Verified Commit 8c3704fa authored by Mike Perry's avatar Mike Perry Committed by Pier Angelo Vendrame
Browse files

Bug 13028: Prevent potential proxy bypass cases. 

It looks like these cases should only be invoked in the NSS command line
tools, and not the browser, but I decided to patch them anyway because there
literally is a maze of network function pointers being passed around, and it's
very hard to tell if some random code might not pass in the proper proxied
versions of the networking code here by accident.

Bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1433509
parent 2025d38e

security/nss/lib/certhigh/ocsp.c

+4 −0
Original line number Diff line number Diff line
@@ -2926,6 +2926,9 @@ loser: 
static PRFileDesc *

ocsp_ConnectToHost(const char *host, PRUint16 port)

{

#ifdef MOZ_PROXY_BYPASS_PROTECTION

    return NULL;

#else

    PRFileDesc *sock = NULL;

    PRIntervalTime timeout;

    PRNetAddr addr;
@@ -2984,6 +2987,7 @@ loser: 
    if (netdbbuf != NULL)

        PORT_Free(netdbbuf);

    return NULL;

#endif

}



/*

security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c

+12 −0
Original line number Diff line number Diff line
@@ -1322,6 +1322,9 @@ pkix_pl_Socket_Create( 
        PKIX_PL_Socket **pSocket,

        void *plContext)

{

#ifdef MOZ_PROXY_BYPASS_PROTECTION

        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);

#else

        PKIX_PL_Socket *socket = NULL;



        PKIX_ENTER(SOCKET, "pkix_pl_Socket_Create");
@@ -1369,6 +1372,7 @@ cleanup: 
        }



        PKIX_RETURN(SOCKET);

#endif

}



/*
@@ -1418,6 +1422,9 @@ pkix_pl_Socket_CreateByName( 
        PKIX_PL_Socket **pSocket,

        void *plContext)

{

#ifdef MOZ_PROXY_BYPASS_PROTECTION

        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);

#else

        PRNetAddr netAddr;

        PKIX_PL_Socket *socket = NULL;

        char *sepPtr = NULL;
@@ -1520,6 +1527,7 @@ cleanup: 
        }



        PKIX_RETURN(SOCKET);

#endif

}



/*
@@ -1571,6 +1579,9 @@ pkix_pl_Socket_CreateByHostAndPort( 
        PKIX_PL_Socket **pSocket,

        void *plContext)

{

#ifdef MOZ_PROXY_BYPASS_PROTECTION

        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);

#else

        PRNetAddr netAddr;

        PKIX_PL_Socket *socket = NULL;

        char *sepPtr = NULL;
@@ -1658,6 +1669,7 @@ cleanup: 
        }



        PKIX_RETURN(SOCKET);

#endif

}



/*