Index: net/third_party/nss/patches/tls12chromium.patch |
diff --git a/net/third_party/nss/patches/tls12chromium.patch b/net/third_party/nss/patches/tls12chromium.patch |
deleted file mode 100644 |
index 0d6d407cf2b3a46e8e5c8ef5b712d15a2e9427f6..0000000000000000000000000000000000000000 |
--- a/net/third_party/nss/patches/tls12chromium.patch |
+++ /dev/null |
@@ -1,100 +0,0 @@ |
-diff -pu a/nss/lib/ssl/ssl3con.c b/nss/lib/ssl/ssl3con.c |
---- a/nss/lib/ssl/ssl3con.c 2014-01-17 18:00:11.213237373 -0800 |
-+++ b/nss/lib/ssl/ssl3con.c 2014-01-17 18:04:22.497405273 -0800 |
-@@ -31,6 +31,15 @@ |
- #include "blapi.h" |
- #endif |
- |
-+/* This is a bodge to allow this code to be compiled against older NSS headers |
-+ * that don't contain the TLS 1.2 changes. */ |
-+#ifndef CKM_NSS_TLS_PRF_GENERAL_SHA256 |
-+#define CKM_NSS_TLS_PRF_GENERAL_SHA256 (CKM_NSS + 21) |
-+#define CKM_NSS_TLS_MASTER_KEY_DERIVE_SHA256 (CKM_NSS + 22) |
-+#define CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256 (CKM_NSS + 23) |
-+#define CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256 (CKM_NSS + 24) |
-+#endif |
-+ |
- #include <stdio.h> |
- #ifdef NSS_ENABLE_ZLIB |
- #include "zlib.h" |
-diff -pu a/nss/lib/ssl/ssl3ecc.c b/nss/lib/ssl/ssl3ecc.c |
---- a/nss/lib/ssl/ssl3ecc.c 2014-01-17 18:01:31.474568608 -0800 |
-+++ b/nss/lib/ssl/ssl3ecc.c 2014-01-17 18:04:22.497405273 -0800 |
-@@ -30,6 +30,12 @@ |
- |
- #include <stdio.h> |
- |
-+/* This is a bodge to allow this code to be compiled against older NSS headers |
-+ * that don't contain the TLS 1.2 changes. */ |
-+#ifndef CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256 |
-+#define CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256 (CKM_NSS + 24) |
-+#endif |
-+ |
- #ifdef NSS_ENABLE_ECC |
- |
- #ifndef PK11_SETATTRS |
-diff -pu a/nss/lib/ssl/sslsock.c b/nss/lib/ssl/sslsock.c |
---- a/nss/lib/ssl/sslsock.c 2014-01-17 18:00:11.213237373 -0800 |
-+++ b/nss/lib/ssl/sslsock.c 2014-01-17 18:04:22.497405273 -0800 |
-@@ -17,8 +17,15 @@ |
- #ifndef NO_PKCS11_BYPASS |
- #include "blapi.h" |
- #endif |
-+#include "pk11pub.h" |
- #include "nss.h" |
- |
-+/* This is a bodge to allow this code to be compiled against older NSS headers |
-+ * that don't contain the TLS 1.2 changes. */ |
-+#ifndef CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256 |
-+#define CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256 (CKM_NSS + 24) |
-+#endif |
-+ |
- #define SET_ERROR_CODE /* reminder */ |
- |
- static const sslSocketOps ssl_default_ops = { /* No SSL. */ |
-@@ -1836,6 +1843,24 @@ SSL_VersionRangeGet(PRFileDesc *fd, SSLV |
- return SECSuccess; |
- } |
- |
-+static PRCallOnceType checkTLS12TokenOnce; |
-+static PRBool tls12TokenExists; |
-+ |
-+static PRStatus |
-+ssl_CheckTLS12Token(void) |
-+{ |
-+ tls12TokenExists = |
-+ PK11_TokenExists(CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256); |
-+ return PR_SUCCESS; |
-+} |
-+ |
-+static PRBool |
-+ssl_TLS12TokenExists(void) |
-+{ |
-+ (void) PR_CallOnce(&checkTLS12TokenOnce, ssl_CheckTLS12Token); |
-+ return tls12TokenExists; |
-+} |
-+ |
- SECStatus |
- SSL_VersionRangeSet(PRFileDesc *fd, const SSLVersionRange *vrange) |
- { |
-@@ -1856,6 +1881,20 @@ SSL_VersionRangeSet(PRFileDesc *fd, cons |
- ssl_GetSSL3HandshakeLock(ss); |
- |
- ss->vrange = *vrange; |
-+ /* If we don't have a sufficiently up-to-date softoken then we cannot do |
-+ * TLS 1.2. */ |
-+ if (ss->vrange.max >= SSL_LIBRARY_VERSION_TLS_1_2 && |
-+ !ssl_TLS12TokenExists()) { |
-+ /* If the user requested a minimum version of 1.2, then we don't |
-+ * silently downgrade. */ |
-+ if (ss->vrange.min >= SSL_LIBRARY_VERSION_TLS_1_2) { |
-+ ssl_ReleaseSSL3HandshakeLock(ss); |
-+ ssl_Release1stHandshakeLock(ss); |
-+ PORT_SetError(SSL_ERROR_INVALID_VERSION_RANGE); |
-+ return SECFailure; |
-+ } |
-+ ss->vrange.max = SSL_LIBRARY_VERSION_TLS_1_1; |
-+ } |
- |
- ssl_ReleaseSSL3HandshakeLock(ss); |
- ssl_Release1stHandshakeLock(ss); |