Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-29 07:42:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 716636, Part 1: Fix TLS toleraance lock reentrence, r=honzab

Browse Source
This commit is contained in:
Brian Smith 2012-01-31 05:19:25 -08:00
parent d61f0dc5d6
commit 7c5351e6de
3 changed files with 30 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
security/manager/ssl/src/nsNSSCallbacks.cpp
View File

@ -836,7 +836,7 @@ void PR_CALLBACK HandshakeCallback(PRFileDesc* fd, void* client_data) {
// If the handshake completed, then we know the site is TLS tolerant (if this
// was a TLS connection).
nsSSLIOLayerHelpers::rememberTolerantSite(fd, infoObject);
nsSSLIOLayerHelpers::rememberTolerantSite(infoObject);
if (SECSuccess != SSL_SecurityStatus(fd, &sslStatus, &cipherName, &keyLength,
&encryptBits, &signer, nsnull)) {

41
security/manager/ssl/src/nsNSSIOLayer.cpp
View File

@ -164,6 +164,8 @@ nsNSSSocketInfo::nsNSSSocketInfo()
mErrorCode(0),
mErrorMessageType(PlainErrorMessage),
mForSTARTTLS(false),
mSSL3Enabled(false),
mTLSEnabled(false),
mHandshakePending(true),
mHasCleartextPhase(false),
mHandshakeInProgress(false),
@ -1759,16 +1761,13 @@ nsSSLIOLayerHelpers::getSiteKey(nsNSSSocketInfo *socketInfo, nsCSubstring &key)
// Call this function to report a site that is possibly TLS intolerant.
// This function will return true, if the given socket is currently using TLS.
bool
nsSSLIOLayerHelpers::rememberPossibleTLSProblemSite(PRFileDesc* ssl_layer_fd, nsNSSSocketInfo *socketInfo)
nsSSLIOLayerHelpers::rememberPossibleTLSProblemSite(nsNSSSocketInfo *socketInfo)
{
PRBool currentlyUsesTLS = false;
nsCAutoString key;
getSiteKey(socketInfo, key);
SSL_OptionGet(ssl_layer_fd, SSL_ENABLE_TLS, &currentlyUsesTLS);
if (!currentlyUsesTLS) {
// We were not using TLS but failed with an intolerant error using
if (!socketInfo->IsTLSEnabled()) {
// We did not offer TLS but failed with an intolerant error using
// a different protocol. To give TLS a try on next connection attempt again
// drop this site from the list of intolerant sites. TLS failure might be
// caused only by a traffic congestion while the server is TLS tolerant.
@ -1776,27 +1775,19 @@ nsSSLIOLayerHelpers::rememberPossibleTLSProblemSite(PRFileDesc* ssl_layer_fd, ns
return false;
}
PRBool enableSSL3 = false;
SSL_OptionGet(ssl_layer_fd, SSL_ENABLE_SSL3, &enableSSL3);
if (enableSSL3) {
if (socketInfo->IsSSL3Enabled()) {
// Add this site to the list of TLS intolerant sites.
addIntolerantSite(key);
}
return currentlyUsesTLS;
return socketInfo->IsTLSEnabled();
}
void
nsSSLIOLayerHelpers::rememberTolerantSite(PRFileDesc* ssl_layer_fd,
nsNSSSocketInfo *socketInfo)
nsSSLIOLayerHelpers::rememberTolerantSite(nsNSSSocketInfo *socketInfo)
{
PRBool usingSecurity = false;
PRBool currentlyUsesTLS = false;
SSL_OptionGet(ssl_layer_fd, SSL_SECURITY, &usingSecurity);
SSL_OptionGet(ssl_layer_fd, SSL_ENABLE_TLS, &currentlyUsesTLS);
if (!usingSecurity || !currentlyUsesTLS) {
if (!socketInfo->IsTLSEnabled())
return;
}
nsCAutoString key;
getSiteKey(socketInfo, key);
@ -2024,7 +2015,7 @@ PRInt32 checkHandshake(PRInt32 bytesTransfered, bool wasReading,
if (!wantRetry // no decision yet
&& isTLSIntoleranceError(err, socketInfo->GetHasCleartextPhase()))
{
wantRetry = nsSSLIOLayerHelpers::rememberPossibleTLSProblemSite(ssl_layer_fd, socketInfo);
wantRetry = nsSSLIOLayerHelpers::rememberPossibleTLSProblemSite(socketInfo);
}
}
@ -2052,7 +2043,7 @@ PRInt32 checkHandshake(PRInt32 bytesTransfered, bool wasReading,
&& !socketInfo->GetHasCleartextPhase()) // mirror PR_CONNECT_RESET_ERROR treament
{
wantRetry =
nsSSLIOLayerHelpers::rememberPossibleTLSProblemSite(ssl_layer_fd, socketInfo);
nsSSLIOLayerHelpers::rememberPossibleTLSProblemSite(socketInfo);
}
}
}
@ -3915,6 +3906,16 @@ nsSSLIOLayerSetOptions(PRFileDesc *fd, bool forSTARTTLS,
// on our single retry attempt.
}
PRBool enabled;
if (SECSuccess != SSL_OptionGet(fd, SSL_ENABLE_SSL3, &enabled)) {
return NS_ERROR_FAILURE;
}
infoObject->SetSSL3Enabled(enabled);
if (SECSuccess != SSL_OptionGet(fd, SSL_ENABLE_TLS, &enabled)) {
return NS_ERROR_FAILURE;
}
infoObject->SetTLSEnabled(enabled);
if (SECSuccess != SSL_OptionSet(fd, SSL_HANDSHAKE_AS_CLIENT, true)) {
return NS_ERROR_FAILURE;
}

11
security/manager/ssl/src/nsNSSIOLayer.h
View File

@ -177,7 +177,10 @@ public:
return mCertVerificationState == waiting_for_cert_verification;
}
bool IsSSL3Enabled() const { return mSSL3Enabled; }
void SetSSL3Enabled(bool enabled) { mSSL3Enabled = enabled; }
bool IsTLSEnabled() const { return mTLSEnabled; }
void SetTLSEnabled(bool enabled) { mTLSEnabled = enabled; }
protected:
mutable ::mozilla::Mutex mMutex;
@ -201,6 +204,8 @@ protected:
bool mDocShellDependentStuffKnown;
bool mExternalErrorReporting; // DocShellDependent
bool mForSTARTTLS;
bool mSSL3Enabled;
bool mTLSEnabled;
bool mHandshakePending;
bool mHasCleartextPhase;
bool mHandshakeInProgress;
@ -280,8 +285,8 @@ public:
static PRInt32 getWarnLevelMissingRFC5746();
static void getSiteKey(nsNSSSocketInfo *socketInfo, nsCSubstring &key);
static bool rememberPossibleTLSProblemSite(PRFileDesc* fd, nsNSSSocketInfo *socketInfo);
static void rememberTolerantSite(PRFileDesc* ssl_layer_fd, nsNSSSocketInfo *socketInfo);
static bool rememberPossibleTLSProblemSite(nsNSSSocketInfo *socketInfo);
static void rememberTolerantSite(nsNSSSocketInfo *socketInfo);
static void addIntolerantSite(const nsCString &str);
static void removeIntolerantSite(const nsCString &str);