mozilla-nss/renegotiate-transitional.patch

diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
--- a/lib/ssl/sslsock.c
+++ b/lib/ssl/sslsock.c
@@ -72,17 +72,17 @@ static sslOptions ssl_defaults = {
     PR_FALSE,
     /* v2CompatibleHello  */ /* now defaults to off in NSS 3.13 */
     PR_TRUE,                 /* detectRollBack     */
     PR_FALSE,                /* noStepDown         */
     PR_FALSE,                /* bypassPKCS11       */
     PR_FALSE,                /* noLocks            */
     PR_FALSE,                /* enableSessionTickets */
     PR_FALSE,                /* enableDeflate      */
-    2,                       /* enableRenegotiation (default: requires extension) */
+    3,                       /* enableRenegotiation (default: requires extension) */
     PR_FALSE,                /* requireSafeNegotiation */
     PR_FALSE,                /* enableFalseStart   */
     PR_TRUE,                 /* cbcRandomIV        */
     PR_FALSE,                /* enableOCSPStapling */
     PR_TRUE,                 /* enableNPN          */
     PR_FALSE,                /* enableALPN         */
     PR_TRUE,                 /* reuseServerECDHEKey */
     PR_FALSE,                /* enableFallbackSCSV */
- update to 3.15 * Packaging + removed obsolete patches * nss-disable-expired-testcerts.patch * bug-834091.patch * New Functionality + Support for OCSP Stapling (RFC 6066, Certificate Status Request) has been added for both client and server sockets. TLS client applications may enable this via a call to SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING, PR_TRUE); + Added function SECITEM_ReallocItemV2. It replaces function SECITEM_ReallocItem, which is now declared as obsolete. + Support for single-operation (eg: not multi-part) symmetric key encryption and decryption, via PK11_Encrypt and PK11_Decrypt. + certutil has been updated to support creating name constraints extensions. * New Functions in ssl.h SSL_PeerStapledOCSPResponse - Returns the server's stapled OCSP response, when used with a TLS client socket that negotiated the status_request extension. SSL_SetStapledOCSPResponses - Set's a stapled OCSP response for a TLS server socket to return when clients send the status_request extension. in ocsp.h CERT_PostOCSPRequest - Primarily intended for testing, permits the sending and receiving of raw OCSP request/responses. in secpkcs7.h SEC_PKCS7VerifyDetachedSignatureAtTime - Verifies a PKCS#7 signature at a specific time other than the present time. OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=124 2013-06-11 17:41:13 +02:00			`diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c`
			`--- a/lib/ssl/sslsock.c`
			`+++ b/lib/ssl/sslsock.c`
- update to NSS 3.23 New functionality: * ChaCha20/Poly1305 cipher and TLS cipher suites now supported * Experimental-only support TLS 1.3 1-RTT mode (draft-11). This code is not ready for production use. New functions: * SSL_SetDowngradeCheckVersion - Set maximum version for new ServerRandom anti-downgrade mechanism. Clients that perform a version downgrade (which is generally a very bad idea) call this with the highest version number that they possibly support. This gives them access to the version downgrade protection from TLS 1.3. Notable changes: * The copy of SQLite shipped with NSS has been updated to version 3.10.2 * The list of TLS extensions sent in the TLS handshake has been reordered to increase compatibility of the Extended Master Secret with with servers * The build time environment variable NSS_ENABLE_ZLIB has been renamed to NSS_SSL_ENABLE_ZLIB * The build time environment variable NSS_DISABLE_CHACHAPOLY was added, which can be used to prevent compilation of the ChaCha20/Poly1305 code. * The following CA certificates were Removed - Staat der Nederlanden Root CA - NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado - NetLock Kozjegyzoi (Class A) Tanusitvanykiado - NetLock Uzleti (Class B) Tanusitvanykiado - NetLock Expressz (Class C) Tanusitvanykiado - VeriSign Class 1 Public PCA – G2 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=212 2016-05-26 22:20:47 +02:00			`@@ -72,17 +72,17 @@ static sslOptions ssl_defaults = {`
			`PR_FALSE,`
			`/* v2CompatibleHello / / now defaults to off in NSS 3.13 */`
			`PR_TRUE, /* detectRollBack */`
			`PR_FALSE, /* noStepDown */`
			`PR_FALSE, /* bypassPKCS11 */`
			`PR_FALSE, /* noLocks */`
			`PR_FALSE, /* enableSessionTickets */`
			`PR_FALSE, /* enableDeflate */`
			`- 2, /* enableRenegotiation (default: requires extension) */`
			`+ 3, /* enableRenegotiation (default: requires extension) */`
			`PR_FALSE, /* requireSafeNegotiation */`
			`PR_FALSE, /* enableFalseStart */`
			`PR_TRUE, /* cbcRandomIV */`
			`PR_FALSE, /* enableOCSPStapling */`
			`PR_TRUE, /* enableNPN */`
			`PR_FALSE, /* enableALPN */`
			`PR_TRUE, /* reuseServerECDHEKey */`
			`PR_FALSE, /* enableFallbackSCSV */`