Mercurial > hg > release > icedtea6-1.13
changeset 3180:62e04f490bb4
PR1832, RH1022017: Report elliptic curves supported by NSS, not the SunEC library
2014-06-10 Andrew John Hughes <gnu.andrew@member.fsf.org>
PR1832, RH1022017: Report elliptic curves
supported by NSS, not the SunEC library
* Makefile.am:
(ICEDTEA_PATCHES): Add new patch when
PKCS11+NSS or SunEC+NSS are enabled, so
that the NSS set of curves are announced
via SSL.
* NEWS: Updated.
* patches/rh1022017.patch:
Reduce number of curves announced over SSL
to just those supported by NSS.
| author | Andrew John Hughes <gnu.andrew@redhat.com> |
|---|---|
| date | Tue, 20 Jan 2015 05:59:10 +0000 |
| parents | 72e1b748868f |
| children | 0f903bacbe64 |
| files | ChangeLog Makefile.am NEWS patches/rh1022017.patch |
| diffstat | 4 files changed, 60 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/ChangeLog Tue Jan 20 05:57:38 2015 +0000 +++ b/ChangeLog Tue Jan 20 05:59:10 2015 +0000 @@ -1,3 +1,17 @@ +2014-06-10 Andrew John Hughes <gnu.andrew@member.fsf.org> + + PR1832, RH1022017: Report elliptic curves + supported by NSS, not the SunEC library + * Makefile.am: + (ICEDTEA_PATCHES): Add new patch when + PKCS11+NSS is enabled, so + that the NSS set of curves are announced + via SSL. + * NEWS: Updated. + * patches/rh1022017.patch: + Reduce number of curves announced over SSL + to just those supported by NSS. + 2014-06-10 Andrew John Hughes <gnu.andrew@member.fsf.org> PR1831: Drop version requirement for LCMS 2
--- a/Makefile.am Tue Jan 20 05:57:38 2015 +0000 +++ b/Makefile.am Tue Jan 20 05:59:10 2015 +0000 @@ -659,6 +659,7 @@ endif if ENABLE_NSS +ICEDTEA_PATCHES += patches/rh1022017.patch NSS_PATCHES = patches/nss-config.patch else NSS_PATCHES = patches/nss-not-enabled-config.patch
--- a/NEWS Tue Jan 20 05:57:38 2015 +0000 +++ b/NEWS Tue Jan 20 05:59:10 2015 +0000 @@ -20,6 +20,7 @@ - S8000897, RH1155012: VM crash in CompileBroker * Bug fixes - PR1831: Drop version requirement for LCMS 2 + - PR1832, RH1022017: Report elliptic curves supported by NSS, not the SunEC library - PR2033: patches/ecj/jaxws-getdtdtype.patch no longer applies since removal of JAXWS drop New in release 1.13.5 (2014-10-14):
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/rh1022017.patch Tue Jan 20 05:59:10 2015 +0000 @@ -0,0 +1,44 @@ +diff -r cdfd161703ed src/share/classes/sun/security/ssl/HelloExtensions.java +--- openjdk/jdk/src/share/classes/sun/security/ssl/HelloExtensions.java Wed Oct 23 05:22:55 2013 +0100 ++++ openjdk/jdk/src/share/classes/sun/security/ssl/HelloExtensions.java Thu Nov 07 12:41:45 2013 +0000 +@@ -435,25 +435,11 @@ + // the extension value to send in the ClientHello message + static final SupportedEllipticCurvesExtension DEFAULT; + +- private static final boolean fips; +- + static { +- int[] ids; +- fips = SunJSSE.isFIPS(); +- if (fips == false) { +- ids = new int[] { +- // NIST curves first +- // prefer NIST P-256, rest in order of increasing key length +- 23, 1, 3, 19, 21, 6, 7, 9, 10, 24, 11, 12, 25, 13, 14, +- // non-NIST curves +- 15, 16, 17, 2, 18, 4, 5, 20, 8, 22, +- }; +- } else { +- ids = new int[] { +- // same as above, but allow only NIST curves in FIPS mode +- 23, 1, 3, 19, 21, 6, 7, 9, 10, 24, 11, 12, 25, 13, 14, +- }; +- } ++ int[] ids = new int[] { ++ // NSS currently only supports these three NIST curves ++ 23, 24, 25 ++ }; + DEFAULT = new SupportedEllipticCurvesExtension(ids); + } + +@@ -545,10 +531,6 @@ + if ((index <= 0) || (index >= NAMED_CURVE_OID_TABLE.length)) { + return false; + } +- if (fips == false) { +- // in non-FIPS mode, we support all valid indices +- return true; +- } + return DEFAULT.contains(index); + } +