335 Commits

Author SHA1 Message Date
wtc%google.com
fa46d39e9d Bug 537356: In SSL 3.0, send and handle the renegotiation_info extension
but not any other extension.  r=rrelyea.
Modified Files:
	ssl3con.c ssl3ext.c


git-svn-id: svn://10.0.0.236/trunk@259505 18797224-902f-48f8-a5cc-f745e15eee43
2010-01-29 19:20:28 +00:00
kaie%kuix.de
bd4c4b9fa4 Bug 540304, Implement SSL_HandshakeNegotiatedExtension
r=nelson


git-svn-id: svn://10.0.0.236/trunk@259501 18797224-902f-48f8-a5cc-f745e15eee43
2010-01-28 16:14:25 +00:00
nelson%bolyard.com
0bc55de11a Bug 537356: Implement new safe SSL3 & TLS renegotiation, r=wtc
git-svn-id: svn://10.0.0.236/trunk@259500 18797224-902f-48f8-a5cc-f745e15eee43
2010-01-28 06:19:13 +00:00
wtc%google.com
66dfd7adba Bug 536474: Add support for logging pre-master secrets. The patch is
contributed by Adam Langley <agl@chromium.org>.  r=nelson,wtc.
Modified Files:
	ssl3con.c sslimpl.h sslsock.c


git-svn-id: svn://10.0.0.236/trunk@259455 18797224-902f-48f8-a5cc-f745e15eee43
2010-01-22 03:47:42 +00:00
alexei.volkov.bugs%sun.com
9cbdff6813 additional fix for bug 360421 - Implement TLS Server Name Indication for servers.
git-svn-id: svn://10.0.0.236/trunk@259404 18797224-902f-48f8-a5cc-f745e15eee43
2010-01-15 01:49:34 +00:00
alexei.volkov.bugs%sun.com
d26b36b737 360421 - Implement TLS Server Name Indication for servers. r=nelson
git-svn-id: svn://10.0.0.236/trunk@259396 18797224-902f-48f8-a5cc-f745e15eee43
2010-01-14 22:15:26 +00:00
wtc%google.com
0caf483ea7 Bug 535669: Move common makefile code in if and else to the outside.
r=nelson.
Modified Files:
	cmd/platlibs.mk lib/ssl/config.mk


git-svn-id: svn://10.0.0.236/trunk@259249 18797224-902f-48f8-a5cc-f745e15eee43
2009-12-18 02:37:12 +00:00
wtc%google.com
0dd48d5002 Bug 531188: Don't call zlib with 0-length inputs (the avail_in is 0),
otherwise zlib returns Z_BUF_ERROR, which we consider fatal.  The patch is
contributed by Adam Langley of Google <agl@chromium.org>.  r=wtc,nelson.


git-svn-id: svn://10.0.0.236/trunk@259136 18797224-902f-48f8-a5cc-f745e15eee43
2009-12-01 17:59:46 +00:00
wtc%google.com
61c9cc167c Bug 531188: ssl3_DeflateDecompress should set an error code on failure.
Remove an extraneous ssl_ReleaseSpecReadLock(ss) call.  r=agl,nelson.


git-svn-id: svn://10.0.0.236/trunk@259090 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-26 01:51:10 +00:00
wtc%google.com
d73ba345fb Bug 530907: The peerID argument to SSL_SetSockPeerID should be declared
const.  Removed an unnecessary PR_CALLBACK qualifier.  r=nelson.


git-svn-id: svn://10.0.0.236/trunk@259084 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-25 05:24:25 +00:00
wtc%google.com
a75ee146fb Bug 275744: Fix a compilation error on Windows. Need to declare variables
at the beginning of a block.  TBR=nelson.


git-svn-id: svn://10.0.0.236/trunk@259051 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-21 05:31:16 +00:00
wtc%google.com
6159af71f0 Bug 275744: Back out the previous solution of undefining the compress macro
after including zlib.h.  Rename compress to compressor and decompress to
decompressor to avoid the compress macro that may be defined by zconf.h.
r=nelson.
Modified Files:
	ssl3con.c sslimpl.h


git-svn-id: svn://10.0.0.236/trunk@259050 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-21 03:40:49 +00:00
wtc%google.com
7b748542b5 Bug 275744: Make sure the compression of resumed sessions is correct. The
patch is contributed by Adam Langley of Google <agl@chromium.org>.
r=wtc,nelson.


git-svn-id: svn://10.0.0.236/trunk@259049 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-21 03:32:40 +00:00
wtc%google.com
0615d94be7 Bug 275744: Mozilla's zconf.h defines 'compress' as a macro. When NSS is
built as part of Mozilla, the 'compress' member of the ssl3CipherSpec
structure gets renamed.  Undefine 'compress' to avoid that.  r=nelson.


git-svn-id: svn://10.0.0.236/trunk@258982 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-12 05:08:27 +00:00
wtc%google.com
efef0f47b7 Bug 275744: report a compressionMethodName of "N/A" rather than "NULL" for
SSL v2.  r=nelson.


git-svn-id: svn://10.0.0.236/trunk@258945 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-09 22:00:18 +00:00
wtc%google.com
a2b2156e95 Bug 275744: SSL_GetChannelInfo needs to set the new compression method
fields for SSL2, too.  TBR=nelson.


git-svn-id: svn://10.0.0.236/trunk@258921 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-07 22:11:57 +00:00
wtc%google.com
c0ec7fbfae Bug 275744: In client hello, list compression methods in the order of
desirability so that servers that simply pick the first mutually supported
compression method will pick the best compression method.  Add compression
method info to the SSLChannelInfo structure.  Rename SSL3CompressionMethod
to SSLCompressionMethod and add the ssl_ prefix to the enum constants.
Remove an extra comma in strsclnt.c that breaks the concatenation of two
string literals.  r=agl,rrelyea,nelson.
Modified Files:
	cmd/selfserv/selfserv.c cmd/strsclnt/strsclnt.c
	cmd/tstclnt/tstclnt.c lib/ssl/ssl3con.c lib/ssl/ssl3ext.c
	lib/ssl/ssl3prot.h lib/ssl/sslimpl.h lib/ssl/sslinfo.c
	lib/ssl/sslsnce.c lib/ssl/sslt.h tests/ssl/sslstress.txt


git-svn-id: svn://10.0.0.236/trunk@258919 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-07 18:23:06 +00:00
nelson%bolyard.com
089608da06 Bug 526689: (CVE-2009-3555) SSL3 & TLS Renegotiation Vulnerability
Disable SSL 3.x renegotiation by default.  Add new options to re-enable.
r=wtc,rrelyea


git-svn-id: svn://10.0.0.236/trunk@258888 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-06 20:11:29 +00:00
wtc%google.com
7904b372b3 Bug 275744: Implement TLS compression RFC 3749. Add the SSL_ENABLE_DEFLATE
SSL option and the -z command-line option for tstclnt, strsclnt, and
selfserv for enabling the DEFLATE compression method.  The patch is
contributed by Adam Langley <agl@chromium.org> of Google.  r=nelson.
Modified Files:
	cmd/selfserv/selfserv.c cmd/strsclnt/strsclnt.c
	cmd/tstclnt/tstclnt.c lib/ssl/Makefile lib/ssl/ssl.h
	lib/ssl/ssl3con.c lib/ssl/ssl3prot.h lib/ssl/sslerr.h
	lib/ssl/sslimpl.h lib/ssl/sslsock.c


git-svn-id: svn://10.0.0.236/trunk@258862 18797224-902f-48f8-a5cc-f745e15eee43
2009-11-04 17:19:25 +00:00
wtc%google.com
689c26eeba Bug 525056: Use NSS_SecureMemcmp to check the session ticket's HMAC.
Trevor Perrin <trevor@cryptography.com> reported the bug and outlined a
fix.  The patch is contributed by Adam Langley of Google
<agl@chromium.org>.  r=wtc.


git-svn-id: svn://10.0.0.236/trunk@258817 18797224-902f-48f8-a5cc-f745e15eee43
2009-10-29 01:44:04 +00:00
wtc%google.com
e8653a0f01 Bug 522580: Add the NSS_SecureMemcmp function that performs a constant-time
compare of two memory regions, and use it in libSSL for comparing secret
data.  The patch is contributed by Adam Langley <agl@chromium.org> of
Google.  r=wtc,nelson.
Modified Files:
	lib/ssl/ssl3con.c lib/ssl/sslcon.c lib/ssl/sslgathr.c
	lib/util/nssutil.def lib/util/secport.c lib/util/secport.h


git-svn-id: svn://10.0.0.236/trunk@258699 18797224-902f-48f8-a5cc-f745e15eee43
2009-10-16 17:45:36 +00:00
wtc%google.com
dd52174c15 Bug 510436: Add macros for build numbers (4th component of version number)
to nssutil.h and nss.h.  r=christophe,nelson.
Modified Files:
	lib/nss/nss.h lib/nss/nss.rc lib/nss/nssinit.c
	lib/smime/smime.rc lib/ssl/ssl.rc lib/util/nssutil.h
	lib/util/nssutil.rc


git-svn-id: svn://10.0.0.236/trunk@258338 18797224-902f-48f8-a5cc-f745e15eee43
2009-09-09 14:17:36 +00:00
julien.pierre.boogz%sun.com
b0b9a5cab2 Fix for bug 494107 . Fix rpath in coreconf. r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@257464 18797224-902f-48f8-a5cc-f745e15eee43
2009-06-11 00:55:53 +00:00
nelson%bolyard.com
d75e071b87 Bug 491044: Remove support for VMS (a.k.a., OpenVMS) from NSS, r=rrelyea
git-svn-id: svn://10.0.0.236/trunk@257408 18797224-902f-48f8-a5cc-f745e15eee43
2009-06-05 02:34:15 +00:00
wtc%google.com
aab096c8c3 Bug 487858: Remove obsolete variables MOZILLA_SECURITY_BUILD,
MOZILLA_BSAFE_BUILD, and CRYPTODIR.  r=emaldona.
Modified Files:
	cmd/platlibs.mk lib/Makefile lib/softoken/config.mk
	lib/softoken/legacydb/config.mk lib/ssl/config.mk


git-svn-id: svn://10.0.0.236/trunk@256902 18797224-902f-48f8-a5cc-f745e15eee43
2009-04-12 17:19:26 +00:00
emaldona%redhat.com
a0e0b2022f Bug 486698, r=wtc, Changed .mk files to enable building of major components independently and in a chain manner by downstream distributions
git-svn-id: svn://10.0.0.236/trunk@256894 18797224-902f-48f8-a5cc-f745e15eee43
2009-04-11 21:18:48 +00:00
nelson%bolyard.com
18113d7a39 Bug 486999: Calling SSL_SetSockPeerID a second time leaks the previous value
r=rrelyea


git-svn-id: svn://10.0.0.236/trunk@256861 18797224-902f-48f8-a5cc-f745e15eee43
2009-04-09 01:46:22 +00:00
nelson%bolyard.com
d049b9bded Bug 481216: Fix specific spelling errors in NSS & NSPR, r=timeless
git-svn-id: svn://10.0.0.236/trunk@256449 18797224-902f-48f8-a5cc-f745e15eee43
2009-03-04 21:57:28 +00:00
nelson%bolyard.com
d2e7f8c5a8 Bug 441321: Tolerate incorrect encoding of DSA signatures in SSL 3.0 handshakes
r=wtc.


git-svn-id: svn://10.0.0.236/trunk@256213 18797224-902f-48f8-a5cc-f745e15eee43
2009-02-13 05:23:23 +00:00
nelson%bolyard.com
3bf81e175c Bug 453234: Support for SEED Cipher Suites to TLS RFC 4010
patch by Yeonjung Kang <kang.yeonjung@gmail.com>, r=nelson


git-svn-id: svn://10.0.0.236/trunk@255547 18797224-902f-48f8-a5cc-f745e15eee43
2008-12-17 06:09:22 +00:00
nelson%bolyard.com
e25cdff2dd Bug 466180 - SSL server changes for BSD Unix
Patches by Kaspar Brand <mozbugzilla@velox.ch>, r=nelson


git-svn-id: svn://10.0.0.236/trunk@255294 18797224-902f-48f8-a5cc-f745e15eee43
2008-12-02 06:36:59 +00:00
wtc%google.com
5ef4dc5b70 Bug 454120: removed parentheses that are no longer necessary after
"&& !defined(_WIN32_WCE)" was removed.  r=nelson.
Modified Files:
	sslmutex.c sslsnce.c


git-svn-id: svn://10.0.0.236/trunk@255172 18797224-902f-48f8-a5cc-f745e15eee43
2008-11-21 21:00:13 +00:00
nelson%bolyard.com
e61ba41ed5 Back out last patch, because it seems to have made tinderboxes fail on
Windows. Sheriff Nelson


git-svn-id: svn://10.0.0.236/trunk@255148 18797224-902f-48f8-a5cc-f745e15eee43
2008-11-20 07:37:25 +00:00
nelson%bolyard.com
7aa2b49d91 Bug 454120: Problems Compiling SECURITY module for WinMobile
Patch by Doug Turner <doug.turner@gmail.com>, r=nelson


git-svn-id: svn://10.0.0.236/trunk@255144 18797224-902f-48f8-a5cc-f745e15eee43
2008-11-20 04:39:59 +00:00
nelson%bolyard.com
9196c7463d Bug 462874: Can not reliably wait for close_notify
Patch by Miloslav Trmac <mitr@redhat.com>, r=nelson


git-svn-id: svn://10.0.0.236/trunk@255138 18797224-902f-48f8-a5cc-f745e15eee43
2008-11-20 00:45:25 +00:00
christophe.ravel.bugs%sun.com
15ebacce7e Bug 463678 - Need to add RPATH to 64-bit libraries on HP-UX
r=julien


git-svn-id: svn://10.0.0.236/trunk@255128 18797224-902f-48f8-a5cc-f745e15eee43
2008-11-19 20:09:51 +00:00
nelson%bolyard.com
172499bfd0 Bug 421634: Don't send an SNI Client Hello extension bearing an IPv6 address
r=wtc,julien.pierre


git-svn-id: svn://10.0.0.236/trunk@254543 18797224-902f-48f8-a5cc-f745e15eee43
2008-10-06 22:04:15 +00:00
wtc%google.com
58d4cc9297 Bug 456862: added a block comment to explain why we don't respond with a
close_notify alert after we receive a close_notify alert.  Reordered the
tests in ssl_SecureClose and ssl_SecureShutdown to make it clear that the
tests in those two functions are almost the same.  r=nelson.


git-svn-id: svn://10.0.0.236/trunk@254526 18797224-902f-48f8-a5cc-f745e15eee43
2008-10-03 19:20:20 +00:00
nelson%bolyard.com
31e128e527 Bug 455348: Don't use DEBUG_nelsonb. r=wtc
git-svn-id: svn://10.0.0.236/trunk@254473 18797224-902f-48f8-a5cc-f745e15eee43
2008-09-30 03:53:01 +00:00
wtc%google.com
997b195396 Bug 426266: Decoupled lib/softoken and lib/ssl. lib/softoken should not
include any headers from lib/ssl.  r=nelson.
Modified Files:
	softoken/pkcs11c.c ssl/manifest.mn ssl/ssl3con.c


git-svn-id: svn://10.0.0.236/trunk@254368 18797224-902f-48f8-a5cc-f745e15eee43
2008-09-22 23:47:00 +00:00
wtc%google.com
b23ff9f322 Bug 452865: removed obsolete linker flags that were needed when libnss3
was linked with libsoftokn3.  r=glen.beasley.
Modified Files:
	cmd/platlibs.mk lib/nss/config.mk lib/smime/config.mk
	lib/ssl/config.mk


git-svn-id: svn://10.0.0.236/trunk@254077 18797224-902f-48f8-a5cc-f745e15eee43
2008-09-05 23:30:52 +00:00
wtc%google.com
06fe065f74 Bug 434187: fixed compiler warnings reported by GCC on Mac OS X.
r=julien.pierre


git-svn-id: svn://10.0.0.236/trunk@252143 18797224-902f-48f8-a5cc-f745e15eee43
2008-06-06 01:16:31 +00:00
wtc%google.com
1c27f0e02e Bug 434187: fixed a MSVC compiler warning about signed/unsigned comparison.
r=nelson


git-svn-id: svn://10.0.0.236/trunk@252097 18797224-902f-48f8-a5cc-f745e15eee43
2008-06-04 01:27:36 +00:00
wtc%google.com
014a34c5d2 Bug 430875: Documented the policy for the order of cipher suites in
SSL_ImplementedCiphers.  r=nelson.


git-svn-id: svn://10.0.0.236/trunk@251352 18797224-902f-48f8-a5cc-f745e15eee43
2008-05-07 20:45:53 +00:00
nelson%bolyard.com
0106be60bd Bug 420644: Improve SSL tracing of key derivation, r=julien.pierre
git-svn-id: svn://10.0.0.236/trunk@250832 18797224-902f-48f8-a5cc-f745e15eee43
2008-04-27 02:06:05 +00:00
julien.pierre.boogz%sun.com
2294a416d4 Fix for bug 405652 . TLS ClientHello message has incorrect gmt_unix_time . r=nelson
git-svn-id: svn://10.0.0.236/trunk@248035 18797224-902f-48f8-a5cc-f745e15eee43
2008-03-18 01:32:18 +00:00
wtc%google.com
dd1ffe05f6 Bug 419523: Export Cert_NewTempCertificate. Remove unnecessary inclusions
of nssrenam.h.  Remove functions that no longer need to be renamed from
nssrenam.h.  r=rrelyea.
Modified Files:
	cmd/vfychain/vfychain.c lib/certdb/stanpcertdb.c
	lib/crmf/asn1cmn.c lib/crmf/cmmfrec.c lib/crmf/respcmn.c
	lib/nss/nss.def lib/nss/nssrenam.h lib/pkcs12/p12e.c
	lib/pkcs7/certread.c lib/pkcs7/p7decode.c lib/pkcs7/p7encode.c
	lib/smime/cmsutil.c lib/ssl/ssl3con.c lib/ssl/ssl3ecc.c
	lib/ssl/sslnonce.c lib/ssl/sslsnce.c


git-svn-id: svn://10.0.0.236/trunk@247455 18797224-902f-48f8-a5cc-f745e15eee43
2008-03-10 00:01:28 +00:00
wtc%google.com
a522c3ec67 Bug 417641: fixed compiler warnings in SSL_CanBypass. r=nelson.
git-svn-id: svn://10.0.0.236/trunk@247453 18797224-902f-48f8-a5cc-f745e15eee43
2008-03-09 23:43:26 +00:00
wtc%google.com
f7911d005d Bug 419242: moved a makefile rule from config.mk to Makefile so that 'all'
is the default (first) makefile target.  r=christophe.ravel


git-svn-id: svn://10.0.0.236/trunk@247451 18797224-902f-48f8-a5cc-f745e15eee43
2008-03-09 23:17:25 +00:00
wtc%google.com
6289ace530 Bug 403563: implement the TLS session ticket extension (rfc4507bis). The
patch is contributed by Nagendra Modadugu <ngm+mozilla@google.com>.  A
small portion (PKCS #11 code and tests) was written by Wan-Teh Chang
<wtc@google.com>.  r=nelson,wtc
Modified Files:
	cmd/lib/SSLerrs.h cmd/selfserv/selfserv.c
	cmd/strsclnt/strsclnt.c cmd/tstclnt/tstclnt.c
	lib/ssl/manifest.mn lib/ssl/ssl.h lib/ssl/ssl3con.c
	lib/ssl/ssl3ecc.c lib/ssl/ssl3prot.h lib/ssl/sslerr.h
	lib/ssl/sslimpl.h lib/ssl/sslnonce.c lib/ssl/sslsnce.c
	lib/ssl/sslsock.c lib/ssl/sslt.h tests/ssl/sslstress.txt
Added Files:
	lib/ssl/ssl3ext.c


git-svn-id: svn://10.0.0.236/trunk@247232 18797224-902f-48f8-a5cc-f745e15eee43
2008-03-06 20:16:24 +00:00