1347429 - Deprecated SSL 3.0 cipher names in SSLSocket class.

Status: VERIFIED FIXED

(JSS Graveyard :: Library, defect)

Description

[Endi S. Dewata]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Build ID: 20170125094131

Steps to reproduce:

Some SSL 3.0 cipher names have been replaced with IANA-registered TLS names. See https://github.com/nss-dev/nss/blob/master/lib/ssl/sslproto.h.


Actual results:

In the SSLSocket class the deprecation is only documented as comments and the replacement cipher names are not defined.


Expected results:

The old cipher names should be deprecated, and the replacement cipher names should be defined with the same cipher IDs. This will allow applications to migrate to the new cipher names while maintaining backward compatibility.

Comment 1

[Endi S. Dewata]

Attachment: 0001-Reformatted-cipher-definitions-in-SSLSocket-class.patch

The cipher definitions in SSLSocket class have been moved to the
top of the class and reformatted for better readability.

Comment 2

[Endi S. Dewata]

Attachment: 0002-Added-annotations-for-deprecated-SSL-3.0-ciphers.patch

Some SSL 3.0 ciphers have deprecated according to this list:
https://github.com/nss-dev/nss/blob/master/lib/ssl/sslproto.h

The deprecated cipher definitions have been marked accordingly
in the SSLSocket class. The replacement cipher definitions (if
any) have been added with the same cipher IDs.

Comment 3

[Endi S. Dewata]

Depends on bug #1347394 due to formatting.

Comment 4

[Elio Maldonado]

Comment on attachment 8848671 [details] [diff] [review]
0001-Reformatted-cipher-definitions-in-SSLSocket-class.patch

Review of attachment 8848671 [details] [diff] [review]:
-----------------------------------------------------------------

r+, Applies cleanly and no extra warnings on the build, ran test and all pass.

Comment 5

[Elio Maldonado]

Comment on attachment 8848672 [details] [diff] [review]
0002-Added-annotations-for-deprecated-SSL-3.0-ciphers.patch

Review of attachment 8848672 [details] [diff] [review]:
-----------------------------------------------------------------

r+, Applies cleanly and no extra warnings on the build, ran test and all pass.

I did the review of the patches for Bug 1347394 along with the the ones for this bug.
Applied the four patches as follows:
hg import ~/Downloads/0001-Added-Eclipse-project-files.patch
hg import ~/Downloads/0002-Cleaned-up-SSLSocket-class.patch
hg import ~/Downloads/0001-Reformatted-cipher-definitions-in-SSLSocket-class.patch
hg import ~/Downloads/0002-Added-annotations-for-deprecated-SSL-3.0-ciphers.patch

They applied cleanly. The build went fine with no additional warnings. 
Built and tested following the steps in https://hg.mozilla.org/projects/jss/file/tip/README and all tests passed.

Comment 6

[Elio Maldonado]

Pushed:
https://hg.mozilla.org/projects/jss/rev/ea54f0555d0d0bd571af227bbb847cf0c0cb641e
https://hg.mozilla.org/projects/jss/rev/7184079cfbf3727cf95a00df5095ae4ca7a2c913
https://hg.mozilla.org/projects/jss/rev/2a57326753132be7bd5c5d3a8c23073894aa23b0
https://hg.mozilla.org/projects/jss/rev/73d4029d986bff42a0f4dd31eb774b0bca0f9270