Update NSS to 3.48

CHANGES_UNRELEASED.md

@@ -2,12 +2,16 @@
 
 # Unreleased Changes
 
+## General
+
+- Updated NSS to version 3.48. ([#2379](https://github.com/mozilla/application-services/issues/2379))
+
 ## Logins
 
 ### Breaking Changes
 
-- `LoginsStorage.getByHostname` has been removed ([#2152](https://github.com/mozilla/application-services/issues/2152)
+- `LoginsStorage.getByHostname` has been removed ([#2152](https://github.com/mozilla/application-services/issues/2152))
 
 ### What's new
 
-- `LoginsStorage.getByBaseDomain` has been added ([#2152](https://github.com/mozilla/application-services/issues/2152)
+- `LoginsStorage.getByBaseDomain` has been added ([#2152](https://github.com/mozilla/application-services/issues/2152))

components/support/rc_crypto/src/hkdf.rs

@@ -50,10 +50,6 @@ mod tests {
     use crate::digest;
     use hex;
 
-    // NSS limits the size of derived key material to 576 bytes due to fixed-size `key_block` buffer here:
-    // https://dxr.mozilla.org/mozilla-central/rev/3c0f78074b727fbae112b6eda111d4c4d30cc3ec/security/nss/lib/softoken/pkcs11c.c#7758
-    const NSS_MAX_DERIVED_KEY_MATERIAL: usize = 576;
-
     #[test]
     fn hkdf_produces_correct_result() {
         let secret = hex::decode("0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b").unwrap();
@@ -98,7 +94,7 @@ mod tests {
     #[test]
     fn hkdf_rejects_gigantic_output_buffers() {
         let salt = hmac::SigningKey::new(&digest::SHA256, b"salt");
-        let mut out = vec![0u8; NSS_MAX_DERIVED_KEY_MATERIAL + 1];
+        let mut out = vec![0u8; 8160 + 1]; // RFC maximum (hashlen * 255) + 1
         assert!(extract_and_expand(&salt, b"secret", b"info", &mut out).is_err());
     }
 

libs/build-all.sh

@@ -5,10 +5,10 @@ set -euvx
 # SQLCIPHER_VERSION="4.1.0"
 # SQLCIPHER_SHA256="65144ca3ba4c0f9cd4bae8c20bb42f2b84424bf29d1ebcf04c44a728903b1faa"
 
-NSS="nss-3.46"
-NSS_ARCHIVE="nss-3.46-with-nspr-4.22.tar.gz"
-NSS_URL="http://ftp.mozilla.org/pub/security/nss/releases/NSS_3_46_RTM/src/${NSS_ARCHIVE}"
-NSS_SHA256="3d4197196e870ab2dccc6ee497e0ec83f45ea070fee929dd931491c024d69f31"
+NSS="nss-3.48"
+NSS_ARCHIVE="nss-3.48-with-nspr-4.24.tar.gz"
+NSS_URL="http://ftp.mozilla.org/pub/security/nss/releases/NSS_3_48_RTM/src/${NSS_ARCHIVE}"
+NSS_SHA256="a97f96d81c77954fd7aba7ab7310b2e9ab066347bc604c3c5174877113c47f4c"
 
 # End of configuration.
 
@@ -80,13 +80,15 @@ echo $'\
 diff -r 65efa74ef84a coreconf/config.gypi
 --- a/coreconf/config.gypi      Thu May 16 09:43:04 2019 +0000
 +++ b/coreconf/config.gypi      Thu May 23 19:46:44 2019 -0400
-@@ -138,6 +138,21 @@
+@@ -138,6 +138,23 @@
        \'<(nspr_include_dir)\',
        \'<(nss_dist_dir)/private/<(module)\',
      ],
 +    \'defines\': [
 +      \'HMAC_Update=NSS_HMAC_Update\',
 +      \'HMAC_Init=NSS_HMAC_Init\',
++      \'CMAC_Update=NSS_CMAC_Update\',
++      \'CMAC_Init=NSS_CMAC_Init\',
 +      \'MD5_Update=NSS_MD5_Update\',
 +      \'SHA1_Update=NSS_SHA1_Update\',
 +      \'SHA256_Update=NSS_SHA256_Update\',