930811 - Update mozilla-aurora to NSS 3.15.2 RTM (NSS_3_15_2_RTM)

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: update_to_NSS_3_15_2_RTM.patch

Linux distributors would like us to use an RTM release for mozilla-beta and mozilla-release when possible. mozilla-aurora is currently using a beta release of NSS, with a private patch for the TLS False Start feature. We already disabled TLS False Start in mozilla-aurora, so we just need to remove the private patch to NSS and remove one function call (in nsNSSIOLayer.cpp) to a function that was added by that private patch. There is no functional change to the false start logic otherwise.

There are no string changes and this is a low-risk change.

Try run: https://tbpl.mozilla.org/?tree=Try&rev=d6ce6d4ab462

Comment 1

[Ed Morley [:emorley]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/0fcff6f948f6

Comment 2

[Kai Engert [:KaiE:]]

I recommend to apply this same change to mozilla aurora 27.

We are releasing an intermediate NSS release for several stable branches.
That particular snapshot should get testing, and the state of some branches is confusing.

I propose to temporarily clean up all branches from early testing code, such as this code with the false start patch.

To be clear, I propose to:
- apply this patch to aurora 27, which will change it to the stable NSS 3.15.2
- in a separate step (bug), we should update it to the "NEW" 3.15.3 version
  (which will have some security fixes)

If that other work (false start feature) gets completed in time, you could still land the newer 3.15.4 into aurora 27.

So, let's do this cleanup first.

Comment 3

[Kai Engert [:KaiE:]]

Brian, can you please agree to this proposal?

If you do, I can take care of it, since the patch already has approval for aurora.

Comment 4

[Kai Engert [:KaiE:]]

(In reply to Kai Engert (:kaie) from comment #2)
> - in a separate step (bug), we should update it to the "NEW" 3.15.3 version
>   (which will have some security fixes)

This separate work will be tracked in bug 935959

Comment 5

[Kai Engert [:KaiE:]]

Attachment: backout false start from aurora27 and go to 3.15.2 RTM in preparation for temporarily using a newer NSS release (that lacks false start)

Comment 6

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 828645 [details] [diff] [review]
backout false start from aurora27 and go to 3.15.2 RTM in preparation for temporarily using a newer NSS release (that lacks false start)

Review of attachment 828645 [details] [diff] [review]:
-----------------------------------------------------------------

I assume that this patch is just updating NSS to NSS_3_15_2_RTM, removing the call to SSL_SetCanFalseStartCallback, and removing the private false start patch. I agree with all of that. If there are other changes please NEEDINFO? me after you've posted what else changed.

Comment 7

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

clearing NEEDINFO.

Comment 8

[Kai Engert [:KaiE:]]

(In reply to Brian Smith from comment #6)
> I assume that this patch is just updating NSS to NSS_3_15_2_RTM, removing
> the call to SSL_SetCanFalseStartCallback, and removing the private false
> start patch. I agree with all of that.

Correct, thanks Brian.

Comment 9

[Kai Engert [:KaiE:]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/571b5e7bf31f

All branches (other than mozilla-central) using experimental false start patches have been cleaned up, so we can close this for now.