nss: explicitly tell NSS to disable NPN/ALPN

... if disabled at libcurl level.  Otherwise, we would allow to
negotiate NPN despite curl was invoked with the --no-npn option.

diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
index ee22e9db377577328fe008b31d37f71d388a44cd..841d6b75d48244a33e2d1fb33d28aeaa8a97ce81 100644 (file)
--- a/lib/vtls/nss.c
+++ b/lib/vtls/nss.c
@@ -1641,18 +1641,15 @@ static CURLcode nss_setup_connect(struct connectdata *conn, int sockindex)
 #endif
 
 #ifdef SSL_ENABLE_NPN
-  if(data->set.ssl_enable_npn) {
-    if(SSL_OptionSet(connssl->handle, SSL_ENABLE_NPN, PR_TRUE) != SECSuccess)
-      goto error;
-  }
+  if(SSL_OptionSet(connssl->handle, SSL_ENABLE_NPN, data->set.ssl_enable_npn
+        ? PR_TRUE : PR_FALSE) != SECSuccess)
+    goto error;
 #endif
 
 #ifdef SSL_ENABLE_ALPN
-  if(data->set.ssl_enable_alpn) {
-    if(SSL_OptionSet(connssl->handle, SSL_ENABLE_ALPN, PR_TRUE)
-        != SECSuccess)
-      goto error;
-  }
+  if(SSL_OptionSet(connssl->handle, SSL_ENABLE_ALPN, data->set.ssl_enable_alpn
+        ? PR_TRUE : PR_FALSE) != SECSuccess)
+    goto error;
 #endif
 
 #if defined(SSL_ENABLE_NPN) || defined(SSL_ENABLE_ALPN)