nss: Upgrade to 3.17

CVE patches removed since they have been implemented upstream
Rename patch dir (files) to generic PN name

Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>

15 files changed, 9 insertions, 1281 deletions

diff --git a/meta/recipes-support/nss/files/nss-3.15.1-fix-CVE-2013-1739.patch b/meta/recipes-support/nss/files/nss-3.15.1-fix-CVE-2013-1739.patch
deleted file mode 100644
index 1a159c3934..0000000000
--- a/meta/recipes-support/nss/files/nss-3.15.1-fix-CVE-2013-1739.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-Upstream-Status: Backport
-Signed-off-by: yzhu1 <yanjun.zhu@windriver.com>
-
---- a/nss/lib/ssl/ssl3con.c
-+++ b/nss/lib/ssl/ssl3con.c
-@@ -10509,7 +10509,7 @@ ssl_RemoveSSLv3CBCPadding(sslBuffer *pla
-     /* SSLv3 padding bytes are random and cannot be checked. */
-     t = plaintext->len;
-     t -= paddingLength+overhead;
--    /* If len >= padding_length+overhead then the MSB of t is zero. */
-+    /* If len >= paddingLength+overhead then the MSB of t is zero. */
-     good = DUPLICATE_MSB_TO_ALL(~t);
-     /* SSLv3 requires that the padding is minimal. */
-     t = blockSize - (paddingLength+1);
-@@ -10742,7 +10742,7 @@ ssl3_HandleRecord(sslSocket *ss, SSL3Cip
- 	}
-     }
- 
--    good = (unsigned)-1;
-+    good = ~0U;
-     minLength = crSpec->mac_size;
-     if (cipher_def->type == type_block) {
- 	/* CBC records have a padding length byte at the end. */
-@@ -10756,14 +10756,7 @@ ssl3_HandleRecord(sslSocket *ss, SSL3Cip
-     /* We can perform this test in variable time because the record's total
-      * length and the ciphersuite are both public knowledge. */
-     if (cText->buf->len < minLength) {
--	SSL_DBG(("%d: SSL3[%d]: HandleRecord, record too small.",
--		 SSL_GETPID(), ss->fd));
--	/* must not hold spec lock when calling SSL3_SendAlert. */
--	ssl_ReleaseSpecReadLock(ss);
--	SSL3_SendAlert(ss, alert_fatal, bad_record_mac);
--	/* always log mac error, in case attacker can read server logs. */
--	PORT_SetError(SSL_ERROR_BAD_MAC_READ);
--	return SECFailure;
-+	goto decrypt_loser;
-     }
- 
-     if (cipher_def->type == type_block &&
-@@ -10831,11 +10824,18 @@ ssl3_HandleRecord(sslSocket *ss, SSL3Cip
- 	return SECFailure;
-     }
- 
-+    if (cipher_def->type == type_block &&
-+	((cText->buf->len - ivLen) % cipher_def->block_size) != 0) {
-+	goto decrypt_loser;
-+    }
-+
-     /* decrypt from cText buf to plaintext. */
-     rv = crSpec->decode(
- 	crSpec->decodeContext, plaintext->buf, (int *)&plaintext->len,
- 	plaintext->space, cText->buf->buf + ivLen, cText->buf->len - ivLen);
--    good &= SECStatusToMask(rv);
-+    if (rv != SECSuccess) {
-+	goto decrypt_loser;
-+    }
- 
-     PRINT_BUF(80, (ss, "cleartext:", plaintext->buf, plaintext->len));
- 
-@@ -10843,7 +10843,7 @@ ssl3_HandleRecord(sslSocket *ss, SSL3Cip
- 
-     /* If it's a block cipher, check and strip the padding. */
-     if (cipher_def->type == type_block) {
--	const unsigned int blockSize = cipher_def->iv_size;
-+	const unsigned int blockSize = cipher_def->block_size;
- 	const unsigned int macSize = crSpec->mac_size;
- 
- 	if (crSpec->version <= SSL_LIBRARY_VERSION_3_0) {
-@@ -10899,10 +10899,11 @@ ssl3_HandleRecord(sslSocket *ss, SSL3Cip
-     }
- 
-     if (good == 0) {
-+decrypt_loser:
- 	/* must not hold spec lock when calling SSL3_SendAlert. */
- 	ssl_ReleaseSpecReadLock(ss);
- 
--	SSL_DBG(("%d: SSL3[%d]: mac check failed", SSL_GETPID(), ss->fd));
-+	SSL_DBG(("%d: SSL3[%d]: decryption failed", SSL_GETPID(), ss->fd));
- 
- 	if (!IS_DTLS(ss)) {
- 	    SSL3_SendAlert(ss, alert_fatal, bad_record_mac);
diff --git a/meta/recipes-support/nss/files/nss-3.15.1-fix-CVE-2013-1741.patch b/meta/recipes-support/nss/files/nss-3.15.1-fix-CVE-2013-1741.patch
deleted file mode 100644
index 21da0c03b5..0000000000
--- a/meta/recipes-support/nss/files/nss-3.15.1-fix-CVE-2013-1741.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-Upstream-Status: backport
-yanjun.zhu <yanjun.zhu@windriver.com>
---- a/nss/lib/util/secport.c
-+++ b/nss/lib/util/secport.c
-@@ -69,13 +69,22 @@ PORTCharConversionFunc ucs4Utf8ConvertFu
- PORTCharConversionFunc ucs2Utf8ConvertFunc;
- PORTCharConversionWSwapFunc  ucs2AsciiConvertFunc;
- 
-+/* NSPR memory allocation functions (PR_Malloc, PR_Calloc, and PR_Realloc)
-+ * use the PRUint32 type for the size parameter. Before we pass a size_t or
-+ * unsigned long size to these functions, we need to ensure it is <= half of
-+ * the maximum PRUint32 value to avoid truncation and catch a negative size.
-+ */
-+#define MAX_SIZE (PR_UINT32_MAX >> 1)
-+
- void *
- PORT_Alloc(size_t bytes)
- {
--    void *rv;
-+    void *rv = NULL;
- 
--    /* Always allocate a non-zero amount of bytes */
--    rv = (void *)PR_Malloc(bytes ? bytes : 1);
-+    if (bytes <= MAX_SIZE) {
-+	/* Always allocate a non-zero amount of bytes */
-+	rv = PR_Malloc(bytes ? bytes : 1);
-+    }
-     if (!rv) {
- 	++port_allocFailures;
- 	PORT_SetError(SEC_ERROR_NO_MEMORY);
-@@ -86,9 +95,11 @@ PORT_Alloc(size_t bytes)
- void *
- PORT_Realloc(void *oldptr, size_t bytes)
- {
--    void *rv;
-+    void *rv = NULL;
- 
--    rv = (void *)PR_Realloc(oldptr, bytes);
-+    if (bytes <= MAX_SIZE) {
-+	rv = PR_Realloc(oldptr, bytes);
-+    }
-     if (!rv) {
- 	++port_allocFailures;
- 	PORT_SetError(SEC_ERROR_NO_MEMORY);
-@@ -99,10 +110,12 @@ PORT_Realloc(void *oldptr, size_t bytes)
- void *
- PORT_ZAlloc(size_t bytes)
- {
--    void *rv;
-+    void *rv = NULL;
- 
--    /* Always allocate a non-zero amount of bytes */
--    rv = (void *)PR_Calloc(1, bytes ? bytes : 1);
-+    if (bytes <= MAX_SIZE) {
-+	/* Always allocate a non-zero amount of bytes */
-+	rv = PR_Calloc(1, bytes ? bytes : 1);
-+    }
-     if (!rv) {
- 	++port_allocFailures;
- 	PORT_SetError(SEC_ERROR_NO_MEMORY);
-@@ -209,6 +222,10 @@ PORT_NewArena(unsigned long chunksize)
- {
-     PORTArenaPool *pool;
-     
-+    if (chunksize > MAX_SIZE) {
-+	PORT_SetError(SEC_ERROR_NO_MEMORY);
-+	return NULL;
-+    }
-     pool = PORT_ZNew(PORTArenaPool);
-     if (!pool) {
- 	return NULL;
-@@ -224,8 +241,6 @@ PORT_NewArena(unsigned long chunksize)
-     return(&pool->arena);
- }
- 
--#define MAX_SIZE 0x7fffffffUL
--
- void *
- PORT_ArenaAlloc(PLArenaPool *arena, size_t size)
- {
-@@ -330,6 +345,11 @@ PORT_ArenaGrow(PLArenaPool *arena, void 
-     PORTArenaPool *pool = (PORTArenaPool *)arena;
-     PORT_Assert(newsize >= oldsize);
-     
-+    if (newsize > MAX_SIZE) {
-+	PORT_SetError(SEC_ERROR_NO_MEMORY);
-+	return NULL;
-+    }
-+
-     if (ARENAPOOL_MAGIC == pool->magic ) {
- 	PZ_Lock(pool->lock);
- 	/* Do we do a THREADMARK check here? */
diff --git a/meta/recipes-support/nss/files/nss-3.15.1-fix-CVE-2013-5605.patch b/meta/recipes-support/nss/files/nss-3.15.1-fix-CVE-2013-5605.patch
deleted file mode 100644
index 7203d02c78..0000000000
--- a/meta/recipes-support/nss/files/nss-3.15.1-fix-CVE-2013-5605.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-signed-off-by: Ryan Sleevi <ryan.sleevi@gmail.com>
-Upstream-Status: Backport
-reference:https://hg.mozilla.org/projects/nss/rev/e79a09364b5e
-
---- a/nss/lib/ssl/ssl3con.c
-+++ b/nss/lib/ssl/ssl3con.c
-@@ -781,6 +781,11 @@ static SECStatus
- Null_Cipher(void *ctx, unsigned char *output, int *outputLen, int maxOutputLen,
- 	    const unsigned char *input, int inputLen)
- {
-+    if (inputLen > maxOutputLen) {
-+        *outputLen = 0;  /* Match PK11_CipherOp in setting outputLen */
-+        PORT_SetError(SEC_ERROR_OUTPUT_LEN);
-+        return SECFailure;
-+    }
-     *outputLen = inputLen;
-     if (input != output)
- 	PORT_Memcpy(output, input, inputLen);
diff --git a/meta/recipes-support/nss/files/nss-CVE-2013-1740.patch b/meta/recipes-support/nss/files/nss-CVE-2013-1740.patch
deleted file mode 100644
index db3d6f9103..0000000000
--- a/meta/recipes-support/nss/files/nss-CVE-2013-1740.patch
+++ /dev/null
@@ -1,916 +0,0 @@
-nss: CVE-2013-1740
-
-Upstream-Status: Backport
-
-the patch comes from:
-http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1740
-https://bugzilla.mozilla.org/show_bug.cgi?id=919877
-https://bugzilla.mozilla.org/show_bug.cgi?id=713933
-
-changeset:   10946:f28426e944ae
-user:        Wan-Teh Chang <wtc@google.com>
-date:        Tue Nov 26 16:44:39 2013 -0800
-summary:     Bug 713933: Handle the return value of both ssl3_HandleRecord calls
-
-changeset:   10945:774c7dec7565
-user:        Wan-Teh Chang <wtc@google.com>
-date:        Mon Nov 25 19:16:23 2013 -0800
-summary:     Bug 713933: Declare the |falseStart| local variable in the smallest
-
-changeset:   10848:141fae8fb2e8
-user:        Wan-Teh Chang <wtc@google.com>
-date:        Mon Sep 23 11:25:41 2013 -0700
-summary:     Bug 681839: Allow SSL_HandshakeNegotiatedExtension to be called before the handshake is finished, r=brian@briansmith.org
-
-changeset:   10898:1b9c43d28713
-user:        Brian Smith <brian@briansmith.org>
-date:        Thu Oct 31 15:40:42 2013 -0700
-summary:     Bug 713933: Make SSL False Start work with asynchronous certificate validation, r=wtc
-
-Signed-off-by: Li Wang <li.wang@windriver.com>
----
- nss/lib/ssl/ssl.def     |    7 ++
- nss/lib/ssl/ssl.h       |   54 +++++++++++---
- nss/lib/ssl/ssl3con.c   |  188 +++++++++++++++++++++++++++++++++++------------
- nss/lib/ssl/ssl3gthr.c  |   63 ++++++++++++----
- nss/lib/ssl/sslauth.c   |   10 +--
- nss/lib/ssl/sslimpl.h   |   22 +++++-
- nss/lib/ssl/sslinfo.c   |   10 +--
- nss/lib/ssl/sslreveal.c |    9 +--
- nss/lib/ssl/sslsecur.c  |  139 ++++++++++++++++++++++++++++-------
- nss/lib/ssl/sslsock.c   |   12 ++-
- 10 files changed, 386 insertions(+), 128 deletions(-)
-
-diff --git a/nss/lib/ssl/ssl.def b/nss/lib/ssl/ssl.def
-index fbf7fc5..e937bd4 100644
---- a/nss/lib/ssl/ssl.def
-+++ b/nss/lib/ssl/ssl.def
-@@ -163,3 +163,10 @@ SSL_SetStapledOCSPResponses;
- ;+    local:
- ;+*;
- ;+};
-+;+NSS_3.15.3 {    # NSS 3.15.3 release
-+;+    global:
-+SSL_RecommendedCanFalseStart;
-+SSL_SetCanFalseStartCallback;
-+;+    local:
-+;+*;
-+;+};
-diff --git a/nss/lib/ssl/ssl.h b/nss/lib/ssl/ssl.h
-index 6db0e34..ddeaaef 100644
---- a/nss/lib/ssl/ssl.h
-+++ b/nss/lib/ssl/ssl.h
-@@ -121,14 +121,17 @@ SSL_IMPORT PRFileDesc *DTLS_ImportFD(PRFileDesc *model, PRFileDesc *fd);
- #define SSL_ENABLE_FALSE_START         22 /* Enable SSL false start (off by */
-                                           /* default, applies only to       */
-                                           /* clients). False start is a     */
--/* mode where an SSL client will start sending application data before      */
--/* verifying the server's Finished message. This means that we could end up */
--/* sending data to an imposter. However, the data will be encrypted and     */
--/* only the true server can derive the session key. Thus, so long as the    */
--/* cipher isn't broken this is safe. Because of this, False Start will only */
--/* occur on RSA or DH ciphersuites where the cipher's key length is >= 80   */
--/* bits. The advantage of False Start is that it saves a round trip for     */
--/* client-speaks-first protocols when performing a full handshake.          */
-+/* mode where an SSL client will start sending application data before
-+ * verifying the server's Finished message. This means that we could end up
-+ * sending data to an imposter. However, the data will be encrypted and
-+ * only the true server can derive the session key. Thus, so long as the
-+ * cipher isn't broken this is safe. The advantage of false start is that
-+ * it saves a round trip for client-speaks-first protocols when performing a
-+ * full handshake.
-+ *
-+ * In addition to enabling this option, the application must register a
-+ * callback using the SSL_SetCanFalseStartCallback function.
-+ */
- 
- /* For SSL 3.0 and TLS 1.0, by default we prevent chosen plaintext attacks
-  * on SSL CBC mode cipher suites (see RFC 4346 Section F.3) by splitting
-@@ -653,14 +656,45 @@ SSL_IMPORT SECStatus SSL_SetMaxServerCacheLocks(PRUint32 maxLocks);
- SSL_IMPORT SECStatus SSL_InheritMPServerSIDCache(const char * envString);
- 
- /*
--** Set the callback on a particular socket that gets called when we finish
--** performing a handshake.
-+** Set the callback that gets called when a TLS handshake is complete. The
-+** handshake callback is called after verifying the peer's Finished message and
-+** before processing incoming application data.
-+**
-+** For the initial handshake: If the handshake false started (see
-+** SSL_ENABLE_FALSE_START), then application data may already have been sent
-+** before the handshake callback is called. If we did not false start then the
-+** callback will get called before any application data is sent.
- */
- typedef void (PR_CALLBACK *SSLHandshakeCallback)(PRFileDesc *fd,
-                                                  void *client_data);
- SSL_IMPORT SECStatus SSL_HandshakeCallback(PRFileDesc *fd, 
- 			          SSLHandshakeCallback cb, void *client_data);
- 
-+/* Applications that wish to enable TLS false start must set this callback
-+** function. NSS will invoke the functon to determine if a particular
-+** connection should use false start or not. SECSuccess indicates that the
-+** callback completed successfully, and if so *canFalseStart indicates if false
-+** start can be used. If the callback does not return SECSuccess then the
-+** handshake will be canceled. NSS's recommended criteria can be evaluated by
-+** calling SSL_RecommendedCanFalseStart.
-+**
-+** If no false start callback is registered then false start will never be
-+** done, even if the SSL_ENABLE_FALSE_START option is enabled.
-+**/
-+typedef SECStatus (PR_CALLBACK *SSLCanFalseStartCallback)(
-+    PRFileDesc *fd, void *arg, PRBool *canFalseStart);
-+
-+SSL_IMPORT SECStatus SSL_SetCanFalseStartCallback(
-+    PRFileDesc *fd, SSLCanFalseStartCallback callback, void *arg);
-+
-+/* This function sets *canFalseStart according to the recommended criteria for
-+** false start. These criteria may change from release to release and may depend
-+** on which handshake features have been negotiated and/or properties of the
-+** certifciates/keys used on the connection.
-+*/
-+SSL_IMPORT SECStatus SSL_RecommendedCanFalseStart(PRFileDesc *fd,
-+                                                  PRBool *canFalseStart);
-+
- /*
- ** For the server, request a new handshake.  For the client, begin a new
- ** handshake.  If flushCache is non-zero, the SSL3 cache entry will be 
-diff --git a/nss/lib/ssl/ssl3con.c b/nss/lib/ssl/ssl3con.c
-index 61d24d9..f39ba09 100644
---- a/nss/lib/ssl/ssl3con.c
-+++ b/nss/lib/ssl/ssl3con.c
-@@ -2535,7 +2535,7 @@ ssl3_SendRecord(   sslSocket *        ss,
-     SSL_TRC(3, ("%d: SSL3[%d] SendRecord type: %s nIn=%d",
- 		SSL_GETPID(), ss->fd, ssl3_DecodeContentType(type),
- 		nIn));
--    PRINT_BUF(3, (ss, "Send record (plain text)", pIn, nIn));
-+    PRINT_BUF(50, (ss, "Send record (plain text)", pIn, nIn));
- 
-     PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );
- 
-@@ -6674,36 +6674,73 @@ done:
-     return rv;
- }
- 
-+static SECStatus
-+ssl3_CheckFalseStart(sslSocket *ss)
-+{
-+    PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
-+    PORT_Assert( !ss->ssl3.hs.authCertificatePending );
-+    PORT_Assert( !ss->ssl3.hs.canFalseStart );
-+
-+    if (!ss->canFalseStartCallback) {
-+       SSL_TRC(3, ("%d: SSL[%d]: no false start callback so no false start",
-+                   SSL_GETPID(), ss->fd));
-+    } else {
-+       PRBool maybeFalseStart;
-+       SECStatus rv;
-+
-+       /* An attacker can control the selected ciphersuite so we only wish to
-+        * do False Start in the case that the selected ciphersuite is
-+        * sufficiently strong that the attack can gain no advantage.
-+        * Therefore we always require an 80-bit cipher. */
-+        ssl_GetSpecReadLock(ss);
-+        maybeFalseStart = ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10;
-+        ssl_ReleaseSpecReadLock(ss);
-+
-+       if (!maybeFalseStart) {
-+           SSL_TRC(3, ("%d: SSL[%d]: no false start due to weak cipher",
-+                       SSL_GETPID(), ss->fd));
-+       } else {
-+           rv = (ss->canFalseStartCallback)(ss->fd,
-+                                            ss->canFalseStartCallbackData,
-+                                            &ss->ssl3.hs.canFalseStart);
-+           if (rv == SECSuccess) {
-+               SSL_TRC(3, ("%d: SSL[%d]: false start callback returned %s",
-+                           SSL_GETPID(), ss->fd,
-+                           ss->ssl3.hs.canFalseStart ? "TRUE" : "FALSE"));
-+           } else {
-+               SSL_TRC(3, ("%d: SSL[%d]: false start callback failed (%s)",
-+                           SSL_GETPID(), ss->fd,
-+                           PR_ErrorToName(PR_GetError())));
-+           }
-+           return rv;
-+       }
-+    }
-+
-+    ss->ssl3.hs.canFalseStart = PR_FALSE;
-+    return SECSuccess;
-+}
-+
- PRBool
--ssl3_CanFalseStart(sslSocket *ss) {
--    PRBool rv;
-+ssl3_WaitingForStartOfServerSecondRound(sslSocket *ss)
-+{
-+    PRBool result = PR_FALSE;
- 
-     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
- 
--    /* XXX: does not take into account whether we are waiting for
--     * SSL_AuthCertificateComplete or SSL_RestartHandshakeAfterCertReq. If/when
--     * that is done, this function could return different results each time it
--     * would be called.
--     */
-+    switch (ss->ssl3.hs.ws) {
-+    case wait_new_session_ticket:
-+        result = PR_TRUE;
-+        break;
-+    case wait_change_cipher:
-+        result = !ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn);
-+        break;
-+    case wait_finished:
-+        break;
-+    default:
-+        PR_NOT_REACHED("ssl3_WaitingForStartOfServerSecondRound");
-+    }
- 
--    ssl_GetSpecReadLock(ss);
--    rv = ss->opt.enableFalseStart &&
--	 !ss->sec.isServer &&
--	 !ss->ssl3.hs.isResuming &&
--	 ss->ssl3.cwSpec &&
--
--	 /* An attacker can control the selected ciphersuite so we only wish to
--	  * do False Start in the case that the selected ciphersuite is
--	  * sufficiently strong that the attack can gain no advantage.
--	  * Therefore we require an 80-bit cipher and a forward-secret key
--	  * exchange. */
--	 ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10 &&
--	(ss->ssl3.hs.kea_def->kea == kea_dhe_dss ||
--	 ss->ssl3.hs.kea_def->kea == kea_dhe_rsa ||
--	 ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa ||
--	 ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa);
--    ssl_ReleaseSpecReadLock(ss);
--    return rv;
-+    return result;
- }
- 
- static SECStatus ssl3_SendClientSecondRound(sslSocket *ss);
-@@ -6785,6 +6822,9 @@ ssl3_SendClientSecondRound(sslSocket *ss)
-     }
-     if (ss->ssl3.hs.authCertificatePending &&
- 	(sendClientCert || ss->ssl3.sendEmptyCert || ss->firstHsDone)) {
-+        SSL_TRC(3, ("%d: SSL3[%p]: deferring ssl3_SendClientSecondRound because"
-+                    " certificate authentication is still pending.",
-+                    SSL_GETPID(), ss->fd));
- 	ss->ssl3.hs.restartTarget = ssl3_SendClientSecondRound;
- 	return SECWouldBlock;
-     }
-@@ -6822,14 +6862,50 @@ ssl3_SendClientSecondRound(sslSocket *ss)
- 	goto loser;	/* err code was set. */
-     }
- 
--    /* XXX: If the server's certificate hasn't been authenticated by this
--     * point, then we may be leaking this NPN message to an attacker.
-+    /* This must be done after we've set ss->ssl3.cwSpec in
-+     * ssl3_SendChangeCipherSpecs because SSL_GetChannelInfo uses information
-+     * from cwSpec. This must be done before we call ssl3_CheckFalseStart
-+     * because the false start callback (if any) may need the information from
-+     * the functions that depend on this being set.
-      */
-+    ss->enoughFirstHsDone = PR_TRUE;
-+
-     if (!ss->firstHsDone) {
-+        /* XXX: If the server's certificate hasn't been authenticated by this
-+         * point, then we may be leaking this NPN message to an attacker.
-+         */
- 	rv = ssl3_SendNextProto(ss);
- 	if (rv != SECSuccess) {
- 	    goto loser;	/* err code was set. */
- 	}
-+
-+        if (ss->opt.enableFalseStart) {
-+            if (!ss->ssl3.hs.authCertificatePending) {
-+                /* When we fix bug 589047, we will need to know whether we are
-+                 * false starting before we try to flush the client second
-+                 * round to the network. With that in mind, we purposefully
-+                 * call ssl3_CheckFalseStart before calling ssl3_SendFinished,
-+                 * which includes a call to ssl3_FlushHandshake, so that
-+                 * no application develops a reliance on such flushing being
-+                 * done before its false start callback is called.
-+                 */
-+                ssl_ReleaseXmitBufLock(ss);
-+                rv = ssl3_CheckFalseStart(ss);
-+                ssl_GetXmitBufLock(ss);
-+                if (rv != SECSuccess) {
-+                    goto loser;
-+                }
-+            } else {
-+                /* The certificate authentication and the server's Finished
-+                 * message are racing each other. If the certificate
-+                 * authentication wins, then we will try to false start in
-+                 * ssl3_AuthCertificateComplete.
-+                 */
-+                SSL_TRC(3, ("%d: SSL3[%p]: deferring false start check because"
-+                            " certificate authentication is still pending.",
-+                            SSL_GETPID(), ss->fd));
-+            }
-+        }
-     }
- 
-     rv = ssl3_SendFinished(ss, 0);
-@@ -6844,10 +6920,7 @@ ssl3_SendClientSecondRound(sslSocket *ss)
-     else
- 	ss->ssl3.hs.ws = wait_change_cipher;
- 
--    /* Do the handshake callback for sslv3 here, if we can false start. */
--    if (ss->handshakeCallback != NULL && ssl3_CanFalseStart(ss)) {
--	(ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
--    }
-+    PORT_Assert(ssl3_WaitingForStartOfServerSecondRound(ss));
- 
-     return SECSuccess;
- 
-@@ -9421,13 +9494,6 @@ ssl3_AuthCertificate(sslSocket *ss)
- 
- 	    ss->ssl3.hs.authCertificatePending = PR_TRUE;
- 	    rv = SECSuccess;
--
--	    /* XXX: Async cert validation and False Start don't work together
--	     * safely yet; if we leave False Start enabled, we may end up false
--	     * starting (sending application data) before we
--	     * SSL_AuthCertificateComplete has been called.
--	     */
--	    ss->opt.enableFalseStart = PR_FALSE;
- 	}
- 
- 	if (rv != SECSuccess) {
-@@ -9551,6 +9617,12 @@ ssl3_AuthCertificateComplete(sslSocket *ss, PRErrorCode error)
-     } else if (ss->ssl3.hs.restartTarget != NULL) {
- 	sslRestartTarget target = ss->ssl3.hs.restartTarget;
- 	ss->ssl3.hs.restartTarget = NULL;
-+
-+        if (target == ssl3_FinishHandshake) {
-+            SSL_TRC(3,("%d: SSL3[%p]: certificate authentication lost the race"
-+                       " with peer's finished message", SSL_GETPID(), ss->fd));
-+        }
-+
- 	rv = target(ss);
- 	/* Even if we blocked here, we have accomplished enough to claim
- 	 * success. Any remaining work will be taken care of by subsequent
-@@ -9560,7 +9632,29 @@ ssl3_AuthCertificateComplete(sslSocket *ss, PRErrorCode error)
- 	    rv = SECSuccess;
- 	}
-     } else {
--	rv = SECSuccess;
-+        SSL_TRC(3, ("%d: SSL3[%p]: certificate authentication won the race with"
-+                    " peer's finished message", SSL_GETPID(), ss->fd));
-+
-+        PORT_Assert(!ss->firstHsDone);
-+        PORT_Assert(!ss->sec.isServer);
-+        PORT_Assert(!ss->ssl3.hs.isResuming);
-+        PORT_Assert(ss->ssl3.hs.ws == wait_new_session_ticket ||
-+                    ss->ssl3.hs.ws == wait_change_cipher ||
-+                    ss->ssl3.hs.ws == wait_finished);
-+ 
-+        /* ssl3_SendClientSecondRound deferred the false start check because
-+         * certificate authentication was pending, so we do it now if we still
-+          * haven't received any of the server's second round yet.
-+         */
-+        if (ss->opt.enableFalseStart &&
-+            !ss->firstHsDone &&
-+            !ss->sec.isServer &&
-+            !ss->ssl3.hs.isResuming &&
-+            ssl3_WaitingForStartOfServerSecondRound(ss)) {
-+            rv = ssl3_CheckFalseStart(ss);
-+        } else {
-+            rv = SECSuccess;
-+        }
-     }
- 
- done:
-@@ -10023,9 +10117,6 @@ xmit_loser:
-         return rv;
-     }
- 
--    ss->gs.writeOffset = 0;
--    ss->gs.readOffset  = 0;
--
-     if (ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) {
- 	effectiveExchKeyType = kt_rsa;
-     } else {
-@@ -10090,6 +10181,9 @@ xmit_loser:
-     return rv;
- }
- 
-+/* The return type is SECStatus instead of void because this function needs
-+ * to have type sslRestartTarget.
-+ */
- SECStatus
- ssl3_FinishHandshake(sslSocket * ss)
- {
-@@ -10099,19 +10193,16 @@ ssl3_FinishHandshake(sslSocket * ss)
- 
-     /* The first handshake is now completed. */
-     ss->handshake           = NULL;
--    ss->firstHsDone         = PR_TRUE;
- 
-     if (ss->ssl3.hs.cacheSID) {
- 	(*ss->sec.cache)(ss->sec.ci.sid);
- 	ss->ssl3.hs.cacheSID = PR_FALSE;
-     }
- 
-+    ss->ssl3.hs.canFalseStart = PR_FALSE; /* False Start phase is complete */
-     ss->ssl3.hs.ws = idle_handshake;
- 
--    /* Do the handshake callback for sslv3 here, if we cannot false start. */
--    if (ss->handshakeCallback != NULL && !ssl3_CanFalseStart(ss)) {
--	(ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
--    }
-+    ssl_FinishHandshake(ss);
- 
-     return SECSuccess;
- }
-@@ -11045,7 +11136,6 @@ process_it:
- 
-     ssl_ReleaseSSL3HandshakeLock(ss);
-     return rv;
--
- }
- 
- /*
-diff --git a/nss/lib/ssl/ssl3gthr.c b/nss/lib/ssl/ssl3gthr.c
-index 6d62515..03e369d 100644
---- a/nss/lib/ssl/ssl3gthr.c
-+++ b/nss/lib/ssl/ssl3gthr.c
-@@ -275,11 +275,17 @@ ssl3_GatherCompleteHandshake(sslSocket *ss, int flags)
- {
-     SSL3Ciphertext cText;
-     int            rv;
--    PRBool         canFalseStart = PR_FALSE;
-+    PRBool         keepGoing = PR_TRUE;
- 
-     SSL_TRC(30, ("ssl3_GatherCompleteHandshake"));
- 
-+    /* ssl3_HandleRecord may end up eventually calling ssl_FinishHandshake,
-+     * which requires the 1stHandshakeLock, which must be acquired before the
-+     * RecvBufLock.
-+     */
-+    PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) );
-     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
-+
-     do {
- 	PRBool handleRecordNow = PR_FALSE;
- 
-@@ -368,20 +374,48 @@ ssl3_GatherCompleteHandshake(sslSocket *ss, int flags)
- 	if (rv < 0) {
- 	    return ss->recvdCloseNotify ? 0 : rv;
- 	}
-+        if (rv == (int) SECSuccess && ss->gs.buf.len > 0) {
-+            /* We have application data to return to the application. This
-+             * prioritizes returning application data to the application over
-+             * completing any renegotiation handshake we may be doing.
-+             */
-+            PORT_Assert(ss->firstHsDone);
-+            PORT_Assert(cText.type == content_application_data);
-+            break;
-+        }
- 
--	/* If we kicked off a false start in ssl3_HandleServerHelloDone, break
--	 * out of this loop early without finishing the handshake.
--	 */
--	if (ss->opt.enableFalseStart) {
--	    ssl_GetSSL3HandshakeLock(ss);
--	    canFalseStart = (ss->ssl3.hs.ws == wait_change_cipher ||
--			     ss->ssl3.hs.ws == wait_new_session_ticket) &&
--		            ssl3_CanFalseStart(ss);
--	    ssl_ReleaseSSL3HandshakeLock(ss);
-+        PORT_Assert(keepGoing);
-+        ssl_GetSSL3HandshakeLock(ss);
-+        if (ss->ssl3.hs.ws == idle_handshake) {
-+            /* We are done with the current handshake so stop trying to
-+             * handshake. Note that it would be safe to test ss->firstHsDone
-+             * instead of ss->ssl3.hs.ws. By testing ss->ssl3.hs.ws instead,
-+             * we prioritize completing a renegotiation handshake over sending
-+             * application data.
-+             */
-+            PORT_Assert(ss->firstHsDone);
-+            PORT_Assert(!ss->ssl3.hs.canFalseStart);
-+            keepGoing = PR_FALSE;
-+        } else if (ss->ssl3.hs.canFalseStart) {
-+            /* Prioritize sending application data over trying to complete
-+             * the handshake if we're false starting.
-+             *
-+             * If we were to do this check at the beginning of the loop instead
-+             * of here, then this function would become be a no-op after
-+             * receiving the ServerHelloDone in the false start case, and we
-+             * would never complete the handshake.
-+             */
-+            PORT_Assert(!ss->firstHsDone);
-+ 
-+            if (ssl3_WaitingForStartOfServerSecondRound(ss)) {
-+                keepGoing = PR_FALSE;
-+            } else {
-+                ss->ssl3.hs.canFalseStart = PR_FALSE;
-+            }
- 	}
--    } while (ss->ssl3.hs.ws != idle_handshake &&
--             !canFalseStart &&
--             ss->gs.buf.len == 0);
-+        ssl_ReleaseSSL3HandshakeLock(ss);
-+     } while (keepGoing);
-+
- 
-     ss->gs.readOffset = 0;
-     ss->gs.writeOffset = ss->gs.buf.len;
-@@ -404,7 +438,10 @@ ssl3_GatherAppDataRecord(sslSocket *ss, int flags)
- {
-     int            rv;
- 
-+    /* ssl3_GatherCompleteHandshake requires both of these locks. */
-+    PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) );
-     PORT_Assert( ss->opt.noLocks || ssl_HaveRecvBufLock(ss) );
-+
-     do {
- 	rv = ssl3_GatherCompleteHandshake(ss, flags);
-     } while (rv > 0 && ss->gs.buf.len == 0);
-diff --git a/nss/lib/ssl/sslauth.c b/nss/lib/ssl/sslauth.c
-index d2f57bf..cb956d4 100644
---- a/nss/lib/ssl/sslauth.c
-+++ b/nss/lib/ssl/sslauth.c
-@@ -60,7 +60,6 @@ SSL_SecurityStatus(PRFileDesc *fd, int *op, char **cp, int *kp0, int *kp1,
-     sslSocket *ss;
-     const char *cipherName;
-     PRBool isDes = PR_FALSE;
--    PRBool enoughFirstHsDone = PR_FALSE;
- 
-     ss = ssl_FindSocket(fd);
-     if (!ss) {
-@@ -78,14 +77,7 @@ SSL_SecurityStatus(PRFileDesc *fd, int *op, char **cp, int *kp0, int *kp1,
- 	*op = SSL_SECURITY_STATUS_OFF;
-     }
- 
--    if (ss->firstHsDone) {
--	enoughFirstHsDone = PR_TRUE;
--    } else if (ss->version >= SSL_LIBRARY_VERSION_3_0 &&
--	       ssl3_CanFalseStart(ss)) {
--	enoughFirstHsDone = PR_TRUE;
--    }
--
--    if (ss->opt.useSecurity && enoughFirstHsDone) {
-+    if (ss->opt.useSecurity && ss->enoughFirstHsDone) {
- 	if (ss->version < SSL_LIBRARY_VERSION_3_0) {
- 	    cipherName = ssl_cipherName[ss->sec.cipherType];
- 	} else {
-diff --git a/nss/lib/ssl/sslimpl.h b/nss/lib/ssl/sslimpl.h
-index 90e9567..bf0d67f 100644
---- a/nss/lib/ssl/sslimpl.h
-+++ b/nss/lib/ssl/sslimpl.h
-@@ -842,6 +842,8 @@ const ssl3CipherSuiteDef *suite_def;
-     /* Shared state between ssl3_HandleFinished and ssl3_FinishHandshake */
-     PRBool                cacheSID;
- 
-+    PRBool                canFalseStart;   /* Can/did we False Start */
-+
-     /* clientSigAndHash contains the contents of the signature_algorithms
-      * extension (if any) from the client. This is only valid for TLS 1.2
-      * or later. */
-@@ -1116,6 +1118,10 @@ struct sslSocketStr {
-     unsigned long    clientAuthRequested;
-     unsigned long    delayDisabled;       /* Nagle delay disabled */
-     unsigned long    firstHsDone;         /* first handshake is complete. */
-+    unsigned long    enoughFirstHsDone;   /* enough of the first handshake is
-+                                           * done for callbacks to be able to
-+                                           * retrieve channel security
-+                                           * parameters from the SSL socket. */
-     unsigned long    handshakeBegun;     
-     unsigned long    lastWriteBlocked;   
-     unsigned long    recvdCloseNotify;    /* received SS