From 4f04820c76a8c0a14564bcb02d51a71f86e8fb09 Mon Sep 17 00:00:00 2001
From: Daniel Reichelt <hacking@nachtgeist.net>
Date: Thu, 22 Sep 2016 16:53:43 +0200
Subject: [PATCH] Fix handling of empty argument to "-nextprotoneg" parameter

s_client's manpage states for -nextprotoneg:

"Empty list of protocols is treated specially and will cause the client
to advertise support for the TLS extension but disconnect just after
reciving ServerHello with a list of server supported protocols."

Consequently, the previous workaround of just quoting an empty variable
is insufficient and the "-nextprotoneg" parameter has to be removed
entirely from the command-line in case of an empty argument.

In other locations where "-nextprotoneg" is used
- its argument cannot be empty ($NPN_PROTOs is initialized to a non-
  empty value and set read-only) or
- its argument is intended to be empty (line 3724) or
- the command will not be invoked at all (for-loop parameter, line 3725)

This fixes #467 - again.

Additionally this patch prefers usage of -alpn over -nextprotoneg if the
openssl binary used supports it.
---
 testssl.sh | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/testssl.sh b/testssl.sh
index d9a1679..2e12c5a 100755
--- a/testssl.sh
+++ b/testssl.sh
@@ -3933,11 +3933,15 @@ sclient_connect_successful() {
 determine_tls_extensions() {
      local proto addcmd
      local success
-     local alpn=""
+     local alpnOrNpnParam=""
      local savedir
      local nrsaved
 
-     "$HAS_ALPN" && alpn="h2-14,h2-15,h2"
+     if "$HAS_ALPN"; then
+          alpnOrNpnParam="-alpn \"http/1.1,spdy/1,spdy/2,spdy/3,stun.turn,stun.nat-discovery,h2,h2c,webrtc,c-webrtc,ftp\""
+     elif "$HAS_SPDY"; then
+          alpnOrNpnParam="-nextprotoneg \"h2-14,h2-15,h2\""
+     fi
 
      if [[ -n "$2" ]]; then
          protocols_to_try="$2"
@@ -3983,7 +3987,7 @@ determine_tls_extensions() {
 # alpn: echo | openssl s_client -connect google.com:443 -tlsextdebug -alpn h2-14 -servername google.com  <-- suport needs to be checked b4 -- see also: ssl/t1_trce.c
           addcmd=""
           [[ ! "$proto" =~ ssl ]] && addcmd="$SNI"
-          $OPENSSL s_client $STARTTLS $BUGS $1 -showcerts -connect $NODEIP:$PORT $PROXY $addcmd -$proto -tlsextdebug -nextprotoneg "$alpn" -status </dev/null 2>$ERRFILE >$TMPFILE
+          $OPENSSL s_client $STARTTLS $BUGS $1 -showcerts -connect $NODEIP:$PORT $PROXY $addcmd -$proto -tlsextdebug $alpnOrNpnParam -status </dev/null 2>$ERRFILE >$TMPFILE
           sclient_connect_successful $? $TMPFILE && success=0 && break
      done                          # this loop is needed for IIS6 and others which have a handshake size limitations
      if [[ $success -eq 7 ]]; then