105fd7
From f3fb07d2576c71a6409c0c1662c3b5ac61c283ab Mon Sep 17 00:00:00 2001
105fd7
From: Kamil Dudka <kdudka@redhat.com>
105fd7
Date: Fri, 18 Sep 2015 17:07:22 +0200
105fd7
Subject: [PATCH 1/2] nss: check return values of NSS functions
105fd7
105fd7
Upstream-commit: a9fd53887ba07cd8313a8b9706f2dc71d6b8ed1b
105fd7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
105fd7
---
105fd7
 lib/nss.c | 8 ++++++--
105fd7
 1 file changed, 6 insertions(+), 2 deletions(-)
105fd7
105fd7
diff --git a/lib/nss.c b/lib/nss.c
105fd7
index 0691394..763390d 100644
105fd7
--- a/lib/nss.c
105fd7
+++ b/lib/nss.c
105fd7
@@ -1491,9 +1491,13 @@ static CURLcode nss_setup_connect(struct connectdata *conn, int sockindex)
105fd7
   }
105fd7
 
105fd7
   /* Force handshake on next I/O */
105fd7
-  SSL_ResetHandshake(connssl->handle, /* asServer */ PR_FALSE);
105fd7
+  if(SSL_ResetHandshake(connssl->handle, /* asServer */ PR_FALSE)
105fd7
+      != SECSuccess)
105fd7
+    goto error;
105fd7
 
105fd7
-  SSL_SetURL(connssl->handle, conn->host.name);
105fd7
+  /* propagate hostname to the TLS layer */
105fd7
+  if(SSL_SetURL(connssl->handle, conn->host.name) != SECSuccess)
105fd7
+    goto error;
105fd7
 
105fd7
   return CURLE_OK;
105fd7
 
105fd7
-- 
105fd7
2.5.2
105fd7
105fd7
105fd7
From 6b301701920a7b36df02bd94cdde259882e521d2 Mon Sep 17 00:00:00 2001
105fd7
From: Kamil Dudka <kdudka@redhat.com>
105fd7
Date: Fri, 18 Sep 2015 17:10:05 +0200
105fd7
Subject: [PATCH 2/2] nss: prevent NSS from incorrectly re-using a session
105fd7
105fd7
Without this workaround, NSS re-uses a session cache entry despite the
105fd7
server name does not match.  This causes SNI host name to differ from
105fd7
the actual host name.  Consequently, certain servers (e.g. github.com)
105fd7
respond by 400 to such requests.
105fd7
105fd7
Bug: https://bugzilla.mozilla.org/1202264
105fd7
105fd7
Upstream-commit: 958d2ffb198166a062a0ff20d009c64972a2b374
105fd7
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
105fd7
---
105fd7
 lib/nss.c | 4 ++++
105fd7
 1 file changed, 4 insertions(+)
105fd7
105fd7
diff --git a/lib/nss.c b/lib/nss.c
105fd7
index 763390d..88d1a0d 100644
105fd7
--- a/lib/nss.c
105fd7
+++ b/lib/nss.c
105fd7
@@ -1499,6 +1499,10 @@ static CURLcode nss_setup_connect(struct connectdata *conn, int sockindex)
105fd7
   if(SSL_SetURL(connssl->handle, conn->host.name) != SECSuccess)
105fd7
     goto error;
105fd7
 
105fd7
+  /* prevent NSS from re-using the session for a different hostname */
105fd7
+  if(SSL_SetSockPeerID(connssl->handle, conn->host.name) != SECSuccess)
105fd7
+    goto error;
105fd7
+
105fd7
   return CURLE_OK;
105fd7
 
105fd7
 error:
105fd7
-- 
105fd7
2.5.2
105fd7