net: only False Start with forward secret servers.

net/third_party/nss/ssl/ssl3con.c

 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /*
  * SSL3 Protocol
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
@@ skipping 6068 matching lines @@
     /* XXX: does not take into account whether we are waiting for
      * SSL_AuthCertificateComplete or SSL_RestartHandshakeAfterCertReq. If/when
      * that is done, this function could return different results each time it
      * would be called.
      */
 
     ssl_GetSpecReadLock(ss);
     rv = ss->opt.enableFalseStart &&
          !ss->sec.isServer &&
          !ss->ssl3.hs.isResuming &&
-         ssl3_ExtensionNegotiated(ss, ssl_next_proto_nego_xtn) &&
          ss->ssl3.cwSpec &&
          ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10 &&
-        (ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_rsa ||
-         ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_dh  ||
+        (ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_dh  ||
          ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_ecdh);

[wtc, 2012/04/19 22:33:53]

It would be nice to add a comment to briefly explain why
only certain key exchange algorithms are compatible with
False Start.

IMPORTANT: Looking at this more closely, I think we're testing the wrong
member of ss->ssl3.hs.kea_def here.

I assume we don't want to enable False Start with the
non-ephemeral DH and ECDH cipher suites such as
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA.  If so, we should
be testing
  ss->ssl3.hs.kea_def->kea == kea_dhe_dss ||
  ss->ssl3.hs.kea_def->kea == kea_dhe_rsa ||
  ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa ||
  ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa

See
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl3...

and http://mxr.mozilla.org/security/ident?i=kea_ecdhe_rsa

[agl, 2012/04/20 18:30:29]

Done.
Thanks! Done.

     ssl_ReleaseSpecReadLock(ss);
     return rv;
 }
 
 static SECStatus ssl3_SendClientSecondRound(sslSocket *ss);
 
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
  * ssl3 Server Hello Done message.
  * Caller must hold Handshake and RecvBuf locks.
  */
@@ skipping 4327 matching lines @@
             PORT_Free(ss->ssl3.hs.recvdFragments.buf);
         }
     }
 
     ss->ssl3.initialized = PR_FALSE;
 
     SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 }
 
 /* End of ssl3con.c */