2012-10-01 22:02:15 +04:00
|
|
|
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
|
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
|
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
2008-06-06 16:40:11 +04:00
|
|
|
#ifndef _PK11PRIV_H_
|
|
|
|
|
#define _PK11PRIV_H_
|
Bug 1642687 - land NSS cbf75aedf480 UPGRADE_NSS_RELEASE, r=jcj
2020-06-12 Kevin Jacobs <kjacobs@mozilla.com>
* cmd/lib/secutil.c:
Bug 1645479 - Use SECITEM_CopyItem instead of SECITEM_MakeItem in
secutil.c. r=jcj
This patch converts a call to `SECITEM_MakeItem` to use
`SECITEM_CopyItem` instead. Using the former works fine in NSS CI,
but causes build failures in mozilla-central due to differences in
how both symbols are exported (i.e. when folding nssutil into nss).
[cbf75aedf480] [tip]
2020-06-11 Kevin Jacobs <kjacobs@mozilla.com>
* gtests/ssl_gtest/libssl_internals.c,
gtests/ssl_gtest/ssl_resumption_unittest.cc:
Bug 1644774 - Use ClearServerCache instead of
SSLInt_ClearSelfEncryptKey for ticket invalidation. r=mt
[7b2413d80ce3]
2020-06-10 Kevin Jacobs <kjacobs@mozilla.com>
* cmd/lib/basicutil.c, cmd/lib/secutil.c, cmd/lib/secutil.h,
cmd/selfserv/selfserv.c, cmd/tstclnt/tstclnt.c, lib/ssl/tls13psk.c:
Bug 1603042 - Support external PSKs in tstclnt/selfserv. r=jcj
This patch adds support for TLS 1.3 external PSKs in tstclnt and
selfserv with the `-z` option.
Command examples:
- `selfserv -D -p 4443 -d . -n localhost.localdomain -w nss -V tls1.3:
-H 1 -z 0xAAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD[:label] -m`
- `tstclnt -h 127.0.0.1 -p 4443 -z
0xAAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD[:label] -d . -w nss`
For OpenSSL interop:
- `openssl s_server -nocert -port 4433 -psk
AAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD [-psk_identity label]`
Note: If the optional label is omitted, both NSS tools and OpenSSL
default to "Client_identity".
[c1b1112af415]
2020-06-09 Kevin Jacobs <kjacobs@mozilla.com>
* lib/ssl/tls13con.c:
Bug 1642638 - Don't assert sid ciphersuite to be defined in fuzzer
mode. r=mt
[238bd7912429]
2020-06-08 Kevin Jacobs <kjacobs@mozilla.com>
* lib/freebl/freebl.gyp, lib/freebl/freebl_base.gypi:
Bug 1642802 - Win64 GYP builds to use HACL* curve25519.
r=bbeurdouche
This patch causes Windows 64-bit GYP builds to use HACL* curve25519
rather than the 32-bit (fiat-crypto) implementation.
For non-clang/GCC Win64 builds, we define `KRML_VERIFIED_UINT128` to
workaround an upstream bug that breaks Win32 builds by selecting a
64-bit `__int128` implementation (in types.h).
For clang/GCC builds, using the compiler-provided type yields a ~5x
speedup on Win64.
[566fa62d6522]
2020-06-05 Jeff Walden <jwalden@mit.edu>
* lib/pk11wrap/pk11cert.c, lib/pk11wrap/pk11kea.c,
lib/pk11wrap/pk11merge.c, lib/pk11wrap/pk11nobj.c,
lib/pk11wrap/pk11obj.c, lib/pk11wrap/pk11skey.c,
lib/pk11wrap/secmodi.h:
Bug 1643557 - Make pk11_FindObjectByTemplate accept a size_t count
rather than a signed type to avoid internal signed-unsigned
comparison warnings. r=kjacobs
Depends on D78454
[5ee293d1a282]
* lib/pk11wrap/pk11skey.c:
Bug 1643557 - Make PK11_SetWrapKey explicitly handle being passed a
negative wrap argument, to avoid a signed-unsigned comparison.
r=kjacobs
Depends on D78453
[7bb3677a2ed0]
* lib/pk11wrap/pk11akey.c, lib/pk11wrap/pk11cert.c,
lib/pk11wrap/pk11obj.c, lib/pk11wrap/secmodi.h:
Bug 1643557 - Change the type of the size argument to
pk11_FindObjectsByTemplate to be size_t, consistent with the type of
some (small) numeric values passed to it after the previous
revision. r=kjacobs
Depends on D78452
[eaf223c2646a]
* lib/pk11wrap/pk11slot.c:
Bug 1643557 - Use size_t for various counts in pk11slot.c. r=kjacobs
Depends on D78451
[465a7954ce0a]
* lib/pk11wrap/pk11priv.h, lib/pk11wrap/pk11slot.c:
Bug 1643557 - Make pk11_MatchString accept a size_t length rather
than an int length (consistent with all callers), and reformulate
its internals to avoid a signed-unsigned comparison. r=kjacobs
Depends on D78450
[fff8c883ef7d]
* lib/pk11wrap/pk11skey.c, lib/ssl/sslsnce.c, lib/util/secport.h:
Bug 1643557 - Add PORT_AssertNotReached and use it instead of
PORT_Assert(!"str"), which may warn about vacuous string literal to
boolean conversions. r=kjacobs
Depends on D78449
[c0aa47eb2fdd]
* lib/util/secoid.c:
Bug 1643557 - Use SECOidTag as the type of a loop variable over all
values of that type to avoid a signed-unsigned comparison warning.
r=kjacobs
Depends on D78448
[d7f1e9975e67]
* lib/util/utilpars.c:
Bug 1643557 - Use size_t for a parameter-indexing variable to
eliminate a signed-unsigned comparison warning. r=kjacobs
Depends on D78447
[5d7206908ca7]
* lib/freebl/rsapkcs.c:
Bug 1643557 - Used unsigned int for two for-loops upper-bounded by
unsigned ints in rsa_FormatOneBlock. r=kjacobs
Depends on D78446
[ed9a1a41ca1e]
* lib/pk11wrap/debug_module.c:
Bug 1643557 - Use unsigned int for log level, consistent with
PRLogModuleLevel. r=kjacobs
[7f89fa701ce3]
Differential Revision: https://phabricator.services.mozilla.com/D79566
2020-06-13 02:42:37 +03:00
|
|
|
|
|
|
|
|
#include <stddef.h>
|
|
|
|
|
|
2008-06-06 16:40:11 +04:00
|
|
|
#include "plarena.h"
|
|
|
|
|
#include "seccomon.h"
|
|
|
|
|
#include "secoidt.h"
|
|
|
|
|
#include "secdert.h"
|
2018-09-19 19:43:03 +03:00
|
|
|
#include "keythi.h"
|
2008-06-06 16:40:11 +04:00
|
|
|
#include "certt.h"
|
|
|
|
|
#include "pkcs11t.h"
|
|
|
|
|
#include "secmodt.h"
|
|
|
|
|
#include "seccomon.h"
|
|
|
|
|
#include "pkcs7t.h"
|
|
|
|
|
#include "cmsreclist.h"
|
2017-05-16 18:12:24 +03:00
|
|
|
#include "pkcs11uri.h"
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* These are the private NSS functions. They are not exported by nss.def, and
|
2016-11-02 12:29:58 +03:00
|
|
|
* are not callable outside nss3.dll.
|
2008-06-06 16:40:11 +04:00
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
SEC_BEGIN_PROTOS
|
|
|
|
|
|
|
|
|
|
/************************************************************
|
|
|
|
|
* Generic Slot Lists Management
|
|
|
|
|
************************************************************/
|
2016-11-02 12:29:58 +03:00
|
|
|
PK11SlotList *PK11_NewSlotList(void);
|
|
|
|
|
PK11SlotList *PK11_GetPrivateKeyTokens(CK_MECHANISM_TYPE type,
|
|
|
|
|
PRBool needRW, void *wincx);
|
|
|
|
|
SECStatus PK11_AddSlotToList(PK11SlotList *list, PK11SlotInfo *slot, PRBool sorted);
|
|
|
|
|
SECStatus PK11_DeleteSlotFromList(PK11SlotList *list, PK11SlotListElement *le);
|
2008-06-06 16:40:11 +04:00
|
|
|
PK11SlotListElement *PK11_FindSlotElement(PK11SlotList *list,
|
2016-11-02 12:29:58 +03:00
|
|
|
PK11SlotInfo *slot);
|
2008-06-06 16:40:11 +04:00
|
|
|
PK11SlotInfo *PK11_FindSlotBySerial(char *serial);
|
|
|
|
|
int PK11_GetMaxKeyLength(CK_MECHANISM_TYPE type);
|
|
|
|
|
|
|
|
|
|
/************************************************************
|
|
|
|
|
* Generic Slot Management
|
|
|
|
|
************************************************************/
|
|
|
|
|
CK_OBJECT_HANDLE PK11_CopyKey(PK11SlotInfo *slot, CK_OBJECT_HANDLE srcObject);
|
2017-05-16 18:12:24 +03:00
|
|
|
PRBool pk11_MatchUriTokenInfo(PK11SlotInfo *slot, PK11URI *uri);
|
2008-06-06 16:40:11 +04:00
|
|
|
SECStatus PK11_ReadAttribute(PK11SlotInfo *slot, CK_OBJECT_HANDLE id,
|
2016-11-02 12:29:58 +03:00
|
|
|
CK_ATTRIBUTE_TYPE type, PLArenaPool *arena, SECItem *result);
|
2008-06-06 16:40:11 +04:00
|
|
|
CK_ULONG PK11_ReadULongAttribute(PK11SlotInfo *slot, CK_OBJECT_HANDLE id,
|
2016-11-02 12:29:58 +03:00
|
|
|
CK_ATTRIBUTE_TYPE type);
|
|
|
|
|
char *PK11_MakeString(PLArenaPool *arena, char *space, char *staticSring,
|
|
|
|
|
int stringLen);
|
2017-05-16 18:12:24 +03:00
|
|
|
PRBool pk11_MatchString(const char *string,
|
Bug 1642687 - land NSS cbf75aedf480 UPGRADE_NSS_RELEASE, r=jcj
2020-06-12 Kevin Jacobs <kjacobs@mozilla.com>
* cmd/lib/secutil.c:
Bug 1645479 - Use SECITEM_CopyItem instead of SECITEM_MakeItem in
secutil.c. r=jcj
This patch converts a call to `SECITEM_MakeItem` to use
`SECITEM_CopyItem` instead. Using the former works fine in NSS CI,
but causes build failures in mozilla-central due to differences in
how both symbols are exported (i.e. when folding nssutil into nss).
[cbf75aedf480] [tip]
2020-06-11 Kevin Jacobs <kjacobs@mozilla.com>
* gtests/ssl_gtest/libssl_internals.c,
gtests/ssl_gtest/ssl_resumption_unittest.cc:
Bug 1644774 - Use ClearServerCache instead of
SSLInt_ClearSelfEncryptKey for ticket invalidation. r=mt
[7b2413d80ce3]
2020-06-10 Kevin Jacobs <kjacobs@mozilla.com>
* cmd/lib/basicutil.c, cmd/lib/secutil.c, cmd/lib/secutil.h,
cmd/selfserv/selfserv.c, cmd/tstclnt/tstclnt.c, lib/ssl/tls13psk.c:
Bug 1603042 - Support external PSKs in tstclnt/selfserv. r=jcj
This patch adds support for TLS 1.3 external PSKs in tstclnt and
selfserv with the `-z` option.
Command examples:
- `selfserv -D -p 4443 -d . -n localhost.localdomain -w nss -V tls1.3:
-H 1 -z 0xAAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD[:label] -m`
- `tstclnt -h 127.0.0.1 -p 4443 -z
0xAAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD[:label] -d . -w nss`
For OpenSSL interop:
- `openssl s_server -nocert -port 4433 -psk
AAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD [-psk_identity label]`
Note: If the optional label is omitted, both NSS tools and OpenSSL
default to "Client_identity".
[c1b1112af415]
2020-06-09 Kevin Jacobs <kjacobs@mozilla.com>
* lib/ssl/tls13con.c:
Bug 1642638 - Don't assert sid ciphersuite to be defined in fuzzer
mode. r=mt
[238bd7912429]
2020-06-08 Kevin Jacobs <kjacobs@mozilla.com>
* lib/freebl/freebl.gyp, lib/freebl/freebl_base.gypi:
Bug 1642802 - Win64 GYP builds to use HACL* curve25519.
r=bbeurdouche
This patch causes Windows 64-bit GYP builds to use HACL* curve25519
rather than the 32-bit (fiat-crypto) implementation.
For non-clang/GCC Win64 builds, we define `KRML_VERIFIED_UINT128` to
workaround an upstream bug that breaks Win32 builds by selecting a
64-bit `__int128` implementation (in types.h).
For clang/GCC builds, using the compiler-provided type yields a ~5x
speedup on Win64.
[566fa62d6522]
2020-06-05 Jeff Walden <jwalden@mit.edu>
* lib/pk11wrap/pk11cert.c, lib/pk11wrap/pk11kea.c,
lib/pk11wrap/pk11merge.c, lib/pk11wrap/pk11nobj.c,
lib/pk11wrap/pk11obj.c, lib/pk11wrap/pk11skey.c,
lib/pk11wrap/secmodi.h:
Bug 1643557 - Make pk11_FindObjectByTemplate accept a size_t count
rather than a signed type to avoid internal signed-unsigned
comparison warnings. r=kjacobs
Depends on D78454
[5ee293d1a282]
* lib/pk11wrap/pk11skey.c:
Bug 1643557 - Make PK11_SetWrapKey explicitly handle being passed a
negative wrap argument, to avoid a signed-unsigned comparison.
r=kjacobs
Depends on D78453
[7bb3677a2ed0]
* lib/pk11wrap/pk11akey.c, lib/pk11wrap/pk11cert.c,
lib/pk11wrap/pk11obj.c, lib/pk11wrap/secmodi.h:
Bug 1643557 - Change the type of the size argument to
pk11_FindObjectsByTemplate to be size_t, consistent with the type of
some (small) numeric values passed to it after the previous
revision. r=kjacobs
Depends on D78452
[eaf223c2646a]
* lib/pk11wrap/pk11slot.c:
Bug 1643557 - Use size_t for various counts in pk11slot.c. r=kjacobs
Depends on D78451
[465a7954ce0a]
* lib/pk11wrap/pk11priv.h, lib/pk11wrap/pk11slot.c:
Bug 1643557 - Make pk11_MatchString accept a size_t length rather
than an int length (consistent with all callers), and reformulate
its internals to avoid a signed-unsigned comparison. r=kjacobs
Depends on D78450
[fff8c883ef7d]
* lib/pk11wrap/pk11skey.c, lib/ssl/sslsnce.c, lib/util/secport.h:
Bug 1643557 - Add PORT_AssertNotReached and use it instead of
PORT_Assert(!"str"), which may warn about vacuous string literal to
boolean conversions. r=kjacobs
Depends on D78449
[c0aa47eb2fdd]
* lib/util/secoid.c:
Bug 1643557 - Use SECOidTag as the type of a loop variable over all
values of that type to avoid a signed-unsigned comparison warning.
r=kjacobs
Depends on D78448
[d7f1e9975e67]
* lib/util/utilpars.c:
Bug 1643557 - Use size_t for a parameter-indexing variable to
eliminate a signed-unsigned comparison warning. r=kjacobs
Depends on D78447
[5d7206908ca7]
* lib/freebl/rsapkcs.c:
Bug 1643557 - Used unsigned int for two for-loops upper-bounded by
unsigned ints in rsa_FormatOneBlock. r=kjacobs
Depends on D78446
[ed9a1a41ca1e]
* lib/pk11wrap/debug_module.c:
Bug 1643557 - Use unsigned int for log level, consistent with
PRLogModuleLevel. r=kjacobs
[7f89fa701ce3]
Differential Revision: https://phabricator.services.mozilla.com/D79566
2020-06-13 02:42:37 +03:00
|
|
|
const char *staticString, size_t staticStringLen);
|
2008-06-06 16:40:11 +04:00
|
|
|
int PK11_MapError(CK_RV error);
|
|
|
|
|
CK_SESSION_HANDLE PK11_GetRWSession(PK11SlotInfo *slot);
|
2016-11-02 12:29:58 +03:00
|
|
|
void PK11_RestoreROSession(PK11SlotInfo *slot, CK_SESSION_HANDLE rwsession);
|
2008-06-06 16:40:11 +04:00
|
|
|
PRBool PK11_RWSessionHasLock(PK11SlotInfo *slot,
|
2016-11-02 12:29:58 +03:00
|
|
|
CK_SESSION_HANDLE session_handle);
|
2008-06-06 16:40:11 +04:00
|
|
|
PK11SlotInfo *PK11_NewSlotInfo(SECMODModule *mod);
|
|
|
|
|
void PK11_EnterSlotMonitor(PK11SlotInfo *);
|
|
|
|
|
void PK11_ExitSlotMonitor(PK11SlotInfo *);
|
|
|
|
|
void PK11_CleanKeyList(PK11SlotInfo *slot);
|
|
|
|
|
|
|
|
|
|
/************************************************************
|
|
|
|
|
* Slot Password Management
|
|
|
|
|
************************************************************/
|
2012-12-06 03:19:18 +04:00
|
|
|
SECStatus PK11_DoPassword(PK11SlotInfo *slot, CK_SESSION_HANDLE session,
|
2016-11-02 12:29:58 +03:00
|
|
|
PRBool loadCerts, void *wincx, PRBool alreadyLocked,
|
|
|
|
|
PRBool contextSpecific);
|
|
|
|
|
SECStatus PK11_VerifyPW(PK11SlotInfo *slot, char *pw);
|
|
|
|
|
void PK11_HandlePasswordCheck(PK11SlotInfo *slot, void *wincx);
|
2008-06-06 16:40:11 +04:00
|
|
|
void PK11_SetVerifyPasswordFunc(PK11VerifyPasswordFunc func);
|
|
|
|
|
void PK11_SetIsLoggedInFunc(PK11IsLoggedInFunc func);
|
|
|
|
|
|
|
|
|
|
/************************************************************
|
|
|
|
|
* Manage the built-In Slot Lists
|
|
|
|
|
************************************************************/
|
|
|
|
|
SECStatus PK11_InitSlotLists(void);
|
|
|
|
|
void PK11_DestroySlotLists(void);
|
|
|
|
|
PK11SlotList *PK11_GetSlotList(CK_MECHANISM_TYPE type);
|
|
|
|
|
void PK11_LoadSlotList(PK11SlotInfo *slot, PK11PreSlotInfo *psi, int count);
|
|
|
|
|
void PK11_ClearSlotList(PK11SlotInfo *slot);
|
|
|
|
|
|
|
|
|
|
/******************************************************************
|
|
|
|
|
* Slot initialization
|
|
|
|
|
******************************************************************/
|
|
|
|
|
SECStatus PK11_InitToken(PK11SlotInfo *slot, PRBool loadCerts);
|
2016-11-02 12:29:58 +03:00
|
|
|
void PK11_InitSlot(SECMODModule *mod, CK_SLOT_ID slotID, PK11SlotInfo *slot);
|
2008-06-06 16:40:11 +04:00
|
|
|
PRBool PK11_NeedPWInitForSlot(PK11SlotInfo *slot);
|
|
|
|
|
SECStatus PK11_ReadSlotCerts(PK11SlotInfo *slot);
|
2010-02-07 14:54:28 +03:00
|
|
|
void pk11_SetInternalKeySlot(PK11SlotInfo *slot);
|
2011-05-05 18:35:11 +04:00
|
|
|
PK11SlotInfo *pk11_SwapInternalKeySlot(PK11SlotInfo *slot);
|
|
|
|
|
void pk11_SetInternalKeySlotIfFirst(PK11SlotInfo *slot);
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
/*********************************************************************
|
|
|
|
|
* Mechanism Mapping functions
|
|
|
|
|
*********************************************************************/
|
|
|
|
|
void PK11_AddMechanismEntry(CK_MECHANISM_TYPE type, CK_KEY_TYPE key,
|
2016-11-02 12:29:58 +03:00
|
|
|
CK_MECHANISM_TYPE keygen, CK_MECHANISM_TYPE pad,
|
|
|
|
|
int ivLen, int blocksize);
|
2008-06-06 16:40:11 +04:00
|
|
|
CK_MECHANISM_TYPE PK11_GetKeyMechanism(CK_KEY_TYPE type);
|
|
|
|
|
CK_MECHANISM_TYPE PK11_GetKeyGenWithSize(CK_MECHANISM_TYPE type, int size);
|
Bug 1629594 - land NSS 50dcc34d470d UPGRADE_NSS_RELEASE, r=jcj
2020-04-13 Kevin Jacobs <kjacobs@mozilla.com>
* lib/pk11wrap/debug_module.c, lib/pk11wrap/pk11load.c:
Bug 1629105 - Update PKCS11 module debug logger for v3.0 r=rrelyea
Differential Revision:
https://phabricator.services.mozilla.com/D70582
[50dcc34d470d] [tip]
2020-04-07 Robert Relyea <rrelyea@redhat.com>
* lib/ckfw/builtins/testlib/Makefile:
Bug 1465613 Fix gmake issue create by the patch which adds ability
to distrust certificates issued after a certain date for a specified
root cert r=jcj
I've been trying to run down an issue I've been having, and I think
this bug is the source. Whenever I build ('gmake' build), I get the
following untracted files: ? lib/ckfw/builtins/testlib/anchor.o ?
lib/ckfw/builtins/testlib/bfind.o ?
lib/ckfw/builtins/testlib/binst.o ?
lib/ckfw/builtins/testlib/bobject.o ?
lib/ckfw/builtins/testlib/bsession.o ?
lib/ckfw/builtins/testlib/bslot.o ?
lib/ckfw/builtins/testlib/btoken.o ?
lib/ckfw/builtins/testlib/ckbiver.o ?
lib/ckfw/builtins/testlib/constants.o
This is because of the way lib/ckfw/builtins/testlib works, it uses
the sources from the directory below, and explicitly reference them
with ../{source_name}.c. The object file then becomes
lib/ckfw/builtins/testlib/{OBJDIR}/../{source_name}.o.
The simple fix would be to paper over the issue and just add these
to .hgignore, but that would break our ability to build multiple
platforms on a single source directory. I'll include a patch that
fixes this issue.
bob
Differential Revision:
https://phabricator.services.mozilla.com/D70077
[92058f185316]
2020-04-06 Robert Relyea <rrelyea@redhat.com>
* automation/abi-check/expected-report-libnss3.so.txt,
gtests/ssl_gtest/tls_hkdf_unittest.cc, lib/nss/nss.def,
lib/pk11wrap/pk11pub.h, lib/pk11wrap/pk11skey.c,
lib/ssl/sslprimitive.c, lib/ssl/tls13con.c, lib/ssl/tls13con.h,
lib/ssl/tls13hkdf.c, lib/ssl/tls13replay.c, tests/ssl/ssl.sh:
Bug 1561637 TLS 1.3 does not work in FIPS mode r=mt
Part 2 of 2
Use the official PKCS #11 HKDF mechanism to implement tls 1.3.
1) The new mechanism is a single derive mechanism, so we no longer
need to pick it based on the underlying hmac (Note, we still need to
know the underlying hmac, which is passed in as a mechanism
parameter).
2) Use the new keygen to generate CKK_HKDF keys rather than doing it
by hand with the random number generator (never was really the best
way of doing this).
3) modify tls13hkdf.c to use the new mechanisms: 1) Extract: use the
new key handle in the mechanism parameters to pass the salt when the
salt is a key handle. Extract: use the explicit NULL salt parameter
if for the hash len salt of zeros. 2) Expand: Expand is mostly a
helper function which takes a mechanism. For regular expand, the
mechanism is the normal _Derive, for the Raw version its the _Data
function. That creates a data object, which is extractable in FIPS
mode.
4) update slot handling in tls13hkdf.c: 1) we need to make sure that
the key and the salt key are in the same slot. Provide a PK11wrap
function to make that guarrentee (and use that function in
PK11_WrapKey, which already has to do the same function). 2) When
importing a 'data' key for the zero key case, make sure we import
into the salt key's slot. If there is no salt key, use
PK11_GetBestSlot() rather than PK11_GetInternal slot.
Differential Revision:
https://phabricator.services.mozilla.com/D69899
[3d2b1738e064]
2020-04-06 Kevin Jacobs <kjacobs@mozilla.com>
* gtests/common/testvectors/curve25519-vectors.h,
gtests/common/testvectors/p256ecdh-vectors.h,
gtests/common/testvectors/p384ecdh-vectors.h,
gtests/common/testvectors/p521ecdh-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha1_mgf1sha1-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha256_mgf1sha1-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha256_mgf1sha256-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha384_mgf1sha1-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha384_mgf1sha384-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha512_mgf1sha1-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha512_mgf1sha512-vectors.h,
gtests/common/testvectors/rsa_pkcs1_2048_test-vectors.h,
gtests/common/testvectors/rsa_pkcs1_3072_test-vectors.h,
gtests/common/testvectors/rsa_pkcs1_4096_test-vectors.h,
gtests/common/testvectors/rsa_pss_2048_sha1_mgf1_20-vectors.h,
gtests/common/testvectors/rsa_pss_2048_sha256_mgf1_0-vectors.h,
gtests/common/testvectors/rsa_pss_2048_sha256_mgf1_32-vectors.h,
gtests/common/testvectors/rsa_pss_3072_sha256_mgf1_32-vectors.h,
gtests/common/testvectors/rsa_pss_4096_sha256_mgf1_32-vectors.h,
gtests/common/testvectors/rsa_pss_4096_sha512_mgf1_32-vectors.h,
gtests/common/testvectors/rsa_pss_misc-vectors.h,
gtests/common/testvectors/rsa_signature-vectors.h,
gtests/common/testvectors/rsa_signature_2048_sha224-vectors.h,
gtests/common/testvectors/rsa_signature_2048_sha256-vectors.h,
gtests/common/testvectors/rsa_signature_2048_sha512-vectors.h,
gtests/common/testvectors/rsa_signature_3072_sha256-vectors.h,
gtests/common/testvectors/rsa_signature_3072_sha384-vectors.h,
gtests/common/testvectors/rsa_signature_3072_sha512-vectors.h,
gtests/common/testvectors/rsa_signature_4096_sha384-vectors.h,
gtests/common/testvectors/rsa_signature_4096_sha512-vectors.h,
gtests/common/testvectors_base/rsa_signature-vectors_base.txt,
gtests/common/testvectors_base/test-structs.h,
gtests/common/wycheproof/genTestVectors.py,
gtests/pk11_gtest/manifest.mn, gtests/pk11_gtest/pk11_gtest.gyp,
gtests/pk11_gtest/pk11_rsaencrypt_unittest.cc,
gtests/pk11_gtest/pk11_rsaoaep_unittest.cc,
gtests/pk11_gtest/pk11_rsapkcs1_unittest.cc,
gtests/pk11_gtest/pk11_rsapss_unittest.cc:
Bug 1612260 - Add Wycheproof vectors for RSA PKCS1 and PSS signing,
PKCS1 and OEAP decryption. r=bbeurdouche
This patch updates the Wycheproof script to build RSA test vectors
(covering PKCS1 decryption/verification, as well as PSS and OAEP)
and adds the appropriate test drivers.
Differential Revision:
https://phabricator.services.mozilla.com/D69847
[469fd8633757]
2020-04-01 Kevin Jacobs <kjacobs@mozilla.com>
* automation/taskcluster/docker-fuzz32/Dockerfile:
Bug 1626751 - Add apt-transport-https & apt-utils to fuzz32 docker
image r=jcj
We already install these packages on the image_builder image itself.
It seems they're now required on the fuzz32 image as well.
Differential Revision:
https://phabricator.services.mozilla.com/D69274
[c7a8195e3072]
2020-04-01 Giulio Benetti <giulio.benetti@benettiengineering.com>
* lib/freebl/Makefile:
Bug 1624864 - Don't force ARMv7 for gcm-arm32-neon r=jcj
[858209235972]
* coreconf/config.gypi, coreconf/config.mk, lib/freebl/Makefile,
lib/freebl/freebl.gyp, lib/freebl/gcm.c:
Bug 1620799 - Introduce NSS_DISABLE_ARM32_NEON r=jcj
Only some Arm32 supports neon, so let's introduce
NSS_DISABLE_ARM32_NEON to allow disabling Neon acceleration when
building for Arm32.
Signed-off-by: Giulio Benetti
<giulio.benetti@benettiengineering.com>
[b47b2c35aa64]
2020-04-01 Kevin Jacobs <kjacobs@mozilla.com>
* automation/abi-check/expected-report-libnss3.so.txt, automation/abi-
check/expected-report-libsoftokn3.so.txt, automation/abi-check
/expected-report-libssl3.so.txt:
Fixup ABI checks after libabigail update and Delegated Credentials
backport. r=me
[7f50f6ca7658]
2020-03-31 hajma <tropikhajma@gmail.com>
* coreconf/SunOS5.mk:
Bug 1625133 - Fix implicit declaration of function 'getopt' on SunOS
r=jcj
[744788dd18dc]
2020-03-30 Robert Relyea <rrelyea@redhat.com>
* automation/abi-check/expected-report-libnss3.so.txt,
gtests/pk11_gtest/pk11_hkdf_unittest.cc, lib/nss/nss.def,
lib/pk11wrap/pk11mech.c, lib/pk11wrap/pk11obj.c,
lib/pk11wrap/pk11pub.h, lib/softoken/pkcs11.c,
lib/softoken/pkcs11c.c:
Bug 1561637 TLS 1.3 does not work in FIPS mode
Patch 1 of 2. This patch updates softoken and helper functions with
the new PKCS #11 v3 HKDF, which handles all the correct key
management so that we can work in FIPS mode
1) Salts can be passed in as data, as and explicit NULL (which per
spec means a zero filled buffer of length of the underlying HMAC),
or through a key handle 2) A Data object can be used as a key
(explicitly allowed for this mechanism by the spec). 3) A special
mechansism produces a data object rather than a key, the latter
which can be exported. Softoken does not do the optional validation
on the pInfo to verify that the requested values are supposed to be
data rather than keys. Some other tokens may.
The old hkdf mechanism has been retained for compatibility (well
namely until patch 2 is created, tls is still using it). The hkdf
function has been broken off into it's own function rather than
inline in the derive function.
Note: because the base key and/or the export key could really be a
data object, our explicit handling of sensitive and extractable are
adjusted to take into account that those flags do not exist in data
objects.
Differential Revision:
https://phabricator.services.mozilla.com/D68940
[e0922aac5267]
2020-03-26 Hans Petter Jansson <hpj@cl.no>
* cmd/lowhashtest/lowhashtest.c:
Bug 1622555 - Fix lowhashtest argument parsing. r=kjacobs
[f3c5ab41c972]
2020-03-26 Benjamin Beurdouche <bbeurdouche@mozilla.com>
* lib/freebl/Makefile, lib/freebl/freebl.gyp:
Bug 1624377 - Replace freebl flag -msse4 by -msse4.1 -msse4.2 which
are supported by older compilers r=kjacobs
Differential Revision:
https://phabricator.services.mozilla.com/D68407
[16ee7cb36fff]
2020-03-26 Robert Relyea <rrelyea@redhat.com>
* gtests/ssl_gtest/libssl_internals.c, lib/pk11wrap/exports.gyp,
lib/pk11wrap/manifest.mn, lib/ssl/ssl3con.c, lib/ssl/sslprimitive.c,
lib/ssl/sslspec.h, lib/ssl/tls13con.c, lib/ssl/tls13con.h,
lib/ssl/tls13esni.c, lib/ssl/tls13exthandle.c:
Bug 1623374 Need to support the new PKCS #11 Message interface for
AES GCM and ChaCha Poly r=mt
Update ssl to use the new PK11_AEADOp() interface. 1. We restore the
use of PK11Context_Create() for AEAD operations. 2. AES GCM and
CHACHA/Poly specific functions are no longer needed as PK11_AEADOp()
handles all the mechanism specific processing. 3. TLS semantic
differences between the two algorithms is handled by their
parameters: 1. Nonce length is the length of the nonce counter. If
it's zero, then XOR_Counter is used (and the nonce length is the
sizeof(sslSequenceNumber)). 2. IV length is the full IV length -
nonce length. 3. TLS 1.3 always uses XOR_Counter. 4. The IV is
returned from the token in the encrypt case. Only in the explict
nonce case is it examined. (The code depends on the fact that the
count in the token will match sslSequenceNumber). I did have assert
code to verify this was happening for testing, but it's removed from
this patch it can be added back. 5. All the decrypt instances of
XOR_Counter IV creation have been colapsed into tls13_WriteNonce().
6. Even tough PK11_AEADOp returns and accepts the tag separately
(for encrypt and decrypt respectively). The SSL code still returns
the values as buffer||tag. 7. tls13_AEAD() has been enhanced so all
uses of AEAD outside of the TLS stream can use it instead of their
own wrapped version. It can handle streams (CreateContext()
tls13_AEAD() tls13_AEAD() DestroyContext()) or single shot
tls13_AEAD(context=NULL). In the later case, the keys for the single
shot operation should not be resued. 8. libssl_internals.c in the
gtests directory has been updated to handle advancing the internal
iv counter when we artifically advance the seqNum. Since we don't
have access to any token iv counter (including softoken), The code
switches to simulated message mode, and updates the simulated state
as appropriate. (obviously this is for testing only code as it
reaches into normally private data structures).
Differential Revision:
https://phabricator.services.mozilla.com/D68480
[e7c7f305078e]
2020-03-26 Robert Relyea <rrelyea@redhat.com>
* gtests/ssl_gtest/libssl_internals.c, lib/pk11wrap/exports.gyp,
lib/pk11wrap/manifest.mn, lib/ssl/ssl3con.c, lib/ssl/sslprimitive.c,
lib/ssl/sslspec.h, lib/ssl/tls13con.c, lib/ssl/tls13con.h,
lib/ssl/tls13esni.c, lib/ssl/tls13exthandle.c:
Bug 1623374 Need to support the new PKCS #11 Message interface for
AES GCM and ChaCha Poly r=mt
Update ssl to use the new PK11_AEADOp() interface. 1. We restore the
use of PK11Context_Create() for AEAD operations. 2. AES GCM and
CHACHA/Poly specific functions are no longer needed as PK11_AEADOp()
handles all the mechanism specific processing. 3. TLS semantic
differences between the two algorithms is handled by their
parameters: 1. Nonce length is the length of the nonce counter. If
it's zero, then XOR_Counter is used (and the nonce length is the
sizeof(sslSequenceNumber)). 2. IV length is the full IV length -
nonce length. 3. TLS 1.3 always uses XOR_Counter. 4. The IV is
returned from the token in the encrypt case. Only in the explict
nonce case is it examined. (The code depends on the fact that the
count in the token will match sslSequenceNumber). I did have assert
code to verify this was happening for testing, but it's removed from
this patch it can be added back. 5. All the decrypt instances of
XOR_Counter IV creation have been colapsed into tls13_WriteNonce().
6. Even tough PK11_AEADOp returns and accepts the tag separately
(for encrypt and decrypt respectively). The SSL code still returns
the values as buffer||tag. 7. tls13_AEAD() has been enhanced so all
uses of AEAD outside of the TLS stream can use it instead of their
own wrapped version. It can handle streams (CreateContext()
tls13_AEAD() tls13_AEAD() DestroyContext()) or single shot
tls13_AEAD(context=NULL). In the later case, the keys for the single
shot operation should not be resued. 8. libssl_internals.c in the
gtests directory has been updated to handle advancing the internal
iv counter when we artifically advance the seqNum. Since we don't
have access to any token iv counter (including softoken), The code
switches to simulated message mode, and updates the simulated state
as appropriate. (obviously this is for testing only code as it
reaches into normally private data structures).
Differential Revision:
https://phabricator.services.mozilla.com/D68480
[e7c7f305078e]
2020-03-23 Kevin Jacobs <kjacobs@mozilla.com>
* lib/softoken/pkcs11.c:
Bug 1624402 - Fix compilation error when NO_FORK_CHECK and
CHECK_FORK_* are defined r=rrelyea
Differential Revision:
https://phabricator.services.mozilla.com/D67911
[0225889e5292]
2020-03-23 Kevin Jacobs <kjacobs@mozilla.com>
* lib/util/pkcs11.h:
Bug 1624130 - Require CK_FUNCTION_LIST structs to be packed.
r=rrelyea
Differential Revision:
https://phabricator.services.mozilla.com/D67741
[7ab62d3d0445]
2020-03-19 Robert Relyea <rrelyea@redhat.com>
* automation/abi-check/expected-report-libnss3.so.txt,
gtests/pk11_gtest/pk11_aes_gcm_unittest.cc,
gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc,
lib/freebl/blapi.h, lib/freebl/blapii.h, lib/freebl/blapit.h,
lib/freebl/chacha20poly1305.c, lib/freebl/gcm.c, lib/freebl/gcm.h,
lib/freebl/intel-gcm-wrap.c, lib/freebl/intel-gcm.h,
lib/freebl/ldvector.c, lib/freebl/loader.c, lib/freebl/loader.h,
lib/freebl/rijndael.c, lib/freebl/rijndael.h, lib/nss/nss.def,
lib/pk11wrap/pk11cxt.c, lib/pk11wrap/pk11mech.c,
lib/pk11wrap/pk11priv.h, lib/pk11wrap/pk11pub.h,
lib/pk11wrap/pk11skey.c, lib/pk11wrap/pk11slot.c,
lib/pk11wrap/secmodti.h, lib/softoken/fipstokn.c,
lib/softoken/pkcs11.c, lib/softoken/pkcs11c.c,
lib/softoken/pkcs11i.h, lib/softoken/pkcs11u.c,
lib/softoken/sftkmessage.c, lib/util/pkcs11n.h, lib/util/pkcs11t.h,
lib/util/secport.h:
Bug 1623374 Need to support the new PKCS #11 Message interface for
AES GCM and ChaCha Poly
PKCS #11 defines a new interface for handling AEAD type ciphers that
allow multiple AEAD operations without repeating the key schedule.
It also allows tokens to keep track of the number of operations, and
generate IVs (depending on the cipher).
This patch: 1. implement those new functions in softoken. With the
addition of CKF_MESSAGE_* flags to various mechanism, we need to
strip them when using the version 2 API of softoken (since there are
no C_Message* function in version 2). For that we need a separate
C_GetMechanismInfo function. We use the same trick we used to have a
separate version function for the V2 interface. Also now that the
new message functions are in their own file, they still need access
to the common Session state processing functions. those have gone
from static to exported within softoken to accomidate that. Same
with sftk_MapDecryptError() (sftk_MapVerifyError() was also made
global, though nothing else is yet using it). Only
C_MessageEncrptInit(), C_EncryptMessage(), C_MessageEncryptFinal,
C_MessageDecryptInit(), C_DecryptMessage(), and
C_MessageDecryptFinal are implemented. C_EncryptMessageBegin(),
C_EncryptMessageNext(), C_DecryptMessageBegin(), and
C_DecryptMessageNext() are all part of the multi-part withing a
multi-part operation and are only necessary for things like S/MIME
(potentially). If we wanted to implement them, we would need more
functions exported from freebl (and initaead, updateaead, finalaead
for each mechanism type). 2. make those interfaces call aes_gcm and
chacha20_poly1503 (and make adjustments for those ciphers). For AES,
I added a new function AES_AEAD, which handles both encrypt and
decrypt. Internally, the gcm functions (both the generic gcm and the
intel gcm wrapper) had their init functions split into key
scheduling and counter mode/tag initialization. The latter is still
called from init, but the former is now for each update call. IV
generation is handled by a single function in gcm.c, and shared with
intel_gcm_wrapper.c Since the AES functions already know about the
underlying PKCS #11 mechanism parameters, the new AEAD functions
also parse the PKCS #11 GCM parameters. For Chacha/Poly new aead
update functions were created called ChaChaPoly1305_Encrypt and
ChaChaChaPoly1305_Decrypt. There was no Message specific
initialization in the existing chacha_init, so no changes were
needed there. The primary difference between _Encrypt/_Decrypt and
_Seal/_Open is the fact that the tag is put at the end of the
encrypted data buffer in the latter, and in a generic buffer in the
former. 3. create new pk11wrap interfaces that also squash the api
differences between the various mechanisms for aead (similiar to the
way we do it for CBC and ECB crypto today). To accomplish this I
added PK11_AEADOp() and PK11_AEADRawOp(). Both functions handle the
case where the token only supports the single shot interface, by
using the single short interface to simulate the Message interface.
The PK11_AEADOp() also smooths out the differences in the parameters
and symantics of the various mechanism so the application does not
need to worry about the PKCS #11 differences in the mechanism. Both
use contexts from the standard PK11_CreateContext(), so key
schedules are done once for each key rather than once for each
message. MESSAGE/AEAD operations are selected by adding the psuedo
attribute flag CKA_NSS_MESSAGE to the requested operation
(CKA_ENCRYPT, CKA_DECRYPT, CKA_SIGN, CKA_VERIFY). 4. write tests for
the new interfaces Tests were added to make sure the PK11_AEADRawOp
interface works, The single shot interface is used to test output of
the message interface we also use two test only functions to force
the connection to use the simulation interface, which is also
compared to the non-simulate inteface. The AES_GCM also tests
various IV generators.
Differential Revision:
https://phabricator.services.mozilla.com/D67552
[293ac3688ced]
2020-03-18 Kevin Jacobs <kjacobs@mozilla.com>
* lib/freebl/mpi/mpcpucache.c:
Bug 1623184 - Clear ECX prior to cpuid, fixing query for Extended
Features r=bbeurdouche
While trying to benchmark the recent HACL* AVX2 code, I noticed that
it was not being called on two machines (that both support AVX2),
instead using only the AVX version.
In order to query for Extended Features (cpuid with EAX=7), we also
need to set ECX to 0: https://www.intel.com/content/www/us/en
/architecture-and-technology/64-ia-32-architectures-software-
developer-vol-2a-manual.html. The current code fails to do this,
resulting in flags that show no support.
Initially, I wrote a separate `freebl_cpuid_ex` function that
accepted a value for ECX as a separate input argument. However, some
definitions of `freebl_cpuid` already zero ECX, so making this
consistent is the simplest way to get the desired behavior.
With this patch, the two test machines (MacOS and Linux x64)
correctly use the AVX2 ChaCha20Poly1305 code.
Differential Revision:
https://phabricator.services.mozilla.com/D67235
[06d41fe87c58]
2020-03-17 Robert Relyea <rrelyea@redhat.com>
* automation/abi-check/expected-report-libnss3.so.txt, automation/abi-
check/expected-report-libsoftokn3.so.txt, cmd/pk11mode/pk11mode.c,
lib/pk11wrap/pk11load.c, lib/pk11wrap/secmodi.h,
lib/pk11wrap/secmodt.h, lib/softoken/fipstokn.c,
lib/softoken/manifest.mn, lib/softoken/pkcs11.c,
lib/softoken/pkcs11c.c, lib/softoken/pkcs11i.h,
lib/softoken/sftkmessage.c, lib/softoken/softoken.gyp,
lib/softoken/softoken.h, lib/softoken/softokn.def,
lib/util/pkcs11.h, lib/util/pkcs11f.h, lib/util/pkcs11n.h,
nss/automation/abi-check/new-report-libnss3.so.txt, nss/automation
/abi-check/new-report-libsoftokn3.so.txt:
Bug 1603628 Update NSS to handle PKCS #11 v3.0 r=ueno r=mt
Update to PKCS #11 v3.0 part 2.
Create the functions and switch to the C_Interface() function to
fetch the PKCS #11 function table. Also PKCS #11 v3.0 uses a new
fork safe interface. NSS can already handle the case if the PKCS #11
module happens to be fork safe (when asked by the application to
refresh the tokens in the child process, NSS can detect that such a
refresh is not necessary and continue. Softoken could also be put in
fork_safe mode with an environment variable. With this patch it's
the default, and NSS asks for the fork safe API by default.
Technically softoken should implement the old non-fork safe
interface when PKCS #11 v2.0 is called, but NSS no longer needs it,
and doing so would double the number of PKCS #11 interfaces are
needed. You can still compile with fork unsafe semantics, and the
PKCS #11 V3.0 module will do the right thing and not include the
fork safe flag. Firefox does not fork(), so for firefox this is
simply code that is no longer compilied.
We now use C_GetInterface, which allows us to specify what kind of
interface we want (PKCS #11 v3.0, PKCS #11 v2.0, fork safe, etc.).
Vendor specific functions can now be accessed through the
C_GetInterface. If the C_GetInterface function does not exists, we
fall bak to the old C_GetFunctionList.
There are 24 new functions in PKCS #11 v3.0: C_GetInterfaceList -
return a table of all the supported interfaces C_GetInterface -
return a specific interface. You can specify interface name, version
and flags separately. You can leave off any of these and you will
get what the token thinks is the best match of the interfaces that
meet the criteria. We do this in softoken by the order of the
interface list. C_SessionCancel - Cancel one or more multipart
operation C_LoginUser - Supply a user name to C_Login(). This
function has no meaning for softoken, so it just returns
CKR_OPERATION_NOT_INITIALIZED under the theory that if we in the
future want to support usernames, the NSS db would need special
initialization to make that happen. C_Message* and C_*Message* (20
functions in all) are the new AEAD interface (they are written
generally so that it can be used for things other than AEAD). In
this patch they are unimplemented (see the next patch).
This patch adds regular (NSC_) and FIPS (FC_) versions of these
functions. Also when creating the PKCS #11 v2.0 interface, we had to
create a 2.0 specific version of C_GetInfo so that it can return a
2.40 in the CK_VERSION field rather than 3.00. We do this with
#defines since all the function tables are generated automagically
with pkcs11f.h.
Differential Revision:
https://phabricator.services.mozilla.com/D67240
[2364598f8a36]
2020-03-09 Benjamin Beurdouche <bbeurdouche@mozilla.com>
* automation/taskcluster/scripts/run_hacl.sh,
lib/freebl/verified/Hacl_Poly1305_128.c,
lib/freebl/verified/Hacl_Poly1305_256.c:
Bug 1612493 - Fix Firefox build for Windows 2012 x64. r=kjacobs
Differential Revision:
https://phabricator.services.mozilla.com/D65945
[7e09cdab32d0]
2020-03-02 Kurt Miller <kurt@intricatesoftware.com>
* lib/freebl/blinit.c:
Bug 1618400 - Fix unused variable 'getauxval' on OpenBSD/arm64 r=jcj
https://bugzilla.mozilla.org/show_bug.cgi?id=1618400
[2c989888dee7]
2020-03-02 Giulio Benetti <giulio.benetti@benettiengineering.com>
* lib/freebl/blinit.c:
Bug 1614183 - Check if PPC __has_include(<sys/auxv.h>). r=kjacobs
Some build environment doesn't provide <sys/auxv.h> and this causes
build failure, so let's check if that header exists by using
__has_include() helper.
Signed-off-by: Giulio Benetti
<giulio.benetti@benettiengineering.com>
[bb7c46049f26]
2020-02-28 Benjamin Beurdouche <bbeurdouche@mozilla.com>
* automation/taskcluster/scripts/run_hacl.sh,
lib/freebl/verified/Hacl_Chacha20.c,
lib/freebl/verified/Hacl_Chacha20Poly1305_128.c,
lib/freebl/verified/Hacl_Chacha20Poly1305_32.c,
lib/freebl/verified/Hacl_Chacha20_Vec128.c,
lib/freebl/verified/Hacl_Curve25519_51.c,
lib/freebl/verified/Hacl_Kremlib.h,
lib/freebl/verified/Hacl_Poly1305_128.c,
lib/freebl/verified/Hacl_Poly1305_32.c,
lib/freebl/verified/kremlin/include/kremlin/internal/types.h,
lib/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt128.h, li
b/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt128_Verifie
d.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt_8_1
6_32_64.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/LowStar_
Endianness.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar
_uint128_gcc64.h, lib/freebl/verified/libintvector.h:
Bug 1617533 - Update of HACL* after libintvector.h and coding style
changes. r=kjacobs
*** Bug 1617533 - Clang format
*** Bug 1617533 - Update HACL* commit for job in Taskcluster
*** Bug 1617533 - Update HACL* Kremlin code
Differential Revision:
https://phabricator.services.mozilla.com/D63829
[b6677ae9067e]
* automation/taskcluster/graph/src/extend.js, coreconf/arch.mk,
coreconf/config.mk, lib/freebl/Makefile, lib/freebl/blapii.h,
lib/freebl/blinit.c, lib/freebl/chacha20poly1305.c,
lib/freebl/freebl.gyp,
lib/freebl/verified/Hacl_Chacha20Poly1305_256.c,
lib/freebl/verified/Hacl_Chacha20Poly1305_256.h,
lib/freebl/verified/Hacl_Chacha20_Vec256.c,
lib/freebl/verified/Hacl_Chacha20_Vec256.h,
lib/freebl/verified/Hacl_Poly1305_256.c,
lib/freebl/verified/Hacl_Poly1305_256.h, nss-tool/hw-support.c:
Bug 1612493 - Support for HACL* AVX2 code for Chacha20, Poly1305 and
Chacha20Poly1305. r=kjacobs
*** Bug 1612493 - Import AVX2 code from HACL*
*** Bug 1612493 - Add CPU detection for AVX2, BMI1, BMI2, FMA, MOVBE
*** Bug 1612493 - New flag NSS_DISABLE_AVX2 for freebl/Makefile and
freebl.gyp
*** Bug 1612493 - Disable use of AVX2 on GCC 4.4 which doesn’t
support -mavx2
*** Bug 1612493 - Disable tests when the platform doesn't have
support for AVX2
Differential Revision:
https://phabricator.services.mozilla.com/D64718
[d5deac55f543]
2020-02-18 Robert Relyea <rrelyea@redhat.com>
* cmd/bltest/blapitest.c, cmd/fipstest/fipstest.c,
cmd/lib/pk11table.c, cmd/pk11gcmtest/pk11gcmtest.c,
cmd/shlibsign/shlibsign.c,
gtests/pk11_gtest/pk11_aes_gcm_unittest.cc,
gtests/pk11_gtest/pk11_cbc_unittest.cc, lib/certdb/crl.c,
lib/ckfw/dbm/db.c, lib/dev/devslot.c, lib/dev/devtoken.c,
lib/dev/devutil.c, lib/freebl/fipsfreebl.c, lib/freebl/gcm.c,
lib/freebl/intel-gcm-wrap.c, lib/pk11wrap/debug_module.c,
lib/pk11wrap/dev3hack.c, lib/pk11wrap/pk11akey.c,
lib/pk11wrap/pk11auth.c, lib/pk11wrap/pk11cert.c,
lib/pk11wrap/pk11err.c, lib/pk11wrap/pk11load.c,
lib/pk11wrap/pk11mech.c, lib/pk11wrap/pk11merge.c,
lib/pk11wrap/pk11nobj.c, lib/pk11wrap/pk11obj.c,
lib/pk11wrap/pk11pbe.c, lib/pk11wrap/pk11pk12.c,
lib/pk11wrap/pk11pqg.c, lib/pk11wrap/pk11skey.c,
lib/pk11wrap/pk11slot.c, lib/pk11wrap/pk11util.c, lib/pkcs12/p12d.c,
lib/pkcs12/p12e.c, lib/softoken/fipstokn.c,
lib/softoken/legacydb/lgattr.c, lib/softoken/legacydb/lgcreate.c,
lib/softoken/legacydb/lgfind.c, lib/softoken/legacydb/lginit.c,
lib/softoken/pkcs11.c, lib/softoken/pkcs11c.c,
lib/softoken/pkcs11u.c, lib/softoken/sdb.c, lib/softoken/sftkdb.c,
lib/softoken/sftkpwd.c, lib/ssl/ssl3con.c, lib/ssl/sslprimitive.c,
lib/ssl/tls13con.c, lib/util/pkcs11.h, lib/util/pkcs11f.h,
lib/util/pkcs11n.h, lib/util/pkcs11t.h, lib/util/secoid.c, nss-
tool/enc/enctool.cc:
Bug 1603628 Update NSS to handle PKCS #11 v3.0 r=daiki r=mhoye
https://phabricator.services.mozilla.com/D63241
This patch implements the first phase: updating the headers.
lib/util/pkcs11.h lib/util/pkcs11f.h lib/util/pkcs11t.h
Were updated using the released OASIS PKCS #11 v3.0 header files.
lib/util/pkcs11n.h was updated to finally deprecate all uses of
CK?_NETSCAPE_?.
A new define as added: NSS_PKCS11_2_0_COMPAT. If it's defined, the
small semantic changes (including the removal of deprecated defines)
between the NSS PKCS #11 v2 header file and the new PKCS #11 v3 are
reverted in favor of the PKCS #11 v2 definitions. This include the
removal of CK?_NETSCAPE_? in favor of CK?_NSS_?.
One notable change was caused by an inconsistancy between the spec
and the released headers in PKCS #11 v2.40. CK_GCM_PARAMS had an
extra field in the header that was not in the spec. OASIS considers
the header file to be normative, so PKCS #11 v3.0 resolved the issue
in favor of the header file definition. NSS had the spec definition,
so now there are 2 defines for this structure:
CK_NSS_GCM_PARAMS - the old nss define. Still used internally in
freebl. CK_GCM_PARAMS_V3 - the new define. CK_GCM_PARAMS - no longer
referenced in NSS itself. It's defined as CK_GCM_PARAMS_V3 if
NSS_PKCS11_2_0_COMPAT is *not* defined, and it's defined as
CKM_NSS_GCM_PARAMS if NSS_PKCS11_2_0_COMPAT is defined.
Softoken has been updated to accept either CK_NSS_GCM_PARAMS or
CK_GCM_PARAMS_V3. In a future patch NSS will be updated to use
CK_GCM_PARAMS_V3 and fall back to CK_NSS_GMC_PARAMS.
One other semantic difference between the 3.0 version of pkcs11f.h
and the version here: In the oasis version of the header, you must
define CK_PKCS11_2_0_ONLY to get just the PKCS #11 v2 defines. In
our version you must define CK_PKCS11_3 to get the PCKS #11 v3
defines.
Most of this patch is to handle changing the deprecated defines that
have been removed in PCKS #11 v3 from NSS.
Differential Revision:
https://phabricator.services.mozilla.com/D63241
[b5d90a7fe217]
Differential Revision: https://phabricator.services.mozilla.com/D70773
--HG--
extra : moz-landing-system : lando
2020-04-14 20:53:38 +03:00
|
|
|
PRBool PK11_DoesMechanismFlag(PK11SlotInfo *, CK_MECHANISM_TYPE type, CK_FLAGS flags);
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
/**********************************************************************
|
2016-11-02 12:29:58 +03:00
|
|
|
* Symetric, Public, and Private Keys
|
2008-06-06 16:40:11 +04:00
|
|
|
**********************************************************************/
|
|
|
|
|
/* Key Generation specialized for SDR (fixed DES3 key) */
|
|
|
|
|
PK11SymKey *PK11_GenDES3TokenKey(PK11SlotInfo *slot, SECItem *keyid, void *cx);
|
|
|
|
|
SECKEYPublicKey *PK11_ExtractPublicKey(PK11SlotInfo *slot, KeyType keyType,
|
2016-11-02 12:29:58 +03:00
|
|
|
CK_OBJECT_HANDLE id);
|
2008-06-06 16:40:11 +04:00
|
|
|
CK_OBJECT_HANDLE PK11_FindObjectForCert(CERTCertificate *cert,
|
2016-11-02 12:29:58 +03:00
|
|
|
void *wincx, PK11SlotInfo **pSlot);
|
|
|
|
|
PK11SymKey *pk11_CopyToSlot(PK11SlotInfo *slot, CK_MECHANISM_TYPE type,
|
|
|
|
|
CK_ATTRIBUTE_TYPE operation, PK11SymKey *symKey);
|
2017-05-16 18:12:24 +03:00
|
|
|
unsigned int pk11_GetPredefinedKeyLength(CK_KEY_TYPE keyType);
|
2019-06-07 20:51:08 +03:00
|
|
|
CK_OBJECT_HANDLE PK11_DerivePubKeyFromPrivKey(SECKEYPrivateKey *privKey);
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
/**********************************************************************
|
|
|
|
|
* Certs
|
|
|
|
|
**********************************************************************/
|
2016-11-02 12:29:58 +03:00
|
|
|
SECStatus PK11_TraversePrivateKeysInSlot(PK11SlotInfo *slot,
|
|
|
|
|
SECStatus (*callback)(SECKEYPrivateKey *, void *), void *arg);
|
|
|
|
|
SECKEYPrivateKey *PK11_FindPrivateKeyFromNickname(char *nickname, void *wincx);
|
|
|
|
|
CK_OBJECT_HANDLE *PK11_FindObjectsFromNickname(char *nickname,
|
|
|
|
|
PK11SlotInfo **slotptr, CK_OBJECT_CLASS objclass, int *returnCount,
|
|
|
|
|
void *wincx);
|
|
|
|
|
CK_OBJECT_HANDLE PK11_MatchItem(PK11SlotInfo *slot, CK_OBJECT_HANDLE peer,
|
|
|
|
|
CK_OBJECT_CLASS o_class);
|
2017-03-10 08:01:18 +03:00
|
|
|
CK_BBOOL pk11_HasAttributeSet_Lock(PK11SlotInfo *slot,
|
|
|
|
|
CK_OBJECT_HANDLE id,
|
|
|
|
|
CK_ATTRIBUTE_TYPE type,
|
|
|
|
|
PRBool haslock);
|
2016-11-02 12:29:58 +03:00
|
|
|
CK_RV PK11_GetAttributes(PLArenaPool *arena, PK11SlotInfo *slot,
|
|
|
|
|
CK_OBJECT_HANDLE obj, CK_ATTRIBUTE *attr, int count);
|
2008-06-06 16:40:11 +04:00
|
|
|
int PK11_NumberCertsForCertSubject(CERTCertificate *cert);
|
2016-11-02 12:29:58 +03:00
|
|
|
SECStatus PK11_TraverseCertsForSubject(CERTCertificate *cert,
|
|
|
|
|
SECStatus (*callback)(CERTCertificate *, void *), void *arg);
|
2008-06-06 16:40:11 +04:00
|
|
|
SECStatus PK11_GetKEAMatchedCerts(PK11SlotInfo *slot1,
|
2016-11-02 12:29:58 +03:00
|
|
|
PK11SlotInfo *slot2, CERTCertificate **cert1, CERTCertificate **cert2);
|
2008-06-06 16:40:11 +04:00
|
|
|
SECStatus PK11_TraverseCertsInSlot(PK11SlotInfo *slot,
|
2016-11-02 12:29:58 +03:00
|
|
|
SECStatus (*callback)(CERTCertificate *, void *), void *arg);
|
2008-06-06 16:40:11 +04:00
|
|
|
SECStatus PK11_LookupCrls(CERTCrlHeadNode *nodes, int type, void *wincx);
|
|
|
|
|
|
|
|
|
|
/**********************************************************************
|
|
|
|
|
* Crypto Contexts
|
|
|
|
|
**********************************************************************/
|
2016-11-02 12:29:58 +03:00
|
|
|
PK11Context *PK11_CreateContextByRawKey(PK11SlotInfo *slot,
|
|
|
|
|
CK_MECHANISM_TYPE type, PK11Origin origin, CK_ATTRIBUTE_TYPE operation,
|
|
|
|
|
SECItem *key, SECItem *param, void *wincx);
|
2008-06-06 16:40:11 +04:00
|
|
|
PRBool PK11_HashOK(SECOidTag hashAlg);
|
Bug 1629594 - land NSS 50dcc34d470d UPGRADE_NSS_RELEASE, r=jcj
2020-04-13 Kevin Jacobs <kjacobs@mozilla.com>
* lib/pk11wrap/debug_module.c, lib/pk11wrap/pk11load.c:
Bug 1629105 - Update PKCS11 module debug logger for v3.0 r=rrelyea
Differential Revision:
https://phabricator.services.mozilla.com/D70582
[50dcc34d470d] [tip]
2020-04-07 Robert Relyea <rrelyea@redhat.com>
* lib/ckfw/builtins/testlib/Makefile:
Bug 1465613 Fix gmake issue create by the patch which adds ability
to distrust certificates issued after a certain date for a specified
root cert r=jcj
I've been trying to run down an issue I've been having, and I think
this bug is the source. Whenever I build ('gmake' build), I get the
following untracted files: ? lib/ckfw/builtins/testlib/anchor.o ?
lib/ckfw/builtins/testlib/bfind.o ?
lib/ckfw/builtins/testlib/binst.o ?
lib/ckfw/builtins/testlib/bobject.o ?
lib/ckfw/builtins/testlib/bsession.o ?
lib/ckfw/builtins/testlib/bslot.o ?
lib/ckfw/builtins/testlib/btoken.o ?
lib/ckfw/builtins/testlib/ckbiver.o ?
lib/ckfw/builtins/testlib/constants.o
This is because of the way lib/ckfw/builtins/testlib works, it uses
the sources from the directory below, and explicitly reference them
with ../{source_name}.c. The object file then becomes
lib/ckfw/builtins/testlib/{OBJDIR}/../{source_name}.o.
The simple fix would be to paper over the issue and just add these
to .hgignore, but that would break our ability to build multiple
platforms on a single source directory. I'll include a patch that
fixes this issue.
bob
Differential Revision:
https://phabricator.services.mozilla.com/D70077
[92058f185316]
2020-04-06 Robert Relyea <rrelyea@redhat.com>
* automation/abi-check/expected-report-libnss3.so.txt,
gtests/ssl_gtest/tls_hkdf_unittest.cc, lib/nss/nss.def,
lib/pk11wrap/pk11pub.h, lib/pk11wrap/pk11skey.c,
lib/ssl/sslprimitive.c, lib/ssl/tls13con.c, lib/ssl/tls13con.h,
lib/ssl/tls13hkdf.c, lib/ssl/tls13replay.c, tests/ssl/ssl.sh:
Bug 1561637 TLS 1.3 does not work in FIPS mode r=mt
Part 2 of 2
Use the official PKCS #11 HKDF mechanism to implement tls 1.3.
1) The new mechanism is a single derive mechanism, so we no longer
need to pick it based on the underlying hmac (Note, we still need to
know the underlying hmac, which is passed in as a mechanism
parameter).
2) Use the new keygen to generate CKK_HKDF keys rather than doing it
by hand with the random number generator (never was really the best
way of doing this).
3) modify tls13hkdf.c to use the new mechanisms: 1) Extract: use the
new key handle in the mechanism parameters to pass the salt when the
salt is a key handle. Extract: use the explicit NULL salt parameter
if for the hash len salt of zeros. 2) Expand: Expand is mostly a
helper function which takes a mechanism. For regular expand, the
mechanism is the normal _Derive, for the Raw version its the _Data
function. That creates a data object, which is extractable in FIPS
mode.
4) update slot handling in tls13hkdf.c: 1) we need to make sure that
the key and the salt key are in the same slot. Provide a PK11wrap
function to make that guarrentee (and use that function in
PK11_WrapKey, which already has to do the same function). 2) When
importing a 'data' key for the zero key case, make sure we import
into the salt key's slot. If there is no salt key, use
PK11_GetBestSlot() rather than PK11_GetInternal slot.
Differential Revision:
https://phabricator.services.mozilla.com/D69899
[3d2b1738e064]
2020-04-06 Kevin Jacobs <kjacobs@mozilla.com>
* gtests/common/testvectors/curve25519-vectors.h,
gtests/common/testvectors/p256ecdh-vectors.h,
gtests/common/testvectors/p384ecdh-vectors.h,
gtests/common/testvectors/p521ecdh-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha1_mgf1sha1-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha256_mgf1sha1-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha256_mgf1sha256-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha384_mgf1sha1-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha384_mgf1sha384-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha512_mgf1sha1-vectors.h,
gtests/common/testvectors/rsa_oaep_2048_sha512_mgf1sha512-vectors.h,
gtests/common/testvectors/rsa_pkcs1_2048_test-vectors.h,
gtests/common/testvectors/rsa_pkcs1_3072_test-vectors.h,
gtests/common/testvectors/rsa_pkcs1_4096_test-vectors.h,
gtests/common/testvectors/rsa_pss_2048_sha1_mgf1_20-vectors.h,
gtests/common/testvectors/rsa_pss_2048_sha256_mgf1_0-vectors.h,
gtests/common/testvectors/rsa_pss_2048_sha256_mgf1_32-vectors.h,
gtests/common/testvectors/rsa_pss_3072_sha256_mgf1_32-vectors.h,
gtests/common/testvectors/rsa_pss_4096_sha256_mgf1_32-vectors.h,
gtests/common/testvectors/rsa_pss_4096_sha512_mgf1_32-vectors.h,
gtests/common/testvectors/rsa_pss_misc-vectors.h,
gtests/common/testvectors/rsa_signature-vectors.h,
gtests/common/testvectors/rsa_signature_2048_sha224-vectors.h,
gtests/common/testvectors/rsa_signature_2048_sha256-vectors.h,
gtests/common/testvectors/rsa_signature_2048_sha512-vectors.h,
gtests/common/testvectors/rsa_signature_3072_sha256-vectors.h,
gtests/common/testvectors/rsa_signature_3072_sha384-vectors.h,
gtests/common/testvectors/rsa_signature_3072_sha512-vectors.h,
gtests/common/testvectors/rsa_signature_4096_sha384-vectors.h,
gtests/common/testvectors/rsa_signature_4096_sha512-vectors.h,
gtests/common/testvectors_base/rsa_signature-vectors_base.txt,
gtests/common/testvectors_base/test-structs.h,
gtests/common/wycheproof/genTestVectors.py,
gtests/pk11_gtest/manifest.mn, gtests/pk11_gtest/pk11_gtest.gyp,
gtests/pk11_gtest/pk11_rsaencrypt_unittest.cc,
gtests/pk11_gtest/pk11_rsaoaep_unittest.cc,
gtests/pk11_gtest/pk11_rsapkcs1_unittest.cc,
gtests/pk11_gtest/pk11_rsapss_unittest.cc:
Bug 1612260 - Add Wycheproof vectors for RSA PKCS1 and PSS signing,
PKCS1 and OEAP decryption. r=bbeurdouche
This patch updates the Wycheproof script to build RSA test vectors
(covering PKCS1 decryption/verification, as well as PSS and OAEP)
and adds the appropriate test drivers.
Differential Revision:
https://phabricator.services.mozilla.com/D69847
[469fd8633757]
2020-04-01 Kevin Jacobs <kjacobs@mozilla.com>
* automation/taskcluster/docker-fuzz32/Dockerfile:
Bug 1626751 - Add apt-transport-https & apt-utils to fuzz32 docker
image r=jcj
We already install these packages on the image_builder image itself.
It seems they're now required on the fuzz32 image as well.
Differential Revision:
https://phabricator.services.mozilla.com/D69274
[c7a8195e3072]
2020-04-01 Giulio Benetti <giulio.benetti@benettiengineering.com>
* lib/freebl/Makefile:
Bug 1624864 - Don't force ARMv7 for gcm-arm32-neon r=jcj
[858209235972]
* coreconf/config.gypi, coreconf/config.mk, lib/freebl/Makefile,
lib/freebl/freebl.gyp, lib/freebl/gcm.c:
Bug 1620799 - Introduce NSS_DISABLE_ARM32_NEON r=jcj
Only some Arm32 supports neon, so let's introduce
NSS_DISABLE_ARM32_NEON to allow disabling Neon acceleration when
building for Arm32.
Signed-off-by: Giulio Benetti
<giulio.benetti@benettiengineering.com>
[b47b2c35aa64]
2020-04-01 Kevin Jacobs <kjacobs@mozilla.com>
* automation/abi-check/expected-report-libnss3.so.txt, automation/abi-
check/expected-report-libsoftokn3.so.txt, automation/abi-check
/expected-report-libssl3.so.txt:
Fixup ABI checks after libabigail update and Delegated Credentials
backport. r=me
[7f50f6ca7658]
2020-03-31 hajma <tropikhajma@gmail.com>
* coreconf/SunOS5.mk:
Bug 1625133 - Fix implicit declaration of function 'getopt' on SunOS
r=jcj
[744788dd18dc]
2020-03-30 Robert Relyea <rrelyea@redhat.com>
* automation/abi-check/expected-report-libnss3.so.txt,
gtests/pk11_gtest/pk11_hkdf_unittest.cc, lib/nss/nss.def,
lib/pk11wrap/pk11mech.c, lib/pk11wrap/pk11obj.c,
lib/pk11wrap/pk11pub.h, lib/softoken/pkcs11.c,
lib/softoken/pkcs11c.c:
Bug 1561637 TLS 1.3 does not work in FIPS mode
Patch 1 of 2. This patch updates softoken and helper functions with
the new PKCS #11 v3 HKDF, which handles all the correct key
management so that we can work in FIPS mode
1) Salts can be passed in as data, as and explicit NULL (which per
spec means a zero filled buffer of length of the underlying HMAC),
or through a key handle 2) A Data object can be used as a key
(explicitly allowed for this mechanism by the spec). 3) A special
mechansism produces a data object rather than a key, the latter
which can be exported. Softoken does not do the optional validation
on the pInfo to verify that the requested values are supposed to be
data rather than keys. Some other tokens may.
The old hkdf mechanism has been retained for compatibility (well
namely until patch 2 is created, tls is still using it). The hkdf
function has been broken off into it's own function rather than
inline in the derive function.
Note: because the base key and/or the export key could really be a
data object, our explicit handling of sensitive and extractable are
adjusted to take into account that those flags do not exist in data
objects.
Differential Revision:
https://phabricator.services.mozilla.com/D68940
[e0922aac5267]
2020-03-26 Hans Petter Jansson <hpj@cl.no>
* cmd/lowhashtest/lowhashtest.c:
Bug 1622555 - Fix lowhashtest argument parsing. r=kjacobs
[f3c5ab41c972]
2020-03-26 Benjamin Beurdouche <bbeurdouche@mozilla.com>
* lib/freebl/Makefile, lib/freebl/freebl.gyp:
Bug 1624377 - Replace freebl flag -msse4 by -msse4.1 -msse4.2 which
are supported by older compilers r=kjacobs
Differential Revision:
https://phabricator.services.mozilla.com/D68407
[16ee7cb36fff]
2020-03-26 Robert Relyea <rrelyea@redhat.com>
* gtests/ssl_gtest/libssl_internals.c, lib/pk11wrap/exports.gyp,
lib/pk11wrap/manifest.mn, lib/ssl/ssl3con.c, lib/ssl/sslprimitive.c,
lib/ssl/sslspec.h, lib/ssl/tls13con.c, lib/ssl/tls13con.h,
lib/ssl/tls13esni.c, lib/ssl/tls13exthandle.c:
Bug 1623374 Need to support the new PKCS #11 Message interface for
AES GCM and ChaCha Poly r=mt
Update ssl to use the new PK11_AEADOp() interface. 1. We restore the
use of PK11Context_Create() for AEAD operations. 2. AES GCM and
CHACHA/Poly specific functions are no longer needed as PK11_AEADOp()
handles all the mechanism specific processing. 3. TLS semantic
differences between the two algorithms is handled by their
parameters: 1. Nonce length is the length of the nonce counter. If
it's zero, then XOR_Counter is used (and the nonce length is the
sizeof(sslSequenceNumber)). 2. IV length is the full IV length -
nonce length. 3. TLS 1.3 always uses XOR_Counter. 4. The IV is
returned from the token in the encrypt case. Only in the explict
nonce case is it examined. (The code depends on the fact that the
count in the token will match sslSequenceNumber). I did have assert
code to verify this was happening for testing, but it's removed from
this patch it can be added back. 5. All the decrypt instances of
XOR_Counter IV creation have been colapsed into tls13_WriteNonce().
6. Even tough PK11_AEADOp returns and accepts the tag separately
(for encrypt and decrypt respectively). The SSL code still returns
the values as buffer||tag. 7. tls13_AEAD() has been enhanced so all
uses of AEAD outside of the TLS stream can use it instead of their
own wrapped version. It can handle streams (CreateContext()
tls13_AEAD() tls13_AEAD() DestroyContext()) or single shot
tls13_AEAD(context=NULL). In the later case, the keys for the single
shot operation should not be resued. 8. libssl_internals.c in the
gtests directory has been updated to handle advancing the internal
iv counter when we artifically advance the seqNum. Since we don't
have access to any token iv counter (including softoken), The code
switches to simulated message mode, and updates the simulated state
as appropriate. (obviously this is for testing only code as it
reaches into normally private data structures).
Differential Revision:
https://phabricator.services.mozilla.com/D68480
[e7c7f305078e]
2020-03-26 Robert Relyea <rrelyea@redhat.com>
* gtests/ssl_gtest/libssl_internals.c, lib/pk11wrap/exports.gyp,
lib/pk11wrap/manifest.mn, lib/ssl/ssl3con.c, lib/ssl/sslprimitive.c,
lib/ssl/sslspec.h, lib/ssl/tls13con.c, lib/ssl/tls13con.h,
lib/ssl/tls13esni.c, lib/ssl/tls13exthandle.c:
Bug 1623374 Need to support the new PKCS #11 Message interface for
AES GCM and ChaCha Poly r=mt
Update ssl to use the new PK11_AEADOp() interface. 1. We restore the
use of PK11Context_Create() for AEAD operations. 2. AES GCM and
CHACHA/Poly specific functions are no longer needed as PK11_AEADOp()
handles all the mechanism specific processing. 3. TLS semantic
differences between the two algorithms is handled by their
parameters: 1. Nonce length is the length of the nonce counter. If
it's zero, then XOR_Counter is used (and the nonce length is the
sizeof(sslSequenceNumber)). 2. IV length is the full IV length -
nonce length. 3. TLS 1.3 always uses XOR_Counter. 4. The IV is
returned from the token in the encrypt case. Only in the explict
nonce case is it examined. (The code depends on the fact that the
count in the token will match sslSequenceNumber). I did have assert
code to verify this was happening for testing, but it's removed from
this patch it can be added back. 5. All the decrypt instances of
XOR_Counter IV creation have been colapsed into tls13_WriteNonce().
6. Even tough PK11_AEADOp returns and accepts the tag separately
(for encrypt and decrypt respectively). The SSL code still returns
the values as buffer||tag. 7. tls13_AEAD() has been enhanced so all
uses of AEAD outside of the TLS stream can use it instead of their
own wrapped version. It can handle streams (CreateContext()
tls13_AEAD() tls13_AEAD() DestroyContext()) or single shot
tls13_AEAD(context=NULL). In the later case, the keys for the single
shot operation should not be resued. 8. libssl_internals.c in the
gtests directory has been updated to handle advancing the internal
iv counter when we artifically advance the seqNum. Since we don't
have access to any token iv counter (including softoken), The code
switches to simulated message mode, and updates the simulated state
as appropriate. (obviously this is for testing only code as it
reaches into normally private data structures).
Differential Revision:
https://phabricator.services.mozilla.com/D68480
[e7c7f305078e]
2020-03-23 Kevin Jacobs <kjacobs@mozilla.com>
* lib/softoken/pkcs11.c:
Bug 1624402 - Fix compilation error when NO_FORK_CHECK and
CHECK_FORK_* are defined r=rrelyea
Differential Revision:
https://phabricator.services.mozilla.com/D67911
[0225889e5292]
2020-03-23 Kevin Jacobs <kjacobs@mozilla.com>
* lib/util/pkcs11.h:
Bug 1624130 - Require CK_FUNCTION_LIST structs to be packed.
r=rrelyea
Differential Revision:
https://phabricator.services.mozilla.com/D67741
[7ab62d3d0445]
2020-03-19 Robert Relyea <rrelyea@redhat.com>
* automation/abi-check/expected-report-libnss3.so.txt,
gtests/pk11_gtest/pk11_aes_gcm_unittest.cc,
gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc,
lib/freebl/blapi.h, lib/freebl/blapii.h, lib/freebl/blapit.h,
lib/freebl/chacha20poly1305.c, lib/freebl/gcm.c, lib/freebl/gcm.h,
lib/freebl/intel-gcm-wrap.c, lib/freebl/intel-gcm.h,
lib/freebl/ldvector.c, lib/freebl/loader.c, lib/freebl/loader.h,
lib/freebl/rijndael.c, lib/freebl/rijndael.h, lib/nss/nss.def,
lib/pk11wrap/pk11cxt.c, lib/pk11wrap/pk11mech.c,
lib/pk11wrap/pk11priv.h, lib/pk11wrap/pk11pub.h,
lib/pk11wrap/pk11skey.c, lib/pk11wrap/pk11slot.c,
lib/pk11wrap/secmodti.h, lib/softoken/fipstokn.c,
lib/softoken/pkcs11.c, lib/softoken/pkcs11c.c,
lib/softoken/pkcs11i.h, lib/softoken/pkcs11u.c,
lib/softoken/sftkmessage.c, lib/util/pkcs11n.h, lib/util/pkcs11t.h,
lib/util/secport.h:
Bug 1623374 Need to support the new PKCS #11 Message interface for
AES GCM and ChaCha Poly
PKCS #11 defines a new interface for handling AEAD type ciphers that
allow multiple AEAD operations without repeating the key schedule.
It also allows tokens to keep track of the number of operations, and
generate IVs (depending on the cipher).
This patch: 1. implement those new functions in softoken. With the
addition of CKF_MESSAGE_* flags to various mechanism, we need to
strip them when using the version 2 API of softoken (since there are
no C_Message* function in version 2). For that we need a separate
C_GetMechanismInfo function. We use the same trick we used to have a
separate version function for the V2 interface. Also now that the
new message functions are in their own file, they still need access
to the common Session state processing functions. those have gone
from static to exported within softoken to accomidate that. Same
with sftk_MapDecryptError() (sftk_MapVerifyError() was also made
global, though nothing else is yet using it). Only
C_MessageEncrptInit(), C_EncryptMessage(), C_MessageEncryptFinal,
C_MessageDecryptInit(), C_DecryptMessage(), and
C_MessageDecryptFinal are implemented. C_EncryptMessageBegin(),
C_EncryptMessageNext(), C_DecryptMessageBegin(), and
C_DecryptMessageNext() are all part of the multi-part withing a
multi-part operation and are only necessary for things like S/MIME
(potentially). If we wanted to implement them, we would need more
functions exported from freebl (and initaead, updateaead, finalaead
for each mechanism type). 2. make those interfaces call aes_gcm and
chacha20_poly1503 (and make adjustments for those ciphers). For AES,
I added a new function AES_AEAD, which handles both encrypt and
decrypt. Internally, the gcm functions (both the generic gcm and the
intel gcm wrapper) had their init functions split into key
scheduling and counter mode/tag initialization. The latter is still
called from init, but the former is now for each update call. IV
generation is handled by a single function in gcm.c, and shared with
intel_gcm_wrapper.c Since the AES functions already know about the
underlying PKCS #11 mechanism parameters, the new AEAD functions
also parse the PKCS #11 GCM parameters. For Chacha/Poly new aead
update functions were created called ChaChaPoly1305_Encrypt and
ChaChaChaPoly1305_Decrypt. There was no Message specific
initialization in the existing chacha_init, so no changes were
needed there. The primary difference between _Encrypt/_Decrypt and
_Seal/_Open is the fact that the tag is put at the end of the
encrypted data buffer in the latter, and in a generic buffer in the
former. 3. create new pk11wrap interfaces that also squash the api
differences between the various mechanisms for aead (similiar to the
way we do it for CBC and ECB crypto today). To accomplish this I
added PK11_AEADOp() and PK11_AEADRawOp(). Both functions handle the
case where the token only supports the single shot interface, by
using the single short interface to simulate the Message interface.
The PK11_AEADOp() also smooths out the differences in the parameters
and symantics of the various mechanism so the application does not
need to worry about the PKCS #11 differences in the mechanism. Both
use contexts from the standard PK11_CreateContext(), so key
schedules are done once for each key rather than once for each
message. MESSAGE/AEAD operations are selected by adding the psuedo
attribute flag CKA_NSS_MESSAGE to the requested operation
(CKA_ENCRYPT, CKA_DECRYPT, CKA_SIGN, CKA_VERIFY). 4. write tests for
the new interfaces Tests were added to make sure the PK11_AEADRawOp
interface works, The single shot interface is used to test output of
the message interface we also use two test only functions to force
the connection to use the simulation interface, which is also
compared to the non-simulate inteface. The AES_GCM also tests
various IV generators.
Differential Revision:
https://phabricator.services.mozilla.com/D67552
[293ac3688ced]
2020-03-18 Kevin Jacobs <kjacobs@mozilla.com>
* lib/freebl/mpi/mpcpucache.c:
Bug 1623184 - Clear ECX prior to cpuid, fixing query for Extended
Features r=bbeurdouche
While trying to benchmark the recent HACL* AVX2 code, I noticed that
it was not being called on two machines (that both support AVX2),
instead using only the AVX version.
In order to query for Extended Features (cpuid with EAX=7), we also
need to set ECX to 0: https://www.intel.com/content/www/us/en
/architecture-and-technology/64-ia-32-architectures-software-
developer-vol-2a-manual.html. The current code fails to do this,
resulting in flags that show no support.
Initially, I wrote a separate `freebl_cpuid_ex` function that
accepted a value for ECX as a separate input argument. However, some
definitions of `freebl_cpuid` already zero ECX, so making this
consistent is the simplest way to get the desired behavior.
With this patch, the two test machines (MacOS and Linux x64)
correctly use the AVX2 ChaCha20Poly1305 code.
Differential Revision:
https://phabricator.services.mozilla.com/D67235
[06d41fe87c58]
2020-03-17 Robert Relyea <rrelyea@redhat.com>
* automation/abi-check/expected-report-libnss3.so.txt, automation/abi-
check/expected-report-libsoftokn3.so.txt, cmd/pk11mode/pk11mode.c,
lib/pk11wrap/pk11load.c, lib/pk11wrap/secmodi.h,
lib/pk11wrap/secmodt.h, lib/softoken/fipstokn.c,
lib/softoken/manifest.mn, lib/softoken/pkcs11.c,
lib/softoken/pkcs11c.c, lib/softoken/pkcs11i.h,
lib/softoken/sftkmessage.c, lib/softoken/softoken.gyp,
lib/softoken/softoken.h, lib/softoken/softokn.def,
lib/util/pkcs11.h, lib/util/pkcs11f.h, lib/util/pkcs11n.h,
nss/automation/abi-check/new-report-libnss3.so.txt, nss/automation
/abi-check/new-report-libsoftokn3.so.txt:
Bug 1603628 Update NSS to handle PKCS #11 v3.0 r=ueno r=mt
Update to PKCS #11 v3.0 part 2.
Create the functions and switch to the C_Interface() function to
fetch the PKCS #11 function table. Also PKCS #11 v3.0 uses a new
fork safe interface. NSS can already handle the case if the PKCS #11
module happens to be fork safe (when asked by the application to
refresh the tokens in the child process, NSS can detect that such a
refresh is not necessary and continue. Softoken could also be put in
fork_safe mode with an environment variable. With this patch it's
the default, and NSS asks for the fork safe API by default.
Technically softoken should implement the old non-fork safe
interface when PKCS #11 v2.0 is called, but NSS no longer needs it,
and doing so would double the number of PKCS #11 interfaces are
needed. You can still compile with fork unsafe semantics, and the
PKCS #11 V3.0 module will do the right thing and not include the
fork safe flag. Firefox does not fork(), so for firefox this is
simply code that is no longer compilied.
We now use C_GetInterface, which allows us to specify what kind of
interface we want (PKCS #11 v3.0, PKCS #11 v2.0, fork safe, etc.).
Vendor specific functions can now be accessed through the
C_GetInterface. If the C_GetInterface function does not exists, we
fall bak to the old C_GetFunctionList.
There are 24 new functions in PKCS #11 v3.0: C_GetInterfaceList -
return a table of all the supported interfaces C_GetInterface -
return a specific interface. You can specify interface name, version
and flags separately. You can leave off any of these and you will
get what the token thinks is the best match of the interfaces that
meet the criteria. We do this in softoken by the order of the
interface list. C_SessionCancel - Cancel one or more multipart
operation C_LoginUser - Supply a user name to C_Login(). This
function has no meaning for softoken, so it just returns
CKR_OPERATION_NOT_INITIALIZED under the theory that if we in the
future want to support usernames, the NSS db would need special
initialization to make that happen. C_Message* and C_*Message* (20
functions in all) are the new AEAD interface (they are written
generally so that it can be used for things other than AEAD). In
this patch they are unimplemented (see the next patch).
This patch adds regular (NSC_) and FIPS (FC_) versions of these
functions. Also when creating the PKCS #11 v2.0 interface, we had to
create a 2.0 specific version of C_GetInfo so that it can return a
2.40 in the CK_VERSION field rather than 3.00. We do this with
#defines since all the function tables are generated automagically
with pkcs11f.h.
Differential Revision:
https://phabricator.services.mozilla.com/D67240
[2364598f8a36]
2020-03-09 Benjamin Beurdouche <bbeurdouche@mozilla.com>
* automation/taskcluster/scripts/run_hacl.sh,
lib/freebl/verified/Hacl_Poly1305_128.c,
lib/freebl/verified/Hacl_Poly1305_256.c:
Bug 1612493 - Fix Firefox build for Windows 2012 x64. r=kjacobs
Differential Revision:
https://phabricator.services.mozilla.com/D65945
[7e09cdab32d0]
2020-03-02 Kurt Miller <kurt@intricatesoftware.com>
* lib/freebl/blinit.c:
Bug 1618400 - Fix unused variable 'getauxval' on OpenBSD/arm64 r=jcj
https://bugzilla.mozilla.org/show_bug.cgi?id=1618400
[2c989888dee7]
2020-03-02 Giulio Benetti <giulio.benetti@benettiengineering.com>
* lib/freebl/blinit.c:
Bug 1614183 - Check if PPC __has_include(<sys/auxv.h>). r=kjacobs
Some build environment doesn't provide <sys/auxv.h> and this causes
build failure, so let's check if that header exists by using
__has_include() helper.
Signed-off-by: Giulio Benetti
<giulio.benetti@benettiengineering.com>
[bb7c46049f26]
2020-02-28 Benjamin Beurdouche <bbeurdouche@mozilla.com>
* automation/taskcluster/scripts/run_hacl.sh,
lib/freebl/verified/Hacl_Chacha20.c,
lib/freebl/verified/Hacl_Chacha20Poly1305_128.c,
lib/freebl/verified/Hacl_Chacha20Poly1305_32.c,
lib/freebl/verified/Hacl_Chacha20_Vec128.c,
lib/freebl/verified/Hacl_Curve25519_51.c,
lib/freebl/verified/Hacl_Kremlib.h,
lib/freebl/verified/Hacl_Poly1305_128.c,
lib/freebl/verified/Hacl_Poly1305_32.c,
lib/freebl/verified/kremlin/include/kremlin/internal/types.h,
lib/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt128.h, li
b/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt128_Verifie
d.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt_8_1
6_32_64.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/LowStar_
Endianness.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar
_uint128_gcc64.h, lib/freebl/verified/libintvector.h:
Bug 1617533 - Update of HACL* after libintvector.h and coding style
changes. r=kjacobs
*** Bug 1617533 - Clang format
*** Bug 1617533 - Update HACL* commit for job in Taskcluster
*** Bug 1617533 - Update HACL* Kremlin code
Differential Revision:
https://phabricator.services.mozilla.com/D63829
[b6677ae9067e]
* automation/taskcluster/graph/src/extend.js, coreconf/arch.mk,
coreconf/config.mk, lib/freebl/Makefile, lib/freebl/blapii.h,
lib/freebl/blinit.c, lib/freebl/chacha20poly1305.c,
lib/freebl/freebl.gyp,
lib/freebl/verified/Hacl_Chacha20Poly1305_256.c,
lib/freebl/verified/Hacl_Chacha20Poly1305_256.h,
lib/freebl/verified/Hacl_Chacha20_Vec256.c,
lib/freebl/verified/Hacl_Chacha20_Vec256.h,
lib/freebl/verified/Hacl_Poly1305_256.c,
lib/freebl/verified/Hacl_Poly1305_256.h, nss-tool/hw-support.c:
Bug 1612493 - Support for HACL* AVX2 code for Chacha20, Poly1305 and
Chacha20Poly1305. r=kjacobs
*** Bug 1612493 - Import AVX2 code from HACL*
*** Bug 1612493 - Add CPU detection for AVX2, BMI1, BMI2, FMA, MOVBE
*** Bug 1612493 - New flag NSS_DISABLE_AVX2 for freebl/Makefile and
freebl.gyp
*** Bug 1612493 - Disable use of AVX2 on GCC 4.4 which doesn’t
support -mavx2
*** Bug 1612493 - Disable tests when the platform doesn't have
support for AVX2
Differential Revision:
https://phabricator.services.mozilla.com/D64718
[d5deac55f543]
2020-02-18 Robert Relyea <rrelyea@redhat.com>
* cmd/bltest/blapitest.c, cmd/fipstest/fipstest.c,
cmd/lib/pk11table.c, cmd/pk11gcmtest/pk11gcmtest.c,
cmd/shlibsign/shlibsign.c,
gtests/pk11_gtest/pk11_aes_gcm_unittest.cc,
gtests/pk11_gtest/pk11_cbc_unittest.cc, lib/certdb/crl.c,
lib/ckfw/dbm/db.c, lib/dev/devslot.c, lib/dev/devtoken.c,
lib/dev/devutil.c, lib/freebl/fipsfreebl.c, lib/freebl/gcm.c,
lib/freebl/intel-gcm-wrap.c, lib/pk11wrap/debug_module.c,
lib/pk11wrap/dev3hack.c, lib/pk11wrap/pk11akey.c,
lib/pk11wrap/pk11auth.c, lib/pk11wrap/pk11cert.c,
lib/pk11wrap/pk11err.c, lib/pk11wrap/pk11load.c,
lib/pk11wrap/pk11mech.c, lib/pk11wrap/pk11merge.c,
lib/pk11wrap/pk11nobj.c, lib/pk11wrap/pk11obj.c,
lib/pk11wrap/pk11pbe.c, lib/pk11wrap/pk11pk12.c,
lib/pk11wrap/pk11pqg.c, lib/pk11wrap/pk11skey.c,
lib/pk11wrap/pk11slot.c, lib/pk11wrap/pk11util.c, lib/pkcs12/p12d.c,
lib/pkcs12/p12e.c, lib/softoken/fipstokn.c,
lib/softoken/legacydb/lgattr.c, lib/softoken/legacydb/lgcreate.c,
lib/softoken/legacydb/lgfind.c, lib/softoken/legacydb/lginit.c,
lib/softoken/pkcs11.c, lib/softoken/pkcs11c.c,
lib/softoken/pkcs11u.c, lib/softoken/sdb.c, lib/softoken/sftkdb.c,
lib/softoken/sftkpwd.c, lib/ssl/ssl3con.c, lib/ssl/sslprimitive.c,
lib/ssl/tls13con.c, lib/util/pkcs11.h, lib/util/pkcs11f.h,
lib/util/pkcs11n.h, lib/util/pkcs11t.h, lib/util/secoid.c, nss-
tool/enc/enctool.cc:
Bug 1603628 Update NSS to handle PKCS #11 v3.0 r=daiki r=mhoye
https://phabricator.services.mozilla.com/D63241
This patch implements the first phase: updating the headers.
lib/util/pkcs11.h lib/util/pkcs11f.h lib/util/pkcs11t.h
Were updated using the released OASIS PKCS #11 v3.0 header files.
lib/util/pkcs11n.h was updated to finally deprecate all uses of
CK?_NETSCAPE_?.
A new define as added: NSS_PKCS11_2_0_COMPAT. If it's defined, the
small semantic changes (including the removal of deprecated defines)
between the NSS PKCS #11 v2 header file and the new PKCS #11 v3 are
reverted in favor of the PKCS #11 v2 definitions. This include the
removal of CK?_NETSCAPE_? in favor of CK?_NSS_?.
One notable change was caused by an inconsistancy between the spec
and the released headers in PKCS #11 v2.40. CK_GCM_PARAMS had an
extra field in the header that was not in the spec. OASIS considers
the header file to be normative, so PKCS #11 v3.0 resolved the issue
in favor of the header file definition. NSS had the spec definition,
so now there are 2 defines for this structure:
CK_NSS_GCM_PARAMS - the old nss define. Still used internally in
freebl. CK_GCM_PARAMS_V3 - the new define. CK_GCM_PARAMS - no longer
referenced in NSS itself. It's defined as CK_GCM_PARAMS_V3 if
NSS_PKCS11_2_0_COMPAT is *not* defined, and it's defined as
CKM_NSS_GCM_PARAMS if NSS_PKCS11_2_0_COMPAT is defined.
Softoken has been updated to accept either CK_NSS_GCM_PARAMS or
CK_GCM_PARAMS_V3. In a future patch NSS will be updated to use
CK_GCM_PARAMS_V3 and fall back to CK_NSS_GMC_PARAMS.
One other semantic difference between the 3.0 version of pkcs11f.h
and the version here: In the oasis version of the header, you must
define CK_PKCS11_2_0_ONLY to get just the PKCS #11 v2 defines. In
our version you must define CK_PKCS11_3 to get the PCKS #11 v3
defines.
Most of this patch is to handle changing the deprecated defines that
have been removed in PCKS #11 v3 from NSS.
Differential Revision:
https://phabricator.services.mozilla.com/D63241
[b5d90a7fe217]
Differential Revision: https://phabricator.services.mozilla.com/D70773
--HG--
extra : moz-landing-system : lando
2020-04-14 20:53:38 +03:00
|
|
|
/*
|
|
|
|
|
* Testing interfaces, not for general use. If your code isn't in
|
|
|
|
|
* gtests or cmd, stay away from these. This function forces
|
|
|
|
|
* an AEAD context into simulation mode even though the target token
|
|
|
|
|
* can already do PKCS #11 v3.0 Message (e.i. softoken).
|
|
|
|
|
*/
|
|
|
|
|
SECStatus _PK11_ContextSetAEADSimulation(PK11Context *context);
|
|
|
|
|
PRBool _PK11_ContextGetAEADSimulation(PK11Context *context);
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
/**********************************************************************
|
2008-08-15 08:12:54 +04:00
|
|
|
* Functions which are deprecated....
|
2008-06-06 16:40:11 +04:00
|
|
|
**********************************************************************/
|
|
|
|
|
|
|
|
|
|
SECItem *
|
|
|
|
|
PK11_FindCrlByName(PK11SlotInfo **slot, CK_OBJECT_HANDLE *handle,
|
2016-11-02 12:29:58 +03:00
|
|
|
SECItem *derName, int type, char **url);
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
CK_OBJECT_HANDLE
|
2016-11-02 12:29:58 +03:00
|
|
|
PK11_PutCrl(PK11SlotInfo *slot, SECItem *crl,
|
|
|
|
|
SECItem *name, char *url, int type);
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
SECItem *
|
|
|
|
|
PK11_FindSMimeProfile(PK11SlotInfo **slotp, char *emailAddr, SECItem *derSubj,
|
2016-11-02 12:29:58 +03:00
|
|
|
SECItem **profileTime);
|
2008-06-06 16:40:11 +04:00
|
|
|
SECStatus
|
|
|
|
|
PK11_SaveSMimeProfile(PK11SlotInfo *slot, char *emailAddr, SECItem *derSubj,
|
2016-11-02 12:29:58 +03:00
|
|
|
SECItem *emailProfile, SECItem *profileTime);
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
PRBool PK11_IsPermObject(PK11SlotInfo *slot, CK_OBJECT_HANDLE handle);
|
|
|
|
|
|
2016-11-02 12:29:58 +03:00
|
|
|
char *PK11_GetObjectNickname(PK11SlotInfo *slot, CK_OBJECT_HANDLE id);
|
|
|
|
|
SECStatus PK11_SetObjectNickname(PK11SlotInfo *slot, CK_OBJECT_HANDLE id,
|
|
|
|
|
const char *nickname);
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
/* private */
|
2016-11-02 12:29:58 +03:00
|
|
|
SECStatus pk11_TraverseAllSlots(SECStatus (*callback)(PK11SlotInfo *, void *),
|
|
|
|
|
void *cbArg, PRBool forceLogin, void *pwArg);
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
/* fetch multiple CRLs for a specific issuer */
|
2016-11-02 12:29:58 +03:00
|
|
|
SECStatus pk11_RetrieveCrls(CERTCrlHeadNode *nodes, SECItem *issuer,
|
|
|
|
|
void *wincx);
|
2008-06-06 16:40:11 +04:00
|
|
|
|
|
|
|
|
/* set global options for NSS PKCS#11 module loader */
|
|
|
|
|
SECStatus pk11_setGlobalOptions(PRBool noSingleThreadedModules,
|
|
|
|
|
PRBool allowAlreadyInitializedModules,
|
|
|
|
|
PRBool dontFinalizeModules);
|
|
|
|
|
|
|
|
|
|
/* return whether NSS is allowed to call C_Finalize */
|
|
|
|
|
PRBool pk11_getFinalizeModulesOption(void);
|
|
|
|
|
|
Bug 1711262 - land NSS 40edc4f4c117 UPGRADE_NSS_RELEASE, r=beurdouche
2021-05-11 Robert Relyea <rrelyea@redhat.com>
* automation/abi-check/expected-report-libnss3.so.txt, automation/abi-
check/expected-report-libssl3.so.txt, cmd/selfserv/selfserv.c,
cmd/strsclnt/strsclnt.c, cmd/tstclnt/tstclnt.c, lib/nss/nss.def,
lib/pk11wrap/pk11cxt.c, lib/pk11wrap/pk11load.c,
lib/pk11wrap/pk11obj.c, lib/pk11wrap/pk11priv.h,
lib/pk11wrap/pk11pub.h, lib/pk11wrap/pk11slot.c,
lib/pk11wrap/secmodt.h, lib/softoken/config.mk,
lib/softoken/fips_algorithms.h, lib/softoken/fipstokn.c,
lib/softoken/pkcs11.c, lib/softoken/pkcs11c.c,
lib/softoken/pkcs11i.h, lib/softoken/pkcs11u.c,
lib/softoken/sftkmessage.c, lib/ssl/ssl3con.c, lib/ssl/sslimpl.h,
lib/ssl/sslinfo.c, lib/ssl/sslt.h, lib/util/pkcs11n.h,
tests/ssl/ssl.sh, tests/ssl/sslcov.txt:
Bug 1710773 NSS needs FIPS 180-3 FIPS indicators. r=mt
Changes from the review: The while loop was taken out of it's
subshell pipe, which prevented the selfserv PID from being passed on
to the final selfserv-kill. This eventally lead to a freeze on
windows.
The last paragraph of ISO 19790:2012 section 7.2.4.2 states:
All services shall [02.24] provide an indicator when the service
utilises an approved cryptographic algorithm, security function or
process in an approved manner and those services or processes
specified in 7.4.3
This means our libraries need to grow an API or provide some
additional information via contexts or similar in order for an
application to be able to query this indicator. This can't be just a
Security Policy description because ISO 24759:2017 section 6.2.4.2
states:
TE02.24.02: The tester shall execute all services and verify that
the indicator provides an unambiguous indication of whether the
service utilizes an approved cryptographic algorithm, security
function or process in an approved manner or not.
The indicator can't be just a marker over an algorithm either,
because it needs to show different values based on whether the
algorithm parameters causes the algorithm to run in approved or non-
approved mode (ie keys outside of valid range for RSA means RSA is
being used in non-approved mode ...)
For NSS, there is a PKCS #11 design: https://docs.google.com/documen
t/d/1Me9YksPE7K1Suvk9Ls5PqJXPpDmpAboLsrq0z54m_tA/edit?usp=sharing
This patch implments the above design as well as: 1) NSS proper
functions to access these indicators from either the pk11wrap layer
or the ssl layer. 2) Updates to the ssl tests which will output the
value of the
Changes decription by file: cmd/selfserv/selfserv.c Add a FIPS
indicator if the connection was excuted in FIPS mode on a FIPS
token. cmd/strsclnt/strsclnt.c Add a FIPS indicator if the
connection was excuted in FIPS mode on a FIPS token.
cmd/tstclnt/tstclnt.c Add a FIPS indicator if the connection was
excuted in FIPS mode on a FIPS token. lib/nss/nss.def Add the new
pk11 functions to access the fips indicator. lib/pk11wrap/pk11cxt.c
Implement a function to get the FIPS indicator for the current
PK11Context. lib/pk11wrap/pk11load.c Get the fips indicator function
from the PKCS #11 module using the vendor function interface from
PKCS #11 v3.0 lib/pk11wrap/pk11obj.c Implement a function to get the
FIPS indicator for a specific PKCS #11 object.
lib/pk11wrap/pk11priv.h Add a generalized helper function to get the
FIPS indicator used by all the other exported functions to get FIPS
indicator. lib/pk11wrap/pk11pub.h Add function to get the FIPS
indicator for the current PK11Context. lib/pk11wrap/pk11slot.c
Implement a generalized helper function to get the FIPS indicator.
Implement a function to get the FIPS indicator for the latest single
shot operation on the slot. lib/pk11wrap/secmodt.h Add a new field
to hold the fipsIndicator function. lib/softoken/fips_algorithms.h
New sample header which vendors can replace with their own table. In
the default NSS case, the table in this header will be empty.
lib/softoken/fipstokn.c Add Vendor specific interface for the FIPS
indicator to the FIPS token. lib/softoken/pkcs11.c Add Vendor
specific interface for the FIPS indicator to the non-FIPS token.
Factor out the code tha maps an attribute value to a mechanism flag
to it's own file so it can be used by other parts of softoken. (new
function is in pkcs11u.c Implement the function that returns the
FIPS indicator. This function fetches the indicator from either the
session or the object or both. The session indicator is in the
crypto context (except the last operation indicator, which is in the
session itself. The object indicator is in the base object.
lib/softoken/pkcs11c.c Record the FIPS indicator in the various
helper function.
- sftk_TerminateOp is called when a crypto operation had been
finalized, so we can store that fips indicator in the lastOpWasFIPS
field.
- sftk_InitGeneric is called when a crypto operation has been
initialized, so we can make a preliminary determination if the
operation is within the FIPS policy (could later change bases on
other operations. For this to work, we need the actual mechanism, so
pMechanism is now a parameter to sftk_InitGeneric.
- sftk_HKDF - HKDF when used in TLS has the unusual characteristic
that the salt could actually be a key. In this case, usually the
base key is some known public value which would not be FIPS
generated, but the security is based on whether the salt is really a
FIPS generated key. In this case we redo the calculation based on
the salt key. lib/softoken/pkcs11i.h
- add the FIPS indicators to the various structures (crypto contexts,
sessions, objects).
- add the FIPS indicators function list
- add pMechanism the the sftkInitGeneric function.
- add the helper function to map Attribute Types to Mechanism Flags.
- add the function that will look up the current operation in the FIPS
table to determine that it is allowed by policy.
lib/softoken/pkcs11u.c
- include the new fips_algorithms.h (if NSS_FIPS_DISABLED is not on)
- handle the FIPS status for objects and session on creation an copy.
- implement the helper function to map Attribute Types to Mechanism
Flags.
- get the key length of a key. This involves getting the key type and
then using the key type to determin the appropriate attribute to
fetch. Most keys it's simply the CKA_VALUE. ECC is special, we get
the key length from the curve. Since only a subset of curves can be
FIPS Curves, we use key length to return false for other curves.
- the handle special function handles any unusal semantics for various
mechanism types. This function precodes possible mechanism semantics
we may need to check. The special handling can be selected by the
mechanism table in fips_algorithms.h
- sftk_operationIsFIPS - the actual function to determine if the
givelib/n operation is in the FIPS table. lib/softoken/sftkmessage.c
- just need to update the sftk_InitGeneric function to pass the
mechanism. lib/ssl/ssl3con.c
- and functions to query the underlying crypto contexts to see if the
current ssl session is running in FIPS approved mode based on the
security policy. It does so by checking the CipherSpecIsFIPS
function to verify that both the mac and the encryption algorithm
FIPS conforms to the ciphers in the security profile (using
PK11_GetFIPSStatus). We check both the cipher specs for read and
write. These underlying specs depends on the keys used in these
specs being generated with FIPS approved algorithms as well, so this
verifies the kea and kdf functions as well. lib/ssl/sslimpl.h
- ass ssl_isFIPS() so it can be used by other files here in the ssl
directory. lib/ssl/sslinfo.c
- set the new isFIPS field in the existing sslinfo structure.
SSL_GetChannelInfo knows how to handle sslinfo structures that are
smaller then expected and larger than expected. unknown fields will
be set to '0' (so new applications running against old versions will
always get zero for new fields). sslinfo that are smaller will only
return a the subset the calling application expects (so old
applications will not get the new fields). lib/ssl/sslt.h
- Add the new isFIPS field (must be at the end of the ChannelInfo
structure). lib/util/pkcs11n.h
- add the new FIPS indicator defines. tests/ssl/ssl.h
- The main changes was to turn on verbose for the coverage tests so we
can test the FIPS indicators on various cipher suites. NOTE: this
only works with either NSS_TEST_FIPS_ALGORIHTMS set, or a vendor
fips_algorthims.h, so vendors will need to do their own test
interpretation. While working in ssl.sh I fixed an number of other
issues:
- many tests that were skipped in FIPS mode were skipped not because
they didn't work in FIPS mode, but because tstclnt requires a
password when running in FIPS mode. I've now added the password if
the function is running in fips mode and removed the fips
restrictions.
- dtls had a race condition. the server side needed to come up before
the client, but couldn't end before the client ran. We already had a
sleep to guarrentee the former, I added a sleep before sending the
server it's data to handle the latter.
- CURVE25519 is the default ECC curve, but it's not a fiPS curve, so I
disable it in FIPS mode so we will actually get FIPS indicators when
using ECDHE.
- I added TLS 1.3 to the coverage tests.
[40edc4f4c117] [tip]
Differential Revision: https://phabricator.services.mozilla.com/D115625
2021-05-20 20:42:35 +03:00
|
|
|
/* fetch the FIPS state from the fips indicator, public versions of
|
|
|
|
|
* this function operate on the slot, the context, and the object */
|
|
|
|
|
PRBool pk11slot_GetFIPSStatus(PK11SlotInfo *slot, CK_SESSION_HANDLE session,
|
|
|
|
|
CK_OBJECT_HANDLE object, CK_ULONG operationType);
|
|
|
|
|
|
2008-06-06 16:40:11 +04:00
|
|
|
SEC_END_PROTOS
|
|
|
|
|
|
|
|
|
|
#endif
|
