506ad33ba3
* Packaging
+ removed obsolete patches
* nss-disable-expired-testcerts.patch
* bug-834091.patch
* New Functionality
+ Support for OCSP Stapling (RFC 6066, Certificate Status
Request) has been added for both client and server sockets.
TLS client applications may enable this via a call to
SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING, PR_TRUE);
+ Added function SECITEM_ReallocItemV2. It replaces function
SECITEM_ReallocItem, which is now declared as obsolete.
+ Support for single-operation (eg: not multi-part) symmetric
key encryption and decryption, via PK11_Encrypt and PK11_Decrypt.
+ certutil has been updated to support creating name constraints
extensions.
* New Functions
in ssl.h
SSL_PeerStapledOCSPResponse - Returns the server's stapled
OCSP response, when used with a TLS client socket that
negotiated the status_request extension.
SSL_SetStapledOCSPResponses - Set's a stapled OCSP response
for a TLS server socket to return when clients send the
status_request extension.
in ocsp.h
CERT_PostOCSPRequest - Primarily intended for testing, permits
the sending and receiving of raw OCSP request/responses.
in secpkcs7.h
SEC_PKCS7VerifyDetachedSignatureAtTime - Verifies a PKCS#7
signature at a specific time other than the present time.
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=124
23 lines
900 B
Diff
23 lines
900 B
Diff
diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
|
|
--- a/lib/ssl/sslsock.c
|
|
+++ b/lib/ssl/sslsock.c
|
|
@@ -144,17 +144,17 @@ static sslOptions ssl_defaults = {
|
|
PR_FALSE, /* fdx */
|
|
PR_FALSE, /* v2CompatibleHello */ /* now defaults to off in NSS 3.13 */
|
|
PR_TRUE, /* detectRollBack */
|
|
PR_FALSE, /* noStepDown */
|
|
PR_FALSE, /* bypassPKCS11 */
|
|
PR_FALSE, /* noLocks */
|
|
PR_FALSE, /* enableSessionTickets */
|
|
PR_FALSE, /* enableDeflate */
|
|
- 2, /* enableRenegotiation (default: requires extension) */
|
|
+ 3, /* enableRenegotiation (default: requires extension) */
|
|
PR_FALSE, /* requireSafeNegotiation */
|
|
PR_FALSE, /* enableFalseStart */
|
|
PR_TRUE, /* cbcRandomIV */
|
|
PR_FALSE /* enableOCSPStapling */
|
|
};
|
|
|
|
/*
|
|
* default range of enabled SSL/TLS protocols
|