Update net/third_party/nss to NSS 3.13.3.

net/third_party/nss/ssl/ssl3con.c

 /*
  * SSL3 Protocol
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 21 matching lines @@
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-/* $Id: ssl3con.c,v 1.142.2.4 2010/09/01 19:47:11 wtc%google.com Exp $ */
+/* $Id: ssl3con.c,v 1.164 2012/02/17 09:50:04 kaie%kuix.de Exp $ */
 
 #include "cert.h"
 #include "ssl.h"
 #include "cryptohi.h"   /* for DSAU_ stuff */
 #include "keyhi.h"
 #include "secder.h"
 #include "secitem.h"
 
 #include "sslimpl.h"
 #include "sslproto.h"
@@ skipping 28 matching lines @@
 static SECStatus ssl3_InitState(             sslSocket *ss);
 static SECStatus ssl3_SendCertificate(       sslSocket *ss);
 static SECStatus ssl3_SendEmptyCertificate(  sslSocket *ss);
 static SECStatus ssl3_SendCertificateRequest(sslSocket *ss);
 static SECStatus ssl3_SendNextProto(         sslSocket *ss);
 static SECStatus ssl3_SendFinished(          sslSocket *ss, PRInt32 flags);
 static SECStatus ssl3_SendServerHello(       sslSocket *ss);
 static SECStatus ssl3_SendServerHelloDone(   sslSocket *ss);
 static SECStatus ssl3_SendServerKeyExchange( sslSocket *ss);
 static SECStatus ssl3_NewHandshakeHashes(    sslSocket *ss);
-static SECStatus ssl3_UpdateHandshakeHashes( sslSocket *ss, unsigned char *b, 
+static SECStatus ssl3_UpdateHandshakeHashes( sslSocket *ss,
+                                             const unsigned char *b,
                                              unsigned int l);
 
 static SECStatus Null_Cipher(void *ctx, unsigned char *output, int *outputLen,
                              int maxOutputLen, const unsigned char *input,
                              int inputLen);
 
 #define MAX_SEND_BUF_LENGTH 32000 /* watch for 16-bit integer overflow */
 #define MIN_SEND_BUF_LENGTH  4000
 
 #define MAX_CIPHER_SUITES 20
@@ skipping 129 matching lines @@
 
 /*
  * make sure there is room in the write buffer for padding and
  * other compression and cryptographic expansions.
  */
 #define SSL3_BUFFER_FUDGE     100 + SSL3_COMPRESSION_MAX_EXPANSION
 
 #define EXPORT_RSA_KEY_LENGTH 64        /* bytes */
 
 
-/* This is a hack to make sure we don't do double handshakes for US policy */
-PRBool ssl3_global_policy_some_restricted = PR_FALSE;
-
 /* This global item is used only in servers.  It is is initialized by
 ** SSL_ConfigSecureServer(), and is used in ssl3_SendCertificateRequest().
 */
 CERTDistNames *ssl3_server_ca_list = NULL;
 static SSL3Statistics ssl3stats;
 
 /* indexed by SSL3BulkCipher */
 static const ssl3BulkCipherDef bulk_cipher_defs[] = {
     /* cipher          calg        keySz secretSz  type  ivSz BlkSz keygen */
     {cipher_null,      calg_null,      0,  0, type_stream,  0, 0, kg_null},
@@ skipping 669 matching lines @@
 #ifdef NSS_ENABLE_ECC
     unsigned int      len;
 #endif /* NSS_ENABLE_ECC */
 
 
     PRINT_BUF(60, (NULL, "check signed hashes",
                   buf->data, buf->len));
 
     key = CERT_ExtractPublicKey(cert);
     if (key == NULL) {
-        /* CERT_ExtractPublicKey doesn't set error code */
-        PORT_SetError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE);
+        ssl_MapLowLevelError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE);
         return SECFailure;
     }
 
     switch (key->keyType) {
     case rsaKey:
         hashItem.data = hash->md5;
         hashItem.len = sizeof(SSL3Hashes);
         break;
     case dsaKey:
         hashItem.data = hash->sha;
@@ skipping 1090 matching lines @@
         sid->u.ssl3.clAuthModuleID   != PK11_GetModuleID(slot)   ||
         (PK11_NeedLogin(slot) && !PK11_IsLoggedIn(slot, NULL))) {
         isPresent = PR_FALSE;
     } 
     if (slot) {
         PK11_FreeSlot(slot);
     }
     return isPresent;
 }
 
-/* Caller must hold the spec read lock. wrBuf is sometimes, but not always,
- * ss->sec.writeBuf.
- */
+/* Caller must hold the spec read lock. */
 static SECStatus
 ssl3_CompressMACEncryptRecord(ssl3CipherSpec *   cwSpec,
                               PRBool             isServer,
                               SSL3ContentType    type,
                               const SSL3Opaque * pIn,
                               PRUint32           contentLen,
                               sslBuffer *        wrBuf)
 {
     const ssl3BulkCipherDef * cipher_def;
     SECStatus                 rv;
@@ skipping 164 matching lines @@
         return SECFailure;
     }
 
     while (nIn > 0) {
         PRUint32  contentLen = PR_MIN(nIn, MAX_FRAGMENT_LENGTH);
         unsigned int spaceNeeded;
         unsigned int numRecords;
 
         ssl_GetSpecReadLock(ss);    /********************************/
 
-        if (nIn > 1 &&
-            ss->opt.enableFalseStart &&
+        if (nIn > 1 && ss->opt.cbcRandomIV &&
             ss->ssl3.cwSpec->version <= SSL_LIBRARY_VERSION_3_1_TLS &&
             type == content_application_data &&
             ss->ssl3.cwSpec->cipher_def->type == type_block /* CBC mode */) {
             /* We will split the first byte of the record into its own record,
              * as explained in the documentation for SSL_CBC_RANDOM_IV in ssl.h
              */
             numRecords = 2;
         } else {
             numRecords = 1;
         }
 
         spaceNeeded = contentLen + (numRecords * SSL3_BUFFER_FUDGE);
         if (spaceNeeded > wrBuf->space) {
             rv = sslBuffer_Grow(wrBuf, spaceNeeded);
             if (rv != SECSuccess) {
                 SSL_DBG(("%d: SSL3[%d]: SendRecord, tried to get %d bytes",
                          SSL_GETPID(), ss->fd, spaceNeeded));
-                goto spec_locked_loser; /* sslBuffer_Grow set a memory error code. */
+                goto spec_locked_loser; /* sslBuffer_Grow set error code. */
             }
         }
 
         if (numRecords == 2) {
             sslBuffer secondRecord;
 
             rv = ssl3_CompressMACEncryptRecord(ss->ssl3.cwSpec,
                                                ss->sec.isServer, type, pIn, 1,
                                                wrBuf);
             if (rv != SECSuccess)
@@ skipping 12 matching lines @@
             if (rv == SECSuccess) {
                 PRINT_BUF(50, (ss, "send (encrypted) record data [2/2]:",
                                secondRecord.buf, secondRecord.len));
                 wrBuf->len += secondRecord.len;
             }
         } else {
             rv = ssl3_CompressMACEncryptRecord(ss->ssl3.cwSpec,
                                                ss->sec.isServer, type, pIn,
                                                contentLen, wrBuf);
             if (rv == SECSuccess) {
-                PRINT_BUF(50, (ss, "send (encrypted) record data [1/1]:",
+                PRINT_BUF(50, (ss, "send (encrypted) record data:",
                                wrBuf->buf, wrBuf->len));
             }
         }
 
 spec_locked_loser:
         ssl_ReleaseSpecReadLock(ss); /************************************/
 
         if (rv != SECSuccess)
             return SECFailure;
 
@@ skipping 315 matching lines @@
  */
 static SECStatus
 ssl3_HandshakeFailure(sslSocket *ss)
 {
     (void)SSL3_SendAlert(ss, alert_fatal, handshake_failure);
     PORT_SetError( ss->sec.isServer ? SSL_ERROR_BAD_CLIENT
                                     : SSL_ERROR_BAD_SERVER );
     return SECFailure;
 }
 
+static void
+ssl3_SendAlertForCertError(sslSocket * ss, PRErrorCode errCode)
+{
+    SSL3AlertDescription desc   = bad_certificate;
+    PRBool isTLS = ss->version >= SSL_LIBRARY_VERSION_3_1_TLS;
+
+    switch (errCode) {
+    case SEC_ERROR_LIBRARY_FAILURE:     desc = unsupported_certificate; break;
+    case SEC_ERROR_EXPIRED_CERTIFICATE: desc = certificate_expired;     break;
+    case SEC_ERROR_REVOKED_CERTIFICATE: desc = certificate_revoked;     break;
+    case SEC_ERROR_INADEQUATE_KEY_USAGE:
+    case SEC_ERROR_INADEQUATE_CERT_TYPE:
+                                        desc = certificate_unknown;     break;
+    case SEC_ERROR_UNTRUSTED_CERT:
+                    desc = isTLS ? access_denied : certificate_unknown; break;
+    case SEC_ERROR_UNKNOWN_ISSUER:      
+    case SEC_ERROR_UNTRUSTED_ISSUER:    
+                    desc = isTLS ? unknown_ca : certificate_unknown; break;
+    case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE:
+                    desc = isTLS ? unknown_ca : certificate_expired; break;
+
+    case SEC_ERROR_CERT_NOT_IN_NAME_SPACE:
+    case SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID:
+    case SEC_ERROR_CA_CERT_INVALID:
+    case SEC_ERROR_BAD_SIGNATURE:
+    default:                            desc = bad_certificate;     break;
+    }
+    SSL_DBG(("%d: SSL3[%d]: peer certificate is no good: error=%d",
+             SSL_GETPID(), ss->fd, errCode));
+
+    (void) SSL3_SendAlert(ss, alert_fatal, desc);
+}
+
+
 /*
  * Send handshake_Failure alert.  Set generic error number.
  */
 static SECStatus
 ssl3_DecodeError(sslSocket *ss)
 {
     (void)SSL3_SendAlert(ss, alert_fatal, 
                   ss->version > SSL_LIBRARY_VERSION_3_0 ? decode_error 
                                                         : illegal_parameter);
     PORT_SetError( ss->sec.isServer ? SSL_ERROR_BAD_CLIENT
@@ skipping 596 matching lines @@
 /*
  * Handshake messages
  */
 /* Called from  ssl3_AppendHandshake()
 **              ssl3_StartHandshakeHash()
 **              ssl3_HandleV2ClientHello()
 **              ssl3_HandleHandshakeMessage()
 ** Caller must hold the ssl3Handshake lock.
 */
 static SECStatus
-ssl3_UpdateHandshakeHashes(sslSocket *ss, unsigned char *b, unsigned int l)
+ssl3_UpdateHandshakeHashes(sslSocket *ss, const unsigned char *b,
+                           unsigned int l)
 {
     SECStatus  rv = SECSuccess;
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
 
     PRINT_BUF(90, (NULL, "MD5 & SHA handshake hash input:", b, l));
 
     if (ss->opt.bypassPKCS11) {
         MD5_Update((MD5Context *)ss->ssl3.hs.md5_cx, b, l);
         SHA1_Update((SHA1Context *)ss->ssl3.hs.sha_cx, b, l);
@@ skipping 519 matching lines @@
     ssl_ReleaseSSL3HandshakeLock(ss);  /**************************************/
     return rv;
 }
 
 /**************************************************************************
  * end of Handshake Hash functions.
  * Begin Send and Handle functions for handshakes.
  **************************************************************************/
 
 /* Called from ssl3_HandleHelloRequest(),
- *             ssl3_HandleFinished() (for step-up)
  *             ssl3_RedoHandshake()
  *             ssl2_BeginClientHandshake (when resuming ssl3 session)
  */
 SECStatus
 ssl3_SendClientHello(sslSocket *ss)
 {
     sslSessionID *   sid;
     ssl3CipherSpec * cwSpec;
     SECStatus        rv;
     int              i;
@@ skipping 552 matching lines @@
     SECKEYPrivateKey *       svrPrivKey;
     SECKEYPublicKey *        svrPubKey             = NULL;
     PK11SymKey *             unwrappedWrappingKey  = NULL;
     PK11SymKey **            pSymWrapKey;
     CK_MECHANISM_TYPE        asymWrapMechanism = CKM_INVALID_MECHANISM;
     int                      length;
     int                      symWrapMechIndex;
     SECStatus                rv;
     SECItem                  wrappedKey;
     SSLWrappedSymWrappingKey wswk;
+#ifdef NSS_ENABLE_ECC
+    PK11SymKey *      Ks = NULL;
+    SECKEYPublicKey   *pubWrapKey = NULL;
+    SECKEYPrivateKey  *privWrapKey = NULL;
+    ECCWrappedKeyInfo *ecWrapped;
+#endif /* NSS_ENABLE_ECC */
 
     svrPrivKey  = ss->serverCerts[exchKeyType].SERVERKEY;
     PORT_Assert(svrPrivKey != NULL);
     if (!svrPrivKey) {
         return NULL;    /* why are we here?!? */
     }
 
     symWrapMechIndex = ssl_FindIndexByWrapMechanism(masterWrapMech);
     PORT_Assert(symWrapMechIndex >= 0);
     if (symWrapMechIndex < 0)
@@ skipping 56 matching lines @@
     wrappedKey.type = siBuffer;
     wrappedKey.len  = SECKEY_PublicKeyStrength(svrPubKey);
     wrappedKey.data = wswk.wrappedSymmetricWrappingkey;
 
     PORT_Assert(wrappedKey.len <= sizeof wswk.wrappedSymmetricWrappingkey);
     if (wrappedKey.len > sizeof wswk.wrappedSymmetricWrappingkey)
         goto loser;
 
     /* wrap symmetric wrapping key in server's public key. */
     switch (exchKeyType) {
-#ifdef NSS_ENABLE_ECC
-    PK11SymKey *      Ks = NULL;
-    SECKEYPublicKey   *pubWrapKey = NULL;
-    SECKEYPrivateKey  *privWrapKey = NULL;
-    ECCWrappedKeyInfo *ecWrapped;
-#endif /* NSS_ENABLE_ECC */
-
     case kt_rsa:
         asymWrapMechanism = CKM_RSA_PKCS;
         rv = PK11_PubWrapSymKey(asymWrapMechanism, svrPubKey,
                                 unwrappedWrappingKey, &wrappedKey);
         break;
 
 #ifdef NSS_ENABLE_ECC
     case kt_ecdh:
         /*
          * We generate an ephemeral EC key pair. Perform an ECDH
@@ skipping 347 matching lines @@
 
     SSL_TRC(3, ("%d: SSL3[%d]: send client_key_exchange handshake",
                 SSL_GETPID(), ss->fd));
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
 
     if (ss->sec.peerKey == NULL) {
         serverKey = CERT_ExtractPublicKey(ss->sec.peerCert);
         if (serverKey == NULL) {
-            PORT_SetError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE);
+            ssl_MapLowLevelError(SSL_ERROR_EXTRACT_PUBLIC_KEY_FAILURE);
             return SECFailure;
         }
     } else {
         serverKey = ss->sec.peerKey;
         ss->sec.peerKey = NULL; /* we're done with it now */
     }
 
     isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0);
     /* enforce limits on kea key sizes. */
     if (ss->ssl3.hs.kea_def->is_limited) {
@@ skipping 409 matching lines @@
             ss->ssl3.hs.ws = wait_change_cipher;
 
         ss->ssl3.hs.isResuming = PR_TRUE;
 
         /* copy the peer cert from the SID */
         if (sid->peerCert != NULL) {
             ss->sec.peerCert = CERT_DupCertificate(sid->peerCert);
             ssl3_CopyPeerCertsFromSID(ss, sid);
         }
 
+
         /* NULL value for PMS signifies re-use of the old MS */
         rv = ssl3_InitPendingCipherSpec(ss,  NULL);
         if (rv != SECSuccess) {
             goto alert_loser;   /* err code was set */
         }
         return SECSuccess;
     } while (0);
 
     if (sid_match)
         SSL_AtomicIncrementLong(& ssl3stats.hsh_sid_cache_not_ok );
@@ skipping 394 matching lines @@
     } else {
         /* XXX Should pass cert_types in this call!! */
         rv = (SECStatus)(*ss->getClientAuthData)(ss->getClientAuthDataArg,
                                                  ss->fd, &ca_list,
                                                  &ss->ssl3.clientCertificate,
                                                  &ss->ssl3.clientPrivateKey);
     }
 #endif   /* NSS_PLATFORM_CLIENT_AUTH */
     switch (rv) {
     case SECWouldBlock: /* getClientAuthData has put up a dialog box. */
-        ssl_SetAlwaysBlock(ss);
+        ssl3_SetAlwaysBlock(ss);
         break;  /* not an error */
 
     case SECSuccess:
 #ifdef NSS_PLATFORM_CLIENT_AUTH
         if (!platform_cert_list || CERT_LIST_EMPTY(platform_cert_list) ||
             !ss->ssl3.platformClientKey) {
             if (platform_cert_list) {
                 CERT_DestroyCertList(platform_cert_list);
                 platform_cert_list = NULL;
             }
@@ skipping 125 matching lines @@
  *     It does not work on a subsequent handshake (redo).
  *
  * Caller holds 1stHandshakeLock.
  */
 SECStatus
 ssl3_RestartHandshakeAfterCertReq(sslSocket *         ss,
                                 CERTCertificate *    cert,
                                 SECKEYPrivateKey *   key,
                                 CERTCertificateList *certChain)
 {
-    SECStatus        rv          = SECFailure;
+    SECStatus        rv          = SECSuccess;
 
     /* XXX This code only works on the initial handshake on a connection,
     ** XXX It does not work on a subsequent handshake (redo).
     */
     if (ss->handshake != 0) {
         ss->handshake              = ssl_GatherRecord1stHandshake;
         ss->ssl3.clientCertificate = cert;
         ss->ssl3.clientPrivateKey  = key;
         ss->ssl3.clientCertChain   = certChain;
         if (!cert || !key || !certChain) {
             /* we are missing the key, cert, or cert chain */
             if (ss->ssl3.clientCertificate) {
                 CERT_DestroyCertificate(ss->ssl3.clientCertificate);
                 ss->ssl3.clientCertificate = NULL;
             }
             if (ss->ssl3.clientPrivateKey) {
                 SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);
                 ss->ssl3.clientPrivateKey = NULL;
             }
             if (ss->ssl3.clientCertChain != NULL) {
                 CERT_DestroyCertificateList(ss->ssl3.clientCertChain);
                 ss->ssl3.clientCertChain = NULL;
             }
             if (ss->ssl3.prSpec->version > SSL_LIBRARY_VERSION_3_0) {
                 ss->ssl3.sendEmptyCert = PR_TRUE;
             } else {
                 (void)SSL3_SendAlert(ss, alert_warning, no_certificate);
             }
         }
-        ssl_GetRecvBufLock(ss);
-        if (ss->ssl3.hs.msgState.buf != NULL) {
-            rv = ssl3_HandleRecord(ss, NULL, &ss->gs.buf);
-        }
-        ssl_ReleaseRecvBufLock(ss);
     } else {
         if (cert) {
             CERT_DestroyCertificate(cert);
         }
         if (key) {
             SECKEY_DestroyPrivateKey(key);
         }
         if (certChain) {
             CERT_DestroyCertificateList(certChain);
         }
+        rv = SECFailure;
     }
     return rv;
 }
 
 PRBool
 ssl3_CanFalseStart(sslSocket *ss) {
-    return ss->opt.enableFalseStart &&
-           !ss->sec.isServer &&
-           !ss->ssl3.hs.isResuming &&
-           ss->ssl3.cwSpec &&
-           ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10 &&
-           (ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_rsa ||
-            ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_dh  ||
-            ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_ecdh);
+    PRBool rv;
+
+    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
+
+    /* XXX: does not take into account whether we are waiting for
+     * SSL_AuthCertificateComplete or SSL_RestartHandshakeAfterCertReq. If/when
+     * that is done, this function could return different results each time it
+     * would be called.
+     */
+
+    ssl_GetSpecReadLock(ss);
+    rv = ss->opt.enableFalseStart &&
+         !ss->sec.isServer &&
+         !ss->ssl3.hs.isResuming &&
+         ss->ssl3.cwSpec &&
+         ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10 &&
+        (ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_rsa ||
+         ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_dh  ||
+         ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_ecdh);
+    ssl_ReleaseSpecReadLock(ss);
+    return rv;
 }
 
+static SECStatus ssl3_SendClientSecondRound(sslSocket *ss);
+
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
  * ssl3 Server Hello Done message.
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
 ssl3_HandleServerHelloDone(sslSocket *ss)
 {
     SECStatus     rv;
     SSL3WaitState ws          = ss->ssl3.hs.ws;
-    PRBool        sendEmptyCert, sendCert;
-    int           n = 0, i;
-    typedef SECStatus (*SendFunction)(sslSocket*);
-    SendFunction  send_funcs[5];
 
     SSL_TRC(3, ("%d: SSL3[%d]: handle server_hello_done handshake",
                 SSL_GETPID(), ss->fd));
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
 
     if (ws != wait_hello_done  &&
         ws != wait_server_cert &&
         ws != wait_server_key  &&
         ws != wait_cert_request) {
         SSL3_SendAlert(ss, alert_fatal, unexpected_message);
         PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);
         return SECFailure;
     }
 
+    rv = ssl3_SendClientSecondRound(ss);
+
+    return rv;
+}
+
+/* Called from ssl3_HandleServerHelloDone and ssl3_AuthCertificateComplete.
+ *
+ * Caller must hold Handshake and RecvBuf locks.
+ */
+static SECStatus
+ssl3_SendClientSecondRound(sslSocket *ss)
+{
+    SECStatus rv;
+    PRBool sendClientCert;
+    PRBool sendEmptyCert;
+    int n = 0, i;
+    typedef SECStatus (*SendFunction)(sslSocket*);
+    SendFunction  send_funcs[5];
+
+    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
+    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
+
+    sendClientCert = !ss->ssl3.sendEmptyCert &&
+                     ss->ssl3.clientCertChain  != NULL &&
+                     (ss->ssl3.platformClientKey ||
+                     ss->ssl3.clientPrivateKey != NULL);
+
+    /* We must wait for the server's certificate to be authenticated before
+     * sending the client certificate in order to disclosing the client
+     * certificate to an attacker that does not have a valid cert for the
+     * domain we are connecting to.
+     *
+     * XXX: We should do the same for the NPN extension, but for that we
+     * need an option to give the application the ability to leak the NPN
+     * information to get better performance.
+     *
+     * During the initial handshake on a connection, we never send/receive
+     * application data until we have authenticated the server's certificate;
+     * i.e. we have fully authenticated the handshake before using the cipher
+     * specs agreed upon for that handshake. During a renegotiation, we may
+     * continue sending and receiving application data during the handshake
+     * interleaved with the handshake records. If we were to send the client's
+     * second round for a renegotiation before the server's certificate was
+     * authenticated, then the application data sent/received after this point
+     * would be using cipher spec that hadn't been authenticated. By waiting
+     * until the server's certificate has been authenticated during
+     * renegotiations, we ensure that renegotiations have the same property
+     * as initial handshakes; i.e. we have fully authenticated the handshake
+     * before using the cipher specs agreed upon for that handshake for
+     * application data.
+     */
+    if (ss->ssl3.hs.restartTarget) {
+        PR_NOT_REACHED("unexpected ss->ssl3.hs.restartTarget");
+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+        return SECFailure;
+    }
+    if (ss->ssl3.hs.authCertificatePending &&
+        (sendClientCert || ss->ssl3.sendEmptyCert || ss->firstHsDone)) {
+        ss->ssl3.hs.restartTarget = ssl3_SendClientSecondRound;
+        return SECWouldBlock;
+    }
+
     ssl_GetXmitBufLock(ss);             /*******************************/
 
     sendEmptyCert = ss->ssl3.sendEmptyCert;
     ss->ssl3.sendEmptyCert = PR_FALSE;
-    sendCert = !sendEmptyCert &&
-               ss->ssl3.clientCertChain != NULL &&
-               (ss->ssl3.platformClientKey ||
-                ss->ssl3.clientPrivateKey != NULL);
 
     if (ssl3_ExtensionNegotiated(ss, ssl_encrypted_client_certs)) {
         send_funcs[n++] = ssl3_SendClientKeyExchange;
         send_funcs[n++] = ssl3_SendChangeCipherSpecs;
         if (sendEmptyCert) {
             send_funcs[n++] = ssl3_SendEmptyCertificate;
         }
-        if (sendCert) {
+        if (sendClientCert) {
             send_funcs[n++] = ssl3_SendCertificate;
             send_funcs[n++] = ssl3_SendCertificateVerify;
         }
     } else {
         if (sendEmptyCert) {
             send_funcs[n++] = ssl3_SendEmptyCertificate;
         }
-        if (sendCert) {
+        if (sendClientCert) {
             send_funcs[n++] = ssl3_SendCertificate;
         }
         send_funcs[n++] = ssl3_SendClientKeyExchange;
-        if (sendCert) {
+        if (sendClientCert) {
             send_funcs[n++] = ssl3_SendCertificateVerify;
         }
         send_funcs[n++] = ssl3_SendChangeCipherSpecs;
     }
 
     PORT_Assert(n <= sizeof(send_funcs)/sizeof(send_funcs[0]));
 
     for (i = 0; i < n; i++) {
         rv = send_funcs[i](ss);
         if (rv != SECSuccess) {
             goto loser; /* err code was set. */
         }
     }
 
-    /* We don't send NPN in a renegotiation as it's explicitly disallowed by
-     * the spec. */
+    /* XXX: If the server's certificate hasn't been authenticated by this
+     * point, then we may be leaking this NPN message to an attacker.
+     */
     if (!ss->firstHsDone) {
         rv = ssl3_SendNextProto(ss);
         if (rv != SECSuccess) {
             goto loser; /* err code was set. */
         }
     }
 
     rv = ssl3_SendFinished(ss, 0);
     if (rv != SECSuccess) {
         goto loser;     /* err code was set. */
@@ skipping 1960 matching lines @@
                 len += fakeCert.len + 3;
             } else {
                 len += certChain->certs[i].len + 3;
             }
 #else
             len += certChain->certs[i].len + 3;
 #endif
         }
     }
 
-    if (ss->ssl3.cachedInfoCertChainDigestReceived) {
-        /* Compute hash. */
-        PRUint64 certChainHash;
-        int i;
-        FNV1A64_Init(&certChainHash);
-        for (i = 0; i < certChain->len; i++) {
-            unsigned int certLen = certChain->certs[i].len;
-            unsigned char certLenArray[3] = {
-                certLen >> 16,
-                certLen >> 8,
-                certLen
-            };
-            FNV1A64_Update(&certChainHash, certLenArray, sizeof(certLenArray));
-            FNV1A64_Update(&certChainHash, certChain->certs[i].data, certLen);
-        }
-        FNV1A64_Final(&certChainHash);
-
-        /* Both |&certChainHash| and |ss->ssl3.certChainDigest| should be in
-         * network byte order since both are computed with the FNV1A64 hash,
-         * which calls the function htonll.
-         */
-        if (memcmp(&certChainHash, ss->ssl3.certChainDigest,
-                   sizeof(certChainHash)) == 0) {
-            /* The client correctly predicted the certificate chain. */
-
-            /* Handshake type: certificate. */
-            rv = ssl3_AppendHandshakeNumber(ss, certificate, 1);
-            if (rv != SECSuccess) {
-                return rv;              /* err set by AppendHandshake. */
-            }
-            /* Handshake message length. */
-            rv = ssl3_AppendHandshakeNumber(ss, 15, 3);
-            if (rv != SECSuccess) {
-                return rv;              /* err set by AppendHandshake. */
-            }
-            /* CertChainLen(3) + ASN.1CertLen(3) + DigestLen(1) + Digest(8) */
-            rv = ssl3_AppendHandshakeNumber(ss, 12, 3);
-            if (rv != SECSuccess) {
-                return rv;              /* err set by AppendHandshake. */
-            }
-            /* ASN.1CertLen(3) + DigestLen(1) + Digest(8) */
-            rv = ssl3_AppendHandshakeNumber(ss, 9, 3);
-            if (rv != SECSuccess) {
-                return rv;              /* err set by AppendHandshake. */
-            }
-            /* Digest Length Byte */
-            rv = ssl3_AppendHandshakeNumber(ss, sizeof(certChainHash), 1);
-            if (rv != SECSuccess) {
-                return rv;              /* err set by AppendHandshake. */
-            }
-            /* Digest */
-            rv = ssl3_AppendHandshake(ss, &certChainHash,
-                                      sizeof(certChainHash));
-            if (rv != SECSuccess) {
-                return rv;              /* err set by AppendHandshake. */
-            }
-
-            return SECSuccess;
-        }
-    }
-
-    /* Send the entire certificate as usual. */
-
     rv = ssl3_AppendHandshakeHeader(ss, certificate, len + 3);
     if (rv != SECSuccess) {
         return rv;              /* err set by AppendHandshake. */
     }
     rv = ssl3_AppendHandshakeNumber(ss, len, 3);
     if (rv != SECSuccess) {
         return rv;              /* err set by AppendHandshake. */
     }
     if (certChain) {
         for (i = 0; i < certChain->len; i++) {
@@ skipping 127 matching lines @@
 
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
  * ssl3 Certificate message.
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
 ssl3_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
 {
     ssl3CertNode *   c;
     ssl3CertNode *   lastCert   = NULL;
-    ssl3CertNode *   certs      = NULL;
-    PRArenaPool *    arena      = NULL;
-    CERTCertificate *cert;
     PRInt32          remaining  = 0;
     PRInt32          size;
     SECStatus        rv;
     PRBool           isServer   = (PRBool)(!!ss->sec.isServer);
+    PRBool           trusted    = PR_FALSE;
     PRBool           isTLS;
-    SSL3AlertDescription desc   = bad_certificate;
+    SSL3AlertDescription desc;
     int              errCode    = SSL_ERROR_RX_MALFORMED_CERTIFICATE;
     SECItem          certItem;
 
     SSL_TRC(3, ("%d: SSL3[%d]: handle certificate handshake",
                 SSL_GETPID(), ss->fd));
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
 
     if ((ss->ssl3.hs.ws != wait_server_cert) &&
         (ss->ssl3.hs.ws != wait_client_cert)) {
@@ skipping 29 matching lines @@
     if (!remaining) {
         if (!(isTLS && isServer))
             goto alert_loser;
         /* This is TLS's version of a no_certificate alert. */
         /* I'm a server. I've requested a client cert. He hasn't got one. */
         rv = ssl3_HandleNoCertificate(ss);
         if (rv != SECSuccess) {
             errCode = PORT_GetError();
             goto loser;
         }
-        goto cert_block;
+        goto server_no_cert;
     }
 
-    ss->ssl3.peerCertArena = arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
-    if ( arena == NULL ) {
+    ss->ssl3.peerCertArena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+    if (ss->ssl3.peerCertArena == NULL) {
         goto loser;     /* don't send alerts on memory errors */
     }
 
-    if (length == 12 && ssl3_ExtensionNegotiated(ss, ssl_cached_info_xtn)) {
-        /* We are dealing with a certificate_chain digest */
-        int i;
+    /* First get the peer cert. */
+    remaining -= 3;
+    if (remaining < 0)
+        goto decode_loser;
 
-        ss->ssl3.cachedInfoCertChainDigestReceived = PR_TRUE;
+    size = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length);
+    if (size <= 0)
+        goto loser;     /* fatal alert already sent by ConsumeHandshake. */
 
-        /* Make sure the digests match. */
-        if (memcmp(b + 4, ss->ssl3.certChainDigest, 8)) {
-            desc = handshake_failure;
-            goto alert_loser;
-        }
+    if (remaining < size)
+        goto decode_loser;
 
-        /* First get the peer cert. */
-        if (ss->ssl3.predictedCertChain[0] == NULL) {
-            desc = handshake_failure;
-            goto alert_loser;
-        }
-        ss->sec.peerCert = CERT_DupCertificate(ss->ssl3.predictedCertChain[0]);
+    certItem.data = b;
+    certItem.len = size;
+    b      += size;
+    length -= size;
+    remaining -= size;
 
-        /* Now get all of the CA certs. */
-        ss->ssl3.peerCertChain = NULL;
-        for (i = 1; ss->ssl3.predictedCertChain[i] != NULL; i++) {
-            c = PORT_ArenaNew(arena, ssl3CertNode);
-            if (c == NULL) {
-                goto loser;     /* don't send alerts on memory errors */
-            }
-            c->cert = CERT_DupCertificate(ss->ssl3.predictedCertChain[i]);
-            c->next = NULL;
-            if (lastCert) {
-                lastCert->next = c;
-            } else {
-                ss->ssl3.peerCertChain = c;
-            }
-            lastCert = c;
-        }
-    } else {
-        /* We are dealing with a regular certificate message */
-        ss->ssl3.cachedInfoCertChainDigestReceived = PR_FALSE;
+    ss->sec.peerCert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL,
+                                            PR_FALSE, PR_TRUE);
+    if (ss->sec.peerCert == NULL) {
+        /* We should report an alert if the cert was bad, but not if the
+         * problem was just some local problem, like memory error.
+         */
+        goto ambiguous_err;
+    }
 
-        /* First get the peer cert. */
+    /* Now get all of the CA certs. */
+    while (remaining > 0) {
         remaining -= 3;
         if (remaining < 0)
             goto decode_loser;
 
         size = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length);
         if (size <= 0)
             goto loser; /* fatal alert already sent by ConsumeHandshake. */
 
         if (remaining < size)
             goto decode_loser;
 
         certItem.data = b;
         certItem.len = size;
-        b += size;
+        b      += size;
         length -= size;
         remaining -= size;
 
-        ss->sec.peerCert = CERT_NewTempCertificate(ss->dbHandle, &certItem,
-                                                   NULL, PR_FALSE, PR_TRUE);
-        if (ss->sec.peerCert == NULL) {
-            /* We should report an alert if the cert was bad, but not if the
-             * problem was just some local problem, like memory error.
-             */
+        c = PORT_ArenaNew(ss->ssl3.peerCertArena, ssl3CertNode);
+        if (c == NULL) {
+            goto loser; /* don't send alerts on memory errors */
+        }
+
+        c->cert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL,
+                                          PR_FALSE, PR_TRUE);
+        if (c->cert == NULL) {
             goto ambiguous_err;
         }
 
-        /* Now get all of the CA certs. */
-        while (remaining > 0) {
-            remaining -= 3;
-            if (remaining < 0)
-                goto decode_loser;
+        if (c->cert->trust)
+            trusted = PR_TRUE;
 
-            size = ssl3_ConsumeHandshakeNumber(ss, 3, &b, &length);
-            if (size <= 0)
-                goto loser; /* fatal alert already sent by ConsumeHandshake. */
-
-            if (remaining < size)
-                goto decode_loser;
-
-            certItem.data = b;
-            certItem.len = size;
-            b      += size;
-            length -= size;
-            remaining -= size;
-
-            c = PORT_ArenaNew(arena, ssl3CertNode);
-            if (c == NULL) {
-                goto loser;     /* don't send alerts on memory errors */
-            }
-
-            c->cert = CERT_NewTempCertificate(ss->dbHandle, &certItem, NULL,
-                                              PR_FALSE, PR_TRUE);
-            if (c->cert == NULL) {
-                goto ambiguous_err;
-            }
-
-            c->next = NULL;
-            if (lastCert) {
-                lastCert->next = c;
-            } else {
-                certs = c;
-            }
-            lastCert = c;
+        c->next = NULL;
+        if (lastCert) {
+            lastCert->next = c;
+        } else {
+            ss->ssl3.peerCertChain = c;
         }
-
-        if (remaining != 0)
-            goto decode_loser;
-
-        ss->ssl3.peerCertChain = certs;  certs = NULL;  arena = NULL;
+        lastCert = c;
     }
 
+    if (remaining != 0)
+        goto decode_loser;
+
     SECKEY_UpdateCertPQG(ss->sec.peerCert);
 
+    ss->ssl3.hs.authCertificatePending = PR_FALSE;
+
     /*
      * Ask caller-supplied callback function to validate cert chain.
      */
     rv = (SECStatus)(*ss->authCertificate)(ss->authCertificateArg, ss->fd,
                                            PR_TRUE, isServer);
     if (rv) {
         errCode = PORT_GetError();
-        if (!ss->handleBadCert) {
-            goto bad_cert;
+        if (rv != SECWouldBlock) {
+            if (ss->handleBadCert) {
+                rv = (*ss->handleBadCert)(ss->badCertArg, ss->fd);
+            }
         }
-        rv = (SECStatus)(*ss->handleBadCert)(ss->badCertArg, ss->fd);
-        if ( rv ) {
-            if ( rv == SECWouldBlock ) {
-                /* someone will handle this connection asynchronously*/
-                SSL_DBG(("%d: SSL3[%d]: go to async cert handler",
-                         SSL_GETPID(), ss->fd));
-                ssl_SetAlwaysBlock(ss);
-                goto cert_block;
+
+        if (rv == SECWouldBlock) {
+            if (ss->sec.isServer) {
+                errCode = SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SERVERS;
+                rv = SECFailure;
+                goto loser;
             }
-            /* cert is bad */
-            goto bad_cert;
+
+            ss->ssl3.hs.authCertificatePending = PR_TRUE;
+            rv = SECSuccess;
+
+            /* XXX: Async cert validation and False Start don't work together
+             * safely yet; if we leave False Start enabled, we may end up false
+             * starting (sending application data) before we
+             * SSL_AuthCertificateComplete has been called.
+             */
+            ss->opt.enableFalseStart = PR_FALSE;
         }
-        /* cert is good */
-    }
 
-    /* start SSL Step Up, if appropriate */
-    cert = ss->sec.peerCert;
-    if (!isServer &&
-        ssl3_global_policy_some_restricted &&
-        ss->ssl3.policy == SSL_ALLOWED &&
-        anyRestrictedEnabled(ss) &&
-        SECSuccess == CERT_VerifyCertNow(cert->dbhandle, cert,
-                                         PR_FALSE, /* checkSig */
-                                         certUsageSSLServerWithStepUp,
-/*XXX*/                                  ss->authCertificateArg) ) {
-        ss->ssl3.policy         = SSL_RESTRICTED;
-        ss->ssl3.hs.rehandshake = PR_TRUE;
+        if (rv != SECSuccess) {
+            ssl3_SendAlertForCertError(ss, errCode);
+            goto loser;
+        }
     }
 
     ss->sec.ci.sid->peerCert = CERT_DupCertificate(ss->sec.peerCert);
     ssl3_CopyPeerCertsToSID(ss->ssl3.peerCertChain, ss->sec.ci.sid);
 
     if (!ss->sec.isServer) {
+        CERTCertificate *cert = ss->sec.peerCert;
+
         /* set the server authentication and key exchange types and sizes
         ** from the value in the cert.  If the key exchange key is different,
         ** it will get fixed when we handle the server key exchange message.
         */
         SECKEYPublicKey * pubKey  = CERT_ExtractPublicKey(cert);
         ss->sec.authAlgorithm = ss->ssl3.hs.kea_def->signKeyType;
         ss->sec.keaType       = ss->ssl3.hs.kea_def->exchKeyType;
         if (pubKey) {
             ss->sec.keaKeyBits = ss->sec.authKeyBits =
                 SECKEY_PublicKeyStrengthInBits(pubKey);
@@ skipping 20 matching lines @@
                     /* 
                      * XXX: if cert is not signed by rsa we should
                      * destroy pubKey and goto bad_cert
                      */
                 }
             }
 #endif /* NSS_ENABLE_ECC */
             SECKEY_DestroyPublicKey(pubKey); 
             pubKey = NULL;
         }
-    }
 
-cert_block:
-    if (ss->sec.isServer) {
-        if (ssl3_ExtensionNegotiated(ss, ssl_encrypted_client_certs)) {
-            ss->ssl3.hs.ws = wait_cert_verify;
-        } else {
-            ss->ssl3.hs.ws = wait_client_key;
-        }
-    } else {
         ss->ssl3.hs.ws = wait_cert_request; /* disallow server_key_exchange */
         if (ss->ssl3.hs.kea_def->is_limited ||
             /* XXX OR server cert is signing only. */
 #ifdef NSS_ENABLE_ECC
             ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa ||
             ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa ||
 #endif /* NSS_ENABLE_ECC */
             ss->ssl3.hs.kea_def->exchKeyType == kt_dh) {
             ss->ssl3.hs.ws = wait_server_key; /* allow server_key_exchange */
         }
+    } else {
+server_no_cert:
+        if (ssl3_ExtensionNegotiated(ss, ssl_encrypted_client_certs)) {
+            ss->ssl3.hs.ws = wait_cert_verify;
+        } else {
+            ss->ssl3.hs.ws = wait_client_key;
+        }
     }
 
-    /* rv must normally be equal to SECSuccess here.  If we called
-     * handleBadCert, it can also be SECWouldBlock.
-     */
+    PORT_Assert(rv == SECSuccess);
+    if (rv != SECSuccess) {
+        errCode = SEC_ERROR_LIBRARY_FAILURE;
+        rv = SECFailure;
+        goto loser;
+    }
+
     return rv;
 
 ambiguous_err:
     errCode = PORT_GetError();
     switch (errCode) {
     case PR_OUT_OF_MEMORY_ERROR:
     case SEC_ERROR_BAD_DATABASE:
     case SEC_ERROR_NO_MEMORY:
         if (isTLS) {
             desc = internal_error;
             goto alert_loser;
         }
         goto loser;
     }
-    /* fall through to bad_cert. */
-
-bad_cert:       /* caller has set errCode. */
-    switch (errCode) {
-    case SEC_ERROR_LIBRARY_FAILURE:     desc = unsupported_certificate; break;
-    case SEC_ERROR_EXPIRED_CERTIFICATE: desc = certificate_expired;     break;
-    case SEC_ERROR_REVOKED_CERTIFICATE: desc = certificate_revoked;     break;
-    case SEC_ERROR_INADEQUATE_KEY_USAGE:
-    case SEC_ERROR_INADEQUATE_CERT_TYPE:
-                                        desc = certificate_unknown;     break;
-    case SEC_ERROR_UNTRUSTED_CERT:
-                    desc = isTLS ? access_denied : certificate_unknown; break;
-    case SEC_ERROR_UNKNOWN_ISSUER:      
-    case SEC_ERROR_UNTRUSTED_ISSUER:    
-                    desc = isTLS ? unknown_ca : certificate_unknown; break;
-    case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE:
-                    desc = isTLS ? unknown_ca : certificate_expired; break;
-
-    case SEC_ERROR_CERT_NOT_IN_NAME_SPACE:
-    case SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID:
-    case SEC_ERROR_CA_CERT_INVALID:
-    case SEC_ERROR_BAD_SIGNATURE:
-    default:                            desc = bad_certificate;     break;
-    }
-    SSL_DBG(("%d: SSL3[%d]: peer certificate is no good: error=%d",
-             SSL_GETPID(), ss->fd, errCode));
-
-    goto alert_loser;
+    ssl3_SendAlertForCertError(ss, errCode);
+    goto loser;
 
 decode_loser:
     desc = isTLS ? decode_error : bad_certificate;
 
 alert_loser:
     (void)SSL3_SendAlert(ss, alert_fatal, desc);
 
 loser:
-    if (ss->ssl3.peerCertChain == NULL) {
-        ss->ssl3.peerCertChain = certs;  certs = NULL;  arena = NULL;
-    }
-    PORT_Assert(certs == NULL);
     ssl3_CleanupPeerCerts(ss);
 
     if (ss->sec.peerCert != NULL) {
         CERT_DestroyCertificate(ss->sec.peerCert);
         ss->sec.peerCert = NULL;
     }
     (void)ssl_MapLowLevelError(errCode);
     return SECFailure;
 }
 
+static SECStatus ssl3_FinishHandshake(sslSocket *ss);
 
-/* restart an SSL connection that we stopped to run certificate dialogs
-** XXX  Need to document here how an application marks a cert to show that
-**      the application has accepted it (overridden CERT_VerifyCert).
- *
- * XXX This code only works on the initial handshake on a connection, XXX
- *     It does not work on a subsequent handshake (redo).
- *
- * Return value: XXX
- *
- * Caller holds 1stHandshakeLock.
+static SECStatus
+ssl3_AlwaysFail(sslSocket * ss)
+{
+    PORT_SetError(PR_INVALID_STATE_ERROR);
+    return SECFailure;
+}
+
+/* Caller must hold 1stHandshakeLock.
 */
-int
-ssl3_RestartHandshakeAfterServerCert(sslSocket *ss)
+SECStatus
+ssl3_AuthCertificateComplete(sslSocket *ss, PRErrorCode error)
 {
-    CERTCertificate * cert;
-    int               rv        = SECSuccess;
+    SECStatus rv;
 
-    if (MSB(ss->version) != MSB(SSL_LIBRARY_VERSION_3_0)) {
-        SET_ERROR_CODE
-        return SECFailure;
-    }
-    if (!ss->ssl3.initialized) {
-        SET_ERROR_CODE
-        return SECFailure;
+    PORT_Assert(ss->opt.noLocks || ssl_Have1stHandshakeLock(ss));
+
+    if (ss->sec.isServer) {
+        PORT_SetError(SSL_ERROR_FEATURE_NOT_SUPPORTED_FOR_SERVERS);
+        return SECFailure;
     }
 
-    cert = ss->sec.peerCert;
+    ssl_GetRecvBufLock(ss);
+    ssl_GetSSL3HandshakeLock(ss);
 
-    /* Permit step up if user decided to accept the cert */
-    if (!ss->sec.isServer &&
-        ssl3_global_policy_some_restricted &&
-        ss->ssl3.policy == SSL_ALLOWED &&
-        anyRestrictedEnabled(ss) &&
-        (SECSuccess == CERT_VerifyCertNow(cert->dbhandle, cert,
-                                          PR_FALSE, /* checksig */
-                                          certUsageSSLServerWithStepUp,
-/*XXX*/                                   ss->authCertificateArg) )) {
-        ss->ssl3.policy         = SSL_RESTRICTED;
-        ss->ssl3.hs.rehandshake = PR_TRUE;
+    if (!ss->ssl3.hs.authCertificatePending) {
+        PORT_SetError(PR_INVALID_STATE_ERROR);
+        rv = SECFailure;
+        goto done;
     }
 
-    if (ss->handshake != NULL) {
-        ss->handshake = ssl_GatherRecord1stHandshake;
-        ss->sec.ci.sid->peerCert = CERT_DupCertificate(ss->sec.peerCert);
-        ssl3_CopyPeerCertsToSID((ssl3CertNode *)ss->ssl3.peerCertChain,
-                                ss->sec.ci.sid);
+    ss->ssl3.hs.authCertificatePending = PR_FALSE;
 
-        ssl_GetRecvBufLock(ss);
-        if (ss->ssl3.hs.msgState.buf != NULL) {
-            rv = ssl3_HandleRecord(ss, NULL, &ss->gs.buf);
+    if (error != 0) {
+        ss->ssl3.hs.restartTarget = ssl3_AlwaysFail;
+        ssl3_SendAlertForCertError(ss, error);
+        rv = SECSuccess;
+    } else if (ss->ssl3.hs.restartTarget != NULL) {
+        sslRestartTarget target = ss->ssl3.hs.restartTarget;
+        ss->ssl3.hs.restartTarget = NULL;
+        rv = target(ss);
+        /* Even if we blocked here, we have accomplished enough to claim
+         * success. Any remaining work will be taken care of by subsequent
+         * calls to SSL_ForceHandshake/PR_Send/PR_Read/etc. 
+         */
+        if (rv == SECWouldBlock) {
+            rv = SECSuccess;
         }
-        ssl_ReleaseRecvBufLock(ss);
+    } else {
+        rv = SECSuccess;
     }
 
+done:
+    ssl_ReleaseSSL3HandshakeLock(ss);
+    ssl_ReleaseRecvBufLock(ss);
+
     return rv;
 }
 
 /* The calling function must acquire and release the appropriate lock (i.e.,
  * ssl_GetSpecReadLock / ssl_ReleaseSpecReadLock for ss->ssl3.crSpec). Any
  * label must already be concatenated onto the beginning of val.
  */
 SECStatus
 ssl3_TLSPRFWithMasterSecret(ssl3CipherSpec *spec, const char *label,
     unsigned int labelLen, const unsigned char *val, unsigned int valLen,
@@ skipping 244 matching lines @@
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
 ssl3_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
                     const SSL3Hashes *hashes)
 {
     sslSessionID *    sid          = ss->sec.ci.sid;
     SECStatus         rv           = SECSuccess;
     PRBool            isServer     = ss->sec.isServer;
     PRBool            isTLS;
-    PRBool            doStepUp;
     SSL3KEAType       effectiveExchKeyType;
 
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
 
     SSL_TRC(3, ("%d: SSL3[%d]: handle finished handshake",
         SSL_GETPID(), ss->fd));
 
     if (ss->ssl3.hs.ws != wait_finished) {
         SSL3_SendAlert(ss, alert_fatal, unexpected_message);
@@ skipping 35 matching lines @@
         else
             ss->ssl3.hs.finishedMsgs.sFinished[0] = *hashes;
         ss->ssl3.hs.finishedBytes = sizeof *hashes;
         if (0 != NSS_SecureMemcmp(hashes, b, length)) {
             (void)ssl3_HandshakeFailure(ss);
             PORT_SetError(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
             return SECFailure;
         }
     }
 
-    doStepUp = (PRBool)(!isServer && ss->ssl3.hs.rehandshake);
-
     ssl_GetXmitBufLock(ss);     /*************************************/
 
     if ((isServer && !ss->ssl3.hs.isResuming) ||
         (!isServer && ss->ssl3.hs.isResuming)) {
         PRInt32 flags = 0;
 
         /* Send a NewSessionTicket message if the client sent us
          * either an empty session ticket, or one that did not verify.
          * (Note that if either of these conditions was met, then the
          * server has sent a SessionTicket extension in the
          * ServerHello message.)
          */
         if (isServer && !ss->ssl3.hs.isResuming &&
             ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn)) {
             rv = ssl3_SendNewSessionTicket(ss);
             if (rv != SECSuccess) {
                 goto xmit_loser;
             }
         }
 
         rv = ssl3_SendChangeCipherSpecs(ss);
         if (rv != SECSuccess) {
             goto xmit_loser;    /* err is set. */
         }
         /* If this thread is in SSL_SecureSend (trying to write some data) 
-        ** or if it is going to step up, 
         ** then set the ssl_SEND_FLAG_FORCE_INTO_BUFFER flag, so that the 
         ** last two handshake messages (change cipher spec and finished) 
         ** will be sent in the same send/write call as the application data.
         */
-        if (doStepUp || ss->writerThread == PR_GetCurrentThread()) {
+        if (ss->writerThread == PR_GetCurrentThread()) {
             flags = ssl_SEND_FLAG_FORCE_INTO_BUFFER;
         }
 
         if (!isServer && !ss->firstHsDone) {
             rv = ssl3_SendNextProto(ss);
             if (rv != SECSuccess) {
-                goto xmit_loser;        /* err code was set. */
+                goto xmit_loser; /* err code was set. */
             }
         }
 
         rv = ssl3_SendFinished(ss, flags);
         if (rv != SECSuccess) {
             goto xmit_loser;    /* err is set. */
         }
     }
 
-    /* Optimization: don't cache this connection if we're going to step up. */
-    if (doStepUp) {
-        ssl_FreeSID(sid);
-        ss->sec.ci.sid     = sid = NULL;
-        ss->ssl3.hs.rehandshake = PR_FALSE;
-        rv = ssl3_SendClientHello(ss);
 xmit_loser:
-        ssl_ReleaseXmitBufLock(ss);
-        return rv;      /* err code is set if appropriate. */
+    ssl_ReleaseXmitBufLock(ss); /*************************************/
+    if (rv != SECSuccess) {
+        return rv;
     }
 
-    ssl_ReleaseXmitBufLock(ss); /*************************************/
-
-    /* The first handshake is now completed. */
-    ss->handshake           = NULL;
-    ss->firstHsDone         = PR_TRUE;
     ss->gs.writeOffset = 0;
     ss->gs.readOffset  = 0;
 
     if (ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) {
         effectiveExchKeyType = kt_rsa;
     } else {
         effectiveExchKeyType = ss->ssl3.hs.kea_def->exchKeyType;
     }
 
     if (sid->cached == never_cached && !ss->opt.noCache && ss->sec.cache) {
@@ skipping 29 matching lines @@
             rv = ssl3_CacheWrappedMasterSecret(ss, ss->sec.ci.sid,
                                                ss->ssl3.crSpec,
                                                effectiveExchKeyType);
             sid->u.ssl3.keys.msIsWrapped = PR_TRUE;
         }
         ssl_ReleaseSpecReadLock(ss);  /*************************************/
 
         /* If the wrap failed, we don't cache the sid.
          * The connection continues normally however.
          */
-        if (rv == SECSuccess) {
-            (*ss->sec.cache)(sid);
+        ss->ssl3.hs.cacheSID = rv == SECSuccess;
+    }
+
+    if (ss->ssl3.hs.authCertificatePending) {
+        if (ss->ssl3.hs.restartTarget) {
+            PR_NOT_REACHED("ssl3_HandleFinished: unexpected restartTarget");
+            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+            return SECFailure;
         }
+
+        ss->ssl3.hs.restartTarget = ssl3_FinishHandshake;
+        return SECWouldBlock;
     }
+
+    rv = ssl3_FinishHandshake(ss);
+    return rv;
+}
+
+SECStatus
+ssl3_FinishHandshake(sslSocket * ss)
+{
+    SECStatus rv;
+
+    PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
+    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
+    PORT_Assert( ss->ssl3.hs.restartTarget == NULL );
+
+    /* The first handshake is now completed. */
+    ss->handshake           = NULL;
+    ss->firstHsDone         = PR_TRUE;
+
+    if (ss->sec.ci.sid->cached == never_cached &&
+        !ss->opt.noCache && ss->sec.cache && ss->ssl3.hs.cacheSID) {
+        (*ss->sec.cache)(ss->sec.ci.sid);
+    }
+
     ss->ssl3.hs.ws = idle_handshake;
 
     /* Do the handshake callback for sslv3 here, if we cannot false start. */
     if (ss->handshakeCallback != NULL && !ssl3_CanFalseStart(ss)) {
         (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
     }
 
     return SECSuccess;
 }
 
@@ skipping 344 matching lines @@
  *
  * If cText is NULL, then the ciphertext has previously been deciphered and
  * checked, and is already sitting in databuf.  It is processed as an SSL
  * Handshake message.
  *
  * DOES NOT process the decrypted/decompressed application data.
  * On return, databuf contains the decrypted/decompressed record.
  *
  * Called from ssl3_GatherCompleteHandshake
  *             ssl3_RestartHandshakeAfterCertReq
- *             ssl3_RestartHandshakeAfterServerCert
  *
  * Caller must hold the RecvBufLock.
  *
  * This function aquires and releases the SSL3Handshake Lock, holding the
  * lock around any calls to functions that handle records other than
  * Application Data records.
  */
 SECStatus
 ssl3_HandleRecord(sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *databuf)
 {
@@ skipping 329 matching lines @@
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
 
     if (ss->ssl3.initialized)
         return SECSuccess;      /* Function should be idempotent */
 
     ss->ssl3.policy = SSL_ALLOWED;
 
     ssl_GetSpecWriteLock(ss);
     ss->ssl3.crSpec = ss->ssl3.cwSpec = &ss->ssl3.specs[0];
     ss->ssl3.prSpec = ss->ssl3.pwSpec = &ss->ssl3.specs[1];
-    ss->ssl3.hs.rehandshake = PR_FALSE;
     ss->ssl3.hs.sendingSCSV = PR_FALSE;
     ssl3_InitCipherSpec(ss, ss->ssl3.crSpec);
     ssl3_InitCipherSpec(ss, ss->ssl3.prSpec);
 
     ss->ssl3.hs.ws = (ss->sec.isServer) ? wait_client_hello : wait_server_hello;
 #ifdef NSS_ENABLE_ECC
     ss->ssl3.hs.negotiatedECCurves = SSL3_SUPPORTED_CURVES_MASK;
 #endif
     ssl_ReleaseSpecWriteLock(ss);
 
@@ skipping 88 matching lines @@
 ssl3_SetPolicy(ssl3CipherSuite which, int policy)
 {
     ssl3CipherSuiteCfg *suite;
 
     suite = ssl_LookupCipherSuiteCfg(which, cipherSuites);
     if (suite == NULL) {
         return SECFailure; /* err code was set by ssl_LookupCipherSuiteCfg */
     }
     suite->policy = policy;
 
-    if (policy == SSL_RESTRICTED) {
-        ssl3_global_policy_some_restricted = PR_TRUE;
-    }
-
     return SECSuccess;
 }
 
 SECStatus
 ssl3_GetPolicy(ssl3CipherSuite which, PRInt32 *oPolicy)
 {
     ssl3CipherSuiteCfg *suite;
     PRInt32             policy;
     SECStatus           rv;
 
@@ skipping 156 matching lines @@
     ssl_GetXmitBufLock(ss);     /**************************************/
 
     /* start off a new handshake. */
     rv = (ss->sec.isServer) ? ssl3_SendHelloRequest(ss)
                             : ssl3_SendClientHello(ss);
 
     ssl_ReleaseXmitBufLock(ss); /**************************************/
     return rv;
 }
 
-static void
-ssl3_CleanupPredictedPeerCertificates(sslSocket *ss) {
-    unsigned int i;
-
-    if (!ss->ssl3.predictedCertChain)
-        return;
-
-    for (i = 0; ss->ssl3.predictedCertChain[i]; i++) {
-        CERT_DestroyCertificate(ss->ssl3.predictedCertChain[i]);
-    }
-
-    PORT_Free(ss->ssl3.predictedCertChain);
-    ss->ssl3.predictedCertChain = NULL;
-}
-
 /* Called from ssl_DestroySocketContents() in sslsock.c */
 void
 ssl3_DestroySSL3Info(sslSocket *ss)
 {
 
     if (ss->ssl3.clientCertificate != NULL)
         CERT_DestroyCertificate(ss->ssl3.clientCertificate);
 
     if (ss->ssl3.clientPrivateKey != NULL)
         SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);
 #ifdef NSS_PLATFORM_CLIENT_AUTH
     if (ss->ssl3.platformClientKey)
         ssl_FreePlatformKey(ss->ssl3.platformClientKey);
 #endif /* NSS_PLATFORM_CLIENT_AUTH */
 
     if (ss->ssl3.peerCertArena != NULL)
         ssl3_CleanupPeerCerts(ss);
 
     if (ss->ssl3.clientCertChain != NULL) {
        CERT_DestroyCertificateList(ss->ssl3.clientCertChain);
        ss->ssl3.clientCertChain = NULL;
     }
 
-    if (ss->ssl3.predictedCertChain != NULL)
-        ssl3_CleanupPredictedPeerCertificates(ss);
-
     /* clean up handshake */
     if (ss->opt.bypassPKCS11) {
         SHA1_DestroyContext((SHA1Context *)ss->ssl3.hs.sha_cx, PR_FALSE);
         MD5_DestroyContext((MD5Context *)ss->ssl3.hs.md5_cx, PR_FALSE);
     } 
     if (ss->ssl3.hs.md5) {
         PK11_DestroyContext(ss->ssl3.hs.md5,PR_TRUE);
     }
     if (ss->ssl3.hs.sha) {
         PK11_DestroyContext(ss->ssl3.hs.sha,PR_TRUE);
@@ skipping 13 matching lines @@
 
     /* free the SSL3Buffer (msg_body) */
     PORT_Free(ss->ssl3.hs.msg_body.buf);
 
     /* free up the CipherSpecs */
     ssl3_DestroyCipherSpec(&ss->ssl3.specs[0], PR_TRUE/*freeSrvName*/);
     ssl3_DestroyCipherSpec(&ss->ssl3.specs[1], PR_TRUE/*freeSrvName*/);
 
     ss->ssl3.initialized = PR_FALSE;
 
-    if (ss->ssl3.nextProto.data) {
-        PORT_Free(ss->ssl3.nextProto.data);
-        ss->ssl3.nextProto.data = NULL;
-    }
+    SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 }
 
 /* End of ssl3con.c */