net: allow SSL secrets to be exported sooner.

net/third_party/nss/ssl/sslinfo.c

Index: net/third_party/nss/ssl/sslinfo.c
diff --git a/net/third_party/nss/ssl/sslinfo.c b/net/third_party/nss/ssl/sslinfo.c
index 9a58b4d3b9174443c01b2845c49b2ddfbb54e43d..a707395ec48f6a4267964dfaa1a2da8aac52e583 100644
--- a/net/third_party/nss/ssl/sslinfo.c
+++ b/net/third_party/nss/ssl/sslinfo.c
@@ -39,7 +39,6 @@
 #include "ssl.h"
 #include "sslimpl.h"
 #include "sslproto.h"
-#include "pk11func.h"
 
 static const char *
 ssl_GetCompressionMethodName(SSLCompressionMethod compression)
@@ -318,12 +317,14 @@ SSL_IsExportCipherSuite(PRUint16 cipherSuite)
     return PR_FALSE;
 }
 
-/* Export keying material according to draft-ietf-tls-extractor-06.
+/* Export keying material according to RFC 5705.
 ** fd must correspond to a TLS 1.0 or higher socket, out must
 ** be already allocated.
 */
 SECStatus
-SSL_ExportKeyingMaterial(PRFileDesc *fd, const char *label,
+SSL_ExportKeyingMaterial(PRFileDesc *fd,
+			 const char *label,
+			 unsigned int labelLen,
 			 const unsigned char *context,
 			 unsigned int contextLen,
 			 unsigned char *out,
@@ -346,11 +347,6 @@ SSL_ExportKeyingMaterial(PRFileDesc *fd, const char *label,
 	return SECFailure;
     }
 
-    if (ss->ssl3.hs.ws != idle_handshake) {
-	PORT_SetError(SSL_ERROR_HANDSHAKE_NOT_COMPLETED);
-	return SECFailure;
-    }
-
     valLen = SSL3_RANDOM_LENGTH * 2;
     if (contextLen > 0)
 	valLen += 2 /* uint16 length */ + contextLen;
@@ -371,11 +367,16 @@ SSL_ExportKeyingMaterial(PRFileDesc *fd, const char *label,
     PORT_Assert(i == valLen);
 
     ssl_GetSpecReadLock(ss);
-    rv = ssl3_TLSPRFWithMasterSecret(ss->ssl3.crSpec, label, strlen(label), val, valLen, out, outLen);
+    if (ss->ssl3.cwSpec->master_secret == NULL) {

[wtc, 2011/07/25 17:31:13]

I'd like to doublecheck this ss->ssl3.cwSpec->master_secret
test later, but it seems correct to me.

[wtc, 2011/07/25 18:51:22]

I checked this test again.  There are two possible solutions
to this problem.

1. Come up with a conditional expression for the state that
the SSL handshake has completed.  This is the approach taken
by the original code.

2. Come up with a conditional expression for the presence of
master secret.  This is the approach the CL is taking.

Solution #2 is a fine idea because the conditional
expression in solution 1 may be complicated.

In solution #2, we also need to handle the "bypass PKCS #11"
mode, which uses not ss->ssl3.cwSpec->master_secret but
rather ss->ssl3.cwSpec->msItem.  This code should give you
an idea how to test if the master secret is present, in
both the regular mode and the "bypass PKCS #11" mode:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl3...

I think a simple test like
    !ss->ssl3.cwSpec->master_secret && !ss->ssl3.cwSpec->msItem.len
should suffice:
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl3...

[agl, 2011/07/26 13:50:04]

Done.

+	PORT_SetError(SSL_ERROR_HANDSHAKE_NOT_COMPLETED);
+	rv = SECFailure;
+    } else {
+	rv = ssl3_TLSPRFWithMasterSecret(ss->ssl3.cwSpec, label, labelLen, val,
+					 valLen, out, outLen);
+    }
     ssl_ReleaseSpecReadLock(ss);
 
-    if (val != NULL)
-	PORT_ZFree(val, valLen);
+    PORT_ZFree(val, valLen);
     return rv;
 }