|
 |
652e94 |
diff --git a/lib/ssl/config.mk b/lib/ssl/config.mk
|
|
|
652e94 |
--- a/lib/ssl/config.mk
|
|
|
652e94 |
+++ b/lib/ssl/config.mk
|
|
|
652e94 |
@@ -2,16 +2,20 @@
|
|
|
652e94 |
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
|
652e94 |
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
|
652e94 |
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
652e94 |
|
|
|
652e94 |
ifdef NISCC_TEST
|
|
|
f57139 |
DEFINES += -DNISCC_TEST
|
|
|
f57139 |
endif
|
|
|
f57139 |
|
|
|
f57139 |
+ifdef NSS_NO_SSL2
|
|
|
f57139 |
+DEFINES += -DNSS_NO_SSL2
|
|
|
f57139 |
+endif
|
|
|
f57139 |
+
|
|
|
f57139 |
ifdef NSS_NO_PKCS11_BYPASS
|
|
|
f57139 |
DEFINES += -DNO_PKCS11_BYPASS
|
|
|
f57139 |
else
|
|
|
652e94 |
CRYPTOLIB=$(SOFTOKEN_LIB_DIR)/$(LIB_PREFIX)freebl.$(LIB_SUFFIX)
|
|
|
652e94 |
|
|
|
652e94 |
EXTRA_LIBS += \
|
|
|
652e94 |
$(CRYPTOLIB) \
|
|
|
652e94 |
$(NULL)
|
|
|
652e94 |
diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
|
|
|
652e94 |
--- a/lib/ssl/sslsock.c
|
|
|
652e94 |
+++ b/lib/ssl/sslsock.c
|
|
|
652e94 |
@@ -649,16 +649,24 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
|
|
|
652e94 |
if (ss->cipherSpecs) {
|
|
|
652e94 |
PORT_Free(ss->cipherSpecs);
|
|
|
652e94 |
ss->cipherSpecs = NULL;
|
|
|
652e94 |
ss->sizeCipherSpecs = 0;
|
|
|
652e94 |
}
|
|
|
652e94 |
break;
|
|
|
f57139 |
|
|
|
f57139 |
case SSL_ENABLE_SSL2:
|
|
|
f57139 |
+#ifdef NSS_NO_SSL2
|
|
|
652e94 |
+ if (on) {
|
|
|
652e94 |
+ PORT_SetError(SSL_ERROR_SSL2_DISABLED);
|
|
|
652e94 |
+ rv = SECFailure; /* not allowed */
|
|
|
652e94 |
+ }
|
|
|
652e94 |
+ break;
|
|
|
652e94 |
+ ss->opt.enableSSL2 = on;
|
|
|
f57139 |
+#else
|
|
|
f57139 |
if (IS_DTLS(ss)) {
|
|
|
652e94 |
if (on) {
|
|
|
652e94 |
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
|
|
652e94 |
rv = SECFailure; /* not allowed */
|
|
|
652e94 |
}
|
|
|
652e94 |
break;
|
|
|
652e94 |
}
|
|
|
652e94 |
ss->opt.enableSSL2 = on;
|
|
|
652e94 |
@@ -666,42 +674,51 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
|
|
|
652e94 |
ss->opt.v2CompatibleHello = on;
|
|
|
652e94 |
}
|
|
|
652e94 |
ss->preferredCipher = NULL;
|
|
|
652e94 |
if (ss->cipherSpecs) {
|
|
|
652e94 |
PORT_Free(ss->cipherSpecs);
|
|
|
652e94 |
ss->cipherSpecs = NULL;
|
|
|
652e94 |
ss->sizeCipherSpecs = 0;
|
|
|
652e94 |
}
|
|
|
652e94 |
+#endif /* NSS_NO_SSL2 */
|
|
|
652e94 |
break;
|
|
|
652e94 |
|
|
|
652e94 |
case SSL_NO_CACHE:
|
|
|
652e94 |
ss->opt.noCache = on;
|
|
|
652e94 |
break;
|
|
|
652e94 |
|
|
|
652e94 |
case SSL_ENABLE_FDX:
|
|
|
652e94 |
if (on && ss->opt.noLocks) {
|
|
|
652e94 |
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
|
|
652e94 |
rv = SECFailure;
|
|
|
652e94 |
}
|
|
|
652e94 |
ss->opt.fdx = on;
|
|
|
652e94 |
break;
|
|
|
f57139 |
|
|
|
f57139 |
case SSL_V2_COMPATIBLE_HELLO:
|
|
|
f57139 |
+#ifdef NSS_NO_SSL2
|
|
|
652e94 |
+ if (on) {
|
|
|
652e94 |
+ PORT_SetError(SSL_ERROR_SSL2_DISABLED);
|
|
|
652e94 |
+ rv = SECFailure; /* not allowed */
|
|
|
652e94 |
+ break;
|
|
|
652e94 |
+ }
|
|
|
f57139 |
+#else
|
|
|
f57139 |
if (IS_DTLS(ss)) {
|
|
|
652e94 |
if (on) {
|
|
|
652e94 |
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
|
|
652e94 |
rv = SECFailure; /* not allowed */
|
|
|
652e94 |
}
|
|
|
652e94 |
break;
|
|
|
652e94 |
}
|
|
|
652e94 |
ss->opt.v2CompatibleHello = on;
|
|
|
652e94 |
if (!on) {
|
|
|
652e94 |
ss->opt.enableSSL2 = on;
|
|
|
652e94 |
}
|
|
|
652e94 |
+#endif /* NSS_NO_SSL2 */
|
|
|
652e94 |
break;
|
|
|
652e94 |
|
|
|
652e94 |
case SSL_ROLLBACK_DETECTION:
|
|
|
652e94 |
ss->opt.detectRollBack = on;
|
|
|
652e94 |
break;
|
|
|
652e94 |
|
|
|
652e94 |
case SSL_NO_STEP_DOWN:
|
|
|
652e94 |
ss->opt.noStepDown = on;
|
|
|
652e94 |
@@ -1155,17 +1172,21 @@ SSL_CipherPolicySet(PRInt32 which, PRInt
|
|
|
652e94 |
|
|
|
652e94 |
if (rv != SECSuccess) {
|
|
|
652e94 |
return rv;
|
|
|
652e94 |
}
|
|
|
652e94 |
|
|
|
f57139 |
if (ssl_IsRemovedCipherSuite(which)) {
|
|
|
652e94 |
rv = SECSuccess;
|
|
|
f57139 |
} else if (SSL_IS_SSL2_CIPHER(which)) {
|
|
|
f57139 |
+#ifdef NSS_NO_SSL2
|
|
|
652e94 |
+ rv = SSL_ERROR_SSL2_DISABLED;
|
|
|
f57139 |
+#else
|
|
|
652e94 |
rv = ssl2_SetPolicy(which, policy);
|
|
|
652e94 |
+#endif /* NSS_NO_SSL2 */
|
|
|
f57139 |
} else {
|
|
|
652e94 |
rv = ssl3_SetPolicy((ssl3CipherSuite)which, policy);
|
|
|
f57139 |
}
|
|
|
652e94 |
return rv;
|
|
|
652e94 |
}
|
|
|
652e94 |
|
|
|
652e94 |
SECStatus
|
|
|
652e94 |
SSL_CipherPolicyGet(PRInt32 which, PRInt32 *oPolicy)
|
|
|
652e94 |
|