Remove the TLS Snap Start code from NSS.

net/third_party/nss/ssl/sslimpl.h

 /*
  * This file is PRIVATE to SSL and should be the first thing included by
  * any SSL implementation file.
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
@@ skipping 269 matching lines @@
     int         (*read)    (sslSocket *, unsigned char *, int);
     int         (*write)   (sslSocket *, const unsigned char *, int);
 
     int         (*getpeername)(sslSocket *, PRNetAddr *);
     int         (*getsockname)(sslSocket *, PRNetAddr *);
 };
 
 /* Flags interpreted by ssl send functions. */
 #define ssl_SEND_FLAG_FORCE_INTO_BUFFER 0x40000000
 #define ssl_SEND_FLAG_NO_BUFFER         0x20000000
-#define ssl_SEND_FLAG_NO_FLUSH          0x10000000
 #define ssl_SEND_FLAG_MASK              0x7f000000
 
 /*
 ** A buffer object.
 */
 struct sslBufferStr {
     unsigned char *     buf;
     unsigned int        len;
     unsigned int        space;
 };
@@ skipping 41 matching lines @@
     unsigned int v2CompatibleHello      : 1;  /* 13 */
     unsigned int detectRollBack         : 1;  /* 14 */
     unsigned int noStepDown             : 1;  /* 15 */
     unsigned int bypassPKCS11           : 1;  /* 16 */
     unsigned int noLocks                : 1;  /* 17 */
     unsigned int enableSessionTickets   : 1;  /* 18 */
     unsigned int enableDeflate          : 1;  /* 19 */
     unsigned int enableRenegotiation    : 2;  /* 20-21 */
     unsigned int requireSafeNegotiation : 1;  /* 22 */
     unsigned int enableFalseStart       : 1;  /* 23 */
-    unsigned int enableSnapStart        : 1;  /* 24 */
-    unsigned int enableOCSPStapling     : 1;  /* 25 */
+    unsigned int enableOCSPStapling     : 1;  /* 24 */
 } sslOptions;
 
 typedef enum { sslHandshakingUndetermined = 0,
                sslHandshakingAsClient,
                sslHandshakingAsServer 
 } sslHandshakingType;
 
 typedef struct sslServerCertsStr {
     /* Configuration state for server sockets */
     CERTCertificate *     serverCert;
@@ skipping 394 matching lines @@
     /* registered callbacks that send server hello extensions */
     ssl3HelloExtensionSender serverSenders[SSL_MAX_EXTENSIONS];
     /* Keep track of the extensions that are negotiated. */
     PRUint16 numAdvertised;
     PRUint16 numNegotiated;
     PRUint16 advertised[SSL_MAX_EXTENSIONS];
     PRUint16 negotiated[SSL_MAX_EXTENSIONS];
 
     /* SessionTicket Extension related data. */
     PRBool ticketTimestampVerified;
-    PRBool serverReceivedEmptySessionTicket;
-    PRBool clientSentNonEmptySessionTicket;
+    PRBool emptySessionTicket;
 
     /* SNI Extension related data
      * Names data is not coppied from the input buffer. It can not be
      * used outside the scope where input buffer is defined and that
      * is beyond ssl3_HandleClientHello function. */
     SECItem *sniNameArr;
     PRUint32 sniNameArrSize;
 };
 
-typedef enum {
-    snap_start_none = 0,
-    snap_start_full,
-    snap_start_recovery,
-    snap_start_resume,
-    snap_start_resume_recovery
-} TLSSnapStartType;
-
 /*
 ** This is the "hs" member of the "ssl3" struct.
 ** This entire struct is protected by ssl3HandshakeLock
 */
 typedef struct SSL3HandshakeStateStr {
     SSL3Random            server_random;
     SSL3Random            client_random;
     SSL3WaitState         ws;
     PRUint64              md5_cx[MAX_MAC_CONTEXT_LLONGS];
     PRUint64              sha_cx[MAX_MAC_CONTEXT_LLONGS];
@@ skipping 26 matching lines @@
     SECItem               cert_status; /* an OCSP response */
     sslBuffer             msgState;    /* current state for handshake messages*/
                                        /* protected by recvBufLock */
     sslBuffer             messages;    /* Accumulated handshake messages */
     PRUint16              finishedBytes; /* size of single finished below */
     union {
         TLSFinished       tFinished[2]; /* client, then server */
         SSL3Hashes        sFinished[2];
         SSL3Opaque        data[72];
     }                     finishedMsgs;
-
-    TLSSnapStartType      snapStartType;
-    /* When we perform a Snap Start handshake, we hash our ClientHello as if
-     * the Snap Start extension wasn't included. However, if the server rejects
-     * our Snap Start attempt, then it will hash the whole ClientHello. Thus we
-     * store the original ClientHello that we sent in case we need to reset our
-     * Finished hash to cover it. */
-    SECItem               origClientHello;
 #ifdef NSS_ENABLE_ECC
     PRUint32              negotiatedECCurves; /* bit mask */
 #endif /* NSS_ENABLE_ECC */
     PRBool                nextProtoNego;/* Our peer has sent this extension */
 } SSL3HandshakeState;
 
 
 
 /*
 ** This is the "ssl3" struct, as in "ss->ssl3".
@@ skipping 15 matching lines @@
     ssl3CipherSpec *     pwSpec;        /* pending write spec. */
 
     CERTCertificate *    clientCertificate;  /* used by client */
     SECKEYPrivateKey *   clientPrivateKey;   /* used by client */
 #ifdef NSS_PLATFORM_CLIENT_AUTH
     PlatformKey          platformClientKey;  /* used by client */
 #endif  /* NSS_PLATFORM_CLIENT_AUTH */
     CERTCertificateList *clientCertChain;    /* used by client */
     PRBool               sendEmptyCert;      /* used by client */
 
-    /* TLS Snap Start: */
-    CERTCertificate **   predictedCertChain;
-                            /* An array terminated with a NULL. */
-    SECItem              serverHelloPredictionData;
-    PRBool               serverHelloPredictionDataValid;
-                            /* data needed to predict the ServerHello from
-                             * this server. */
-    SECItem              snapStartApplicationData;
-                            /* the application data to include in the Snap
-                             * Start extension. */
-
     int                  policy;
                         /* This says what cipher suites we can do, and should 
                          * be either SSL_ALLOWED or SSL_RESTRICTED 
                          */
     PRArenaPool *        peerCertArena;  
                             /* These are used to keep track of the peer CA */
     void *               peerCertChain;     
                             /* chain while we are trying to validate it.   */
     CERTDistNames *      ca_list; 
                             /* used by server.  trusted CAs for this socket. */
@@ skipping 419 matching lines @@
 extern SECStatus sslBuffer_Append(sslBuffer *b, const void * data, 
                                   unsigned int len);
 
 extern void      ssl2_UseClearSendFunc(sslSocket *ss);
 extern void      ssl_ChooseSessionIDProcs(sslSecurityInfo *sec);
 
 extern sslSessionID *ssl3_NewSessionID(sslSocket *ss, PRBool is_server);
 extern sslSessionID *ssl_LookupSID(const PRIPv6Addr *addr, PRUint16 port, 
                                    const char *peerID, const char *urlSvrName);
 extern void      ssl_FreeSID(sslSessionID *sid);
-extern void      ssl3_CopyPeerCertsFromSID(sslSocket *ss, sslSessionID *sid);
 
 extern int       ssl3_SendApplicationData(sslSocket *ss, const PRUint8 *in,
                                           int len, int flags);
 
-extern SECStatus ssl3_RestartHandshakeHashes(sslSocket *ss);
-
 extern PRBool    ssl_FdIsBlocking(PRFileDesc *fd);
 
 extern PRBool    ssl_SocketIsBlocking(sslSocket *ss);
 
 extern void      ssl_SetAlwaysBlock(sslSocket *ss);
 
 extern SECStatus ssl_EnableNagleDelay(sslSocket *ss, PRBool enabled);
 
 extern PRBool    ssl3_CanFalseStart(sslSocket *ss);
 
@@ skipping 152 matching lines @@
                ec_pastLastName
 } ECName;
 
 extern SECStatus ssl3_ECName2Params(PRArenaPool *arena, ECName curve,
                                    SECKEYECParams *params);
 ECName  ssl3_GetCurveWithECKeyStrength(PRUint32 curvemsk, int requiredECCbits);
 
 
 #endif /* NSS_ENABLE_ECC */
 
-extern SECStatus ssl3_UpdateHandshakeHashes(sslSocket* ss, unsigned char *b,
-                                            unsigned int l);
-
 extern SECStatus ssl3_CipherPrefSetDefault(ssl3CipherSuite which, PRBool on);
 extern SECStatus ssl3_CipherPrefGetDefault(ssl3CipherSuite which, PRBool *on);
 extern SECStatus ssl2_CipherPrefSetDefault(PRInt32 which, PRBool enabled);
 extern SECStatus ssl2_CipherPrefGetDefault(PRInt32 which, PRBool *enabled);
 
 extern SECStatus ssl3_CipherPrefSet(sslSocket *ss, ssl3CipherSuite which, PRBool on);
 extern SECStatus ssl3_CipherPrefGet(sslSocket *ss, ssl3CipherSuite which, PRBool *on);
 extern SECStatus ssl2_CipherPrefSet(sslSocket *ss, PRInt32 which, PRBool enabled);
 extern SECStatus ssl2_CipherPrefGet(sslSocket *ss, PRInt32 which, PRBool *enabled);
 
 extern SECStatus ssl3_SetPolicy(ssl3CipherSuite which, PRInt32 policy);
 extern SECStatus ssl3_GetPolicy(ssl3CipherSuite which, PRInt32 *policy);
 extern SECStatus ssl2_SetPolicy(PRInt32 which, PRInt32 policy);
 extern SECStatus ssl2_GetPolicy(PRInt32 which, PRInt32 *policy);
 
 extern void      ssl2_InitSocketPolicy(sslSocket *ss);
 extern void      ssl3_InitSocketPolicy(sslSocket *ss);
 
 extern SECStatus ssl3_ConstructV2CipherSpecsHack(sslSocket *ss,
                                                  unsigned char *cs, int *size);
-extern void ssl3_DestroyCipherSpec(ssl3CipherSpec* spec, PRBool freeSrvName);
 
 extern SECStatus ssl3_RedoHandshake(sslSocket *ss, PRBool flushCache);
 
 extern void ssl3_DestroySSL3Info(sslSocket *ss);
 
 extern SECStatus ssl3_NegotiateVersion(sslSocket *ss, 
                                        SSL3ProtocolVersion peerVersion);
 
 extern SECStatus ssl_GetPeerInfo(sslSocket *ss);
 
@@ skipping 29 matching lines @@
 extern SECStatus ssl3_ConsumeHandshakeVariable(sslSocket *ss, SECItem *i, 
                         PRInt32 bytes, SSL3Opaque **b, PRUint32 *length);
 extern SECStatus ssl3_SignHashes(SSL3Hashes *hash, SECKEYPrivateKey *key, 
                         SECItem *buf, PRBool isTLS);
 extern SECStatus ssl3_VerifySignedHashes(SSL3Hashes *hash, 
                         CERTCertificate *cert, SECItem *buf, PRBool isTLS, 
                         void *pwArg);
 extern SECStatus ssl3_CacheWrappedMasterSecret(sslSocket *ss,
                         sslSessionID *sid, ssl3CipherSpec *spec,
                         SSL3KEAType effectiveExchKeyType);
-extern void ssl3_CleanupPredictedPeerCertificates(sslSocket *ss);
-extern const ssl3CipherSuiteDef* ssl_LookupCipherSuiteDef(ssl3CipherSuite suite);
-extern SECStatus ssl3_SetupPendingCipherSpec(sslSocket *ss);
-extern SECStatus ssl3_SendClientKeyExchange(sslSocket *ss);
-extern SECStatus ssl3_SendNextProto(sslSocket *ss);
-extern SECStatus ssl3_SendFinished(sslSocket *ss, PRInt32 flags);
-extern SECStatus ssl3_CompressMACEncryptRecord
-        (sslSocket *        ss,
-         SSL3ContentType    type,
-         const SSL3Opaque * pIn,
-         PRUint32           contentLen);
-extern PRBool ssl3_ClientExtensionAdvertised(sslSocket *ss, PRUint16 ex_type);
-extern SECStatus ssl3_SetupMasterSecretFromSessionID(sslSocket* ss);
-extern SECStatus ssl3_ComputeHandshakeHashes(
-        sslSocket *     ss,
-        ssl3CipherSpec *spec,   /* uses ->master_secret */
-        SSL3Hashes *    hashes, /* output goes here. */
-        PRUint32        sender);
-extern SECStatus ssl3_UpdateHandshakeHashes(sslSocket* ss, unsigned char *b,
-                                            unsigned int l);
-extern SECStatus ssl3_ComputeTLSFinished(
-        ssl3CipherSpec *spec,
-        PRBool          isServer,
-        const   SSL3Finished *  hashes,
-        TLSFinished  *  tlsFinished);
 
 /* Functions that handle ClientHello and ServerHello extensions. */
 extern SECStatus ssl3_HandleServerNameXtn(sslSocket * ss,
                         PRUint16 ex_type, SECItem *data);
 extern SECStatus ssl3_HandleSupportedCurvesXtn(sslSocket * ss,
                         PRUint16 ex_type, SECItem *data);
 extern SECStatus ssl3_HandleSupportedPointFormatsXtn(sslSocket * ss,
                         PRUint16 ex_type, SECItem *data);
 extern SECStatus ssl3_ClientHandleSessionTicketXtn(sslSocket *ss,
                         PRUint16 ex_type, SECItem *data);
@@ skipping 13 matching lines @@
 extern PRInt32 ssl3_SendSessionTicketXtn(sslSocket *ss, PRBool append,
                         PRUint32 maxBytes);
 extern PRInt32 ssl3_ClientSendStatusRequestXtn(sslSocket *ss, PRBool append,
                         PRUint32 maxBytes);
 
 /* ClientHello and ServerHello extension senders.
  * The code is in ssl3ext.c.
  */
 extern PRInt32 ssl3_SendServerNameXtn(sslSocket *ss, PRBool append,
                      PRUint32 maxBytes);
-extern PRInt32 ssl3_SendSnapStartXtn(sslSocket *ss, PRBool append,
-                     PRUint32 maxBytes);
-extern SECStatus ssl3_ClientHandleSnapStartXtn(sslSocket *ss, PRUint16 ex_type,
-                     SECItem *data);
-
-extern SECStatus ssl3_ResetForSnapStartRecovery(sslSocket *ss,
-                      SSL3Opaque *b, PRUint32 length);
 
 /* Assigns new cert, cert chain and keys to ss->serverCerts
  * struct. If certChain is NULL, tries to find one. Aborts if
  * fails to do so. If cert and keyPair are NULL - unconfigures
  * sslSocket of kea type.*/
 extern SECStatus ssl_ConfigSecureServer(sslSocket *ss, CERTCertificate *cert,
                                         CERTCertificateList *certChain,
                                         ssl3KeyPair *keyPair, SSLKEAType kea);
 /* Return key type for the cert */
 extern SSLKEAType ssl_FindCertKEAType(CERTCertificate * cert);
@@ skipping 103 matching lines @@
 extern int ssl_MapLowLevelError(int hiLevelError);
 
 extern PRUint32 ssl_Time(void);
 
 extern void SSL_AtomicIncrementLong(long * x);
 
 SECStatus SSL_DisableDefaultExportCipherSuites(void);
 SECStatus SSL_DisableExportCipherSuites(PRFileDesc * fd);
 PRBool    SSL_IsExportCipherSuite(PRUint16 cipherSuite);
 
-/********************** FNV hash  *********************/
-
-void FNV1A64_Init(PRUint64 *digest);
-void FNV1A64_Update(PRUint64 *digest, const unsigned char *data,
-                    unsigned int length);
-void FNV1A64_Final(PRUint64 *digest);
 
 #ifdef TRACE
 #define SSL_TRACE(msg) ssl_Trace msg
 #else
 #define SSL_TRACE(msg)
 #endif
 
 void ssl_Trace(const char *format, ...);
 
 SEC_END_PROTOS
 
 #if defined(XP_UNIX) || defined(XP_OS2) || defined(XP_BEOS)
 #define SSL_GETPID getpid
 #elif defined(_WIN32_WCE)
 #define SSL_GETPID GetCurrentProcessId
 #elif defined(WIN32)
 extern int __cdecl _getpid(void);
 #define SSL_GETPID _getpid
 #else
 #define SSL_GETPID() 0
 #endif
 
 #endif /* __sslimpl_h_ */