When performing an SSL renegotiation and requesting a certificate status, clear any existing certif…

net/third_party/nss/ssl/ssl3ext.c

 /*
  * SSL3 Protocol
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /* TLS extension code moved here from ssl3ecc.c */
 /* $Id: ssl3ext.c,v 1.28 2012/09/21 00:28:05 wtc%google.com Exp $ */
 
@@ skipping 715 matching lines @@
  * client side. See RFC 4366 section 3.6. */
 PRInt32
 ssl3_ClientSendStatusRequestXtn(sslSocket * ss, PRBool append,
                                 PRUint32 maxBytes)
 {
     PRInt32 extension_length;
 
     if (!ss->opt.enableOCSPStapling)
         return 0;
 
+    ss->ssl3.hs.may_get_cert_status = PR_FALSE;

[agl, 2013/02/21 14:57:02]

Is ssl3_HandleHelloRequest a better place for this? This fix doesn't really
depend on whether or not we send a StatusRequest extension or not on the
renegotiation.

+    if (ss->ssl3.hs.cert_status.data) {
+        SECITEM_FreeItem(&ss->ssl3.hs.cert_status, PR_FALSE);
+    }
+
     /* extension_type (2-bytes) +
      * length(extension_data) (2-bytes) +
      * status_type (1) +
      * responder_id_list length (2) +
      * request_extensions length (2)
      */
     extension_length = 9;
 
     if (append && maxBytes >= extension_length) {
         SECStatus rv;
@@ skipping 1239 matching lines @@
         return SECSuccess;
     }
 
     /* OK, we have a valid cipher and we've selected it */
     ss->ssl3.dtlsSRTPCipherSuite = cipher;
     ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ssl_use_srtp_xtn;
 
     return ssl3_RegisterServerHelloExtensionSender(ss, ssl_use_srtp_xtn,
                                                    ssl3_SendUseSRTPXtn);
 }