blob: 95e7973f3fab59bf38eab6dd13a0d1efbb13a896 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
Name: Network Security Services (NSS)
URL: http://www.mozilla.org/projects/security/pki/nss/
Version: 3.13.4 pre-release snapshot 20120319
Security Critical: Yes
This directory includes a copy of NSS's libssl from the CVS repo at:
:pserver:anonymous@cvs-mirror.mozilla.org:/cvsroot
The snapshot was updated to the CVS tag: NSS_SSL_3_13_4_20120319_TAG
Patches:
* Commenting out a couple of functions because they need NSS symbols
which may not exist in the system NSS library.
patches/versionskew.patch
* Send empty renegotiation info extension instead of SCSV unless TLS is
disabled.
patches/renegoscsv.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=549042
* Cache the peer's intermediate CA certificates in session ID, so that
they're available when we resume a session.
patches/cachecerts.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=731478
* Add the SSL_PeerCertificateChain function
patches/peercertchain.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=731485
* Add OCSP stapling support
patches/ocspstapling.patch
* Add support for client auth with native crypto APIs on Mac and Windows
patches/clientauth.patch
ssl/sslplatf.c
* Add a function to export whether the last handshake on a socket resumed a
previous session.
patches/didhandshakeresume.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=731798
* Add a function to restart a handshake after a client certificate request.
patches/restartclientauth.patch
* Allow SSL_HandshakeNegotiatedExtension to be called before the handshake
is finished.
https://bugzilla.mozilla.org/show_bug.cgi?id=681839
patches/negotiatedextension.patch
* Add function to retrieve TLS client cert types requested by server.
https://bugzilla.mozilla.org/show_bug.cgi?id=51413
patches/getrequestedclientcerttypes.patch
* Add DTLS support.
https://bugzilla.mozilla.org/show_bug.cgi?id=681065
patches/dtls.patch
* Enable False Start only when the server supports forward secrecy.
patches/falsestartnpn.patch
* Reject DH generators and public values equal to zero or one.
patches/dhvalues.patch
* Add support for TLS Channel IDs
patches/channelid.patch
* Add DTLS-SRTP (RFC 5764) support.
https://bugzilla.mozilla.org/show_bug.cgi?id=737178
patches/dtlssrtp.patch
* Move SSL keylogging out from behind the TRACE and DEBUG defines and add
support for CLIENT_RANDOM keylogging to support ECDHE-RSA and others.
patches/keylog.patch
https://bugzilla.mozilla.org/show_bug.cgi?id=762763
* SSL_GetChannelInfo and SSL_GetNegotiatedHostInfo should use cwSpec
instead of crSpec to support False Start.
https://bugzilla.mozilla.org/show_bug.cgi?id=766137
patches/getchannelinfo.patch
* Add support for extracting the tls-unique channel binding value
patches/tlsunique.patch
* Don't crash when the SSL keylog file cannot be opened.
patches/sslkeylogerror.patch
* Sets the record layer version number of ClientHello to at most TLS 1.0
if we don't know what protocol version the server supports.
https://bugzilla.mozilla.org/show_bug.cgi?id=774547
patches/recordlayerversion.patch
Apply the patches to NSS by running the patches/applypatches.sh script. Read
the comments at the top of patches/applypatches.sh for instructions.
The ssl/bodge directory contains files taken from the NSS repo that we required
for building libssl outside of its usual build environment.
|
