| OLD | NEW |
|---|
| (Empty) | |
| 1 diff --git a/net/third_party/nss/ssl/SSLerrs.h b/net/third_party/nss/ssl/SSLerrs
.h |
| 2 index e3f9a1c..03958d2 100644 |
| 3 --- a/net/third_party/nss/ssl/SSLerrs.h |
| 4 +++ b/net/third_party/nss/ssl/SSLerrs.h |
| 5 @@ -429,3 +429,12 @@ ER3(SSL_ERROR_RX_MALFORMED_HELLO_VERIFY_REQUEST, (SSL_ERROR
_BASE + 122), |
| 6 |
| 7 ER3(SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST, (SSL_ERROR_BASE + 123), |
| 8 "SSL received an unexpected Hello Verify Request handshake message.") |
| 9 + |
| 10 +ER3(SSL_ERROR_BAD_CHANNEL_ID_DATA, (SSL_ERROR_BASE + 124), |
| 11 +"SSL received a malformed TLS Channel ID extension.") |
| 12 + |
| 13 +ER3(SSL_ERROR_INVALID_CHANNEL_ID_KEY, (SSL_ERROR_BASE + 125), |
| 14 +"An invalid TLS Channel ID key was returned by the callback.") |
| 15 + |
| 16 +ER3(SSL_ERROR_CHANNEL_ID_CALLBACK_FAILED, (SSL_ERROR_BASE + 126), |
| 17 +"The callback set by SSL_SetClientChannelIDCallback failed.") |
| 18 diff --git a/net/third_party/nss/ssl/ssl.h b/net/third_party/nss/ssl/ssl.h |
| 19 index 1368e2f..09e4fe9 100644 |
| 20 --- a/net/third_party/nss/ssl/ssl.h |
| 21 +++ b/net/third_party/nss/ssl/ssl.h |
| 22 @@ -945,6 +945,25 @@ SSL_IMPORT SECStatus SSL_HandshakeNegotiatedExtension(PRFil
eDesc * socket, |
| 23 SSL_IMPORT SECStatus SSL_HandshakeResumedSession(PRFileDesc *fd, |
| 24 PRBool *last_handshake_resumed
); |
| 25 |
| 26 +/* See SSL_SetClientChannelIDCallback for usage. The callback must return |
| 27 + * SECFailure or SECSuccess (not SECWouldBlock). On SECSuccess, the callback |
| 28 + * must have written a P-256 key pair to |out_public_key| and |
| 29 + * |out_private_key|. */ |
| 30 +typedef SECStatus (PR_CALLBACK *SSLClientChannelIDCallback)( |
| 31 + void *arg, |
| 32 + PRFileDesc *fd, |
| 33 + SECKEYPublicKey **out_public_key, |
| 34 + SECKEYPrivateKey **out_private_key); |
| 35 + |
| 36 +/* SSL_SetClientChannelIDCallback sets a callback function that will be called |
| 37 + * just before a Channel ID is sent. This is only applicable to a client socket |
| 38 + * and setting this callback causes the TLS Channel ID extension to be |
| 39 + * advertised. */ |
| 40 +SSL_IMPORT SECStatus SSL_SetClientChannelIDCallback( |
| 41 + PRFileDesc *fd, |
| 42 + SSLClientChannelIDCallback callback, |
| 43 + void *arg); |
| 44 + |
| 45 /* |
| 46 ** How long should we wait before retransmitting the next flight of |
| 47 ** the DTLS handshake? Returns SECFailure if not DTLS or not in a |
| 48 diff --git a/net/third_party/nss/ssl/ssl3con.c b/net/third_party/nss/ssl/ssl3con
.c |
| 49 index db9fad3..6163bae 100644 |
| 50 --- a/net/third_party/nss/ssl/ssl3con.c |
| 51 +++ b/net/third_party/nss/ssl/ssl3con.c |
| 52 @@ -86,6 +86,7 @@ static SECStatus ssl3_SendCertificate( sslSocket *ss); |
| 53 static SECStatus ssl3_SendEmptyCertificate( sslSocket *ss); |
| 54 static SECStatus ssl3_SendCertificateRequest(sslSocket *ss); |
| 55 static SECStatus ssl3_SendNextProto( sslSocket *ss); |
| 56 +static SECStatus ssl3_SendEncryptedExtensions(sslSocket *ss); |
| 57 static SECStatus ssl3_SendFinished( sslSocket *ss, PRInt32 flags); |
| 58 static SECStatus ssl3_SendServerHello( sslSocket *ss); |
| 59 static SECStatus ssl3_SendServerHelloDone( sslSocket *ss); |
| 60 @@ -6239,6 +6240,10 @@ ssl3_SendClientSecondRound(sslSocket *ss) |
| 61 goto loser; /* err code was set. */ |
| 62 } |
| 63 } |
| 64 + rv = ssl3_SendEncryptedExtensions(ss); |
| 65 + if (rv != SECSuccess) { |
| 66 + goto loser; /* err code was set. */ |
| 67 + } |
| 68 |
| 69 rv = ssl3_SendFinished(ss, 0); |
| 70 if (rv != SECSuccess) { |
| 71 @@ -8855,6 +8860,134 @@ ssl3_SendNextProto(sslSocket *ss) |
| 72 return rv; |
| 73 } |
| 74 |
| 75 +/* called from ssl3_SendClientSecondRound |
| 76 + * ssl3_HandleFinished |
| 77 + */ |
| 78 +static SECStatus |
| 79 +ssl3_SendEncryptedExtensions(sslSocket *ss) |
| 80 +{ |
| 81 + static const char CHANNEL_ID_MAGIC[] = "TLS Channel ID signature"; |
| 82 + /* This is the ASN.1 prefix for a P-256 public key. Specifically it's: |
| 83 + * SEQUENCE |
| 84 + * SEQUENCE |
| 85 + * OID id-ecPublicKey |
| 86 + * OID prime256v1 |
| 87 + * BIT STRING, length 66, 0 trailing bits: 0x04 |
| 88 + * |
| 89 + * The 0x04 in the BIT STRING is the prefix for an uncompressed, X9.62 |
| 90 + * public key. Following that are the two field elements as 32-byte, |
| 91 + * big-endian numbers, as required by the Channel ID. */ |
| 92 + static const unsigned char P256_SPKI_PREFIX[] = { |
| 93 + 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, |
| 94 + 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, |
| 95 + 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, |
| 96 + 0x42, 0x00, 0x04 |
| 97 + }; |
| 98 + /* ChannelIDs are always 128 bytes long: 64 bytes of P-256 public key and 6
4 |
| 99 + * bytes of ECDSA signature. */ |
| 100 + static const int CHANNEL_ID_PUBLIC_KEY_LENGTH = 64; |
| 101 + static const int CHANNEL_ID_LENGTH = 128; |
| 102 + |
| 103 + SECStatus rv = SECFailure; |
| 104 + SECItem *spki = NULL; |
| 105 + SSL3Hashes hashes; |
| 106 + const unsigned char *pub_bytes; |
| 107 + unsigned char signed_data[sizeof(CHANNEL_ID_MAGIC) + sizeof(SSL3Hashes)]; |
| 108 + unsigned char digest[SHA256_LENGTH]; |
| 109 + SECItem digest_item; |
| 110 + unsigned char signature[64]; |
| 111 + SECItem signature_item; |
| 112 + SECKEYPrivateKey *channelID = NULL; |
| 113 + SECKEYPublicKey *channelIDPub = NULL; |
| 114 + |
| 115 + PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss)); |
| 116 + PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss)); |
| 117 + |
| 118 + if (ss->ssl3.channelIDCallback == NULL || |
| 119 + !ssl3_ExtensionNegotiated(ss, ssl_channel_id_xtn)) { |
| 120 + return SECSuccess; |
| 121 + } |
| 122 + |
| 123 + rv = ss->ssl3.channelIDCallback(ss->ssl3.channelIDCallbackArg, ss->fd, |
| 124 + &channelIDPub, &channelID); |
| 125 + if (rv != SECSuccess) { |
| 126 + PORT_SetError(SSL_ERROR_CHANNEL_ID_CALLBACK_FAILED); |
| 127 + goto loser; |
| 128 + } |
| 129 + |
| 130 + if (SECKEY_GetPrivateKeyType(channelID) != ecKey || |
| 131 + PK11_SignatureLen(channelID) != sizeof(signature)) { |
| 132 + PORT_SetError(SSL_ERROR_INVALID_CHANNEL_ID_KEY); |
| 133 + rv = SECFailure; |
| 134 + goto loser; |
| 135 + } |
| 136 + |
| 137 + ssl_GetSpecReadLock(ss); |
| 138 + rv = ssl3_ComputeHandshakeHashes(ss, ss->ssl3.cwSpec, &hashes, 0); |
| 139 + ssl_ReleaseSpecReadLock(ss); |
| 140 + |
| 141 + if (rv != SECSuccess) |
| 142 + goto loser; |
| 143 + |
| 144 + rv = ssl3_AppendHandshakeHeader(ss, encrypted_extensions, |
| 145 + 2 + 2 + CHANNEL_ID_LENGTH); |
| 146 + if (rv != SECSuccess) |
| 147 + goto loser; /* error code set by AppendHandshakeHeader */ |
| 148 + rv = ssl3_AppendHandshakeNumber(ss, ssl_channel_id_xtn, 2); |
| 149 + if (rv != SECSuccess) |
| 150 + goto loser; /* error code set by AppendHandshake */ |
| 151 + rv = ssl3_AppendHandshakeNumber(ss, CHANNEL_ID_LENGTH, 2); |
| 152 + if (rv != SECSuccess) |
| 153 + goto loser; /* error code set by AppendHandshake */ |
| 154 + |
| 155 + spki = SECKEY_EncodeDERSubjectPublicKeyInfo(channelIDPub); |
| 156 + |
| 157 + if (spki->len != sizeof(P256_SPKI_PREFIX) + CHANNEL_ID_PUBLIC_KEY_LENGTH || |
| 158 + memcmp(spki->data, P256_SPKI_PREFIX, sizeof(P256_SPKI_PREFIX) != 0)) { |
| 159 + PORT_SetError(SSL_ERROR_INVALID_CHANNEL_ID_KEY); |
| 160 + rv = SECFailure; |
| 161 + goto loser; |
| 162 + } |
| 163 + |
| 164 + pub_bytes = spki->data + sizeof(P256_SPKI_PREFIX); |
| 165 + |
| 166 + memcpy(signed_data, CHANNEL_ID_MAGIC, sizeof(CHANNEL_ID_MAGIC)); |
| 167 + memcpy(signed_data + sizeof(CHANNEL_ID_MAGIC), &hashes, sizeof(hashes)); |
| 168 + |
| 169 + rv = PK11_HashBuf(SEC_OID_SHA256, digest, signed_data, sizeof(signed_data))
; |
| 170 + if (rv != SECSuccess) |
| 171 + goto loser; |
| 172 + |
| 173 + digest_item.data = (void*) digest; |
| 174 + digest_item.len = sizeof(digest); |
| 175 + |
| 176 + signature_item.data = (void*) signature; |
| 177 + signature_item.len = sizeof(signature); |
| 178 + |
| 179 + rv = PK11_Sign(channelID, &signature_item, &digest_item); |
| 180 + if (rv != SECSuccess) |
| 181 + goto loser; |
| 182 + |
| 183 + rv = ssl3_AppendHandshake(ss, pub_bytes, CHANNEL_ID_PUBLIC_KEY_LENGTH); |
| 184 + if (rv != SECSuccess) |
| 185 + goto loser; |
| 186 + rv = ssl3_AppendHandshake(ss, signature, sizeof(signature)); |
| 187 + if (rv != SECSuccess) |
| 188 + goto loser; |
| 189 + |
| 190 + rv = SECSuccess; |
| 191 + |
| 192 +loser: |
| 193 + if (spki) |
| 194 + SECITEM_FreeItem(spki, PR_TRUE); |
| 195 + if (channelID) |
| 196 + SECKEY_DestroyPrivateKey(channelID); |
| 197 + if (channelIDPub) |
| 198 + SECKEY_DestroyPublicKey(channelIDPub); |
| 199 + |
| 200 + return rv; |
| 201 +} |
| 202 + |
| 203 /* called from ssl3_HandleServerHelloDone |
| 204 * ssl3_HandleClientHello |
| 205 * ssl3_HandleFinished |
| 206 @@ -9105,11 +9238,16 @@ ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint
32 length, |
| 207 flags = ssl_SEND_FLAG_FORCE_INTO_BUFFER; |
| 208 } |
| 209 |
| 210 - if (!isServer && !ss->firstHsDone) { |
| 211 - rv = ssl3_SendNextProto(ss); |
| 212 - if (rv != SECSuccess) { |
| 213 - goto xmit_loser; /* err code was set. */ |
| 214 + if (!isServer) { |
| 215 + if (!ss->firstHsDone) { |
| 216 + rv = ssl3_SendNextProto(ss); |
| 217 + if (rv != SECSuccess) { |
| 218 + goto xmit_loser; /* err code was set. */ |
| 219 + } |
| 220 } |
| 221 + rv = ssl3_SendEncryptedExtensions(ss); |
| 222 + if (rv != SECSuccess) |
| 223 + goto xmit_loser; /* err code was set. */ |
| 224 } |
| 225 |
| 226 if (IS_DTLS(ss)) { |
| 227 diff --git a/net/third_party/nss/ssl/ssl3ext.c b/net/third_party/nss/ssl/ssl3ext
.c |
| 228 index b9fd6e7..3220b8c 100644 |
| 229 --- a/net/third_party/nss/ssl/ssl3ext.c |
| 230 +++ b/net/third_party/nss/ssl/ssl3ext.c |
| 231 @@ -80,10 +80,14 @@ static SECStatus ssl3_HandleRenegotiationInfoXtn(sslSocket *
ss, |
| 232 PRUint16 ex_type, SECItem *data); |
| 233 static SECStatus ssl3_ClientHandleNextProtoNegoXtn(sslSocket *ss, |
| 234 PRUint16 ex_type, SECItem *data); |
| 235 +static SECStatus ssl3_ClientHandleChannelIDXtn(sslSocket *ss, |
| 236 + PRUint16 ex_type, SECItem *data); |
| 237 static SECStatus ssl3_ServerHandleNextProtoNegoXtn(sslSocket *ss, |
| 238 PRUint16 ex_type, SECItem *data); |
| 239 static PRInt32 ssl3_ClientSendNextProtoNegoXtn(sslSocket *ss, PRBool append, |
| 240 PRUint32 maxBytes); |
| 241 +static PRInt32 ssl3_ClientSendChannelIDXtn(sslSocket *ss, PRBool append, |
| 242 + PRUint32 maxBytes); |
| 243 |
| 244 /* |
| 245 * Write bytes. Using this function means the SECItem structure |
| 246 @@ -253,6 +257,7 @@ static const ssl3HelloExtensionHandler serverHelloHandlersTL
S[] = { |
| 247 { ssl_session_ticket_xtn, &ssl3_ClientHandleSessionTicketXtn }, |
| 248 { ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn }, |
| 249 { ssl_next_proto_nego_xtn, &ssl3_ClientHandleNextProtoNegoXtn }, |
| 250 + { ssl_channel_id_xtn, &ssl3_ClientHandleChannelIDXtn }, |
| 251 { ssl_cert_status_xtn, &ssl3_ClientHandleStatusRequestXtn }, |
| 252 { -1, NULL } |
| 253 }; |
| 254 @@ -278,6 +283,7 @@ ssl3HelloExtensionSender clientHelloSendersTLS[SSL_MAX_EXTEN
SIONS] = { |
| 255 #endif |
| 256 { ssl_session_ticket_xtn, &ssl3_SendSessionTicketXtn }, |
| 257 { ssl_next_proto_nego_xtn, &ssl3_ClientSendNextProtoNegoXtn }, |
| 258 + { ssl_channel_id_xtn, &ssl3_ClientSendChannelIDXtn }, |
| 259 { ssl_cert_status_xtn, &ssl3_ClientSendStatusRequestXtn } |
| 260 /* any extra entries will appear as { 0, NULL } */ |
| 261 }; |
| 262 @@ -668,6 +674,52 @@ loser: |
| 263 return -1; |
| 264 } |
| 265 |
| 266 +static SECStatus |
| 267 +ssl3_ClientHandleChannelIDXtn(sslSocket *ss, PRUint16 ex_type, |
| 268 + SECItem *data) |
| 269 +{ |
| 270 + PORT_Assert(ss->ssl3.channelIDCallback != NULL); |
| 271 + |
| 272 + if (data->len) { |
| 273 + PORT_SetError(SSL_ERROR_BAD_CHANNEL_ID_DATA); |
| 274 + return SECFailure; |
| 275 + } |
| 276 + ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type; |
| 277 + return SECSuccess; |
| 278 +} |
| 279 + |
| 280 +static PRInt32 |
| 281 +ssl3_ClientSendChannelIDXtn(sslSocket * ss, PRBool append, |
| 282 + PRUint32 maxBytes) |
| 283 +{ |
| 284 + PRInt32 extension_length = 4; |
| 285 + |
| 286 + if (!ss->ssl3.channelIDCallback) |
| 287 + return 0; |
| 288 + |
| 289 + if (maxBytes < extension_length) { |
| 290 + PORT_Assert(0); |
| 291 + return 0; |
| 292 + } |
| 293 + |
| 294 + if (append) { |
| 295 + SECStatus rv; |
| 296 + rv = ssl3_AppendHandshakeNumber(ss, ssl_channel_id_xtn, 2); |
| 297 + if (rv != SECSuccess) |
| 298 + goto loser; |
| 299 + rv = ssl3_AppendHandshakeNumber(ss, 0, 2); |
| 300 + if (rv != SECSuccess) |
| 301 + goto loser; |
| 302 + ss->xtnData.advertised[ss->xtnData.numAdvertised++] = |
| 303 + ssl_channel_id_xtn; |
| 304 + } |
| 305 + |
| 306 + return extension_length; |
| 307 + |
| 308 +loser: |
| 309 + return -1; |
| 310 +} |
| 311 + |
| 312 SECStatus |
| 313 ssl3_ClientHandleStatusRequestXtn(sslSocket *ss, PRUint16 ex_type, |
| 314 SECItem *data) |
| 315 diff --git a/net/third_party/nss/ssl/ssl3prot.h b/net/third_party/nss/ssl/ssl3pr
ot.h |
| 316 index 550c341..11f9624 100644 |
| 317 --- a/net/third_party/nss/ssl/ssl3prot.h |
| 318 +++ b/net/third_party/nss/ssl/ssl3prot.h |
| 319 @@ -163,7 +163,8 @@ typedef enum { |
| 320 client_key_exchange = 16, |
| 321 finished = 20, |
| 322 certificate_status = 22, |
| 323 - next_proto = 67 |
| 324 + next_proto = 67, |
| 325 + encrypted_extensions= 203 |
| 326 } SSL3HandshakeType; |
| 327 |
| 328 typedef struct { |
| 329 diff --git a/net/third_party/nss/ssl/sslerr.h b/net/third_party/nss/ssl/sslerr.h |
| 330 index 9d3bebc..6e08239 100644 |
| 331 --- a/net/third_party/nss/ssl/sslerr.h |
| 332 +++ b/net/third_party/nss/ssl/sslerr.h |
| 333 @@ -218,6 +218,10 @@ SSL_ERROR_RX_UNEXPECTED_CERT_STATUS = (SSL_ERROR_BASE +
121), |
| 334 SSL_ERROR_RX_MALFORMED_HELLO_VERIFY_REQUEST = (SSL_ERROR_BASE + 122), |
| 335 SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST = (SSL_ERROR_BASE + 123), |
| 336 |
| 337 +SSL_ERROR_BAD_CHANNEL_ID_DATA = (SSL_ERROR_BASE + 124), |
| 338 +SSL_ERROR_INVALID_CHANNEL_ID_KEY = (SSL_ERROR_BASE + 125), |
| 339 +SSL_ERROR_CHANNEL_ID_CALLBACK_FAILED = (SSL_ERROR_BASE + 126), |
| 340 + |
| 341 SSL_ERROR_END_OF_LIST /* let the c compiler determine the value of this. */ |
| 342 } SSLErrorCodes; |
| 343 #endif /* NO_SECURITY_ERROR_ENUM */ |
| 344 diff --git a/net/third_party/nss/ssl/sslimpl.h b/net/third_party/nss/ssl/sslimpl
.h |
| 345 index 8ab865a..afecfde 100644 |
| 346 --- a/net/third_party/nss/ssl/sslimpl.h |
| 347 +++ b/net/third_party/nss/ssl/sslimpl.h |
| 348 @@ -949,6 +949,8 @@ struct ssl3StateStr { |
| 349 */ |
| 350 SECItem nextProto; |
| 351 SSLNextProtoState nextProtoState; |
| 352 + SSLClientChannelIDCallback channelIDCallback; |
| 353 + void * channelIDCallbackArg; |
| 354 |
| 355 PRUint16 mtu; /* Our estimate of the MTU */ |
| 356 }; |
| 357 diff --git a/net/third_party/nss/ssl/sslsock.c b/net/third_party/nss/ssl/sslsock
.c |
| 358 index ebc245a..dee4b82 100644 |
| 359 --- a/net/third_party/nss/ssl/sslsock.c |
| 360 +++ b/net/third_party/nss/ssl/sslsock.c |
| 361 @@ -1878,6 +1878,24 @@ SSL_HandshakeResumedSession(PRFileDesc *fd, PRBool *hands
hake_resumed) { |
| 362 return SECSuccess; |
| 363 } |
| 364 |
| 365 +SECStatus |
| 366 +SSL_SetClientChannelIDCallback(PRFileDesc *fd, |
| 367 + SSLClientChannelIDCallback callback, |
| 368 + void *arg) { |
| 369 + sslSocket *ss = ssl_FindSocket(fd); |
| 370 + |
| 371 + if (!ss) { |
| 372 + SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetClientChannelIDCallback", |
| 373 + SSL_GETPID(), fd)); |
| 374 + return SECFailure; |
| 375 + } |
| 376 + |
| 377 + ss->ssl3.channelIDCallback = callback; |
| 378 + ss->ssl3.channelIDCallbackArg = arg; |
| 379 + |
| 380 + return SECSuccess; |
| 381 +} |
| 382 + |
| 383 const SECItem * |
| 384 SSL_GetRequestedClientCertificateTypes(PRFileDesc *fd) |
| 385 { |
| 386 diff --git a/net/third_party/nss/ssl/sslt.h b/net/third_party/nss/ssl/sslt.h |
| 387 index 0636570..978b1cb 100644 |
| 388 --- a/net/third_party/nss/ssl/sslt.h |
| 389 +++ b/net/third_party/nss/ssl/sslt.h |
| 390 @@ -215,9 +215,10 @@ typedef enum { |
| 391 #endif |
| 392 ssl_session_ticket_xtn = 35, |
| 393 ssl_next_proto_nego_xtn = 13172, |
| 394 + ssl_channel_id_xtn = 30031, |
| 395 ssl_renegotiation_info_xtn = 0xff01 /* experimental number */ |
| 396 } SSLExtensionType; |
| 397 |
| 398 -#define SSL_MAX_EXTENSIONS 7 |
| 399 +#define SSL_MAX_EXTENSIONS 8 |
| 400 |
| 401 #endif /* __sslt_h_ */ |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 10424013:
Support TLS Channel IDs in NSS (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src