1183395 - Spurious branch in ssl3_HandleServerHello

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Eric Rescorla (:ekr)]

Currently the code reads:


    if (ss->ssl3.hs.kea_def->signKeyType != sign_null) {
        /* All current cipher suites other than those with sign_null (i.e.,
         * DH_anon_* suites) require a certificate, so use that signal. */
        ss->ssl3.hs.ws = wait_server_cert;
    } else if (ss->ssl3.hs.kea_def->ephemeral) {
        /* Only ephemeral cipher suites use ServerKeyExchange. */
        ss->ssl3.hs.ws = wait_server_key;
    } else {
        ss->ssl3.hs.ws = wait_cert_request;
    }

But the last arm of this is bogus because the only negotiable suites
in NSS which have sign_null are (EC)DH_anon.

Comment 1

[Kai Engert [:KaiE:]]

I see a commit for this bug:
  https://hg.mozilla.org/projects/nss/rev/e41b7af9223f

It mentions the patch has r=mt, I guess this was done elsewhere.

Can this bug be marked resolved, target milestone 3.21 ?

Comment 2

[Eric Rescorla (:ekr)]

Yes, we reviewed it on Rietveld.

https://codereview.appspot.com/251170043/


Yes, we can mark it resolved.