Opt, Value}}}});
+	_ ->
+	    validate_binary_list(client_preferred_next_protocols, PreferredProtocols),
+	    validate_npn_ordering(Precedence),
+	    {Precedence, PreferredProtocols, ?NO_PROTOCOL}
+    end;
+validate_option(client_preferred_next_protocols = Opt, {Precedence, PreferredProtocols, Default} = Value)
+      when is_list(PreferredProtocols), is_binary(Default),
+           byte_size(Default) > 0, byte_size(Default) < 256 ->
+    case ssl_record:highest_protocol_version([]) of
+	{3,0} ->
+	    throw({error, {eoptions, {not_supported_in_sslv3, {Opt, Value}}}});
+	_ ->
+	    validate_binary_list(client_preferred_next_protocols, PreferredProtocols),
+	    validate_npn_ordering(Precedence),
+	    Value
+    end;
+	
+validate_option(client_preferred_next_protocols, undefined) ->
+    undefined;
+validate_option(next_protocols_advertised = Opt, Value) when is_list(Value) ->
+    case ssl_record:highest_protocol_version([]) of
+	{3,0} ->
+	    throw({error, {eoptions, {not_supported_in_sslv3, {Opt, Value}}}});
+	_ ->
+	    validate_binary_list(next_protocols_advertised, Value),
+	    Value
+    end;
+
+validate_option(next_protocols_advertised, undefined) ->
+    undefined;
 validate_option(Opt, Value) ->
     throw({error, {eoptions, {Opt, Value}}}).
-    
+
+validate_npn_ordering(client) ->
+    ok;
+validate_npn_ordering(server) ->
+    ok;
+validate_npn_ordering(Value) ->
+    throw({error, {eoptions, {client_preferred_next_protocols, {invalid_precedence, Value}}}}).
+
+validate_binary_list(Opt, List) ->
+    lists:foreach(
+        fun(Bin) when is_binary(Bin),
+                      byte_size(Bin) > 0,
+                      byte_size(Bin) < 256 ->
+            ok;
+           (Bin) ->
+            throw({error, {eoptions, {Opt, {invalid_protocol, Bin}}}})
+        end, List).
+
 validate_versions([], Versions) ->
     Versions;
 validate_versions([Version | Rest], Versions) when Version == 'tlsv1.2';
@@ -839,6 +906,34 @@ cipher_suites(Version, Ciphers0)  ->
 
 no_format(Error) ->    
     lists:flatten(io_lib:format("No format string for error: \"~p\" available.", [Error])).
+
+detect(_Pred, []) ->
+    undefined;
+detect(Pred, [H|T]) ->
+    case Pred(H) of
+        true ->
+            H;
+        _ ->
+            detect(Pred, T)
+    end.
+
+make_next_protocol_selector(undefined) ->
+    undefined;
+make_next_protocol_selector({client, AllProtocols, DefaultProtocol}) ->
+    fun(AdvertisedProtocols) ->
+        case detect(fun(PreferredProtocol) -> lists:member(PreferredProtocol, AdvertisedProtocols) end, AllProtocols) of
+            undefined -> DefaultProtocol;
+            PreferredProtocol -> PreferredProtocol
+        end
+    end;
+
+make_next_protocol_selector({server, AllProtocols, DefaultProtocol}) ->
+    fun(AdvertisedProtocols) ->
+        case detect(fun(PreferredProtocol) -> lists:member(PreferredProtocol, AllProtocols) end, AdvertisedProtocols) of
+            undefined -> DefaultProtocol;
+            PreferredProtocol -> PreferredProtocol
+        end
+    end.
                                 
 %% Only used to remove exit messages from old ssl
 %% First is a nonsense clause to provide some