mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-20 23:37:33 +09:00
Update NSS to 3.38
- Added HACL*Poly1305 32-bit (INRIA/Microsoft) - Updated to final TLS 1.3 draft version (28) - Removed TLS 1.3 prerelease draft limit check - Removed NPN code - Enabled dev/urandom-only RNG on Linux with NSS_SEED_ONLY_DEV_URANDOM for non-standard environments - Fixed several bugs with TLS 1.3 negotiation - Updated internal certificate store - Added support for the TLS Record Size Limit Extension. - Fixed CVE-2018-0495 - Various security fixes in the ASN.1 code.
This commit is contained in:
wolfbeast
Roy Tam
parent
0d5d154158
commit
d36d4eb674
197 changed files with 4873 additions and 7145 deletions
|
|
@ -55,6 +55,7 @@ static const sslSocketOps ssl_secure_ops = { /* SSL. */
|
|||
static sslOptions ssl_defaults = {
|
||||
.nextProtoNego = { siBuffer, NULL, 0 },
|
||||
.maxEarlyDataSize = 1 << 16,
|
||||
.recordSizeLimit = MAX_FRAGMENT_LENGTH + 1,
|
||||
.useSecurity = PR_TRUE,
|
||||
.useSocks = PR_FALSE,
|
||||
.requestCertificate = PR_FALSE,
|
||||
|
|
@ -72,7 +73,6 @@ static sslOptions ssl_defaults = {
|
|||
.enableFalseStart = PR_FALSE,
|
||||
.cbcRandomIV = PR_TRUE,
|
||||
.enableOCSPStapling = PR_FALSE,
|
||||
.enableNPN = PR_FALSE,
|
||||
.enableALPN = PR_TRUE,
|
||||
.reuseServerECDHEKey = PR_TRUE,
|
||||
.enableFallbackSCSV = PR_FALSE,
|
||||
|
|
@ -81,7 +81,8 @@ static sslOptions ssl_defaults = {
|
|||
.enableSignedCertTimestamps = PR_FALSE,
|
||||
.requireDHENamedGroups = PR_FALSE,
|
||||
.enable0RttData = PR_FALSE,
|
||||
.enableTls13CompatMode = PR_FALSE
|
||||
.enableTls13CompatMode = PR_FALSE,
|
||||
.enableDtlsShortHeader = PR_FALSE
|
||||
};
|
||||
|
||||
/*
|
||||
|
|
@ -803,10 +804,23 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 which, PRIntn val)
|
|||
ss->opt.enable0RttData = val;
|
||||
break;
|
||||
|
||||
case SSL_RECORD_SIZE_LIMIT:
|
||||
if (val < 64 || val > (MAX_FRAGMENT_LENGTH + 1)) {
|
||||
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
||||
rv = SECFailure;
|
||||
} else {
|
||||
ss->opt.recordSizeLimit = val;
|
||||
}
|
||||
break;
|
||||
|
||||
case SSL_ENABLE_TLS13_COMPAT_MODE:
|
||||
ss->opt.enableTls13CompatMode = val;
|
||||
break;
|
||||
|
||||
case SSL_ENABLE_DTLS_SHORT_HEADER:
|
||||
ss->opt.enableDtlsShortHeader = val;
|
||||
break;
|
||||
|
||||
default:
|
||||
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
||||
rv = SECFailure;
|
||||
|
|
@ -914,7 +928,7 @@ SSL_OptionGet(PRFileDesc *fd, PRInt32 which, PRIntn *pVal)
|
|||
val = ss->opt.enableOCSPStapling;
|
||||
break;
|
||||
case SSL_ENABLE_NPN:
|
||||
val = ss->opt.enableNPN;
|
||||
val = PR_FALSE;
|
||||
break;
|
||||
case SSL_ENABLE_ALPN:
|
||||
val = ss->opt.enableALPN;
|
||||
|
|
@ -940,9 +954,15 @@ SSL_OptionGet(PRFileDesc *fd, PRInt32 which, PRIntn *pVal)
|
|||
case SSL_ENABLE_0RTT_DATA:
|
||||
val = ss->opt.enable0RttData;
|
||||
break;
|
||||
case SSL_RECORD_SIZE_LIMIT:
|
||||
val = ss->opt.recordSizeLimit;
|
||||
break;
|
||||
case SSL_ENABLE_TLS13_COMPAT_MODE:
|
||||
val = ss->opt.enableTls13CompatMode;
|
||||
break;
|
||||
case SSL_ENABLE_DTLS_SHORT_HEADER:
|
||||
val = ss->opt.enableDtlsShortHeader;
|
||||
break;
|
||||
default:
|
||||
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
||||
rv = SECFailure;
|
||||
|
|
@ -1037,7 +1057,7 @@ SSL_OptionGetDefault(PRInt32 which, PRIntn *pVal)
|
|||
val = ssl_defaults.enableOCSPStapling;
|
||||
break;
|
||||
case SSL_ENABLE_NPN:
|
||||
val = ssl_defaults.enableNPN;
|
||||
val = PR_FALSE;
|
||||
break;
|
||||
case SSL_ENABLE_ALPN:
|
||||
val = ssl_defaults.enableALPN;
|
||||
|
|
@ -1060,9 +1080,15 @@ SSL_OptionGetDefault(PRInt32 which, PRIntn *pVal)
|
|||
case SSL_ENABLE_0RTT_DATA:
|
||||
val = ssl_defaults.enable0RttData;
|
||||
break;
|
||||
case SSL_RECORD_SIZE_LIMIT:
|
||||
val = ssl_defaults.recordSizeLimit;
|
||||
break;
|
||||
case SSL_ENABLE_TLS13_COMPAT_MODE:
|
||||
val = ssl_defaults.enableTls13CompatMode;
|
||||
break;
|
||||
case SSL_ENABLE_DTLS_SHORT_HEADER:
|
||||
val = ssl_defaults.enableDtlsShortHeader;
|
||||
break;
|
||||
default:
|
||||
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
||||
rv = SECFailure;
|
||||
|
|
@ -1242,10 +1268,22 @@ SSL_OptionSetDefault(PRInt32 which, PRIntn val)
|
|||
ssl_defaults.enable0RttData = val;
|
||||
break;
|
||||
|
||||
case SSL_RECORD_SIZE_LIMIT:
|
||||
if (val < 64 || val > (MAX_FRAGMENT_LENGTH + 1)) {
|
||||
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
||||
return SECFailure;
|
||||
}
|
||||
ssl_defaults.recordSizeLimit = val;
|
||||
break;
|
||||
|
||||
case SSL_ENABLE_TLS13_COMPAT_MODE:
|
||||
ssl_defaults.enableTls13CompatMode = val;
|
||||
break;
|
||||
|
||||
case SSL_ENABLE_DTLS_SHORT_HEADER:
|
||||
ssl_defaults.enableDtlsShortHeader = val;
|
||||
break;
|
||||
|
||||
default:
|
||||
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
||||
return SECFailure;
|
||||
|
|
@ -1895,10 +1933,7 @@ DTLS_ImportFD(PRFileDesc *model, PRFileDesc *fd)
|
|||
}
|
||||
|
||||
/* SSL_SetNextProtoCallback is used to select an application protocol
|
||||
* for ALPN and NPN. For ALPN, this runs on the server; for NPN it
|
||||
* runs on the client. */
|
||||
/* Note: The ALPN version doesn't allow for the use of a default, setting a
|
||||
* status of SSL_NEXT_PROTO_NO_OVERLAP is treated as a failure. */
|
||||
* for ALPN. */
|
||||
SECStatus
|
||||
SSL_SetNextProtoCallback(PRFileDesc *fd, SSLNextProtoCallback callback,
|
||||
void *arg)
|
||||
|
|
@ -1919,7 +1954,7 @@ SSL_SetNextProtoCallback(PRFileDesc *fd, SSLNextProtoCallback callback,
|
|||
return SECSuccess;
|
||||
}
|
||||
|
||||
/* ssl_NextProtoNegoCallback is set as an ALPN/NPN callback when
|
||||
/* ssl_NextProtoNegoCallback is set as an ALPN callback when
|
||||
* SSL_SetNextProtoNego is used.
|
||||
*/
|
||||
static SECStatus
|
||||
|
|
@ -1929,7 +1964,6 @@ ssl_NextProtoNegoCallback(void *arg, PRFileDesc *fd,
|
|||
unsigned int protoMaxLen)
|
||||
{
|
||||
unsigned int i, j;
|
||||
const unsigned char *result;
|
||||
sslSocket *ss = ssl_FindSocket(fd);
|
||||
|
||||
if (!ss) {
|
||||
|
|
@ -1937,37 +1971,29 @@ ssl_NextProtoNegoCallback(void *arg, PRFileDesc *fd,
|
|||
SSL_GETPID(), fd));
|
||||
return SECFailure;
|
||||
}
|
||||
PORT_Assert(protoMaxLen <= 255);
|
||||
if (protoMaxLen > 255) {
|
||||
PORT_SetError(SEC_ERROR_OUTPUT_LEN);
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
/* For each protocol in server preference, see if we support it. */
|
||||
for (i = 0; i < protos_len;) {
|
||||
for (j = 0; j < ss->opt.nextProtoNego.len;) {
|
||||
/* For each protocol in client preference, see if we support it. */
|
||||
for (j = 0; j < ss->opt.nextProtoNego.len;) {
|
||||
for (i = 0; i < protos_len;) {
|
||||
if (protos[i] == ss->opt.nextProtoNego.data[j] &&
|
||||
PORT_Memcmp(&protos[i + 1], &ss->opt.nextProtoNego.data[j + 1],
|
||||
protos[i]) == 0) {
|
||||
/* We found a match. */
|
||||
ss->xtnData.nextProtoState = SSL_NEXT_PROTO_NEGOTIATED;
|
||||
result = &protos[i];
|
||||
goto found;
|
||||
const unsigned char *result = &protos[i];
|
||||
memcpy(protoOut, result + 1, result[0]);
|
||||
*protoOutLen = result[0];
|
||||
return SECSuccess;
|
||||
}
|
||||
j += 1 + (unsigned int)ss->opt.nextProtoNego.data[j];
|
||||
i += 1 + (unsigned int)protos[i];
|
||||
}
|
||||
i += 1 + (unsigned int)protos[i];
|
||||
j += 1 + (unsigned int)ss->opt.nextProtoNego.data[j];
|
||||
}
|
||||
|
||||
/* The other side supports the extension, and either doesn't have any
|
||||
* protocols configured, or none of its options match ours. In this case we
|
||||
* request our favoured protocol. */
|
||||
/* This will be treated as a failure for ALPN. */
|
||||
ss->xtnData.nextProtoState = SSL_NEXT_PROTO_NO_OVERLAP;
|
||||
result = ss->opt.nextProtoNego.data;
|
||||
|
||||
found:
|
||||
if (protoMaxLen < result[0]) {
|
||||
PORT_SetError(SEC_ERROR_OUTPUT_LEN);
|
||||
return SECFailure;
|
||||
}
|
||||
memcpy(protoOut, result + 1, result[0]);
|
||||
*protoOutLen = result[0];
|
||||
return SECSuccess;
|
||||
}
|
||||
|
||||
|
|
@ -1976,8 +2002,6 @@ SSL_SetNextProtoNego(PRFileDesc *fd, const unsigned char *data,
|
|||
unsigned int length)
|
||||
{
|
||||
sslSocket *ss;
|
||||
SECStatus rv;
|
||||
SECItem dataItem = { siBuffer, (unsigned char *)data, length };
|
||||
|
||||
ss = ssl_FindSocket(fd);
|
||||
if (!ss) {
|
||||
|
|
@ -1986,17 +2010,22 @@ SSL_SetNextProtoNego(PRFileDesc *fd, const unsigned char *data,
|
|||
return SECFailure;
|
||||
}
|
||||
|
||||
if (ssl3_ValidateNextProtoNego(data, length) != SECSuccess)
|
||||
if (ssl3_ValidateAppProtocol(data, length) != SECSuccess) {
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
/* NPN required that the client's fallback protocol is first in the
|
||||
* list. However, ALPN sends protocols in preference order. So move the
|
||||
* first protocol to the end of the list. */
|
||||
ssl_GetSSL3HandshakeLock(ss);
|
||||
SECITEM_FreeItem(&ss->opt.nextProtoNego, PR_FALSE);
|
||||
rv = SECITEM_CopyItem(NULL, &ss->opt.nextProtoNego, &dataItem);
|
||||
SECITEM_AllocItem(NULL, &ss->opt.nextProtoNego, length);
|
||||
size_t firstLen = data[0] + 1;
|
||||
/* firstLen <= length is ensured by ssl3_ValidateAppProtocol. */
|
||||
PORT_Memcpy(ss->opt.nextProtoNego.data + (length - firstLen), data, firstLen);
|
||||
PORT_Memcpy(ss->opt.nextProtoNego.data, data + firstLen, length - firstLen);
|
||||
ssl_ReleaseSSL3HandshakeLock(ss);
|
||||
|
||||
if (rv != SECSuccess)
|
||||
return rv;
|
||||
|
||||
return SSL_SetNextProtoCallback(fd, ssl_NextProtoNegoCallback, NULL);
|
||||
}
|
||||
|
||||
|
|
@ -3034,26 +3063,27 @@ ssl_Poll(PRFileDesc *fd, PRInt16 how_flags, PRInt16 *p_out_flags)
|
|||
} else { /* handshaking as server */
|
||||
new_flags |= PR_POLL_READ;
|
||||
}
|
||||
} else
|
||||
} else if (ss->lastWriteBlocked) {
|
||||
/* First handshake is in progress */
|
||||
if (ss->lastWriteBlocked) {
|
||||
if (new_flags & PR_POLL_READ) {
|
||||
/* The caller is waiting for data to be received,
|
||||
** but the initial handshake is blocked on write, or the
|
||||
** client's first handshake record has not been written.
|
||||
** The code should select on write, not read.
|
||||
*/
|
||||
new_flags ^= PR_POLL_READ; /* don't select on read. */
|
||||
new_flags &= ~PR_POLL_READ; /* don't select on read. */
|
||||
new_flags |= PR_POLL_WRITE; /* do select on write. */
|
||||
}
|
||||
} else if (new_flags & PR_POLL_WRITE) {
|
||||
/* The caller is trying to write, but the handshake is
|
||||
** blocked waiting for data to read, and the first
|
||||
** handshake has been sent. So do NOT to poll on write
|
||||
** unless we did false start.
|
||||
** unless we did false start or we are doing 0-RTT.
|
||||
*/
|
||||
if (!ss->ssl3.hs.canFalseStart) {
|
||||
new_flags ^= PR_POLL_WRITE; /* don't select on write. */
|
||||
if (!(ss->ssl3.hs.canFalseStart ||
|
||||
ss->ssl3.hs.zeroRttState == ssl_0rtt_sent ||
|
||||
ss->ssl3.hs.zeroRttState == ssl_0rtt_accepted)) {
|
||||
new_flags &= ~PR_POLL_WRITE; /* don't select on write. */
|
||||
}
|
||||
new_flags |= PR_POLL_READ; /* do select on read. */
|
||||
}
|
||||
|
|
@ -3093,6 +3123,9 @@ ssl_Poll(PRFileDesc *fd, PRInt16 how_flags, PRInt16 *p_out_flags)
|
|||
}
|
||||
}
|
||||
|
||||
SSL_TRC(20, ("%d: SSL[%d]: ssl_Poll flags %x -> %x",
|
||||
SSL_GETPID(), fd, how_flags, new_flags));
|
||||
|
||||
if (new_flags && (fd->lower->methods->poll != NULL)) {
|
||||
PRInt16 lower_out_flags = 0;
|
||||
PRInt16 lower_new_flags;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue