443 Commits

Author SHA1 Message Date
wtc%google.com
1d16428221 Bug 565047: Block export cipher suites when TLS 1.1 is negotiated. The
patch is contributed by Brian Smith <bsmith@mozilla.com>.  r=wtc.
Modified Files:
	SSLerrs.h ssl3con.c sslerr.h


git-svn-id: svn://10.0.0.236/trunk@263634 18797224-902f-48f8-a5cc-f745e15eee43
2012-04-03 02:30:54 +00:00
wtc%google.com
352352e81e Bug 697910: ssl3_HandleHandshake should handle SECWouldBlock from
ssl3_HandleHandshakeMessage when the handshake message spans multiple TLS
records.  Patch by Brian Smith <bsmith@mozilla.com>.  r=wtc.


git-svn-id: svn://10.0.0.236/trunk@263633 18797224-902f-48f8-a5cc-f745e15eee43
2012-04-03 02:00:14 +00:00
wtc%google.com
b81f872bd2 Change the NSS version on the trunk to 3.13.5 Beta.
Modified Files:
	lib/nss/nss.h lib/softoken/softkver.h lib/ssl/ssl.def
	lib/util/nssutil.h


git-svn-id: svn://10.0.0.236/trunk@263621 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-31 02:02:35 +00:00
wtc%google.com
ca681fddad Bug 571722: merge with the "Implement SSL Version Range API [v5]" patch by
Brian Smith <bsmith@mozilla.com>.  Comment changes only.  Export
SSL_VersionRangeGetDefault, SSL_VersionRangeGetSupported, and
SSL_VersionRangeSetDefault.  r=wtc.
Modified Files:
	ssl.def ssl.h ssl3con.c sslcon.c sslimpl.h sslsock.c


git-svn-id: svn://10.0.0.236/trunk@263579 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-18 00:31:20 +00:00
wtc%google.com
e32a1aeb5a Bug 571722: add the SSLProtocolVariant enum type to indicate the byte
stream and datagram variants of SSL/TLS.  Add an SSLProtocolVariant
argument to the version range functions that don't take an fd.  The patch
is written by Brian Smith <bsmith@mozilla.com> and Eric Rescorla
<ekr@rtfm.com>.  r=wtc.
Modified Files:
	ssl.h ssl3con.c sslimpl.h sslsock.c sslt.h


git-svn-id: svn://10.0.0.236/trunk@263575 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-16 01:23:55 +00:00
wtc%google.com
ca327be5b5 Bug 565047: have ssl3_HandleRecord send a bad_record_mac alert instead of
decode_error when the cipher text is shorter than an IV block.  Reduce
MAX_IV_LENGTH to 24 to match the size of IVs in ssl3SidKeys.  r=rrelyea.
Modified Files:
	ssl3con.c sslimpl.h


git-svn-id: svn://10.0.0.236/trunk@263570 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-14 23:02:01 +00:00
wtc%google.com
170761bafa Bug 507359: remove a superfluous "if" in SSL_ExportKeyingMaterial.
Suggested by Adam Langley.


git-svn-id: svn://10.0.0.236/trunk@263567 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-14 00:56:43 +00:00
wtc%google.com
55b2d61236 Bug 565047: Implement TLS 1.1, except for restrictions on export cipher
suites.  The patch is written by Brian Smith <bsmith@mozilla.com>.  r=wtc.
Modified Files:
	ssl3con.c sslimpl.h sslproto.h


git-svn-id: svn://10.0.0.236/trunk@263561 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-13 02:39:11 +00:00
wtc%google.com
bb548cd810 Bug 734534: Fix a buffer length bug and nits in the next protocol
negotiation (NPN) functions.  r=agl.
Modified Files:
	ssl3ext.c sslsock.c


git-svn-id: svn://10.0.0.236/trunk@263560 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-12 19:14:12 +00:00
wtc%google.com
c40d150f71 Bug 571722: Implement SSL Version Range API. The patch is written by
Brian Smith <bsmith@mozilla.com>.  r=wtc.
Modified Files:
	SSLerrs.h ssl.def ssl.h ssl3con.c sslcon.c sslerr.h sslgathr.c
	sslimpl.h sslproto.h sslsock.c sslt.h


git-svn-id: svn://10.0.0.236/trunk@263554 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-11 04:32:35 +00:00
wtc%google.com
72837f0506 Bug 507359: add the hasContext parameter to SSL_ExportKeyingMaterial
to support both nonexistent and zero-length context unambiguously.
The patch is contributed by Douglas Stebila <douglas@stebila.ca>.  r=wtc.
Modified Files:
	ssl.h sslinfo.c


git-svn-id: svn://10.0.0.236/trunk@263543 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-10 02:34:45 +00:00
wtc%google.com
ade9335c30 Bug 507359: Implement TLS keying material exporters. The patch is written
by Douglas Stebila <douglas@stebila.ca> and improved by Adam Langley
<agl@chromium.org>.  r=wtc.
Modified Files:
	ssl.def ssl.h ssl3con.c sslimpl.h sslinfo.c


git-svn-id: svn://10.0.0.236/trunk@263533 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-07 01:27:40 +00:00
wtc%google.com
35ee8cc42f Bug 732258: ssl3_FinishHandshake cleanup. Fix the unused variable compiler
warning about 'rv' and simplify the conditional expression around the
ss->sec.cache call.  r=bsmith.


git-svn-id: svn://10.0.0.236/trunk@263520 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-06 02:23:25 +00:00
wtc%google.com
eae9177a84 Bug 732630: Prefer SSL_RSA_WITH_RC4_128_SHA over SSL_RSA_WITH_RC4_128_MD5.
The change to the suiteInfo table in sslinfo.c is not necessary but is
made to keep that table in roughly the same order as the other two tables
in ssl3con.c and sslenum.c.  r=rrelyea.
Modified Files:
	ssl3con.c sslenum.c sslinfo.c


git-svn-id: svn://10.0.0.236/trunk@263519 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-06 00:26:31 +00:00
kaie%kuix.de
837ba973da Bug 727691, SSL_InvalidateSession crashes if session cache was disabled (edit), Patch contribute by Julien Pierre, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263508 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-01 18:36:35 +00:00
wtc%google.com
e67e96fa34 Bug 728919: Fix clang warning about equality comparison with extraneous
parentheses.  The patch is contributed by Nico Weber <thakis@chromium.org>.
r=wtc.


git-svn-id: svn://10.0.0.236/trunk@263505 18797224-902f-48f8-a5cc-f745e15eee43
2012-03-01 01:58:22 +00:00
wtc%google.com
c4ffa157f5 Bug 729380: add an emacs mode line to make mxr.mozilla.org display tabs
correctly.  Fix variable declarations in lib/ssl/ssl3con.c to not start
from column 0, which would confuse cvs diff -p.  r=kaie.


git-svn-id: svn://10.0.0.236/trunk@263475 18797224-902f-48f8-a5cc-f745e15eee43
2012-02-23 00:13:23 +00:00
kaie%kuix.de
8684f22723 Bug 713410, move variable declaration, r=jst, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263438 18797224-902f-48f8-a5cc-f745e15eee43
2012-02-17 09:50:04 +00:00
kaie%kuix.de
6c980c7018 Bug 726315, followup from bug 542832, Patch contributed by Brian Smith, r=kaie
git-svn-id: svn://10.0.0.236/trunk@263415 18797224-902f-48f8-a5cc-f745e15eee43
2012-02-15 21:52:08 +00:00
kaie%kuix.de
01e83ecd8d Bug 726588, attempted tinderbox bustage fix for bug 542832. no review yet. will backout if there's no review by tomorrow.
git-svn-id: svn://10.0.0.236/trunk@263394 18797224-902f-48f8-a5cc-f745e15eee43
2012-02-13 17:19:40 +00:00
kaie%kuix.de
24031fa098 Bug 542832 - SSL_RestartHandshakeAfterServerCert is broken, patch by Brian Smith, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263387 18797224-902f-48f8-a5cc-f745e15eee43
2012-02-11 13:20:53 +00:00
kaie%kuix.de
f1f6b33c41 Bug 542832 - SSL_RestartHandshakeAfterServerCert is broken, patch by Brian Smith, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263386 18797224-902f-48f8-a5cc-f745e15eee43
2012-02-11 13:03:08 +00:00
kaie%kuix.de
a80bdaa107 Bug 542832 - SSL_RestartHandshakeAfterServerCert is broken, patch by Brian Smith, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263385 18797224-902f-48f8-a5cc-f745e15eee43
2012-02-11 12:58:48 +00:00
kaie%kuix.de
f0bd270bae Bug 542832 - SSL_RestartHandshakeAfterServerCert is broken, patch by Brian Smith, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263384 18797224-902f-48f8-a5cc-f745e15eee43
2012-02-11 12:58:47 +00:00
kaie%kuix.de
1d479025ca Bug 542832 - SSL_RestartHandshakeAfterServerCert is broken, patch by Brian Smith, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263383 18797224-902f-48f8-a5cc-f745e15eee43
2012-02-11 12:57:28 +00:00
kaie%kuix.de
9d33576904 Bug 542832 - SSL_RestartHandshakeAfterServerCert is broken, patch by Brian Smith, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263382 18797224-902f-48f8-a5cc-f745e15eee43
2012-02-11 12:55:58 +00:00
wtc%google.com
10830da36d Bug 718554: SSL_ForceHandshake returns wrong positive results after sending
pending data.  The patch is by Brian Smith <bsmith@mozilla.com>.  r=wtc.


git-svn-id: svn://10.0.0.236/trunk@263294 18797224-902f-48f8-a5cc-f745e15eee43
2012-01-22 01:14:14 +00:00
bsmith%mozilla.com
9b720db9f7 Bug 700516: Remove SSL2 support for SSL_RestartHandshakeAfterServerCert and SSL_RestartHandshakeAfterCertReq, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263089 18797224-902f-48f8-a5cc-f745e15eee43
2011-11-19 21:58:21 +00:00
bsmith%mozilla.com
24363aa2e6 Bug 651523: Remove step-up code, v4, removing EXPORT_VERSION build option, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263080 18797224-902f-48f8-a5cc-f745e15eee43
2011-11-17 00:20:22 +00:00
kaie%kuix.de
51ddd562f1 Fix Tinderbox bustage, backout all patches from 2011-11-11
git-svn-id: svn://10.0.0.236/trunk@263077 18797224-902f-48f8-a5cc-f745e15eee43
2011-11-16 19:12:36 +00:00
bsmith%mozilla.com
4778bbc800 Bug 700516: Remove SSL2 support for SSL_RestartHandshakeAfterServerCert and SSL_RestartHandshakeAfterCertReq, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263067 18797224-902f-48f8-a5cc-f745e15eee43
2011-11-11 19:06:52 +00:00
bsmith%mozilla.com
7a0edbfd6a Bug 651523 - Remove SSL step-up code from libssl and remove step-up extended key usage support, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@263066 18797224-902f-48f8-a5cc-f745e15eee43
2011-11-11 18:47:20 +00:00
bsmith%mozilla.com
c73410f580 Bug 547312: Next protocol negotiation support (minor fixes), r=agl
git-svn-id: svn://10.0.0.236/trunk@263063 18797224-902f-48f8-a5cc-f745e15eee43
2011-11-08 22:12:05 +00:00
wtc%google.com
67190228d5 Bug 676729: SSL_ForceHandshake does not send the saved write data in
ss->pendingBuf.  r=rrelyea.


git-svn-id: svn://10.0.0.236/trunk@263027 18797224-902f-48f8-a5cc-f745e15eee43
2011-10-30 00:08:59 +00:00
bsmith%mozilla.com
0601ca68ad Bug 547312: Implement client-side support for NPN; original patch by agl r=wtc; changes by bsmith r=agl
git-svn-id: svn://10.0.0.236/trunk@263024 18797224-902f-48f8-a5cc-f745e15eee43
2011-10-29 00:29:11 +00:00
emaldona%redhat.com
f364be9f97 Bug 691997 Code cleanup for Bug 172051 - All localizable error messages for NSS error codes, r=wtc
git-svn-id: svn://10.0.0.236/trunk@263003 18797224-902f-48f8-a5cc-f745e15eee43
2011-10-22 16:45:40 +00:00
wtc%google.com
eb480c28ad Bug 647706: add SHA-224 support to more functions, in particular to
support SHA-224 certificates.  Portions of this patch are contributed
by Hanno Boeck <hanno@hboeck.de>.  r=wtc,emaldona.
Modified Files:
	cmd/lib/secutil.c lib/cryptohi/seckey.c lib/cryptohi/secsign.c
	lib/cryptohi/secvfy.c lib/pk11wrap/pk11mech.c
	lib/pk11wrap/pk11slot.c lib/pkcs12/p12local.c
	lib/softoken/rsawrapr.c lib/ssl/ssl3ecc.c lib/util/secalgid.c


git-svn-id: svn://10.0.0.236/trunk@263002 18797224-902f-48f8-a5cc-f745e15eee43
2011-10-22 14:35:44 +00:00
wtc%google.com
eeafd4b2de Bug 593080: change the default of the SSL_ENABLE_SSL2 and
SSL_V2_COMPATIBLE_HELLO options to PR_FALSE.  r=rrelyea.
Modified Files:
	cmd/strsclnt/strsclnt.c cmd/tstclnt/tstclnt.c lib/ssl/ssl.h
	lib/ssl/sslsock.c


git-svn-id: svn://10.0.0.236/trunk@262964 18797224-902f-48f8-a5cc-f745e15eee43
2011-10-06 22:42:34 +00:00
emaldona%redhat.com
3037aaaa3a Bug 683424 - tstclnt emits "SSL peer is in another FORTEZZA domain." error messages, r=wtc
git-svn-id: svn://10.0.0.236/trunk@262961 18797224-902f-48f8-a5cc-f745e15eee43
2011-10-05 18:07:18 +00:00
emaldona%redhat.com
7c113a42d9 Bug 172051 - Do not add headers to PRIVATE_EXPORT, r=wtc,emaldona
git-svn-id: svn://10.0.0.236/trunk@262952 18797224-902f-48f8-a5cc-f745e15eee43
2011-10-04 02:24:52 +00:00
bsmith%mozilla.com
2e2793892a Bug 665814: Prevent chosen plaintext attacks on SSL 3.0 and TLS 1.0 connections, r=wtc, sr=rrelyea
git-svn-id: svn://10.0.0.236/trunk@262945 18797224-902f-48f8-a5cc-f745e15eee43
2011-10-01 03:59:54 +00:00
wtc%google.com
93a9d52a1e Bug 685592: fix comment nits in the previous checkin.
Modified Files:
	sslmutex.c sslsnce.c


git-svn-id: svn://10.0.0.236/trunk@262943 18797224-902f-48f8-a5cc-f745e15eee43
2011-10-01 00:11:02 +00:00
rrelyea%redhat.com
8048b035ce Bug 685592 - File descriptor leak after "service httpd reload"
r= wtc.


git-svn-id: svn://10.0.0.236/trunk@262942 18797224-902f-48f8-a5cc-f745e15eee43
2011-09-30 23:27:08 +00:00
emaldona%redhat.com
44f2e32775 Fix Bug 6172051 - Add localizable error messages for NSS error codes, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@262711 18797224-902f-48f8-a5cc-f745e15eee43
2011-08-17 14:41:48 +00:00
wtc%google.com
4fb0cbda9f Bug 587234: SSL_ERROR_WEAK_SERVER_KEY is renamed
SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEY to be specific about key type.
TBR=kaie.
Modified Files:
	cmd/lib/SSLerrs.h lib/ssl/ssl3con.c lib/ssl/sslerr.h


git-svn-id: svn://10.0.0.236/trunk@262706 18797224-902f-48f8-a5cc-f745e15eee43
2011-08-17 05:02:05 +00:00
wtc%google.com
74f8f184d5 Bug 587234: Better error reporting for tiny DH keys in Server Key Exchange.
Add a new error code SSL_ERROR_WEAK_SERVER_KEY for the dh_p size check in
ssl3_HandleServerKeyExchange.  r=nelson.
Modified Files:
	cmd/lib/SSLerrs.h lib/ssl/ssl3con.c lib/ssl/sslerr.h


git-svn-id: svn://10.0.0.236/trunk@262704 18797224-902f-48f8-a5cc-f745e15eee43
2011-08-17 05:02:03 +00:00
wtc%google.com
2d904a0db9 Bug 275744: Add new error code SSL_ERROR_RX_UNEXPECTED_UNCOMPRESSED_RECORD
when we detect missing compression.  The patch is contributed by Adam
Langley <agl@chromium.org>.  r=nelson,wtc.
Modified Files:
	cmd/lib/SSLerrs.h lib/ssl/ssl3con.c lib/ssl/sslerr.h


git-svn-id: svn://10.0.0.236/trunk@262702 18797224-902f-48f8-a5cc-f745e15eee43
2011-08-17 05:02:01 +00:00
nelson%bolyard.com
d5fea0b0a5 Bug 537356: Implement new safe SSL3 & TLS renegotiation, r=wtc
git-svn-id: svn://10.0.0.236/trunk@262700 18797224-902f-48f8-a5cc-f745e15eee43
2011-08-17 05:01:59 +00:00
nelson%bolyard.com
40b99b60c5 Bug 526689: (CVE-2009-3555) SSL3 & TLS Renegotiation Vulnerability
Disable SSL 3.x renegotiation by default.  Add new options to re-enable.
r=wtc,rrelyea


git-svn-id: svn://10.0.0.236/trunk@262698 18797224-902f-48f8-a5cc-f745e15eee43
2011-08-17 05:01:57 +00:00
wtc%google.com
b2535bc0a6 Bug 403563: implement the TLS session ticket extension (rfc4507bis). The
patch is contributed by Nagendra Modadugu <ngm+mozilla@google.com>.  A
small portion (PKCS #11 code and tests) was written by Wan-Teh Chang
<wtc@google.com>.  r=nelson,wtc
Modified Files:
	cmd/lib/SSLerrs.h cmd/selfserv/selfserv.c
	cmd/strsclnt/strsclnt.c cmd/tstclnt/tstclnt.c
	lib/ssl/manifest.mn lib/ssl/ssl.h lib/ssl/ssl3con.c
	lib/ssl/ssl3ecc.c lib/ssl/ssl3prot.h lib/ssl/sslerr.h
	lib/ssl/sslimpl.h lib/ssl/sslnonce.c lib/ssl/sslsnce.c
	lib/ssl/sslsock.c lib/ssl/sslt.h tests/ssl/sslstress.txt
Added Files:
	lib/ssl/ssl3ext.c


git-svn-id: svn://10.0.0.236/trunk@262696 18797224-902f-48f8-a5cc-f745e15eee43
2011-08-17 05:01:55 +00:00