Mercurial > hg > release > icedtea7-2.6
changeset 2725:1e199b277a83
PR1833, RH1022017: Report elliptic curves supported by NSS, not the SunEC library
2014-06-10 Andrew John Hughes <gnu.andrew@member.fsf.org>
PR1833, RH1022017: Report elliptic curves
supported by NSS, not the SunEC library
* NEWS: Updated.
* Makefile.am:
(ICEDTEA_PATCHES): Add new patch when
PKCS11+NSS or SunEC+NSS are enabled, so
that the NSS set of curves are announced
via SSL.
* patches/rh1022017.patch:
Reduce number of curves announced over SSL
to just those supported by NSS.
author | Andrew John Hughes <gnu_andrew@member.fsf.org> |
---|---|
date | Wed, 11 Jun 2014 02:35:36 +0100 |
parents | 4a2fdacd0277 |
children | 38b2afc62b2d |
files | ChangeLog Makefile.am NEWS patches/rh1022017.patch |
diffstat | 4 files changed, 67 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/ChangeLog Wed Jun 11 02:34:28 2014 +0100 +++ b/ChangeLog Wed Jun 11 02:35:36 2014 +0100 @@ -1,3 +1,17 @@ +2014-06-10 Andrew John Hughes <gnu.andrew@member.fsf.org> + + PR1833, RH1022017: Report elliptic curves + supported by NSS, not the SunEC library + * NEWS: Updated. + * Makefile.am: + (ICEDTEA_PATCHES): Add new patch when + PKCS11+NSS or SunEC+NSS are enabled, so + that the NSS set of curves are announced + via SSL. + * patches/rh1022017.patch: + Reduce number of curves announced over SSL + to just those supported by NSS. + 2014-06-10 Andrew John Hughes <gnu.andrew@member.fsf.org> PR1830: Drop version requirement for LCMS 2
--- a/Makefile.am Wed Jun 11 02:34:28 2014 +0100 +++ b/Makefile.am Wed Jun 11 02:35:36 2014 +0100 @@ -292,7 +292,14 @@ endif if ENABLE_NSS -ICEDTEA_PATCHES += patches/nss-config.patch +ICEDTEA_PATCHES += patches/nss-config.patch \ + patches/rh1022017.patch +endif + +if ENABLE_SUNEC +if !ENABLE_NSS +ICEDTEA_PATCHES += patches/rh1022017.patch +endif endif if WITH_ALT_HSBUILD
--- a/NEWS Wed Jun 11 02:34:28 2014 +0100 +++ b/NEWS Wed Jun 11 02:35:36 2014 +0100 @@ -190,6 +190,7 @@ - PR1371: Provide option to build without debugging - PR1827: Support AM_MAINTAINER_MODE - PR1830: Drop version requirement for LCMS 2 + - PR1833, RH1022017: Report elliptic curves supported by NSS, not the SunEC library New in release 2.5.0 (2014-XX-XX):
--- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/patches/rh1022017.patch Wed Jun 11 02:35:36 2014 +0100 @@ -0,0 +1,44 @@ +diff -r cdfd161703ed src/share/classes/sun/security/ssl/HelloExtensions.java +--- openjdk/jdk/src/share/classes/sun/security/ssl/HelloExtensions.java Wed Oct 23 05:22:55 2013 +0100 ++++ openjdk/jdk/src/share/classes/sun/security/ssl/HelloExtensions.java Thu Nov 07 12:41:45 2013 +0000 +@@ -435,25 +435,11 @@ + // the extension value to send in the ClientHello message + static final SupportedEllipticCurvesExtension DEFAULT; + +- private static final boolean fips; +- + static { +- int[] ids; +- fips = SunJSSE.isFIPS(); +- if (fips == false) { +- ids = new int[] { +- // NIST curves first +- // prefer NIST P-256, rest in order of increasing key length +- 23, 1, 3, 19, 21, 6, 7, 9, 10, 24, 11, 12, 25, 13, 14, +- // non-NIST curves +- 15, 16, 17, 2, 18, 4, 5, 20, 8, 22, +- }; +- } else { +- ids = new int[] { +- // same as above, but allow only NIST curves in FIPS mode +- 23, 1, 3, 19, 21, 6, 7, 9, 10, 24, 11, 12, 25, 13, 14, +- }; +- } ++ int[] ids = new int[] { ++ // NSS currently only supports these three NIST curves ++ 23, 24, 25 ++ }; + DEFAULT = new SupportedEllipticCurvesExtension(ids); + } + +@@ -545,10 +531,6 @@ + if ((index <= 0) || (index >= NAMED_CURVE_OID_TABLE.length)) { + return false; + } +- if (fips == false) { +- // in non-FIPS mode, we support all valid indices +- return true; +- } + return DEFAULT.contains(index); + } +