net/third_party/nss/patches/norc4falsestart.patch - Issue 13985023: net: don't do TLS False Start with RC4.

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: net/third_party/nss/patches/norc4falsestart.patch

Issue 13985023: net: don't do TLS False Start with RC4. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src

Patch Set: Created 7 years, 8 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

OLD	NEW
(Empty)
	1 diff --git a/net/third_party/nss/ssl/ssl3con.c b/net/third_party/nss/ssl/ssl3con .c

	2 index ee96089..3b0c22e 100644

	3 --- a/net/third_party/nss/ssl/ssl3con.c

	4 +++ b/net/third_party/nss/ssl/ssl3con.c

	5 @@ -6416,7 +6416,10 @@ ssl3_CanFalseStart(sslSocket *ss) {

	6 (ss->ssl3.hs.kea_def->kea == kea_dhe_dss \|\|

	7 ss->ssl3.hs.kea_def->kea == kea_dhe_rsa \|\|

	8 ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa \|\|

	9 - ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa);

	10 + ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) &&

	11 + /* In light of recent RC4 analysis (http://www.isg.rhul.ac.uk/tls/), we

	12 + * don't allow False Start with RC4. */
	Ryan Sleevi 2013/04/15 18:08:35 In 5 years (as NSS code easily lives on), this wil In 5 years (as NSS code easily lives on), this will no longer be "recent". Perhaps reword /* Due to biases in the RC4 keystream, do not allow False Start with RC4 / agl* 2013/04/16 14:59:29 Good point. Done. Show quoted text On 2013/04/15 18:08:35, Ryan Sleevi wrote: > In 5 years (as NSS code easily lives on), this will no longer be "recent". > > Perhaps reword > > /* Due to biases in the RC4 keystream, do not allow False Start with RC4 */ Good point. Done.
	13 + ss->ssl3.cwSpec->cipher_def->cipher != cipher_rc4;

	14 ssl_ReleaseSpecReadLock(ss);

	15 return rv;

	16 }

OLD	NEW