nss: support SECWouldBlock from ChannelID callback.

net/third_party/nss/ssl/ssl3con.c

 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /*
  * SSL3 Protocol
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
@@ skipping 5183 matching lines @@
        SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);
        ss->ssl3.clientPrivateKey = NULL;
     }
 #ifdef NSS_PLATFORM_CLIENT_AUTH
     if (ss->ssl3.platformClientKey) {
        ssl_FreePlatformKey(ss->ssl3.platformClientKey);
        ss->ssl3.platformClientKey = (PlatformKey)NULL;
     }
 #endif  /* NSS_PLATFORM_CLIENT_AUTH */
 
+    if (ss->ssl3.channelID != NULL) {
+        SECKEY_DestroyPrivateKey(ss->ssl3.channelID);
+        ss->ssl3.channelID = NULL;
+    }
+    if (ss->ssl3.channelIDPub != NULL) {
+        SECKEY_DestroyPublicKey(ss->ssl3.channelIDPub);
+        ss->ssl3.channelIDPub = NULL;
+    }
+
     temp = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
     if (temp < 0) {
         goto loser;     /* alert has been sent */
     }
     version = (SSL3ProtocolVersion)temp;
 
     if (IS_DTLS(ss)) {
         /* RFC 4347 required that you verify that the server versions
          * match (Section 4.2.1) in the HelloVerifyRequest and the
          * ServerHello.
@@ skipping 232 matching lines @@
             ss->ssl3.hs.ws = wait_change_cipher;
 
         ss->ssl3.hs.isResuming = PR_TRUE;
 
         /* copy the peer cert from the SID */
         if (sid->peerCert != NULL) {
             ss->sec.peerCert = CERT_DupCertificate(sid->peerCert);
             ssl3_CopyPeerCertsFromSID(ss, sid);
         }
 
-
         /* NULL value for PMS signifies re-use of the old MS */
         rv = ssl3_InitPendingCipherSpec(ss,  NULL);
         if (rv != SECSuccess) {
             goto alert_loser;   /* err code was set */
         }
-        return SECSuccess;
+        goto winner;
     } while (0);
 
     if (sid_match)
         SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_not_ok );
     else
         SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_misses );
 
     /* throw the old one away */
     sid->u.ssl3.keys.resumable = PR_FALSE;
     (*ss->sec.uncache)(sid);
     ssl_FreeSID(sid);
 
     /* get a new sid */
     ss->sec.ci.sid = sid = ssl3_NewSessionID(ss, PR_FALSE);
     if (sid == NULL) {
         goto alert_loser;       /* memory error is set. */
     }
 
     sid->version = ss->version;
     sid->u.ssl3.sessionIDLength = sidBytes.len;
     PORT_Memcpy(sid->u.ssl3.sessionID, sidBytes.data, sidBytes.len);
 
     ss->ssl3.hs.isResuming = PR_FALSE;
     ss->ssl3.hs.ws         = wait_server_cert;
+
+winner:
+    /* If we will need a ChannelID key then we make the callback now. This
+     * allows the handshake to be restarted cleanly if the callback returns
+     * SECWouldBlock. */
+    if (ss->getChannelID &&
+        ssl3_ExtensionNegotiated(ss, ssl_channel_id_xtn)) {

[wtc, 2012/06/05 19:38:49]

Nit: it should be sufficient to just test ssl3_ExtensionNegotiated(ss,
ssl_channel_id_xtn).
I remember a non-null ss->getChannelID is used as a cue
that the Channel ID extension is enabled.  So
ssl3_ExtensionNegotiated(ss, ssl_channel_id_xtn) should
imply a non-null ss->getChannelID.

[agl, 2012/06/05 19:58:43]

Done.

+        rv = ss->getChannelID(ss->getChannelIDArg, ss->fd,
+                              &ss->ssl3.channelIDPub, &ss->ssl3.channelID);
+        if (rv == SECWouldBlock) {
+            ssl3_SetAlwaysBlock(ss);
+            return rv;
+        }
+        if (rv != SECSuccess) {
+            PORT_SetError(SSL_ERROR_GET_CHANNEL_ID_FAILED);
+            goto loser;
+        }

[wtc, 2012/06/05 19:38:49]

Nit: we may want to check if both ss->ssl3.channelIDPub and
ss->ssl3.channelID are non-null.  We have such a check after
calling ss->getClientAuthData.

[agl, 2012/06/05 19:58:43]

Done.

+    }
+
     return SECSuccess;
 
 alert_loser:
     (void)SSL3_SendAlert(ss, alert_fatal, desc);
 
 loser:
     errCode = ssl_MapLowLevelError(errCode);
     return SECFailure;
 }
 
@@ skipping 3393 matching lines @@
 
     SECStatus rv = SECFailure;
     SECItem *spki = NULL;
     SSL3Hashes hashes;
     const unsigned char *pub_bytes;
     unsigned char signed_data[sizeof(CHANNEL_ID_MAGIC) + sizeof(SSL3Hashes)];
     unsigned char digest[SHA256_LENGTH];
     SECItem digest_item;
     unsigned char signature[64];
     SECItem signature_item;
-    SECKEYPrivateKey *channelID = NULL;
-    SECKEYPublicKey *channelIDPub = NULL;
 
     PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
     PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
 
-    if (ss->getChannelID == NULL ||
-        !ssl3_ExtensionNegotiated(ss, ssl_channel_id_xtn)) {
+    if (ss->ssl3.channelID == NULL)
         return SECSuccess;
-    }
 
-    rv = ss->getChannelID(ss->getChannelIDArg, ss->fd,
-                          &channelIDPub, &channelID);
-    if (rv != SECSuccess) {
-        PORT_SetError(SSL_ERROR_GET_CHANNEL_ID_FAILED);
-        goto loser;
-    }
+    PORT_Assert(ssl3_ExtensionNegotiated(ss, ssl_channel_id_xtn));
 
-    if (SECKEY_GetPrivateKeyType(channelID) != ecKey ||
-        PK11_SignatureLen(channelID) != sizeof(signature)) {
+    if (SECKEY_GetPrivateKeyType(ss->ssl3.channelID) != ecKey ||
+        PK11_SignatureLen(ss->ssl3.channelID) != sizeof(signature)) {
         PORT_SetError(SSL_ERROR_INVALID_CHANNEL_ID_KEY);
         rv = SECFailure;
         goto loser;
     }
 
     ssl_GetSpecReadLock(ss);
     rv = ssl3_ComputeHandshakeHashes(ss, ss->ssl3.cwSpec, &hashes, 0);
     ssl_ReleaseSpecReadLock(ss);
 
     if (rv != SECSuccess)
         goto loser;
 
     rv = ssl3_AppendHandshakeHeader(ss, encrypted_extensions,
                                     2 + 2 + CHANNEL_ID_LENGTH);
     if (rv != SECSuccess)
         goto loser;     /* error code set by AppendHandshakeHeader */
     rv = ssl3_AppendHandshakeNumber(ss, ssl_channel_id_xtn, 2);
     if (rv != SECSuccess)
         goto loser;     /* error code set by AppendHandshake */
     rv = ssl3_AppendHandshakeNumber(ss, CHANNEL_ID_LENGTH, 2);
     if (rv != SECSuccess)
         goto loser;     /* error code set by AppendHandshake */
 
-    spki = SECKEY_EncodeDERSubjectPublicKeyInfo(channelIDPub);
+    spki = SECKEY_EncodeDERSubjectPublicKeyInfo(ss->ssl3.channelIDPub);
 
     if (spki->len != sizeof(P256_SPKI_PREFIX) + CHANNEL_ID_PUBLIC_KEY_LENGTH ||
         memcmp(spki->data, P256_SPKI_PREFIX, sizeof(P256_SPKI_PREFIX) != 0)) {
         PORT_SetError(SSL_ERROR_INVALID_CHANNEL_ID_KEY);
         rv = SECFailure;
         goto loser;
     }
 
     pub_bytes = spki->data + sizeof(P256_SPKI_PREFIX);
 
     memcpy(signed_data, CHANNEL_ID_MAGIC, sizeof(CHANNEL_ID_MAGIC));
     memcpy(signed_data + sizeof(CHANNEL_ID_MAGIC), &hashes, sizeof(hashes));
 
     rv = PK11_HashBuf(SEC_OID_SHA256, digest, signed_data, sizeof(signed_data));
     if (rv != SECSuccess)
         goto loser;
 
     digest_item.data = digest;
     digest_item.len = sizeof(digest);
 
     signature_item.data = signature;
     signature_item.len = sizeof(signature);
 
-    rv = PK11_Sign(channelID, &signature_item, &digest_item);
+    rv = PK11_Sign(ss->ssl3.channelID, &signature_item, &digest_item);
     if (rv != SECSuccess)
         goto loser;
 
     rv = ssl3_AppendHandshake(ss, pub_bytes, CHANNEL_ID_PUBLIC_KEY_LENGTH);
     if (rv != SECSuccess)
         goto loser;
     rv = ssl3_AppendHandshake(ss, signature, sizeof(signature));
 
 loser:
     if (spki)
         SECITEM_FreeItem(spki, PR_TRUE);
-    if (channelID)
-        SECKEY_DestroyPrivateKey(channelID);
-    if (channelIDPub)
-        SECKEY_DestroyPublicKey(channelIDPub);
+    if (ss->ssl3.channelID) {
+        SECKEY_DestroyPrivateKey(ss->ssl3.channelID);
+        ss->ssl3.channelID = NULL;
+    }
+    if (ss->ssl3.channelIDPub) {
+        SECKEY_DestroyPublicKey(ss->ssl3.channelIDPub);
+        ss->ssl3.channelIDPub = NULL;
+    }
 
     return rv;
 }
 
+/* ssl3_RestartHandshakeAfterChannelIDReq is called to restart a handshake
+ * after a ChannelID callback returned SECWouldBlock. At this point we have
+ * processed the server's ServerHello but not yet any further messages. We will
+ * always get a message from the server after a ServerHello so either they are
+ * waiting in the buffer or we'll get network I/O. */
+SECStatus
+ssl3_RestartHandshakeAfterChannelIDReq(sslSocket *ss,
+                                       SECKEYPublicKey *channelIDPub,
+                                       SECKEYPrivateKey *channelID)
+{
+    if (ss->handshake == 0) {
+        SECKEY_DestroyPublicKey(channelIDPub);
+        SECKEY_DestroyPrivateKey(channelID);
+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+        return SECFailure;
+    }
+
+    if (ss->ssl3.channelID)
+        SECKEY_DestroyPrivateKey(ss->ssl3.channelID);
+    if (ss->ssl3.channelIDPub)
+        SECKEY_DestroyPublicKey(ss->ssl3.channelIDPub);

[wtc, 2012/06/05 19:38:49]

Nit: we shouldn't need to do this because these two members
are already cleared at the beginning of ssl3_HandleServerHello.

[agl, 2012/06/05 19:58:43]

That's true but it seems more robust to free these members before assigning to
them. Otherwise I would worry that future changes could introduce a memory leak.

+
+    ss->handshake = ssl_GatherRecord1stHandshake;
+    ss->ssl3.channelID = channelID;
+    ss->ssl3.channelIDPub = channelIDPub;

[wtc, 2012/06/05 19:38:49]

We may want to check if both channelID and channelIDPub are
non-null.

[agl, 2012/06/05 19:58:43]

Done.

+
+    return SECSuccess;
+}
+
 /* called from ssl3_HandleServerHelloDone
  *             ssl3_HandleClientHello
  *             ssl3_HandleFinished
  */
 static SECStatus
 ssl3_SendFinished(sslSocket *ss, PRInt32 flags)
 {
     ssl3CipherSpec *cwSpec;
     PRBool          isTLS;
     PRBool          isServer = ss->sec.isServer;
@@ skipping 1506 matching lines @@
     if (ss->ssl3.clientCertificate != NULL)
         CERT_DestroyCertificate(ss->ssl3.clientCertificate);
 
     if (ss->ssl3.clientPrivateKey != NULL)
         SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);
 #ifdef NSS_PLATFORM_CLIENT_AUTH
     if (ss->ssl3.platformClientKey)
         ssl_FreePlatformKey(ss->ssl3.platformClientKey);
 #endif /* NSS_PLATFORM_CLIENT_AUTH */
 
+    if (ss->ssl3.channelID)
+        SECKEY_DestroyPrivateKey(ss->ssl3.channelID);
+    if (ss->ssl3.channelIDPub)
+        SECKEY_DestroyPublicKey(ss->ssl3.channelIDPub);
+
     if (ss->ssl3.peerCertArena != NULL)
         ssl3_CleanupPeerCerts(ss);
 
     if (ss->ssl3.clientCertChain != NULL) {
        CERT_DestroyCertificateList(ss->ssl3.clientCertChain);
        ss->ssl3.clientCertChain = NULL;
     }
 
     /* clean up handshake */
     if (ss->opt.bypassPKCS11) {
@@ skipping 36 matching lines @@
             PORT_Free(ss->ssl3.hs.recvdFragments.buf);
         }
     }
 
     ss->ssl3.initialized = PR_FALSE;
 
     SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 }
 
 /* End of ssl3con.c */