diff --git a/.gitignore b/.gitignore index 2911bbd..43c0bc2 100644 --- a/.gitignore +++ b/.gitignore @@ -64,3 +64,15 @@ TestUser51.cert /nss-3.65.tar.gz /nss-3.67.tar.gz /nspr-4.31.tar.gz +/nss-3.69.tar.gz +/nspr-4.32.tar.gz +/nss-3.71.tar.gz +/nss-3.73.tar.gz +/nss-3.75.tar.gz +/nss-3.77.tar.gz +/nss-3.79.tar.gz +/nspr-4.34.tar.gz +/nss-3.81.tar.gz +/nss-3.83.tar.gz +/nspr-4.35.tar.gz +/nss-3.85.tar.gz diff --git a/nspr-gcc-atomics.patch b/nspr-gcc-atomics.patch index b94e840..20eaefa 100644 --- a/nspr-gcc-atomics.patch +++ b/nspr-gcc-atomics.patch @@ -1,12 +1,7 @@ -diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h ---- a/pr/include/md/_linux.h -+++ b/pr/include/md/_linux.h -@@ -82,53 +82,73 @@ - #define NO_DLOPEN_NULL - #endif - - #if defined(__FreeBSD_kernel__) || defined(__GNU__) - #define _PR_HAVE_SOCKADDR_LEN +diff -up ./pr/include/md/_linux.h.gcc-atomics ./pr/include/md/_linux.h +--- ./pr/include/md/_linux.h.gcc-atomics 2022-09-20 11:23:22.008942926 -0700 ++++ ./pr/include/md/_linux.h 2022-09-20 11:34:45.536751340 -0700 +@@ -105,6 +105,15 @@ #endif #if defined(__i386__) @@ -22,11 +17,7 @@ diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h #define _PR_HAVE_ATOMIC_OPS #define _MD_INIT_ATOMIC() extern PRInt32 _PR_x86_AtomicIncrement(PRInt32 *val); - #define _MD_ATOMIC_INCREMENT _PR_x86_AtomicIncrement - extern PRInt32 _PR_x86_AtomicDecrement(PRInt32 *val); - #define _MD_ATOMIC_DECREMENT _PR_x86_AtomicDecrement - extern PRInt32 _PR_x86_AtomicAdd(PRInt32 *ptr, PRInt32 val); - #define _MD_ATOMIC_ADD _PR_x86_AtomicAdd +@@ -116,6 +125,7 @@ extern PRInt32 _PR_x86_AtomicAdd(PRInt32 extern PRInt32 _PR_x86_AtomicSet(PRInt32 *val, PRInt32 newval); #define _MD_ATOMIC_SET _PR_x86_AtomicSet #endif @@ -34,15 +25,7 @@ diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h #if defined(__ia64__) #define _PR_HAVE_ATOMIC_OPS - #define _MD_INIT_ATOMIC() - extern PRInt32 _PR_ia64_AtomicIncrement(PRInt32 *val); - #define _MD_ATOMIC_INCREMENT _PR_ia64_AtomicIncrement - extern PRInt32 _PR_ia64_AtomicDecrement(PRInt32 *val); - #define _MD_ATOMIC_DECREMENT _PR_ia64_AtomicDecrement - extern PRInt32 _PR_ia64_AtomicAdd(PRInt32 *ptr, PRInt32 val); - #define _MD_ATOMIC_ADD _PR_ia64_AtomicAdd - extern PRInt32 _PR_ia64_AtomicSet(PRInt32 *val, PRInt32 newval); - #define _MD_ATOMIC_SET _PR_ia64_AtomicSet +@@ -131,6 +141,15 @@ extern PRInt32 _PR_ia64_AtomicSet(PRInt3 #endif #if defined(__x86_64__) @@ -58,20 +41,11 @@ diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h #define _PR_HAVE_ATOMIC_OPS #define _MD_INIT_ATOMIC() extern PRInt32 _PR_x86_64_AtomicIncrement(PRInt32 *val); - #define _MD_ATOMIC_INCREMENT _PR_x86_64_AtomicIncrement - extern PRInt32 _PR_x86_64_AtomicDecrement(PRInt32 *val); - #define _MD_ATOMIC_DECREMENT _PR_x86_64_AtomicDecrement - extern PRInt32 _PR_x86_64_AtomicAdd(PRInt32 *ptr, PRInt32 val); - #define _MD_ATOMIC_ADD _PR_x86_64_AtomicAdd +@@ -142,6 +161,7 @@ extern PRInt32 _PR_x86_64_AtomicAdd(PRIn extern PRInt32 _PR_x86_64_AtomicSet(PRInt32 *val, PRInt32 newval); #define _MD_ATOMIC_SET _PR_x86_64_AtomicSet #endif +#endif - #if defined(__or1k__) + #if defined(__loongarch__) #if defined(__GNUC__) - /* Use GCC built-in functions */ - #define _PR_HAVE_ATOMIC_OPS - #define _MD_INIT_ATOMIC() - #define _MD_ATOMIC_INCREMENT(ptr) __sync_add_and_fetch(ptr, 1) - #define _MD_ATOMIC_DECREMENT(ptr) __sync_sub_and_fetch(ptr, 1) diff --git a/nss-3.79-fix-client-cert-crash.patch b/nss-3.79-fix-client-cert-crash.patch new file mode 100644 index 0000000..5f80fdc --- /dev/null +++ b/nss-3.79-fix-client-cert-crash.patch @@ -0,0 +1,23 @@ +diff --git a/lib/ssl/authcert.c b/lib/ssl/authcert.c +--- a/lib/ssl/authcert.c ++++ b/lib/ssl/authcert.c +@@ -212,17 +212,17 @@ NSS_GetClientAuthData(void *arg, + pw_arg); + } else { + int nnames = 0; + char **names = ssl_DistNamesToStrings(caNames, &nnames); + rv = CERT_FilterCertListByCANames(certList, nnames, names, + certUsageSSLClient); + ssl_FreeDistNamesStrings(names, nnames); + } +- if ((rv != SECSuccess) || CERT_LIST_EMPTY(certList)) { ++ if ((rv != SECSuccess) || (certList && CERT_LIST_EMPTY(certList))) { + CERT_DestroyCertList(certList); + certList = NULL; + } + } + if (certList == NULL) { + /* no user certs meeting the nickname/usage requirements found */ + return SECFailure; + } + diff --git a/nss-fix-PayPal-upstream.patch b/nss-fix-PayPal-upstream.patch new file mode 100644 index 0000000..71e78cb --- /dev/null +++ b/nss-fix-PayPal-upstream.patch @@ -0,0 +1,42 @@ +diff --git a/tests/chains/chains.sh b/tests/chains/chains.sh +--- a/tests/chains/chains.sh ++++ b/tests/chains/chains.sh +@@ -917,7 +917,7 @@ + done + + VFY_OPTS_TNAME="${DB_OPT} ${ENGINE} ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${TRUST_OPT}" +- VFY_OPTS_ALL="${DB_OPT} ${ENGINE} -vv ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${VFY_CERTS} ${TRUST_OPT}" ++ VFY_OPTS_ALL="${DB_OPT} ${ENGINE} -vv ${VFY_TIME_OPT} ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${VFY_CERTS} ${TRUST_OPT}" + + TESTNAME="Verifying certificate(s) ${VFY_LIST} with flags ${VFY_OPTS_TNAME}" + echo "${SCRIPTNAME}: ${TESTNAME}" +@@ -1118,6 +1118,7 @@ + ;; + "verify") + VERIFY="${VALUE}" ++ VFY_TIME_OPT= + TRUST= + TRUST_AND_DB= + POLICY= +@@ -1126,6 +1127,9 @@ + REV_OPTS= + USAGE_OPT= + ;; ++ "at_time") ++ VFY_TIME_OPT="-b ${VALUE}" ++ ;; + "cert") + VERIFY="${VERIFY} ${VALUE}" + ;; +diff --git a/tests/chains/scenarios/realcerts.cfg b/tests/chains/scenarios/realcerts.cfg +--- a/tests/chains/scenarios/realcerts.cfg ++++ b/tests/chains/scenarios/realcerts.cfg +@@ -22,6 +22,7 @@ + + verify PayPalEE:x + policy OID.2.16.840.1.114412.2.1 ++ at_time 2201010000Z + result pass + + verify BrAirWaysBadSig:x + diff --git a/nss.spec b/nss.spec index e7834f9..87a4152 100644 --- a/nss.spec +++ b/nss.spec @@ -1,13 +1,13 @@ -%global nspr_version 4.31.0 -%global nss_version 3.67.0 +%global nspr_version 4.35.0 +%global nss_version 3.85.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only -%global baserelease 4 +%global baserelease 1 %global nss_release %baserelease -# use %global nspr_release %[%baserelease+n] to handle offsets when +# use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %baserelease +%global nspr_release %[%baserelease+1] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -115,8 +115,6 @@ Source28: nss-p11-kit.config Source100: nspr-%{nspr_archive_version}.tar.gz Source101: nspr-config.xml -# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=617723 -Patch2: nss-539183.patch # This patch uses the GCC -iquote option documented at # http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options # to give the in-tree headers a higher priority over the system headers, @@ -130,9 +128,11 @@ Patch2: nss-539183.patch # but it doesn't hurt to keep it. Patch4: iquote.patch Patch12: nss-signtool-format.patch -Patch30: nss-fedora-btrf-sql-hack.patch # fedora disabled dbm by default Patch40: nss-no-dbm-man-page.patch + +# upstream bug https://bugzilla.mozilla.org/show_bug.cgi?id=1774654 +Patch50: nss-3.79-fix-client-cert-crash.patch Patch100: nspr-config-pc.patch Patch101: nspr-gcc-atomics.patch @@ -353,7 +353,7 @@ popd # Build NSS # # This package fails its testsuite with LTO. Disable LTO for now -%global _lto_cflags %{nil} +#%global _lto_cflags %{nil} #export FREEBL_NO_DEPEND=1 @@ -395,6 +395,7 @@ export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1 export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 export NSPR_INCLUDE_DIR=$PWD/dist/include/nspr +export NSPR_LIB_DIR=$PWD/dist/lib export NSS_USE_SYSTEM_SQLITE=1 @@ -419,6 +420,7 @@ export POLICY_FILE="nss.config" # location of the policy file export POLICY_PATH="/etc/crypto-policies/back-ends" + %{__make} -C ./nss all %{__make} -C ./nss latest @@ -562,6 +564,15 @@ export USE_64=1 # End -- copied from the build section +# copy the nspr libraries into the NSS object directory so we use the +# newly compiled nspr binaries in our test rather than the build root +# versions +export LOBJDIR=`make -s -C ./nss/tests/common objdir_name` +for i in ./dist/lib/*.so +do + cp $i ./dist/${LOBJDIR}/lib +done + # This is necessary because the test suite tests algorithms that are # disabled by the system policy. export NSS_IGNORE_SYSTEM_POLICY=1 @@ -585,9 +596,9 @@ if [ $SPACEISBAD -ne 0 ]; then echo "error: filenames containing space are not supported (xargs)" exit 1 fi -MYRAND=`perl -e 'print 9000 + int rand 1000'`; echo $MYRAND ||: -RANDSERV=selfserv_${MYRAND}; echo $RANDSERV ||: -DISTBINDIR=`ls -d ./dist/*.OBJ/bin`; echo $DISTBINDIR ||: +export MYRAND=`perl -e 'print 9000 + int rand 1000'`; echo $MYRAND +export RANDSERV=selfserv_${MYRAND}; echo $RANDSERV +export DISTBINDIR=./dist/${LOBJDIR}/bin pushd "$DISTBINDIR" ln -s selfserv $RANDSERV popd @@ -646,6 +657,25 @@ for f in nspr-config; do done popd +# Begin -- copied from the build section +# this is needed to make sure LOBJDIR is correct + +export FREEBL_NO_DEPEND=1 + +export BUILD_OPT=1 +export NSS_DISABLE_PPC_GHASH=1 + +%ifnarch noarch +%if 0%{__isa_bits} == 64 +export USE_64=1 +%endif +%endif + +# End -- copied from the build section + +# get the objdir value from the test make file +export LOBJDIR=`make -s -C ./nss/tests/common objdir_name` + # There is no make install target so we'll do it ourselves. mkdir -p $RPM_BUILD_ROOT/%{_includedir}/nss3 @@ -674,7 +704,7 @@ mkdir -p $RPM_BUILD_ROOT%{_mandir}/man5 # Copy the binary libraries we want for file in libnssutil3.so libsoftokn3.so %{?with_dbm:libnssdbm3.so} libfreebl3.so libfreeblpriv3.so libnss3.so libnsssysinit.so libsmime3.so libssl3.so do - install -p -m 755 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir} + install -p -m 755 dist/${LOBJDIR}/lib/$file $RPM_BUILD_ROOT/%{_libdir} done # Install the empty NSS db files @@ -693,19 +723,19 @@ install -p -m 644 %{SOURCE15} $RPM_BUILD_ROOT/%{_sysconfdir}/pki/nssdb/pkcs11.tx # Copy the development libraries we want for file in libcrmf.a libnssb.a libnssckfw.a do - install -p -m 644 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir} + install -p -m 644 dist/${LOBJDIR}/lib/$file $RPM_BUILD_ROOT/%{_libdir} done # Copy the binaries we want for file in certutil cmsutil crlutil modutil nss-policy-check pk12util signver ssltap do - install -p -m 755 dist/*.OBJ/bin/$file $RPM_BUILD_ROOT/%{_bindir} + install -p -m 755 dist/${LOBJDIR}/bin/$file $RPM_BUILD_ROOT/%{_bindir} done # Copy the binaries we ship as unsupported for file in bltest ecperf fbectest fipstest shlibsign atob btoa derdump listsuites ocspclnt pp selfserv signtool strsclnt symkeyutil tstclnt vfyserv vfychain do - install -p -m 755 dist/*.OBJ/bin/$file $RPM_BUILD_ROOT/%{unsupported_tools_directory} + install -p -m 755 dist/${LOBJDIR}/bin/$file $RPM_BUILD_ROOT/%{unsupported_tools_directory} done # Copy the include files we want @@ -723,7 +753,7 @@ done # Copy the static freebl library for file in libfreebl.a do -install -p -m 644 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir} +install -p -m 644 dist/${LOBJDIR}/lib/$file $RPM_BUILD_ROOT/%{_libdir} done # Copy the template files we want @@ -1060,6 +1090,42 @@ update-crypto-policies &> /dev/null || : %changelog +* Thu Nov 17 2022 Bob Relyea - 3.85.0-1 + - update to NSS 3.85 + +* Tue Sep 20 2022 Bob Relyea - 3.83.0-1 + - update to NSS 3.83 + - update to NSPR 4.35 + +* Thu Jun 21 2022 Bob Relyea - 3.81.0-1 + - udpate to NSS 3.81 +- Fix crash when getting client cert and there is none in the database. + +* Tue May 31 2022 Bob Relyea - 3.79.0-1 +- Update to NSS 3.79 +- Update to NSPR 4.34 + +* Tue Apr 5 2022 Bob Relyea - 3.77.0-1 +- Update to 3.77 + +* Mon Feb 7 2022 Bob Relyea - 3.75.0-1 +- Update to 3.75 +- fix PayPal expiration issue + +* Wed Dec 1 2021 Bob Relyea - 3.73.0-1 +- Update to 3.73 +- includes CVE 2021-43527 + +* Mon Oct 4 2021 Bob Relyea - 3.71.0-1 +- Update to 3.71 + +* Tue Aug 10 2021 Bob Relyea - 3.69.0-2 +- turn on lto + +* Tue Aug 10 2021 Bob Relyea - 3.69.0-1 +- Update to 3.69 +- Update to NSPR 4.31 + * Tue Jul 27 2021 Bob Relyea - 3.67.0-4 - switch to baserelease so rpmdev-bumpspec will work next time diff --git a/sources b/sources index 1dae6c2..c9d91e9 100644 --- a/sources +++ b/sources @@ -1,7 +1,4 @@ -SHA512 (blank-cert8.db) = ac131d15708c5f1b5e467831f919f4fc4ba13b60a4bb5fe260c845fa9afcd899a588d21ed52060abaa1bbb29f2b53af8b495d28407183cb03aff1974f95f1d3d SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 -SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.67.tar.gz) = 1d3fa3fafbf3e54c9c3b54b0b3c291aebb48542380a1b704fa07359d3cefab93f166b31928c9db190ed58118e289e67ce8aa1619e4219d69b2c098484a22bc9d -SHA512 (nspr-4.31.tar.gz) = 1f37d04721335288dd8a5cf700ead5a56cee73365e619f3da90f6067830b78a050a525950686bcdd14fcf61faffd1141ec46d4180a0dd10375f7e9fef6eac6ed +SHA512 (nss-3.85.tar.gz) = 97cfffa2beed1dba5d31e0c6e450553e5a8c78b427521640adb00c05d9d63cd64dc08388f0dbf96c93efb79f5daf4ba8db8d026b0b43d2e5c865a9b833fc77a1 +SHA512 (nspr-4.35.tar.gz) = 502815833116e25f79ddf71d1526484908aa92fbc55f8a892729cb404a4daafcc0470a89854cd080d2d20299fdb7d9662507c5362c7ae661cbacf308ac56ef7f