Make SSL False Start work with asynchronous certificate validation

net/third_party/nss/ssl/sslauth.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "cert.h"
 #include "secitem.h"
 #include "ssl.h"
 #include "sslimpl.h"
 #include "sslproto.h"
 #include "pk11func.h"
 #include "ocsp.h"
@@ skipping 77 matching lines @@
 
 
 /* NEED LOCKS IN HERE.  */
 SECStatus
 SSL_SecurityStatus(PRFileDesc *fd, int *op, char **cp, int *kp0, int *kp1,
                    char **ip, char **sp)
 {
     sslSocket *ss;
     const char *cipherName;
     PRBool isDes = PR_FALSE;
-    PRBool enoughFirstHsDone = PR_FALSE;
 
     ss = ssl_FindSocket(fd);
     if (!ss) {
         SSL_DBG(("%d: SSL[%d]: bad socket in SecurityStatus",
                  SSL_GETPID(), fd));
         return SECFailure;
     }
 
     if (cp) *cp = 0;
     if (kp0) *kp0 = 0;
     if (kp1) *kp1 = 0;
     if (ip) *ip = 0;
     if (sp) *sp = 0;
     if (op) {
         *op = SSL_SECURITY_STATUS_OFF;
     }
 
-    if (ss->firstHsDone) {
-        enoughFirstHsDone = PR_TRUE;
-    } else if (ss->version >= SSL_LIBRARY_VERSION_3_0 &&
-               ssl3_CanFalseStart(ss)) {
-        enoughFirstHsDone = PR_TRUE;
-    }
-
-    if (ss->opt.useSecurity && enoughFirstHsDone) {
+    if (ss->opt.useSecurity && ss->enoughFirstHsDone) {
         if (ss->version < SSL_LIBRARY_VERSION_3_0) {
             cipherName = ssl_cipherName[ss->sec.cipherType];
         } else {
             cipherName = ssl3_cipherName[ss->sec.cipherType];
         }
         PORT_Assert(cipherName);
         if (cipherName) {
             if (PORT_Strstr(cipherName, "DES")) isDes = PR_TRUE;
 
             if (cp) {
                 *cp = PORT_Strdup(cipherName);
             }
         }
 
         if (kp0) {
             *kp0 = ss->sec.keyBits;
             if (isDes) *kp0 = (*kp0 * 7) / 8;
         }
         if (kp1) {
             *kp1 = ss->sec.secretKeyBits;
             if (isDes) *kp1 = (*kp1 * 7) / 8;
         }
         if (op) {
             if (ss->sec.keyBits == 0) {
                 *op = SSL_SECURITY_STATUS_OFF;
             } else if (ss->sec.secretKeyBits < 90) {

[wtc, 2013/09/18 22:57:23]

This doesn't really matter because we don't have any cipher suite that
uses 80 or 90-bit keys, but it seems that "90" should be changed to "80"
here.

[agl, 2013/09/19 16:59:32]

That seems reasonable, although then I think it should be "<= 80", not "< 80",
no?

                 *op = SSL_SECURITY_STATUS_ON_LOW;
 
             } else {
                 *op = SSL_SECURITY_STATUS_ON_HIGH;
             }
         }
 
         if (ip || sp) {
             CERTCertificate *cert;
 
@@ skipping 163 matching lines @@
     hostname = ss->url;
     if (hostname && hostname[0])
         rv = CERT_VerifyCertName(ss->sec.peerCert, hostname);
     else 
         rv = SECFailure;
     if (rv != SECSuccess)
         PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
 
     return rv;
 }