net: fix caching of peer's cert chain in session objects.

net/third_party/nss/patches/cachedinfo.patch

-commit 070963bde0a9c474733f19fbd525ff14e3f15803
+commit b84efe75d31ad7e16bf8e97845d264a0f5994a3f
 Author: Adam Langley <agl@chromium.org>
 Date:   Fri Jun 24 13:10:38 2011 -0400
 
     cachedinfo.patch
 
 diff --git a/mozilla/security/nss/lib/ssl/fnv1a64.c b/mozilla/security/nss/lib/ssl/fnv1a64.c
 new file mode 100644
 index 0000000..c7c4b08
 --- /dev/null
 +++ b/mozilla/security/nss/lib/ssl/fnv1a64.c
@@ skipping 134 matching lines @@
 + */
 + SSL_IMPORT SECStatus SSL_SetPredictedPeerCertificates(
 +         PRFileDesc *fd, CERTCertificate **certs,
 +         unsigned int numCerts);
 +
 +/*
  ** Configure SSL socket for running a secure server. Needs the
  ** certificate for the server and the servers private key. The arguments
  ** are copied.
 diff --git a/mozilla/security/nss/lib/ssl/ssl3con.c b/mozilla/security/nss/lib/ssl/ssl3con.c
-index 0997e18..f7064ef 100644
+index 0997e18..068f021 100644
 --- a/mozilla/security/nss/lib/ssl/ssl3con.c
 +++ b/mozilla/security/nss/lib/ssl/ssl3con.c
 @@ -5170,7 +5170,6 @@ ssl3_HandleServerHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
             ssl3_CopyPeerCertsFromSID(ss, sid);
         }
  
 -
         /* NULL value for PMS signifies re-use of the old MS */
         rv = ssl3_InitPendingCipherSpec(ss,  NULL);
         if (rv != SECSuccess) {
@@ skipping 232 matching lines @@
  
 @@ -8108,8 +8208,6 @@ ssl3_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
                 /* someone will handle this connection asynchronously*/
                 SSL_DBG(("%d: SSL3[%d]: go to async cert handler",
                          SSL_GETPID(), ss->fd));
 -               ss->ssl3.peerCertChain = certs;
 -               certs               = NULL;
                 ssl_SetAlwaysBlock(ss);
                 goto cert_block;
             }
+@@ -8134,7 +8232,7 @@ ssl3_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+     }
+ 
+     ss->sec.ci.sid->peerCert = CERT_DupCertificate(ss->sec.peerCert);
+-    ssl3_CopyPeerCertsToSID(certs, ss->sec.ci.sid);
++    ssl3_CopyPeerCertsToSID(ss->ssl3.peerCertChain, ss->sec.ci.sid);
+ 
+     if (!ss->sec.isServer) {
+        /* set the server authentication and key exchange types and sizes
 @@ -8179,8 +8277,6 @@ ssl3_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
         }
      }
  
 -    ss->ssl3.peerCertChain = certs;  certs = NULL;  arena = NULL;
 -
  cert_block:
      if (ss->sec.isServer) {
         ss->ssl3.hs.ws = wait_client_key;
 @@ -8250,7 +8346,10 @@ alert_loser:
@@ skipping 526 matching lines @@
      ssl_session_ticket_xtn           = 35,
      ssl_next_proto_neg_xtn           = 13172,
 +    ssl_cached_info_xtn              = 13173,
      ssl_renegotiation_info_xtn       = 0xff01  /* experimental number */
  } SSLExtensionType;
  
 -#define SSL_MAX_EXTENSIONS             7
 +#define SSL_MAX_EXTENSIONS             8
  
  #endif /* __sslt_h_ */