Rob Crittenden added support for NSS (Network Security Service) for the

SSL/TLS layer. http://www.mozilla.org/projects/security/pki/nss/

7 files changed, 55 insertions, 14 deletions

diff --git a/docs/FAQ b/docs/FAQ
index ea8b8ccdd..e2bf53ae0 100644
--- a/docs/FAQ
+++ b/docs/FAQ
@@ -358,10 +358,10 @@ FAQ
 
   2.2 Does curl work/build with other SSL libraries?
 
-  Curl has been written to use OpenSSL, GnuTLS or yassl, although there should
-  not be many problems using a different library. If anyone does "port" curl
-  to use a different SSL library, we are of course very interested in getting
-  the patch!
+  Curl has been written to use OpenSSL, GnuTLS, yassl or NSS, although there
+  should not be many problems using a different library. If anyone does "port"
+  curl to use a different SSL library, we are of course very interested in
+  getting the patch!
 
   2.3 Where can I find a copy of LIBEAY32.DLL?
 
@@ -844,6 +844,8 @@ FAQ
 
     http://www.gnu.org/software/gnutls/manual/html_node/Multi_002dthreaded-applications.html
 
+  No special locking is needed with a NSS-powered libcurl. NSS is thread-safe.
+
   5.2 How can I receive all data into a large memory chunk?
 
   [ See also the examples/getinmemory.c source ]
diff --git a/docs/FEATURES b/docs/FEATURES
index e5331fc81..1bbbfef08 100644
--- a/docs/FEATURES
+++ b/docs/FEATURES
@@ -116,10 +116,10 @@ FILE
 FOOTNOTES
 =========
 
-  *1 = requires OpenSSL or GnuTLS
+  *1 = requires OpenSSL, GnuTLS or NSS
   *2 = requires OpenLDAP
   *3 = requires a GSSAPI-compliant library, such as Heimdal or similar.
   *4 = requires FBopenssl
   *5 = requires a krb4 library, such as the MIT one or similar.
   *6 = requires c-ares
-  *7 = requires OpenSSL specificly, as GnuTLS only supports SSLv3 and TLSv1
+  *7 = requires OpenSSL or NSS, as GnuTLS only supports SSLv3 and TLSv1
diff --git a/docs/INSTALL b/docs/INSTALL
index 6da338055..7b98ab215 100644
--- a/docs/INSTALL
+++ b/docs/INSTALL
@@ -140,6 +140,9 @@ UNIX
      yassl with its OpenSSL emulation enabled and point to that directory root
      with configure --with-ssl.
 
+     To build with NSS support instead of OpenSSL for SSL/TLS, note that
+     you need to use both --without-ssl and --with-nss.
+
 
 Win32
 =====
diff --git a/docs/LICENSE-MIXING b/docs/LICENSE-MIXING
index 60f5f934c..c5a158446 100644
--- a/docs/LICENSE-MIXING
+++ b/docs/LICENSE-MIXING
@@ -47,6 +47,14 @@ yassl   http://www.yassl.com/
         (May be used for SSL/TLS support) Uses the GPL[1] license. If this is
         a problem for you, consider using OpenSSL or GnuTLS instead.
 
+NSS     http://www.mozilla.org/projects/security/pki/nss/
+
+        (May be used for SSL/TLS support) Is covered by the MPL[4] license,
+        the GPL[1] license and the LGPL[3] license. You may choose to license
+        the code under MPL terms, GPL terms, or LGPL terms. These licenses
+        grant you different permissions and impose different obligations. You
+        should select the license that best meets your needs.
+
 c-ares  http://daniel.haxx.se/projects/c-ares/license.html
 
         (Used for asynchronous name resolves) Uses an MIT license that is very
@@ -110,3 +118,5 @@ OpenLDAP http://www.openldap.org/software/release/license.html
       how to write such an exception to the GPL
 [3] = LGPL - GNU Lesser General Public License:
       http://www.gnu.org/licenses/lgpl.html
+[4] = MPL - Mozilla Public License:
+      http://www.mozilla.org/MPL/
diff --git a/docs/TODO b/docs/TODO
index a19e47d94..53176a4e0 100644
--- a/docs/TODO
+++ b/docs/TODO
@@ -157,16 +157,14 @@ TODO
    Clark)
 
  * Make curl's SSL layer capable of using other free SSL libraries.  Such as
-   Mozilla Security Services
-   (http://www.mozilla.org/projects/security/pki/nss/) or MatrixSSL
-   (http://www.matrixssl.org/).
+   MatrixSSL (http://www.matrixssl.org/).
 
  * Peter Sylvester's patch for SRP on the TLS layer.
    Awaits OpenSSL support for this, no need to support this in libcurl before
    there's an OpenSSL release that does it.
 
- * make the configure --with-ssl option first check for OpenSSL and then for
-   GnuTLS if OpenSSL wasn't detected.
+ * make the configure --with-ssl option first check for OpenSSL, then GnuTLS,
+   then NSS...
 
  GnuTLS
 
diff --git a/docs/curl.1 b/docs/curl.1
index cd69f08ff..881cd77a2 100644
--- a/docs/curl.1
+++ b/docs/curl.1
@@ -167,6 +167,10 @@ difference.
 must be using valid ciphers. Read up on SSL cipher list details on this URL:
 \fIhttp://www.openssl.org/docs/apps/ciphers.html\fP
 
+NSS ciphers are done differently than OpenSSL and GnuTLS. The full list of
+NSS ciphers is in the NSSCipherSuite entry at this URL:
+\fIhttp://directory.fedora.redhat.com/docs/mod_nss.html#Directives\fP
+
 If this option is used several times, the last one will override the others.
 .IP "--compressed"
 (HTTP) Request a compressed response using one of the algorithms libcurl
@@ -323,6 +327,10 @@ this option assumes a \&"certificate" file that is the private key and the
 private certificate concatenated! See \fI--cert\fP and \fI--key\fP to specify
 them independently.
 
+If curl is built against the NSS SSL library then this option tells
+curl the nickname of the certificate to use within the NSS database defined
+by --cacert.
+
 If this option is used several times, the last one will be used.
 .IP "--cert-type <type>"
 (SSL) Tells curl what certificate type the provided certificate is in. PEM,
@@ -342,6 +350,9 @@ The windows version of curl will automatically look for a CA certs file named
 \'curl-ca-bundle.crt\', either in the same directory as curl.exe, or in the
 Current Working Directory, or in any folder along your PATH.
 
+If curl is built against the NSS SSL library then this option tells
+curl the directory that the NSS certificate database resides in.
+
 If this option is used several times, the last one will be used.
 .IP "--capath <CA certificate directory>"
 (SSL) Tells curl to use the specified certificate directory to verify the
diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3
index 0c55e1400..66ca11f34 100644
--- a/docs/libcurl/curl_easy_setopt.3
+++ b/docs/libcurl/curl_easy_setopt.3
@@ -1178,6 +1178,9 @@ transfers. (Added in 7.15.2)
 Pass a pointer to a zero terminated string as parameter. The string should be
 the file name of your certificate. The default format is "PEM" and can be
 changed with \fICURLOPT_SSLCERTTYPE\fP.
+
+With NSS this is the nickname of the certificate you wish to authenticate
+with.
 .IP CURLOPT_SSLCERTTYPE
 Pass a pointer to a zero terminated string as parameter. The string should be
 the format of your certificate. Supported formats are "PEM" and "DER".  (Added
@@ -1222,8 +1225,8 @@ Pass a long as parameter to control what version of SSL/TLS to attempt to use.
 The available options are:
 .RS
 .IP CURL_SSLVERSION_DEFAULT
-The default action. When libcurl built with OpenSSL, this will attempt to
-figure out the remote SSL protocol version. Unfortunately there are a lot of
+The default action. When libcurl built with OpenSSL or NSS, this will attempt
+to figure out the remote SSL protocol version. Unfortunately there are a lot of
 ancient and broken servers in use which cannot handle this technique and will
 fail to connect. When libcurl is built with GnuTLS, this will mean SSLv3.
 .IP CURL_SSLVERSION_TLSv1
@@ -1266,6 +1269,9 @@ even indicate an accessible file.
 
 Note that option is by default set to the system path where libcurl's cacert
 bundle is assumed to be stored, as established at build time.
+
+When built against NSS this is the directory that the NSS certificate
+database resides in.
 .IP CURLOPT_CAPATH
 Pass a char * to a zero terminated string naming a directory holding multiple
 CA certificates to verify the peer with. The certificate directory must be
@@ -1315,12 +1321,23 @@ Pass a char *, pointing to a zero terminated string holding the list of
 ciphers to use for the SSL connection. The list must be syntactically correct,
 it consists of one or more cipher strings separated by colons. Commas or spaces
 are also acceptable separators but colons are normally used, \!, \- and \+ can
-be used as operators. Valid examples of cipher lists include 'RC4-SHA',
+be used as operators.
+
+For OpenSSL and GnuTLS valid examples of cipher lists include 'RC4-SHA',
 \'SHA1+DES\', 'TLSv1' and 'DEFAULT'. The default list is normally set when you
 compile OpenSSL.
 
 You'll find more details about cipher lists on this URL:
 \fIhttp://www.openssl.org/docs/apps/ciphers.html\fP
+
+For NSS valid examples of cipher lists include 'rsa_rc4_128_md5',
+\'rsa_aes_128_sha\', etc. With NSS you don't add/remove ciphers. If one uses
+this option then all known ciphers are disabled and only those passed in
+are enabled.
+
+You'll find more details about the NSS cipher lists on this URL:
+\fIhttp://directory.fedora.redhat.com/docs/mod_nss.html#Directives\fP
+
 .IP CURLOPT_SSL_SESSIONID_CACHE
 Pass a long set to 0 to disable libcurl's use of SSL session-ID caching. Set
 this to 1 to enable it. By default all transfers are done using the