From 4d56a6c3a11f005706c8c7c3df5acc52dd5ee14c Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 3 Sep 2019 09:47:21 +0200 Subject: [PATCH 01/41] Update to NSS 3.46 --- .gitignore | 1 + STAGE2-nss | 68 -------- nss-cavs-tests.patch | 155 ------------------ nss.spec | 8 +- sources | 2 +- .../Makefile | 64 -------- .../PURPOSE | 4 - .../runtest.sh | 125 -------------- tests/tests.yml | 12 -- 9 files changed, 7 insertions(+), 432 deletions(-) delete mode 100644 STAGE2-nss delete mode 100644 nss-cavs-tests.patch delete mode 100644 tests/NSS-tools-should-not-use-SHA1-by-default-when/Makefile delete mode 100644 tests/NSS-tools-should-not-use-SHA1-by-default-when/PURPOSE delete mode 100755 tests/NSS-tools-should-not-use-SHA1-by-default-when/runtest.sh delete mode 100644 tests/tests.yml diff --git a/.gitignore b/.gitignore index 23a0c00..f245589 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ TestUser51.cert /nss-3.43.tar.gz /nss-3.44.tar.gz /nss-3.44.1.tar.gz +/nss-3.46.tar.gz diff --git a/STAGE2-nss b/STAGE2-nss deleted file mode 100644 index 3d43b92..0000000 --- a/STAGE2-nss +++ /dev/null @@ -1,68 +0,0 @@ -#requires nspr -#requires perl -#requires nss-util -#requires nss-softokn - -mcd $BUILDDIR/nss - -export BUILD_OPT=1 -export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1 -export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 -export NSPR_INCLUDE_DIR=/usr/include/nspr -export NSPR_LIB_DIR=/usr/lib${SUFFIX} -export NSS_USE_SYSTEM_SQLITE=1 -export NSS_BUILD_WITHOUT_SOFTOKEN=1 -export USE_SYSTEM_SOFTOKEN=1 -export SOFTOKEN_LIB_DIR=/usr/lib${SUFFIX} -export NSSUTIL_INCLUDE_DIR=/usr/include/nss3 -export NSSUTIL_LIB_DIR=/usr/lib${SUFFIX} -export USE_SYSTEM_NSSUTIL=1 -export FREEBL_INCLUDE_DIR=/usr/include/nss3 -export FREEBL_LIB_DIR=/usr/lib${SUFFIX} -export USE_SYSTEM_FREEBL=1 -export NSS_USE_SYSTEM_FREEBL=1 -export FREEBL_NO_DEPEND=1 -export IN_TREE_FREEBL_HEADERS_FIRST=1 -export NSS_BLTEST_NOT_AVAILABLE=1 -export NSS_NO_SSL2_NO_EXPORT=1 -export NSS_ECC_MORE_THAN_SUITE_B=1 -export NSS_NO_PKCS11_BYPASS=1 -#export NSDISTMODE="copy" - -if [ "$SUFFIX" = "64" ]; then - USE_64=1 - export USE_64 -fi - -(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp nss/lib/ckfw/nssck.api dist/private/nss/) - -make -C $SRC/nss-3.*/nss/coreconf -make -C $SRC/nss-3.*/nss/lib/dbm - -# nss/nssinit.c, ssl/sslcon.c, smime/smimeutil.c and ckfw/builtins/binst.c -# need nss/verref.h which is exported privately, move it to where it can be found. -(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp -a nss/verref.h dist/private/nss/) - -make -C $SRC/nss-3.*/nss -cd $SRC/nss-3.*/nss/coreconf -make install -cd $SRC/nss-3.*/nss/lib/dbm -make install -cd $SRC/nss-3.*/nss -make install -# Copy the binary libraries we want -NSSLIBS="libnss3.so libnssckbi.so libnsspem.so libnsssysinit.so libsmime3.so libssl3.so" -# BOZO: temporarily disable FIPS140 support -#NSSLIBCHKS="libnssdbm3.chk libfreebl3.chk libsoftokn3.chk" -NSSLIBCHKS="" -# END BOZO -cd $SRC/nss-3.* -for file in $NSSLIBS $NSSLIBCHKS -do - install -p -m 755 dist/*.OBJ/lib/$file /usr/lib${SUFFIX}/ -done -# Copy the include files we want -for file in $SRC/nss-*/dist/public/nss/*.h -do - install -p -m 644 $file /usr/include/nss3/ -done diff --git a/nss-cavs-tests.patch b/nss-cavs-tests.patch deleted file mode 100644 index c0b2306..0000000 --- a/nss-cavs-tests.patch +++ /dev/null @@ -1,155 +0,0 @@ -# HG changeset patch -# User Daiki Ueno -# Date 1562162181 -7200 -# Wed Jul 03 15:56:21 2019 +0200 -# Node ID 88feab2a3e5e4b00b1626d59a0d3ecef93cafb92 -# Parent b5d3f574967f8c5c705dab15682b0e16fac3e4be -tests: ensure CAVS test dirs are created - -diff --git a/tests/fips/cavs_scripts/aes.sh b/tests/fips/cavs_scripts/aes.sh ---- a/tests/fips/cavs_scripts/aes.sh -+++ b/tests/fips/cavs_scripts/aes.sh -@@ -83,6 +83,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $cbc_kat_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/aesgcm.sh b/tests/fips/cavs_scripts/aesgcm.sh ---- a/tests/fips/cavs_scripts/aesgcm.sh -+++ b/tests/fips/cavs_scripts/aesgcm.sh -@@ -56,6 +56,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $gcm_decrypt_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/dsa.sh b/tests/fips/cavs_scripts/dsa.sh ---- a/tests/fips/cavs_scripts/dsa.sh -+++ b/tests/fips/cavs_scripts/dsa.sh -@@ -59,6 +59,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - request=KeyPair.req - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/ecdsa.sh b/tests/fips/cavs_scripts/ecdsa.sh ---- a/tests/fips/cavs_scripts/ecdsa.sh -+++ b/tests/fips/cavs_scripts/ecdsa.sh -@@ -50,6 +50,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - request=KeyPair.req - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/hmac.sh b/tests/fips/cavs_scripts/hmac.sh ---- a/tests/fips/cavs_scripts/hmac.sh -+++ b/tests/fips/cavs_scripts/hmac.sh -@@ -31,6 +31,9 @@ if [ ${COMMAND} = "verify" ]; then - done - exit $result - fi -+ -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $hmac_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/ike.sh b/tests/fips/cavs_scripts/ike.sh ---- a/tests/fips/cavs_scripts/ike.sh -+++ b/tests/fips/cavs_scripts/ike.sh -@@ -33,6 +33,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - request=ikev1_dsa.req - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/kas.sh b/tests/fips/cavs_scripts/kas.sh ---- a/tests/fips/cavs_scripts/kas.sh -+++ b/tests/fips/cavs_scripts/kas.sh -@@ -68,6 +68,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - request=KASFunctionTest_ECCEphemeralUnified_NOKC_ZZOnly_init.req - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/rng.sh b/tests/fips/cavs_scripts/rng.sh ---- a/tests/fips/cavs_scripts/rng.sh -+++ b/tests/fips/cavs_scripts/rng.sh -@@ -30,6 +30,9 @@ if [ ${COMMAND} = "verify" ]; then - done - exit $result - fi -+ -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $drbg_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/rsa.sh b/tests/fips/cavs_scripts/rsa.sh ---- a/tests/fips/cavs_scripts/rsa.sh -+++ b/tests/fips/cavs_scripts/rsa.sh -@@ -38,6 +38,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - request=SigGen15_186-3.req - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/sha.sh b/tests/fips/cavs_scripts/sha.sh ---- a/tests/fips/cavs_scripts/sha.sh -+++ b/tests/fips/cavs_scripts/sha.sh -@@ -51,6 +51,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $sha_ShortMsg_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/tdea.sh b/tests/fips/cavs_scripts/tdea.sh ---- a/tests/fips/cavs_scripts/tdea.sh -+++ b/tests/fips/cavs_scripts/tdea.sh -@@ -77,6 +77,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $cbc_kat_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/tls.sh b/tests/fips/cavs_scripts/tls.sh ---- a/tests/fips/cavs_scripts/tls.sh -+++ b/tests/fips/cavs_scripts/tls.sh -@@ -30,6 +30,9 @@ if [ ${COMMAND} = "verify" ]; then - done - exit $result - fi -+ -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $tls_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response diff --git a/nss.spec b/nss.spec index aab54ef..0133a31 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.21.0 -%global nss_version 3.44.1 +%global nss_version 3.46.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -109,7 +109,6 @@ Patch3: nss-module-leak.patch Patch4: iquote.patch # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1552767 Patch5: nss-skip-tls13-fips.patch -Patch6: nss-cavs-tests.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -874,6 +873,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Sep 3 2019 Daiki Ueno - 3.46.0-2 +- Update to NSS 3.46 + * Thu Jul 25 2019 Fedora Release Engineering - 3.44.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index 53b9c62..7b4873a 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.44.1.tar.gz) = eb8777701a25b54377026633b6bf284e4c62308012058355f348a7c57525afe96db74a07de41ba01754e316a7dff06689de527359a5474ed7ab606779c4cf169 +SHA512 (nss-3.46.tar.gz) = de309ec8d6aa2c3cf4d5ebfe9fa1f8bf5def717d22018d5c88c1de963b4ae7b0d69ad64e68d830574fc85613483fd538cb2f319ffb3fa2e1b97ec02f85d37c48 diff --git a/tests/NSS-tools-should-not-use-SHA1-by-default-when/Makefile b/tests/NSS-tools-should-not-use-SHA1-by-default-when/Makefile deleted file mode 100644 index ea65d87..0000000 --- a/tests/NSS-tools-should-not-use-SHA1-by-default-when/Makefile +++ /dev/null @@ -1,64 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/nss/Regression/NSS-tools-should-not-use-SHA1-by-default-when -# Description: NSS tools should not use SHA1 by default when -# Author: Hubert Kario -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/nss/Regression/NSS-tools-should-not-use-SHA1-by-default-when -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - test -x runtest.sh || chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Hubert Kario " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: NSS tools should not use SHA1 by default when" >> $(METADATA) - @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: nss openssl" >> $(METADATA) - @echo "Requires: nss nss-tools openssl" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) - - rhts-lint $(METADATA) diff --git a/tests/NSS-tools-should-not-use-SHA1-by-default-when/PURPOSE b/tests/NSS-tools-should-not-use-SHA1-by-default-when/PURPOSE deleted file mode 100644 index 7caf493..0000000 --- a/tests/NSS-tools-should-not-use-SHA1-by-default-when/PURPOSE +++ /dev/null @@ -1,4 +0,0 @@ -PURPOSE of NSS-tools-should-not-use-SHA1-by-default-when -Description: NSS tools should not use SHA1 by default when -Author: Hubert Kario -Summary: NSS tools should not use SHA1 by default when generating digital signatures/certificates diff --git a/tests/NSS-tools-should-not-use-SHA1-by-default-when/runtest.sh b/tests/NSS-tools-should-not-use-SHA1-by-default-when/runtest.sh deleted file mode 100755 index 8290d92..0000000 --- a/tests/NSS-tools-should-not-use-SHA1-by-default-when/runtest.sh +++ /dev/null @@ -1,125 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of NSS-tools-should-not-use-SHA1-by-default-when -# Description: NSS tools should not use SHA1 by default when -# Author: Hubert Kario -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="nss" -PACKAGES="nss openssl" -DBDIR="nssdb" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm --all - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlRun "mkdir nssdb" - rlRun "certutil -N -d $DBDIR --empty-password" - rlLogInfo "Create a JAR file" - rlRun "mkdir java-dir" - rlRun "pushd java-dir" - rlRun "mkdir META-INF mypackage" - rlRun "echo 'Main-Class: mypackage/MyMainFile' > META-INF/MANIFEST.MF" - rlRun "echo 'Those are not the droids you are looking for' > mypackage/MyMainFile.class" - #rlRun "jar -cfe package.jar mypackage/MyMainFile mypackage/MyMainFile.class" - rlRun "popd" - #rlRun "mv java-dir/package.jar ." - rlPhaseEnd - - rlPhaseStartTest "Self signing certificates" - rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null" - rlRun "certutil -d $DBDIR -S -n 'CA' -t 'cTC,cTC,cTC' -s 'CN=CA' -x -z noise" - rlRun -s "certutil -d $DBDIR -L -n 'CA' -a | openssl x509 -noout -text" - rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG" - rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG - rlPhaseEnd - - rlPhaseStartTest "Signing certificates" - rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null" - rlRun "certutil -d $DBDIR -S -n 'server' -t 'u,u,u' -s 'CN=server.example.com' -c 'CA' -z noise --nsCertType sslClient,sslServer,objectSigning,smime" - rlRun -s "certutil -d $DBDIR -L -n 'server' -a | openssl x509 -noout -text" - rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG" - rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG - rlPhaseEnd - - rlPhaseStartTest "Certificate request" - rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null" - rlRun "mkdir srv2db" - rlRun "certutil -d srv2db -N --empty-password" - rlRun "certutil -d srv2db -R -s CN=www.example.com -o srv2.req -a -z noise" - rlRun -s "openssl req -noout -text -in srv2.req" - rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG" - rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG - rlRun "certutil -d $DBDIR -C -c 'CA' -i srv2.req -a -o srv2.crt" - rlRun -s "openssl x509 -in srv2.crt -noout -text" - rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG" - rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG - rlRun "rm -rf srv2db" - rlPhaseEnd - - rlPhaseStartTest "Certificate request with SHA1" - rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null" - rlRun "mkdir srv2db" - rlRun "certutil -d srv2db -N --empty-password" - rlRun "certutil -d srv2db -R -s CN=www.example.com -o srv2.req -a -z noise -Z SHA1" - rlRun -s "openssl req -noout -text -in srv2.req" - rlAssertGrep "Signature Algorithm: sha1WithRSAEncryption" "$rlRun_LOG" - rlRun "certutil -d $DBDIR -C -c 'CA' -i srv2.req -a -o srv2.crt" - rlRun -s "openssl x509 -in srv2.crt -noout -text" - rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG" - rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG - rlRun "rm -rf srv2db" - rlPhaseEnd - - rlPhaseStartTest "Signing CMS messages" - rlRun "echo 'This is a document' > document.txt" - rlRun "cmsutil -S -d $DBDIR -N 'server' -i document.txt -o document.cms" - rlRun -s "openssl cms -in document.cms -inform der -noout -cmsout -print" - rlAssertGrep "algorithm: sha256" $rlRun_LOG - rlAssertNotGrep "algorithm: sha1" $rlRun_LOG - rlPhaseEnd - - rlPhaseStartTest "CRL signing" - rlRun "echo $(date --utc +update=%Y%m%d%H%M%SZ) > script" - rlRun "echo $(date -d 'next week' --utc +nextupdate=%Y%m%d%H%M%SZ) >> script" - rlRun "echo addext crlNumber 0 1245 >>script" - rlRun "echo addcert 12 $(date -d 'yesterday' --utc +%Y%m%d%H%M%SZ) >>script" - rlRun "echo addext reasonCode 0 0 >>script" - rlRun "cat script" - rlRun "crlutil -G -c script -d $DBDIR -n CA -o ca.crl" - rlRun -s "openssl crl -in ca.crl -inform der -noout -text" - rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" $rlRun_LOG - rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index df64aa2..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,12 +0,0 @@ ---- -# This first play always runs on the local staging system -- hosts: localhost - roles: - - role: standard-test-beakerlib - tags: - - classic - tests: - - NSS-tools-should-not-use-SHA1-by-default-when - required_packages: - - nss-tools - - nss From 64e05e396da0fd191f379b91afed334e1ae4a4f6 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 3 Sep 2019 09:51:35 +0200 Subject: [PATCH 02/41] Restore files mistakenly removed in the last commit --- STAGE2-nss | 68 ++++++++++ .../Makefile | 64 +++++++++ .../PURPOSE | 4 + .../runtest.sh | 125 ++++++++++++++++++ tests/tests.yml | 12 ++ 5 files changed, 273 insertions(+) create mode 100644 STAGE2-nss create mode 100644 tests/NSS-tools-should-not-use-SHA1-by-default-when/Makefile create mode 100644 tests/NSS-tools-should-not-use-SHA1-by-default-when/PURPOSE create mode 100755 tests/NSS-tools-should-not-use-SHA1-by-default-when/runtest.sh create mode 100644 tests/tests.yml diff --git a/STAGE2-nss b/STAGE2-nss new file mode 100644 index 0000000..3d43b92 --- /dev/null +++ b/STAGE2-nss @@ -0,0 +1,68 @@ +#requires nspr +#requires perl +#requires nss-util +#requires nss-softokn + +mcd $BUILDDIR/nss + +export BUILD_OPT=1 +export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1 +export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 +export NSPR_INCLUDE_DIR=/usr/include/nspr +export NSPR_LIB_DIR=/usr/lib${SUFFIX} +export NSS_USE_SYSTEM_SQLITE=1 +export NSS_BUILD_WITHOUT_SOFTOKEN=1 +export USE_SYSTEM_SOFTOKEN=1 +export SOFTOKEN_LIB_DIR=/usr/lib${SUFFIX} +export NSSUTIL_INCLUDE_DIR=/usr/include/nss3 +export NSSUTIL_LIB_DIR=/usr/lib${SUFFIX} +export USE_SYSTEM_NSSUTIL=1 +export FREEBL_INCLUDE_DIR=/usr/include/nss3 +export FREEBL_LIB_DIR=/usr/lib${SUFFIX} +export USE_SYSTEM_FREEBL=1 +export NSS_USE_SYSTEM_FREEBL=1 +export FREEBL_NO_DEPEND=1 +export IN_TREE_FREEBL_HEADERS_FIRST=1 +export NSS_BLTEST_NOT_AVAILABLE=1 +export NSS_NO_SSL2_NO_EXPORT=1 +export NSS_ECC_MORE_THAN_SUITE_B=1 +export NSS_NO_PKCS11_BYPASS=1 +#export NSDISTMODE="copy" + +if [ "$SUFFIX" = "64" ]; then + USE_64=1 + export USE_64 +fi + +(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp nss/lib/ckfw/nssck.api dist/private/nss/) + +make -C $SRC/nss-3.*/nss/coreconf +make -C $SRC/nss-3.*/nss/lib/dbm + +# nss/nssinit.c, ssl/sslcon.c, smime/smimeutil.c and ckfw/builtins/binst.c +# need nss/verref.h which is exported privately, move it to where it can be found. +(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp -a nss/verref.h dist/private/nss/) + +make -C $SRC/nss-3.*/nss +cd $SRC/nss-3.*/nss/coreconf +make install +cd $SRC/nss-3.*/nss/lib/dbm +make install +cd $SRC/nss-3.*/nss +make install +# Copy the binary libraries we want +NSSLIBS="libnss3.so libnssckbi.so libnsspem.so libnsssysinit.so libsmime3.so libssl3.so" +# BOZO: temporarily disable FIPS140 support +#NSSLIBCHKS="libnssdbm3.chk libfreebl3.chk libsoftokn3.chk" +NSSLIBCHKS="" +# END BOZO +cd $SRC/nss-3.* +for file in $NSSLIBS $NSSLIBCHKS +do + install -p -m 755 dist/*.OBJ/lib/$file /usr/lib${SUFFIX}/ +done +# Copy the include files we want +for file in $SRC/nss-*/dist/public/nss/*.h +do + install -p -m 644 $file /usr/include/nss3/ +done diff --git a/tests/NSS-tools-should-not-use-SHA1-by-default-when/Makefile b/tests/NSS-tools-should-not-use-SHA1-by-default-when/Makefile new file mode 100644 index 0000000..ea65d87 --- /dev/null +++ b/tests/NSS-tools-should-not-use-SHA1-by-default-when/Makefile @@ -0,0 +1,64 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/nss/Regression/NSS-tools-should-not-use-SHA1-by-default-when +# Description: NSS tools should not use SHA1 by default when +# Author: Hubert Kario +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/nss/Regression/NSS-tools-should-not-use-SHA1-by-default-when +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Hubert Kario " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: NSS tools should not use SHA1 by default when" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: nss openssl" >> $(METADATA) + @echo "Requires: nss nss-tools openssl" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/tests/NSS-tools-should-not-use-SHA1-by-default-when/PURPOSE b/tests/NSS-tools-should-not-use-SHA1-by-default-when/PURPOSE new file mode 100644 index 0000000..7caf493 --- /dev/null +++ b/tests/NSS-tools-should-not-use-SHA1-by-default-when/PURPOSE @@ -0,0 +1,4 @@ +PURPOSE of NSS-tools-should-not-use-SHA1-by-default-when +Description: NSS tools should not use SHA1 by default when +Author: Hubert Kario +Summary: NSS tools should not use SHA1 by default when generating digital signatures/certificates diff --git a/tests/NSS-tools-should-not-use-SHA1-by-default-when/runtest.sh b/tests/NSS-tools-should-not-use-SHA1-by-default-when/runtest.sh new file mode 100755 index 0000000..8290d92 --- /dev/null +++ b/tests/NSS-tools-should-not-use-SHA1-by-default-when/runtest.sh @@ -0,0 +1,125 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of NSS-tools-should-not-use-SHA1-by-default-when +# Description: NSS tools should not use SHA1 by default when +# Author: Hubert Kario +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="nss" +PACKAGES="nss openssl" +DBDIR="nssdb" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm --all + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "mkdir nssdb" + rlRun "certutil -N -d $DBDIR --empty-password" + rlLogInfo "Create a JAR file" + rlRun "mkdir java-dir" + rlRun "pushd java-dir" + rlRun "mkdir META-INF mypackage" + rlRun "echo 'Main-Class: mypackage/MyMainFile' > META-INF/MANIFEST.MF" + rlRun "echo 'Those are not the droids you are looking for' > mypackage/MyMainFile.class" + #rlRun "jar -cfe package.jar mypackage/MyMainFile mypackage/MyMainFile.class" + rlRun "popd" + #rlRun "mv java-dir/package.jar ." + rlPhaseEnd + + rlPhaseStartTest "Self signing certificates" + rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null" + rlRun "certutil -d $DBDIR -S -n 'CA' -t 'cTC,cTC,cTC' -s 'CN=CA' -x -z noise" + rlRun -s "certutil -d $DBDIR -L -n 'CA' -a | openssl x509 -noout -text" + rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG" + rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "Signing certificates" + rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null" + rlRun "certutil -d $DBDIR -S -n 'server' -t 'u,u,u' -s 'CN=server.example.com' -c 'CA' -z noise --nsCertType sslClient,sslServer,objectSigning,smime" + rlRun -s "certutil -d $DBDIR -L -n 'server' -a | openssl x509 -noout -text" + rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG" + rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "Certificate request" + rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null" + rlRun "mkdir srv2db" + rlRun "certutil -d srv2db -N --empty-password" + rlRun "certutil -d srv2db -R -s CN=www.example.com -o srv2.req -a -z noise" + rlRun -s "openssl req -noout -text -in srv2.req" + rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG" + rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG + rlRun "certutil -d $DBDIR -C -c 'CA' -i srv2.req -a -o srv2.crt" + rlRun -s "openssl x509 -in srv2.crt -noout -text" + rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG" + rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG + rlRun "rm -rf srv2db" + rlPhaseEnd + + rlPhaseStartTest "Certificate request with SHA1" + rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null" + rlRun "mkdir srv2db" + rlRun "certutil -d srv2db -N --empty-password" + rlRun "certutil -d srv2db -R -s CN=www.example.com -o srv2.req -a -z noise -Z SHA1" + rlRun -s "openssl req -noout -text -in srv2.req" + rlAssertGrep "Signature Algorithm: sha1WithRSAEncryption" "$rlRun_LOG" + rlRun "certutil -d $DBDIR -C -c 'CA' -i srv2.req -a -o srv2.crt" + rlRun -s "openssl x509 -in srv2.crt -noout -text" + rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG" + rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG + rlRun "rm -rf srv2db" + rlPhaseEnd + + rlPhaseStartTest "Signing CMS messages" + rlRun "echo 'This is a document' > document.txt" + rlRun "cmsutil -S -d $DBDIR -N 'server' -i document.txt -o document.cms" + rlRun -s "openssl cms -in document.cms -inform der -noout -cmsout -print" + rlAssertGrep "algorithm: sha256" $rlRun_LOG + rlAssertNotGrep "algorithm: sha1" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "CRL signing" + rlRun "echo $(date --utc +update=%Y%m%d%H%M%SZ) > script" + rlRun "echo $(date -d 'next week' --utc +nextupdate=%Y%m%d%H%M%SZ) >> script" + rlRun "echo addext crlNumber 0 1245 >>script" + rlRun "echo addcert 12 $(date -d 'yesterday' --utc +%Y%m%d%H%M%SZ) >>script" + rlRun "echo addext reasonCode 0 0 >>script" + rlRun "cat script" + rlRun "crlutil -G -c script -d $DBDIR -n CA -o ca.crl" + rlRun -s "openssl crl -in ca.crl -inform der -noout -text" + rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" $rlRun_LOG + rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..df64aa2 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,12 @@ +--- +# This first play always runs on the local staging system +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + tests: + - NSS-tools-should-not-use-SHA1-by-default-when + required_packages: + - nss-tools + - nss From cf10cdf0892723cee8f9f4dd5b5a35652c71a83e Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 3 Sep 2019 11:06:21 +0200 Subject: [PATCH 03/41] Remove upstreamed patch --- nss.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/nss.spec b/nss.spec index 0133a31..f77bd04 100644 --- a/nss.spec +++ b/nss.spec @@ -93,8 +93,6 @@ Source28: nss-p11-kit.config # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=617723 Patch2: nss-539183.patch -# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1549382 -Patch3: nss-module-leak.patch # This patch uses the GCC -iquote option documented at # http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options # to give the in-tree headers a higher priority over the system headers, From 79de609de68d90da05a338b4c0dc89dfb0b54a21 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 3 Sep 2019 11:08:58 +0200 Subject: [PATCH 04/41] Remove unused patch --- nss-module-leak.patch | 35 ----------------------------------- 1 file changed, 35 deletions(-) delete mode 100644 nss-module-leak.patch diff --git a/nss-module-leak.patch b/nss-module-leak.patch deleted file mode 100644 index 7acf3f3..0000000 --- a/nss-module-leak.patch +++ /dev/null @@ -1,35 +0,0 @@ -# HG changeset patch -# User Daiki Ueno -# Date 1557150127 -7200 -# Mon May 06 15:42:07 2019 +0200 -# Node ID 438ac983bda9ec7944990d22a37877e9111caa90 -# Parent b018f3e84d87cce99a1fd81feeecb31123058687 -pk11slot: reference module from slot for finalization - -diff --git a/lib/pk11wrap/pk11slot.c b/lib/pk11wrap/pk11slot.c ---- a/lib/pk11wrap/pk11slot.c -+++ b/lib/pk11wrap/pk11slot.c -@@ -1439,6 +1439,11 @@ PK11_InitSlot(SECMODModule *mod, CK_SLOT - slot->slotID = slotID; - slot->isThreadSafe = mod->isThreadSafe; - slot->hasRSAInfo = PR_FALSE; -+ slot->module = mod; /* NOTE: we don't make a reference here because -+ * modules have references to their slots. This -+ * works because modules keep implicit references -+ * from their slots, and won't unload and disappear -+ * until all their slots have been freed */ - - if (PK11_GETTAB(slot)->C_GetSlotInfo(slotID, &slotInfo) != CKR_OK) { - slot->disabled = PR_TRUE; -@@ -1448,11 +1453,6 @@ PK11_InitSlot(SECMODModule *mod, CK_SLOT - - /* test to make sure claimed mechanism work */ - slot->needTest = mod->internal ? PR_FALSE : PR_TRUE; -- slot->module = mod; /* NOTE: we don't make a reference here because -- * modules have references to their slots. This -- * works because modules keep implicit references -- * from their slots, and won't unload and disappear -- * until all their slots have been freed */ - (void)PK11_MakeString(NULL, slot->slot_name, - (char *)slotInfo.slotDescription, sizeof(slotInfo.slotDescription)); - slot->isHW = (PRBool)((slotInfo.flags & CKF_HW_SLOT) == CKF_HW_SLOT); From f767d63b1bd068fa292391b91ff1bad1181152e7 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 4 Sep 2019 11:52:26 +0200 Subject: [PATCH 05/41] Rebuild with NSPR 4.22 --- nss-skip-tls13-fips.patch | 27 --------------------------- nss.spec | 9 +++++---- 2 files changed, 5 insertions(+), 31 deletions(-) delete mode 100644 nss-skip-tls13-fips.patch diff --git a/nss-skip-tls13-fips.patch b/nss-skip-tls13-fips.patch deleted file mode 100644 index 4a7c707..0000000 --- a/nss-skip-tls13-fips.patch +++ /dev/null @@ -1,27 +0,0 @@ -# HG changeset patch -# User Daiki Ueno -# Date 1558341826 -7200 -# Mon May 20 10:43:46 2019 +0200 -# Node ID b447f0046807b718d2928d0e33313620d38a287a -# Parent 02ea5f29ac3c1f1c6e6eb4b655afd9b4fc075a9e -tests: skip TLS 1.3 tests under FIPS mode - -diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh ---- a/tests/ssl/ssl.sh -+++ b/tests/ssl/ssl.sh -@@ -393,6 +393,15 @@ ssl_auth() - echo "${testname}" | grep "TLS 1.3" > /dev/null - TLS13=$? - -+ # Currently TLS 1.3 tests are known to fail under FIPS mode, -+ # because HKDF is implemented using the PKCS #11 functions -+ # prohibited under FIPS mode. -+ if [ "${TLS13}" -eq 0 ] && \ -+ [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then -+ echo "$SCRIPTNAME: skipping $testname (non-FIPS only)" -+ continue -+ fi -+ - if [ "${CLIENT_MODE}" = "fips" -a "${CAUTH}" -eq 0 ] ; then - echo "$SCRIPTNAME: skipping $testname (non-FIPS only)" - elif [ "$ectype" = "SNI" -a "$NORM_EXT" = "Extended Test" ] ; then diff --git a/nss.spec b/nss.spec index f77bd04..3d44579 100644 --- a/nss.spec +++ b/nss.spec @@ -1,4 +1,4 @@ -%global nspr_version 4.21.0 +%global nspr_version 4.22.0 %global nss_version 3.46.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -105,8 +105,6 @@ Patch2: nss-539183.patch # Once the buildroot aha been bootstrapped the patch may be removed # but it doesn't hurt to keep it. Patch4: iquote.patch -# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1552767 -Patch5: nss-skip-tls13-fips.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -871,6 +869,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Wed Sep 4 2019 Daiki Ueno - 3.46.0-2 +- Rebuild with NSPR 4.22 + * Tue Sep 3 2019 Daiki Ueno - 3.46.0-2 - Update to NSS 3.46 From 3c59bd0f5af2a3fb77434bb9551d4028dade2230 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 21 Oct 2019 13:48:37 +0200 Subject: [PATCH 06/41] Update to NSS 3.46.1 --- .gitignore | 1 + nss.spec | 9 ++++++--- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index f245589..8f02c46 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ TestUser51.cert /nss-3.44.tar.gz /nss-3.44.1.tar.gz /nss-3.46.tar.gz +/nss-3.46.1.tar.gz diff --git a/nss.spec b/nss.spec index 3d44579..a67fb7b 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ -%global nspr_version 4.22.0 -%global nss_version 3.46.0 +%global nspr_version 4.23.0 +%global nss_version 3.46.1 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -869,6 +869,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Oct 21 2019 Daiki Ueno - 3.46.1-1 +- Update to NSS 3.46.1 + * Wed Sep 4 2019 Daiki Ueno - 3.46.0-2 - Rebuild with NSPR 4.22 diff --git a/sources b/sources index 7b4873a..cef553a 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.46.tar.gz) = de309ec8d6aa2c3cf4d5ebfe9fa1f8bf5def717d22018d5c88c1de963b4ae7b0d69ad64e68d830574fc85613483fd538cb2f319ffb3fa2e1b97ec02f85d37c48 +SHA512 (nss-3.46.1.tar.gz) = f4c24f0e31d11413cbbf791a24687c02cd934b9baf4a3e9ce27406638a1d497654fbeec79c22ab4ad29374dd0063c05104c9514580b1b8156ed8d18404e1681b From b7b17c0e1f97461af87b3769355f7801bd72792f Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 22 Oct 2019 15:24:15 +0200 Subject: [PATCH 07/41] Update to NSS 3.47 --- .gitignore | 1 + nss.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 8f02c46..db90691 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ TestUser51.cert /nss-3.44.1.tar.gz /nss-3.46.tar.gz /nss-3.46.1.tar.gz +/nss-3.47.tar.gz diff --git a/nss.spec b/nss.spec index a67fb7b..5225209 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.23.0 -%global nss_version 3.46.1 +%global nss_version 3.47.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -869,6 +869,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Oct 22 2019 Daiki Ueno - 3.47.0-1 +- Update to NSS 3.47 + * Mon Oct 21 2019 Daiki Ueno - 3.46.1-1 - Update to NSS 3.46.1 diff --git a/sources b/sources index cef553a..324bcf1 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.46.1.tar.gz) = f4c24f0e31d11413cbbf791a24687c02cd934b9baf4a3e9ce27406638a1d497654fbeec79c22ab4ad29374dd0063c05104c9514580b1b8156ed8d18404e1681b +SHA512 (nss-3.47.tar.gz) = 99d04d28c38092826f5aab125662780865de49a97743ff0ab49a191bafae3ba3a937369cd6909ab23e7dcaf06482c8852b31ef057dc12c758f2681e03822e247 From 74e1e8c297617ec839e5fed2b07cc093cc8a3d08 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 23 Oct 2019 10:44:14 +0200 Subject: [PATCH 08/41] Install cmac.h required by blapi.h (#1764513) --- nss.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/nss.spec b/nss.spec index 5225209..8214426 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -552,7 +552,7 @@ do done # Copy some freebl include files we also want -for file in blapi.h alghmac.h +for file in blapi.h alghmac.h cmac.h do install -p -m 644 dist/private/nss/$file $RPM_BUILD_ROOT/%{_includedir}/nss3 done @@ -845,6 +845,7 @@ update-crypto-policies &> /dev/null || : %{_includedir}/nss3/blapi.h %{_includedir}/nss3/blapit.h %{_includedir}/nss3/alghmac.h +%{_includedir}/nss3/cmac.h %{_includedir}/nss3/lowkeyi.h %{_includedir}/nss3/lowkeyti.h @@ -869,6 +870,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Wed Oct 23 2019 Daiki Ueno - 3.47.0-2 +- Install cmac.h required by blapi.h (#1764513) + * Tue Oct 22 2019 Daiki Ueno - 3.47.0-1 - Update to NSS 3.47 From 0102258016c7ed9efc8e99564905647ecc5271d3 Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Mon, 4 Nov 2019 14:08:21 -0800 Subject: [PATCH 09/41] Resolves: rhbz#1768653 NSS softoken does not include CKM_NSS_IKE1_APP_B_PRF_DERIVE in it's mechanism list, causing libreswan to crash. --- nss-3.47-ike-fix.patch | 22 ++++++++++++++++++++++ nss.spec | 7 ++++++- 2 files changed, 28 insertions(+), 1 deletion(-) create mode 100644 nss-3.47-ike-fix.patch diff --git a/nss-3.47-ike-fix.patch b/nss-3.47-ike-fix.patch new file mode 100644 index 0000000..2de0aee --- /dev/null +++ b/nss-3.47-ike-fix.patch @@ -0,0 +1,22 @@ +diff -up ./lib/softoken/pkcs11.c.ike_fix ./lib/softoken/pkcs11.c +--- ./lib/softoken/pkcs11.c.ike_fix 2019-11-04 10:15:08.022176945 -0800 ++++ ./lib/softoken/pkcs11.c 2019-11-04 10:17:35.396733750 -0800 +@@ -330,7 +330,7 @@ static const struct mechanismList mechan + { CKM_AES_CTS, { 16, 32, CKF_EN_DE }, PR_TRUE }, + { CKM_AES_CTR, { 16, 32, CKF_EN_DE }, PR_TRUE }, + { CKM_AES_GCM, { 16, 32, CKF_EN_DE }, PR_TRUE }, +- { CKM_AES_XCBC_MAC_96, { 16, 16, CKF_SN_VR }, PR_TRUE }, ++ { CKM_AES_XCBC_MAC_96, { 12, 12, CKF_SN_VR }, PR_TRUE }, + { CKM_AES_XCBC_MAC, { 16, 16, CKF_SN_VR }, PR_TRUE }, + /* ------------------------- Camellia Operations --------------------- */ + { CKM_CAMELLIA_KEY_GEN, { 16, 32, CKF_GENERATE }, PR_TRUE }, +@@ -518,7 +518,8 @@ static const struct mechanismList mechan + /* --------------------IPSEC ----------------------- */ + { CKM_NSS_IKE_PRF_PLUS_DERIVE, { 8, 255 * 64, CKF_DERIVE }, PR_TRUE }, + { CKM_NSS_IKE_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE }, +- { CKM_NSS_IKE1_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE } ++ { CKM_NSS_IKE1_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE }, ++ { CKM_NSS_IKE1_APP_B_PRF_DERIVE, { 8, 255 * 64, CKF_DERIVE }, PR_TRUE } + }; + static const CK_ULONG mechanismCount = sizeof(mechanisms) / sizeof(mechanisms[0]); + diff --git a/nss.spec b/nss.spec index 8214426..a955a65 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 3%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -105,6 +105,8 @@ Patch2: nss-539183.patch # Once the buildroot aha been bootstrapped the patch may be removed # but it doesn't hurt to keep it. Patch4: iquote.patch +# add missing ike mechanism to softoken +Patch10: nss-3.47-ike-fix.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -870,6 +872,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Nov 7 2019 Bob Relyea - 3.47.0-3 +- Include ike mechanism fix + * Wed Oct 23 2019 Daiki Ueno - 3.47.0-2 - Install cmac.h required by blapi.h (#1764513) From ed198c758712beb5454df42b51a1bb521ed8def6 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 22 Nov 2019 18:02:43 +0100 Subject: [PATCH 10/41] Update to NSS 3.47.1 --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index db90691..2580845 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ TestUser51.cert /nss-3.46.tar.gz /nss-3.46.1.tar.gz /nss-3.47.tar.gz +/nss-3.47.1.tar.gz diff --git a/nss.spec b/nss.spec index a955a65..909d0c4 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.23.0 -%global nss_version 3.47.0 +%global nss_version 3.47.1 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 3%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -872,6 +872,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri Nov 22 2019 Daiki Ueno - 3.47.1-1 +- Update to NSS 3.47.1 + * Mon Nov 7 2019 Bob Relyea - 3.47.0-3 - Include ike mechanism fix diff --git a/sources b/sources index 324bcf1..e15e2b4 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.47.tar.gz) = 99d04d28c38092826f5aab125662780865de49a97743ff0ab49a191bafae3ba3a937369cd6909ab23e7dcaf06482c8852b31ef057dc12c758f2681e03822e247 +SHA512 (nss-3.47.1.tar.gz) = ddee53f58929e5f3849c9f88a3a6735453a258c3c32a7e3e73cc949e0b7ad2dff81b21db31c9c5e1ef3eb79d63c31660e38ce76c06ca54a5681dd611dc2e2ae9 From eab1ac886283ec38ccaad82f7a219afc9397ad13 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 28 Nov 2019 16:13:41 +0100 Subject: [PATCH 11/41] Fix intermittent SEC_ERROR_UNKNOWN_ISSUER (#1752303, #1648617) --- nss-3.47-certdb-temp-cert.patch | 230 ++++++++++++++++++++++++++++++++ nss.spec | 7 +- 2 files changed, 236 insertions(+), 1 deletion(-) create mode 100644 nss-3.47-certdb-temp-cert.patch diff --git a/nss-3.47-certdb-temp-cert.patch b/nss-3.47-certdb-temp-cert.patch new file mode 100644 index 0000000..b5623de --- /dev/null +++ b/nss-3.47-certdb-temp-cert.patch @@ -0,0 +1,230 @@ +# HG changeset patch +# User Daiki Ueno +# Date 1574953499 -3600 +# Thu Nov 28 16:04:59 2019 +0100 +# Node ID f1f705bd0528713216e16867233825c299d3e3b2 +# Parent 10722c590949819ed4d971ad5ae213bc8b11a1bf +Bug 1593167, certdb: prefer perm certs over temp certs when trust is not available + +Summary: +When a builtin root module is loaded after some temp certs being +loaded, our certificate lookup logic preferred those temp certs over +perm certs stored on the root module. This was a problem because such +temp certs are usually not accompanied with trust information. + +This makes the certificate lookup logic capable of handling such +situations by checking if the trust information is attached to temp +certs and otherwise falling back to perm certs. + +Reviewers: rrelyea, keeler + +Reviewed By: rrelyea + +Subscribers: heftig + +Bug #: 1593167 + +Differential Revision: https://phabricator.services.mozilla.com/D54726 + +diff --git a/lib/certdb/stanpcertdb.c b/lib/certdb/stanpcertdb.c +--- a/lib/certdb/stanpcertdb.c ++++ b/lib/certdb/stanpcertdb.c +@@ -340,6 +340,91 @@ CERT_AddTempCertToPerm(CERTCertificate * + return __CERT_AddTempCertToPerm(cert, nickname, trust); + } + ++static CERTCertificate * ++find_cert_by_der_cert(CERTCertDBHandle *handle, SECItem *derCert) ++{ ++ CERTCertificate *cc; ++ NSSCryptoContext *context; ++ NSSCertificate *cert = NULL; ++ NSSCertificate *tempCert = NULL; ++ NSSCertificate *permCert = NULL; ++ NSSDER encoding; ++ nssCertificateStoreTrace lockTrace = { NULL, NULL, PR_FALSE, PR_FALSE }; ++ nssCertificateStoreTrace unlockTrace = { NULL, NULL, PR_FALSE, PR_FALSE }; ++ ++ /* We retrieve a certificate instance for derCert in this order: ++ * 1. Look up a temp cert in the crypto context. If it is found ++ * and has a trust object associated, use it. ++ * 2. Look up a perm cert in the trust domain. If it is found, ++ * use it. Otherwise, use the temp cert. ++ */ ++ NSSITEM_FROM_SECITEM(&encoding, derCert); ++ context = STAN_GetDefaultCryptoContext(); ++ ++ /* First, see if it is already a temp cert */ ++ tempCert = NSSCryptoContext_FindCertificateByEncodedCertificate(context, ++ &encoding); ++ if (tempCert) { ++ NSSTrust *trust; ++ ++ trust = nssCryptoContext_FindTrustForCertificate(context, tempCert); ++ if (trust) { ++ nssTrust_Destroy(trust); ++ cert = tempCert; ++ tempCert = NULL; ++ } ++ } ++ ++ /* Then, see if it is already a perm cert */ ++ if (!cert && handle) { ++ permCert = NSSTrustDomain_FindCertificateByEncodedCertificate(handle, ++ &encoding); ++ if (permCert) { ++ /* Delete the temp instance */ ++ if (tempCert) { ++ nssCertificateStore_Lock(context->certStore, &lockTrace); ++ nssCertificateStore_RemoveCertLOCKED(context->certStore, ++ tempCert); ++ nssCertificateStore_Unlock(context->certStore, &lockTrace, ++ &unlockTrace); ++ } ++ cert = permCert; ++ permCert = NULL; ++ } else if (tempCert) { ++ cert = tempCert; ++ tempCert = NULL; ++ } ++ } ++ ++ if (tempCert) { ++ nssCertificate_Destroy(tempCert); ++ } ++ if (permCert) { ++ nssCertificate_Destroy(permCert); ++ } ++ ++ if (!cert) { ++ return NULL; ++ } ++ ++ /* Actually, that search ends up going by issuer/serial, ++ * so it is still possible to return a cert with the same ++ * issuer/serial but a different encoding, and we're ++ * going to reject that ++ */ ++ if (!nssItem_Equal(&cert->encoding, &encoding, NULL)) { ++ nssCertificate_Destroy(cert); ++ PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL); ++ return NULL; ++ } ++ ++ cc = STAN_GetCERTCertificateOrRelease(cert); ++ if (!cc) { ++ CERT_MapStanError(); ++ } ++ return cc; ++} ++ + CERTCertificate * + CERT_NewTempCertificate(CERTCertDBHandle *handle, SECItem *derCert, + char *nickname, PRBool isperm, PRBool copyDER) +@@ -351,32 +436,8 @@ CERT_NewTempCertificate(CERTCertDBHandle + NSSCryptoContext *gCC = STAN_GetDefaultCryptoContext(); + NSSTrustDomain *gTD = STAN_GetDefaultTrustDomain(); + if (!isperm) { +- NSSDER encoding; +- NSSITEM_FROM_SECITEM(&encoding, derCert); +- /* First, see if it is already a temp cert */ +- c = NSSCryptoContext_FindCertificateByEncodedCertificate(gCC, +- &encoding); +- if (!c && handle) { +- /* Then, see if it is already a perm cert */ +- c = NSSTrustDomain_FindCertificateByEncodedCertificate(handle, +- &encoding); +- } +- if (c) { +- /* actually, that search ends up going by issuer/serial, +- * so it is still possible to return a cert with the same +- * issuer/serial but a different encoding, and we're +- * going to reject that +- */ +- if (!nssItem_Equal(&c->encoding, &encoding, NULL)) { +- nssCertificate_Destroy(c); +- PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL); +- cc = NULL; +- } else { +- cc = STAN_GetCERTCertificateOrRelease(c); +- if (cc == NULL) { +- CERT_MapStanError(); +- } +- } ++ cc = find_cert_by_der_cert(handle, derCert); ++ if (cc) { + return cc; + } + } +@@ -598,19 +659,7 @@ CERT_FindCertByNickname(CERTCertDBHandle + CERTCertificate * + CERT_FindCertByDERCert(CERTCertDBHandle *handle, SECItem *derCert) + { +- NSSCryptoContext *cc; +- NSSCertificate *c; +- NSSDER encoding; +- NSSITEM_FROM_SECITEM(&encoding, derCert); +- cc = STAN_GetDefaultCryptoContext(); +- c = NSSCryptoContext_FindCertificateByEncodedCertificate(cc, &encoding); +- if (!c) { +- c = NSSTrustDomain_FindCertificateByEncodedCertificate(handle, +- &encoding); +- if (!c) +- return NULL; +- } +- return STAN_GetCERTCertificateOrRelease(c); ++ return find_cert_by_der_cert(handle, derCert); + } + + static CERTCertificate * +diff --git a/lib/pki/pkistore.c b/lib/pki/pkistore.c +--- a/lib/pki/pkistore.c ++++ b/lib/pki/pkistore.c +@@ -27,6 +27,8 @@ + + #include "prbit.h" + ++#include "secerr.h" ++ + /* + * Certificate Store + * +@@ -544,6 +546,13 @@ nssCertificateStore_FindCertificateByEnc + &serial); + PORT_Free(issuer.data); + PORT_Free(serial.data); ++ ++ if (rvCert && !nssItem_Equal(&rvCert->encoding, encoding, NULL)) { ++ nssCertificate_Destroy(rvCert); ++ PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL); ++ return NULL; ++ } ++ + return rvCert; + } + +diff --git a/lib/pki/trustdomain.c b/lib/pki/trustdomain.c +--- a/lib/pki/trustdomain.c ++++ b/lib/pki/trustdomain.c +@@ -15,6 +15,7 @@ + #include "pk11pub.h" + #include "nssrwlk.h" + #include "pk11priv.h" ++#include "secerr.h" + + #define NSSTRUSTDOMAIN_DEFAULT_CACHE_SIZE 32 + +@@ -841,6 +842,13 @@ nssTrustDomain_FindCertificateByEncodedC + &serial); + PORT_Free(issuer.data); + PORT_Free(serial.data); ++ ++ if (rvCert && !nssItem_Equal(&rvCert->encoding, ber, NULL)) { ++ nssCertificate_Destroy(rvCert); ++ PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL); ++ return NULL; ++ } ++ + return rvCert; + } + diff --git a/nss.spec b/nss.spec index 909d0c4..9f888c0 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -107,6 +107,8 @@ Patch2: nss-539183.patch Patch4: iquote.patch # add missing ike mechanism to softoken Patch10: nss-3.47-ike-fix.patch +# https://bugzilla.mozilla.org/show_bug.cgi?id=1593167 +Patch11: nss-3.47-certdb-temp-cert.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -872,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Thu Nov 28 2019 Daiki Ueno - 3.47.1-2 +- Fix intermittent SEC_ERROR_UNKNOWN_ISSUER (#1752303, #1648617) + * Fri Nov 22 2019 Daiki Ueno - 3.47.1-1 - Update to NSS 3.47.1 From 7007c4d4300a089e2b63f9dac5735aba1310f31d Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 3 Dec 2019 09:31:24 +0100 Subject: [PATCH 12/41] Update nss-3.47-certdb-temp-cert.patch to the final version --- nss-3.47-certdb-temp-cert.patch | 249 +++----------------------------- nss.spec | 5 +- 2 files changed, 24 insertions(+), 230 deletions(-) diff --git a/nss-3.47-certdb-temp-cert.patch b/nss-3.47-certdb-temp-cert.patch index b5623de..a1608f4 100644 --- a/nss-3.47-certdb-temp-cert.patch +++ b/nss-3.47-certdb-temp-cert.patch @@ -1,230 +1,21 @@ -# HG changeset patch -# User Daiki Ueno -# Date 1574953499 -3600 -# Thu Nov 28 16:04:59 2019 +0100 -# Node ID f1f705bd0528713216e16867233825c299d3e3b2 -# Parent 10722c590949819ed4d971ad5ae213bc8b11a1bf -Bug 1593167, certdb: prefer perm certs over temp certs when trust is not available - -Summary: -When a builtin root module is loaded after some temp certs being -loaded, our certificate lookup logic preferred those temp certs over -perm certs stored on the root module. This was a problem because such -temp certs are usually not accompanied with trust information. - -This makes the certificate lookup logic capable of handling such -situations by checking if the trust information is attached to temp -certs and otherwise falling back to perm certs. - -Reviewers: rrelyea, keeler - -Reviewed By: rrelyea - -Subscribers: heftig - -Bug #: 1593167 - -Differential Revision: https://phabricator.services.mozilla.com/D54726 - -diff --git a/lib/certdb/stanpcertdb.c b/lib/certdb/stanpcertdb.c ---- a/lib/certdb/stanpcertdb.c -+++ b/lib/certdb/stanpcertdb.c -@@ -340,6 +340,91 @@ CERT_AddTempCertToPerm(CERTCertificate * - return __CERT_AddTempCertToPerm(cert, nickname, trust); - } - -+static CERTCertificate * -+find_cert_by_der_cert(CERTCertDBHandle *handle, SECItem *derCert) -+{ -+ CERTCertificate *cc; -+ NSSCryptoContext *context; -+ NSSCertificate *cert = NULL; -+ NSSCertificate *tempCert = NULL; -+ NSSCertificate *permCert = NULL; -+ NSSDER encoding; -+ nssCertificateStoreTrace lockTrace = { NULL, NULL, PR_FALSE, PR_FALSE }; -+ nssCertificateStoreTrace unlockTrace = { NULL, NULL, PR_FALSE, PR_FALSE }; -+ -+ /* We retrieve a certificate instance for derCert in this order: -+ * 1. Look up a temp cert in the crypto context. If it is found -+ * and has a trust object associated, use it. -+ * 2. Look up a perm cert in the trust domain. If it is found, -+ * use it. Otherwise, use the temp cert. -+ */ -+ NSSITEM_FROM_SECITEM(&encoding, derCert); -+ context = STAN_GetDefaultCryptoContext(); -+ -+ /* First, see if it is already a temp cert */ -+ tempCert = NSSCryptoContext_FindCertificateByEncodedCertificate(context, -+ &encoding); -+ if (tempCert) { -+ NSSTrust *trust; -+ -+ trust = nssCryptoContext_FindTrustForCertificate(context, tempCert); -+ if (trust) { -+ nssTrust_Destroy(trust); -+ cert = tempCert; -+ tempCert = NULL; -+ } -+ } -+ -+ /* Then, see if it is already a perm cert */ -+ if (!cert && handle) { -+ permCert = NSSTrustDomain_FindCertificateByEncodedCertificate(handle, -+ &encoding); -+ if (permCert) { -+ /* Delete the temp instance */ -+ if (tempCert) { -+ nssCertificateStore_Lock(context->certStore, &lockTrace); -+ nssCertificateStore_RemoveCertLOCKED(context->certStore, -+ tempCert); -+ nssCertificateStore_Unlock(context->certStore, &lockTrace, -+ &unlockTrace); -+ } -+ cert = permCert; -+ permCert = NULL; -+ } else if (tempCert) { -+ cert = tempCert; -+ tempCert = NULL; -+ } -+ } -+ -+ if (tempCert) { -+ nssCertificate_Destroy(tempCert); -+ } -+ if (permCert) { -+ nssCertificate_Destroy(permCert); -+ } -+ -+ if (!cert) { -+ return NULL; -+ } -+ -+ /* Actually, that search ends up going by issuer/serial, -+ * so it is still possible to return a cert with the same -+ * issuer/serial but a different encoding, and we're -+ * going to reject that -+ */ -+ if (!nssItem_Equal(&cert->encoding, &encoding, NULL)) { -+ nssCertificate_Destroy(cert); -+ PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL); -+ return NULL; -+ } -+ -+ cc = STAN_GetCERTCertificateOrRelease(cert); -+ if (!cc) { -+ CERT_MapStanError(); -+ } -+ return cc; -+} -+ - CERTCertificate * - CERT_NewTempCertificate(CERTCertDBHandle *handle, SECItem *derCert, - char *nickname, PRBool isperm, PRBool copyDER) -@@ -351,32 +436,8 @@ CERT_NewTempCertificate(CERTCertDBHandle - NSSCryptoContext *gCC = STAN_GetDefaultCryptoContext(); - NSSTrustDomain *gTD = STAN_GetDefaultTrustDomain(); - if (!isperm) { -- NSSDER encoding; -- NSSITEM_FROM_SECITEM(&encoding, derCert); -- /* First, see if it is already a temp cert */ -- c = NSSCryptoContext_FindCertificateByEncodedCertificate(gCC, -- &encoding); -- if (!c && handle) { -- /* Then, see if it is already a perm cert */ -- c = NSSTrustDomain_FindCertificateByEncodedCertificate(handle, -- &encoding); -- } -- if (c) { -- /* actually, that search ends up going by issuer/serial, -- * so it is still possible to return a cert with the same -- * issuer/serial but a different encoding, and we're -- * going to reject that -- */ -- if (!nssItem_Equal(&c->encoding, &encoding, NULL)) { -- nssCertificate_Destroy(c); -- PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL); -- cc = NULL; -- } else { -- cc = STAN_GetCERTCertificateOrRelease(c); -- if (cc == NULL) { -- CERT_MapStanError(); -- } -- } -+ cc = find_cert_by_der_cert(handle, derCert); -+ if (cc) { - return cc; - } +diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c +--- a/lib/pki/pki3hack.c ++++ b/lib/pki/pki3hack.c +@@ -921,11 +921,11 @@ } -@@ -598,19 +659,7 @@ CERT_FindCertByNickname(CERTCertDBHandle - CERTCertificate * - CERT_FindCertByDERCert(CERTCertDBHandle *handle, SECItem *derCert) - { -- NSSCryptoContext *cc; -- NSSCertificate *c; -- NSSDER encoding; -- NSSITEM_FROM_SECITEM(&encoding, derCert); -- cc = STAN_GetDefaultCryptoContext(); -- c = NSSCryptoContext_FindCertificateByEncodedCertificate(cc, &encoding); -- if (!c) { -- c = NSSTrustDomain_FindCertificateByEncodedCertificate(handle, -- &encoding); -- if (!c) -- return NULL; -- } -- return STAN_GetCERTCertificateOrRelease(c); -+ return find_cert_by_der_cert(handle, derCert); - } - - static CERTCertificate * -diff --git a/lib/pki/pkistore.c b/lib/pki/pkistore.c ---- a/lib/pki/pkistore.c -+++ b/lib/pki/pkistore.c -@@ -27,6 +27,8 @@ - - #include "prbit.h" - -+#include "secerr.h" -+ - /* - * Certificate Store - * -@@ -544,6 +546,13 @@ nssCertificateStore_FindCertificateByEnc - &serial); - PORT_Free(issuer.data); - PORT_Free(serial.data); -+ -+ if (rvCert && !nssItem_Equal(&rvCert->encoding, encoding, NULL)) { -+ nssCertificate_Destroy(rvCert); -+ PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL); -+ return NULL; -+ } -+ - return rvCert; - } - -diff --git a/lib/pki/trustdomain.c b/lib/pki/trustdomain.c ---- a/lib/pki/trustdomain.c -+++ b/lib/pki/trustdomain.c -@@ -15,6 +15,7 @@ - #include "pk11pub.h" - #include "nssrwlk.h" - #include "pk11priv.h" -+#include "secerr.h" - - #define NSSTRUSTDOMAIN_DEFAULT_CACHE_SIZE 32 - -@@ -841,6 +842,13 @@ nssTrustDomain_FindCertificateByEncodedC - &serial); - PORT_Free(issuer.data); - PORT_Free(serial.data); -+ -+ if (rvCert && !nssItem_Equal(&rvCert->encoding, ber, NULL)) { -+ nssCertificate_Destroy(rvCert); -+ PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL); -+ return NULL; -+ } -+ - return rvCert; - } - + if (!cc->nssCertificate || forceUpdate) { + fill_CERTCertificateFields(c, cc, forceUpdate); +- } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess && +- !c->object.cryptoContext) { +- /* if it's a perm cert, it might have been stored before the +- * trust, so look for the trust again. But a temp cert can be +- * ignored. ++ } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess) { ++ /* If it's a perm cert, it might have been stored before the ++ * trust, so look for the trust again. If it's a temp cert, it ++ * might have been stored before the builtin module is loaded, ++ * so still need to look for the trust again. + */ + CERTCertTrust *trust = NULL; + trust = nssTrust_GetCERTCertTrustForCert(c, cc); + diff --git a/nss.spec b/nss.spec index 9f888c0..75dde95 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 3%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -874,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Dec 3 2019 Daiki Ueno - 3.47.1-3 +- Update nss-3.47-certdb-temp-cert.patch to the final version + * Thu Nov 28 2019 Daiki Ueno - 3.47.1-2 - Fix intermittent SEC_ERROR_UNKNOWN_ISSUER (#1752303, #1648617) From 1c0d77a6bbb53e4419ad316fd0a814b748f8083b Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 3 Dec 2019 15:51:55 +0100 Subject: [PATCH 13/41] Update nss-3.47-certdb-temp-cert.patch to avoid setting empty trust value --- nss-3.47-certdb-temp-cert.patch | 61 ++++++++++++++++++++++++++++----- nss.spec | 5 ++- 2 files changed, 56 insertions(+), 10 deletions(-) diff --git a/nss-3.47-certdb-temp-cert.patch b/nss-3.47-certdb-temp-cert.patch index a1608f4..b2afd50 100644 --- a/nss-3.47-certdb-temp-cert.patch +++ b/nss-3.47-certdb-temp-cert.patch @@ -1,7 +1,35 @@ +# HG changeset patch +# User Daiki Ueno +# Date 1575381287 -3600 +# Tue Dec 03 14:54:47 2019 +0100 +# Node ID 5ad40d3c760edac96d22b99e4e3e916b74f903fe +# Parent d64102b76a437f24d98a20480dcc9f1655143e7c +Bug 1593167, certdb: prefer perm certs over temp certs when trust is not available + +Summary: +When a builtin root module is loaded after some temp certs being +loaded, our certificate lookup logic preferred those temp certs over +perm certs stored on the root module. This was a problem because such +temp certs are usually not accompanied with trust information. + +This makes the certificate lookup logic capable of handling such +situations by checking if the trust information is attached to temp +certs and otherwise falling back to perm certs. + +Reviewers: rrelyea, keeler + +Reviewed By: rrelyea + +Subscribers: reviewbot, heftig + +Bug #: 1593167 + +Differential Revision: https://phabricator.services.mozilla.com/D54726 + diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c --- a/lib/pki/pki3hack.c +++ b/lib/pki/pki3hack.c -@@ -921,11 +921,11 @@ +@@ -921,14 +921,24 @@ stan_GetCERTCertificate(NSSCertificate * } if (!cc->nssCertificate || forceUpdate) { fill_CERTCertificateFields(c, cc, forceUpdate); @@ -10,12 +38,27 @@ diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c - /* if it's a perm cert, it might have been stored before the - * trust, so look for the trust again. But a temp cert can be - * ignored. +- */ +- CERTCertTrust *trust = NULL; +- trust = nssTrust_GetCERTCertTrustForCert(c, cc); + } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess) { -+ /* If it's a perm cert, it might have been stored before the -+ * trust, so look for the trust again. If it's a temp cert, it -+ * might have been stored before the builtin module is loaded, -+ * so still need to look for the trust again. - */ - CERTCertTrust *trust = NULL; - trust = nssTrust_GetCERTCertTrustForCert(c, cc); - ++ CERTCertTrust *trust; ++ if (!c->object.cryptoContext) { ++ /* If it's a perm cert, it might have been stored before the ++ * trust, so look for the trust again. ++ */ ++ trust = nssTrust_GetCERTCertTrustForCert(c, cc); ++ } else { ++ /* If it's a temp cert, it might have been stored before ++ * the builtin module is loaded, so look for the trust ++ * again, but not set the empty trust if not found. ++ */ ++ NSSTrust *t = nssTrustDomain_FindTrustForCertificate(c->object.cryptoContext->td, c); ++ if (!t) { ++ goto loser; ++ } ++ trust = cert_trust_from_stan_trust(t, cc->arena); ++ } + + CERT_LockCertTrust(cc); + cc->trust = trust; diff --git a/nss.spec b/nss.spec index 75dde95..b4e361a 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 3%{?dist} +Release: 4%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -874,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Dec 3 2019 Daiki Ueno - 3.47.1-4 +- Update nss-3.47-certdb-temp-cert.patch to avoid setting empty trust value + * Tue Dec 3 2019 Daiki Ueno - 3.47.1-3 - Update nss-3.47-certdb-temp-cert.patch to the final version From 71cc95f92d9c22a7bea26e6327a5a867b5a2ad10 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 4 Dec 2019 10:20:43 +0100 Subject: [PATCH 14/41] Update nss-3.47-certdb-temp-cert.patch --- nss-3.47-certdb-temp-cert.patch | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/nss-3.47-certdb-temp-cert.patch b/nss-3.47-certdb-temp-cert.patch index b2afd50..0c37c0f 100644 --- a/nss-3.47-certdb-temp-cert.patch +++ b/nss-3.47-certdb-temp-cert.patch @@ -1,20 +1,15 @@ # HG changeset patch # User Daiki Ueno -# Date 1575381287 -3600 -# Tue Dec 03 14:54:47 2019 +0100 -# Node ID 5ad40d3c760edac96d22b99e4e3e916b74f903fe +# Date 1575450841 -3600 +# Wed Dec 04 10:14:01 2019 +0100 +# Node ID 017097f0a0eaea1a3d849f3de79475c9bc28fcc2 # Parent d64102b76a437f24d98a20480dcc9f1655143e7c -Bug 1593167, certdb: prefer perm certs over temp certs when trust is not available +Bug 1593167, certdb: propagate trust information if trust module is loaded afterwards Summary: -When a builtin root module is loaded after some temp certs being -loaded, our certificate lookup logic preferred those temp certs over -perm certs stored on the root module. This was a problem because such -temp certs are usually not accompanied with trust information. +When the builtin trust module is loaded after some temp certs being created, these temp certs are usually not accompanied by trust information. This causes a problem in Firefox as it loads the module from a separate thread while accessing the network cache which populates temp certs. -This makes the certificate lookup logic capable of handling such -situations by checking if the trust information is attached to temp -certs and otherwise falling back to perm certs. +This change makes it properly roll up the trust information, if a temp cert doesn't have trust information. Reviewers: rrelyea, keeler @@ -29,7 +24,7 @@ Differential Revision: https://phabricator.services.mozilla.com/D54726 diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c --- a/lib/pki/pki3hack.c +++ b/lib/pki/pki3hack.c -@@ -921,14 +921,24 @@ stan_GetCERTCertificate(NSSCertificate * +@@ -921,14 +921,28 @@ stan_GetCERTCertificate(NSSCertificate * } if (!cc->nssCertificate || forceUpdate) { fill_CERTCertificateFields(c, cc, forceUpdate); @@ -49,15 +44,19 @@ diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c + */ + trust = nssTrust_GetCERTCertTrustForCert(c, cc); + } else { -+ /* If it's a temp cert, it might have been stored before -+ * the builtin module is loaded, so look for the trust -+ * again, but not set the empty trust if not found. ++ /* If it's a temp cert, it might have been stored before the ++ * builtin trust module is loaded, so look for the trust ++ * again, but don't set the empty trust if it is not found. + */ + NSSTrust *t = nssTrustDomain_FindTrustForCertificate(c->object.cryptoContext->td, c); + if (!t) { + goto loser; + } + trust = cert_trust_from_stan_trust(t, cc->arena); ++ nssTrust_Destroy(t); ++ if (!trust) { ++ goto loser; ++ } + } CERT_LockCertTrust(cc); From 81985bfb9651636e8cddfd1350bfc30a7a04f812 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 3 Jan 2020 11:17:25 +0100 Subject: [PATCH 15/41] Update to NSS 3.48 --- .gitignore | 1 + nss.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 2580845..a3c611b 100644 --- a/.gitignore +++ b/.gitignore @@ -41,3 +41,4 @@ TestUser51.cert /nss-3.46.1.tar.gz /nss-3.47.tar.gz /nss-3.47.1.tar.gz +/nss-3.48.tar.gz diff --git a/nss.spec b/nss.spec index b4e361a..05e21c2 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ -%global nspr_version 4.23.0 -%global nss_version 3.47.1 +%global nspr_version 4.24.0 +%global nss_version 3.48.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 4%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -874,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri Jan 3 2020 Daiki Ueno - 3.48.0-1 +- Update to NSS 3.48 + * Tue Dec 3 2019 Daiki Ueno - 3.47.1-4 - Update nss-3.47-certdb-temp-cert.patch to avoid setting empty trust value @@ -886,7 +889,7 @@ update-crypto-policies &> /dev/null || : * Fri Nov 22 2019 Daiki Ueno - 3.47.1-1 - Update to NSS 3.47.1 -* Mon Nov 7 2019 Bob Relyea - 3.47.0-3 +* Thu Nov 7 2019 Bob Relyea - 3.47.0-3 - Include ike mechanism fix * Wed Oct 23 2019 Daiki Ueno - 3.47.0-2 diff --git a/sources b/sources index e15e2b4..2e36a5d 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.47.1.tar.gz) = ddee53f58929e5f3849c9f88a3a6735453a258c3c32a7e3e73cc949e0b7ad2dff81b21db31c9c5e1ef3eb79d63c31660e38ce76c06ca54a5681dd611dc2e2ae9 +SHA512 (nss-3.48.tar.gz) = 71aefe323501dd8d750ed36606554f2e67ecb2bca85b55bc798d5dfc3a47f3d454348ca950971aaaafb16f6d847c098d2b1c40d40b50380e0c2540ed1b9a9e9a From 3b655a2e4d5183904c2d152e24e0e207522f32e1 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 10 Jan 2020 10:37:16 +0100 Subject: [PATCH 16/41] Update to NSS 3.49 --- .gitignore | 1 + nss-3.47-certdb-temp-cert.patch | 63 --------------------------------- nss.spec | 17 ++++----- sources | 2 +- 4 files changed, 11 insertions(+), 72 deletions(-) delete mode 100644 nss-3.47-certdb-temp-cert.patch diff --git a/.gitignore b/.gitignore index a3c611b..fff1204 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ TestUser51.cert /nss-3.47.tar.gz /nss-3.47.1.tar.gz /nss-3.48.tar.gz +/nss-3.49.tar.gz diff --git a/nss-3.47-certdb-temp-cert.patch b/nss-3.47-certdb-temp-cert.patch deleted file mode 100644 index 0c37c0f..0000000 --- a/nss-3.47-certdb-temp-cert.patch +++ /dev/null @@ -1,63 +0,0 @@ -# HG changeset patch -# User Daiki Ueno -# Date 1575450841 -3600 -# Wed Dec 04 10:14:01 2019 +0100 -# Node ID 017097f0a0eaea1a3d849f3de79475c9bc28fcc2 -# Parent d64102b76a437f24d98a20480dcc9f1655143e7c -Bug 1593167, certdb: propagate trust information if trust module is loaded afterwards - -Summary: -When the builtin trust module is loaded after some temp certs being created, these temp certs are usually not accompanied by trust information. This causes a problem in Firefox as it loads the module from a separate thread while accessing the network cache which populates temp certs. - -This change makes it properly roll up the trust information, if a temp cert doesn't have trust information. - -Reviewers: rrelyea, keeler - -Reviewed By: rrelyea - -Subscribers: reviewbot, heftig - -Bug #: 1593167 - -Differential Revision: https://phabricator.services.mozilla.com/D54726 - -diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c ---- a/lib/pki/pki3hack.c -+++ b/lib/pki/pki3hack.c -@@ -921,14 +921,28 @@ stan_GetCERTCertificate(NSSCertificate * - } - if (!cc->nssCertificate || forceUpdate) { - fill_CERTCertificateFields(c, cc, forceUpdate); -- } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess && -- !c->object.cryptoContext) { -- /* if it's a perm cert, it might have been stored before the -- * trust, so look for the trust again. But a temp cert can be -- * ignored. -- */ -- CERTCertTrust *trust = NULL; -- trust = nssTrust_GetCERTCertTrustForCert(c, cc); -+ } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess) { -+ CERTCertTrust *trust; -+ if (!c->object.cryptoContext) { -+ /* If it's a perm cert, it might have been stored before the -+ * trust, so look for the trust again. -+ */ -+ trust = nssTrust_GetCERTCertTrustForCert(c, cc); -+ } else { -+ /* If it's a temp cert, it might have been stored before the -+ * builtin trust module is loaded, so look for the trust -+ * again, but don't set the empty trust if it is not found. -+ */ -+ NSSTrust *t = nssTrustDomain_FindTrustForCertificate(c->object.cryptoContext->td, c); -+ if (!t) { -+ goto loser; -+ } -+ trust = cert_trust_from_stan_trust(t, cc->arena); -+ nssTrust_Destroy(t); -+ if (!trust) { -+ goto loser; -+ } -+ } - - CERT_LockCertTrust(cc); - cc->trust = trust; diff --git a/nss.spec b/nss.spec index 05e21c2..8a7a756 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.24.0 -%global nss_version 3.48.0 +%global nss_version 3.49.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -107,8 +107,6 @@ Patch2: nss-539183.patch Patch4: iquote.patch # add missing ike mechanism to softoken Patch10: nss-3.47-ike-fix.patch -# https://bugzilla.mozilla.org/show_bug.cgi?id=1593167 -Patch11: nss-3.47-certdb-temp-cert.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -874,6 +872,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri Jan 10 2020 Daiki Ueno - 3.49.0-1 +- Update to NSS 3.49 + * Fri Jan 3 2020 Daiki Ueno - 3.48.0-1 - Update to NSS 3.48 @@ -889,7 +890,7 @@ update-crypto-policies &> /dev/null || : * Fri Nov 22 2019 Daiki Ueno - 3.47.1-1 - Update to NSS 3.47.1 -* Thu Nov 7 2019 Bob Relyea - 3.47.0-3 +* Mon Nov 4 2019 Bob Relyea - 3.47.0-3 - Include ike mechanism fix * Wed Oct 23 2019 Daiki Ueno - 3.47.0-2 @@ -901,12 +902,12 @@ update-crypto-policies &> /dev/null || : * Mon Oct 21 2019 Daiki Ueno - 3.46.1-1 - Update to NSS 3.46.1 -* Wed Sep 4 2019 Daiki Ueno - 3.46.0-2 -- Rebuild with NSPR 4.22 - -* Tue Sep 3 2019 Daiki Ueno - 3.46.0-2 +* Tue Sep 3 2019 Daiki Ueno - 3.46.0-1 - Update to NSS 3.46 +* Thu Aug 29 2019 Daiki Ueno - 3.45.0-1 +- Update to NSS 3.45 + * Thu Jul 25 2019 Fedora Release Engineering - 3.44.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index 2e36a5d..b9615c6 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.48.tar.gz) = 71aefe323501dd8d750ed36606554f2e67ecb2bca85b55bc798d5dfc3a47f3d454348ca950971aaaafb16f6d847c098d2b1c40d40b50380e0c2540ed1b9a9e9a +SHA512 (nss-3.49.tar.gz) = 7d8df73a2e585585a7cb3f887af3f933854984479531b3dd30316873bdd92c130e2fadb54e7b3b1f0b10675b1bce09112ef39860d74ef6f0df7b57bf430bd072 From 219dd2513d6782abfcb6b4d8671d50d98038f2b6 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 10 Jan 2020 10:39:48 +0100 Subject: [PATCH 17/41] Fix %changelog mistakenly pulled from F32 --- nss.spec | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/nss.spec b/nss.spec index 8a7a756..574f327 100644 --- a/nss.spec +++ b/nss.spec @@ -890,7 +890,7 @@ update-crypto-policies &> /dev/null || : * Fri Nov 22 2019 Daiki Ueno - 3.47.1-1 - Update to NSS 3.47.1 -* Mon Nov 4 2019 Bob Relyea - 3.47.0-3 +* Thu Nov 7 2019 Bob Relyea - 3.47.0-3 - Include ike mechanism fix * Wed Oct 23 2019 Daiki Ueno - 3.47.0-2 @@ -902,11 +902,11 @@ update-crypto-policies &> /dev/null || : * Mon Oct 21 2019 Daiki Ueno - 3.46.1-1 - Update to NSS 3.46.1 -* Tue Sep 3 2019 Daiki Ueno - 3.46.0-1 -- Update to NSS 3.46 +* Wed Sep 4 2019 Daiki Ueno - 3.46.0-2 +- Rebuild with NSPR 4.22 -* Thu Aug 29 2019 Daiki Ueno - 3.45.0-1 -- Update to NSS 3.45 +* Tue Sep 3 2019 Daiki Ueno - 3.46.0-2 +- Update to NSS 3.46 * Thu Jul 25 2019 Fedora Release Engineering - 3.44.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 7e331e9268c11fb580d295a04307ff42b7cde32d Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 10 Jan 2020 17:26:33 +0100 Subject: [PATCH 18/41] Fix build on armv7hl with the patch proposed in upstream --- nss-3.49-neon-build-fixes.patch | 159 ++++++++++++++++++++++++++++++++ nss.spec | 5 + 2 files changed, 164 insertions(+) create mode 100644 nss-3.49-neon-build-fixes.patch diff --git a/nss-3.49-neon-build-fixes.patch b/nss-3.49-neon-build-fixes.patch new file mode 100644 index 0000000..7ac5b0f --- /dev/null +++ b/nss-3.49-neon-build-fixes.patch @@ -0,0 +1,159 @@ +# HG changeset patch +# User Mike Hommey +# Date 1578673372 -3600 +# Fri Jan 10 17:22:52 2020 +0100 +# Node ID 9c359d019d333282476ffeec3dab819cfdcf127e +# Parent 4921046404f197526969a6b79f19c136469e69f8 +Bug 1608327 - Fix freebl arm NEON code use on tier3 platforms. + +Summary: +Despite the code having runtime detection of NEON and crypto extensions, +the optimized code using those instructions is disabled at build time on +platforms where the compiler doesn't enable NEON by default of with the +flags it's given for the caller code. + +In the case of gcm, this goes as far as causing a build error. + +What is needed is for the optimized code to be enabled in every case, +letting the caller code choose whether to use that code based on the +existing runtime checks. + +But this can't be simply done either, because those optimized parts of +the code need to be built with NEON enabled, unconditionally, but that +is not compatible with platforms using the softfloat ABI. For those, +we need to use the softfp ABI, which is compatible. However, the softfp +ABI is not compatible with the hardfp ABI, so we also can't +unconditionally use the softfp ABI, so we do so only when the compiler +targets the softfloat ABI, which confusingly enough is advertized via +the `__SOFTFP__` define. + +Reviewers: jcj! + +Bug #: 1608327 + +Differential Revision: https://phabricator.services.mozilla.com/D59451 + +diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile +--- a/lib/freebl/Makefile ++++ b/lib/freebl/Makefile +@@ -781,8 +781,12 @@ ifdef INTEL_GCM_CLANG_CL + endif + + ifeq ($(CPU_ARCH),arm) +-$(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a -mfpu=crypto-neon-fp-armv8 +-$(OBJDIR)/$(PROG_PREFIX)gcm-arm32-neon$(OBJ_SUFFIX): CFLAGS += -mfpu=neon ++# When the compiler uses the softfloat ABI, we want to use the compatible softfp ABI when ++# enabling NEON for these objects. ++# Confusingly, __SOFTFP__ is the name of the define for the softfloat ABI, not for the softfp ABI. ++USES_SOFTFLOAT_ABI := $(shell $(CC) -o - -E -dM - $(CFLAGS) < /dev/null | grep __SOFTFP__ > /dev/null && echo 1) ++$(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a -mfpu=crypto-neon-fp-armv8$(if $(USES_SOFTFLOAT_ABI), -mfloat-abi=softfp) ++$(OBJDIR)/$(PROG_PREFIX)gcm-arm32-neon$(OBJ_SUFFIX): CFLAGS += -mfpu=neon$(if $(USES_SOFTFLOAT_ABI), -mfloat-abi=softfp) + endif + ifeq ($(CPU_ARCH),aarch64) + $(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto +diff --git a/lib/freebl/aes-armv8.c b/lib/freebl/aes-armv8.c +--- a/lib/freebl/aes-armv8.c ++++ b/lib/freebl/aes-armv8.c +@@ -8,7 +8,7 @@ + #if ((defined(__clang__) || \ + (defined(__GNUC__) && defined(__GNUC_MINOR__) && \ + (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ > 8)))) && \ +- (defined(__ARM_NEON) || defined(__ARM_NEON__))) ++ defined(IS_LITTLE_ENDIAN)) + + #ifndef __ARM_FEATURE_CRYPTO + #error "Compiler option is invalid" +diff --git a/lib/freebl/freebl.gyp b/lib/freebl/freebl.gyp +--- a/lib/freebl/freebl.gyp ++++ b/lib/freebl/freebl.gyp +@@ -126,10 +126,12 @@ + '<(DEPTH)/exports.gyp:nss_exports' + ], + 'cflags': [ +- '-mfpu=neon' ++ '-mfpu=neon', ++ '<@(softfp_cflags)', + ], + 'cflags_mozilla': [ +- '-mfpu=neon' ++ '-mfpu=neon', ++ '<@(softfp_cflags)', + ] + }, + { +@@ -179,11 +181,13 @@ + [ 'target_arch=="arm"', { + 'cflags': [ + '-march=armv8-a', +- '-mfpu=crypto-neon-fp-armv8' ++ '-mfpu=crypto-neon-fp-armv8', ++ '<@(softfp_cflags)', + ], + 'cflags_mozilla': [ + '-march=armv8-a', +- '-mfpu=crypto-neon-fp-armv8' ++ '-mfpu=crypto-neon-fp-armv8', ++ '<@(softfp_cflags)', + ], + }, 'target_arch=="arm64" or target_arch=="aarch64"', { + 'cflags': [ +@@ -533,6 +537,11 @@ + }, { + 'have_int128_support%': 0, + }], ++ [ 'target_arch=="arm"', { ++ # When the compiler uses the softfloat ABI, we want to use the compatible softfp ABI when enabling NEON for these objects. ++ # Confusingly, __SOFTFP__ is the name of the define for the softfloat ABI, not for the softfp ABI. ++ 'softfp_cflags': ' /dev/null && echo -mfloat-abi=softfp || true)', ++ }], + ], + } + } +diff --git a/lib/freebl/gcm-arm32-neon.c b/lib/freebl/gcm-arm32-neon.c +--- a/lib/freebl/gcm-arm32-neon.c ++++ b/lib/freebl/gcm-arm32-neon.c +@@ -11,7 +11,7 @@ + #include "secerr.h" + #include "prtypes.h" + +-#if defined(__ARM_NEON__) || defined(__ARM_NEON) ++#if defined(IS_LITTLE_ENDIAN) + + #include + +@@ -199,4 +199,4 @@ gcm_HashZeroX_hw(gcmHashContext *ghash) + return SECSuccess; + } + +-#endif /* __ARM_NEON__ || __ARM_NEON */ ++#endif /* IS_LITTLE_ENDIAN */ +diff --git a/lib/freebl/gcm.c b/lib/freebl/gcm.c +--- a/lib/freebl/gcm.c ++++ b/lib/freebl/gcm.c +@@ -21,11 +21,8 @@ + #if defined(__aarch64__) && defined(IS_LITTLE_ENDIAN) && \ + (defined(__clang__) || defined(__GNUC__) && __GNUC__ > 6) + #define USE_ARM_GCM +-#elif defined(__arm__) && defined(IS_LITTLE_ENDIAN) && \ +- (defined(__ARM_NEON__) || defined(__ARM_NEON)) +-/* We don't test on big endian platform, so disable this on big endian. +- * Also, we don't check whether compiler support NEON well, so this uses +- * that compiler uses -mfpu=neon only. */ ++#elif defined(__arm__) && defined(IS_LITTLE_ENDIAN) ++/* We don't test on big endian platform, so disable this on big endian. */ + #define USE_ARM_GCM + #endif + +diff --git a/lib/freebl/rijndael.c b/lib/freebl/rijndael.c +--- a/lib/freebl/rijndael.c ++++ b/lib/freebl/rijndael.c +@@ -20,8 +20,7 @@ + #include "gcm.h" + #include "mpi.h" + +-#if (!defined(IS_LITTLE_ENDIAN) && !defined(NSS_X86_OR_X64)) || \ +- (defined(__arm__) && !defined(__ARM_NEON) && !defined(__ARM_NEON__)) ++#if !defined(IS_LITTLE_ENDIAN) && !defined(NSS_X86_OR_X64) + // not test yet on big endian platform of arm + #undef USE_HW_AES + #endif diff --git a/nss.spec b/nss.spec index 574f327..cdb4628 100644 --- a/nss.spec +++ b/nss.spec @@ -107,6 +107,8 @@ Patch2: nss-539183.patch Patch4: iquote.patch # add missing ike mechanism to softoken Patch10: nss-3.47-ike-fix.patch +# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1608327 +Patch11: nss-3.49-neon-build-fixes.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -245,6 +247,8 @@ find nss/lib/libpkix -perm /u+x -type f -exec chmod -x {} \; %build +gcc -mfpu=neon -dM -E - < /dev/null + export FREEBL_NO_DEPEND=1 # Must export FREEBL_LOWHASH=1 for nsslowhash.h so that it gets @@ -874,6 +878,7 @@ update-crypto-policies &> /dev/null || : %changelog * Fri Jan 10 2020 Daiki Ueno - 3.49.0-1 - Update to NSS 3.49 +- Fix build on armv7hl with the patch proposed in upstream * Fri Jan 3 2020 Daiki Ueno - 3.48.0-1 - Update to NSS 3.48 From b8de59e750baf84b0e62f4eca9e18cb61ca9346d Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sat, 11 Jan 2020 09:02:36 +0100 Subject: [PATCH 19/41] Remove leftover debug command in %build --- nss.spec | 2 -- 1 file changed, 2 deletions(-) diff --git a/nss.spec b/nss.spec index cdb4628..c61419f 100644 --- a/nss.spec +++ b/nss.spec @@ -247,8 +247,6 @@ find nss/lib/libpkix -perm /u+x -type f -exec chmod -x {} \; %build -gcc -mfpu=neon -dM -E - < /dev/null - export FREEBL_NO_DEPEND=1 # Must export FREEBL_LOWHASH=1 for nsslowhash.h so that it gets From c3571bbb3d14afc382d17ca6acfb155cc2c6f43d Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 27 Jan 2020 10:24:30 +0100 Subject: [PATCH 20/41] Update to NSS 3.49.2 --- .gitignore | 1 + nss-3.49-neon-build-fixes.patch | 159 -------------------------------- nss-tls13-default.patch | 12 +++ nss.spec | 13 ++- sources | 2 +- 5 files changed, 24 insertions(+), 163 deletions(-) delete mode 100644 nss-3.49-neon-build-fixes.patch create mode 100644 nss-tls13-default.patch diff --git a/.gitignore b/.gitignore index fff1204..9bcb442 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,4 @@ TestUser51.cert /nss-3.47.1.tar.gz /nss-3.48.tar.gz /nss-3.49.tar.gz +/nss-3.49.2.tar.gz diff --git a/nss-3.49-neon-build-fixes.patch b/nss-3.49-neon-build-fixes.patch deleted file mode 100644 index 7ac5b0f..0000000 --- a/nss-3.49-neon-build-fixes.patch +++ /dev/null @@ -1,159 +0,0 @@ -# HG changeset patch -# User Mike Hommey -# Date 1578673372 -3600 -# Fri Jan 10 17:22:52 2020 +0100 -# Node ID 9c359d019d333282476ffeec3dab819cfdcf127e -# Parent 4921046404f197526969a6b79f19c136469e69f8 -Bug 1608327 - Fix freebl arm NEON code use on tier3 platforms. - -Summary: -Despite the code having runtime detection of NEON and crypto extensions, -the optimized code using those instructions is disabled at build time on -platforms where the compiler doesn't enable NEON by default of with the -flags it's given for the caller code. - -In the case of gcm, this goes as far as causing a build error. - -What is needed is for the optimized code to be enabled in every case, -letting the caller code choose whether to use that code based on the -existing runtime checks. - -But this can't be simply done either, because those optimized parts of -the code need to be built with NEON enabled, unconditionally, but that -is not compatible with platforms using the softfloat ABI. For those, -we need to use the softfp ABI, which is compatible. However, the softfp -ABI is not compatible with the hardfp ABI, so we also can't -unconditionally use the softfp ABI, so we do so only when the compiler -targets the softfloat ABI, which confusingly enough is advertized via -the `__SOFTFP__` define. - -Reviewers: jcj! - -Bug #: 1608327 - -Differential Revision: https://phabricator.services.mozilla.com/D59451 - -diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile ---- a/lib/freebl/Makefile -+++ b/lib/freebl/Makefile -@@ -781,8 +781,12 @@ ifdef INTEL_GCM_CLANG_CL - endif - - ifeq ($(CPU_ARCH),arm) --$(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a -mfpu=crypto-neon-fp-armv8 --$(OBJDIR)/$(PROG_PREFIX)gcm-arm32-neon$(OBJ_SUFFIX): CFLAGS += -mfpu=neon -+# When the compiler uses the softfloat ABI, we want to use the compatible softfp ABI when -+# enabling NEON for these objects. -+# Confusingly, __SOFTFP__ is the name of the define for the softfloat ABI, not for the softfp ABI. -+USES_SOFTFLOAT_ABI := $(shell $(CC) -o - -E -dM - $(CFLAGS) < /dev/null | grep __SOFTFP__ > /dev/null && echo 1) -+$(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a -mfpu=crypto-neon-fp-armv8$(if $(USES_SOFTFLOAT_ABI), -mfloat-abi=softfp) -+$(OBJDIR)/$(PROG_PREFIX)gcm-arm32-neon$(OBJ_SUFFIX): CFLAGS += -mfpu=neon$(if $(USES_SOFTFLOAT_ABI), -mfloat-abi=softfp) - endif - ifeq ($(CPU_ARCH),aarch64) - $(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto -diff --git a/lib/freebl/aes-armv8.c b/lib/freebl/aes-armv8.c ---- a/lib/freebl/aes-armv8.c -+++ b/lib/freebl/aes-armv8.c -@@ -8,7 +8,7 @@ - #if ((defined(__clang__) || \ - (defined(__GNUC__) && defined(__GNUC_MINOR__) && \ - (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ > 8)))) && \ -- (defined(__ARM_NEON) || defined(__ARM_NEON__))) -+ defined(IS_LITTLE_ENDIAN)) - - #ifndef __ARM_FEATURE_CRYPTO - #error "Compiler option is invalid" -diff --git a/lib/freebl/freebl.gyp b/lib/freebl/freebl.gyp ---- a/lib/freebl/freebl.gyp -+++ b/lib/freebl/freebl.gyp -@@ -126,10 +126,12 @@ - '<(DEPTH)/exports.gyp:nss_exports' - ], - 'cflags': [ -- '-mfpu=neon' -+ '-mfpu=neon', -+ '<@(softfp_cflags)', - ], - 'cflags_mozilla': [ -- '-mfpu=neon' -+ '-mfpu=neon', -+ '<@(softfp_cflags)', - ] - }, - { -@@ -179,11 +181,13 @@ - [ 'target_arch=="arm"', { - 'cflags': [ - '-march=armv8-a', -- '-mfpu=crypto-neon-fp-armv8' -+ '-mfpu=crypto-neon-fp-armv8', -+ '<@(softfp_cflags)', - ], - 'cflags_mozilla': [ - '-march=armv8-a', -- '-mfpu=crypto-neon-fp-armv8' -+ '-mfpu=crypto-neon-fp-armv8', -+ '<@(softfp_cflags)', - ], - }, 'target_arch=="arm64" or target_arch=="aarch64"', { - 'cflags': [ -@@ -533,6 +537,11 @@ - }, { - 'have_int128_support%': 0, - }], -+ [ 'target_arch=="arm"', { -+ # When the compiler uses the softfloat ABI, we want to use the compatible softfp ABI when enabling NEON for these objects. -+ # Confusingly, __SOFTFP__ is the name of the define for the softfloat ABI, not for the softfp ABI. -+ 'softfp_cflags': ' /dev/null && echo -mfloat-abi=softfp || true)', -+ }], - ], - } - } -diff --git a/lib/freebl/gcm-arm32-neon.c b/lib/freebl/gcm-arm32-neon.c ---- a/lib/freebl/gcm-arm32-neon.c -+++ b/lib/freebl/gcm-arm32-neon.c -@@ -11,7 +11,7 @@ - #include "secerr.h" - #include "prtypes.h" - --#if defined(__ARM_NEON__) || defined(__ARM_NEON) -+#if defined(IS_LITTLE_ENDIAN) - - #include - -@@ -199,4 +199,4 @@ gcm_HashZeroX_hw(gcmHashContext *ghash) - return SECSuccess; - } - --#endif /* __ARM_NEON__ || __ARM_NEON */ -+#endif /* IS_LITTLE_ENDIAN */ -diff --git a/lib/freebl/gcm.c b/lib/freebl/gcm.c ---- a/lib/freebl/gcm.c -+++ b/lib/freebl/gcm.c -@@ -21,11 +21,8 @@ - #if defined(__aarch64__) && defined(IS_LITTLE_ENDIAN) && \ - (defined(__clang__) || defined(__GNUC__) && __GNUC__ > 6) - #define USE_ARM_GCM --#elif defined(__arm__) && defined(IS_LITTLE_ENDIAN) && \ -- (defined(__ARM_NEON__) || defined(__ARM_NEON)) --/* We don't test on big endian platform, so disable this on big endian. -- * Also, we don't check whether compiler support NEON well, so this uses -- * that compiler uses -mfpu=neon only. */ -+#elif defined(__arm__) && defined(IS_LITTLE_ENDIAN) -+/* We don't test on big endian platform, so disable this on big endian. */ - #define USE_ARM_GCM - #endif - -diff --git a/lib/freebl/rijndael.c b/lib/freebl/rijndael.c ---- a/lib/freebl/rijndael.c -+++ b/lib/freebl/rijndael.c -@@ -20,8 +20,7 @@ - #include "gcm.h" - #include "mpi.h" - --#if (!defined(IS_LITTLE_ENDIAN) && !defined(NSS_X86_OR_X64)) || \ -- (defined(__arm__) && !defined(__ARM_NEON) && !defined(__ARM_NEON__)) -+#if !defined(IS_LITTLE_ENDIAN) && !defined(NSS_X86_OR_X64) - // not test yet on big endian platform of arm - #undef USE_HW_AES - #endif diff --git a/nss-tls13-default.patch b/nss-tls13-default.patch new file mode 100644 index 0000000..ffdca50 --- /dev/null +++ b/nss-tls13-default.patch @@ -0,0 +1,12 @@ +diff -up nss/lib/ssl/sslsock.c.tls13-default nss/lib/ssl/sslsock.c +--- nss/lib/ssl/sslsock.c.tls13-default 2020-01-27 10:21:44.930830558 +0100 ++++ nss/lib/ssl/sslsock.c 2020-01-27 10:21:47.419852229 +0100 +@@ -97,7 +97,7 @@ static sslOptions ssl_defaults = { + */ + static SSLVersionRange versions_defaults_stream = { + SSL_LIBRARY_VERSION_TLS_1_0, +- SSL_LIBRARY_VERSION_TLS_1_3 ++ SSL_LIBRARY_VERSION_TLS_1_2 + }; + + static SSLVersionRange versions_defaults_datagram = { diff --git a/nss.spec b/nss.spec index c61419f..16921d7 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.24.0 -%global nss_version 3.49.0 +%global nss_version 3.49.2 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -107,8 +107,11 @@ Patch2: nss-539183.patch Patch4: iquote.patch # add missing ike mechanism to softoken Patch10: nss-3.47-ike-fix.patch -# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1608327 -Patch11: nss-3.49-neon-build-fixes.patch +# To revert the upstream change: +# https://bugzilla.mozilla.org/show_bug.cgi?id=1573118 +# as it still doesn't work under FIPS mode because of missing HKDF +# support in PKCS #11. +Patch11: nss-tls13-default.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -874,6 +877,10 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Jan 27 2020 Daiki Ueno - 3.49.2-1 +- Update to NSS 3.49.2 +- Don't enable TLS 1.3 by default (#1794814) + * Fri Jan 10 2020 Daiki Ueno - 3.49.0-1 - Update to NSS 3.49 - Fix build on armv7hl with the patch proposed in upstream diff --git a/sources b/sources index b9615c6..935d8e3 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.49.tar.gz) = 7d8df73a2e585585a7cb3f887af3f933854984479531b3dd30316873bdd92c130e2fadb54e7b3b1f0b10675b1bce09112ef39860d74ef6f0df7b57bf430bd072 +SHA512 (nss-3.49.2.tar.gz) = fe0fe032db15853384a50b145dd6f3187a855109f0b81f1846312d33f8c628aededcbca4d199f974ae52530aec3f2312f80afbca3e5b97ed1ff96fcffafd2881 From c0b78bc53de645de4ed5ca8ac9f1fdcc7ef54349 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 4 Mar 2020 17:34:17 +0100 Subject: [PATCH 21/41] Update to NSS 3.50 --- nss-kremlin-ppc64le.patch | 30 +++++++++++++ nss-signtool-format.patch | 94 +++++++++++++++++++++++++++++++++++++++ nss.spec | 10 ++++- 3 files changed, 132 insertions(+), 2 deletions(-) create mode 100644 nss-kremlin-ppc64le.patch create mode 100644 nss-signtool-format.patch diff --git a/nss-kremlin-ppc64le.patch b/nss-kremlin-ppc64le.patch new file mode 100644 index 0000000..d4e9d89 --- /dev/null +++ b/nss-kremlin-ppc64le.patch @@ -0,0 +1,30 @@ +Index: nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h +=================================================================== +--- nss.orig/lib/freebl/verified/kremlin/include/kremlin/internal/types.h ++++ nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h +@@ -56,7 +56,9 @@ typedef const char *Prims_string; + #include + typedef __m128i FStar_UInt128_uint128; + #elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \ +- (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__)) ++ (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \ ++ (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \ ++ defined(__s390x__)) + typedef unsigned __int128 FStar_UInt128_uint128; + #else + typedef struct FStar_UInt128_uint128_s { +Index: nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h +=================================================================== +--- nss.orig/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h ++++ nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h +@@ -25,7 +25,9 @@ + #include "LowStar_Endianness.h" + + #if !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \ +- (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__)) ++ (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \ ++ (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \ ++ defined(__s390x__)) + + /* GCC + using native unsigned __int128 support */ + diff --git a/nss-signtool-format.patch b/nss-signtool-format.patch new file mode 100644 index 0000000..f54e7f3 --- /dev/null +++ b/nss-signtool-format.patch @@ -0,0 +1,94 @@ +diff --git a/cmd/modutil/install.c b/cmd/modutil/install.c +--- a/cmd/modutil/install.c ++++ b/cmd/modutil/install.c +@@ -825,17 +825,20 @@ rm_dash_r(char *path) + + dir = PR_OpenDir(path); + if (!dir) { + return -1; + } + + /* Recursively delete all entries in the directory */ + while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) { +- sprintf(filename, "%s/%s", path, entry->name); ++ if (snprintf(filename, sizeof(filename), "%s/%s", path, entry->name) >= sizeof(filename)) { ++ PR_CloseDir(dir); ++ return -1; ++ } + if (rm_dash_r(filename)) { + PR_CloseDir(dir); + return -1; + } + } + + if (PR_CloseDir(dir) != PR_SUCCESS) { + return -1; +diff --git a/cmd/signtool/util.c b/cmd/signtool/util.c +--- a/cmd/signtool/util.c ++++ b/cmd/signtool/util.c +@@ -132,17 +132,20 @@ rm_dash_r(char *path) + if (!dir) { + PR_fprintf(errorFD, "Error: Unable to open directory %s.\n", path); + errorCount++; + return -1; + } + + /* Recursively delete all entries in the directory */ + while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) { +- sprintf(filename, "%s/%s", path, entry->name); ++ if (snprintf(filename, sizeof(filename), "%s/%s", path, entry->name) >= sizeof(filename)) { ++ errorCount++; ++ return -1; ++ } + if (rm_dash_r(filename)) + return -1; + } + + if (PR_CloseDir(dir) != PR_SUCCESS) { + PR_fprintf(errorFD, "Error: Could not close %s.\n", path); + errorCount++; + return -1; +diff --git a/lib/libpkix/pkix/util/pkix_list.c b/lib/libpkix/pkix/util/pkix_list.c +--- a/lib/libpkix/pkix/util/pkix_list.c ++++ b/lib/libpkix/pkix/util/pkix_list.c +@@ -1530,17 +1530,17 @@ cleanup: + */ + PKIX_Error * + PKIX_List_SetItem( + PKIX_List *list, + PKIX_UInt32 index, + PKIX_PL_Object *item, + void *plContext) + { +- PKIX_List *element; ++ PKIX_List *element = NULL; + + PKIX_ENTER(LIST, "PKIX_List_SetItem"); + PKIX_NULLCHECK_ONE(list); + + if (list->immutable){ + PKIX_ERROR(PKIX_OPERATIONNOTPERMITTEDONIMMUTABLELIST); + } + +diff --git a/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c b/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c +--- a/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c ++++ b/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c +@@ -102,17 +102,17 @@ cleanup: + */ + static PKIX_Error * + pkix_pl_OID_Equals( + PKIX_PL_Object *first, + PKIX_PL_Object *second, + PKIX_Boolean *pResult, + void *plContext) + { +- PKIX_Int32 cmpResult; ++ PKIX_Int32 cmpResult = 0; + + PKIX_ENTER(OID, "pkix_pl_OID_Equals"); + PKIX_NULLCHECK_THREE(first, second, pResult); + + PKIX_CHECK(pkix_pl_OID_Comparator + (first, second, &cmpResult, plContext), + PKIX_OIDCOMPARATORFAILED); + diff --git a/nss.spec b/nss.spec index 16921d7..0f5e7e2 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ -%global nspr_version 4.24.0 -%global nss_version 3.49.2 +%global nspr_version 4.25.0 +%global nss_version 3.50.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -112,6 +112,9 @@ Patch10: nss-3.47-ike-fix.patch # as it still doesn't work under FIPS mode because of missing HKDF # support in PKCS #11. Patch11: nss-tls13-default.patch +Patch12: nss-signtool-format.patch +# https://github.com/FStarLang/kremlin/issues/166 +Patch13: nss-kremlin-ppc64le.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -877,6 +880,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Feb 17 2020 Daiki Ueno - 3.50.0-1 +- Update to NSS 3.50 + * Mon Jan 27 2020 Daiki Ueno - 3.49.2-1 - Update to NSS 3.49.2 - Don't enable TLS 1.3 by default (#1794814) From f1e37f35f82322d0cfe4359f0a7c34573ae66913 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 4 Mar 2020 17:35:50 +0100 Subject: [PATCH 22/41] Upload new sources --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 9bcb442..4e170e7 100644 --- a/.gitignore +++ b/.gitignore @@ -44,3 +44,4 @@ TestUser51.cert /nss-3.48.tar.gz /nss-3.49.tar.gz /nss-3.49.2.tar.gz +/nss-3.50.tar.gz diff --git a/sources b/sources index 935d8e3..8a7e320 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.49.2.tar.gz) = fe0fe032db15853384a50b145dd6f3187a855109f0b81f1846312d33f8c628aededcbca4d199f974ae52530aec3f2312f80afbca3e5b97ed1ff96fcffafd2881 +SHA512 (nss-3.50.tar.gz) = d6bcaf8ad65b5a97c42cd6cbbc68add5c4b49db74b2debcedb2a007f72511ac0e9bd21fd2dec041bc1975cfc8af26a48450aa0d1b962f755931ab2ac45c795b1 From 4a5cdbbdb2d50d1a17a3adea9f5c20bd9cbbd00c Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 5 Mar 2020 09:57:34 +0100 Subject: [PATCH 23/41] Apply CMAC fixes from upstream --- nss-cmac-fixes.patch | 75 ++++++++++++++++++++++++++++++++++++++++++++ nss.spec | 8 ++++- 2 files changed, 82 insertions(+), 1 deletion(-) create mode 100644 nss-cmac-fixes.patch diff --git a/nss-cmac-fixes.patch b/nss-cmac-fixes.patch new file mode 100644 index 0000000..9bcd954 --- /dev/null +++ b/nss-cmac-fixes.patch @@ -0,0 +1,75 @@ +# HG changeset patch +# User Robert Relyea +# Date 1581383641 28800 +# Mon Feb 10 17:14:01 2020 -0800 +# Node ID df142975f4f695f84a662abdd27219c21c87c8d1 +# Parent 046a6f5bfb271ed03ed6a93e3f879d57905999c5 +Bug 1611209 - Value of CKM_AES_CMAC and CKM_AES_CMAC_GENERAL are swapped r=rrelyea + +diff --git a/lib/util/pkcs11t.h b/lib/util/pkcs11t.h +--- a/lib/util/pkcs11t.h ++++ b/lib/util/pkcs11t.h +@@ -898,8 +898,8 @@ typedef CK_ULONG CK_MECHANISM_TYPE; + #define CKM_AES_CCM 0x00001088 + #define CKM_AES_CTS 0x00001089 + /* AES-CMAC values copied from v2.40 errata 1 header file */ +-#define CKM_AES_CMAC_GENERAL 0x0000108A +-#define CKM_AES_CMAC 0x0000108B ++#define CKM_AES_CMAC 0x0000108A ++#define CKM_AES_CMAC_GENERAL 0x0000108B + #define CKM_AES_XCBC_MAC 0x0000108C + #define CKM_AES_XCBC_MAC_96 0x0000108D + +# HG changeset patch +# User Robert Relyea +# Date 1581371554 28800 +# Mon Feb 10 13:52:34 2020 -0800 +# Node ID 046a6f5bfb271ed03ed6a93e3f879d57905999c5 +# Parent f161f15f8c8d37070aa5763a1edd91cbbc7c54fb +Bug 1610687 - Crash on unaligned CMACContext.aes.keySchedule when using AES-NI intrinsics r=kjacobs +https://phabricator.services.mozilla.com/D60699 + +diff --git a/lib/freebl/cmac.c b/lib/freebl/cmac.c +--- a/lib/freebl/cmac.c ++++ b/lib/freebl/cmac.c +@@ -22,7 +22,7 @@ struct CMACContextStr { + * add a new Context pointer to the cipher union with the correct type. */ + CMACCipher cipherType; + union { +- AESContext aes; ++ AESContext *aes; + } cipher; + int blockSize; + +@@ -62,7 +62,7 @@ cmac_Encrypt(CMACContext *ctx, unsigned + { + if (ctx->cipherType == CMAC_AES) { + unsigned int tmpOutputLen; +- SECStatus rv = AES_Encrypt(&ctx->cipher.aes, output, &tmpOutputLen, ++ SECStatus rv = AES_Encrypt(ctx->cipher.aes, output, &tmpOutputLen, + ctx->blockSize, input, inputLen); + + /* Assumption: AES_Encrypt (when in ECB mode) always returns an +@@ -156,8 +156,9 @@ CMAC_Init(CMACContext *ctx, CMACCipher t + + ctx->blockSize = AES_BLOCK_SIZE; + ctx->cipherType = CMAC_AES; +- if (AES_InitContext(&ctx->cipher.aes, key, key_len, NULL, NSS_AES, 1, +- ctx->blockSize) != SECSuccess) { ++ ctx->cipher.aes = AES_CreateContext(key, NULL, NSS_AES, 1, key_len, ++ ctx->blockSize); ++ if (ctx->cipher.aes == NULL) { + return SECFailure; + } + +@@ -308,8 +309,8 @@ CMAC_Destroy(CMACContext *ctx, PRBool fr + return; + } + +- if (ctx->cipherType == CMAC_AES) { +- AES_DestroyContext(&ctx->cipher.aes, PR_FALSE); ++ if (ctx->cipherType == CMAC_AES && ctx->cipher.aes != NULL) { ++ AES_DestroyContext(ctx->cipher.aes, PR_TRUE); + } + + /* Destroy everything in the context. This includes sensitive data in diff --git a/nss.spec b/nss.spec index 0f5e7e2..9ccfc45 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -115,6 +115,9 @@ Patch11: nss-tls13-default.patch Patch12: nss-signtool-format.patch # https://github.com/FStarLang/kremlin/issues/166 Patch13: nss-kremlin-ppc64le.patch +# https://bugzilla.mozilla.org/show_bug.cgi?id=1611209 +# https://bugzilla.mozilla.org/show_bug.cgi?id=1610687 +Patch14: nss-cmac-fixes.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -880,6 +883,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Thu Mar 5 2020 Daiki Ueno - 3.50.0-2 +- Apply CMAC fixes from upstream + * Mon Feb 17 2020 Daiki Ueno - 3.50.0-1 - Update to NSS 3.50 From 364a86cc8f32eb5fef16f82f2d9f4e3f928f9bd4 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 7 Apr 2020 11:18:10 +0200 Subject: [PATCH 24/41] Update to NSS 3.51 --- .gitignore | 1 + nss-cmac-fixes.patch | 75 -------------------------------------------- nss.spec | 10 +++--- sources | 2 +- 4 files changed, 7 insertions(+), 81 deletions(-) delete mode 100644 nss-cmac-fixes.patch diff --git a/.gitignore b/.gitignore index 4e170e7..303c2dc 100644 --- a/.gitignore +++ b/.gitignore @@ -45,3 +45,4 @@ TestUser51.cert /nss-3.49.tar.gz /nss-3.49.2.tar.gz /nss-3.50.tar.gz +/nss-3.51.tar.gz diff --git a/nss-cmac-fixes.patch b/nss-cmac-fixes.patch deleted file mode 100644 index 9bcd954..0000000 --- a/nss-cmac-fixes.patch +++ /dev/null @@ -1,75 +0,0 @@ -# HG changeset patch -# User Robert Relyea -# Date 1581383641 28800 -# Mon Feb 10 17:14:01 2020 -0800 -# Node ID df142975f4f695f84a662abdd27219c21c87c8d1 -# Parent 046a6f5bfb271ed03ed6a93e3f879d57905999c5 -Bug 1611209 - Value of CKM_AES_CMAC and CKM_AES_CMAC_GENERAL are swapped r=rrelyea - -diff --git a/lib/util/pkcs11t.h b/lib/util/pkcs11t.h ---- a/lib/util/pkcs11t.h -+++ b/lib/util/pkcs11t.h -@@ -898,8 +898,8 @@ typedef CK_ULONG CK_MECHANISM_TYPE; - #define CKM_AES_CCM 0x00001088 - #define CKM_AES_CTS 0x00001089 - /* AES-CMAC values copied from v2.40 errata 1 header file */ --#define CKM_AES_CMAC_GENERAL 0x0000108A --#define CKM_AES_CMAC 0x0000108B -+#define CKM_AES_CMAC 0x0000108A -+#define CKM_AES_CMAC_GENERAL 0x0000108B - #define CKM_AES_XCBC_MAC 0x0000108C - #define CKM_AES_XCBC_MAC_96 0x0000108D - -# HG changeset patch -# User Robert Relyea -# Date 1581371554 28800 -# Mon Feb 10 13:52:34 2020 -0800 -# Node ID 046a6f5bfb271ed03ed6a93e3f879d57905999c5 -# Parent f161f15f8c8d37070aa5763a1edd91cbbc7c54fb -Bug 1610687 - Crash on unaligned CMACContext.aes.keySchedule when using AES-NI intrinsics r=kjacobs -https://phabricator.services.mozilla.com/D60699 - -diff --git a/lib/freebl/cmac.c b/lib/freebl/cmac.c ---- a/lib/freebl/cmac.c -+++ b/lib/freebl/cmac.c -@@ -22,7 +22,7 @@ struct CMACContextStr { - * add a new Context pointer to the cipher union with the correct type. */ - CMACCipher cipherType; - union { -- AESContext aes; -+ AESContext *aes; - } cipher; - int blockSize; - -@@ -62,7 +62,7 @@ cmac_Encrypt(CMACContext *ctx, unsigned - { - if (ctx->cipherType == CMAC_AES) { - unsigned int tmpOutputLen; -- SECStatus rv = AES_Encrypt(&ctx->cipher.aes, output, &tmpOutputLen, -+ SECStatus rv = AES_Encrypt(ctx->cipher.aes, output, &tmpOutputLen, - ctx->blockSize, input, inputLen); - - /* Assumption: AES_Encrypt (when in ECB mode) always returns an -@@ -156,8 +156,9 @@ CMAC_Init(CMACContext *ctx, CMACCipher t - - ctx->blockSize = AES_BLOCK_SIZE; - ctx->cipherType = CMAC_AES; -- if (AES_InitContext(&ctx->cipher.aes, key, key_len, NULL, NSS_AES, 1, -- ctx->blockSize) != SECSuccess) { -+ ctx->cipher.aes = AES_CreateContext(key, NULL, NSS_AES, 1, key_len, -+ ctx->blockSize); -+ if (ctx->cipher.aes == NULL) { - return SECFailure; - } - -@@ -308,8 +309,8 @@ CMAC_Destroy(CMACContext *ctx, PRBool fr - return; - } - -- if (ctx->cipherType == CMAC_AES) { -- AES_DestroyContext(&ctx->cipher.aes, PR_FALSE); -+ if (ctx->cipherType == CMAC_AES && ctx->cipher.aes != NULL) { -+ AES_DestroyContext(ctx->cipher.aes, PR_TRUE); - } - - /* Destroy everything in the context. This includes sensitive data in diff --git a/nss.spec b/nss.spec index 9ccfc45..f9d07e3 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.25.0 -%global nss_version 3.50.0 +%global nss_version 3.51.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -115,9 +115,6 @@ Patch11: nss-tls13-default.patch Patch12: nss-signtool-format.patch # https://github.com/FStarLang/kremlin/issues/166 Patch13: nss-kremlin-ppc64le.patch -# https://bugzilla.mozilla.org/show_bug.cgi?id=1611209 -# https://bugzilla.mozilla.org/show_bug.cgi?id=1610687 -Patch14: nss-cmac-fixes.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -883,6 +880,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Apr 7 2020 Daiki Ueno - 3.51.0-1 +- Update to NSS 3.51 + * Thu Mar 5 2020 Daiki Ueno - 3.50.0-2 - Apply CMAC fixes from upstream diff --git a/sources b/sources index 8a7e320..d0ba033 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.50.tar.gz) = d6bcaf8ad65b5a97c42cd6cbbc68add5c4b49db74b2debcedb2a007f72511ac0e9bd21fd2dec041bc1975cfc8af26a48450aa0d1b962f755931ab2ac45c795b1 +SHA512 (nss-3.51.tar.gz) = 9c894b1ea41449b000750a7b3a89fcb43dfc3d0d4d6dcc0dc288bc73996f76f1ee1ede927a8aecae6d4a07f9f3d3e3a042c6a60cf06e27e0cdc004fce2e510fd From 3dda51fb0f3a308a5e48dd64dc7911d20e93bf0e Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 4 May 2020 07:54:02 +0200 Subject: [PATCH 25/41] Update to NSS 3.51.1 --- .gitignore | 1 + nss.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 303c2dc..e7b1e2c 100644 --- a/.gitignore +++ b/.gitignore @@ -46,3 +46,4 @@ TestUser51.cert /nss-3.49.2.tar.gz /nss-3.50.tar.gz /nss-3.51.tar.gz +/nss-3.51.1.tar.gz diff --git a/nss.spec b/nss.spec index f9d07e3..19cafb8 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.25.0 -%global nss_version 3.51.0 +%global nss_version 3.51.1 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -880,6 +880,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon May 4 2020 Daiki Ueno - 3.51.1-1 +- Update to NSS 3.51.1 + * Tue Apr 7 2020 Daiki Ueno - 3.51.0-1 - Update to NSS 3.51 diff --git a/sources b/sources index d0ba033..8464526 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.51.tar.gz) = 9c894b1ea41449b000750a7b3a89fcb43dfc3d0d4d6dcc0dc288bc73996f76f1ee1ede927a8aecae6d4a07f9f3d3e3a042c6a60cf06e27e0cdc004fce2e510fd +SHA512 (nss-3.51.1.tar.gz) = 1878780886cc330489a14a60ee5cb67b174f3167d020db256eacdce079652ef8af65813914cd0fb5684457053fa27acc9bff72d0713fbea28795613ca45a6d46 From 2354903488238edf7af24c850692ee04c8a05fb3 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 11 May 2020 18:21:55 +0200 Subject: [PATCH 26/41] Update to NSS 3.52 --- .gitignore | 1 + nss-3.47-ike-fix.patch | 22 ---------------------- nss-kremlin-ppc64le.patch | 23 ++++++++++++----------- nss-tls13-default.patch | 12 ------------ nss.spec | 12 ++++-------- sources | 2 +- 6 files changed, 18 insertions(+), 54 deletions(-) delete mode 100644 nss-3.47-ike-fix.patch delete mode 100644 nss-tls13-default.patch diff --git a/.gitignore b/.gitignore index e7b1e2c..9718285 100644 --- a/.gitignore +++ b/.gitignore @@ -47,3 +47,4 @@ TestUser51.cert /nss-3.50.tar.gz /nss-3.51.tar.gz /nss-3.51.1.tar.gz +/nss-3.52.tar.gz diff --git a/nss-3.47-ike-fix.patch b/nss-3.47-ike-fix.patch deleted file mode 100644 index 2de0aee..0000000 --- a/nss-3.47-ike-fix.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff -up ./lib/softoken/pkcs11.c.ike_fix ./lib/softoken/pkcs11.c ---- ./lib/softoken/pkcs11.c.ike_fix 2019-11-04 10:15:08.022176945 -0800 -+++ ./lib/softoken/pkcs11.c 2019-11-04 10:17:35.396733750 -0800 -@@ -330,7 +330,7 @@ static const struct mechanismList mechan - { CKM_AES_CTS, { 16, 32, CKF_EN_DE }, PR_TRUE }, - { CKM_AES_CTR, { 16, 32, CKF_EN_DE }, PR_TRUE }, - { CKM_AES_GCM, { 16, 32, CKF_EN_DE }, PR_TRUE }, -- { CKM_AES_XCBC_MAC_96, { 16, 16, CKF_SN_VR }, PR_TRUE }, -+ { CKM_AES_XCBC_MAC_96, { 12, 12, CKF_SN_VR }, PR_TRUE }, - { CKM_AES_XCBC_MAC, { 16, 16, CKF_SN_VR }, PR_TRUE }, - /* ------------------------- Camellia Operations --------------------- */ - { CKM_CAMELLIA_KEY_GEN, { 16, 32, CKF_GENERATE }, PR_TRUE }, -@@ -518,7 +518,8 @@ static const struct mechanismList mechan - /* --------------------IPSEC ----------------------- */ - { CKM_NSS_IKE_PRF_PLUS_DERIVE, { 8, 255 * 64, CKF_DERIVE }, PR_TRUE }, - { CKM_NSS_IKE_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE }, -- { CKM_NSS_IKE1_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE } -+ { CKM_NSS_IKE1_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE }, -+ { CKM_NSS_IKE1_APP_B_PRF_DERIVE, { 8, 255 * 64, CKF_DERIVE }, PR_TRUE } - }; - static const CK_ULONG mechanismCount = sizeof(mechanisms) / sizeof(mechanisms[0]); - diff --git a/nss-kremlin-ppc64le.patch b/nss-kremlin-ppc64le.patch index d4e9d89..b5f4700 100644 --- a/nss-kremlin-ppc64le.patch +++ b/nss-kremlin-ppc64le.patch @@ -2,27 +2,28 @@ Index: nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h =================================================================== --- nss.orig/lib/freebl/verified/kremlin/include/kremlin/internal/types.h +++ nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h -@@ -56,7 +56,9 @@ typedef const char *Prims_string; +@@ -56,9 +56,10 @@ typedef const char *Prims_string; + !defined(__clang__) #include typedef __m128i FStar_UInt128_uint128; - #elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \ -- (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__)) -+ (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \ +-#elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \ ++#elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \ + (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \ +- (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__))) + (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \ + defined(__s390x__)) typedef unsigned __int128 FStar_UInt128_uint128; - #else - typedef struct FStar_UInt128_uint128_s { + #elif !defined(KRML_VERIFIED_UINT128) && defined(_MSC_VER) && defined(__clang__) + typedef __uint128_t FStar_UInt128_uint128; Index: nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h =================================================================== --- nss.orig/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h +++ nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h -@@ -25,7 +25,9 @@ - #include "LowStar_Endianness.h" +@@ -26,7 +26,8 @@ - #if !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \ -- (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__)) -+ (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \ + #if !defined(KRML_VERIFIED_UINT128) && (!defined(_MSC_VER) || defined(__clang__)) && \ + (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \ +- (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__))) + (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \ + defined(__s390x__)) diff --git a/nss-tls13-default.patch b/nss-tls13-default.patch deleted file mode 100644 index ffdca50..0000000 --- a/nss-tls13-default.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up nss/lib/ssl/sslsock.c.tls13-default nss/lib/ssl/sslsock.c ---- nss/lib/ssl/sslsock.c.tls13-default 2020-01-27 10:21:44.930830558 +0100 -+++ nss/lib/ssl/sslsock.c 2020-01-27 10:21:47.419852229 +0100 -@@ -97,7 +97,7 @@ static sslOptions ssl_defaults = { - */ - static SSLVersionRange versions_defaults_stream = { - SSL_LIBRARY_VERSION_TLS_1_0, -- SSL_LIBRARY_VERSION_TLS_1_3 -+ SSL_LIBRARY_VERSION_TLS_1_2 - }; - - static SSLVersionRange versions_defaults_datagram = { diff --git a/nss.spec b/nss.spec index 19cafb8..45d6dde 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.25.0 -%global nss_version 3.51.1 +%global nss_version 3.52.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -105,13 +105,6 @@ Patch2: nss-539183.patch # Once the buildroot aha been bootstrapped the patch may be removed # but it doesn't hurt to keep it. Patch4: iquote.patch -# add missing ike mechanism to softoken -Patch10: nss-3.47-ike-fix.patch -# To revert the upstream change: -# https://bugzilla.mozilla.org/show_bug.cgi?id=1573118 -# as it still doesn't work under FIPS mode because of missing HKDF -# support in PKCS #11. -Patch11: nss-tls13-default.patch Patch12: nss-signtool-format.patch # https://github.com/FStarLang/kremlin/issues/166 Patch13: nss-kremlin-ppc64le.patch @@ -880,6 +873,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon May 11 2020 Daiki Ueno - 3.52.0-1 +- Update to NSS 3.52 + * Mon May 4 2020 Daiki Ueno - 3.51.1-1 - Update to NSS 3.51.1 diff --git a/sources b/sources index 8464526..2f019bb 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.51.1.tar.gz) = 1878780886cc330489a14a60ee5cb67b174f3167d020db256eacdce079652ef8af65813914cd0fb5684457053fa27acc9bff72d0713fbea28795613ca45a6d46 +SHA512 (nss-3.52.tar.gz) = a45baf38717bceda03c292b2c01def680a24a846327e17d36044a85e30ed40c68220c78c0a2c3025c11778ee58f5d5eb0fff1b4cd274b95c408fb59e394e62c6 From 3511128cfd932e2e3c8697a6c190a44cc640ab71 Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Wed, 13 May 2020 16:00:12 -0700 Subject: [PATCH 27/41] Delay new CK_GCM_PARAMS semantics until fedora 34 unless explicitly enabled. --- nss-gcm-param-default-pkcs11v2.patch | 21 +++++++++++++++++++++ nss.spec | 11 ++++++++++- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 nss-gcm-param-default-pkcs11v2.patch diff --git a/nss-gcm-param-default-pkcs11v2.patch b/nss-gcm-param-default-pkcs11v2.patch new file mode 100644 index 0000000..2d6cba8 --- /dev/null +++ b/nss-gcm-param-default-pkcs11v2.patch @@ -0,0 +1,21 @@ +diff -up ./lib/util/pkcs11n.h.aes_gcm_pkcs11_v2 ./lib/util/pkcs11n.h +--- ./lib/util/pkcs11n.h.aes_gcm_pkcs11_v2 2020-05-13 13:44:11.312405744 -0700 ++++ ./lib/util/pkcs11n.h 2020-05-13 13:45:23.951723660 -0700 +@@ -605,7 +605,7 @@ typedef struct CK_NSS_GCM_PARAMS { + typedef CK_NSS_GCM_PARAMS CK_PTR CK_NSS_GCM_PARAMS_PTR; + + /* deprecated #defines. Drop in future NSS releases */ +-#ifdef NSS_PKCS11_2_0_COMPAT ++#ifndef NSS_PKCS11_3_0_STRICT + + /* defines that were changed between NSS's PKCS #11 and the Oasis headers */ + #define CKF_EC_FP CKF_EC_F_P +@@ -664,7 +664,7 @@ typedef CK_NSS_GCM_PARAMS CK_PTR CK_GCM_ + #define CKT_NETSCAPE_VALID CKT_NSS_VALID + #define CKT_NETSCAPE_VALID_DELEGATOR CKT_NSS_VALID_DELEGATOR + #else +-/* use the new CK_GCM_PARAMS if NSS_PKCS11_2_0_COMPAT is not defined */ ++/* use the new CK_GCM_PARAMS if NSS_PKCS11_3_0_STRICT is defined */ + typedef struct CK_GCM_PARAMS_V3 CK_GCM_PARAMS; + typedef CK_GCM_PARAMS_V3 CK_PTR CK_GCM_PARAMS_PTR; + #endif diff --git a/nss.spec b/nss.spec index 45d6dde..3f30180 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -108,6 +108,12 @@ Patch4: iquote.patch Patch12: nss-signtool-format.patch # https://github.com/FStarLang/kremlin/issues/166 Patch13: nss-kremlin-ppc64le.patch +%if 0%{?fedora} < 34 +%if 0%{?rhel} < 9 +Patch20: nss-gcm-param-default-pkcs11v2.patch +%endif +%endif + %description Network Security Services (NSS) is a set of libraries designed to @@ -873,6 +879,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Wed May 13 2020 Bob Relyea - 3.52.0-2 +- Delay CK_GCM_PARAMS semantics until fedora 34 + * Mon May 11 2020 Daiki Ueno - 3.52.0-1 - Update to NSS 3.52 From 33682433d04c5e605f2e2c7e8c129519874ed7d0 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 1 Jun 2020 08:08:02 +0200 Subject: [PATCH 28/41] Update to NSS 3.53 --- .gitignore | 1 + nss-kremlin-ppc64le.patch | 31 ------------------------------- nss.spec | 9 +++++---- sources | 2 +- 4 files changed, 7 insertions(+), 36 deletions(-) delete mode 100644 nss-kremlin-ppc64le.patch diff --git a/.gitignore b/.gitignore index 9718285..24c92b8 100644 --- a/.gitignore +++ b/.gitignore @@ -48,3 +48,4 @@ TestUser51.cert /nss-3.51.tar.gz /nss-3.51.1.tar.gz /nss-3.52.tar.gz +/nss-3.53.tar.gz diff --git a/nss-kremlin-ppc64le.patch b/nss-kremlin-ppc64le.patch deleted file mode 100644 index b5f4700..0000000 --- a/nss-kremlin-ppc64le.patch +++ /dev/null @@ -1,31 +0,0 @@ -Index: nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h -=================================================================== ---- nss.orig/lib/freebl/verified/kremlin/include/kremlin/internal/types.h -+++ nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h -@@ -56,9 +56,10 @@ typedef const char *Prims_string; - !defined(__clang__) - #include - typedef __m128i FStar_UInt128_uint128; --#elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \ -+#elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \ - (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \ -- (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__))) -+ (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \ -+ defined(__s390x__)) - typedef unsigned __int128 FStar_UInt128_uint128; - #elif !defined(KRML_VERIFIED_UINT128) && defined(_MSC_VER) && defined(__clang__) - typedef __uint128_t FStar_UInt128_uint128; -Index: nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h -=================================================================== ---- nss.orig/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h -+++ nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h -@@ -26,7 +26,8 @@ - - #if !defined(KRML_VERIFIED_UINT128) && (!defined(_MSC_VER) || defined(__clang__)) && \ - (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \ -- (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__))) -+ (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \ -+ defined(__s390x__)) - - /* GCC + using native unsigned __int128 support */ - diff --git a/nss.spec b/nss.spec index 3f30180..bebd420 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.25.0 -%global nss_version 3.52.0 +%global nss_version 3.53.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -106,8 +106,6 @@ Patch2: nss-539183.patch # but it doesn't hurt to keep it. Patch4: iquote.patch Patch12: nss-signtool-format.patch -# https://github.com/FStarLang/kremlin/issues/166 -Patch13: nss-kremlin-ppc64le.patch %if 0%{?fedora} < 34 %if 0%{?rhel} < 9 Patch20: nss-gcm-param-default-pkcs11v2.patch @@ -879,6 +877,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Jun 1 2020 Daiki Ueno - 3.53.0-1 +- Update to NSS 3.53 + * Wed May 13 2020 Bob Relyea - 3.52.0-2 - Delay CK_GCM_PARAMS semantics until fedora 34 diff --git a/sources b/sources index 2f019bb..77bf7ca 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.52.tar.gz) = a45baf38717bceda03c292b2c01def680a24a846327e17d36044a85e30ed40c68220c78c0a2c3025c11778ee58f5d5eb0fff1b4cd274b95c408fb59e394e62c6 +SHA512 (nss-3.53.tar.gz) = 280edf24356b764584200bff949af4a7f88514ee8ac80bf5348a9a844a8b1eb263e9aa1d772644bd8bb1bd195c12b6cc173280cfc88cd97e56562e1c40e71503 From a01c0815918b7a6558f81b3b175b9859ffce104d Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 2 Jun 2020 08:52:10 +0200 Subject: [PATCH 29/41] Update build procedure after removal of mkdepend --- nss.spec | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/nss.spec b/nss.spec index bebd420..70100a1 100644 --- a/nss.spec +++ b/nss.spec @@ -293,16 +293,14 @@ export USE_64=1 %endif %endif -make -C ./nss/coreconf -make -C ./nss/lib/dbm - # Set the policy file location # if set NSS will always check for the policy file and load if it exists export POLICY_FILE="nss.config" # location of the policy file export POLICY_PATH="/etc/crypto-policies/back-ends" -make -C ./nss +%{__make} -C ./nss all +%{__make} -C ./nss latest # build the man pages clean pushd ./nss From 21d259321d188e4bf3ec65de04e2abd2f3ef77bf Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Fri, 5 Jun 2020 13:41:56 -0700 Subject: [PATCH 30/41] Resolves: rhbz#1843417 Cannot compile code with pk11pub.h (an nss header) with -Werror=strict-prototypes --- nss-3.53-strict-proto-fix.patch | 12 ++++++++++++ nss.spec | 8 ++++++-- 2 files changed, 18 insertions(+), 2 deletions(-) create mode 100644 nss-3.53-strict-proto-fix.patch diff --git a/nss-3.53-strict-proto-fix.patch b/nss-3.53-strict-proto-fix.patch new file mode 100644 index 0000000..e69c977 --- /dev/null +++ b/nss-3.53-strict-proto-fix.patch @@ -0,0 +1,12 @@ +diff -up ./lib/pk11wrap/pk11pub.h.strict_proto_fix ./lib/pk11wrap/pk11pub.h +--- ./lib/pk11wrap/pk11pub.h.strict_proto_fix 2020-06-04 16:48:54.721954514 -0700 ++++ ./lib/pk11wrap/pk11pub.h 2020-06-04 16:49:17.074066050 -0700 +@@ -948,7 +948,7 @@ PRBool SECMOD_HasRootCerts(void); + * the system state independent of the database state and can be called + * before NSS initializes. + */ +-int SECMOD_GetSystemFIPSEnabled(); ++int SECMOD_GetSystemFIPSEnabled(void); + + SEC_END_PROTOS + diff --git a/nss.spec b/nss.spec index 70100a1..4283afc 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -111,7 +111,8 @@ Patch12: nss-signtool-format.patch Patch20: nss-gcm-param-default-pkcs11v2.patch %endif %endif - +# Upstream bug https://bugzilla.mozilla.org/show_bug.cgi?id=1643528 +Patch30: nss-3.53-strict-proto-fix.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -875,6 +876,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri Jun 5 2020 Bob Relyea - 3.53.0-2 +- Fix non-strict prototype in pk11pub.h + * Mon Jun 1 2020 Daiki Ueno - 3.53.0-1 - Update to NSS 3.53 From 8751f8e5bf72e5e4df394353e4abc962db889b6c Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 15 Jul 2020 11:25:04 +0200 Subject: [PATCH 31/41] Update to NSS 3.54 --- .gitignore | 1 + nss.spec | 9 ++++++--- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 24c92b8..32c257f 100644 --- a/.gitignore +++ b/.gitignore @@ -49,3 +49,4 @@ TestUser51.cert /nss-3.51.1.tar.gz /nss-3.52.tar.gz /nss-3.53.tar.gz +/nss-3.54.tar.gz diff --git a/nss.spec b/nss.spec index 4283afc..1db6f03 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ -%global nspr_version 4.25.0 -%global nss_version 3.53.0 +%global nspr_version 4.26.0 +%global nss_version 3.54.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -876,6 +876,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Wed Jul 15 2020 Daiki Ueno - 3.54.0-1 +- Update to NSS 3.54 + * Fri Jun 5 2020 Bob Relyea - 3.53.0-2 - Fix non-strict prototype in pk11pub.h diff --git a/sources b/sources index 77bf7ca..a019b76 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.53.tar.gz) = 280edf24356b764584200bff949af4a7f88514ee8ac80bf5348a9a844a8b1eb263e9aa1d772644bd8bb1bd195c12b6cc173280cfc88cd97e56562e1c40e71503 +SHA512 (nss-3.54.tar.gz) = 9b9253469514c085730ae580f6544e882a8264e253687950627a4fa1eeb956287c9da46caf7d8988cd6363f6dee26cb8db755203375751fe53795697d7ae9b7b From cbfb0c529b7e3738badebe8cca0b3f027cf070b0 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sun, 2 Aug 2020 07:44:16 +0200 Subject: [PATCH 32/41] Update to NSS 3.55 --- .gitignore | 1 + STAGE2-nss | 68 --------------------------------- nss-3.53-strict-proto-fix.patch | 12 ------ nss.spec | 7 ++-- sources | 2 +- 5 files changed, 6 insertions(+), 84 deletions(-) delete mode 100644 STAGE2-nss delete mode 100644 nss-3.53-strict-proto-fix.patch diff --git a/.gitignore b/.gitignore index 32c257f..9c6334a 100644 --- a/.gitignore +++ b/.gitignore @@ -50,3 +50,4 @@ TestUser51.cert /nss-3.52.tar.gz /nss-3.53.tar.gz /nss-3.54.tar.gz +/nss-3.55.tar.gz diff --git a/STAGE2-nss b/STAGE2-nss deleted file mode 100644 index 3d43b92..0000000 --- a/STAGE2-nss +++ /dev/null @@ -1,68 +0,0 @@ -#requires nspr -#requires perl -#requires nss-util -#requires nss-softokn - -mcd $BUILDDIR/nss - -export BUILD_OPT=1 -export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1 -export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 -export NSPR_INCLUDE_DIR=/usr/include/nspr -export NSPR_LIB_DIR=/usr/lib${SUFFIX} -export NSS_USE_SYSTEM_SQLITE=1 -export NSS_BUILD_WITHOUT_SOFTOKEN=1 -export USE_SYSTEM_SOFTOKEN=1 -export SOFTOKEN_LIB_DIR=/usr/lib${SUFFIX} -export NSSUTIL_INCLUDE_DIR=/usr/include/nss3 -export NSSUTIL_LIB_DIR=/usr/lib${SUFFIX} -export USE_SYSTEM_NSSUTIL=1 -export FREEBL_INCLUDE_DIR=/usr/include/nss3 -export FREEBL_LIB_DIR=/usr/lib${SUFFIX} -export USE_SYSTEM_FREEBL=1 -export NSS_USE_SYSTEM_FREEBL=1 -export FREEBL_NO_DEPEND=1 -export IN_TREE_FREEBL_HEADERS_FIRST=1 -export NSS_BLTEST_NOT_AVAILABLE=1 -export NSS_NO_SSL2_NO_EXPORT=1 -export NSS_ECC_MORE_THAN_SUITE_B=1 -export NSS_NO_PKCS11_BYPASS=1 -#export NSDISTMODE="copy" - -if [ "$SUFFIX" = "64" ]; then - USE_64=1 - export USE_64 -fi - -(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp nss/lib/ckfw/nssck.api dist/private/nss/) - -make -C $SRC/nss-3.*/nss/coreconf -make -C $SRC/nss-3.*/nss/lib/dbm - -# nss/nssinit.c, ssl/sslcon.c, smime/smimeutil.c and ckfw/builtins/binst.c -# need nss/verref.h which is exported privately, move it to where it can be found. -(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp -a nss/verref.h dist/private/nss/) - -make -C $SRC/nss-3.*/nss -cd $SRC/nss-3.*/nss/coreconf -make install -cd $SRC/nss-3.*/nss/lib/dbm -make install -cd $SRC/nss-3.*/nss -make install -# Copy the binary libraries we want -NSSLIBS="libnss3.so libnssckbi.so libnsspem.so libnsssysinit.so libsmime3.so libssl3.so" -# BOZO: temporarily disable FIPS140 support -#NSSLIBCHKS="libnssdbm3.chk libfreebl3.chk libsoftokn3.chk" -NSSLIBCHKS="" -# END BOZO -cd $SRC/nss-3.* -for file in $NSSLIBS $NSSLIBCHKS -do - install -p -m 755 dist/*.OBJ/lib/$file /usr/lib${SUFFIX}/ -done -# Copy the include files we want -for file in $SRC/nss-*/dist/public/nss/*.h -do - install -p -m 644 $file /usr/include/nss3/ -done diff --git a/nss-3.53-strict-proto-fix.patch b/nss-3.53-strict-proto-fix.patch deleted file mode 100644 index e69c977..0000000 --- a/nss-3.53-strict-proto-fix.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up ./lib/pk11wrap/pk11pub.h.strict_proto_fix ./lib/pk11wrap/pk11pub.h ---- ./lib/pk11wrap/pk11pub.h.strict_proto_fix 2020-06-04 16:48:54.721954514 -0700 -+++ ./lib/pk11wrap/pk11pub.h 2020-06-04 16:49:17.074066050 -0700 -@@ -948,7 +948,7 @@ PRBool SECMOD_HasRootCerts(void); - * the system state independent of the database state and can be called - * before NSS initializes. - */ --int SECMOD_GetSystemFIPSEnabled(); -+int SECMOD_GetSystemFIPSEnabled(void); - - SEC_END_PROTOS - diff --git a/nss.spec b/nss.spec index 1db6f03..ee33070 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.26.0 -%global nss_version 3.54.0 +%global nss_version 3.55.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -111,8 +111,6 @@ Patch12: nss-signtool-format.patch Patch20: nss-gcm-param-default-pkcs11v2.patch %endif %endif -# Upstream bug https://bugzilla.mozilla.org/show_bug.cgi?id=1643528 -Patch30: nss-3.53-strict-proto-fix.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -876,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Sun Aug 2 2020 Daiki Ueno - 3.55.0-1 +- Update to NSS 3.55 + * Wed Jul 15 2020 Daiki Ueno - 3.54.0-1 - Update to NSS 3.54 diff --git a/sources b/sources index a019b76..040d300 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.54.tar.gz) = 9b9253469514c085730ae580f6544e882a8264e253687950627a4fa1eeb956287c9da46caf7d8988cd6363f6dee26cb8db755203375751fe53795697d7ae9b7b +SHA512 (nss-3.55.tar.gz) = acae7b803a3219cd4b78216cb8a6352805741e42eca6a42a5e6289ebbabc6189c7c6bc138cbd8a93d8631d06175c4d34e72957d49fe726adada6aaa2566e399e From fbf8153cba18db9e1316b3fb6fac7ba117ec37aa Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sun, 2 Aug 2020 07:45:36 +0200 Subject: [PATCH 33/41] Re-add STAGE2-nss --- STAGE2-nss | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 STAGE2-nss diff --git a/STAGE2-nss b/STAGE2-nss new file mode 100644 index 0000000..3d43b92 --- /dev/null +++ b/STAGE2-nss @@ -0,0 +1,68 @@ +#requires nspr +#requires perl +#requires nss-util +#requires nss-softokn + +mcd $BUILDDIR/nss + +export BUILD_OPT=1 +export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1 +export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 +export NSPR_INCLUDE_DIR=/usr/include/nspr +export NSPR_LIB_DIR=/usr/lib${SUFFIX} +export NSS_USE_SYSTEM_SQLITE=1 +export NSS_BUILD_WITHOUT_SOFTOKEN=1 +export USE_SYSTEM_SOFTOKEN=1 +export SOFTOKEN_LIB_DIR=/usr/lib${SUFFIX} +export NSSUTIL_INCLUDE_DIR=/usr/include/nss3 +export NSSUTIL_LIB_DIR=/usr/lib${SUFFIX} +export USE_SYSTEM_NSSUTIL=1 +export FREEBL_INCLUDE_DIR=/usr/include/nss3 +export FREEBL_LIB_DIR=/usr/lib${SUFFIX} +export USE_SYSTEM_FREEBL=1 +export NSS_USE_SYSTEM_FREEBL=1 +export FREEBL_NO_DEPEND=1 +export IN_TREE_FREEBL_HEADERS_FIRST=1 +export NSS_BLTEST_NOT_AVAILABLE=1 +export NSS_NO_SSL2_NO_EXPORT=1 +export NSS_ECC_MORE_THAN_SUITE_B=1 +export NSS_NO_PKCS11_BYPASS=1 +#export NSDISTMODE="copy" + +if [ "$SUFFIX" = "64" ]; then + USE_64=1 + export USE_64 +fi + +(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp nss/lib/ckfw/nssck.api dist/private/nss/) + +make -C $SRC/nss-3.*/nss/coreconf +make -C $SRC/nss-3.*/nss/lib/dbm + +# nss/nssinit.c, ssl/sslcon.c, smime/smimeutil.c and ckfw/builtins/binst.c +# need nss/verref.h which is exported privately, move it to where it can be found. +(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp -a nss/verref.h dist/private/nss/) + +make -C $SRC/nss-3.*/nss +cd $SRC/nss-3.*/nss/coreconf +make install +cd $SRC/nss-3.*/nss/lib/dbm +make install +cd $SRC/nss-3.*/nss +make install +# Copy the binary libraries we want +NSSLIBS="libnss3.so libnssckbi.so libnsspem.so libnsssysinit.so libsmime3.so libssl3.so" +# BOZO: temporarily disable FIPS140 support +#NSSLIBCHKS="libnssdbm3.chk libfreebl3.chk libsoftokn3.chk" +NSSLIBCHKS="" +# END BOZO +cd $SRC/nss-3.* +for file in $NSSLIBS $NSSLIBCHKS +do + install -p -m 755 dist/*.OBJ/lib/$file /usr/lib${SUFFIX}/ +done +# Copy the include files we want +for file in $SRC/nss-*/dist/public/nss/*.h +do + install -p -m 644 $file /usr/include/nss3/ +done From f5d96e69ceb5c2d17346f913966270581cb2968f Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 24 Aug 2020 08:58:51 +0200 Subject: [PATCH 34/41] Update to NSS 3.56 --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 9c6334a..9e4d176 100644 --- a/.gitignore +++ b/.gitignore @@ -51,3 +51,4 @@ TestUser51.cert /nss-3.53.tar.gz /nss-3.54.tar.gz /nss-3.55.tar.gz +/nss-3.56.tar.gz diff --git a/nss.spec b/nss.spec index ee33070..34354de 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ -%global nspr_version 4.26.0 -%global nss_version 3.55.0 +%global nspr_version 4.28.0 +%global nss_version 3.56.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -874,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Aug 24 2020 Daiki Ueno - 3.56.0-1 +- Update to NSS 3.56 + * Sun Aug 2 2020 Daiki Ueno - 3.55.0-1 - Update to NSS 3.55 diff --git a/sources b/sources index 040d300..21a0798 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.55.tar.gz) = acae7b803a3219cd4b78216cb8a6352805741e42eca6a42a5e6289ebbabc6189c7c6bc138cbd8a93d8631d06175c4d34e72957d49fe726adada6aaa2566e399e +SHA512 (nss-3.56.tar.gz) = f2eed8252c13b38a4d80a11203136d22a521205f814b6d954cc119ccf8921fcb8f689d919944bea4739d1575e9bda7e13cf2ad054ac91d51e049abe246efc845 From 946602ffb6589defdefa8d31b5f3f9b5bec6bd30 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sat, 5 Sep 2020 10:46:10 +0200 Subject: [PATCH 35/41] Fix AArch64 build failure --- nss-aarch64-gcc.patch | 58 +++++++++++++++++++++++++++++++++++++++++++ nss.spec | 4 +++ 2 files changed, 62 insertions(+) create mode 100644 nss-aarch64-gcc.patch diff --git a/nss-aarch64-gcc.patch b/nss-aarch64-gcc.patch new file mode 100644 index 0000000..fa3b812 --- /dev/null +++ b/nss-aarch64-gcc.patch @@ -0,0 +1,58 @@ +# HG changeset patch +# User Daiki Ueno +# Date 1599294537 -7200 +# Sat Sep 05 10:28:57 2020 +0200 +# Node ID 1294add76fecdfc301c9cab3ed68ed1681979780 +# Parent e03296e73ba666329bd9c1257038353bc9074466 +Bug 1659256, add gcc version check on AArch64 optimization, r?rrelyea + +Reviewers: rrelyea + +Bug #: 1659256 + +Differential Revision: https://phabricator.services.mozilla.com/D87174 + +diff -r e03296e73ba6 -r 1294add76fec lib/freebl/Makefile +--- a/lib/freebl/Makefile Sat Sep 05 08:53:40 2020 +0200 ++++ b/lib/freebl/Makefile Sat Sep 05 10:28:57 2020 +0200 +@@ -119,11 +119,24 @@ + DEFINES += -DNSS_X86 + endif + endif +-ifdef NS_USE_GCC + ifeq ($(CPU_ARCH),aarch64) +- DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 +- EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c +-endif ++ ifdef CC_IS_CLANG ++ DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 ++ EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c ++ else ifeq (1,$(CC_IS_GCC)) ++ # GCC versions older than 4.9 don't support ARM AES. The check ++ # is done in two parts, first allows "major.minor" == "4.9", ++ # and then rejects any major versions prior to 5. Note that ++ # there has been no GCC 4.10, as it is renamed to GCC 5. ++ ifneq (,$(filter 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION)))) ++ DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 ++ EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c ++ endif ++ ifeq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION)))) ++ DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 ++ EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c ++ endif ++ endif + endif + ifeq ($(CPU_ARCH),arm) + ifndef NSS_DISABLE_ARM32_NEON +@@ -133,7 +146,10 @@ + DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 + EXTRA_SRCS += aes-armv8.c sha1-armv8.c sha256-armv8.c + else ifeq (1,$(CC_IS_GCC)) +- # Old compiler doesn't support ARM AES. ++ # GCC versions older than 4.9 don't support ARM AES. The check ++ # is done in two parts, first allows "major.minor" == "4.9", ++ # and then rejects any major versions prior to 5. Note that ++ # there has been no GCC 4.10, as it is renamed to GCC 5. + ifneq (,$(filter 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION)))) + DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 + EXTRA_SRCS += aes-armv8.c sha1-armv8.c sha256-armv8.c diff --git a/nss.spec b/nss.spec index 34354de..4aa7a78 100644 --- a/nss.spec +++ b/nss.spec @@ -106,6 +106,10 @@ Patch2: nss-539183.patch # but it doesn't hurt to keep it. Patch4: iquote.patch Patch12: nss-signtool-format.patch +# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1659256 +# Also fixes the regression in bug 1652032: +# https://phabricator.services.mozilla.com/D87174#2817994 +Patch13: nss-aarch64-gcc.patch %if 0%{?fedora} < 34 %if 0%{?rhel} < 9 Patch20: nss-gcm-param-default-pkcs11v2.patch From cfc2237de10329616c5076455f25f2f9164ae050 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sat, 5 Sep 2020 11:08:21 +0200 Subject: [PATCH 36/41] Update the AArch64 patch --- nss-aarch64-gcc.patch | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/nss-aarch64-gcc.patch b/nss-aarch64-gcc.patch index fa3b812..ad3533f 100644 --- a/nss-aarch64-gcc.patch +++ b/nss-aarch64-gcc.patch @@ -2,7 +2,7 @@ # User Daiki Ueno # Date 1599294537 -7200 # Sat Sep 05 10:28:57 2020 +0200 -# Node ID 1294add76fecdfc301c9cab3ed68ed1681979780 +# Node ID c2a28193fcf8771dc1f739bf5f41adf3f68b1d7d # Parent e03296e73ba666329bd9c1257038353bc9074466 Bug 1659256, add gcc version check on AArch64 optimization, r?rrelyea @@ -12,7 +12,7 @@ Bug #: 1659256 Differential Revision: https://phabricator.services.mozilla.com/D87174 -diff -r e03296e73ba6 -r 1294add76fec lib/freebl/Makefile +diff -r e03296e73ba6 -r c2a28193fcf8 lib/freebl/Makefile --- a/lib/freebl/Makefile Sat Sep 05 08:53:40 2020 +0200 +++ b/lib/freebl/Makefile Sat Sep 05 10:28:57 2020 +0200 @@ -119,11 +119,24 @@ @@ -56,3 +56,18 @@ diff -r e03296e73ba6 -r 1294add76fec lib/freebl/Makefile ifneq (,$(filter 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION)))) DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 EXTRA_SRCS += aes-armv8.c sha1-armv8.c sha256-armv8.c +@@ -728,14 +744,12 @@ + endif + endif + +-ifdef NS_USE_GCC + ifeq ($(CPU_ARCH),aarch64) + $(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto + $(OBJDIR)/$(PROG_PREFIX)gcm-aarch64$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto + $(OBJDIR)/$(PROG_PREFIX)sha1-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto + $(OBJDIR)/$(PROG_PREFIX)sha256-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto + endif +-endif + + ifeq ($(CPU_ARCH),ppc) + ifndef NSS_DISABLE_ALTIVEC From 2ac250b3224d335e73e4f1f269a708815296e502 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Sat, 19 Sep 2020 09:13:11 +0200 Subject: [PATCH 37/41] Update to NSS 3.57 --- .gitignore | 1 + nss-aarch64-gcc.patch | 73 ------------------------------------------- nss.spec | 11 +++---- sources | 2 +- 4 files changed, 7 insertions(+), 80 deletions(-) delete mode 100644 nss-aarch64-gcc.patch diff --git a/.gitignore b/.gitignore index 9e4d176..48c4103 100644 --- a/.gitignore +++ b/.gitignore @@ -52,3 +52,4 @@ TestUser51.cert /nss-3.54.tar.gz /nss-3.55.tar.gz /nss-3.56.tar.gz +/nss-3.57.tar.gz diff --git a/nss-aarch64-gcc.patch b/nss-aarch64-gcc.patch deleted file mode 100644 index ad3533f..0000000 --- a/nss-aarch64-gcc.patch +++ /dev/null @@ -1,73 +0,0 @@ -# HG changeset patch -# User Daiki Ueno -# Date 1599294537 -7200 -# Sat Sep 05 10:28:57 2020 +0200 -# Node ID c2a28193fcf8771dc1f739bf5f41adf3f68b1d7d -# Parent e03296e73ba666329bd9c1257038353bc9074466 -Bug 1659256, add gcc version check on AArch64 optimization, r?rrelyea - -Reviewers: rrelyea - -Bug #: 1659256 - -Differential Revision: https://phabricator.services.mozilla.com/D87174 - -diff -r e03296e73ba6 -r c2a28193fcf8 lib/freebl/Makefile ---- a/lib/freebl/Makefile Sat Sep 05 08:53:40 2020 +0200 -+++ b/lib/freebl/Makefile Sat Sep 05 10:28:57 2020 +0200 -@@ -119,11 +119,24 @@ - DEFINES += -DNSS_X86 - endif - endif --ifdef NS_USE_GCC - ifeq ($(CPU_ARCH),aarch64) -- DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 -- EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c --endif -+ ifdef CC_IS_CLANG -+ DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 -+ EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c -+ else ifeq (1,$(CC_IS_GCC)) -+ # GCC versions older than 4.9 don't support ARM AES. The check -+ # is done in two parts, first allows "major.minor" == "4.9", -+ # and then rejects any major versions prior to 5. Note that -+ # there has been no GCC 4.10, as it is renamed to GCC 5. -+ ifneq (,$(filter 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION)))) -+ DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 -+ EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c -+ endif -+ ifeq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION)))) -+ DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 -+ EXTRA_SRCS += aes-armv8.c gcm-aarch64.c sha1-armv8.c sha256-armv8.c -+ endif -+ endif - endif - ifeq ($(CPU_ARCH),arm) - ifndef NSS_DISABLE_ARM32_NEON -@@ -133,7 +146,10 @@ - DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 - EXTRA_SRCS += aes-armv8.c sha1-armv8.c sha256-armv8.c - else ifeq (1,$(CC_IS_GCC)) -- # Old compiler doesn't support ARM AES. -+ # GCC versions older than 4.9 don't support ARM AES. The check -+ # is done in two parts, first allows "major.minor" == "4.9", -+ # and then rejects any major versions prior to 5. Note that -+ # there has been no GCC 4.10, as it is renamed to GCC 5. - ifneq (,$(filter 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION)))) - DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 - EXTRA_SRCS += aes-armv8.c sha1-armv8.c sha256-armv8.c -@@ -728,14 +744,12 @@ - endif - endif - --ifdef NS_USE_GCC - ifeq ($(CPU_ARCH),aarch64) - $(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto - $(OBJDIR)/$(PROG_PREFIX)gcm-aarch64$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto - $(OBJDIR)/$(PROG_PREFIX)sha1-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto - $(OBJDIR)/$(PROG_PREFIX)sha256-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto - endif --endif - - ifeq ($(CPU_ARCH),ppc) - ifndef NSS_DISABLE_ALTIVEC diff --git a/nss.spec b/nss.spec index 4aa7a78..30cdd2e 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ -%global nspr_version 4.28.0 -%global nss_version 3.56.0 +%global nspr_version 4.29.0 +%global nss_version 3.57.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -106,10 +106,6 @@ Patch2: nss-539183.patch # but it doesn't hurt to keep it. Patch4: iquote.patch Patch12: nss-signtool-format.patch -# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1659256 -# Also fixes the regression in bug 1652032: -# https://phabricator.services.mozilla.com/D87174#2817994 -Patch13: nss-aarch64-gcc.patch %if 0%{?fedora} < 34 %if 0%{?rhel} < 9 Patch20: nss-gcm-param-default-pkcs11v2.patch @@ -878,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Sat Sep 19 2020 Daiki Ueno - 3.57.0-1 +- Update to NSS 3.57 + * Mon Aug 24 2020 Daiki Ueno - 3.56.0-1 - Update to NSS 3.56 diff --git a/sources b/sources index 21a0798..3ddbfe7 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.56.tar.gz) = f2eed8252c13b38a4d80a11203136d22a521205f814b6d954cc119ccf8921fcb8f689d919944bea4739d1575e9bda7e13cf2ad054ac91d51e049abe246efc845 +SHA512 (nss-3.57.tar.gz) = 7e312d7539a26f57b968548935a7715cfa895aa61da21d0542ae45b71cb16f63167728534cdfd15f8eca68c75753a0df3d05e87b4c5acaabbda63c736e552ea2 From d971b86a10ad8454ccb420922a4426d1228770e8 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 20 Oct 2020 09:31:29 +0200 Subject: [PATCH 38/41] Update to NSS 3.58 --- .gitignore | 1 + nss.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 48c4103..291fb6b 100644 --- a/.gitignore +++ b/.gitignore @@ -53,3 +53,4 @@ TestUser51.cert /nss-3.55.tar.gz /nss-3.56.tar.gz /nss-3.57.tar.gz +/nss-3.58.tar.gz diff --git a/nss.spec b/nss.spec index 30cdd2e..5cf103f 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.29.0 -%global nss_version 3.57.0 +%global nss_version 3.58.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -874,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Oct 20 2020 Daiki Ueno - 3.58.0-1 +- Update to NSS 3.58 + * Sat Sep 19 2020 Daiki Ueno - 3.57.0-1 - Update to NSS 3.57 diff --git a/sources b/sources index 3ddbfe7..d5ad023 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.57.tar.gz) = 7e312d7539a26f57b968548935a7715cfa895aa61da21d0542ae45b71cb16f63167728534cdfd15f8eca68c75753a0df3d05e87b4c5acaabbda63c736e552ea2 +SHA512 (nss-3.58.tar.gz) = 03d2ab1517ac07620ea3f02dcf680cf019e0129006ff2559b2d0a047036340c20b98c9679b17a594e5502aa30e158caf309f046901b9ec7c7adeeaa13ec50b80 From 4f8c752d0979935adae6a7402cca37f1ffb1f0da Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 20 Oct 2020 11:12:33 +0200 Subject: [PATCH 39/41] Install pk11hpke.h --- nss.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/nss.spec b/nss.spec index 5cf103f..76ab64d 100644 --- a/nss.spec +++ b/nss.spec @@ -730,6 +730,7 @@ update-crypto-policies &> /dev/null || : %{_includedir}/nss3/p12plcy.h %{_includedir}/nss3/p12t.h %{_includedir}/nss3/pk11func.h +%{_includedir}/nss3/pk11hpke.h %{_includedir}/nss3/pk11pqg.h %{_includedir}/nss3/pk11priv.h %{_includedir}/nss3/pk11pub.h From 16c2f6d758d38b0f52e8b5c482340b9939e6755f Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 22 Oct 2020 17:06:28 +0200 Subject: [PATCH 40/41] Enable TLS 1.3 middlebox compatibility mode by default --- nss-ccs.patch | 13 +++++++++++++ nss.spec | 7 ++++++- 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 nss-ccs.patch diff --git a/nss-ccs.patch b/nss-ccs.patch new file mode 100644 index 0000000..8a258f4 --- /dev/null +++ b/nss-ccs.patch @@ -0,0 +1,13 @@ +Index: nss/lib/ssl/sslsock.c +=================================================================== +--- nss.orig/lib/ssl/sslsock.c ++++ nss/lib/ssl/sslsock.c +@@ -86,7 +86,7 @@ static sslOptions ssl_defaults = { + .enableSignedCertTimestamps = PR_FALSE, + .requireDHENamedGroups = PR_FALSE, + .enable0RttData = PR_FALSE, +- .enableTls13CompatMode = PR_FALSE, ++ .enableTls13CompatMode = PR_TRUE, + .enableDtls13VersionCompat = PR_FALSE, + .enableDtlsShortHeader = PR_FALSE, + .enableHelloDowngradeCheck = PR_FALSE, diff --git a/nss.spec b/nss.spec index 76ab64d..b05e407 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -105,6 +105,8 @@ Patch2: nss-539183.patch # Once the buildroot aha been bootstrapped the patch may be removed # but it doesn't hurt to keep it. Patch4: iquote.patch +# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1672703 +Patch5: nss-ccs.patch Patch12: nss-signtool-format.patch %if 0%{?fedora} < 34 %if 0%{?rhel} < 9 @@ -875,6 +877,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Thu Oct 22 2020 Daiki Ueno - 3.58.0-2 +- Enable TLS 1.3 middlebox compatibility mode by default + * Tue Oct 20 2020 Daiki Ueno - 3.58.0-1 - Update to NSS 3.58 From 09825936b8f137f5125fd26665502d63ab695768 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 26 Oct 2020 06:55:42 +0100 Subject: [PATCH 41/41] Revert the last change, tolerate the first CCS in TLS 1.3 --- nss-ccs.patch | 145 +++++++++++++++++++++++++++++++++++++++++++++----- nss.spec | 5 +- 2 files changed, 136 insertions(+), 14 deletions(-) diff --git a/nss-ccs.patch b/nss-ccs.patch index 8a258f4..4841a5a 100644 --- a/nss-ccs.patch +++ b/nss-ccs.patch @@ -1,13 +1,132 @@ -Index: nss/lib/ssl/sslsock.c -=================================================================== ---- nss.orig/lib/ssl/sslsock.c -+++ nss/lib/ssl/sslsock.c -@@ -86,7 +86,7 @@ static sslOptions ssl_defaults = { - .enableSignedCertTimestamps = PR_FALSE, - .requireDHENamedGroups = PR_FALSE, - .enable0RttData = PR_FALSE, -- .enableTls13CompatMode = PR_FALSE, -+ .enableTls13CompatMode = PR_TRUE, - .enableDtls13VersionCompat = PR_FALSE, - .enableDtlsShortHeader = PR_FALSE, - .enableHelloDowngradeCheck = PR_FALSE, +# HG changeset patch +# User Daiki Ueno +# Date 1603691171 -3600 +# Mon Oct 26 06:46:11 2020 +0100 +# Node ID b03a4fc5b902498414b02640dcb2717dfef9682f +# Parent 6f79a76958129dc09c353c288f115fd9a51ab7d4 +Bug 1672703, always tolerate the first CCS in TLS 1.3, r=mt + +Summary: +This flips the meaning of the flag for checking excessive CCS +messages, so it only rejects multiple CCS messages while the first CCS +message is always accepted. + +Reviewers: mt + +Reviewed By: mt + +Bug #: 1672703 + +Differential Revision: https://phabricator.services.mozilla.com/D94603 + +diff -r 6f79a7695812 -r b03a4fc5b902 gtests/ssl_gtest/ssl_tls13compat_unittest.cc +--- a/gtests/ssl_gtest/ssl_tls13compat_unittest.cc Fri Oct 23 16:14:36 2020 -0700 ++++ b/gtests/ssl_gtest/ssl_tls13compat_unittest.cc Mon Oct 26 06:46:11 2020 +0100 +@@ -348,8 +348,8 @@ + client_->CheckErrorCode(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT); + } + +-// The server rejects a ChangeCipherSpec if the client advertises an +-// empty session ID. ++// The server accepts a ChangeCipherSpec even if the client advertises ++// an empty session ID. + TEST_F(TlsConnectStreamTls13, ChangeCipherSpecAfterClientHelloEmptySid) { + EnsureTlsSetup(); + ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3); +@@ -358,9 +358,8 @@ + client_->Handshake(); // Send ClientHello + client_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs))); // Send CCS + +- server_->ExpectSendAlert(kTlsAlertUnexpectedMessage); +- server_->Handshake(); // Consume ClientHello and CCS +- server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER); ++ Handshake(); ++ CheckConnected(); + } + + // The server rejects multiple ChangeCipherSpec even if the client +@@ -381,7 +380,7 @@ + server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER); + } + +-// The client rejects a ChangeCipherSpec if it advertises an empty ++// The client accepts a ChangeCipherSpec even if it advertises an empty + // session ID. + TEST_F(TlsConnectStreamTls13, ChangeCipherSpecAfterServerHelloEmptySid) { + EnsureTlsSetup(); +@@ -398,9 +397,10 @@ + // send ServerHello..CertificateVerify + // Send CCS + server_->SendDirect(DataBuffer(kCannedCcs, sizeof(kCannedCcs))); +- client_->ExpectSendAlert(kTlsAlertUnexpectedMessage); +- client_->Handshake(); // Consume ClientHello and CCS +- client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER); ++ ++ // No alert is sent from the client. As Finished is dropped, we ++ // can't use Handshake() and CheckConnected(). ++ client_->Handshake(); + } + + // The client rejects multiple ChangeCipherSpec in a row even if the +diff -r 6f79a7695812 -r b03a4fc5b902 lib/ssl/ssl3con.c +--- a/lib/ssl/ssl3con.c Fri Oct 23 16:14:36 2020 -0700 ++++ b/lib/ssl/ssl3con.c Mon Oct 26 06:46:11 2020 +0100 +@@ -6645,11 +6645,7 @@ + + /* TLS 1.3: We sent a session ID. The server's should match. */ + if (!IS_DTLS(ss) && (sentRealSid || sentFakeSid)) { +- if (sidMatch) { +- ss->ssl3.hs.allowCcs = PR_TRUE; +- return PR_TRUE; +- } +- return PR_FALSE; ++ return sidMatch; + } + + /* TLS 1.3 (no SID)/DTLS 1.3: The server shouldn't send a session ID. */ +@@ -8696,7 +8692,6 @@ + errCode = PORT_GetError(); + goto alert_loser; + } +- ss->ssl3.hs.allowCcs = PR_TRUE; + } + + /* TLS 1.3 requires that compression include only null. */ +@@ -13066,15 +13061,14 @@ + ss->ssl3.hs.ws != idle_handshake && + cText->buf->len == 1 && + cText->buf->buf[0] == change_cipher_spec_choice) { +- if (ss->ssl3.hs.allowCcs) { +- /* Ignore the first CCS. */ +- ss->ssl3.hs.allowCcs = PR_FALSE; ++ if (!ss->ssl3.hs.rejectCcs) { ++ /* Allow only the first CCS. */ ++ ss->ssl3.hs.rejectCcs = PR_TRUE; + return SECSuccess; +- } +- +- /* Compatibility mode is not negotiated. */ +- alert = unexpected_message; +- PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER); ++ } else { ++ alert = unexpected_message; ++ PORT_SetError(SSL_ERROR_RX_MALFORMED_CHANGE_CIPHER); ++ } + } + + if ((IS_DTLS(ss) && !dtls13_AeadLimitReached(spec)) || +diff -r 6f79a7695812 -r b03a4fc5b902 lib/ssl/sslimpl.h +--- a/lib/ssl/sslimpl.h Fri Oct 23 16:14:36 2020 -0700 ++++ b/lib/ssl/sslimpl.h Mon Oct 26 06:46:11 2020 +0100 +@@ -710,10 +710,7 @@ + * or received. */ + PRBool receivedCcs; /* A server received ChangeCipherSpec + * before the handshake started. */ +- PRBool allowCcs; /* A server allows ChangeCipherSpec +- * as the middlebox compatibility mode +- * is explicitly indicarted by +- * legacy_session_id in TLS 1.3 ClientHello. */ ++ PRBool rejectCcs; /* Excessive ChangeCipherSpecs are rejected. */ + PRBool clientCertRequested; /* True if CertificateRequest received. */ + PRBool endOfFlight; /* Processed a full flight (DTLS 1.3). */ + ssl3KEADef kea_def_mutable; /* Used to hold the writable kea_def diff --git a/nss.spec b/nss.spec index b05e407..637760d 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 3%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -877,6 +877,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Oct 26 2020 Daiki Ueno - 3.58.0-3 +- Revert the last change, always tolerate the first CCS in TLS 1.3 + * Thu Oct 22 2020 Daiki Ueno - 3.58.0-2 - Enable TLS 1.3 middlebox compatibility mode by default