Uprev NSS (in libssl) to NSS 3.21

net/third_party/nss/ssl/sslsecur.c

 /*
  * Various SSL functions.
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "cert.h"
 #include "secitem.h"
 #include "keyhi.h"
 #include "ssl.h"
@@ skipping 120 matching lines @@
     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
 
     SSL_TRC(3, ("%d: SSL[%d]: handshake is completed", SSL_GETPID(), ss->fd));
 
     ss->firstHsDone = PR_TRUE;
     ss->enoughFirstHsDone = PR_TRUE;
     ss->gs.writeOffset = 0;
     ss->gs.readOffset  = 0;
 
     if (ss->handshakeCallback) {
+      PORT_Assert(ss->version < SSL_LIBRARY_VERSION_3_0 ||
+                  (ss->ssl3.hs.preliminaryInfo & ssl_preinfo_all) ==
+                  ssl_preinfo_all);
         (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
     }
 }
 
 /*
  * Handshake function that blocks.  Used to force a
  * retry on a connection on the next read/write.
  */
 static SECStatus
 ssl3_AlwaysBlock(sslSocket *ss)
@@ skipping 496 matching lines @@
             ** length record) then this will force it to be correct.
             */
             PORT_SetError(PR_WOULD_BLOCK_ERROR);
             rv = SECFailure;
             goto done;
         }
         SSL_TRC(30, ("%d: SSL[%d]: partial data ready, available=%d",
                      SSL_GETPID(), ss->fd, available));
     }
 
+    if (IS_DTLS(ss) && (len < available)) {
+        /* DTLS does not allow you to do partial reads */
+        SSL_TRC(30, ("%d: SSL[%d]: DTLS short read. len=%d available=%d",
+                     SSL_GETPID(), ss->fd, len, available));
+        ss->gs.readOffset += available;
+        PORT_SetError(SSL_ERROR_RX_SHORT_DTLS_READ);
+        rv = SECFailure;
+        goto done;
+    }
+
     /* Dole out clear data to reader */
     amount = PR_MIN(len, available);
     PORT_Memcpy(out, ss->gs.buf.buf + ss->gs.readOffset, amount);
     if (!(flags & PR_MSG_PEEK)) {
         ss->gs.readOffset += amount;
     }
     PORT_Assert(ss->gs.readOffset <= ss->gs.writeOffset);
     rv = amount;
 
     SSL_TRC(30, ("%d: SSL[%d]: amount=%d available=%d",
@@ skipping 19 matching lines @@
   
   if (!cert) goto loser;
   
   tag = SECOID_GetAlgorithmTag(&(cert->subjectPublicKeyInfo.algorithm));
   
   switch (tag) {
   case SEC_OID_X500_RSA_ENCRYPTION:
   case SEC_OID_PKCS1_RSA_ENCRYPTION:
     keaType = kt_rsa;
     break;
+  case SEC_OID_ANSIX9_DSA_SIGNATURE: /* hah, signature, not a key? */
   case SEC_OID_X942_DIFFIE_HELMAN_KEY:
     keaType = kt_dh;
     break;
 #ifndef NSS_DISABLE_ECC
   case SEC_OID_ANSIX962_EC_PUBLIC_KEY:
     keaType = kt_ecdh;
     break;
 #endif /* NSS_DISABLE_ECC */
   default:
     keaType = kt_null;
@@ skipping 76 matching lines @@
     if (keyPair) {
         SECKEY_CacheStaticFlags(keyPair->privKey);
         sc->serverKeyPair = ssl3_GetKeyPairRef(keyPair);
     }
     if (kea == kt_rsa && cert && sc->serverKeyBits > 512 &&
         !ss->opt.noStepDown && !ss->stepDownKeyPair) { 
         if (ssl3_CreateRSAStepDownKeys(ss) != SECSuccess) {
             goto loser;
         }
     }
+    if (kea == ssl_kea_dh || kea == ssl_kea_rsa) {
+        if (ssl3_SelectDHParams(ss) != SECSuccess) {
+            goto loser;
+        }
+     }
     return SECSuccess;
 
 loser:
     if (localCertChain) {
         CERT_DestroyCertificateList(localCertChain);
     }
     if (sc->serverCert != NULL) {
         CERT_DestroyCertificate(sc->serverCert);
         sc->serverCert = NULL;
     }
@@ skipping 368 matching lines @@
 
     return rv;
 }
 
 /************************************************************************/
 
 
 int
 ssl_SecureRecv(sslSocket *ss, unsigned char *buf, int len, int flags)
 {
-    sslSecurityInfo *sec;
     int              rv   = 0;
 
-    sec = &ss->sec;
-
     if (ss->shutdownHow & ssl_SHUTDOWN_RCV) {
         PORT_SetError(PR_SOCKET_SHUTDOWN_ERROR);
         return PR_FAILURE;
     }
     if (flags & ~PR_MSG_PEEK) {
         PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
         return PR_FAILURE;
     }
 
     if (!ssl_SocketIsBlocking(ss) && !ss->opt.fdx) {
@@ skipping 517 matching lines @@
     if (!ss) {
         SSL_DBG(("%d: SSL[%d]: bad socket in SNISocketConfigHook",
                  SSL_GETPID(), fd));
         return SECFailure;
     }
 
     ss->sniSocketConfig = func;
     ss->sniSocketConfigArg = arg;
     return SECSuccess;
 }