1Index: net/third_party/nss/ssl/ssl.h 2=================================================================== 3--- net/third_party/nss/ssl/ssl.h (revision 225295) 4+++ net/third_party/nss/ssl/ssl.h (working copy) 5@@ -434,6 +434,15 @@ 6 */ 7 SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd); 8 9+/* 10+** Return the certificates presented by the SSL peer. If the SSL peer 11+** did not present certificates, return NULL with the 12+** SSL_ERROR_NO_CERTIFICATE error. On failure, return NULL with an error 13+** code other than SSL_ERROR_NO_CERTIFICATE. 14+** "fd" the socket "file" descriptor 15+*/ 16+SSL_IMPORT CERTCertList *SSL_PeerCertificateChain(PRFileDesc *fd); 17+ 18 /* SSL_PeerStapledOCSPResponses returns the OCSP responses that were provided 19 * by the TLS server. The return value is a pointer to an internal SECItemArray 20 * that contains the returned OCSP responses; it is only valid until the 21@@ -463,18 +472,6 @@ 22 SSLKEAType kea); 23 24 /* 25-** Return references to the certificates presented by the SSL peer. 26-** |maxNumCerts| must contain the size of the |certs| array. On successful 27-** return, |*numCerts| contains the number of certificates available and 28-** |certs| will contain references to as many certificates as would fit. 29-** Therefore if |*numCerts| contains a value less than or equal to 30-** |maxNumCerts|, then all certificates were returned. 31-*/ 32-SSL_IMPORT SECStatus SSL_PeerCertificateChain( 33- PRFileDesc *fd, CERTCertificate **certs, 34- unsigned int *numCerts, unsigned int maxNumCerts); 35- 36-/* 37 ** Authenticate certificate hook. Called when a certificate comes in 38 ** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the 39 ** certificate. 40Index: net/third_party/nss/ssl/sslauth.c 41=================================================================== 42--- net/third_party/nss/ssl/sslauth.c (revision 225295) 43+++ net/third_party/nss/ssl/sslauth.c (working copy) 44@@ -28,38 +28,43 @@ 45 } 46 47 /* NEED LOCKS IN HERE. */ 48-SECStatus 49-SSL_PeerCertificateChain(PRFileDesc *fd, CERTCertificate **certs, 50- unsigned int *numCerts, unsigned int maxNumCerts) 51+CERTCertList * 52+SSL_PeerCertificateChain(PRFileDesc *fd) 53 { 54 sslSocket *ss; 55- ssl3CertNode* cur; 56+ CERTCertList *chain = NULL; 57+ CERTCertificate *cert; 58+ ssl3CertNode *cur; 59 60 ss = ssl_FindSocket(fd); 61 if (!ss) { 62 SSL_DBG(("%d: SSL[%d]: bad socket in PeerCertificateChain", 63 SSL_GETPID(), fd)); 64- return SECFailure; 65+ return NULL; 66 } 67- if (!ss->opt.useSecurity) 68- return SECFailure; 69- 70- if (ss->sec.peerCert == NULL) { 71- *numCerts = 0; 72- return SECSuccess; 73+ if (!ss->opt.useSecurity || !ss->sec.peerCert) { 74+ PORT_SetError(SSL_ERROR_NO_CERTIFICATE); 75+ return NULL; 76 } 77- 78- *numCerts = 1; /* for the leaf certificate */ 79- if (maxNumCerts > 0) 80- certs[0] = CERT_DupCertificate(ss->sec.peerCert); 81- 82+ chain = CERT_NewCertList(); 83+ if (!chain) { 84+ return NULL; 85+ } 86+ cert = CERT_DupCertificate(ss->sec.peerCert); 87+ if (CERT_AddCertToListTail(chain, cert) != SECSuccess) { 88+ goto loser; 89+ } 90 for (cur = ss->ssl3.peerCertChain; cur; cur = cur->next) { 91- if (*numCerts < maxNumCerts) 92- certs[*numCerts] = CERT_DupCertificate(cur->cert); 93- (*numCerts)++; 94+ cert = CERT_DupCertificate(cur->cert); 95+ if (CERT_AddCertToListTail(chain, cert) != SECSuccess) { 96+ goto loser; 97+ } 98 } 99+ return chain; 100 101- return SECSuccess; 102+loser: 103+ CERT_DestroyCertList(chain); 104+ return NULL; 105 } 106 107 /* NEED LOCKS IN HERE. */ 108