diff --git a/src/quic/tlscontext.cc b/src/quic/tlscontext.cc index b563bae5071e0f..08ce7f9acd1c4c 100644 --- a/src/quic/tlscontext.cc +++ b/src/quic/tlscontext.cc @@ -338,7 +338,7 @@ int TLSContext::OnSelectAlpn(SSL* ssl, in, inlen) == OPENSSL_NPN_NO_OVERLAP) { Debug(&tls_session.session(), "ALPN negotiation failed"); - return SSL_TLSEXT_ERR_NOACK; + return SSL_TLSEXT_ERR_ALERT_FATAL; } // ALPN negotiated successfully. *out/*outlen point to the selected diff --git a/test/parallel/test-quic-alpn-mismatch.mjs b/test/parallel/test-quic-alpn-mismatch.mjs index 5dfff57219e0aa..252095f4d6b3bc 100644 --- a/test/parallel/test-quic-alpn-mismatch.mjs +++ b/test/parallel/test-quic-alpn-mismatch.mjs @@ -2,12 +2,18 @@ // Test: ALPN mismatch causes connection failure. // The server offers 'quic-test' but the client requests 'nonexistent'. -// The handshake should fail. +// The handshake should fail with a `no_application_protocol` alert. +// +// The QUIC transport error code for a CRYPTO_ERROR carrying a TLS alert is +// 0x100 | . For `no_application_protocol` (alert 120 / 0x78) this +// is 0x178 == 376. ERR_QUIC_TRANSPORT_ERROR formats the wire code into its +// message as a bigint, so we match `376n` to assert the specific alert was +// sent rather than some other handshake failure. import { hasQuic, skip, mustCall } from '../common/index.mjs'; import assert from 'node:assert'; -const { rejects, strictEqual } = assert; +const { rejects, strictEqual, match } = assert; if (!hasQuic) { skip('QUIC is not enabled'); @@ -15,18 +21,20 @@ if (!hasQuic) { const { listen, connect } = await import('../common/quic.mjs'); +const expected = { + code: 'ERR_QUIC_TRANSPORT_ERROR', + message: /\b376n\b/, +}; + const onerror = mustCall((err) => { strictEqual(err.code, 'ERR_QUIC_TRANSPORT_ERROR'); + match(err.message, /\b376n\b/); }, 2); const transportParams = { maxIdleTimeout: 1 }; const serverEndpoint = await listen(mustCall(async (serverSession) => { - await rejects(serverSession.opened, { - code: 'ERR_QUIC_TRANSPORT_ERROR', - }); - await rejects(serverSession.closed, { - code: 'ERR_QUIC_TRANSPORT_ERROR', - }); + await rejects(serverSession.opened, expected); + await rejects(serverSession.closed, expected); }), { transportParams, onerror, @@ -39,12 +47,8 @@ const clientSession = await connect(serverEndpoint.address, { onerror, }); -await rejects(clientSession.opened, { - code: 'ERR_QUIC_TRANSPORT_ERROR', -}); +await rejects(clientSession.opened, expected); // The handshake should fail — opened may reject or never resolve. // The session should close with an error. -await rejects(clientSession.closed, { - code: 'ERR_QUIC_TRANSPORT_ERROR', -}); +await rejects(clientSession.closed, expected);