Bug 1552254 internal_error alert on Certificate Request with sha1+ecdsa in TLS 1.3

We need to be able to select Client certificates based on the schemes sent to us from the server. Rather than changing the callback function, this patch adds those schemes to the ssl socket info as suggested by Dana. In addition, two helpful functions have been added to aid User applications in properly selecting the Certificate:
   PRBool SSL_CertIsUsable(PRFileDesc *fd, CERTCertificate *cert) - returns true if the given cert matches the schemes of the server, the schemes configured on the socket, capability of the token the private key resides on, and the current policy. For future SSL protocol, additional restrictions may be parsed.
   SSL_FilterCertListBySocket(PRFileDesc *fd, CERTCertList *certlist) - removes the certs from the cert list that doesn't pass the SSL_CertIsUsable() call.

In addition the built in cert selection function (NSS_GetClientAuthData) uses the above functions to filter the list. In order to support the NSS_GetClientAuthData three new functions have been added:
   SECStatus CERT_FilterCertListByNickname(CERTCertList *certList, char *nickname, void *pwarg) -- removes the certs that don't match the 'nickname'.
   SECStatus CERT_FilterCertListByCertList(CERTCertlist *certList, const CERTCertlist *filterList ) -- removes all the certs on the first cert list that isn't on the second.
   PRBool CERT_IsInList(CERTCertificate *, const CERTCertList *certList) -- returns true if cert is on certList.

In addition
 * PK11_FindObjectForCert() is exported so the token the cert lives on can be accessed.
 * the ssle ssl_PickClientSignatureScheme() function (along with several supporing functions) have been modified so it can be used by SSL_CertIsUsable()

Differential Revision: https://phabricator.services.mozilla.com/D135715

2 files changed, 12 insertions, 0 deletions

diff --git a/automation/abi-check/expected-report-libnss3.so.txt b/automation/abi-check/expected-report-libnss3.so.txt
index e69de29bb..e60ded534 100644
--- a/automation/abi-check/expected-report-libnss3.so.txt
+++ b/automation/abi-check/expected-report-libnss3.so.txt
@@ -0,0 +1,8 @@
+
+4 Added functions:
+
+  'function SECStatus CERT_FilterCertListByCertList(CERTCertList*, const CERTCertList*)'    {CERT_FilterCertListByCertList@@NSS_3.77}
+  'function SECStatus CERT_FilterCertListByNickname(CERTCertList*, char*, void*)'    {CERT_FilterCertListByNickname@@NSS_3.77}
+  'function PRBool CERT_IsInList(const CERTCertificate*, const CERTCertList*)'    {CERT_IsInList@@NSS_3.77}
+  'function CK_OBJECT_HANDLE PK11_FindObjectForCert(CERTCertificate*, void*, PK11SlotInfo**)'    {PK11_FindObjectForCert@@NSS_3.77}
+
diff --git a/automation/abi-check/expected-report-libssl3.so.txt b/automation/abi-check/expected-report-libssl3.so.txt
index e69de29bb..6c8b7b07d 100644
--- a/automation/abi-check/expected-report-libssl3.so.txt
+++ b/automation/abi-check/expected-report-libssl3.so.txt
@@ -0,0 +1,4 @@
+2 Added functions:
+
+  'function PRBool SSL_CertIsUsable(PRFileDesc*, CERTCertificate*)'    {SSL_CertIsUsable@@NSS_3.77}
+  'function SECStatus SSL_FilterClientCertListBySocket(PRFileDesc*, CERTCertList*)'    {SSL_FilterClientCertListBySocket@@NSS_3.77}