Implement the encrypt-then-MAC TLS extension.

net/third_party/nss/ssl/sslsock.c

 /*
  * vtables (and methods that call through them) for the 4 types of 
  * SSLSockets supported.  Only one type is still supported.
  * Various other functions.
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "seccomon.h"
 #include "cert.h"
@@ skipping 71 matching lines @@
     PR_FALSE,   /* enableSessionTickets */
     PR_FALSE,   /* enableDeflate      */
     2,          /* enableRenegotiation (default: requires extension) */
     PR_FALSE,   /* requireSafeNegotiation */
     PR_FALSE,   /* enableFalseStart   */
     PR_TRUE,    /* cbcRandomIV        */
     PR_FALSE,   /* enableOCSPStapling */
     PR_TRUE,    /* enableNPN          */
     PR_FALSE,   /* enableALPN         */
     PR_FALSE,   /* enableSignedCertTimestamps */
-    PR_FALSE    /* enableFallbackSCSV */
+    PR_FALSE,   /* enableFallbackSCSV */
+    PR_FALSE    /* enableEncryptThenMAC */
 };
 
 /*
  * default range of enabled SSL/TLS protocols
  */
 static SSLVersionRange versions_defaults_stream = {
     SSL_LIBRARY_VERSION_3_0,
     SSL_LIBRARY_VERSION_TLS_1_0
 };
 
@@ skipping 687 matching lines @@
         break;
 
       case SSL_ENABLE_SIGNED_CERT_TIMESTAMPS:
         ss->opt.enableSignedCertTimestamps = on;
         break;
 
       case SSL_ENABLE_FALLBACK_SCSV:
        ss->opt.enableFallbackSCSV = on;
        break;
 
+      case SSL_ENABLE_ENCRYPT_THEN_MAC:
+       ss->opt.enableEncryptThenMAC = on;
+       break;
+
       default:
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         rv = SECFailure;
     }
 
     /* We can't use the macros for releasing the locks here,
      * because ss->opt.noLocks might have changed just above.
      * We must release these locks (monitors) here, if we aquired them above,
      * regardless of the current value of ss->opt.noLocks.
      */
@@ skipping 56 matching lines @@
                                   on = ss->opt.requireSafeNegotiation; break;
     case SSL_ENABLE_FALSE_START:  on = ss->opt.enableFalseStart;   break;
     case SSL_CBC_RANDOM_IV:       on = ss->opt.cbcRandomIV;        break;
     case SSL_ENABLE_OCSP_STAPLING: on = ss->opt.enableOCSPStapling; break;
     case SSL_ENABLE_NPN:          on = ss->opt.enableNPN;          break;
     case SSL_ENABLE_ALPN:         on = ss->opt.enableALPN;         break;
     case SSL_ENABLE_SIGNED_CERT_TIMESTAMPS:
         on = ss->opt.enableSignedCertTimestamps;
         break;
     case SSL_ENABLE_FALLBACK_SCSV: on = ss->opt.enableFallbackSCSV; break;
+    case SSL_ENABLE_ENCRYPT_THEN_MAC: on = ss->opt.enableEncryptThenMAC; break;
 
     default:
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         rv = SECFailure;
     }
 
     ssl_ReleaseSSL3HandshakeLock(ss);
     ssl_Release1stHandshakeLock(ss);
 
     *pOn = on;
@@ skipping 49 matching lines @@
        on = ssl_defaults.enableOCSPStapling;
        break;
     case SSL_ENABLE_NPN:          on = ssl_defaults.enableNPN;          break;
     case SSL_ENABLE_ALPN:         on = ssl_defaults.enableALPN;         break;
     case SSL_ENABLE_SIGNED_CERT_TIMESTAMPS:
         on = ssl_defaults.enableSignedCertTimestamps;
         break;
     case SSL_ENABLE_FALLBACK_SCSV:
         on = ssl_defaults.enableFallbackSCSV;
         break;
+    case SSL_ENABLE_ENCRYPT_THEN_MAC:
+        on = ssl_defaults.enableEncryptThenMAC;
+        break;
 
     default:
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         rv = SECFailure;
     }
 
     *pOn = on;
     return rv;
 }
 
@@ skipping 163 matching lines @@
         break;
 
       case SSL_ENABLE_SIGNED_CERT_TIMESTAMPS:
         ssl_defaults.enableSignedCertTimestamps = on;
         break;
 
       case SSL_ENABLE_FALLBACK_SCSV:
        ssl_defaults.enableFallbackSCSV = on;
        break;
 
+      case SSL_ENABLE_ENCRYPT_THEN_MAC:
+       ssl_defaults.enableEncryptThenMAC = on;
+       break;
+
       default:
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
     return SECSuccess;
 }
 
 /* function tells us if the cipher suite is one that we no longer support. */
 static PRBool 
 ssl_IsRemovedCipherSuite(PRInt32 suite)
@@ skipping 1981 matching lines @@
 loser:
             ssl_DestroySocketContents(ss);
             ssl_DestroyLocks(ss);
             PORT_Free(ss);
             ss = NULL;
         }
     }
     return ss;
 }