path: root/net/third_party/nss/patches/ocspstapling.patch

diff -up a/src/net/third_party/nss/ssl/ssl.h b/src/net/third_party/nss/ssl/ssl.h
--- a/src/net/third_party/nss/ssl/ssl.h	2012-02-28 18:34:23.263186340 -0800
+++ b/src/net/third_party/nss/ssl/ssl.h	2012-02-28 18:47:14.683775498 -0800
@@ -167,6 +167,7 @@ SSL_IMPORT PRFileDesc *SSL_ImportFD(PRFi
  * accept fragmented alerts).
  */
 #define SSL_CBC_RANDOM_IV 23
+#define SSL_ENABLE_OCSP_STAPLING       24 /* Request OCSP stapling (client) */
 
 #ifdef SSL_DEPRECATED_FUNCTION 
 /* Old deprecated function names */
@@ -347,6 +348,23 @@ SSL_IMPORT SECStatus SSL_PeerCertificate
 	PRFileDesc *fd, CERTCertificate **certs,
 	unsigned int *numCerts, unsigned int maxNumCerts);
 
+/* SSL_GetStapledOCSPResponse returns the OCSP response that was provided by
+ * the TLS server. The resulting data is copied to |out_data|. On entry, |*len|
+ * must contain the size of |out_data|. On exit, |*len| will contain the size
+ * of the OCSP stapled response. If the stapled response is too large to fit in
+ * |out_data| then it will be truncated. If no OCSP response was given by the
+ * server then it has zero length.
+ *
+ * You must set the SSL_ENABLE_OCSP_STAPLING option in order for OCSP responses
+ * to be provided by a server.
+ *
+ * You can call this function during the certificate verification callback or
+ * any time afterwards.
+ */
+SSL_IMPORT SECStatus SSL_GetStapledOCSPResponse(PRFileDesc *fd,
+						unsigned char *out_data,
+						unsigned int *len);
+
 /*
 ** Authenticate certificate hook. Called when a certificate comes in
 ** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the
diff -up a/src/net/third_party/nss/ssl/ssl3con.c b/src/net/third_party/nss/ssl/ssl3con.c
--- a/src/net/third_party/nss/ssl/ssl3con.c	2012-02-28 17:48:46.326209244 -0800
+++ b/src/net/third_party/nss/ssl/ssl3con.c	2012-02-28 19:12:51.845953454 -0800
@@ -7887,6 +7887,57 @@ ssl3_CopyPeerCertsToSID(ssl3CertNode *ce
 }
 
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
+ * ssl3 CertificateStatus message.
+ * Caller must hold Handshake and RecvBuf locks.
+ * This is always called before ssl3_HandleCertificate, even if the Certificate
+ * message is sent first.
+ */
+static SECStatus
+ssl3_HandleCertificateStatus(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+{
+    PRInt32 status, len;
+    int     errCode;
+    SSL3AlertDescription desc;
+
+    if (!ss->ssl3.hs.may_get_cert_status ||
+	ss->ssl3.hs.ws != wait_server_cert ||
+	!ss->ssl3.hs.pending_cert_msg.data ||
+	ss->ssl3.hs.cert_status.data) {
+	errCode = SSL_ERROR_RX_UNEXPECTED_CERT_STATUS;
+	desc = unexpected_message;
+	goto alert_loser;
+    }
+
+    /* Consume the CertificateStatusType enum */
+    status = ssl3_ConsumeHandshakeNumber(ss, 1, &b, &length);
+    if (status != 1 /* ocsp */) {
+	goto format_loser;
+    }
+
+    len = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length);
+    if (len != length) {
+	goto format_loser;
+    }
+
+    if (SECITEM_AllocItem(NULL, &ss->ssl3.hs.cert_status, length) == NULL) {
+        return SECFailure;
+    }
+    ss->ssl3.hs.cert_status.type = siBuffer;
+    PORT_Memcpy(ss->ssl3.hs.cert_status.data, b, length);
+
+    return SECSuccess;
+
+format_loser:
+    errCode = SSL_ERROR_BAD_CERT_STATUS_RESPONSE_ALERT;
+    desc = bad_certificate_status_response;
+
+alert_loser:
+    (void)SSL3_SendAlert(ss, alert_fatal, desc);
+    (void)ssl_MapLowLevelError(errCode);
+    return SECFailure;
+}
+
+/* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
  * ssl3 Certificate message.
  * Caller must hold Handshake and RecvBuf locks.
  */
@@ -8679,6 +8730,26 @@ ssl3_FinishHandshake(sslSocket * ss)
     return SECSuccess;
 }
 
+/* This function handles any pending Certificate messages. Certificate messages
+ * can be pending if we expect a possible CertificateStatus message to follow.
+ *
+ * This function must be called immediately after handling the
+ * CertificateStatus message, and before handling any ServerKeyExchange or
+ * CertificateRequest messages.
+ */
+static SECStatus
+ssl3_MaybeHandlePendingCertificateMessage(sslSocket *ss)
+{
+    SECStatus rv = SECSuccess;
+
+    if (ss->ssl3.hs.pending_cert_msg.data) {
+	rv = ssl3_HandleCertificate(ss, ss->ssl3.hs.pending_cert_msg.data,
+				    ss->ssl3.hs.pending_cert_msg.len);
+	SECITEM_FreeItem(&ss->ssl3.hs.pending_cert_msg, PR_FALSE);
+    }
+    return rv;
+}
+
 /* Called from ssl3_HandleHandshake() when it has gathered a complete ssl3
  * hanshake message.
  * Caller must hold Handshake and RecvBuf locks.
@@ -8773,14 +8844,42 @@ ssl3_HandleHandshakeMessage(sslSocket *s
 	rv = ssl3_HandleServerHello(ss, b, length);
 	break;
     case certificate:
+	if (ss->ssl3.hs.may_get_cert_status) {
+	    /* If we might get a CertificateStatus then we want to postpone the
+	     * processing of the Certificate message until after we have
+	     * processed the CertificateStatus */
+	    if (ss->ssl3.hs.pending_cert_msg.data ||
+		ss->ssl3.hs.ws != wait_server_cert) {
+		(void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
+		(void)ssl_MapLowLevelError(SSL_ERROR_RX_UNEXPECTED_CERTIFICATE);
+		return SECFailure;
+	    }
+	    if (SECITEM_AllocItem(NULL, &ss->ssl3.hs.pending_cert_msg,
+			          length) == NULL) {
+		return SECFailure;
+	    }
+	    ss->ssl3.hs.pending_cert_msg.type = siBuffer;
+	    PORT_Memcpy(ss->ssl3.hs.pending_cert_msg.data, b, length);
+	    break;
+	}
 	rv = ssl3_HandleCertificate(ss, b, length);
 	break;
+    case certificate_status:
+	rv = ssl3_HandleCertificateStatus(ss, b, length);
+	if (rv != SECSuccess)
+	    break;
+	PORT_Assert(ss->ssl3.hs.pending_cert_msg.data);
+	rv = ssl3_MaybeHandlePendingCertificateMessage(ss);
+	break;
     case server_key_exchange:
 	if (ss->sec.isServer) {
 	    (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
 	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH);
 	    return SECFailure;
 	}
+	rv = ssl3_MaybeHandlePendingCertificateMessage(ss);
+	if (rv != SECSuccess)
+	    break;
 	rv = ssl3_HandleServerKeyExchange(ss, b, length);
 	break;
     case certificate_request:
@@ -8789,6 +8888,9 @@ ssl3_HandleHandshakeMessage(sslSocket *s
 	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST);
 	    return SECFailure;
 	}
+	rv = ssl3_MaybeHandlePendingCertificateMessage(ss);
+	if (rv != SECSuccess)
+	    break;
 	rv = ssl3_HandleCertificateRequest(ss, b, length);
 	break;
     case server_hello_done:
@@ -8802,6 +8904,9 @@ ssl3_HandleHandshakeMessage(sslSocket *s
 	    PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);
 	    return SECFailure;
 	}
+	rv = ssl3_MaybeHandlePendingCertificateMessage(ss);
+	if (rv != SECSuccess)
+	    break;
 	rv = ssl3_HandleServerHelloDone(ss);
 	break;
     case certificate_verify:
@@ -9646,6 +9751,12 @@ ssl3_DestroySSL3Info(sslSocket *ss)
 	ss->ssl3.hs.messages.len = 0;
 	ss->ssl3.hs.messages.space = 0;
     }
+    if (ss->ssl3.hs.pending_cert_msg.data) {
+	SECITEM_FreeItem(&ss->ssl3.hs.pending_cert_msg, PR_FALSE);
+    }
+    if (ss->ssl3.hs.cert_status.data) {
+	SECITEM_FreeItem(&ss->ssl3.hs.cert_status, PR_FALSE);
+    }
 
     /* free the SSL3Buffer (msg_body) */
     PORT_Free(ss->ssl3.hs.msg_body.buf);
diff -up a/src/net/third_party/nss/ssl/ssl3ext.c b/src/net/third_party/nss/ssl/ssl3ext.c
--- a/src/net/third_party/nss/ssl/ssl3ext.c	2012-02-15 13:52:08.000000000 -0800
+++ b/src/net/third_party/nss/ssl/ssl3ext.c	2012-02-28 19:14:28.617352538 -0800
@@ -253,6 +253,7 @@ static const ssl3HelloExtensionHandler s
     { ssl_session_ticket_xtn,     &ssl3_ClientHandleSessionTicketXtn },
     { ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn },
     { ssl_next_proto_nego_xtn,    &ssl3_ClientHandleNextProtoNegoXtn },
+    { ssl_cert_status_xtn,        &ssl3_ClientHandleStatusRequestXtn },
     { -1, NULL }
 };
 
@@ -276,7 +277,8 @@ ssl3HelloExtensionSender clientHelloSend
     { ssl_ec_point_formats_xtn,   &ssl3_SendSupportedPointFormatsXtn },
 #endif
     { ssl_session_ticket_xtn,     &ssl3_SendSessionTicketXtn },
-    { ssl_next_proto_nego_xtn,    &ssl3_ClientSendNextProtoNegoXtn }
+    { ssl_next_proto_nego_xtn,    &ssl3_ClientSendNextProtoNegoXtn },
+    { ssl_cert_status_xtn,        &ssl3_ClientSendStatusRequestXtn }
     /* any extra entries will appear as { 0, NULL }    */
 };
 
@@ -659,6 +661,80 @@ loser:
     return -1;
 }
 
+SECStatus
+ssl3_ClientHandleStatusRequestXtn(sslSocket *ss, PRUint16 ex_type,
+				  SECItem *data)
+{
+    /* If we didn't request this extension, then the server may not echo it. */
+    if (!ss->opt.enableOCSPStapling)
+	return SECFailure;
+
+    /* The echoed extension must be empty. */
+    if (data->len != 0)
+	return SECFailure;
+
+    ss->ssl3.hs.may_get_cert_status = PR_TRUE;
+
+    /* Keep track of negotiated extensions. */
+    ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
+
+    return SECSuccess;
+}
+
+/* ssl3_ClientSendStatusRequestXtn builds the status_request extension on the
+ * client side. See RFC 4366 section 3.6. */
+PRInt32
+ssl3_ClientSendStatusRequestXtn(sslSocket * ss, PRBool append,
+				PRUint32 maxBytes)
+{
+    PRInt32 extension_length;
+
+    if (!ss->opt.enableOCSPStapling)
+	return 0;
+
+    /* extension_type (2-bytes) +
+     * length(extension_data) (2-bytes) +
+     * status_type (1) +
+     * responder_id_list length (2) +
+     * request_extensions length (2)
+     */
+    extension_length = 9;
+
+    if (append && maxBytes >= extension_length) {
+	SECStatus rv;
+	TLSExtensionData *xtnData;
+
+	/* extension_type */
+	rv = ssl3_AppendHandshakeNumber(ss, ssl_cert_status_xtn, 2);
+	if (rv != SECSuccess)
+	    return -1;
+	rv = ssl3_AppendHandshakeNumber(ss, extension_length - 4, 2);
+	if (rv != SECSuccess)
+	    return -1;
+	rv = ssl3_AppendHandshakeNumber(ss, 1 /* status_type ocsp */, 1);
+	if (rv != SECSuccess)
+	    return -1;
+	/* A zero length responder_id_list means that the responders are
+	 * implicitly known to the server. */
+	rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
+	if (rv != SECSuccess)
+	    return -1;
+	/* A zero length request_extensions means that there are no extensions.
+	 * Specifically, we don't set the id-pkix-ocsp-nonce extension. This
+	 * means that the server can replay a cached OCSP response to us. */
+	rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
+	if (rv != SECSuccess)
+	    return -1;
+
+	xtnData = &ss->xtnData;
+	xtnData->advertised[xtnData->numAdvertised++] = ssl_cert_status_xtn;
+    } else if (maxBytes < extension_length) {
+	PORT_Assert(0);
+	return 0;
+    }
+    return extension_length;
+}
+
 /*
  * NewSessionTicket
  * Called from ssl3_HandleFinished
diff -up a/src/net/third_party/nss/ssl/ssl3prot.h b/src/net/third_party/nss/ssl/ssl3prot.h
--- a/src/net/third_party/nss/ssl/ssl3prot.h	2011-10-28 17:29:11.000000000 -0700
+++ b/src/net/third_party/nss/ssl/ssl3prot.h	2012-02-28 19:12:51.845953454 -0800
@@ -158,6 +158,7 @@ typedef enum {
     certificate_verify	= 15, 
     client_key_exchange	= 16, 
     finished		= 20,
+    certificate_status	= 22,
     next_proto		= 67
 } SSL3HandshakeType;
 
diff -up a/src/net/third_party/nss/ssl/sslerr.h b/src/net/third_party/nss/ssl/sslerr.h
--- a/src/net/third_party/nss/ssl/sslerr.h	2012-02-11 04:55:58.000000000 -0800
+++ b/src/net/third_party/nss/ssl/sslerr.h	2012-02-28 18:58:06.733056235 -0800
@@ -211,6 +211,8 @@ SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SSL2
 SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SERVERS = (SSL_ERROR_BASE + 118),
 SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_CLIENTS = (SSL_ERROR_BASE + 119),
 
+SSL_ERROR_RX_UNEXPECTED_CERT_STATUS     = (SSL_ERROR_BASE + 120),
+
 SSL_ERROR_END_OF_LIST	/* let the c compiler determine the value of this. */
 } SSLErrorCodes;
 #endif /* NO_SECURITY_ERROR_ENUM */
diff -up a/src/net/third_party/nss/ssl/sslimpl.h b/src/net/third_party/nss/ssl/sslimpl.h
--- a/src/net/third_party/nss/ssl/sslimpl.h	2012-02-28 17:48:46.326209244 -0800
+++ b/src/net/third_party/nss/ssl/sslimpl.h	2012-02-28 19:05:14.299310096 -0800
@@ -339,6 +339,7 @@ typedef struct sslOptionsStr {
     unsigned int requireSafeNegotiation : 1;  /* 22 */
     unsigned int enableFalseStart       : 1;  /* 23 */
     unsigned int cbcRandomIV            : 1;  /* 24 */
+    unsigned int enableOCSPStapling     : 1;  /* 25 */
 } sslOptions;
 
 typedef enum { sslHandshakingUndetermined = 0,
@@ -782,6 +783,14 @@ const ssl3CipherSuiteDef *suite_def;
     PRBool                isResuming;  /* are we resuming a session */
     PRBool                usedStepDownKey;  /* we did a server key exchange. */
     PRBool                sendingSCSV; /* instead of empty RI */
+    PRBool                may_get_cert_status; /* the server echoed a
+                                                * status_request extension so
+                                                * may send a CertificateStatus
+                                                * handshake message. */
+    SECItem               pending_cert_msg; /* a Certificate message which we
+                                             * save temporarily if we may get
+                                             * a CertificateStatus message */
+    SECItem               cert_status; /* an OCSP response */
     sslBuffer             msgState;    /* current state for handshake messages*/
                                        /* protected by recvBufLock */
     sslBuffer             messages;    /* Accumulated handshake messages */
@@ -1527,6 +1536,8 @@ extern SECStatus ssl3_HandleSupportedPoi
 			PRUint16 ex_type, SECItem *data);
 extern SECStatus ssl3_ClientHandleSessionTicketXtn(sslSocket *ss,
 			PRUint16 ex_type, SECItem *data);
+extern SECStatus ssl3_ClientHandleStatusRequestXtn(sslSocket *ss,
+			PRUint16 ex_type, SECItem *data);
 extern SECStatus ssl3_ServerHandleSessionTicketXtn(sslSocket *ss,
 			PRUint16 ex_type, SECItem *data);
 
@@ -1536,6 +1547,8 @@ extern SECStatus ssl3_ServerHandleSessio
  */
 extern PRInt32 ssl3_SendSessionTicketXtn(sslSocket *ss, PRBool append,
 			PRUint32 maxBytes);
+extern PRInt32 ssl3_ClientSendStatusRequestXtn(sslSocket *ss, PRBool append,
+			PRUint32 maxBytes);
 
 /* ClientHello and ServerHello extension senders.
  * The code is in ssl3ext.c.
diff -up a/src/net/third_party/nss/ssl/sslsock.c b/src/net/third_party/nss/ssl/sslsock.c
--- a/src/net/third_party/nss/ssl/sslsock.c	2012-02-28 16:15:34.790321976 -0800
+++ b/src/net/third_party/nss/ssl/sslsock.c	2012-02-28 19:12:51.845953454 -0800
@@ -185,7 +185,8 @@ static sslOptions ssl_defaults = {
     2,          /* enableRenegotiation (default: requires extension) */
     PR_FALSE,   /* requireSafeNegotiation */
     PR_FALSE,   /* enableFalseStart   */
-    PR_TRUE     /* cbcRandomIV        */
+    PR_TRUE,    /* cbcRandomIV        */
+    PR_FALSE,   /* enableOCSPStapling */
 };
 
 sslSessionIDLookupFunc  ssl_sid_lookup;
@@ -741,6 +742,10 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
 	ss->opt.cbcRandomIV = on;
 	break;
 
+      case SSL_ENABLE_OCSP_STAPLING:
+	ss->opt.enableOCSPStapling = on;
+	break;
+
       default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
 	rv = SECFailure;
@@ -806,6 +811,7 @@ SSL_OptionGet(PRFileDesc *fd, PRInt32 wh
                                   on = ss->opt.requireSafeNegotiation; break;
     case SSL_ENABLE_FALSE_START:  on = ss->opt.enableFalseStart;   break;
     case SSL_CBC_RANDOM_IV:       on = ss->opt.cbcRandomIV;        break;
+    case SSL_ENABLE_OCSP_STAPLING: on = ss->opt.enableOCSPStapling; break;
 
     default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
@@ -860,6 +866,9 @@ SSL_OptionGetDefault(PRInt32 which, PRBo
 				  break;
     case SSL_ENABLE_FALSE_START:  on = ssl_defaults.enableFalseStart;   break;
     case SSL_CBC_RANDOM_IV:       on = ssl_defaults.cbcRandomIV;        break;
+    case SSL_ENABLE_OCSP_STAPLING:
+	on = ssl_defaults.enableOCSPStapling;
+	break;
 
     default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
@@ -1019,6 +1028,10 @@ SSL_OptionSetDefault(PRInt32 which, PRBo
 	ssl_defaults.cbcRandomIV = on;
 	break;
 
+      case SSL_ENABLE_OCSP_STAPLING:
+	ssl_defaults.enableOCSPStapling = on;
+	break;
+
       default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
 	return SECFailure;
@@ -1537,6 +1550,36 @@ loser:
 #endif
 }
 
+SECStatus
+SSL_GetStapledOCSPResponse(PRFileDesc *fd, unsigned char *out_data,
+			   unsigned int *len) {
+    sslSocket *ss = ssl_FindSocket(fd);
+
+    if (!ss) {
+	SSL_DBG(("%d: SSL[%d]: bad socket in SSL_GetStapledOCSPResponse",
+		 SSL_GETPID(), fd));
+	return SECFailure;
+    }
+
+    ssl_Get1stHandshakeLock(ss);
+    ssl_GetSSL3HandshakeLock(ss);
+
+    if (ss->ssl3.hs.cert_status.data) {
+	unsigned int todo = ss->ssl3.hs.cert_status.len;
+	if (todo > *len)
+	    todo = *len;
+	*len = ss->ssl3.hs.cert_status.len;
+	PORT_Memcpy(out_data, ss->ssl3.hs.cert_status.data, todo);
+    } else {
+	*len = 0;
+    }
+
+    ssl_ReleaseSSL3HandshakeLock(ss);
+    ssl_Release1stHandshakeLock(ss);
+
+    return SECSuccess;
+}
+
 /************************************************************************/
 /* The following functions are the TOP LEVEL SSL functions.
 ** They all get called through the NSPRIOMethods table below.
diff -up a/src/net/third_party/nss/ssl/sslt.h b/src/net/third_party/nss/ssl/sslt.h
--- a/src/net/third_party/nss/ssl/sslt.h	2012-02-15 13:52:08.000000000 -0800
+++ b/src/net/third_party/nss/ssl/sslt.h	2012-02-28 19:12:51.845953454 -0800
@@ -198,6 +198,7 @@ typedef enum {
 /* Update SSL_MAX_EXTENSIONS whenever a new extension type is added. */
 typedef enum {
     ssl_server_name_xtn              = 0,
+    ssl_cert_status_xtn              = 5,
 #ifdef NSS_ENABLE_ECC
     ssl_elliptic_curves_xtn          = 10,
     ssl_ec_point_formats_xtn         = 11,
@@ -207,6 +208,6 @@ typedef enum {
     ssl_renegotiation_info_xtn       = 0xff01	/* experimental number */
 } SSLExtensionType;
 
-#define SSL_MAX_EXTENSIONS             6
+#define SSL_MAX_EXTENSIONS             7
 
 #endif /* __sslt_h_ */