net/third_party/nss/README.chromium - Issue 7239002: net: Precede each CBC encrypted application data record with an empty one.

Side by Side Diff: net/third_party/nss/README.chromium

Issue 7239002: net: Precede each CBC encrypted application data record with an empty one. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src

Patch Set: Created 9 years, 6 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

OLD	NEW
1 Name: Network Security Services (NSS)	1 Name: Network Security Services (NSS)

2 URL: http://www.mozilla.org/projects/security/pki/nss/	2 URL: http://www.mozilla.org/projects/security/pki/nss/

3	3

4 This directory includes a copy of NSS's libssl from the CVS repo at:	4 This directory includes a copy of NSS's libssl from the CVS repo at:

5 :pserver:anonymous@cvs-mirror.mozilla.org:/cvsroot	5 :pserver:anonymous@cvs-mirror.mozilla.org:/cvsroot

6	6

7 The snapshot was updated to the CVS tag: NSS_3_12_9_RTM	7 The snapshot was updated to the CVS tag: NSS_3_12_9_RTM

8	8

9 Patches:	9 Patches:

10	10

(...skipping 25 matching lines...) Expand all Loading...
36 * Add support for client auth with native crypto APIs on Mac and Windows	36 * Add support for client auth with native crypto APIs on Mac and Windows

37 patches/clientauth.patch	37 patches/clientauth.patch

38 ssl/sslplatf.c	38 ssl/sslplatf.c

39	39

40 * Don't send a client certificate when renegotiating if the peer does not	40 * Don't send a client certificate when renegotiating if the peer does not

41 request one. This only happened if the previous key exchange algorithm	41 request one. This only happened if the previous key exchange algorithm

42 was non-RSA.	42 was non-RSA.

43 patches/clientauth.patch	43 patches/clientauth.patch

44 https://bugzilla.mozilla.org/show_bug.cgi?id=616757	44 https://bugzilla.mozilla.org/show_bug.cgi?id=616757

45	45

	46 * Preceed each CBC encrypted application data record with an empty
	wtc 2011/06/23 23:58:33 Typo: Preceed => Precede IMPORTANT: the patch doe Typo: Preceed => Precede IMPORTANT: the patch does not do exactly what you described here. The patch adds an empty application data record for each call to ssl3_SendApplicationData, which may send multiple application data records if the data length is greater than MAX_FRAGMENT_LENGTH. I believe what the patch does is good enough, and we should simply change the description here to match the code. agl 2011/06/24 18:50:18 Done. Show quoted text On 2011/06/23 23:58:33, wtc wrote: > Typo: Preceed => Precede > > IMPORTANT: the patch does not do exactly what you described > here. The patch adds an empty application data record for > each call to ssl3_SendApplicationData, which may send > multiple application data records if the data length is > greater than MAX_FRAGMENT_LENGTH. > > I believe what the patch does is good enough, and we > should simply change the description here to match the code. Done.
	47 application data record in order to randomize the IV in a backwards

	48 compatible manner.

	49 patches/cbcrandomiv.patch

	50

46 Apply the patches to NSS by running the patches/applypatches.sh script. Read	51 Apply the patches to NSS by running the patches/applypatches.sh script. Read

47 the comments at the top of patches/applypatches.sh for instructions.	52 the comments at the top of patches/applypatches.sh for instructions.

48	53

49 The ssl/bodge directory contains files taken from the NSS repo that we required	54 The ssl/bodge directory contains files taken from the NSS repo that we required

50 for building libssl outside of its usual build environment.	55 for building libssl outside of its usual build environment.

OLD	NEW

« no previous file with comments | « no previous file | net/third_party/nss/patches/applypatches.sh » ('j') | net/third_party/nss/ssl/ssl3con.c » ('J')