1302502 - Remove SSL_SECURITY option

Status: NEW

(NSS :: Libraries, defect, P3)

Description

[Martin Thomson [:mt:]]

Setting this option to false disables the use of SSL/TLS.  We agreed 2016-09-13 that setting this to false should cause an error and that all the associated code can be removed.

Comment 1

[Martin Thomson [:mt:]]

Firefox uses this: http://searchfox.org/mozilla-central/rev/f6c298b36db67a7109079c0dd7755f329c1d58e2/security/manager/ssl/nsNSSIOLayer.cpp#2448  We would need to change that (probably by adding and removing the SSL layer) before we could make this change.

Comment 2

[Manish [:manishkk]]

:mt
What exactly I need to remove in this file?

Need to remove all related code?
https://searchfox.org/mozilla-central/search?q=SSL_SECURITY&path=

Comment 3

[Martin Thomson [:mt:]]

This is a tricky bug because https://searchfox.org/mozilla-central/rev/5b3b6b8fd9f90087f618c20382e631451136ed2b/security/manager/ssl/nsNSSIOLayer.cpp#2513 sets the option to false for startTLS and proxies.  We would need to rework the networking code to use that.  

The fix is probably to defer adding the SSL layer to the socket, but that means moving some of the initialization that happens here, which might mess with some of the invariants that other code depends on.

You probably need to ask one of the networking folks about how to test that change properly first.  Try :nwgh perhaps.