net: add missing return value in SSL_SetNextProtoCallback

net/third_party/nss/patches/nextproto.patch

-From 3759b424e3347153e8c9011d9f462f9a351120bb Mon Sep 17 00:00:00 2001
+From 0c2f72b38711abdd4ada08ae8d7e96dce79a672b Mon Sep 17 00:00:00 2001
 From: Adam Langley <agl@chromium.org>
 Date: Mon, 3 Oct 2011 12:19:28 -0400
 Subject: [PATCH 01/15] nextproto.patch
 
 ---
  mozilla/security/nss/lib/ssl/ssl.def    |    8 ++
  mozilla/security/nss/lib/ssl/ssl.h      |   51 ++++++++++++
- mozilla/security/nss/lib/ssl/ssl3con.c  |   54 +++++++++++++
+ mozilla/security/nss/lib/ssl/ssl3con.c  |   58 +++++++++++++
  mozilla/security/nss/lib/ssl/ssl3ext.c  |  104 ++++++++++++++++++++++++-
  mozilla/security/nss/lib/ssl/ssl3prot.h |    3 +-
  mozilla/security/nss/lib/ssl/sslerr.h   |    2 +
  mozilla/security/nss/lib/ssl/sslimpl.h  |   21 +++++
- mozilla/security/nss/lib/ssl/sslsock.c  |  131 +++++++++++++++++++++++++++++++
+ mozilla/security/nss/lib/ssl/sslsock.c  |  134 +++++++++++++++++++++++++++++++
  mozilla/security/nss/lib/ssl/sslt.h     |    3 +-
- 9 files changed, 374 insertions(+), 3 deletions(-)
+ 9 files changed, 381 insertions(+), 3 deletions(-)
 
 diff --git a/mozilla/security/nss/lib/ssl/ssl.def b/mozilla/security/nss/lib/ssl/ssl.def
 index d3f455c..6ea48c0 100644
 --- a/mozilla/security/nss/lib/ssl/ssl.def
 +++ b/mozilla/security/nss/lib/ssl/ssl.def
 @@ -152,3 +152,11 @@ SSL_SNISocketConfigHook;
  ;+    local:
  ;+*;
  ;+};
 +;+NSS_CHROMIUM {
@@ skipping 60 matching lines @@
 +
 +/* TODO(wtc): it may be a good idea to define these as an enum type. */
 +#define SSL_NEXT_PROTO_NO_SUPPORT      0 /* No peer support                */
 +#define SSL_NEXT_PROTO_NEGOTIATED      1 /* Mutual agreement               */
 +#define SSL_NEXT_PROTO_NO_OVERLAP      2 /* No protocol overlap found      */
 +
  /*
  ** Control ciphers that SSL uses. If on is non-zero then the named cipher
  ** is enabled, otherwise it is disabled. 
 diff --git a/mozilla/security/nss/lib/ssl/ssl3con.c b/mozilla/security/nss/lib/ssl/ssl3con.c
-index 8048913..8f860a9 100644
+index 8048913..d2d4f91 100644
 --- a/mozilla/security/nss/lib/ssl/ssl3con.c
 +++ b/mozilla/security/nss/lib/ssl/ssl3con.c
 @@ -81,6 +81,7 @@ static SECStatus ssl3_InitState(             sslSocket *ss);
  static SECStatus ssl3_SendCertificate(       sslSocket *ss);
  static SECStatus ssl3_SendEmptyCertificate(  sslSocket *ss);
  static SECStatus ssl3_SendCertificateRequest(sslSocket *ss);
 +static SECStatus ssl3_SendNextProto(         sslSocket *ss);
  static SECStatus ssl3_SendFinished(          sslSocket *ss, PRInt32 flags);
  static SECStatus ssl3_SendServerHello(       sslSocket *ss);
  static SECStatus ssl3_SendServerHelloDone(   sslSocket *ss);
-@@ -5742,6 +5743,12 @@ ssl3_HandleServerHelloDone(sslSocket *ss)
+@@ -5742,6 +5743,16 @@ ssl3_HandleServerHelloDone(sslSocket *ss)
      if (rv != SECSuccess) {
         goto loser;     /* err code was set. */
      }
 +
-+    rv = ssl3_SendNextProto(ss);
-+    if (rv != SECSuccess) {
-+       goto loser;     /* err code was set. */
++    /* We don't send NPN in a renegotiation as it's explicitly disallowed by
++     * the spec. */
++    if (!ss->firstHsDone) {
++       rv = ssl3_SendNextProto(ss);
++       if (rv != SECSuccess) {
++           goto loser; /* err code was set. */
++       }
 +    }
 +
      rv = ssl3_SendFinished(ss, 0);
      if (rv != SECSuccess) {
         goto loser;     /* err code was set. */
-@@ -8169,6 +8176,40 @@ ssl3_ComputeTLSFinished(ssl3CipherSpec *spec,
+@@ -8169,6 +8180,40 @@ ssl3_ComputeTLSFinished(ssl3CipherSpec *spec,
  }
  
  /* called from ssl3_HandleServerHelloDone
 + */
 +static SECStatus
 +ssl3_SendNextProto(sslSocket *ss)
 +{
 +    SECStatus rv;
 +    int padding_len;
 +    static const unsigned char padding[32] = {0};
@@ skipping 20 matching lines @@
 +    if (rv != SECSuccess) {
 +       return rv;      /* error code set by AppendHandshake */
 +    }
 +    return rv;
 +}
 +
 +/* called from ssl3_HandleServerHelloDone
   *             ssl3_HandleClientHello
   *             ssl3_HandleFinished
   */
-@@ -8421,6 +8462,14 @@ ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+@@ -8421,6 +8466,14 @@ ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
         if (doStepUp || ss->writerThread == PR_GetCurrentThread()) {
             flags = ssl_SEND_FLAG_FORCE_INTO_BUFFER;
         }
 +
-+       if (!isServer) {
++       if (!isServer && !ss->firstHsDone) {
 +           rv = ssl3_SendNextProto(ss);
 +           if (rv != SECSuccess) {
 +               goto xmit_loser;        /* err code was set. */
 +           }
 +       }
 +
         rv = ssl3_SendFinished(ss, flags);
         if (rv != SECSuccess) {
             goto xmit_loser;    /* err is set. */
-@@ -9488,6 +9537,11 @@ ssl3_DestroySSL3Info(sslSocket *ss)
+@@ -9488,6 +9541,11 @@ ssl3_DestroySSL3Info(sslSocket *ss)
      ssl3_DestroyCipherSpec(&ss->ssl3.specs[1], PR_TRUE/*freeSrvName*/);
  
      ss->ssl3.initialized = PR_FALSE;
 +
 +    if (ss->ssl3.nextProto.data) {
 +       PORT_Free(ss->ssl3.nextProto.data);
 +       ss->ssl3.nextProto.data = NULL;
 +    }
  }
  
@@ skipping 217 matching lines @@
                         PRBool append, PRUint32 maxBytes);
  #endif
 +extern PRInt32 ssl3_ClientSendNextProtoNegoXtn(sslSocket *ss, PRBool append,
 +                                              PRUint32 maxBytes);
 +extern SECStatus ssl3_ValidateNextProtoNego(const unsigned char* data,
 +                                           unsigned short length);
  
  /* call the registered extension handlers. */
  extern SECStatus ssl3_HandleHelloExtensions(sslSocket *ss, 
 diff --git a/mozilla/security/nss/lib/ssl/sslsock.c b/mozilla/security/nss/lib/ssl/sslsock.c
-index bc770a1..769ea0a 100644
+index bc770a1..829103b 100644
 --- a/mozilla/security/nss/lib/ssl/sslsock.c
 +++ b/mozilla/security/nss/lib/ssl/sslsock.c
 @@ -163,6 +163,7 @@ static const sslSocketOps ssl_secure_ops = {        /* SSL. */
  ** default settings for socket enables
  */
  static sslOptions ssl_defaults = {
 +    { siBuffer, NULL, 0 },     /* nextProtoNego */
      PR_TRUE,   /* useSecurity        */
      PR_FALSE,  /* useSocks           */
      PR_FALSE,  /* requestCertificate */
 @@ -438,6 +439,10 @@ ssl_DestroySocketContents(sslSocket *ss)
         ssl3_FreeKeyPair(ss->ephemeralECDHKeyPair);
         ss->ephemeralECDHKeyPair = NULL;
      }
 +    if (ss->opt.nextProtoNego.data) {
 +       PORT_Free(ss->opt.nextProtoNego.data);
 +       ss->opt.nextProtoNego.data = NULL;
 +    }
      PORT_Assert(!ss->xtnData.sniNameArr);
      if (ss->xtnData.sniNameArr) {
          PORT_Free(ss->xtnData.sniNameArr);
-@@ -1266,6 +1271,132 @@ SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd)
+@@ -1266,6 +1271,135 @@ SSL_ImportFD(PRFileDesc *model, PRFileDesc *fd)
      return fd;
  }
  
 +SECStatus
 +SSL_SetNextProtoCallback(PRFileDesc *fd,
 +                         SSLNextProtoCallback callback,
 +                         void *arg) {
 +    sslSocket *ss = ssl_FindSocket(fd);
 +
 +    if (!ss) {
 +       SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetNextProtoNego", SSL_GETPID(),
 +               fd));
++       PORT_SetError(SEC_ERROR_INVALID_ARGS);
 +       return SECFailure;
 +    }
 +
 +    ssl_GetSSL3HandshakeLock(ss);
 +    ss->nextProtoCallback = callback;
 +    ss->nextProtoArg = arg;
 +    ssl_ReleaseSSL3HandshakeLock(ss);
++    return SECSuccess;
 +}
 +
 +/* NextProtoStandardCallback is set as an NPN callback for the case when the
 + * user of the sockets wants the standard selection algorithm. */
 +static SECStatus
 +NextProtoStandardCallback(void *arg,
 +                         PRFileDesc *fd,
 +                         const unsigned char *protos,
 +                         unsigned int protos_len,
 +                         unsigned char *protoOut,
@@ skipping 41 matching lines @@
 +SSL_SetNextProtoNego(PRFileDesc *fd, const unsigned char *data,
 +                    unsigned int length)
 +{
 +    SECStatus rv;
 +
 +    sslSocket *ss = ssl_FindSocket(fd);
 +
 +    if (!ss) {
 +       SSL_DBG(("%d: SSL[%d]: bad socket in SSL_SetNextProtoNego",
 +                SSL_GETPID(), fd));
++       PORT_SetError(SEC_ERROR_INVALID_ARGS);
 +       return SECFailure;
 +    }
 +
 +    if (ssl3_ValidateNextProtoNego(data, length) != SECSuccess)
 +       return SECFailure;
 +
 +    ssl_GetSSL3HandshakeLock(ss);
 +    if (ss->opt.nextProtoNego.data)
 +       PORT_Free(ss->opt.nextProtoNego.data);
 +    ss->opt.nextProtoNego.data = PORT_Alloc(length);
@@ skipping 48 matching lines @@
  #endif
      ssl_session_ticket_xtn           = 35,
 +    ssl_next_proto_neg_xtn           = 13172,
      ssl_renegotiation_info_xtn       = 0xff01  /* experimental number */
  } SSLExtensionType;
  
 -#define SSL_MAX_EXTENSIONS             5
 +#define SSL_MAX_EXTENSIONS             6
  
  #endif /* __sslt_h_ */