Replace NSS with Pale Moon's

security/nss/lib/ssl/sslsock.c

@@ -19,7 +19,8 @@
 #include "nss.h"
 #include "pk11pqg.h"
 #include "pk11pub.h"
-#include "tls13esni.h"
+#include "tls13ech.h"
+#include "tls13psk.h"
 #include "tls13subcerts.h"
 
 static const sslSocketOps ssl_default_ops = { /* No SSL. */
@@ -78,7 +79,7 @@ static sslOptions ssl_defaults = {
     .enableOCSPStapling = PR_FALSE,
     .enableDelegatedCredentials = PR_FALSE,
     .enableALPN = PR_TRUE,
-    .reuseServerECDHEKey = PR_TRUE,
+    .reuseServerECDHEKey = PR_FALSE,
     .enableFallbackSCSV = PR_FALSE,
     .enableServerDhe = PR_TRUE,
     .enableExtendedMS = PR_TRUE,
@@ -86,22 +87,29 @@ static sslOptions ssl_defaults = {
     .requireDHENamedGroups = PR_FALSE,
     .enable0RttData = PR_FALSE,
     .enableTls13CompatMode = PR_FALSE,
+    .enableDtls13VersionCompat = PR_FALSE,
     .enableDtlsShortHeader = PR_FALSE,
-    .enableHelloDowngradeCheck = PR_FALSE,
+    .enableHelloDowngradeCheck = PR_TRUE,
     .enableV2CompatibleHello = PR_FALSE,
-    .enablePostHandshakeAuth = PR_FALSE
+    .enablePostHandshakeAuth = PR_FALSE,
+    .suppressEndOfEarlyData = PR_FALSE,
+    .enableTls13GreaseEch = PR_FALSE,
+    .enableTls13BackendEch = PR_FALSE,
+    .callExtensionWriterOnEchInner = PR_FALSE,
+    .enableGrease = PR_FALSE,
+    .enableChXtnPermutation = PR_FALSE
 };
 
 /*
  * default range of enabled SSL/TLS protocols
  */
 static SSLVersionRange versions_defaults_stream = {
-    SSL_LIBRARY_VERSION_TLS_1_0,
+    SSL_LIBRARY_VERSION_TLS_1_2,
     SSL_LIBRARY_VERSION_TLS_1_3
 };
 
 static SSLVersionRange versions_defaults_datagram = {
-    SSL_LIBRARY_VERSION_TLS_1_1,
+    SSL_LIBRARY_VERSION_TLS_1_2,
     SSL_LIBRARY_VERSION_TLS_1_2
 };
 
@@ -368,12 +376,18 @@ ssl_DupSocket(sslSocket *os)
         ss->resumptionTokenCallback = os->resumptionTokenCallback;
         ss->resumptionTokenContext = os->resumptionTokenContext;
 
-        if (os->esniKeys) {
-            ss->esniKeys = tls13_CopyESNIKeys(os->esniKeys);
-            if (!ss->esniKeys) {
+        rv = tls13_CopyEchConfigs(&os->echConfigs, &ss->echConfigs);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+        if (os->echPrivKey && os->echPubKey) {
+            ss->echPrivKey = SECKEY_CopyPrivateKey(os->echPrivKey);
+            ss->echPubKey = SECKEY_CopyPublicKey(os->echPubKey);
+            if (!ss->echPrivKey || !ss->echPubKey) {
                 goto loser;
             }
         }
+
         if (os->antiReplay) {
             ss->antiReplay = tls13_RefAntiReplayContext(os->antiReplay);
             PORT_Assert(ss->antiReplay); /* Can't fail. */
@@ -381,10 +395,12 @@ ssl_DupSocket(sslSocket *os)
                 goto loser;
             }
         }
-        /* The original socket 'owns' the copy of these, so
-         * just set the target copies to zero */
-        ss->peerSignatureSchemes = NULL;
-        ss->peerSignatureSchemeCount = 0;
+        if (os->psk) {
+            ss->psk = tls13_CopyPsk(os->psk);
+            if (!ss->psk) {
+                goto loser;
+            }
+        }
 
         /* Create security data */
         rv = ssl_CopySecurityInfo(ss, os);
@@ -471,14 +487,15 @@ ssl_DestroySocketContents(sslSocket *ss)
 
     ssl_ClearPRCList(&ss->ssl3.hs.dtlsSentHandshake, NULL);
     ssl_ClearPRCList(&ss->ssl3.hs.dtlsRcvdHandshake, NULL);
+    tls13_DestroyPskList(&ss->ssl3.hs.psks);
 
-    /* data in peer Signature schemes comes from the buffer system,
-     * so there is nothing to free here. Make sure that's the case */
-    PORT_Assert(ss->peerSignatureSchemes == NULL);
-    PORT_Assert(ss->peerSignatureSchemeCount == 0);
-
-    tls13_DestroyESNIKeys(ss->esniKeys);
     tls13_ReleaseAntiReplayContext(ss->antiReplay);
+
+    tls13_DestroyPsk(ss->psk);
+
+    tls13_DestroyEchConfigs(&ss->echConfigs);
+    SECKEY_DestroyPrivateKey(ss->echPrivKey);
+    SECKEY_DestroyPublicKey(ss->echPubKey);
 }
 
 /*
@@ -872,6 +889,18 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 which, PRIntn val)
             ss->opt.enablePostHandshakeAuth = val;
             break;
 
+        case SSL_SUPPRESS_END_OF_EARLY_DATA:
+            ss->opt.suppressEndOfEarlyData = val;
+            break;
+
+        case SSL_ENABLE_GREASE:
+            ss->opt.enableGrease = val;
+            break;
+
+        case SSL_ENABLE_CH_EXTENSION_PERMUTATION:
+            ss->opt.enableChXtnPermutation = val;
+            break;
+
         default:
             PORT_SetError(SEC_ERROR_INVALID_ARGS);
             rv = SECFailure;
@@ -1026,6 +1055,9 @@ SSL_OptionGet(PRFileDesc *fd, PRInt32 which, PRIntn *pVal)
         case SSL_ENABLE_POST_HANDSHAKE_AUTH:
             val = ss->opt.enablePostHandshakeAuth;
             break;
+        case SSL_SUPPRESS_END_OF_EARLY_DATA:
+            val = ss->opt.suppressEndOfEarlyData;
+            break;
         default:
             PORT_SetError(SEC_ERROR_INVALID_ARGS);
             rv = SECFailure;
@@ -1164,6 +1196,9 @@ SSL_OptionGetDefault(PRInt32 which, PRIntn *pVal)
         case SSL_ENABLE_POST_HANDSHAKE_AUTH:
             val = ssl_defaults.enablePostHandshakeAuth;
             break;
+        case SSL_SUPPRESS_END_OF_EARLY_DATA:
+            val = ssl_defaults.suppressEndOfEarlyData;
+            break;
         default:
             PORT_SetError(SEC_ERROR_INVALID_ARGS);
             rv = SECFailure;
@@ -1375,6 +1410,10 @@ SSL_OptionSetDefault(PRInt32 which, PRIntn val)
             ssl_defaults.enablePostHandshakeAuth = val;
             break;
 
+        case SSL_SUPPRESS_END_OF_EARLY_DATA:
+            ssl_defaults.suppressEndOfEarlyData = val;
+            break;
+
         default:
             PORT_SetError(SEC_ERROR_INVALID_ARGS);
             return SECFailure;
@@ -1440,6 +1479,10 @@ SSL_CipherPolicySet(PRInt32 which, PRInt32 policy)
     if (rv != SECSuccess) {
         return rv;
     }
+    if (NSS_IsPolicyLocked()) {
+        PORT_SetError(SEC_ERROR_POLICY_LOCKED);
+        return SECFailure;
+    }
     return ssl_CipherPolicySet(which, policy);
 }
 
@@ -1486,10 +1529,15 @@ SECStatus
 SSL_CipherPrefSetDefault(PRInt32 which, PRBool enabled)
 {
     SECStatus rv = ssl_Init();
+    PRInt32 locks;
 
     if (rv != SECSuccess) {
         return rv;
     }
+    rv = NSS_OptionGet(NSS_DEFAULT_LOCKS, &locks);
+    if ((rv == SECSuccess) && (locks & NSS_DEFAULT_SSL_LOCK)) {
+        return SECSuccess;
+    }
     return ssl_CipherPrefSetDefault(which, enabled);
 }
 
@@ -1515,11 +1563,17 @@ SECStatus
 SSL_CipherPrefSet(PRFileDesc *fd, PRInt32 which, PRBool enabled)
 {
     sslSocket *ss = ssl_FindSocket(fd);
+    PRInt32 locks;
+    SECStatus rv;
 
     if (!ss) {
         SSL_DBG(("%d: SSL[%d]: bad socket in CipherPrefSet", SSL_GETPID(), fd));
         return SECFailure;
     }
+    rv = NSS_OptionGet(NSS_DEFAULT_LOCKS, &locks);
+    if ((rv == SECSuccess) && (locks & NSS_DEFAULT_SSL_LOCK)) {
+        return SECSuccess;
+    }
     if (ssl_IsRemovedCipherSuite(which))
         return SECSuccess;
     return ssl3_CipherPrefSet(ss, (ssl3CipherSuite)which, enabled);
@@ -1673,7 +1727,7 @@ NSS_SetDomesticPolicy(void)
     /* If we've already defined some policy oids, skip changing them */
     rv = NSS_GetAlgorithmPolicy(SEC_OID_APPLY_SSL_POLICY, &policy);
     if ((rv == SECSuccess) && (policy & NSS_USE_POLICY_IN_SSL)) {
-        return ssl_Init(); /* make sure the policies have bee loaded */
+        return ssl_Init(); /* make sure the policies have been loaded */
     }
 
     for (cipher = SSL_ImplementedCiphers; *cipher != 0; ++cipher) {
@@ -2053,23 +2107,35 @@ ssl_SelectDHEGroup(sslSocket *ss, const sslNamedGroupDef **groupDef)
         ssl_grp_ffdhe_custom, WEAK_DHE_SIZE, ssl_kea_dh,
         SEC_OID_TLS_DHE_CUSTOM, PR_TRUE
     };
+    PRInt32 minDH;
+    SECStatus rv;
+
+    // make sure we select a group consistent with our
+    // current policy policy
+    rv = NSS_OptionGet(NSS_DH_MIN_KEY_SIZE, &minDH);
+    if (rv != SECSuccess || minDH <= 0) {
+        minDH = DH_MIN_P_BITS;
+    }
 
     /* Only select weak groups in TLS 1.2 and earlier, but not if the client has
      * indicated that it supports an FFDHE named group. */
     if (ss->ssl3.dheWeakGroupEnabled &&
         ss->version < SSL_LIBRARY_VERSION_TLS_1_3 &&
-        !ss->xtnData.peerSupportsFfdheGroups) {
+        !ss->xtnData.peerSupportsFfdheGroups &&
+        weak_group_def.bits >= minDH) {
         *groupDef = &weak_group_def;
         return SECSuccess;
     }
     if (ss->ssl3.dhePreferredGroup &&
-        ssl_NamedGroupEnabled(ss, ss->ssl3.dhePreferredGroup)) {
+        ssl_NamedGroupEnabled(ss, ss->ssl3.dhePreferredGroup) &&
+        ss->ssl3.dhePreferredGroup->bits >= minDH) {
         *groupDef = ss->ssl3.dhePreferredGroup;
         return SECSuccess;
     }
     for (i = 0; i < SSL_NAMED_GROUP_COUNT; ++i) {
         if (ss->namedGroupPreferences[i] &&
-            ss->namedGroupPreferences[i]->keaType == ssl_kea_dh) {
+            ss->namedGroupPreferences[i]->keaType == ssl_kea_dh &&
+            ss->namedGroupPreferences[i]->bits >= minDH) {
             *groupDef = ss->namedGroupPreferences[i];
             return SECSuccess;
         }
@@ -2169,12 +2235,18 @@ ssl_NextProtoNegoCallback(void *arg, PRFileDesc *fd,
 {
     unsigned int i, j;
     sslSocket *ss = ssl_FindSocket(fd);
-
     if (!ss) {
         SSL_DBG(("%d: SSL[%d]: bad socket in ssl_NextProtoNegoCallback",
                  SSL_GETPID(), fd));
         return SECFailure;
     }
+    if (ss->opt.nextProtoNego.len == 0) {
+        SSL_DBG(("%d: SSL[%d]: ssl_NextProtoNegoCallback ALPN disabled",
+                 SSL_GETPID(), fd));
+        SSL3_SendAlert(ss, alert_fatal, unsupported_extension);
+        return SECFailure;
+    }
+
     PORT_Assert(protoMaxLen <= 255);
     if (protoMaxLen > 255) {
         PORT_SetError(SEC_ERROR_OUTPUT_LEN);
@@ -2214,7 +2286,7 @@ SSL_SetNextProtoNego(PRFileDesc *fd, const unsigned char *data,
         return SECFailure;
     }
 
-    if (ssl3_ValidateAppProtocol(data, length) != SECSuccess) {
+    if (length > 0 && ssl3_ValidateAppProtocol(data, length) != SECSuccess) {
         return SECFailure;
     }
 
@@ -2223,11 +2295,13 @@ SSL_SetNextProtoNego(PRFileDesc *fd, const unsigned char *data,
      * first protocol to the end of the list. */
     ssl_GetSSL3HandshakeLock(ss);
     SECITEM_FreeItem(&ss->opt.nextProtoNego, PR_FALSE);
-    SECITEM_AllocItem(NULL, &ss->opt.nextProtoNego, length);
-    size_t firstLen = data[0] + 1;
-    /* firstLen <= length is ensured by ssl3_ValidateAppProtocol. */
-    PORT_Memcpy(ss->opt.nextProtoNego.data + (length - firstLen), data, firstLen);
-    PORT_Memcpy(ss->opt.nextProtoNego.data, data + firstLen, length - firstLen);
+    if (length > 0) {
+        SECITEM_AllocItem(NULL, &ss->opt.nextProtoNego, length);
+        size_t firstLen = data[0] + 1;
+        /* firstLen <= length is ensured by ssl3_ValidateAppProtocol. */
+        PORT_Memcpy(ss->opt.nextProtoNego.data + (length - firstLen), data, firstLen);
+        PORT_Memcpy(ss->opt.nextProtoNego.data, data + firstLen, length - firstLen);
+    }
     ssl_ReleaseSSL3HandshakeLock(ss);
 
     return SSL_SetNextProtoCallback(fd, ssl_NextProtoNegoCallback, NULL);
@@ -2343,6 +2417,7 @@ SSL_ReconfigFD(PRFileDesc *model, PRFileDesc *fd)
 {
     sslSocket *sm = NULL, *ss = NULL;
     PRCList *cursor;
+    SECStatus rv;
 
     if (model == NULL) {
         PR_SetError(SEC_ERROR_INVALID_ARGS, 0);
@@ -2412,7 +2487,6 @@ SSL_ReconfigFD(PRFileDesc *model, PRFileDesc *fd)
     for (cursor = PR_NEXT_LINK(&sm->extensionHooks);
          cursor != &sm->extensionHooks;
          cursor = PR_NEXT_LINK(cursor)) {
-        SECStatus rv;
         sslCustomExtensionHooks *hook = (sslCustomExtensionHooks *)cursor;
         rv = SSL_InstallExtensionHooks(ss->fd, hook->type,
                                        hook->writer, hook->writerArg,
@@ -2438,12 +2512,19 @@ SSL_ReconfigFD(PRFileDesc *model, PRFileDesc *fd)
         }
     }
 
-    /* Copy ESNI. */
-    tls13_DestroyESNIKeys(ss->esniKeys);
-    ss->esniKeys = NULL;
-    if (sm->esniKeys) {
-        ss->esniKeys = tls13_CopyESNIKeys(sm->esniKeys);
-        if (!ss->esniKeys) {
+    /* Copy ECH. */
+    tls13_DestroyEchConfigs(&ss->echConfigs);
+    SECKEY_DestroyPrivateKey(ss->echPrivKey);
+    SECKEY_DestroyPublicKey(ss->echPubKey);
+    rv = tls13_CopyEchConfigs(&sm->echConfigs, &ss->echConfigs);
+    if (rv != SECSuccess) {
+        return NULL;
+    }
+    if (sm->echPrivKey && sm->echPubKey) {
+        /* Might be client (no keys). */
+        ss->echPrivKey = SECKEY_CopyPrivateKey(sm->echPrivKey);
+        ss->echPubKey = SECKEY_CopyPublicKey(sm->echPubKey);
+        if (!ss->echPrivKey || !ss->echPubKey) {
             return NULL;
         }
     }
@@ -2461,6 +2542,8 @@ SSL_ReconfigFD(PRFileDesc *model, PRFileDesc *fd)
         }
     }
 
+    tls13_ResetHandshakePsks(sm, &ss->ssl3.hs.psks);
+
     if (sm->authCertificate)
         ss->authCertificate = sm->authCertificate;
     if (sm->authCertificateArg)
@@ -2491,8 +2574,7 @@ SSL_ReconfigFD(PRFileDesc *model, PRFileDesc *fd)
         ss->handshakeCallbackData = sm->handshakeCallbackData;
     if (sm->pkcs11PinArg)
         ss->pkcs11PinArg = sm->pkcs11PinArg;
-    ss->peerSignatureSchemes = NULL;
-    ss->peerSignatureSchemeCount = 0;
+
     return fd;
 }
 
@@ -3818,7 +3900,7 @@ loser:
     return SECFailure;
 }
 
-#if defined(XP_UNIX) || defined(XP_WIN32) || defined(XP_BEOS)
+#if defined(XP_UNIX) || defined(XP_WIN32)
 #define NSS_HAVE_GETENV 1
 #endif
 
@@ -4126,6 +4208,7 @@ ssl_NewSocket(PRBool makeLocks, SSLProtocolVariant protocolVariant)
     PR_INIT_CLIST(&ss->serverCerts);
     PR_INIT_CLIST(&ss->ephemeralKeyPairs);
     PR_INIT_CLIST(&ss->extensionHooks);
+    PR_INIT_CLIST(&ss->echConfigs);
 
     ss->dbHandle = CERT_GetDefaultCertDB();
 
@@ -4156,12 +4239,13 @@ ssl_NewSocket(PRBool makeLocks, SSLProtocolVariant protocolVariant)
     ssl3_InitExtensionData(&ss->xtnData, ss);
     PR_INIT_CLIST(&ss->ssl3.hs.dtlsSentHandshake);
     PR_INIT_CLIST(&ss->ssl3.hs.dtlsRcvdHandshake);
+    PR_INIT_CLIST(&ss->ssl3.hs.psks);
     dtls_InitTimers(ss);
 
-    ss->esniKeys = NULL;
+    ss->echPrivKey = NULL;
+    ss->echPubKey = NULL;
     ss->antiReplay = NULL;
-    ss->peerSignatureSchemes = NULL;
-    ss->peerSignatureSchemeCount = 0;
+    ss->psk = NULL;
 
     if (makeLocks) {
         rv = ssl_MakeLocks(ss);
@@ -4228,17 +4312,27 @@ struct {
     void *function;
 } ssl_experimental_functions[] = {
 #ifndef SSL_DISABLE_EXPERIMENTAL_API
+    EXP(AddExternalPsk),
+    EXP(AddExternalPsk0Rtt),
     EXP(AeadDecrypt),
     EXP(AeadEncrypt),
+    EXP(CallExtensionWriterOnEchInner),
     EXP(CipherSuiteOrderGet),
     EXP(CipherSuiteOrderSet),
     EXP(CreateAntiReplayContext),
+    EXP(CreateMask),
+    EXP(CreateMaskingContext),
+    EXP(CreateVariantMaskingContext),
     EXP(DelegateCredential),
     EXP(DestroyAead),
+    EXP(DestroyMaskingContext),
     EXP(DestroyResumptionTokenInfo),
-    EXP(EnableESNI),
-    EXP(EncodeESNIKeys),
+    EXP(EnableTls13BackendEch),
+    EXP(EnableTls13GreaseEch),
+    EXP(SetTls13GreaseEchSize),
+    EXP(EncodeEchConfigId),
     EXP(GetCurrentEpoch),
+    EXP(GetEchRetryConfigs),
     EXP(GetExtensionSupport),
     EXP(GetResumptionTokenInfo),
     EXP(HelloRetryRequestCallback),
@@ -4246,19 +4340,26 @@ struct {
     EXP(HkdfExtract),
     EXP(HkdfExpandLabel),
     EXP(HkdfExpandLabelWithMech),
+    EXP(HkdfVariantExpandLabel),
+    EXP(HkdfVariantExpandLabelWithMech),
     EXP(KeyUpdate),
     EXP(MakeAead),
+    EXP(MakeVariantAead),
     EXP(RecordLayerData),
     EXP(RecordLayerWriteCallback),
     EXP(ReleaseAntiReplayContext),
+    EXP(RemoveEchConfigs),
+    EXP(RemoveExternalPsk),
     EXP(SecretCallback),
     EXP(SendCertificateRequest),
     EXP(SendSessionTicket),
     EXP(SetAntiReplayContext),
-    EXP(SetESNIKeyPair),
+    EXP(SetClientEchConfigs),
+    EXP(SetDtls13VersionWorkaround),
     EXP(SetMaxEarlyDataSize),
     EXP(SetResumptionTokenCallback),
     EXP(SetResumptionToken),
+    EXP(SetServerEchConfigs),
     EXP(SetTimeFunc),
 #endif
     { "", NULL }
@@ -4295,6 +4396,68 @@ ssl_ClearPRCList(PRCList *list, void (*f)(void *))
     }
 }
 
+SECStatus
+SSLExp_EnableTls13GreaseEch(PRFileDesc *fd, PRBool enabled)
+{
+    sslSocket *ss = ssl_FindSocket(fd);
+    if (!ss) {
+        return SECFailure;
+    }
+    ss->opt.enableTls13GreaseEch = enabled;
+    return SECSuccess;
+}
+
+SECStatus
+SSLExp_SetTls13GreaseEchSize(PRFileDesc *fd, PRUint8 size)
+{
+    sslSocket *ss = ssl_FindSocket(fd);
+    if (!ss || size == 0) {
+        return SECFailure;
+    }
+    ssl_Get1stHandshakeLock(ss);
+    ssl_GetSSL3HandshakeLock(ss);
+
+    ss->ssl3.hs.greaseEchSize = size;
+
+    ssl_ReleaseSSL3HandshakeLock(ss);
+    ssl_Release1stHandshakeLock(ss);
+
+    return SECSuccess;
+}
+
+SECStatus
+SSLExp_EnableTls13BackendEch(PRFileDesc *fd, PRBool enabled)
+{
+    sslSocket *ss = ssl_FindSocket(fd);
+    if (!ss) {
+        return SECFailure;
+    }
+    ss->opt.enableTls13BackendEch = enabled;
+    return SECSuccess;
+}
+
+SECStatus
+SSLExp_CallExtensionWriterOnEchInner(PRFileDesc *fd, PRBool enabled)
+{
+    sslSocket *ss = ssl_FindSocket(fd);
+    if (!ss) {
+        return SECFailure;
+    }
+    ss->opt.callExtensionWriterOnEchInner = enabled;
+    return SECSuccess;
+}
+
+SECStatus
+SSLExp_SetDtls13VersionWorkaround(PRFileDesc *fd, PRBool enabled)
+{
+    sslSocket *ss = ssl_FindSocket(fd);
+    if (!ss) {
+        return SECFailure;
+    }
+    ss->opt.enableDtls13VersionCompat = enabled;
+    return SECSuccess;
+}
+
 SECStatus
 SSLExp_SetTimeFunc(PRFileDesc *fd, SSLTimeFunc f, void *arg)
 {
@@ -4450,8 +4613,11 @@ SSLExp_GetResumptionTokenInfo(const PRUint8 *tokenData, unsigned int tokenLen,
     if (!token.alpnSelection) {
         return SECFailure;
     }
-    PORT_Memcpy(token.alpnSelection, sid.u.ssl3.alpnSelection.data,
-                token.alpnSelectionLen);
+    if (token.alpnSelectionLen > 0) {
+        PORT_Assert(sid.u.ssl3.alpnSelection.data);
+        PORT_Memcpy(token.alpnSelection, sid.u.ssl3.alpnSelection.data,
+                    token.alpnSelectionLen);
+    }
 
     if (sid.u.ssl3.locked.sessionTicket.flags & ticket_allow_early_data) {
         token.maxEarlyDataSize =