зеркало из https://github.com/mozilla/gecko-dev.git
Merge mozilla-inbound to mozilla-central. a=merge
This commit is contained in:
Daniel Varga
Коммит
5e7f34b25d
|
|
@ -54,7 +54,7 @@ if (isDevelopment()) {
|
|||
pref("devtools.debugger.features.event-listeners", false);
|
||||
pref("devtools.debugger.features.code-folding", false);
|
||||
pref("devtools.debugger.features.outline", true);
|
||||
pref("devtools.debugger.features.column-breakpoints", true);
|
||||
pref("devtools.debugger.features.column-breakpoints", false);
|
||||
pref("devtools.debugger.features.pause-points", true);
|
||||
pref("devtools.debugger.features.skip-pausing", true);
|
||||
pref("devtools.debugger.features.component-pane", false);
|
||||
|
|
|
|||
|
|
@ -51,7 +51,7 @@ pref("devtools.debugger.skip-pausing", false);
|
|||
pref("devtools.debugger.features.wasm", true);
|
||||
pref("devtools.debugger.features.shortcuts", true);
|
||||
pref("devtools.debugger.features.root", true);
|
||||
pref("devtools.debugger.features.column-breakpoints", true);
|
||||
pref("devtools.debugger.features.column-breakpoints", false);
|
||||
pref("devtools.debugger.features.chrome-scopes", false);
|
||||
pref("devtools.debugger.features.map-scopes", true);
|
||||
pref("devtools.debugger.features.remove-command-bar-options", false);
|
||||
|
|
|
|||
|
|
@ -152,25 +152,7 @@ body,
|
|||
}
|
||||
|
||||
#device-selector {
|
||||
align-self: center;
|
||||
background-position: right 4px center;
|
||||
margin-inline-start: 4px;
|
||||
padding-left: 0;
|
||||
width: 8em;
|
||||
}
|
||||
|
||||
#device-selector .title {
|
||||
width: 85%;
|
||||
}
|
||||
|
||||
#device-pixel-ratio-menu {
|
||||
width: 6em;
|
||||
/* `max-width` is here to keep the UI compact if the device pixel ratio changes to a
|
||||
repeating decimal value. This can happen if you zoom the UI (Cmd + Plus / Minus on
|
||||
macOS for example). */
|
||||
max-width: 8em;
|
||||
background-position: right 4px center;
|
||||
padding-left: 0;
|
||||
}
|
||||
|
||||
#viewports-container {
|
||||
|
|
|
|||
|
|
@ -214,8 +214,11 @@ splitter.devtools-horizontal-splitter,
|
|||
/* Dropdown Menu Button */
|
||||
.devtools-dropdown-button {
|
||||
background-image: url("chrome://devtools/skin/images/select-arrow.svg") !important;
|
||||
background-position: right center !important;
|
||||
background-repeat: no-repeat !important;
|
||||
overflow: hidden;
|
||||
padding-inline-start: 2px !important;
|
||||
padding-inline-end: 10px !important;
|
||||
fill: var(--theme-toolbar-photon-icon-color);
|
||||
-moz-context-properties: fill;
|
||||
}
|
||||
|
|
@ -233,15 +236,3 @@ splitter.devtools-horizontal-splitter,
|
|||
text-overflow: ellipsis;
|
||||
white-space: nowrap;
|
||||
}
|
||||
|
||||
/*
|
||||
* Style for the Network throttling menu button. This is shared between the Responsive
|
||||
* Design Mode and Network Monitor.
|
||||
*/
|
||||
|
||||
#network-throttling-menu {
|
||||
padding-left: 2px;
|
||||
padding-right: 10px;
|
||||
background-position: right center;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -36,7 +36,8 @@ function getPausedMessage(visibleMessages, messages, executionPoint) {
|
|||
let pausedMessage = messages.get(visibleMessages[0]);
|
||||
for (const messageId of visibleMessages) {
|
||||
const message = messages.get(messageId);
|
||||
if (executionPoint.progress >= message.executionPoint.progress &&
|
||||
if (message.executionPoint &&
|
||||
executionPoint.progress >= message.executionPoint.progress &&
|
||||
message.executionPoint.progress > pausedMessage.executionPoint.progress) {
|
||||
pausedMessage = message;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -127,7 +127,7 @@ class Message extends Component {
|
|||
|
||||
return MessageIcon({
|
||||
level,
|
||||
onRewindClick: serviceContainer.canRewind()
|
||||
onRewindClick: (serviceContainer.canRewind() && executionPoint)
|
||||
? () => serviceContainer.jumpToExecutionPoint(executionPoint, messageId)
|
||||
: null,
|
||||
});
|
||||
|
|
|
|||
|
|
@ -402,6 +402,13 @@ ReplayDebugger.prototype = {
|
|||
}
|
||||
},
|
||||
|
||||
// Clear OnStep and OnPop hooks for all frames.
|
||||
replayClearSteppingHooks() {
|
||||
this._clearMatchingBreakpoints(
|
||||
({position}) => position.kind == "OnStep" || position.kind == "OnPop"
|
||||
);
|
||||
},
|
||||
|
||||
/////////////////////////////////////////////////////////
|
||||
// Script methods
|
||||
/////////////////////////////////////////////////////////
|
||||
|
|
@ -765,21 +772,11 @@ ReplayDebuggerFrame.prototype = {
|
|||
},
|
||||
|
||||
set onStep(handler) {
|
||||
if (handler) {
|
||||
// Use setReplayingOnStep instead.
|
||||
NotAllowed();
|
||||
}
|
||||
this._clearOnStepBreakpoints();
|
||||
},
|
||||
|
||||
_clearOnStepBreakpoints() {
|
||||
this._dbg._clearMatchingBreakpoints(
|
||||
({position}) => this._positionMatches(position, "OnStep")
|
||||
);
|
||||
// Use setReplayingOnStep or replayClearSteppingHooks instead.
|
||||
NotAllowed();
|
||||
},
|
||||
|
||||
setReplayingOnStep(handler, offsets) {
|
||||
this._clearOnStepBreakpoints();
|
||||
offsets.forEach(offset => {
|
||||
this._dbg._setBreakpoint(
|
||||
() => { handler.call(this._dbg.getNewestFrame()); },
|
||||
|
|
@ -807,9 +804,8 @@ ReplayDebuggerFrame.prototype = {
|
|||
{ kind: "OnPop", script: this._data.script, frameIndex: this._data.index },
|
||||
handler);
|
||||
} else {
|
||||
this._dbg._clearMatchingBreakpoints(
|
||||
({position}) => this._positionMatches(position, "OnPop")
|
||||
);
|
||||
// Use replayClearSteppingHooks instead.
|
||||
NotAllowed();
|
||||
}
|
||||
},
|
||||
|
||||
|
|
|
|||
|
|
@ -687,12 +687,17 @@ const gRequestHandlers = {
|
|||
value: "Recording divergence in getEnvironmentNames" }];
|
||||
}
|
||||
|
||||
const env = gPausedObjects.getObject(request.id);
|
||||
const names = env.names();
|
||||
try {
|
||||
const env = gPausedObjects.getObject(request.id);
|
||||
const names = env.names();
|
||||
|
||||
return names.map(name => {
|
||||
return { name, value: convertValue(env.getVariable(name)) };
|
||||
});
|
||||
return names.map(name => {
|
||||
return { name, value: convertValue(env.getVariable(name)) };
|
||||
});
|
||||
} catch (e) {
|
||||
return [{name: "Unknown names",
|
||||
value: "Exception thrown in getEnvironmentNames" }];
|
||||
}
|
||||
},
|
||||
|
||||
getFrame(request) {
|
||||
|
|
|
|||
|
|
@ -859,18 +859,19 @@ const ThreadActor = ActorClassWithSpec(threadSpec, {
|
|||
},
|
||||
|
||||
/**
|
||||
* Clear the onStep and onPop hooks from the given frame and all of the frames
|
||||
* below it.
|
||||
*
|
||||
* @param Debugger.Frame aFrame
|
||||
* The frame we want to clear the stepping hooks from.
|
||||
* Clear the onStep and onPop hooks for all frames on the stack.
|
||||
*/
|
||||
_clearSteppingHooks: function(frame) {
|
||||
if (frame && frame.live) {
|
||||
while (frame) {
|
||||
frame.onStep = undefined;
|
||||
frame.onPop = undefined;
|
||||
frame = frame.older;
|
||||
_clearSteppingHooks: function() {
|
||||
if (this.dbg.replaying) {
|
||||
this.dbg.replayClearSteppingHooks();
|
||||
} else {
|
||||
let frame = this.youngestFrame;
|
||||
if (frame && frame.live) {
|
||||
while (frame) {
|
||||
frame.onStep = undefined;
|
||||
frame.onPop = undefined;
|
||||
frame = frame.older;
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
@ -940,7 +941,7 @@ const ThreadActor = ActorClassWithSpec(threadSpec, {
|
|||
if (request && request.resumeLimit) {
|
||||
resumeLimitHandled = this._handleResumeLimit(request);
|
||||
} else {
|
||||
this._clearSteppingHooks(this.youngestFrame);
|
||||
this._clearSteppingHooks();
|
||||
resumeLimitHandled = Promise.resolve(true);
|
||||
}
|
||||
|
||||
|
|
@ -1462,10 +1463,7 @@ const ThreadActor = ActorClassWithSpec(threadSpec, {
|
|||
this.dbg.onEnterFrame = undefined;
|
||||
this.dbg.replayingOnPopFrame = undefined;
|
||||
this.dbg.onExceptionUnwind = undefined;
|
||||
if (frame) {
|
||||
frame.onStep = undefined;
|
||||
frame.onPop = undefined;
|
||||
}
|
||||
this._clearSteppingHooks();
|
||||
|
||||
// Clear DOM event breakpoints.
|
||||
// XPCShell tests don't use actual DOM windows for globals and cause
|
||||
|
|
|
|||
|
|
@ -54,7 +54,7 @@ parent:
|
|||
OpUpdateResource[] aResourceUpdates, RefCountedShmem[] aSmallShmems, Shmem[] aLargeShmems,
|
||||
IdNamespace aIdNamespace, TimeStamp refreshStartTime, TimeStamp txnStartTime, nsCString txnURL, TimeStamp fwdTime);
|
||||
async SetFocusTarget(FocusTarget focusTarget);
|
||||
async UpdateResources(OpUpdateResource[] aResourceUpdates, RefCountedShmem[] aSmallShmems, Shmem[] aLargeShmems, bool scheduleComposite);
|
||||
async UpdateResources(OpUpdateResource[] aResourceUpdates, RefCountedShmem[] aSmallShmems, Shmem[] aLargeShmems);
|
||||
async ParentCommands(WebRenderParentCommand[] commands);
|
||||
sync GetSnapshot(PTexture texture);
|
||||
async SetLayersObserverEpoch(LayersObserverEpoch childEpoch);
|
||||
|
|
|
|||
|
|
@ -96,8 +96,7 @@ WebRenderBridgeChild::BeginTransaction()
|
|||
}
|
||||
|
||||
void
|
||||
WebRenderBridgeChild::UpdateResources(wr::IpcResourceUpdateQueue& aResources,
|
||||
bool aScheduleComposite /* = false */)
|
||||
WebRenderBridgeChild::UpdateResources(wr::IpcResourceUpdateQueue& aResources)
|
||||
{
|
||||
if (!IPCOpen()) {
|
||||
aResources.Clear();
|
||||
|
|
@ -114,7 +113,7 @@ WebRenderBridgeChild::UpdateResources(wr::IpcResourceUpdateQueue& aResources,
|
|||
aResources.Flush(resourceUpdates, smallShmems, largeShmems);
|
||||
|
||||
this->SendUpdateResources(resourceUpdates, smallShmems,
|
||||
largeShmems, aScheduleComposite);
|
||||
largeShmems);
|
||||
}
|
||||
|
||||
void
|
||||
|
|
|
|||
|
|
@ -66,8 +66,7 @@ public:
|
|||
|
||||
void AddWebRenderParentCommand(const WebRenderParentCommand& aCmd);
|
||||
|
||||
void UpdateResources(wr::IpcResourceUpdateQueue& aResources,
|
||||
bool aScheduleComposite = false);
|
||||
void UpdateResources(wr::IpcResourceUpdateQueue& aResources);
|
||||
void BeginTransaction();
|
||||
void EndTransaction(const wr::LayoutSize& aContentSize,
|
||||
wr::BuiltDisplayList& dl,
|
||||
|
|
|
|||
|
|
@ -749,8 +749,7 @@ WebRenderBridgeParent::ObserveSharedSurfaceRelease(const nsTArray<wr::ExternalIm
|
|||
mozilla::ipc::IPCResult
|
||||
WebRenderBridgeParent::RecvUpdateResources(nsTArray<OpUpdateResource>&& aResourceUpdates,
|
||||
nsTArray<RefCountedShmem>&& aSmallShmems,
|
||||
nsTArray<ipc::Shmem>&& aLargeShmems,
|
||||
const bool& aScheduleComposite)
|
||||
nsTArray<ipc::Shmem>&& aLargeShmems)
|
||||
{
|
||||
if (mDestroyed) {
|
||||
wr::IpcResourceUpdateQueue::ReleaseShmems(this, aSmallShmems);
|
||||
|
|
@ -770,11 +769,6 @@ WebRenderBridgeParent::RecvUpdateResources(nsTArray<OpUpdateResource>&& aResourc
|
|||
return IPC_FAIL(this, "Invalid WebRender resource data shmem or address.");
|
||||
}
|
||||
|
||||
if (aScheduleComposite) {
|
||||
txn.InvalidateRenderedFrame();
|
||||
ScheduleGenerateFrame();
|
||||
}
|
||||
|
||||
mApi->SendTransaction(txn);
|
||||
|
||||
return IPC_OK();
|
||||
|
|
|
|||
|
|
@ -80,8 +80,7 @@ public:
|
|||
mozilla::ipc::IPCResult RecvDeleteCompositorAnimations(InfallibleTArray<uint64_t>&& aIds) override;
|
||||
mozilla::ipc::IPCResult RecvUpdateResources(nsTArray<OpUpdateResource>&& aUpdates,
|
||||
nsTArray<RefCountedShmem>&& aSmallShmems,
|
||||
nsTArray<ipc::Shmem>&& aLargeShmems,
|
||||
const bool& aScheduleComposite) override;
|
||||
nsTArray<ipc::Shmem>&& aLargeShmems) override;
|
||||
mozilla::ipc::IPCResult RecvSetDisplayList(const gfx::IntSize& aSize,
|
||||
InfallibleTArray<WebRenderParentCommand>&& aCommands,
|
||||
InfallibleTArray<OpDestroy>&& aToDestroy,
|
||||
|
|
|
|||
|
|
@ -364,8 +364,7 @@ WebRenderLayerManager::EndTransactionWithoutLayer(nsDisplayList* aDisplayList,
|
|||
// If we can't just swap the queue, we need to take the slow path and
|
||||
// send the update as a separate message. We don't need to schedule a
|
||||
// composite however because that will happen with EndTransaction.
|
||||
WrBridge()->UpdateResources(mAsyncResourceUpdates.ref(),
|
||||
/* aScheduleComposite */ false);
|
||||
WrBridge()->UpdateResources(mAsyncResourceUpdates.ref());
|
||||
}
|
||||
mAsyncResourceUpdates.reset();
|
||||
}
|
||||
|
|
@ -761,8 +760,7 @@ WebRenderLayerManager::FlushAsyncResourceUpdates()
|
|||
}
|
||||
|
||||
if (!IsDestroyed() && WrBridge()) {
|
||||
WrBridge()->UpdateResources(mAsyncResourceUpdates.ref(),
|
||||
/* aScheduleComposite */ true);
|
||||
WrBridge()->UpdateResources(mAsyncResourceUpdates.ref());
|
||||
}
|
||||
|
||||
mAsyncResourceUpdates.reset();
|
||||
|
|
|
|||
|
|
@ -73,7 +73,7 @@ fuzzy-if(skiaContent,0-73,0-900) == twostops-1e.html twostops-1-ref.html
|
|||
|
||||
# from http://www.xanthir.com/:4bhipd by way of http://a-ja.net/newgrad.html
|
||||
fuzzy-if(!contentSameGfxBackendAsCanvas,0-3,0-20000) fuzzy-if(azureSkiaGL||skiaContent&&layersGPUAccelerated,0-8,0-20000) == aja-linear-1a.html aja-linear-1-ref.html
|
||||
fails-if(!d2d&&!skiaContent) fuzzy-if(skiaContent,0-1,0-20000) fuzzy-if(webrender&&winWidget&&isDebugBuild,1-2,11550-11789) == aja-linear-1b.html aja-linear-1-ref.html # bug 526694
|
||||
fails-if(!d2d&&!skiaContent) fuzzy-if(skiaContent,0-1,0-20000) fuzzy-if(webrender&&winWidget,1-2,11550-11789) == aja-linear-1b.html aja-linear-1-ref.html # bug 526694
|
||||
fuzzy-if(!contentSameGfxBackendAsCanvas,0-3,0-20000) fuzzy-if(azureSkiaGL||skiaContent,0-8,0-20000) == aja-linear-1c.html aja-linear-1-ref.html
|
||||
fuzzy-if(!contentSameGfxBackendAsCanvas,0-3,0-20000) fuzzy-if(azureSkiaGL||skiaContent,0-8,0-20000) == aja-linear-1d.html aja-linear-1-ref.html
|
||||
fuzzy-if(!contentSameGfxBackendAsCanvas,0-3,0-20000) fuzzy-if(azureSkiaGL||skiaContent,0-8,0-20000) == aja-linear-1e.html aja-linear-1-ref.html
|
||||
|
|
|
|||
|
|
@ -363,6 +363,8 @@ function ReadTests() {
|
|||
|
||||
if ((testList && manifests) || !(testList || manifests)) {
|
||||
logger.error("Exactly one of reftest.manifests or reftest.tests must be specified.");
|
||||
logger.debug("reftest.manifests is: " + manifests);
|
||||
logger.error("reftest.tests is: " + testList);
|
||||
DoneTests();
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
59ef418bf925
|
||||
4b9cf6e61a48
|
||||
|
|
|
|||
|
|
@ -131,6 +131,7 @@ typedef enum {
|
|||
UNDEFAULT_SUCCESS_MSG,
|
||||
BROWSER_RUNNING_MSG,
|
||||
ABORTING_MSG,
|
||||
P11_KIT_ENABLED_MSG,
|
||||
|
||||
LAST_MSG /* must be last */
|
||||
} Message;
|
||||
|
|
|
|||
|
|
@ -138,7 +138,11 @@ char* msgStrings[] = {
|
|||
"\ncorruption of your security databases. If the browser is currently running,"
|
||||
"\nyou should exit browser before continuing this operation. Type "
|
||||
"\n'q <enter>' to abort, or <enter> to continue: ",
|
||||
"\nAborting...\n"
|
||||
"\nAborting...\n",
|
||||
"\nWARNING: Manually adding a module while p11-kit is enabled could cause"
|
||||
"\nduplicate module registration in your security database. It is suggested "
|
||||
"\nto configure the module through p11-kit configuration file instead.\n"
|
||||
"\nType 'q <enter>' to abort, or <enter> to continue: "
|
||||
};
|
||||
|
||||
/* Increment i if doing so would have i still be less than j. If you
|
||||
|
|
@ -856,6 +860,28 @@ main(int argc, char* argv[])
|
|||
goto loser;
|
||||
}
|
||||
|
||||
/* Warn if we are adding a module while p11-kit is enabled in the
|
||||
* database. */
|
||||
if ((command == ADD_COMMAND || command == RAW_ADD_COMMAND) &&
|
||||
IsP11KitEnabled()) {
|
||||
char* response;
|
||||
|
||||
PR_fprintf(PR_STDOUT, msgStrings[P11_KIT_ENABLED_MSG]);
|
||||
if (!PR_fgets(stdinbuf, STDINBUF_SIZE, PR_STDIN)) {
|
||||
PR_fprintf(PR_STDERR, errStrings[STDIN_READ_ERR]);
|
||||
errcode = STDIN_READ_ERR;
|
||||
goto loser;
|
||||
}
|
||||
if ((response = strtok(stdinbuf, " \r\n\t"))) {
|
||||
if (!PL_strcasecmp(response, "q")) {
|
||||
PR_fprintf(PR_STDOUT, msgStrings[ABORTING_MSG]);
|
||||
errcode = SUCCESS;
|
||||
goto loser;
|
||||
}
|
||||
}
|
||||
PR_fprintf(PR_STDOUT, "\n");
|
||||
}
|
||||
|
||||
/* Execute the command */
|
||||
switch (command) {
|
||||
case ADD_COMMAND:
|
||||
|
|
|
|||
|
|
@ -36,6 +36,7 @@ Error RawAddModule(char *dbmodulespec, char *modulespec);
|
|||
Error RawListModule(char *modulespec);
|
||||
Error SetDefaultModule(char *moduleName, char *slotName, char *mechanisms);
|
||||
Error UnsetDefaultModule(char *moduleName, char *slotName, char *mechanisms);
|
||||
PRBool IsP11KitEnabled(void);
|
||||
void out_of_memory(void);
|
||||
|
||||
#endif /*MODUTIL_H*/
|
||||
|
|
|
|||
|
|
@ -259,6 +259,55 @@ getStringFromFlags(unsigned long flags, const MaskString array[], int elements)
|
|||
return buf;
|
||||
}
|
||||
|
||||
static PRBool
|
||||
IsP11KitProxyModule(SECMODModule *module)
|
||||
{
|
||||
CK_INFO modinfo;
|
||||
static const char p11KitManufacturerID[33] =
|
||||
"PKCS#11 Kit ";
|
||||
static const char p11KitLibraryDescription[33] =
|
||||
"PKCS#11 Kit Proxy Module ";
|
||||
|
||||
if (PK11_GetModInfo(module, &modinfo) == SECSuccess &&
|
||||
PORT_Memcmp(modinfo.manufacturerID,
|
||||
p11KitManufacturerID,
|
||||
sizeof(modinfo.manufacturerID)) == 0 &&
|
||||
PORT_Memcmp(modinfo.libraryDescription,
|
||||
p11KitLibraryDescription,
|
||||
sizeof(modinfo.libraryDescription)) == 0) {
|
||||
return PR_TRUE;
|
||||
}
|
||||
|
||||
return PR_FALSE;
|
||||
}
|
||||
|
||||
PRBool
|
||||
IsP11KitEnabled(void)
|
||||
{
|
||||
SECMODListLock *lock;
|
||||
SECMODModuleList *mlp;
|
||||
PRBool found = PR_FALSE;
|
||||
|
||||
lock = SECMOD_GetDefaultModuleListLock();
|
||||
if (!lock) {
|
||||
PR_fprintf(PR_STDERR, errStrings[NO_LIST_LOCK_ERR]);
|
||||
return found;
|
||||
}
|
||||
|
||||
SECMOD_GetReadLock(lock);
|
||||
|
||||
mlp = SECMOD_GetDefaultModuleList();
|
||||
for (; mlp != NULL; mlp = mlp->next) {
|
||||
if (IsP11KitProxyModule(mlp->module)) {
|
||||
found = PR_TRUE;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
SECMOD_ReleaseReadLock(lock);
|
||||
return found;
|
||||
}
|
||||
|
||||
/**********************************************************************
|
||||
*
|
||||
* A d d M o d u l e
|
||||
|
|
|
|||
|
|
@ -10,3 +10,4 @@
|
|||
*/
|
||||
|
||||
#error "Do not include this header file."
|
||||
|
||||
|
|
|
|||
|
|
@ -258,7 +258,8 @@ Add one or multiple extensions that certutil cannot encode yet, by loading their
|
|||
|
||||
<varlistentry>
|
||||
<term>-h tokenname</term>
|
||||
<listitem><para>Specify the name of a token to use or act on. If not specified the default token is the internal database slot.</para></listitem>
|
||||
<listitem><para>Specify the name of a token to use or act on. If not specified the default token is the internal database slot.</para>
|
||||
<para>The name can also be a PKCS #11 URI. For example, the NSS internal certificate store can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB". For details about the format, see RFC 7512.</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
|
|
@ -292,7 +293,8 @@ Add one or multiple extensions that certutil cannot encode yet, by loading their
|
|||
|
||||
<varlistentry>
|
||||
<term>-n nickname</term>
|
||||
<listitem><para>Specify the nickname of a certificate or key to list, create, add to a database, modify, or validate. Bracket the nickname string with quotation marks if it contains spaces.</para></listitem>
|
||||
<listitem><para>Specify the nickname of a certificate or key to list, create, add to a database, modify, or validate. Bracket the nickname string with quotation marks if it contains spaces.</para>
|
||||
<para>The nickname can also be a PKCS #11 URI. For example, if you have a certificate named "my-server-cert" on the internal certificate store, it can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB;object=my-server-cert". For details about the format, see RFC 7512.</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
|
|
@ -1017,9 +1019,11 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
|
|||
|
||||
slot: NSS User Private Key and Certificate Services
|
||||
token: NSS Certificate DB
|
||||
uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
|
||||
|
||||
slot: NSS Internal Cryptographic Services
|
||||
token: NSS Generic Crypto Services</programlisting>
|
||||
token: NSS Generic Crypto Services
|
||||
uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203</programlisting>
|
||||
|
||||
<para><command>Adding Certificates to the Database</command></para>
|
||||
<para>
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>CERTUTIL</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="CERTUTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">CERTUTIL</th></tr></table><hr></div><div class="refentry"><a name="certutil"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>certutil — Manage keys and certificate in both NSS databases and other NSS tokens</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">certutil</code> [<em class="replaceable"><code>options</code></em>] [[<em class="replaceable"><code>arguments</code></em>]]</p></div></div><div class="refsection"><a name="idm45522631704896"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>CERTUTIL</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="CERTUTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">CERTUTIL</th></tr></table><hr></div><div class="refentry"><a name="certutil"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>certutil — Manage keys and certificate in both NSS databases and other NSS tokens</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">certutil</code> [<em class="replaceable"><code>options</code></em>] [[<em class="replaceable"><code>arguments</code></em>]]</p></div></div><div class="refsection"><a name="idm46274732654912"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The Certificate Database Tool, <span class="command"><strong>certutil</strong></span>, is a command-line utility that can create and modify certificate and key databases. It can specifically list, generate, modify, or delete certificates, create or change the password, generate new public and private key pairs, display the contents of the key database, or delete key pairs within the key database.</p><p>Certificate issuance, part of the key and certificate management process, requires that keys and certificates be created in the key database. This document discusses certificate and key database management. For information on the security module database management, see the <span class="command"><strong>modutil</strong></span> manpage.</p></div><div class="refsection"><a name="options"></a><h2>Command Options and Arguments</h2><p>Running <span class="command"><strong>certutil</strong></span> always requires one and only one command option to specify the type of certificate operation. Each command option may take zero or more arguments. The command option <code class="option">-H</code> will list all the command options and their relevant arguments.</p><p><span class="command"><strong>Command Options</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-A </span></dt><dd><p>Add an existing certificate to a certificate database. The certificate database should already exist; if one is not present, this command option will initialize one by default.</p></dd><dt><span class="term">-B</span></dt><dd><p>Run a series of commands from the specified batch file. This requires the <code class="option">-i</code> argument.</p></dd><dt><span class="term">-C </span></dt><dd><p>Create a new binary certificate file from a binary certificate request file. Use the <code class="option">-i</code> argument to specify the certificate request file. If this argument is not used, <span class="command"><strong>certutil</strong></span> prompts for a filename. </p></dd><dt><span class="term">-D </span></dt><dd><p>Delete a certificate from the certificate database.</p></dd><dt><span class="term">--rename </span></dt><dd><p>Change the database nickname of a certificate.</p></dd><dt><span class="term">-E </span></dt><dd><p>Add an email certificate to the certificate database.</p></dd><dt><span class="term">-F</span></dt><dd><p>Delete a private key and the associated certificate from a database. Specify the key to delete with the -n argument or the -k argument. Specify the database from which to delete the key with the
|
||||
<code class="option">-d</code> argument.
|
||||
</p><p>
|
||||
|
|
@ -14,13 +14,13 @@ If this option is not used, the validity check defaults to the current system ti
|
|||
Add one or multiple extensions that certutil cannot encode yet, by loading their encodings from external files.
|
||||
</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>OID (example): 1.2.3.4</p></li><li class="listitem"><p>critical-flag: critical or not-critical</p></li><li class="listitem"><p>filename: full path to a file containing an encoded extension</p></li></ul></div></dd><dt><span class="term">-f password-file</span></dt><dd><p>Specify a file that will automatically supply the password to include in a certificate
|
||||
or to access a certificate database. This is a plain-text file containing one password. Be sure to prevent
|
||||
unauthorized access to this file.</p></dd><dt><span class="term">-g keysize</span></dt><dd><p>Set a key size to use when generating new public and private key pairs. The minimum is 512 bits and the maximum is 16384 bits. The default is 2048 bits. Any size between the minimum and maximum is allowed.</p></dd><dt><span class="term">-h tokenname</span></dt><dd><p>Specify the name of a token to use or act on. If not specified the default token is the internal database slot.</p></dd><dt><span class="term">-i input_file</span></dt><dd><p>Pass an input file to the command. Depending on the command option, an input file can be a specific certificate, a certificate request file, or a batch file of commands.</p></dd><dt><span class="term">-k key-type-or-id</span></dt><dd><p>Specify the type or specific ID of a key.</p><p>
|
||||
unauthorized access to this file.</p></dd><dt><span class="term">-g keysize</span></dt><dd><p>Set a key size to use when generating new public and private key pairs. The minimum is 512 bits and the maximum is 16384 bits. The default is 2048 bits. Any size between the minimum and maximum is allowed.</p></dd><dt><span class="term">-h tokenname</span></dt><dd><p>Specify the name of a token to use or act on. If not specified the default token is the internal database slot.</p><p>The name can also be a PKCS #11 URI. For example, the NSS internal certificate store can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB". For details about the format, see RFC 7512.</p></dd><dt><span class="term">-i input_file</span></dt><dd><p>Pass an input file to the command. Depending on the command option, an input file can be a specific certificate, a certificate request file, or a batch file of commands.</p></dd><dt><span class="term">-k key-type-or-id</span></dt><dd><p>Specify the type or specific ID of a key.</p><p>
|
||||
The valid key type options are rsa, dsa, ec, or all. The default
|
||||
value is rsa. Specifying the type of key can avoid mistakes caused by
|
||||
duplicate nicknames. Giving a key type generates a new key pair;
|
||||
giving the ID of an existing key reuses that key pair (which is
|
||||
required to renew certificates).
|
||||
</p></dd><dt><span class="term">-l </span></dt><dd><p>Display detailed information when validating a certificate with the -V option.</p></dd><dt><span class="term">-m serial-number</span></dt><dd><p>Assign a unique serial number to a certificate being created. This operation should be performed by a CA. If no serial number is provided a default serial number is made from the current time. Serial numbers are limited to integers </p></dd><dt><span class="term">-n nickname</span></dt><dd><p>Specify the nickname of a certificate or key to list, create, add to a database, modify, or validate. Bracket the nickname string with quotation marks if it contains spaces.</p></dd><dt><span class="term">-o output-file</span></dt><dd><p>Specify the output file name for new certificates or binary certificate requests. Bracket the output-file string with quotation marks if it contains spaces. If this argument is not used the output destination defaults to standard output.</p></dd><dt><span class="term">-P dbPrefix</span></dt><dd><p>Specify the prefix used on the certificate and key database file. This argument is provided to support legacy servers. Most applications do not use a database prefix.</p></dd><dt><span class="term">-p phone</span></dt><dd><p>Specify a contact telephone number to include in new certificates or certificate requests. Bracket this string with quotation marks if it contains spaces.</p></dd><dt><span class="term">-q pqgfile or curve-name</span></dt><dd><p>Read an alternate PQG value from the specified file when generating DSA key pairs. If this argument is not used, <span class="command"><strong>certutil</strong></span> generates its own PQG value. PQG files are created with a separate DSA utility.</p><p>Elliptic curve name is one of the ones from nistp256, nistp384, nistp521, curve25519.</p><p>
|
||||
</p></dd><dt><span class="term">-l </span></dt><dd><p>Display detailed information when validating a certificate with the -V option.</p></dd><dt><span class="term">-m serial-number</span></dt><dd><p>Assign a unique serial number to a certificate being created. This operation should be performed by a CA. If no serial number is provided a default serial number is made from the current time. Serial numbers are limited to integers </p></dd><dt><span class="term">-n nickname</span></dt><dd><p>Specify the nickname of a certificate or key to list, create, add to a database, modify, or validate. Bracket the nickname string with quotation marks if it contains spaces.</p><p>The nickname can also be a PKCS #11 URI. For example, if you have a certificate named "my-server-cert" on the internal certificate store, it can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB;object=my-server-cert". For details about the format, see RFC 7512.</p></dd><dt><span class="term">-o output-file</span></dt><dd><p>Specify the output file name for new certificates or binary certificate requests. Bracket the output-file string with quotation marks if it contains spaces. If this argument is not used the output destination defaults to standard output.</p></dd><dt><span class="term">-P dbPrefix</span></dt><dd><p>Specify the prefix used on the certificate and key database file. This argument is provided to support legacy servers. Most applications do not use a database prefix.</p></dd><dt><span class="term">-p phone</span></dt><dd><p>Specify a contact telephone number to include in new certificates or certificate requests. Bracket this string with quotation marks if it contains spaces.</p></dd><dt><span class="term">-q pqgfile or curve-name</span></dt><dd><p>Read an alternate PQG value from the specified file when generating DSA key pairs. If this argument is not used, <span class="command"><strong>certutil</strong></span> generates its own PQG value. PQG files are created with a separate DSA utility.</p><p>Elliptic curve name is one of the ones from nistp256, nistp384, nistp521, curve25519.</p><p>
|
||||
If a token is available that supports more curves, the foolowing curves are supported as well:
|
||||
sect163k1, nistk163, sect163r1, sect163r2,
|
||||
nistb163, sect193r1, sect193r2, sect233k1, nistk233,
|
||||
|
|
@ -277,9 +277,11 @@ certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and
|
|||
|
||||
slot: NSS User Private Key and Certificate Services
|
||||
token: NSS Certificate DB
|
||||
uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
|
||||
|
||||
slot: NSS Internal Cryptographic Services
|
||||
token: NSS Generic Crypto Services</pre><p><span class="command"><strong>Adding Certificates to the Database</strong></span></p><p>
|
||||
token: NSS Generic Crypto Services
|
||||
uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203</pre><p><span class="command"><strong>Adding Certificates to the Database</strong></span></p><p>
|
||||
Existing certificates or certificate requests can be added manually to the certificate database, even if they were generated elsewhere. This uses the <code class="option">-A</code> command option.
|
||||
</p><pre class="programlisting">certutil -A -n certname -t trustargs -d [sql:]directory [-a] [-i input-file]</pre><p>
|
||||
For example:
|
||||
|
|
|
|||
Различия файлов скрыты, потому что одна или несколько строк слишком длинны
|
|
@ -1,5 +1,5 @@
|
|||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>PK12UTIL</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="PK12UTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">PK12UTIL</th></tr></table><hr></div><div class="refentry"><a name="pk12util"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>pk12util — Export and import keys and certificate to or from a PKCS #12 file and the NSS database</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">pk12util</code> [-i p12File|-l p12File|-o p12File] [-d [sql:]directory] [-h tokenname] [-P dbprefix] [-r] [-v] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</p></div></div><div class="refsection"><a name="idm139975398059856"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The PKCS #12 utility, <span class="command"><strong>pk12util</strong></span>, enables sharing certificates among any server that supports PKCS #12. The tool can import certificates and keys from PKCS #12 files into security databases, export certificates, and list certificates and keys.</p></div><div class="refsection"><a name="options"></a><h2>Options and Arguments</h2><p><span class="command"><strong>Options</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-i p12file</span></dt><dd><p>Import keys and certificates from a PKCS #12 file into a security database.</p></dd><dt><span class="term">-l p12file</span></dt><dd><p>List the keys and certificates in PKCS #12 file.</p></dd><dt><span class="term">-o p12file</span></dt><dd><p>Export keys and certificates from the security database to a PKCS #12 file.</p></dd></dl></div><p><span class="command"><strong>Arguments</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-c keyCipher</span></dt><dd><p>Specify the key encryption algorithm.</p></dd><dt><span class="term">-C certCipher</span></dt><dd><p>Specify the certiticate encryption algorithm.</p></dd><dt><span class="term">-d [sql:]directory</span></dt><dd><p>Specify the database directory into which to import to or export from certificates and keys.</p><p><span class="command"><strong>pk12util</strong></span> supports two types of databases: the legacy security databases (<code class="filename">cert8.db</code>, <code class="filename">key3.db</code>, and <code class="filename">secmod.db</code>) and new SQLite databases (<code class="filename">cert9.db</code>, <code class="filename">key4.db</code>, and <code class="filename">pkcs11.txt</code>). If the prefix <span class="command"><strong>sql:</strong></span> is not used, then the tool assumes that the given databases are in the old format.</p></dd><dt><span class="term">-h tokenname</span></dt><dd><p>Specify the name of the token to import into or export from.</p></dd><dt><span class="term">-k slotPasswordFile</span></dt><dd><p>Specify the text file containing the slot's password.</p></dd><dt><span class="term">-K slotPassword</span></dt><dd><p>Specify the slot's password.</p></dd><dt><span class="term">-m | --key-len keyLength</span></dt><dd><p>Specify the desired length of the symmetric key to be used to encrypt the private key.</p></dd><dt><span class="term">-n | --cert-key-len certKeyLength</span></dt><dd><p>Specify the desired length of the symmetric key to be used to encrypt the certificates and other meta-data.</p></dd><dt><span class="term">-n certname</span></dt><dd><p>Specify the nickname of the cert and private key to export.</p></dd><dt><span class="term">-P prefix</span></dt><dd><p>Specify the prefix used on the certificate and key databases. This option is provided as a special case.
|
||||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>PK12UTIL</title><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot"><link rel="home" href="index.html" title="PK12UTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">PK12UTIL</th></tr></table><hr></div><div class="refentry"><a name="pk12util"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>pk12util — Export and import keys and certificate to or from a PKCS #12 file and the NSS database</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">pk12util</code> [-i p12File|-l p12File|-o p12File] [-d [sql:]directory] [-h tokenname] [-P dbprefix] [-r] [-v] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]</p></div></div><div class="refsection"><a name="idm45659476549872"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The PKCS #12 utility, <span class="command"><strong>pk12util</strong></span>, enables sharing certificates among any server that supports PKCS #12. The tool can import certificates and keys from PKCS #12 files into security databases, export certificates, and list certificates and keys.</p></div><div class="refsection"><a name="options"></a><h2>Options and Arguments</h2><p><span class="command"><strong>Options</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-i p12file</span></dt><dd><p>Import keys and certificates from a PKCS #12 file into a security database.</p></dd><dt><span class="term">-l p12file</span></dt><dd><p>List the keys and certificates in PKCS #12 file.</p></dd><dt><span class="term">-o p12file</span></dt><dd><p>Export keys and certificates from the security database to a PKCS #12 file.</p></dd></dl></div><p><span class="command"><strong>Arguments</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-c keyCipher</span></dt><dd><p>Specify the key encryption algorithm.</p></dd><dt><span class="term">-C certCipher</span></dt><dd><p>Specify the certiticate encryption algorithm.</p></dd><dt><span class="term">-d [sql:]directory</span></dt><dd><p>Specify the database directory into which to import to or export from certificates and keys.</p><p><span class="command"><strong>pk12util</strong></span> supports two types of databases: the legacy security databases (<code class="filename">cert8.db</code>, <code class="filename">key3.db</code>, and <code class="filename">secmod.db</code>) and new SQLite databases (<code class="filename">cert9.db</code>, <code class="filename">key4.db</code>, and <code class="filename">pkcs11.txt</code>). If the prefix <span class="command"><strong>sql:</strong></span> is not used, then the tool assumes that the given databases are in the old format.</p></dd><dt><span class="term">-h tokenname</span></dt><dd><p>Specify the name of the token to import into or export from.</p></dd><dt><span class="term">-k slotPasswordFile</span></dt><dd><p>Specify the text file containing the slot's password.</p></dd><dt><span class="term">-K slotPassword</span></dt><dd><p>Specify the slot's password.</p></dd><dt><span class="term">-m | --key-len keyLength</span></dt><dd><p>Specify the desired length of the symmetric key to be used to encrypt the private key.</p></dd><dt><span class="term">-n | --cert-key-len certKeyLength</span></dt><dd><p>Specify the desired length of the symmetric key to be used to encrypt the certificates and other meta-data.</p></dd><dt><span class="term">-n certname</span></dt><dd><p>Specify the nickname of the cert and private key to export.</p><p>The nickname can also be a PKCS #11 URI. For example, if you have a certificate named "my-server-cert" on the internal certificate store, it can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB;object=my-server-cert". For details about the format, see RFC 7512.</p></dd><dt><span class="term">-P prefix</span></dt><dd><p>Specify the prefix used on the certificate and key databases. This option is provided as a special case.
|
||||
Changing the names of the certificate and key databases is not recommended.</p></dd><dt><span class="term">-r</span></dt><dd><p>Dumps all of the data in raw (binary) form. This must be saved as a DER file. The default is to return information in a pretty-print ASCII format, which displays the information about the certificates and public keys in the p12 file.</p></dd><dt><span class="term">-v </span></dt><dd><p>Enable debug logging when importing.</p></dd><dt><span class="term">-w p12filePasswordFile</span></dt><dd><p>Specify the text file containing the pkcs #12 file password.</p></dd><dt><span class="term">-W p12filePassword</span></dt><dd><p>Specify the pkcs #12 file password.</p></dd></dl></div></div><div class="refsection"><a name="return-codes"></a><h2>Return Codes</h2><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p> 0 - No error</p></li><li class="listitem"><p> 1 - User Cancelled</p></li><li class="listitem"><p> 2 - Usage error</p></li><li class="listitem"><p> 6 - NLS init error</p></li><li class="listitem"><p> 8 - Certificate DB open error</p></li><li class="listitem"><p> 9 - Key DB open error</p></li><li class="listitem"><p> 10 - File initialization error</p></li><li class="listitem"><p> 11 - Unicode conversion error</p></li><li class="listitem"><p> 12 - Temporary file creation error</p></li><li class="listitem"><p> 13 - PKCS11 get slot error</p></li><li class="listitem"><p> 14 - PKCS12 decoder start error</p></li><li class="listitem"><p> 15 - error read from import file</p></li><li class="listitem"><p> 16 - pkcs12 decode error</p></li><li class="listitem"><p> 17 - pkcs12 decoder verify error</p></li><li class="listitem"><p> 18 - pkcs12 decoder validate bags error</p></li><li class="listitem"><p> 19 - pkcs12 decoder import bags error</p></li><li class="listitem"><p> 20 - key db conversion version 3 to version 2 error</p></li><li class="listitem"><p> 21 - cert db conversion version 7 to version 5 error</p></li><li class="listitem"><p> 22 - cert and key dbs patch error</p></li><li class="listitem"><p> 23 - get default cert db error</p></li><li class="listitem"><p> 24 - find cert by nickname error</p></li><li class="listitem"><p> 25 - create export context error</p></li><li class="listitem"><p> 26 - PKCS12 add password itegrity error</p></li><li class="listitem"><p> 27 - cert and key Safes creation error</p></li><li class="listitem"><p> 28 - PKCS12 add cert and key error</p></li><li class="listitem"><p> 29 - PKCS12 encode error</p></li></ul></div></div><div class="refsection"><a name="examples"></a><h2>Examples</h2><p><span class="command"><strong>Importing Keys and Certificates</strong></span></p><p>The most basic usage of <span class="command"><strong>pk12util</strong></span> for importing a certificate or key is the PKCS #12 input file (<code class="option">-i</code>) and some way to specify the security database being accessed (either <code class="option">-d</code> for a directory or <code class="option">-h</code> for a token).
|
||||
</p><p>
|
||||
pk12util -i p12File [-h tokenname] [-v] [-d [sql:]directory] [-P dbprefix] [-k slotPasswordFile|-K slotPassword] [-w p12filePasswordFile|-W p12filePassword]
|
||||
|
|
|
|||
|
|
@ -322,9 +322,11 @@ Listing of PKCS #11 Modules
|
|||
|
||||
slot: NSS Internal Cryptographic Services
|
||||
token: NSS Generic Crypto Services
|
||||
uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
|
||||
|
||||
slot: NSS User Private Key and Certificate Services
|
||||
token: NSS Certificate DB
|
||||
uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
|
||||
-----------------------------------------------------------</programlisting>
|
||||
<para>Passing a specific module name with the <option>-list</option> returns details information about the module itself, like supported cipher mechanisms, version numbers, serial numbers, and other information about the module and the token it is loaded on. For example:</para>
|
||||
<programlisting> modutil -list "NSS Internal PKCS #11 Module" -dbdir sql:/home/my/sharednssdb
|
||||
|
|
|
|||
|
|
@ -317,6 +317,8 @@ Set a key size to use when generating new public and private key pairs\&. The mi
|
|||
\-h tokenname
|
||||
.RS 4
|
||||
Specify the name of a token to use or act on\&. If not specified the default token is the internal database slot\&.
|
||||
.sp
|
||||
The name can also be a PKCS #11 URI\&. For example, the NSS internal certificate store can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB"\&. For details about the format, see RFC 7512\&.
|
||||
.RE
|
||||
.PP
|
||||
\-i input_file
|
||||
|
|
@ -344,6 +346,8 @@ Assign a unique serial number to a certificate being created\&. This operation s
|
|||
\-n nickname
|
||||
.RS 4
|
||||
Specify the nickname of a certificate or key to list, create, add to a database, modify, or validate\&. Bracket the nickname string with quotation marks if it contains spaces\&.
|
||||
.sp
|
||||
The nickname can also be a PKCS #11 URI\&. For example, if you have a certificate named "my\-server\-cert" on the internal certificate store, it can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB;object=my\-server\-cert"\&. For details about the format, see RFC 7512\&.
|
||||
.RE
|
||||
.PP
|
||||
\-o output\-file
|
||||
|
|
@ -1575,9 +1579,11 @@ $ certutil \-U \-d sql:/home/my/sharednssdb
|
|||
|
||||
slot: NSS User Private Key and Certificate Services
|
||||
token: NSS Certificate DB
|
||||
uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
|
||||
|
||||
slot: NSS Internal Cryptographic Services
|
||||
token: NSS Generic Crypto Services
|
||||
uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
'\" t
|
||||
.\" Title: MODUTIL
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 5 June 2014
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 5 October 2017
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "MODUTIL" "1" "5 June 2014" "nss-tools" "NSS Security Tools"
|
||||
.TH "MODUTIL" "1" "5 October 2017" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
@ -515,9 +515,11 @@ Listing of PKCS #11 Modules
|
|||
|
||||
slot: NSS Internal Cryptographic Services
|
||||
token: NSS Generic Crypto Services
|
||||
uri: pkcs11:token=NSS%20Generic%20Crypto%20Services;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
|
||||
|
||||
slot: NSS User Private Key and Certificate Services
|
||||
token: NSS Certificate DB
|
||||
uri: pkcs11:token=NSS%20Certificate%20DB;manufacturer=Mozilla%20Foundation;serial=0000000000000000;model=NSS%203
|
||||
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-
|
||||
.fi
|
||||
.if n \{\
|
||||
|
|
|
|||
|
|
@ -2,12 +2,12 @@
|
|||
.\" Title: PK12UTIL
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
|
||||
.\" Date: 27 October 2017
|
||||
.\" Date: 5 October 2017
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "PK12UTIL" "1" "27 October 2017" "nss-tools" "NSS Security Tools"
|
||||
.TH "PK12UTIL" "1" "5 October 2017" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
@ -113,6 +113,8 @@ Specify the desired length of the symmetric key to be used to encrypt the certif
|
|||
\-n certname
|
||||
.RS 4
|
||||
Specify the nickname of the cert and private key to export\&.
|
||||
.sp
|
||||
The nickname can also be a PKCS #11 URI\&. For example, if you have a certificate named "my\-server\-cert" on the internal certificate store, it can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB;object=my\-server\-cert"\&. For details about the format, see RFC 7512\&.
|
||||
.RE
|
||||
.PP
|
||||
\-P prefix
|
||||
|
|
|
|||
|
|
@ -114,7 +114,8 @@
|
|||
|
||||
<varlistentry>
|
||||
<term>-n certname</term>
|
||||
<listitem><para>Specify the nickname of the cert and private key to export.</para></listitem>
|
||||
<listitem><para>Specify the nickname of the cert and private key to export.</para>
|
||||
<para>The nickname can also be a PKCS #11 URI. For example, if you have a certificate named "my-server-cert" on the internal certificate store, it can be unambiguously specified as "pkcs11:token=NSS%20Certificate%20DB;object=my-server-cert". For details about the format, see RFC 7512.</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
|
|
|
|||
|
|
@ -64,7 +64,8 @@
|
|||
"RequireAnyClientCertificate-TLS1*":"Bug 1339387",
|
||||
"SendExtensionOnClientCertificate-TLS13":"Bug 1339392",
|
||||
"ALPNClient-Mismatch-TLS13":"NSS sends alerts in response to errors in protected handshake messages in the clear",
|
||||
"P224-Server":"NSS doesn't support P-224"
|
||||
"P224-Server":"NSS doesn't support P-224",
|
||||
"ClientAuth-SHA1-Fallback*":"Boring wants us to fall back to SHA-1 if supported_signature_algorithms in CR is empty."
|
||||
},
|
||||
"ErrorMap" : {
|
||||
":HANDSHAKE_FAILURE_ON_CLIENT_HELLO:":"SSL_ERROR_NO_CYPHER_OVERLAP",
|
||||
|
|
|
|||
|
|
@ -386,9 +386,9 @@ class TlsZeroCertificateRequestSigAlgsFilter : public TlsHandshakeFilter {
|
|||
}
|
||||
};
|
||||
|
||||
// Check that we fall back to SHA-1 when the server doesn't provide any
|
||||
// Check that we send an alert when the server doesn't provide any
|
||||
// supported_signature_algorithms in the CertificateRequest message.
|
||||
TEST_P(TlsConnectTls12, ClientAuthNoSigAlgsFallback) {
|
||||
TEST_P(TlsConnectTls12, ClientAuthNoSigAlgs) {
|
||||
EnsureTlsSetup();
|
||||
MakeTlsFilter<TlsZeroCertificateRequestSigAlgsFilter>(server_);
|
||||
auto capture_cert_verify = MakeTlsFilter<TlsHandshakeRecorder>(
|
||||
|
|
@ -396,15 +396,10 @@ TEST_P(TlsConnectTls12, ClientAuthNoSigAlgsFallback) {
|
|||
client_->SetupClientAuth();
|
||||
server_->RequestClientAuth(true);
|
||||
|
||||
ConnectExpectAlert(server_, kTlsAlertDecryptError);
|
||||
ConnectExpectAlert(client_, kTlsAlertHandshakeFailure);
|
||||
|
||||
// We're expecting a bad signature here because we tampered with a handshake
|
||||
// message (CertReq). Previously, without the SHA-1 fallback, we would've
|
||||
// seen a malformed record alert.
|
||||
server_->CheckErrorCode(SEC_ERROR_BAD_SIGNATURE);
|
||||
client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT);
|
||||
|
||||
CheckSigScheme(capture_cert_verify, 0, server_, ssl_sig_rsa_pkcs1_sha1, 1024);
|
||||
server_->CheckErrorCode(SSL_ERROR_HANDSHAKE_FAILURE_ALERT);
|
||||
client_->CheckErrorCode(SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM);
|
||||
}
|
||||
|
||||
static const SSLSignatureScheme kSignatureSchemeEcdsaSha384[] = {
|
||||
|
|
|
|||
|
|
@ -718,6 +718,86 @@ TEST_F(TlsConnectStreamTls13, RetryStatelessDamageSecondClientHello) {
|
|||
client_->CheckErrorCode(SSL_ERROR_BAD_MAC_READ);
|
||||
}
|
||||
|
||||
// Stream because SSL_SendSessionTicket only supports that.
|
||||
TEST_F(TlsConnectStreamTls13, SecondClientHelloSendSameTicket) {
|
||||
// This simulates the scenario described at:
|
||||
// https://bugzilla.mozilla.org/show_bug.cgi?id=1481271#c7
|
||||
//
|
||||
// Here two connections are interleaved. Tickets are issued on one
|
||||
// connection. A HelloRetryRequest is triggered on the second connection,
|
||||
// meaning that there are two ClientHellos. We need to check that both
|
||||
// ClientHellos have the same ticket, even if a new ticket is issued on the
|
||||
// other connection in the meantime.
|
||||
//
|
||||
// Connection 1: <handshake>
|
||||
// Connection 1: S->C: NST=X
|
||||
// Connection 2: C->S: CH [PSK_ID=X]
|
||||
// Connection 1: S->C: NST=Y
|
||||
// Connection 2: S->C: HRR
|
||||
// Connection 2: C->S: CH [PSK_ID=Y]
|
||||
|
||||
// Connection 1, send a ticket after handshake is complete.
|
||||
ConfigureSessionCache(RESUME_TICKET, RESUME_TICKET);
|
||||
|
||||
Connect();
|
||||
|
||||
// Set this token so that RetryHelloWithToken() will check that this
|
||||
// is the token that it receives in the HelloRetryRequest callback.
|
||||
EXPECT_EQ(SECSuccess,
|
||||
SSL_SendSessionTicket(server_->ssl_fd(), kApplicationToken,
|
||||
sizeof(kApplicationToken)));
|
||||
SendReceive(50);
|
||||
|
||||
// Connection 2, trigger HRR.
|
||||
auto client2 =
|
||||
std::make_shared<TlsAgent>(client_->name(), TlsAgent::CLIENT, variant_);
|
||||
auto server2 =
|
||||
std::make_shared<TlsAgent>(server_->name(), TlsAgent::SERVER, variant_);
|
||||
|
||||
client2->SetPeer(server2);
|
||||
server2->SetPeer(client2);
|
||||
|
||||
client_.swap(client2);
|
||||
server_.swap(server2);
|
||||
|
||||
ConfigureSessionCache(RESUME_TICKET, RESUME_TICKET);
|
||||
|
||||
ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
|
||||
|
||||
client_->StartConnect();
|
||||
server_->StartConnect();
|
||||
|
||||
size_t cb_called = 0;
|
||||
EXPECT_EQ(SECSuccess,
|
||||
SSL_HelloRetryRequestCallback(server_->ssl_fd(),
|
||||
RetryHelloWithToken, &cb_called));
|
||||
client_->Handshake(); // Send ClientHello.
|
||||
server_->Handshake(); // Process ClientHello, send HelloRetryRequest.
|
||||
|
||||
EXPECT_EQ(1U, cb_called) << "callback should be called once here";
|
||||
|
||||
// Connection 1, send another ticket.
|
||||
client_.swap(client2);
|
||||
server_.swap(server2);
|
||||
|
||||
// If the client uses this token, RetryHelloWithToken() will fail the test.
|
||||
const uint8_t kAnotherApplicationToken[] = {0x92, 0x44, 0x01};
|
||||
EXPECT_EQ(SECSuccess,
|
||||
SSL_SendSessionTicket(server_->ssl_fd(), kAnotherApplicationToken,
|
||||
sizeof(kAnotherApplicationToken)));
|
||||
SendReceive(60);
|
||||
|
||||
// Connection 2, continue the handshake.
|
||||
// The client should use kApplicationToken, not kAnotherApplicationToken.
|
||||
client_.swap(client2);
|
||||
server_.swap(server2);
|
||||
|
||||
client_->Handshake();
|
||||
server_->Handshake();
|
||||
|
||||
EXPECT_EQ(2U, cb_called) << "callback should be called twice here";
|
||||
}
|
||||
|
||||
// Read the cipher suite from the HRR and disable it on the identified agent.
|
||||
static void DisableSuiteFromHrr(
|
||||
std::shared_ptr<TlsAgent>& agent,
|
||||
|
|
|
|||
|
|
@ -1272,4 +1272,34 @@ TEST_P(TlsConnectGenericResumption, ConnectResumeClientAuth) {
|
|||
SendReceive();
|
||||
}
|
||||
|
||||
TEST_F(TlsConnectStreamTls13, ExternalTokenAfterHrr) {
|
||||
ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
|
||||
Connect();
|
||||
SendReceive();
|
||||
|
||||
Reset();
|
||||
ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
|
||||
ExpectResumption(RESUME_TICKET);
|
||||
|
||||
static const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1,
|
||||
ssl_grp_ec_secp521r1};
|
||||
server_->ConfigNamedGroups(groups);
|
||||
|
||||
StartConnect();
|
||||
ASSERT_TRUE(client_->MaybeSetResumptionToken());
|
||||
|
||||
client_->Handshake(); // Send ClientHello.
|
||||
server_->Handshake(); // Process ClientHello, send HelloRetryRequest.
|
||||
|
||||
auto& token = client_->GetResumptionToken();
|
||||
SECStatus rv =
|
||||
SSL_SetResumptionToken(client_->ssl_fd(), token.data(), token.size());
|
||||
ASSERT_EQ(SECFailure, rv);
|
||||
ASSERT_EQ(SEC_ERROR_INVALID_ARGS, PORT_GetError());
|
||||
|
||||
Handshake();
|
||||
CheckConnected();
|
||||
SendReceive();
|
||||
}
|
||||
|
||||
} // namespace nss_test
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@
|
|||
#include "pkim.h"
|
||||
#include "pki3hack.h"
|
||||
#include "base.h"
|
||||
#include "keyhi.h"
|
||||
#include "keyi.h"
|
||||
|
||||
/*
|
||||
* Check the validity times of a certificate
|
||||
|
|
@ -73,12 +73,38 @@ checkKeyParams(const SECAlgorithmID *sigAlgorithm, const SECKEYPublicKey *key)
|
|||
return SECFailure;
|
||||
}
|
||||
return SECSuccess;
|
||||
|
||||
case SEC_OID_PKCS1_RSA_PSS_SIGNATURE: {
|
||||
PORTCheapArenaPool tmpArena;
|
||||
SECOidTag hashAlg;
|
||||
SECOidTag maskHashAlg;
|
||||
|
||||
PORT_InitCheapArena(&tmpArena, DER_DEFAULT_CHUNKSIZE);
|
||||
rv = sec_DecodeRSAPSSParams(&tmpArena.arena,
|
||||
&sigAlgorithm->parameters,
|
||||
&hashAlg, &maskHashAlg, NULL);
|
||||
PORT_DestroyCheapArena(&tmpArena);
|
||||
if (rv != SECSuccess) {
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
if (NSS_GetAlgorithmPolicy(hashAlg, &policyFlags) == SECSuccess &&
|
||||
!(policyFlags & NSS_USE_ALG_IN_CERT_SIGNATURE)) {
|
||||
PORT_SetError(SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED);
|
||||
return SECFailure;
|
||||
}
|
||||
if (NSS_GetAlgorithmPolicy(maskHashAlg, &policyFlags) == SECSuccess &&
|
||||
!(policyFlags & NSS_USE_ALG_IN_CERT_SIGNATURE)) {
|
||||
PORT_SetError(SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED);
|
||||
return SECFailure;
|
||||
}
|
||||
}
|
||||
/* fall through to RSA key checking */
|
||||
case SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION:
|
||||
case SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION:
|
||||
case SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION:
|
||||
case SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION:
|
||||
case SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION:
|
||||
case SEC_OID_PKCS1_RSA_PSS_SIGNATURE:
|
||||
case SEC_OID_ISO_SHA_WITH_RSA_SIGNATURE:
|
||||
case SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE:
|
||||
if (key->keyType != rsaKey && key->keyType != rsaPssKey) {
|
||||
|
|
|
|||
|
|
@ -17,8 +17,21 @@ KeyType seckey_GetKeyType(SECOidTag pubKeyOid);
|
|||
SECStatus sec_DecodeSigAlg(const SECKEYPublicKey *key, SECOidTag sigAlg,
|
||||
const SECItem *param, SECOidTag *encalg, SECOidTag *hashalg);
|
||||
|
||||
SECStatus sec_RSAPSSParamsToMechanism(CK_RSA_PKCS_PSS_PARAMS *mech,
|
||||
const SECKEYRSAPSSParams *params);
|
||||
/* extract the RSA-PSS hash algorithms and salt length from
|
||||
* parameters, taking into account of the default implications.
|
||||
*
|
||||
* (parameters is the parameters field of a algorithm ID structure
|
||||
* (SECAlgorithmID)*/
|
||||
SECStatus sec_DecodeRSAPSSParams(PLArenaPool *arena,
|
||||
const SECItem *params,
|
||||
SECOidTag *hashAlg,
|
||||
SECOidTag *maskHashAlg,
|
||||
unsigned long *saltLength);
|
||||
|
||||
/* convert the encoded RSA-PSS parameters into PKCS #11 mechanism parameters */
|
||||
SECStatus sec_DecodeRSAPSSParamsToMechanism(PLArenaPool *arena,
|
||||
const SECItem *params,
|
||||
CK_RSA_PKCS_PSS_PARAMS *mech);
|
||||
|
||||
SEC_END_PROTOS
|
||||
|
||||
|
|
|
|||
|
|
@ -2015,66 +2015,63 @@ sec_GetMgfTypeByOidTag(SECOidTag tag)
|
|||
}
|
||||
|
||||
SECStatus
|
||||
sec_RSAPSSParamsToMechanism(CK_RSA_PKCS_PSS_PARAMS *mech,
|
||||
const SECKEYRSAPSSParams *params)
|
||||
sec_DecodeRSAPSSParams(PLArenaPool *arena,
|
||||
const SECItem *params,
|
||||
SECOidTag *retHashAlg, SECOidTag *retMaskHashAlg,
|
||||
unsigned long *retSaltLength)
|
||||
{
|
||||
SECStatus rv = SECSuccess;
|
||||
SECOidTag hashAlgTag;
|
||||
SECKEYRSAPSSParams pssParams;
|
||||
SECOidTag hashAlg;
|
||||
SECOidTag maskHashAlg;
|
||||
unsigned long saltLength;
|
||||
unsigned long trailerField;
|
||||
SECStatus rv;
|
||||
|
||||
PORT_Memset(mech, 0, sizeof(CK_RSA_PKCS_PSS_PARAMS));
|
||||
PORT_Memset(&pssParams, 0, sizeof(pssParams));
|
||||
rv = SEC_QuickDERDecodeItem(arena, &pssParams,
|
||||
SECKEY_RSAPSSParamsTemplate,
|
||||
params);
|
||||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
}
|
||||
|
||||
if (params->hashAlg) {
|
||||
hashAlgTag = SECOID_GetAlgorithmTag(params->hashAlg);
|
||||
if (pssParams.hashAlg) {
|
||||
hashAlg = SECOID_GetAlgorithmTag(pssParams.hashAlg);
|
||||
} else {
|
||||
hashAlgTag = SEC_OID_SHA1; /* default, SHA-1 */
|
||||
}
|
||||
mech->hashAlg = sec_GetHashMechanismByOidTag(hashAlgTag);
|
||||
if (mech->hashAlg == CKM_INVALID_MECHANISM) {
|
||||
return SECFailure;
|
||||
hashAlg = SEC_OID_SHA1; /* default, SHA-1 */
|
||||
}
|
||||
|
||||
if (params->maskAlg) {
|
||||
SECAlgorithmID maskHashAlg;
|
||||
SECOidTag maskHashAlgTag;
|
||||
PORTCheapArenaPool tmpArena;
|
||||
if (pssParams.maskAlg) {
|
||||
SECAlgorithmID algId;
|
||||
|
||||
if (SECOID_GetAlgorithmTag(params->maskAlg) != SEC_OID_PKCS1_MGF1) {
|
||||
if (SECOID_GetAlgorithmTag(pssParams.maskAlg) != SEC_OID_PKCS1_MGF1) {
|
||||
/* only MGF1 is known to PKCS#11 */
|
||||
PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
PORT_InitCheapArena(&tmpArena, DER_DEFAULT_CHUNKSIZE);
|
||||
rv = SEC_QuickDERDecodeItem(&tmpArena.arena, &maskHashAlg,
|
||||
rv = SEC_QuickDERDecodeItem(arena, &algId,
|
||||
SEC_ASN1_GET(SECOID_AlgorithmIDTemplate),
|
||||
¶ms->maskAlg->parameters);
|
||||
PORT_DestroyCheapArena(&tmpArena);
|
||||
&pssParams.maskAlg->parameters);
|
||||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
}
|
||||
maskHashAlgTag = SECOID_GetAlgorithmTag(&maskHashAlg);
|
||||
mech->mgf = sec_GetMgfTypeByOidTag(maskHashAlgTag);
|
||||
if (mech->mgf == 0) {
|
||||
return SECFailure;
|
||||
}
|
||||
maskHashAlg = SECOID_GetAlgorithmTag(&algId);
|
||||
} else {
|
||||
mech->mgf = CKG_MGF1_SHA1; /* default, MGF1 with SHA-1 */
|
||||
maskHashAlg = SEC_OID_SHA1; /* default, MGF1 with SHA-1 */
|
||||
}
|
||||
|
||||
if (params->saltLength.data) {
|
||||
rv = SEC_ASN1DecodeInteger((SECItem *)¶ms->saltLength, &saltLength);
|
||||
if (pssParams.saltLength.data) {
|
||||
rv = SEC_ASN1DecodeInteger((SECItem *)&pssParams.saltLength, &saltLength);
|
||||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
}
|
||||
} else {
|
||||
saltLength = 20; /* default, 20 */
|
||||
}
|
||||
mech->sLen = saltLength;
|
||||
|
||||
if (params->trailerField.data) {
|
||||
rv = SEC_ASN1DecodeInteger((SECItem *)¶ms->trailerField, &trailerField);
|
||||
if (pssParams.trailerField.data) {
|
||||
rv = SEC_ASN1DecodeInteger((SECItem *)&pssParams.trailerField, &trailerField);
|
||||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
}
|
||||
|
|
@ -2086,5 +2083,46 @@ sec_RSAPSSParamsToMechanism(CK_RSA_PKCS_PSS_PARAMS *mech,
|
|||
}
|
||||
}
|
||||
|
||||
return rv;
|
||||
if (retHashAlg) {
|
||||
*retHashAlg = hashAlg;
|
||||
}
|
||||
if (retMaskHashAlg) {
|
||||
*retMaskHashAlg = maskHashAlg;
|
||||
}
|
||||
if (retSaltLength) {
|
||||
*retSaltLength = saltLength;
|
||||
}
|
||||
|
||||
return SECSuccess;
|
||||
}
|
||||
|
||||
SECStatus
|
||||
sec_DecodeRSAPSSParamsToMechanism(PLArenaPool *arena,
|
||||
const SECItem *params,
|
||||
CK_RSA_PKCS_PSS_PARAMS *mech)
|
||||
{
|
||||
SECOidTag hashAlg;
|
||||
SECOidTag maskHashAlg;
|
||||
unsigned long saltLength;
|
||||
SECStatus rv;
|
||||
|
||||
rv = sec_DecodeRSAPSSParams(arena, params,
|
||||
&hashAlg, &maskHashAlg, &saltLength);
|
||||
if (rv != SECSuccess) {
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
mech->hashAlg = sec_GetHashMechanismByOidTag(hashAlg);
|
||||
if (mech->hashAlg == CKM_INVALID_MECHANISM) {
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
mech->mgf = sec_GetMgfTypeByOidTag(maskHashAlg);
|
||||
if (mech->mgf == 0) {
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
mech->sLen = saltLength;
|
||||
|
||||
return SECSuccess;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -225,22 +225,13 @@ SGN_End(SGNContext *cx, SECItem *result)
|
|||
PORT_Memset(&mech, 0, sizeof(mech));
|
||||
|
||||
if (cx->params && cx->params->data) {
|
||||
SECKEYRSAPSSParams params;
|
||||
|
||||
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
||||
if (!arena) {
|
||||
rv = SECFailure;
|
||||
goto loser;
|
||||
}
|
||||
|
||||
PORT_Memset(¶ms, 0, sizeof(params));
|
||||
rv = SEC_QuickDERDecodeItem(arena, ¶ms,
|
||||
SECKEY_RSAPSSParamsTemplate,
|
||||
cx->params);
|
||||
if (rv != SECSuccess) {
|
||||
goto loser;
|
||||
}
|
||||
rv = sec_RSAPSSParamsToMechanism(&mech, ¶ms);
|
||||
rv = sec_DecodeRSAPSSParamsToMechanism(arena, cx->params, &mech);
|
||||
if (rv != SECSuccess) {
|
||||
goto loser;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -257,25 +257,13 @@ sec_DecodeSigAlg(const SECKEYPublicKey *key, SECOidTag sigAlg,
|
|||
break;
|
||||
case SEC_OID_PKCS1_RSA_PSS_SIGNATURE:
|
||||
if (param && param->data) {
|
||||
SECKEYRSAPSSParams pssParam;
|
||||
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
||||
if (arena == NULL) {
|
||||
return SECFailure;
|
||||
}
|
||||
PORT_Memset(&pssParam, 0, sizeof pssParam);
|
||||
rv = SEC_QuickDERDecodeItem(arena, &pssParam,
|
||||
SECKEY_RSAPSSParamsTemplate,
|
||||
param);
|
||||
if (rv != SECSuccess) {
|
||||
PORT_FreeArena(arena, PR_FALSE);
|
||||
return rv;
|
||||
}
|
||||
if (pssParam.hashAlg) {
|
||||
*hashalg = SECOID_GetAlgorithmTag(pssParam.hashAlg);
|
||||
} else {
|
||||
*hashalg = SEC_OID_SHA1; /* default, SHA-1 */
|
||||
}
|
||||
PORT_FreeArena(arena, PR_FALSE);
|
||||
PORTCheapArenaPool tmpArena;
|
||||
|
||||
PORT_InitCheapArena(&tmpArena, DER_DEFAULT_CHUNKSIZE);
|
||||
rv = sec_DecodeRSAPSSParams(&tmpArena.arena, param,
|
||||
hashalg, NULL, NULL);
|
||||
PORT_DestroyCheapArena(&tmpArena);
|
||||
|
||||
/* only accept hash algorithms */
|
||||
if (HASH_GetHashTypeByOidTag(*hashalg) == HASH_AlgNULL) {
|
||||
/* error set by HASH_GetHashTypeByOidTag */
|
||||
|
|
@ -658,27 +646,17 @@ VFY_EndWithSignature(VFYContext *cx, SECItem *sig)
|
|||
if (cx->encAlg == SEC_OID_PKCS1_RSA_PSS_SIGNATURE) {
|
||||
CK_RSA_PKCS_PSS_PARAMS mech;
|
||||
SECItem mechItem = { siBuffer, (unsigned char *)&mech, sizeof(mech) };
|
||||
SECKEYRSAPSSParams params;
|
||||
PLArenaPool *arena;
|
||||
PORTCheapArenaPool tmpArena;
|
||||
|
||||
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
||||
if (arena == NULL) {
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
PORT_Memset(¶ms, 0, sizeof(params));
|
||||
rv = SEC_QuickDERDecodeItem(arena, ¶ms,
|
||||
SECKEY_RSAPSSParamsTemplate,
|
||||
cx->params);
|
||||
if (rv != SECSuccess) {
|
||||
PORT_FreeArena(arena, PR_FALSE);
|
||||
return SECFailure;
|
||||
}
|
||||
rv = sec_RSAPSSParamsToMechanism(&mech, ¶ms);
|
||||
PORT_FreeArena(arena, PR_FALSE);
|
||||
PORT_InitCheapArena(&tmpArena, DER_DEFAULT_CHUNKSIZE);
|
||||
rv = sec_DecodeRSAPSSParamsToMechanism(&tmpArena.arena,
|
||||
cx->params,
|
||||
&mech);
|
||||
PORT_DestroyCheapArena(&tmpArena);
|
||||
if (rv != SECSuccess) {
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
rsasig.data = cx->u.buffer;
|
||||
rsasig.len = SECKEY_SignatureLen(cx->key);
|
||||
if (rsasig.len == 0) {
|
||||
|
|
|
|||
|
|
@ -4774,6 +4774,10 @@ ssl3_SendClientHello(sslSocket *ss, sslClientHelloType type)
|
|||
sid = ssl_ReferenceSID(ss->sec.ci.sid);
|
||||
SSL_TRC(3, ("%d: SSL3[%d]: using external resumption token in ClientHello",
|
||||
SSL_GETPID(), ss->fd));
|
||||
} else if (ss->sec.ci.sid && ss->statelessResume && type == client_hello_retry) {
|
||||
/* If we are sending a second ClientHello, reuse the same SID
|
||||
* as the original one. */
|
||||
sid = ssl_ReferenceSID(ss->sec.ci.sid);
|
||||
} else if (!ss->opt.noCache) {
|
||||
/* We ignore ss->sec.ci.sid here, and use ssl_Lookup because Lookup
|
||||
* handles expired entries and other details.
|
||||
|
|
@ -6167,16 +6171,12 @@ ssl_PickClientSignatureScheme(sslSocket *ss, const SSLSignatureScheme *schemes,
|
|||
|
||||
PORT_Assert(pubKey);
|
||||
|
||||
if (!isTLS13 && numSchemes == 0) {
|
||||
/* If the server didn't provide any signature algorithms
|
||||
* then let's assume they support SHA-1. */
|
||||
rv = ssl_PickFallbackSignatureScheme(ss, pubKey);
|
||||
SECKEY_DestroyPublicKey(pubKey);
|
||||
return rv;
|
||||
if (ss->version >= SSL_LIBRARY_VERSION_TLS_1_2) {
|
||||
/* We should have already checked that a signature scheme was
|
||||
* listed in the request. */
|
||||
PORT_Assert(schemes && numSchemes > 0);
|
||||
}
|
||||
|
||||
PORT_Assert(schemes && numSchemes > 0);
|
||||
|
||||
if (!isTLS13 &&
|
||||
(SECKEY_GetPublicKeyType(pubKey) == rsaKey ||
|
||||
SECKEY_GetPublicKeyType(pubKey) == dsaKey) &&
|
||||
|
|
@ -7327,6 +7327,11 @@ ssl3_HandleCertificateRequest(sslSocket *ss, PRUint8 *b, PRUint32 length)
|
|||
PORT_SetError(SSL_ERROR_RX_MALFORMED_CERT_REQUEST);
|
||||
goto loser; /* malformed, alert has been sent */
|
||||
}
|
||||
if (signatureSchemeCount == 0) {
|
||||
errCode = SSL_ERROR_UNSUPPORTED_SIGNATURE_ALGORITHM;
|
||||
desc = handshake_failure;
|
||||
goto alert_loser;
|
||||
}
|
||||
}
|
||||
|
||||
rv = ssl3_ParseCertificateRequestCAs(ss, &b, &length, &ca_list);
|
||||
|
|
|
|||
|
|
@ -2561,6 +2561,43 @@ cert_test_orphan_key_reuse()
|
|||
fi
|
||||
}
|
||||
|
||||
cert_test_rsapss_policy()
|
||||
{
|
||||
CERTSERIAL=`expr $CERTSERIAL + 1`
|
||||
|
||||
CERTNAME="TestUser-rsa-pss-policy"
|
||||
|
||||
# Subject certificate: RSA-PSS
|
||||
# Issuer certificate: RSA
|
||||
# Signature: RSA-PSS (explicit, with --pss-sign and -Z SHA1)
|
||||
CU_ACTION="Generate Cert Request for $CERTNAME"
|
||||
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
|
||||
certu -R -d "${PROFILEDIR}" -f "${R_PWFILE}" -z "${R_NOISE_FILE}" --pss -o req 2>&1
|
||||
|
||||
CU_ACTION="Sign ${CERTNAME}'s Request"
|
||||
certu -C -c "TestCA" --pss-sign -Z SHA1 -m "${CERTSERIAL}" -v 60 -d "${P_R_CADIR}" \
|
||||
-i req -o "${CERTNAME}.cert" -f "${R_PWFILE}" "$1" 2>&1
|
||||
|
||||
CU_ACTION="Import $CERTNAME's Cert"
|
||||
certu -A -n "$CERTNAME" -t ",," -d "${PROFILEDIR}" -f "${R_PWFILE}" \
|
||||
-i "${CERTNAME}.cert" 2>&1
|
||||
|
||||
CU_ACTION="Verify $CERTNAME's Cert"
|
||||
certu -V -n "TestUser-rsa-pss-policy" -u V -V -e -d "${PROFILEDIR}" -f "${R_PWFILE}"
|
||||
|
||||
CU_ACTION="Verify $CERTNAME's Cert with Policy"
|
||||
cp ${PROFILEDIR}/pkcs11.txt pkcs11.txt.orig
|
||||
cat >> ${PROFILEDIR}/pkcs11.txt << ++EOF++
|
||||
library=
|
||||
name=Policy
|
||||
config="disallow=SHA1"
|
||||
++EOF++
|
||||
RETEXPECTED=255
|
||||
certu -V -n "TestUser-rsa-pss-policy" -u V -V -e -d "${PROFILEDIR}" -f "${R_PWFILE}"
|
||||
RETEXPECTED=0
|
||||
cp pkcs11.txt.orig ${PROFILEDIR}/pkcs11.txt
|
||||
}
|
||||
|
||||
############################## cert_cleanup ############################
|
||||
# local shell function to finish this script (no exit since it might be
|
||||
# sourced)
|
||||
|
|
@ -2596,6 +2633,9 @@ cert_test_password
|
|||
cert_test_distrust
|
||||
cert_test_ocspresp
|
||||
cert_test_rsapss
|
||||
if [ "${TEST_MODE}" = "SHARED_DB" ] ; then
|
||||
cert_test_rsapss_policy
|
||||
fi
|
||||
cert_test_token_uri
|
||||
|
||||
if [ -z "$NSS_TEST_DISABLE_CRL" ] ; then
|
||||
|
|
|
|||
|
|
@ -399,7 +399,11 @@ class DesktopUnittest(TestingMixin, MercurialScript, MozbaseMixin,
|
|||
# Ignore chunking if we have user specified test paths
|
||||
if not (self.verify_enabled or self.per_test_coverage):
|
||||
if os.environ.get('MOZHARNESS_TEST_PATHS'):
|
||||
base_cmd.extend(os.environ['MOZHARNESS_TEST_PATHS'].split(':'))
|
||||
test_paths = os.environ['MOZHARNESS_TEST_PATHS'].split(':')
|
||||
if suite_category == 'reftest':
|
||||
test_paths = [os.path.join(dirs['abs_reftest_dir'], 'tests', p)
|
||||
for p in test_paths]
|
||||
base_cmd.extend(test_paths)
|
||||
elif c.get('total_chunks') and c.get('this_chunk'):
|
||||
base_cmd.extend(['--total-chunks', c['total_chunks'],
|
||||
'--this-chunk', c['this_chunk']])
|
||||
|
|
@ -795,7 +799,9 @@ class DesktopUnittest(TestingMixin, MercurialScript, MozbaseMixin,
|
|||
}
|
||||
if isinstance(suites[suite], dict):
|
||||
options_list = suites[suite].get('options', [])
|
||||
if self.verify_enabled or self.per_test_coverage:
|
||||
if (self.verify_enabled or self.per_test_coverage or
|
||||
os.environ.get('MOZHARNESS_TEST_PATHS')):
|
||||
# Ignore tests list in modes where we are running specific tests.
|
||||
tests_list = []
|
||||
else:
|
||||
tests_list = suites[suite].get('tests', [])
|
||||
|
|
|
|||
|
|
@ -76,7 +76,7 @@ namespace recordreplay {
|
|||
MACRO(__close_nocancel, RR_SaveRvalHadErrorNegative) \
|
||||
MACRO(mkdir, RR_SaveRvalHadErrorNegative) \
|
||||
MACRO(dup, RR_SaveRvalHadErrorNegative) \
|
||||
MACRO(access, RR_SaveRvalHadErrorNegative) \
|
||||
MACRO(access, RR_SaveRvalHadErrorNegative, nullptr, nullptr, Preamble_SetError<EACCES>) \
|
||||
MACRO(lseek, RR_SaveRvalHadErrorNegative) \
|
||||
MACRO(socketpair, RR_SaveRvalHadErrorNegative<RR_WriteBufferFixedSize<3, 2 * sizeof(int)>>) \
|
||||
MACRO(fileport_makeport, \
|
||||
|
|
@ -178,18 +178,20 @@ namespace recordreplay {
|
|||
MACRO(ftell, RR_SaveRvalHadErrorNegative) \
|
||||
MACRO(fwrite, RR_ScalarRval) \
|
||||
MACRO(getenv, RR_CStringRval, Preamble_getenv, nullptr, Preamble_Veto<0>) \
|
||||
MACRO(localtime_r, RR_SaveRvalHadErrorZero<RR_Compose< \
|
||||
RR_WriteBufferFixedSize<1, sizeof(struct tm)>, \
|
||||
RR_RvalIsArgument<1>>>) \
|
||||
MACRO(gmtime_r, RR_SaveRvalHadErrorZero<RR_Compose< \
|
||||
RR_WriteBufferFixedSize<1, sizeof(struct tm)>, \
|
||||
RR_RvalIsArgument<1>>>) \
|
||||
MACRO(localtime, nullptr, Preamble_localtime) \
|
||||
MACRO(gmtime, nullptr, Preamble_gmtime) \
|
||||
MACRO(localtime_r, \
|
||||
RR_SaveRvalHadErrorZero<RR_Compose<RR_WriteBufferFixedSize<1, sizeof(struct tm)>, \
|
||||
RR_RvalIsArgument<1>>>, \
|
||||
nullptr, nullptr, Preamble_PassThrough) \
|
||||
MACRO(gmtime_r, \
|
||||
RR_SaveRvalHadErrorZero<RR_Compose<RR_WriteBufferFixedSize<1, sizeof(struct tm)>, \
|
||||
RR_RvalIsArgument<1>>>, \
|
||||
nullptr, nullptr, Preamble_PassThrough) \
|
||||
MACRO(localtime, nullptr, Preamble_localtime, nullptr, Preamble_PassThrough) \
|
||||
MACRO(gmtime, nullptr, Preamble_gmtime, nullptr, Preamble_PassThrough) \
|
||||
MACRO(mktime, RR_Compose<RR_ScalarRval, RR_WriteBufferFixedSize<0, sizeof(struct tm)>>) \
|
||||
MACRO(setlocale, RR_CStringRval) \
|
||||
MACRO(strftime, RR_Compose<RR_ScalarRval, RR_WriteBufferViaRval<0, 1, 1>>) \
|
||||
MACRO(arc4random, RR_ScalarRval) \
|
||||
MACRO(arc4random, RR_ScalarRval, nullptr, nullptr, Preamble_PassThrough) \
|
||||
MACRO(mach_absolute_time, RR_ScalarRval, Preamble_mach_absolute_time, \
|
||||
nullptr, Preamble_PassThrough) \
|
||||
MACRO(mach_msg, RR_Compose<RR_ScalarRval, RR_WriteBuffer<0, 3>>, \
|
||||
|
|
@ -357,7 +359,7 @@ namespace recordreplay {
|
|||
MACRO(CGColorSpaceCreateDeviceGray, RR_ScalarRval, nullptr, Middleman_CreateCFTypeRval) \
|
||||
MACRO(CGColorSpaceCreateDeviceRGB, RR_ScalarRval, nullptr, Middleman_CreateCFTypeRval) \
|
||||
MACRO(CGColorSpaceCreatePattern, RR_ScalarRval) \
|
||||
MACRO(CGColorSpaceRelease, RR_ScalarRval) \
|
||||
MACRO(CGColorSpaceRelease, RR_ScalarRval, nullptr, nullptr, Preamble_Veto<0>) \
|
||||
MACRO(CGContextBeginTransparencyLayerWithRect) \
|
||||
MACRO(CGContextClipToRects, RR_ScalarRval, nullptr, \
|
||||
Middleman_Compose<Middleman_CFTypeArg<0>, Middleman_Buffer<1, 2, CGRect>>) \
|
||||
|
|
@ -412,7 +414,10 @@ namespace recordreplay {
|
|||
Middleman_Compose<Middleman_CFTypeArg<0>, Middleman_CreateCFTypeRval>) \
|
||||
MACRO(CGFontCopyVariations, RR_ScalarRval, nullptr, \
|
||||
Middleman_Compose<Middleman_CFTypeArg<0>, Middleman_CreateCFTypeRval>) \
|
||||
MACRO(CGFontCreateCopyWithVariations, RR_ScalarRval) \
|
||||
MACRO(CGFontCreateCopyWithVariations, RR_ScalarRval, nullptr, \
|
||||
Middleman_Compose<Middleman_CFTypeArg<0>, \
|
||||
Middleman_CFTypeArg<1>, \
|
||||
Middleman_CreateCFTypeRval>) \
|
||||
MACRO(CGFontCreateWithDataProvider, RR_ScalarRval, nullptr, \
|
||||
Middleman_Compose<Middleman_CFTypeArg<0>, Middleman_CreateCFTypeRval>) \
|
||||
MACRO(CGFontCreateWithFontName, RR_ScalarRval, nullptr, \
|
||||
|
|
|
|||
|
|
@ -21,9 +21,6 @@ menulist {
|
|||
.menulist-label-box {
|
||||
-moz-box-align: center;
|
||||
-moz-box-pack: center;
|
||||
border: 1px solid transparent;
|
||||
background-color: transparent;
|
||||
color: inherit;
|
||||
}
|
||||
|
||||
.menulist-label {
|
||||
|
|
@ -38,7 +35,7 @@ menulist:focus:not([open="true"]) > .menulist-label-box {
|
|||
}
|
||||
|
||||
menulist:-moz-focusring:not([open="true"]) > .menulist-label-box {
|
||||
border: 1px dotted ThreeDDarkShadow;
|
||||
outline: 1px dotted;
|
||||
}
|
||||
|
||||
/* ..... disabled state ..... */
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче