Replace NSS with Pale Moon's

security/nss/lib/ssl/sslsecur.c

@@ -15,6 +15,8 @@
 #include "pk11func.h" /* for PK11_GenerateRandom */
 #include "nss.h"      /* for NSS_RegisterShutdown */
 #include "prinit.h"   /* for PR_CallOnceWithArg */
+#include "tls13ech.h"
+#include "tls13psk.h"
 
 /* Step through the handshake functions.
  *
@@ -48,11 +50,34 @@ ssl_Do1stHandshake(sslSocket *ss)
     return rv;
 }
 
-void
+SECStatus
 ssl_FinishHandshake(sslSocket *ss)
 {
     PORT_Assert(ss->opt.noLocks || ssl_Have1stHandshakeLock(ss));
     PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
+    PORT_Assert(ss->ssl3.hs.echAccepted ||
+                (ss->opt.enableTls13BackendEch &&
+                 ss->xtnData.ech &&
+                 ss->xtnData.ech->receivedInnerXtn) ==
+                    ssl3_ExtensionNegotiated(ss, ssl_tls13_encrypted_client_hello_xtn));
+
+    /* If ECH was OFFERED to (echHpkeCtx is set on the client) DISABLED by the
+     * server through negotiation of a TLS version < 1.3, an 'ech_required'
+     * alert MUST be sent to inform the server about the intention / possible
+     * misconfiguration. */
+    if (!ss->sec.isServer && ss->ssl3.hs.echHpkeCtx && !ss->ssl3.hs.echAccepted) {
+        SSL3_SendAlert(ss, alert_fatal, ech_required);
+        /* "If [one, none] of the retry_configs contains a supported version,
+         * the client can regard ECH as securely [replaced, disabled] by the
+         * server." */
+        if (ss->xtnData.ech && ss->xtnData.ech->retryConfigs.len) {
+            PORT_SetError(SSL_ERROR_ECH_RETRY_WITH_ECH);
+            ss->xtnData.ech->retryConfigsValid = PR_TRUE;
+        } else {
+            PORT_SetError(SSL_ERROR_ECH_RETRY_WITHOUT_ECH);
+        }
+        return SECFailure;
+    }
 
     SSL_TRC(3, ("%d: SSL[%d]: handshake is completed", SSL_GETPID(), ss->fd));
 
@@ -68,6 +93,8 @@ ssl_FinishHandshake(sslSocket *ss)
     }
 
     ssl_FreeEphemeralKeyPairs(ss);
+
+    return SECSuccess;
 }
 
 /*
@@ -172,7 +199,27 @@ SSL_ResetHandshake(PRFileDesc *s, PRBool asServer)
     ssl_Release1stHandshakeLock(ss);
 
     ssl3_DestroyRemoteExtensions(&ss->ssl3.hs.remoteExtensions);
+    ssl3_DestroyRemoteExtensions(&ss->ssl3.hs.echOuterExtensions);
     ssl3_ResetExtensionData(&ss->xtnData, ss);
+    tls13_ResetHandshakePsks(ss, &ss->ssl3.hs.psks);
+
+    if (ss->ssl3.hs.echHpkeCtx) {
+        PK11_HPKE_DestroyContext(ss->ssl3.hs.echHpkeCtx, PR_TRUE);
+        ss->ssl3.hs.echHpkeCtx = NULL;
+        PORT_Assert(ss->ssl3.hs.echPublicName);
+        PORT_Free((void *)ss->ssl3.hs.echPublicName); /* CONST */
+        ss->ssl3.hs.echPublicName = NULL;
+    }
+    /* Make sure greaseEchBuf is freed in ECH setups without echHpkeCtx. */
+    if (ss->ssl3.hs.echHpkeCtx ||
+        ss->opt.enableTls13BackendEch ||
+        ss->opt.enableTls13GreaseEch) {
+        sslBuffer_Clear(&ss->ssl3.hs.greaseEchBuf);
+    }
+
+    tls13_ClientGreaseDestroy(ss);
+
+    tls_ClientHelloExtensionPermutationDestroy(ss);
 
     if (!ss->TCPconnected)
         ss->TCPconnected = (PR_SUCCESS == ssl_DefGetpeername(ss, &addr));
@@ -544,6 +591,17 @@ DoRecv(sslSocket *ss, unsigned char *out, int len, int flags)
     PORT_Assert(ss->gs.readOffset <= ss->gs.writeOffset);
     rv = amount;
 
+#ifdef DEBUG
+    /* In Debug builds free and zero gather plaintext buffer after its content
+     * has been used/copied for advanced ASAN coverage/utilization.
+     * This frees the buffer after reception of application data,
+     * non-application data is freed at the end of
+     * ssl3con.c/ssl3_HandleRecord(). */
+    if (ss->gs.writeOffset == ss->gs.readOffset) {
+        sslBuffer_Clear(&ss->gs.buf);
+    }
+#endif
+
     SSL_TRC(30, ("%d: SSL[%d]: amount=%d available=%d",
                  SSL_GETPID(), ss->fd, amount, available));
     PRINT_BUF(4, (ss, "DoRecv receiving plaintext:", out, amount));
@@ -1275,6 +1333,43 @@ SSL_AuthCertificateComplete(PRFileDesc *fd, PRErrorCode error)
     return rv;
 }
 
+SECStatus
+SSL_ClientCertCallbackComplete(PRFileDesc *fd, SECStatus outcome, SECKEYPrivateKey *clientPrivateKey,
+                               CERTCertificate *clientCertificate)
+{
+    SECStatus rv;
+    sslSocket *ss = ssl_FindSocket(fd);
+
+    if (!ss) {
+        SSL_DBG(("%d: SSL[%d]: bad socket in SSL_ClientCertCallbackComplete",
+                 SSL_GETPID(), fd));
+        return SECFailure;
+    }
+
+    /* There exists a codepath which exercises each lock.
+     * Socket is blocked whilst waiting on this callback anyway. */
+    ssl_Get1stHandshakeLock(ss);
+    ssl_GetRecvBufLock(ss);
+    ssl_GetSSL3HandshakeLock(ss);
+
+    if (!ss->ssl3.hs.clientCertificatePending) {
+        /* Application invoked callback at wrong time */
+        SSL_DBG(("%d: SSL[%d]: socket not waiting for SSL_ClientCertCallbackComplete",
+                 SSL_GETPID(), fd));
+        PORT_SetError(PR_INVALID_STATE_ERROR);
+        rv = SECFailure;
+        goto cleanup;
+    }
+
+    rv = ssl3_ClientCertCallbackComplete(ss, outcome, clientPrivateKey, clientCertificate);
+
+cleanup:
+    ssl_ReleaseRecvBufLock(ss);
+    ssl_ReleaseSSL3HandshakeLock(ss);
+    ssl_Release1stHandshakeLock(ss);
+    return rv;
+}
+
 /* For more info see ssl.h */
 SECStatus
 SSL_SNISocketConfigHook(PRFileDesc *fd, SSLSNISocketConfig func,