Certificate Transparency TLS extension patch for NSS

net/third_party/nss/ssl/sslnonce.c

 /* 
  * This file implements the CLIENT Session ID cache.  
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "cert.h"
 #include "pk11pub.h"
 #include "secitem.h"
@@ skipping 124 matching lines @@
     for (i = 0; i < MAX_PEER_CERT_CHAIN_SIZE && sid->peerCertChain[i]; i++) {
         CERT_DestroyCertificate(sid->peerCertChain[i]);
     }
     if (sid->peerCertStatus.items) {
         SECITEM_FreeArray(&sid->peerCertStatus, PR_FALSE);
     }
 
     if ( sid->localCert ) {
         CERT_DestroyCertificate(sid->localCert);
     }
-    if (sid->u.ssl3.sessionTicket.ticket.data) {
-        SECITEM_FreeItem(&sid->u.ssl3.sessionTicket.ticket, PR_FALSE);
+
+    if (sid->version >= SSL_LIBRARY_VERSION_3_0) {

[wtc, 2013/11/08 19:51:31]

We are planning to remove the SSL 2.0 code within twelve months, so I suggest we
not add this sid->version check.

[ekasper, 2013/11/18 17:47:18]

u is a union and u.ssl3 is only valid for a 3.0 session, so I think we need this
check. (In practice this is tail end of the union so should be zeroed for ssl2,
but still.)

[wtc, 2013/11/19 23:52:28]

I see. This makes sense, thanks.

I suggest that we combine this with the if statement on lines 122-125.

[ekasper, 2013/11/20 16:06:27]

Done.

+        if (sid->u.ssl3.sessionTicket.ticket.data) {
+            SECITEM_FreeItem(&sid->u.ssl3.sessionTicket.ticket, PR_FALSE);
+        }
+        if (sid->u.ssl3.srvName.data) {
+            SECITEM_FreeItem(&sid->u.ssl3.srvName, PR_FALSE);
+        }
+        if (sid->u.ssl3.signedCertTimestamps.data) {
+            SECITEM_FreeItem(&sid->u.ssl3.signedCertTimestamps, PR_FALSE);
+        }
     }
-    if (sid->u.ssl3.srvName.data) {
-        SECITEM_FreeItem(&sid->u.ssl3.srvName, PR_FALSE);
-    }
-    
+
     PORT_ZFree(sid, sizeof(sslSessionID));
 }
 
 /* BEWARE: This function gets called for both client and server SIDs !!
  * Decrement reference count, and 
  *    free sid if ref count is zero, and sid is not in the cache. 
  * Does NOT remove from the cache first.  
  * If the sid is still in the cache, it is left there until next time
  * the cache list is traversed.
  */
@@ skipping 285 matching lines @@
         sid->u.ssl3.sessionTicket.ticket.len = 0;
     }
     sid->u.ssl3.sessionTicket.received_timestamp =
         session_ticket->received_timestamp;
     sid->u.ssl3.sessionTicket.ticket_lifetime_hint =
         session_ticket->ticket_lifetime_hint;
 
     UNLOCK_CACHE;
     return SECSuccess;
 }