1 |
commit: 2ea1657afa9edafc6f25a30e79dc76e377ab2d4c |
2 |
Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
3 |
AuthorDate: Mon Oct 26 15:02:52 2020 +0000 |
4 |
Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> |
5 |
CommitDate: Mon Oct 26 15:02:52 2020 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2ea1657a |
7 |
|
8 |
dev-libs/nss: update patch to what upstream merged |
9 |
|
10 |
Package-Manager: Portage-3.0.8, Repoman-3.0.2 |
11 |
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org> |
12 |
|
13 |
...8-always-tolerate-the-first-CCS-in-TLS1.3.patch | 107 +++++++++++++++++++-- |
14 |
.../nss/{nss-3.58-r1.ebuild => nss-3.58-r2.ebuild} | 0 |
15 |
2 files changed, 98 insertions(+), 9 deletions(-) |
16 |
|
17 |
diff --git a/dev-libs/nss/files/nss-3.58-always-tolerate-the-first-CCS-in-TLS1.3.patch b/dev-libs/nss/files/nss-3.58-always-tolerate-the-first-CCS-in-TLS1.3.patch |
18 |
index f68b65c119c..a92c0389936 100644 |
19 |
--- a/dev-libs/nss/files/nss-3.58-always-tolerate-the-first-CCS-in-TLS1.3.patch |
20 |
+++ b/dev-libs/nss/files/nss-3.58-always-tolerate-the-first-CCS-in-TLS1.3.patch |
21 |
@@ -1,8 +1,32 @@ |
22 |
-https://bugzilla.mozilla.org/show_bug.cgi?id=1672703 |
23 |
+ |
24 |
+# HG changeset patch |
25 |
+# User Daiki Ueno <dueno@××××××.com> |
26 |
+# Date 1603691171 -3600 |
27 |
+# Node ID b03a4fc5b902498414b02640dcb2717dfef9682f |
28 |
+# Parent 6f79a76958129dc09c353c288f115fd9a51ab7d4 |
29 |
+Bug 1672703, always tolerate the first CCS in TLS 1.3, r=mt |
30 |
+ |
31 |
+Summary: |
32 |
+This flips the meaning of the flag for checking excessive CCS |
33 |
+messages, so it only rejects multiple CCS messages while the first CCS |
34 |
+message is always accepted. |
35 |
+ |
36 |
+Reviewers: mt |
37 |
+ |
38 |
+Reviewed By: mt |
39 |
+ |
40 |
+Bug #: 1672703 |
41 |
+ |
42 |
+Differential Revision: https://phabricator.services.mozilla.com/D94603 |
43 |
|
44 |
--- a/gtests/ssl_gtest/ssl_tls13compat_unittest.cc |
45 |
+++ b/gtests/ssl_gtest/ssl_tls13compat_unittest.cc |
46 |
-@@ -348,8 +348,8 @@ |
47 |
+@@ -343,29 +343,28 @@ TEST_F(TlsConnectStreamTls13, ChangeCiph |
48 |
+ // Client sends CCS before starting the handshake. |
49 |
+ client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs))); |
50 |
+ client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs))); |
51 |
+ ConnectExpectAlert(server_, kTlsAlertUnexpectedMessage); |
52 |
+ server_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER); |
53 |
client_->CheckErrorCode(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT); |
54 |
} |
55 |
|
56 |
@@ -13,7 +37,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1672703 |
57 |
TEST_F(TlsConnectStreamTls13, ChangeCipherSpecAfterClientHelloEmptySid) { |
58 |
EnsureTlsSetup(); |
59 |
ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3); |
60 |
-@@ -358,9 +358,8 @@ |
61 |
+ |
62 |
+ StartConnect(); |
63 |
client_->Handshake(); // Send ClientHello |
64 |
client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs))); // Send CCS |
65 |
|
66 |
@@ -25,7 +50,17 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1672703 |
67 |
} |
68 |
|
69 |
// The server rejects multiple ChangeCipherSpec even if the client |
70 |
-@@ -381,7 +380,7 @@ |
71 |
+ // indicates compatibility mode with non-empty session ID. |
72 |
+ TEST_F(Tls13CompatTest, ChangeCipherSpecAfterClientHelloTwice) { |
73 |
+ EnsureTlsSetup(); |
74 |
+ ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3); |
75 |
+ EnableCompatMode(); |
76 |
+@@ -376,36 +375,37 @@ TEST_F(Tls13CompatTest, ChangeCipherSpec |
77 |
+ client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs))); |
78 |
+ client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs))); |
79 |
+ |
80 |
+ server_->ExpectSendAlert(kTlsAlertUnexpectedMessage); |
81 |
+ server_->Handshake(); // Consume ClientHello and CCS. |
82 |
server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER); |
83 |
} |
84 |
|
85 |
@@ -34,7 +69,16 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1672703 |
86 |
// session ID. |
87 |
TEST_F(TlsConnectStreamTls13, ChangeCipherSpecAfterServerHelloEmptySid) { |
88 |
EnsureTlsSetup(); |
89 |
-@@ -398,9 +397,10 @@ |
90 |
+ ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3); |
91 |
+ |
92 |
+ // To replace Finished with a CCS below |
93 |
+ auto filter = MakeTlsFilter<TlsHandshakeDropper>(server_); |
94 |
+ filter->SetHandshakeTypes({kTlsHandshakeFinished}); |
95 |
+ filter->EnableDecryption(); |
96 |
+ |
97 |
+ StartConnect(); |
98 |
+ client_->Handshake(); // Send ClientHello |
99 |
+ server_->Handshake(); // Consume ClientHello, and |
100 |
// send ServerHello..CertificateVerify |
101 |
// Send CCS |
102 |
server_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs))); |
103 |
@@ -48,9 +92,19 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1672703 |
104 |
} |
105 |
|
106 |
// The client rejects multiple ChangeCipherSpec in a row even if the |
107 |
+ // client indicates compatibility mode with non-empty session ID. |
108 |
+ TEST_F(Tls13CompatTest, ChangeCipherSpecAfterServerHelloTwice) { |
109 |
+ EnsureTlsSetup(); |
110 |
+ ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3); |
111 |
+ EnableCompatMode(); |
112 |
--- a/lib/ssl/ssl3con.c |
113 |
+++ b/lib/ssl/ssl3con.c |
114 |
-@@ -6645,11 +6645,7 @@ |
115 |
+@@ -6640,21 +6640,17 @@ ssl_CheckServerSessionIdCorrectness(sslS |
116 |
+ if (sentFakeSid) { |
117 |
+ return !sidMatch; |
118 |
+ } |
119 |
+ return PR_TRUE; |
120 |
+ } |
121 |
|
122 |
/* TLS 1.3: We sent a session ID. The server's should match. */ |
123 |
if (!IS_DTLS(ss) && (sentRealSid || sentFakeSid)) { |
124 |
@@ -63,7 +117,17 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1672703 |
125 |
} |
126 |
|
127 |
/* TLS 1.3 (no SID)/DTLS 1.3: The server shouldn't send a session ID. */ |
128 |
-@@ -8696,7 +8692,6 @@ |
129 |
+ return sidBytes->len == 0; |
130 |
+ } |
131 |
+ |
132 |
+ static SECStatus |
133 |
+ ssl_CheckServerRandom(sslSocket *ss) |
134 |
+@@ -8691,17 +8687,16 @@ ssl3_HandleClientHello(sslSocket *ss, PR |
135 |
+ if (sidBytes.len > 0 && !IS_DTLS(ss)) { |
136 |
+ SECITEM_FreeItem(&ss->ssl3.hs.fakeSid, PR_FALSE); |
137 |
+ rv = SECITEM_CopyItem(NULL, &ss->ssl3.hs.fakeSid, &sidBytes); |
138 |
+ if (rv != SECSuccess) { |
139 |
+ desc = internal_error; |
140 |
errCode = PORT_GetError(); |
141 |
goto alert_loser; |
142 |
} |
143 |
@@ -71,7 +135,17 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1672703 |
144 |
} |
145 |
|
146 |
/* TLS 1.3 requires that compression include only null. */ |
147 |
-@@ -13066,15 +13061,14 @@ |
148 |
+ if (comps.len != 1 || comps.data[0] != ssl_compression_null) { |
149 |
+ goto alert_loser; |
150 |
+ } |
151 |
+ |
152 |
+ /* If there is a cookie, then this is a second ClientHello (TLS 1.3). */ |
153 |
+@@ -13061,25 +13056,24 @@ ssl3_HandleRecord(sslSocket *ss, SSL3Cip |
154 |
+ * will fail if the server fails to negotiate compatibility mode in a |
155 |
+ * 0-RTT session that is resumed from a session that did negotiate it. |
156 |
+ * We don't care about that corner case right now. */ |
157 |
+ if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_3 && |
158 |
+ cText->hdr[0] == ssl_ct_change_cipher_spec && |
159 |
ss->ssl3.hs.ws != idle_handshake && |
160 |
cText->buf->len == 1 && |
161 |
cText->buf->buf[0] == change_cipher_spec_choice) { |
162 |
@@ -94,9 +168,19 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1672703 |
163 |
} |
164 |
|
165 |
if ((IS_DTLS(ss) && !dtls13_AeadLimitReached(spec)) || |
166 |
+ (!IS_DTLS(ss) && ss->sec.isServer && |
167 |
+ ss->ssl3.hs.zeroRttIgnore == ssl_0rtt_ignore_trial)) { |
168 |
+ /* Silently drop the packet unless we sent a fatal alert. */ |
169 |
+ if (ss->ssl3.fatalAlertSent) { |
170 |
+ return SECFailure; |
171 |
--- a/lib/ssl/sslimpl.h |
172 |
+++ b/lib/ssl/sslimpl.h |
173 |
-@@ -710,10 +710,7 @@ |
174 |
+@@ -705,20 +705,17 @@ typedef struct SSL3HandshakeStateStr { |
175 |
+ sslZeroRttIgnore zeroRttIgnore; /* Are we ignoring 0-RTT? */ |
176 |
+ ssl3CipherSuite zeroRttSuite; /* The cipher suite we used for 0-RTT. */ |
177 |
+ PRCList bufferedEarlyData; /* Buffered TLS 1.3 early data |
178 |
+ * on server.*/ |
179 |
+ PRBool helloRetry; /* True if HelloRetryRequest has been sent |
180 |
* or received. */ |
181 |
PRBool receivedCcs; /* A server received ChangeCipherSpec |
182 |
* before the handshake started. */ |
183 |
@@ -108,4 +192,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1672703 |
184 |
PRBool clientCertRequested; /* True if CertificateRequest received. */ |
185 |
PRBool endOfFlight; /* Processed a full flight (DTLS 1.3). */ |
186 |
ssl3KEADef kea_def_mutable; /* Used to hold the writable kea_def |
187 |
+ * we use for TLS 1.3 */ |
188 |
+ PRUint16 ticketNonce; /* A counter we use for tickets. */ |
189 |
+ SECItem fakeSid; /* ... (server) the SID the client used. */ |
190 |
+ |
191 |
+ /* rttEstimate is used to guess the round trip time between server and client. |
192 |
|
193 |
|
194 |
diff --git a/dev-libs/nss/nss-3.58-r1.ebuild b/dev-libs/nss/nss-3.58-r2.ebuild |
195 |
similarity index 100% |
196 |
rename from dev-libs/nss/nss-3.58-r1.ebuild |
197 |
rename to dev-libs/nss/nss-3.58-r2.ebuild |