net: allow SSL secrets to be exported sooner.

net: allow SSL secrets to be exported sooner.

This also addresses some follows up from previous CLs.

BUG=none
TEST=none


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=94105

[wtc, 2011-07-25 17:31:12]

LGTM.

http://codereview.chromium.org/7493056/diff/1/net/third_party/nss/ssl/ssl.h
File net/third_party/nss/ssl/ssl.h (right):

http://codereview.chromium.org/7493056/diff/1/net/third_party/nss/ssl/ssl.h#n...
net/third_party/nss/ssl/ssl.h:700: unsigned int outlen);
Please also rename this argument "outLen", with a capital 'L'.

http://codereview.chromium.org/7493056/diff/1/net/third_party/nss/ssl/sslinfo.c
File net/third_party/nss/ssl/sslinfo.c (right):

http://codereview.chromium.org/7493056/diff/1/net/third_party/nss/ssl/sslinfo...
net/third_party/nss/ssl/sslinfo.c:370: if (ss->ssl3.cwSpec->master_secret ==
NULL) {
I'd like to doublecheck this ss->ssl3.cwSpec->master_secret
test later, but it seems correct to me.

[wtc, 2011-07-25 18:51:22]

I suggest an improved test for the presence of the master
secret below.  Since Chrome doesn't enable the "bypass PKCS #11"
mode, what you have is good enough.  But we need an improved
test for the NSS upstream.

http://codereview.chromium.org/7493056/diff/1/net/third_party/nss/ssl/sslinfo.c
File net/third_party/nss/ssl/sslinfo.c (right):

http://codereview.chromium.org/7493056/diff/1/net/third_party/nss/ssl/sslinfo...
net/third_party/nss/ssl/sslinfo.c:370: if (ss->ssl3.cwSpec->master_secret ==
NULL) {
I checked this test again.  There are two possible solutions
to this problem.

1. Come up with a conditional expression for the state that
the SSL handshake has completed.  This is the approach taken
by the original code.

2. Come up with a conditional expression for the presence of
master secret.  This is the approach the CL is taking.

Solution #2 is a fine idea because the conditional
expression in solution 1 may be complicated.

In solution #2, we also need to handle the "bypass PKCS #11"
mode, which uses not ss->ssl3.cwSpec->master_secret but
rather ss->ssl3.cwSpec->msItem.  This code should give you
an idea how to test if the master secret is present, in
both the regular mode and the "bypass PKCS #11" mode:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl3...

I think a simple test like
    !ss->ssl3.cwSpec->master_secret && !ss->ssl3.cwSpec->msItem.len
should suffice:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl3...

[agl, 2011-07-26 13:50:04]

Thanks. Flipping the commit bit.

http://codereview.chromium.org/7493056/diff/1/net/third_party/nss/ssl/ssl.h
File net/third_party/nss/ssl/ssl.h (right):

http://codereview.chromium.org/7493056/diff/1/net/third_party/nss/ssl/ssl.h#n...
net/third_party/nss/ssl/ssl.h:700: unsigned int outlen);
On 2011/07/25 17:31:13, wtc wrote:
> Please also rename this argument "outLen", with a capital 'L'.

Done.

http://codereview.chromium.org/7493056/diff/1/net/third_party/nss/ssl/sslinfo.c
File net/third_party/nss/ssl/sslinfo.c (right):

http://codereview.chromium.org/7493056/diff/1/net/third_party/nss/ssl/sslinfo...
net/third_party/nss/ssl/sslinfo.c:370: if (ss->ssl3.cwSpec->master_secret ==
NULL) {
On 2011/07/25 18:51:22, wtc wrote:
> I checked this test again.  There are two possible solutions
> to this problem.
> 
> 1. Come up with a conditional expression for the state that
> the SSL handshake has completed.  This is the approach taken
> by the original code.
> 
> 2. Come up with a conditional expression for the presence of
> master secret.  This is the approach the CL is taking.
> 
> Solution #2 is a fine idea because the conditional
> expression in solution 1 may be complicated.
> 
> In solution #2, we also need to handle the "bypass PKCS #11"
> mode, which uses not ss->ssl3.cwSpec->master_secret but
> rather ss->ssl3.cwSpec->msItem.  This code should give you
> an idea how to test if the master secret is present, in
> both the regular mode and the "bypass PKCS #11" mode:
> 
>
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl3...
> 
> I think a simple test like
>     !ss->ssl3.cwSpec->master_secret && !ss->ssl3.cwSpec->msItem.len
> should suffice:
>
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl3...

Done.

[commit-bot: I haz the power, 2011-07-26 16:04:21]

Change committed as 94105