blob: 47f8d5665ae11ac68ac43a6b05ff8fbfc8e8fabe (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
Name: Network Security Services (NSS)
URL: http://www.mozilla.org/projects/security/pki/nss/
This directory includes a copy of NSS's libssl from the CVS repo at:
:pserver:anonymous@cvs-mirror.mozilla.org:/cvsroot
The snapshot was updated to the CVS tag: NSS_3_12_9_RTM
Patches:
* Next protocol negotiation support.
patches/nextproto.patch
http://codereview.chromium.org/415005
* Commenting out a couple of functions because they need NSS symbols
which may not exist in the system NSS library.
patches/versionskew.patch
* Send empty renegotiation info extension instead of SCSV unless TLS is
disabled.
patches/renegoscsv.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=549042
* Cache the peer's intermediate CA certificates in session ID, so that
they're available when we resume a session. Add certificates to
ss->ssl3.peerCertChain in the right order.
patches/cachecerts.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=606049
* Add the SSL_PeerCertificateChain function
patches/peercertchain.patch
* Add OCSP stapling support
patches/ocspstapling.patch
* Add support for client auth with native crypto APIs on Mac and Windows
patches/clientauth.patch
ssl/sslplatf.c
* Don't send a client certificate when renegotiating if the peer does not
request one. This only happened if the previous key exchange algorithm
was non-RSA.
patches/clientauth.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=616757
* Add support for TLS cached info extension.
patches/cachedinfo.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=665739
* Add a function to export whether the last handshake on a socket resumed a
previous session.
patches/didhandshakeresume.patch
* Precede each set of CBC encrypted application data records, resulting from
a single call to ssl3_SendApplicationData, with an empty application data
record in order to randomize the IV in a backwards compatible manner.
patches/cbcrandomiv.patch
* Support origin bound certificates.
http://balfanz.github.com/tls-obc-spec/draft-balfanz-tls-obc-00.txt
patches/origin_bound_certs.patch
* Add a function to implement RFC 5705: Keying Material Exporters for TLS
This is a reworked version of the patch from
https://bugzilla.mozilla.org/show_bug.cgi?id=507359
patches/secret_exporter.patch
* Send saved write data in the SSL socket in SSL_ForceHandshake.
patches/handshakeshortwrite.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=676729
Apply the patches to NSS by running the patches/applypatches.sh script. Read
the comments at the top of patches/applypatches.sh for instructions.
The ssl/bodge directory contains files taken from the NSS repo that we required
for building libssl outside of its usual build environment.
|
