Update NSS libSSL to NSS_3_15_BETA2.

net/third_party/nss/ssl/sslsock.c

 /*
  * vtables (and methods that call through them) for the 4 types of 
  * SSLSockets supported.  Only one type is still supported.
  * Various other functions.
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-/* $Id: sslsock.c,v 1.96 2012/09/24 23:57:42 wtc%google.com Exp $ */
+/* $Id$ */
 #include "seccomon.h"
 #include "cert.h"
 #include "keyhi.h"
 #include "ssl.h"
 #include "sslimpl.h"
 #include "sslproto.h"
 #include "nspr.h"
 #include "private/pprio.h"
 #ifndef NO_PKCS11_BYPASS
 #include "blapi.h"
@@ skipping 127 matching lines @@
     PR_TRUE,    /* detectRollBack     */
     PR_FALSE,   /* noStepDown         */
     PR_FALSE,   /* bypassPKCS11       */
     PR_FALSE,   /* noLocks            */
     PR_FALSE,   /* enableSessionTickets */
     PR_FALSE,   /* enableDeflate      */
     2,          /* enableRenegotiation (default: requires extension) */
     PR_FALSE,   /* requireSafeNegotiation */
     PR_FALSE,   /* enableFalseStart   */
     PR_TRUE,    /* cbcRandomIV        */
-    PR_FALSE,   /* enableOCSPStapling */
+    PR_FALSE    /* enableOCSPStapling */
 };
 
 /*
  * default range of enabled SSL/TLS protocols
  */
 static SSLVersionRange versions_defaults_stream = {
     SSL_LIBRARY_VERSION_3_0,
     SSL_LIBRARY_VERSION_TLS_1_0
 };
 
@@ skipping 152 matching lines @@
                 sc->serverKeyPair = oc->serverKeyPair ?
                                 ssl3_GetKeyPairRef(oc->serverKeyPair) : NULL;
                 if (oc->serverKeyPair && !sc->serverKeyPair)
                     goto loser;
                 sc->serverKeyBits = oc->serverKeyBits;
             }
             ss->stepDownKeyPair = !os->stepDownKeyPair ? NULL :
                                   ssl3_GetKeyPairRef(os->stepDownKeyPair);
             ss->ephemeralECDHKeyPair = !os->ephemeralECDHKeyPair ? NULL :
                                   ssl3_GetKeyPairRef(os->ephemeralECDHKeyPair);
+            ss->certStatusArray = !os->certStatusArray ? NULL :
+                                  SECITEM_DupArray(NULL, os->certStatusArray);
 /*
  * XXX the preceding CERT_ and SECKEY_ functions can fail and return NULL.
  * XXX We should detect this, and not just march on with NULL pointers.
  */
             ss->authCertificate       = os->authCertificate;
             ss->authCertificateArg    = os->authCertificateArg;
             ss->getClientAuthData     = os->getClientAuthData;
             ss->getClientAuthDataArg  = os->getClientAuthDataArg;
 #ifdef NSS_PLATFORM_CLIENT_AUTH
             ss->getPlatformClientAuthData    = os->getPlatformClientAuthData;
@@ skipping 97 matching lines @@
             ssl3_FreeKeyPair(sc->serverKeyPair);
     }
     if (ss->stepDownKeyPair) {
         ssl3_FreeKeyPair(ss->stepDownKeyPair);
         ss->stepDownKeyPair = NULL;
     }
     if (ss->ephemeralECDHKeyPair) {
         ssl3_FreeKeyPair(ss->ephemeralECDHKeyPair);
         ss->ephemeralECDHKeyPair = NULL;
     }
+    if (ss->certStatusArray) {
+        SECITEM_FreeArray(ss->certStatusArray, PR_TRUE);
+        ss->certStatusArray = NULL;
+    }
     SECITEM_FreeItem(&ss->opt.nextProtoNego, PR_FALSE);
     PORT_Assert(!ss->xtnData.sniNameArr);
     if (ss->xtnData.sniNameArr) {
         PORT_Free(ss->xtnData.sniNameArr);
         ss->xtnData.sniNameArr = NULL;
     }
 }
 
 /*
  * free an sslSocket struct, and all the stuff that hangs off of it
@@ skipping 371 matching lines @@
 
       case SSL_ENABLE_FALSE_START:
         ss->opt.enableFalseStart = on;
         break;
 
       case SSL_CBC_RANDOM_IV:
         ss->opt.cbcRandomIV = on;
         break;
 
       case SSL_ENABLE_OCSP_STAPLING:
-        ss->opt.enableOCSPStapling = on;
-        break;
+       ss->opt.enableOCSPStapling = on;
+       break;
 
       default:
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         rv = SECFailure;
     }
 
     /* We can't use the macros for releasing the locks here,
      * because ss->opt.noLocks might have changed just above.
      * We must release these locks (monitors) here, if we aquired them above,
      * regardless of the current value of ss->opt.noLocks.
@@ skipping 110 matching lines @@
         break;
     case SSL_ENABLE_DEFLATE:      on = ssl_defaults.enableDeflate;      break;
     case SSL_ENABLE_RENEGOTIATION:     
                                   on = ssl_defaults.enableRenegotiation; break;
     case SSL_REQUIRE_SAFE_NEGOTIATION: 
                                   on = ssl_defaults.requireSafeNegotiation; 
                                   break;
     case SSL_ENABLE_FALSE_START:  on = ssl_defaults.enableFalseStart;   break;
     case SSL_CBC_RANDOM_IV:       on = ssl_defaults.cbcRandomIV;        break;
     case SSL_ENABLE_OCSP_STAPLING:
-        on = ssl_defaults.enableOCSPStapling;
-        break;
+       on = ssl_defaults.enableOCSPStapling;
+       break;
 
     default:
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         rv = SECFailure;
     }
 
     *pOn = on;
     return rv;
 }
 
@@ skipping 144 matching lines @@
 
       case SSL_ENABLE_FALSE_START:
         ssl_defaults.enableFalseStart = on;
         break;
 
       case SSL_CBC_RANDOM_IV:
         ssl_defaults.cbcRandomIV = on;
         break;
 
       case SSL_ENABLE_OCSP_STAPLING:
-        ssl_defaults.enableOCSPStapling = on;
-        break;
+       ssl_defaults.enableOCSPStapling = on;
+       break;
 
       default:
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
     return SECSuccess;
 }
 
 /* function tells us if the cipher suite is one that we no longer support. */
 static PRBool 
@@ skipping 565 matching lines @@
         }
         ss->stepDownKeyPair = ssl3_GetKeyPairRef(sm->stepDownKeyPair);
     }
     if (sm->ephemeralECDHKeyPair) {
         if (ss->ephemeralECDHKeyPair) {
             ssl3_FreeKeyPair(ss->ephemeralECDHKeyPair);
         }
         ss->ephemeralECDHKeyPair =
             ssl3_GetKeyPairRef(sm->ephemeralECDHKeyPair);
     }
+    if (sm->certStatusArray) {
+        if (ss->certStatusArray) {
+            SECITEM_FreeArray(ss->certStatusArray, PR_TRUE);
+            ss->certStatusArray = NULL;
+        }
+        ss->certStatusArray = SECITEM_DupArray(NULL, sm->certStatusArray);
+    }
     /* copy trust anchor names */
     if (sm->ssl3.ca_list) {
         if (ss->ssl3.ca_list) {
             CERT_FreeDistNames(ss->ssl3.ca_list);
         }
         ss->ssl3.ca_list = CERT_DupDistNames(sm->ssl3.ca_list);
         if (!ss->ssl3.ca_list) {
             goto loser;
         }
     }
@@ skipping 169 matching lines @@
     ssl_GetSSL3HandshakeLock(ss);
 
     ss->vrange = *vrange;
 
     ssl_ReleaseSSL3HandshakeLock(ss);
     ssl_Release1stHandshakeLock(ss);
 
     return SECSuccess;
 }
 
-SECStatus
-SSL_GetStapledOCSPResponse(PRFileDesc *fd, unsigned char *out_data,
-                           unsigned int *len) {
+const SECItemArray *
+SSL_PeerStapledOCSPResponses(PRFileDesc *fd)
+{
     sslSocket *ss = ssl_FindSocket(fd);
 
     if (!ss) {
-        SSL_DBG(("%d: SSL[%d]: bad socket in SSL_GetStapledOCSPResponse",
-                 SSL_GETPID(), fd));
-        return SECFailure;
+       SSL_DBG(("%d: SSL[%d]: bad socket in SSL_PeerStapledOCSPResponses",
+                SSL_GETPID(), fd));
+       return NULL;
     }
 
-    ssl_Get1stHandshakeLock(ss);
-    ssl_GetSSL3HandshakeLock(ss);
-
-    if (ss->ssl3.hs.cert_status.data) {
-        unsigned int todo = ss->ssl3.hs.cert_status.len;
-        if (todo > *len)
-            todo = *len;
-        *len = ss->ssl3.hs.cert_status.len;
-        PORT_Memcpy(out_data, ss->ssl3.hs.cert_status.data, todo);
-    } else {
-        *len = 0;
+    if (!ss->sec.ci.sid) {
+       PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
+       return NULL;
     }
-
-    ssl_ReleaseSSL3HandshakeLock(ss);
-    ssl_Release1stHandshakeLock(ss);
-
-    return SECSuccess;
+    
+    return &ss->sec.ci.sid->peerCertStatus;
 }
 
 SECStatus
 SSL_HandshakeResumedSession(PRFileDesc *fd, PRBool *handshake_resumed) {
     sslSocket *ss = ssl_FindSocket(fd);
 
     if (!ss) {
         SSL_DBG(("%d: SSL[%d]: bad socket in SSL_HandshakeResumedSession",
                  SSL_GETPID(), fd));
         return SECFailure;
@@ skipping 348 matching lines @@
 
     ss = ssl_GetPrivate(fd);
     if (!ss) {
         SSL_DBG(("%d: SSL[%d]: bad socket in getsockname", SSL_GETPID(), fd));
         return PR_FAILURE;
     }
     return (PRStatus)(*ss->ops->getsockname)(ss, name);
 }
 
 SECStatus
+SSL_SetStapledOCSPResponses(PRFileDesc *fd, SECItemArray *responses,
+                            PRBool takeOwnership)
+{
+    sslSocket *ss;
+
+    ss = ssl_FindSocket(fd);
+    if (!ss) {
+        SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetStapledOCSPResponses",
+                 SSL_GETPID(), fd));
+        return SECFailure;
+    }
+
+    if (ss->certStatusArray) {
+        SECITEM_FreeArray(ss->certStatusArray, PR_TRUE);
+        ss->certStatusArray = NULL;
+    }
+    if (responses) {
+        if (takeOwnership) {
+            ss->certStatusArray = responses;
+        }
+        else {
+            ss->certStatusArray = SECITEM_DupArray(NULL, responses);
+        }
+    }
+    return (ss->certStatusArray || !responses) ? SECSuccess : SECFailure;
+}
+
+SECStatus
 SSL_SetSockPeerID(PRFileDesc *fd, const char *peerID)
 {
     sslSocket *ss;
 
     ss = ssl_FindSocket(fd);
     if (!ss) {
-        SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetCacheIndex",
+        SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetSockPeerID",
                  SSL_GETPID(), fd));
         return SECFailure;
     }
 
     if (ss->peerID) {
         PORT_Free(ss->peerID);
         ss->peerID = NULL;
     }
     if (peerID)
         ss->peerID = PORT_Strdup(peerID);
@@ skipping 535 matching lines @@
         ss->sendLock       = PZ_NewLock(nssILockSSL);
         if (!ss->sendLock) 
             goto loser;
     }
     return SECSuccess;
 loser:
     ssl_DestroyLocks(ss);
     return SECFailure;
 }
 
-#if (defined(XP_UNIX) || defined(XP_WIN32) || defined(XP_BEOS)) && !defined(_WIN32_WCE)
+#if defined(XP_UNIX) || defined(XP_WIN32) || defined(XP_BEOS)
 #define NSS_HAVE_GETENV 1
 #endif
 
 #define LOWER(x) (x | 0x20)  /* cheap ToLower function ignores LOCALE */
 
 static void
 ssl_SetDefaultsFromEnvironment(void)
 {
 #if defined( NSS_HAVE_GETENV )
     static int firsttime = 1;
@@ skipping 19 matching lines @@
         ev = getenv("SSLDEBUG");
         if (ev && ev[0]) {
             ssl_debug = atoi(ev);
             SSL_TRACE(("SSL: debugging set to %d", ssl_debug));
         }
 #endif /* DEBUG */
         ev = getenv("SSLKEYLOGFILE");
         if (ev && ev[0]) {
             ssl_keylog_iob = fopen(ev, "a");
             if (!ssl_keylog_iob) {
-                SSL_TRACE(("Failed to open key log file"));
+                SSL_TRACE(("SSL: failed to open key log file"));
             } else {
                 if (ftell(ssl_keylog_iob) == 0) {
                     fputs("# SSL/TLS secrets log file, generated by NSS\n",
                           ssl_keylog_iob);
                 }
                 SSL_TRACE(("SSL: logging SSL/TLS secrets to %s", ev));
             }
         }
 #ifndef NO_PKCS11_BYPASS
         ev = getenv("SSLBYPASS");
@@ skipping 77 matching lines @@
         for (i=kt_null; i < kt_kea_size; i++) {
             sslServerCerts * sc = ss->serverCerts + i;
             sc->serverCert      = NULL;
             sc->serverCertChain = NULL;
             sc->serverKeyPair   = NULL;
             sc->serverKeyBits   = 0;
         }
         ss->requestedCertTypes = NULL;
         ss->stepDownKeyPair    = NULL;
         ss->dbHandle           = CERT_GetDefaultCertDB();
+        ss->certStatusArray    = NULL;
 
         /* Provide default implementation of hooks */
         ss->authCertificate    = SSL_AuthCertificate;
         ss->authCertificateArg = (void *)ss->dbHandle;
         ss->sniSocketConfig    = NULL;
         ss->sniSocketConfigArg = NULL;
         ss->getClientAuthData  = NULL;
 #ifdef NSS_PLATFORM_CLIENT_AUTH
         ss->getPlatformClientAuthData = NULL;
         ss->getPlatformClientAuthDataArg = NULL;
 #endif   /* NSS_PLATFORM_CLIENT_AUTH */
         ss->handleBadCert      = NULL;
         ss->badCertArg         = NULL;
         ss->pkcs11PinArg       = NULL;
+        ss->ephemeralECDHKeyPair = NULL;
         ss->getChannelID       = NULL;
         ss->getChannelIDArg    = NULL;
 
         ssl_ChooseOps(ss);
         ssl2_InitSocketPolicy(ss);
         ssl3_InitSocketPolicy(ss);
         PR_INIT_CLIST(&ss->ssl3.hs.lastMessageFlight);
 
         if (makeLocks) {
             status = ssl_MakeLocks(ss);
             if (status != SECSuccess)
                 goto loser;
         }
         status = ssl_CreateSecurityInfo(ss);
         if (status != SECSuccess) 
             goto loser;
         status = ssl_InitGather(&ss->gs);
         if (status != SECSuccess) {
 loser:
             ssl_DestroySocketContents(ss);
             ssl_DestroyLocks(ss);
             PORT_Free(ss);
             ss = NULL;
         }
         ss->protocolVariant = protocolVariant;
     }
     return ss;
 }