|
 |
92baa4 |
From 6c5bb879f09c490ad9aebf50670cbe546d0aba4a Mon Sep 17 00:00:00 2001
|
|
|
92baa4 |
From: Kamil Dudka <kdudka@redhat.com>
|
|
|
92baa4 |
Date: Fri, 7 Mar 2014 13:02:03 +0100
|
|
|
92baa4 |
Subject: [PATCH 1/3] nss: do not enable AES cipher-suites by default
|
|
|
92baa4 |
|
|
|
92baa4 |
... but allow them to be enabled/disabled explicitly. The default
|
|
|
92baa4 |
policy should be maintained at the NSS level.
|
|
|
92baa4 |
|
|
|
92baa4 |
Upstream-commit: b4f6cd46eb1b5a98573e0c0e619dc71646affdc8
|
|
|
92baa4 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
92baa4 |
---
|
|
|
92baa4 |
lib/nss.c | 27 ++++-----------------------
|
|
|
92baa4 |
1 file changed, 4 insertions(+), 23 deletions(-)
|
|
|
92baa4 |
|
|
|
92baa4 |
diff --git a/lib/nss.c b/lib/nss.c
|
|
|
92baa4 |
index abc8a91..289c55b 100644
|
|
|
92baa4 |
--- a/lib/nss.c
|
|
|
92baa4 |
+++ b/lib/nss.c
|
|
|
92baa4 |
@@ -122,6 +122,10 @@ static const cipher_s cipherlist[] = {
|
|
|
92baa4 |
{"rsa_des_56_sha", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA},
|
|
|
92baa4 |
{"rsa_rc4_56_sha", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA},
|
|
|
92baa4 |
/* AES ciphers. */
|
|
|
92baa4 |
+ {"dhe_dss_aes_128_cbc_sha", TLS_DHE_DSS_WITH_AES_128_CBC_SHA},
|
|
|
92baa4 |
+ {"dhe_dss_aes_256_cbc_sha", TLS_DHE_DSS_WITH_AES_256_CBC_SHA},
|
|
|
92baa4 |
+ {"dhe_rsa_aes_128_cbc_sha", TLS_DHE_RSA_WITH_AES_128_CBC_SHA},
|
|
|
92baa4 |
+ {"dhe_rsa_aes_256_cbc_sha", TLS_DHE_RSA_WITH_AES_256_CBC_SHA},
|
|
|
92baa4 |
{"rsa_aes_128_sha", TLS_RSA_WITH_AES_128_CBC_SHA},
|
|
|
92baa4 |
{"rsa_aes_256_sha", TLS_RSA_WITH_AES_256_CBC_SHA},
|
|
|
92baa4 |
/* ECC ciphers. */
|
|
|
92baa4 |
@@ -152,18 +156,6 @@ static const cipher_s cipherlist[] = {
|
|
|
92baa4 |
{"ecdh_anon_aes_256_sha", TLS_ECDH_anon_WITH_AES_256_CBC_SHA},
|
|
|
92baa4 |
};
|
|
|
92baa4 |
|
|
|
92baa4 |
-/* following ciphers are new in NSS 3.4 and not enabled by default, therefore
|
|
|
92baa4 |
- they are enabled explicitly */
|
|
|
92baa4 |
-static const int enable_ciphers_by_default[] = {
|
|
|
92baa4 |
- TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
|
|
|
92baa4 |
- TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
|
|
|
92baa4 |
- TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
|
|
|
92baa4 |
- TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
|
|
|
92baa4 |
- TLS_RSA_WITH_AES_128_CBC_SHA,
|
|
|
92baa4 |
- TLS_RSA_WITH_AES_256_CBC_SHA,
|
|
|
92baa4 |
- SSL_NULL_WITH_NULL_NULL
|
|
|
92baa4 |
-};
|
|
|
92baa4 |
-
|
|
|
92baa4 |
static const char* pem_library = "libnsspem.so";
|
|
|
92baa4 |
SECMODModule* mod = NULL;
|
|
|
92baa4 |
|
|
|
92baa4 |
@@ -1214,7 +1206,6 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)
|
|
|
92baa4 |
curl_socket_t sockfd = conn->sock[sockindex];
|
|
|
92baa4 |
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
|
|
|
92baa4 |
CURLcode curlerr;
|
|
|
92baa4 |
- const int *cipher_to_enable;
|
|
|
92baa4 |
PRSocketOptionData sock_opt;
|
|
|
92baa4 |
long time_left;
|
|
|
92baa4 |
PRUint32 timeout;
|
|
|
92baa4 |
@@ -1304,16 +1295,6 @@ CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)
|
|
|
92baa4 |
/* reset the flag to avoid an infinite loop */
|
|
|
92baa4 |
data->state.ssl_connect_retry = FALSE;
|
|
|
92baa4 |
|
|
|
92baa4 |
- /* enable all ciphers from enable_ciphers_by_default */
|
|
|
92baa4 |
- cipher_to_enable = enable_ciphers_by_default;
|
|
|
92baa4 |
- while(SSL_NULL_WITH_NULL_NULL != *cipher_to_enable) {
|
|
|
92baa4 |
- if(SSL_CipherPrefSet(model, *cipher_to_enable, PR_TRUE) != SECSuccess) {
|
|
|
92baa4 |
- curlerr = CURLE_SSL_CIPHER;
|
|
|
92baa4 |
- goto error;
|
|
|
92baa4 |
- }
|
|
|
92baa4 |
- cipher_to_enable++;
|
|
|
92baa4 |
- }
|
|
|
92baa4 |
-
|
|
|
92baa4 |
if(data->set.ssl.cipher_list) {
|
|
|
92baa4 |
if(set_ciphers(data, model, data->set.ssl.cipher_list) != SECSuccess) {
|
|
|
92baa4 |
curlerr = CURLE_SSL_CIPHER;
|
|
|
92baa4 |
--
|
|
|
92baa4 |
2.1.0
|
|
|
92baa4 |
|
|
|
92baa4 |
|
|
|
92baa4 |
From 0dac41d2469fe2990197912f4e2d58e1de6957e6 Mon Sep 17 00:00:00 2001
|
|
|
92baa4 |
From: Kamil Dudka <kdudka@redhat.com>
|
|
|
92baa4 |
Date: Fri, 7 Mar 2014 13:10:54 +0100
|
|
|
92baa4 |
Subject: [PATCH 2/3] nss: allow to enable/disable new HMAC-SHA256
|
|
|
92baa4 |
cipher-suites
|
|
|
92baa4 |
|
|
|
92baa4 |
... if built against a new enough version of NSS
|
|
|
92baa4 |
|
|
|
92baa4 |
Upstream-commit: c864d81289297b04dbbca14e3c5307ef15e6f258
|
|
|
92baa4 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
92baa4 |
---
|
|
|
92baa4 |
lib/nss.c | 10 ++++++++++
|
|
|
92baa4 |
1 file changed, 10 insertions(+)
|
|
|
92baa4 |
|
|
|
92baa4 |
diff --git a/lib/nss.c b/lib/nss.c
|
|
|
92baa4 |
index 289c55b..ea0d4ef 100644
|
|
|
92baa4 |
--- a/lib/nss.c
|
|
|
92baa4 |
+++ b/lib/nss.c
|
|
|
92baa4 |
@@ -154,6 +154,16 @@ static const cipher_s cipherlist[] = {
|
|
|
92baa4 |
{"ecdh_anon_3des_sha", TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA},
|
|
|
92baa4 |
{"ecdh_anon_aes_128_sha", TLS_ECDH_anon_WITH_AES_128_CBC_SHA},
|
|
|
92baa4 |
{"ecdh_anon_aes_256_sha", TLS_ECDH_anon_WITH_AES_256_CBC_SHA},
|
|
|
92baa4 |
+#ifdef TLS_RSA_WITH_NULL_SHA256
|
|
|
92baa4 |
+ /* new HMAC-SHA256 cipher suites specified in RFC */
|
|
|
92baa4 |
+ {"rsa_null_sha_256", TLS_RSA_WITH_NULL_SHA256},
|
|
|
92baa4 |
+ {"rsa_aes_128_cbc_sha_256", TLS_RSA_WITH_AES_128_CBC_SHA256},
|
|
|
92baa4 |
+ {"rsa_aes_256_cbc_sha_256", TLS_RSA_WITH_AES_256_CBC_SHA256},
|
|
|
92baa4 |
+ {"dhe_rsa_aes_128_cbc_sha_256", TLS_DHE_RSA_WITH_AES_128_CBC_SHA256},
|
|
|
92baa4 |
+ {"dhe_rsa_aes_256_cbc_sha_256", TLS_DHE_RSA_WITH_AES_256_CBC_SHA256},
|
|
|
92baa4 |
+ {"ecdhe_ecdsa_aes_128_cbc_sha_256", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256},
|
|
|
92baa4 |
+ {"ecdhe_rsa_aes_128_cbc_sha_256", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256},
|
|
|
92baa4 |
+#endif
|
|
|
92baa4 |
};
|
|
|
92baa4 |
|
|
|
92baa4 |
static const char* pem_library = "libnsspem.so";
|
|
|
92baa4 |
--
|
|
|
92baa4 |
2.1.0
|
|
|
92baa4 |
|
|
|
92baa4 |
|
|
|
92baa4 |
From f9c89d4cf767a7e2ae39ae668ec30a71513a3d98 Mon Sep 17 00:00:00 2001
|
|
|
92baa4 |
From: Kamil Dudka <kdudka@redhat.com>
|
|
|
92baa4 |
Date: Fri, 7 Mar 2014 13:14:08 +0100
|
|
|
92baa4 |
Subject: [PATCH 3/3] nss: allow to enable/disable new AES GCM cipher-suites
|
|
|
92baa4 |
|
|
|
92baa4 |
... if built against a new enough version of NSS
|
|
|
92baa4 |
|
|
|
92baa4 |
Upstream-commit: 67061e3f4ec1c2f3b4bb02bbe2d91ccdeb147c60
|
|
|
92baa4 |
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
|
|
92baa4 |
---
|
|
|
92baa4 |
lib/nss.c | 10 ++++++++++
|
|
|
92baa4 |
1 file changed, 10 insertions(+)
|
|
|
92baa4 |
|
|
|
92baa4 |
diff --git a/lib/nss.c b/lib/nss.c
|
|
|
92baa4 |
index ea0d4ef..1381dc4 100644
|
|
|
92baa4 |
--- a/lib/nss.c
|
|
|
92baa4 |
+++ b/lib/nss.c
|
|
|
92baa4 |
@@ -164,6 +164,16 @@ static const cipher_s cipherlist[] = {
|
|
|
92baa4 |
{"ecdhe_ecdsa_aes_128_cbc_sha_256", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256},
|
|
|
92baa4 |
{"ecdhe_rsa_aes_128_cbc_sha_256", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256},
|
|
|
92baa4 |
#endif
|
|
|
92baa4 |
+#ifdef TLS_RSA_WITH_AES_128_GCM_SHA256
|
|
|
92baa4 |
+ /* AES GCM cipher suites in RFC 5288 and RFC 5289 */
|
|
|
92baa4 |
+ {"rsa_aes_128_gcm_sha_256", TLS_RSA_WITH_AES_128_GCM_SHA256},
|
|
|
92baa4 |
+ {"dhe_rsa_aes_128_gcm_sha_256", TLS_DHE_RSA_WITH_AES_128_GCM_SHA256},
|
|
|
92baa4 |
+ {"dhe_dss_aes_128_gcm_sha_256", TLS_DHE_DSS_WITH_AES_128_GCM_SHA256},
|
|
|
92baa4 |
+ {"ecdhe_ecdsa_aes_128_gcm_sha_256", TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256},
|
|
|
92baa4 |
+ {"ecdh_ecdsa_aes_128_gcm_sha_256", TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256},
|
|
|
92baa4 |
+ {"ecdhe_rsa_aes_128_gcm_sha_256", TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256},
|
|
|
92baa4 |
+ {"ecdh_rsa_aes_128_gcm_sha_256", TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256},
|
|
|
92baa4 |
+#endif
|
|
|
92baa4 |
};
|
|
|
92baa4 |
|
|
|
92baa4 |
static const char* pem_library = "libnsspem.so";
|
|
|
92baa4 |
--
|
|
|
92baa4 |
2.1.0
|
|
|
92baa4 |
|