Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Curve-limited clients must not negotiate ECC ciphersuites unless they send the supported curve extension. This means that when they are nogotiating SSL 3.0

Browse Source 
and not TLS, they should not negotiate ECC ciphersuites at all.
Bug 341707.  r=rrelyea.


git-svn-id: svn://10.0.0.236/trunk@203068 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
nelson%bolyard.com
2006-07-19 01:42:58 +00:00
parent 637b0c77db
commit 505b7efaff
4 changed files with 18 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
mozilla/security/nss/lib/ssl/ssl3con.c
View File

@@ -39,7 +39,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: ssl3con.c,v 1.93 2006-07-17 22:08:03 alexei.volkov.bugs%sun.com Exp $ */
/* $Id: ssl3con.c,v 1.94 2006-07-19 01:40:17 nelson%bolyard.com Exp $ */
#include "nssrenam.h"
#include "cert.h"
@@ -3507,6 +3507,11 @@ ssl3_SendClientHello(sslSocket *ss)
if (total_exten_len > 0)
total_exten_len += 2;
}
#ifndef NSS_ECC_MORE_THAN_SUITE_B
else { /* SSL3 only */
ssl3_DisableECCSuites(ss, NULL); /* disable all ECC suites */
}
#endif
/* how many suites are permitted by policy and user preference? */
num_suites = count_cipher_suites(ss, ss->ssl3.policy, PR_TRUE);

4
mozilla/security/nss/lib/ssl/ssl3ecc.c
View File

@@ -40,7 +40,7 @@
* ***** END LICENSE BLOCK ***** */
/* ECC code moved here from ssl3con.c */
/* $Id: ssl3ecc.c,v 1.14 2006-06-28 21:15:04 julien.pierre.bugs%sun.com Exp $ */
/* $Id: ssl3ecc.c,v 1.15 2006-07-19 01:40:17 nelson%bolyard.com Exp $ */
#include "nssrenam.h"
#include "nss.h"
@@ -957,6 +957,8 @@ static const ssl3CipherSuite ecSuites[] = {
SECStatus
ssl3_DisableECCSuites(sslSocket * ss, const ssl3CipherSuite * suite)
{
if (!suite)
suite = ecSuites;
for (; *suite; ++suite) {
SECStatus rv = ssl3_CipherPrefSet(ss, *suite, PR_FALSE);

8
mozilla/security/nss/lib/ssl/sslcon.c
View File

@@ -37,7 +37,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: sslcon.c,v 1.31 2006-06-07 17:53:19 nelson%bolyard.com Exp $ */
/* $Id: sslcon.c,v 1.32 2006-07-19 01:40:17 nelson%bolyard.com Exp $ */
#include "nssrenam.h"
#include "cert.h"
@@ -3120,7 +3120,11 @@ ssl2_BeginClientHandshake(sslSocket *ss)
return rv;
}
#ifndef NSS_ECC_MORE_THAN_SUITE_B
/* ensure we don't neogtiate ECC cipher suites with SSL2 hello */
ssl3_DisableECCSuites(ss, NULL); /* disable all ECC suites */
#endif
if (!ss->cipherSpecs) {
rv = ssl2_ConstructCipherSpecs(ss);
if (rv < 0) {

4
mozilla/security/nss/lib/ssl/sslimpl.h
View File

@@ -39,7 +39,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: sslimpl.h,v 1.52 2006-06-23 17:01:38 rrelyea%redhat.com Exp $ */
/* $Id: sslimpl.h,v 1.53 2006-07-19 01:40:17 nelson%bolyard.com Exp $ */
#ifndef __sslimpl_h_
#define __sslimpl_h_
@@ -1274,6 +1274,8 @@ extern SECStatus ssl3_CreateRSAStepDownKeys(sslSocket *ss);
#ifdef NSS_ENABLE_ECC
extern void ssl3_FilterECCipherSuitesByServerCerts(sslSocket *ss);
extern PRBool ssl3_IsECCEnabled(sslSocket *ss);
extern SECStatus ssl3_DisableECCSuites(sslSocket * ss,
const ssl3CipherSuite * suite);
#endif /* NSS_ENABLE_ECC */
extern SECStatus ssl3_CipherPrefSetDefault(ssl3CipherSuite which, PRBool on);