зеркало из https://github.com/mozilla/gecko-dev.git
Bug 1921490 - land NSS f8a6e9557d1c UPGRADE_NSS_RELEASE, r=keeler
Differential Revision: https://phabricator.services.mozilla.com/D224149
This commit is contained in:
John Schanck
Родитель
37f8883703
Коммит
62e680a403
|
|
@ -13,7 +13,7 @@ system_lib_option(
|
|||
imply_option("--with-system-nspr", True, when="--with-system-nss")
|
||||
|
||||
nss_pkg = pkg_check_modules(
|
||||
"NSS", "nss >= 3.105", when="--with-system-nss", config=False
|
||||
"NSS", "nss >= 3.106", when="--with-system-nss", config=False
|
||||
)
|
||||
|
||||
set_config("MOZ_SYSTEM_NSS", True, when="--with-system-nss")
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
NSS_3_105_RTM
|
||||
f8a6e9557d1c
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
|
||||
1 function with some indirect sub-type change:
|
||||
|
||||
[C]'function SECStatus CERT_AddOCSPAcceptableResponses(CERTOCSPRequest*, SECOidTag, ...)' at ocsp.c:2202:1 has some indirect sub-type changes:
|
||||
parameter 2 of type 'typedef SECOidTag' has sub-type changes:
|
||||
underlying type 'enum __anonymous_enum__' at secoidt.h:34:1 changed:
|
||||
type size hasn't changed
|
||||
1 enumerator insertion:
|
||||
'__anonymous_enum__::SEC_OID_MLKEM768X25519' value '389'
|
||||
|
||||
1 enumerator change:
|
||||
'__anonymous_enum__::SEC_OID_TOTAL' from value '389' to '390' at secoidt.h:34:1
|
||||
|
||||
|
||||
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
|
||||
1 function with some indirect sub-type change:
|
||||
|
||||
[C]'function SECOidTag HASH_GetHMACOidTagByHashOidTag_Util(SECOidTag)' at nsshash.c:146:1 has some indirect sub-type changes:
|
||||
return type changed:
|
||||
underlying type 'enum __anonymous_enum__' at secoidt.h:34:1 changed:
|
||||
type size hasn't changed
|
||||
1 enumerator insertion:
|
||||
'__anonymous_enum__::SEC_OID_MLKEM768X25519' value '389'
|
||||
|
||||
1 enumerator change:
|
||||
'__anonymous_enum__::SEC_OID_TOTAL' from value '389' to '390' at secoidt.h:34:1
|
||||
|
||||
|
||||
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
|
||||
1 function with some indirect sub-type change:
|
||||
|
||||
[C]'function PK11SymKey* NSS_CMSContentInfo_GetBulkKey(NSSCMSContentInfo*)' at cmscinfo.c:426:1 has some indirect sub-type changes:
|
||||
parameter 1 of type 'NSSCMSContentInfo*' has sub-type changes:
|
||||
in pointed to type 'typedef NSSCMSContentInfo' at cmst.h:54:1:
|
||||
underlying type 'struct NSSCMSContentInfoStr' at cmst.h:126:1 changed:
|
||||
type size hasn't changed
|
||||
1 data member changes (2 filtered):
|
||||
type of 'NSSCMSContent NSSCMSContentInfoStr::content' changed:
|
||||
underlying type 'union NSSCMSContentUnion' at cmst.h:113:1 changed:
|
||||
type size hasn't changed
|
||||
1 data member changes (3 filtered):
|
||||
type of 'NSSCMSEncryptedData* NSSCMSContentUnion::encryptedData' changed:
|
||||
in pointed to type 'typedef NSSCMSEncryptedData' at cmst.h:65:1:
|
||||
underlying type 'struct NSSCMSEncryptedDataStr' at cmst.h:470:1 changed:
|
||||
type size hasn't changed
|
||||
1 data member changes (1 filtered):
|
||||
type of 'NSSCMSAttribute** NSSCMSEncryptedDataStr::unprotectedAttr' changed:
|
||||
in pointed to type 'NSSCMSAttribute*':
|
||||
in pointed to type 'typedef NSSCMSAttribute' at cmst.h:69:1:
|
||||
underlying type 'struct NSSCMSAttributeStr' at cmst.h:489:1 changed:
|
||||
type size hasn't changed
|
||||
1 data member change:
|
||||
type of 'SECOidData* NSSCMSAttributeStr::typeTag' changed:
|
||||
in pointed to type 'typedef SECOidData' at secoidt.h:16:1:
|
||||
underlying type 'struct SECOidDataStr' at secoidt.h:553:1 changed:
|
||||
type size hasn't changed
|
||||
1 data member change:
|
||||
type of 'SECOidTag SECOidDataStr::offset' changed:
|
||||
underlying type 'enum __anonymous_enum__' at secoidt.h:34:1 changed:
|
||||
type size hasn't changed
|
||||
1 enumerator insertion:
|
||||
'__anonymous_enum__::SEC_OID_MLKEM768X25519' value '389'
|
||||
|
||||
1 enumerator change:
|
||||
'__anonymous_enum__::SEC_OID_TOTAL' from value '389' to '390' at secoidt.h:34:1
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -1 +1 @@
|
|||
NSS_3_104_BRANCH
|
||||
NSS_3_105_BRANCH
|
||||
|
|
|
|||
|
|
@ -24,8 +24,6 @@ copy_fuzzer()
|
|||
# Zip and copy the corpus, if any.
|
||||
if [ -d "$SRC/nss-corpus/$name" ]; then
|
||||
zip $OUT/${name}_seed_corpus.zip $SRC/nss-corpus/$name/*
|
||||
else
|
||||
zip $OUT/${name}_seed_corpus.zip $SRC/nss-corpus/*/*
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -303,16 +303,16 @@ def create_nss_release_archive():
|
|||
check_call_noisy(["mkdir", "-p", nss_stagedir])
|
||||
check_call_noisy(["hg", "archive", "-r", nssreltag, "--prefix=nss-" + nssrel + "/nss",
|
||||
stagedir + "/" + nssreltag + "/src/" + nss_tar, "-X", ".hgtags"])
|
||||
check_call_noisy(["tar", "-xz", "-C", nss_stagedir, "-f", nsprtar_with_path])
|
||||
check_call_noisy(["gtar", "-xz", "-C", nss_stagedir, "-f", nsprtar_with_path])
|
||||
print("changing to directory " + nss_stagedir)
|
||||
os.chdir(nss_stagedir)
|
||||
check_call_noisy(["tar", "-xz", "-f", nss_tar])
|
||||
check_call_noisy(["gtar", "-xz", "-f", nss_tar])
|
||||
check_call_noisy(["mv", "-i", "nspr-" + nsprrel + "/nspr", "nss-" + nssrel + "/"])
|
||||
check_call_noisy(["rmdir", "nspr-" + nsprrel])
|
||||
|
||||
nss_nspr_tar = "nss-" + nssrel + "-with-nspr-" + nsprrel + ".tar.gz"
|
||||
|
||||
check_call_noisy(["tar", "-cz", "--remove-files", "-f", nss_nspr_tar, "nss-" + nssrel])
|
||||
check_call_noisy(["gtar", "-cz", "--remove-files", "-f", nss_nspr_tar, "nss-" + nssrel])
|
||||
check_call("sha1sum " + nss_tar + " " + nss_nspr_tar + " > SHA1SUMS", shell=True)
|
||||
check_call("sha256sum " + nss_tar + " " + nss_nspr_tar + " > SHA256SUMS", shell=True)
|
||||
print("created directory " + nss_stagedir + " with files:")
|
||||
|
|
|
|||
|
|
@ -31,6 +31,7 @@ RUN apt-get update \
|
|||
pkg-config \
|
||||
python-is-python3 \
|
||||
python3-requests \
|
||||
python3-toml \
|
||||
unzip \
|
||||
valgrind \
|
||||
zlib1g-dev \
|
||||
|
|
|
|||
|
|
@ -635,7 +635,7 @@ async function scheduleLinux(name, overrides, args = "") {
|
|||
|
||||
/*****************************************************************************/
|
||||
|
||||
function scheduleFuzzingRun(base, name, target, max_len, symbol = null, corpus = null) {
|
||||
function scheduleFuzzingRun(base, name, target, symbol = null, corpus = null) {
|
||||
const MAX_FUZZ_TIME = 300;
|
||||
|
||||
queue.scheduleTask(merge(base, {
|
||||
|
|
@ -645,8 +645,7 @@ function scheduleFuzzingRun(base, name, target, max_len, symbol = null, corpus =
|
|||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/fuzz.sh " +
|
||||
`${target} ${corpus || target} ` +
|
||||
`-max_total_time=${MAX_FUZZ_TIME} ` +
|
||||
`-max_len=${max_len}`
|
||||
`-max_total_time=${MAX_FUZZ_TIME} `
|
||||
],
|
||||
provisioner: "nss-t",
|
||||
workerType: "t-linux-xlarge-gcp",
|
||||
|
|
@ -725,36 +724,37 @@ async function scheduleFuzzing() {
|
|||
|
||||
// Schedule fuzzing runs.
|
||||
let run_base = merge(base, {parent: task_build, kind: "test"});
|
||||
scheduleFuzzingRun(run_base, "CertDN", "certDN", 4096);
|
||||
scheduleFuzzingRun(run_base, "QuickDER", "quickder", 10000);
|
||||
scheduleFuzzingRun(run_base, "CertDN", "certDN");
|
||||
scheduleFuzzingRun(run_base, "PKCS12", "pkcs12");
|
||||
scheduleFuzzingRun(run_base, "QuickDER", "quickder");
|
||||
|
||||
// Schedule MPI fuzzing runs.
|
||||
let mpi_base = merge(run_base, {group: "MPI"});
|
||||
let mpi_names = ["add", "addmod", "div", "mod", "mulmod", "sqr",
|
||||
"sqrmod", "sub", "submod"];
|
||||
for (let name of mpi_names) {
|
||||
scheduleFuzzingRun(mpi_base, `MPI (${name})`, `mpi-${name}`, 4096, name);
|
||||
scheduleFuzzingRun(mpi_base, `MPI (${name})`, `mpi-${name}`, name);
|
||||
}
|
||||
scheduleFuzzingRun(mpi_base, `MPI (invmod)`, `mpi-invmod`, 256, "invmod");
|
||||
scheduleFuzzingRun(mpi_base, `MPI (expmod)`, `mpi-expmod`, 2048, "expmod");
|
||||
scheduleFuzzingRun(mpi_base, `MPI (invmod)`, `mpi-invmod`, "invmod");
|
||||
scheduleFuzzingRun(mpi_base, `MPI (expmod)`, `mpi-expmod`, "expmod");
|
||||
|
||||
// Schedule TLS fuzzing runs (non-fuzzing mode).
|
||||
let tls_base = merge(run_base, {group: "TLS"});
|
||||
scheduleFuzzingRun(tls_base, "TLS Client", "tls-client", 20000, "client-nfm",
|
||||
scheduleFuzzingRun(tls_base, "TLS Client", "tls-client", "client-nfm",
|
||||
"tls-client-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "TLS Server", "tls-server", 20000, "server-nfm",
|
||||
scheduleFuzzingRun(tls_base, "TLS Server", "tls-server", "server-nfm",
|
||||
"tls-server-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "DTLS Client", "dtls-client", 20000,
|
||||
scheduleFuzzingRun(tls_base, "DTLS Client", "dtls-client",
|
||||
"dtls-client-nfm", "dtls-client-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "DTLS Server", "dtls-server", 20000,
|
||||
scheduleFuzzingRun(tls_base, "DTLS Server", "dtls-server",
|
||||
"dtls-server-nfm", "dtls-server-no_fuzzer_mode");
|
||||
|
||||
// Schedule TLS fuzzing runs (fuzzing mode).
|
||||
let tls_fm_base = merge(tls_base, {parent: task_build_tls});
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Client", "tls-client", 20000, "client");
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Server", "tls-server", 20000, "server");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Client", "dtls-client", 20000, "dtls-client");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Server", "dtls-server", 20000, "dtls-server");
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Client", "tls-client", "client");
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Server", "tls-server", "server");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Client", "dtls-client", "dtls-client");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Server", "dtls-server", "dtls-server");
|
||||
|
||||
return queue.submit();
|
||||
}
|
||||
|
|
@ -830,35 +830,36 @@ async function scheduleFuzzing32() {
|
|||
|
||||
// Schedule fuzzing runs.
|
||||
let run_base = merge(base, {parent: task_build, kind: "test"});
|
||||
scheduleFuzzingRun(run_base, "CertDN", "certDN", 4096);
|
||||
scheduleFuzzingRun(run_base, "QuickDER", "quickder", 10000);
|
||||
scheduleFuzzingRun(run_base, "CertDN", "certDN");
|
||||
scheduleFuzzingRun(run_base, "PKCS12", "pkcs12");
|
||||
scheduleFuzzingRun(run_base, "QuickDER", "quickder");
|
||||
|
||||
// Schedule MPI fuzzing runs.
|
||||
let mpi_base = merge(run_base, {group: "MPI"});
|
||||
let mpi_names = ["add", "addmod", "div", "expmod", "mod", "mulmod", "sqr",
|
||||
"sqrmod", "sub", "submod"];
|
||||
for (let name of mpi_names) {
|
||||
scheduleFuzzingRun(mpi_base, `MPI (${name})`, `mpi-${name}`, 4096, name);
|
||||
scheduleFuzzingRun(mpi_base, `MPI (${name})`, `mpi-${name}`, name);
|
||||
}
|
||||
scheduleFuzzingRun(mpi_base, `MPI (invmod)`, `mpi-invmod`, 256, "invmod");
|
||||
scheduleFuzzingRun(mpi_base, `MPI (invmod)`, `mpi-invmod`, "invmod");
|
||||
|
||||
// Schedule TLS fuzzing runs (non-fuzzing mode).
|
||||
let tls_base = merge(run_base, {group: "TLS"});
|
||||
scheduleFuzzingRun(tls_base, "TLS Client", "tls-client", 20000, "client-nfm",
|
||||
scheduleFuzzingRun(tls_base, "TLS Client", "tls-client", "client-nfm",
|
||||
"tls-client-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "TLS Server", "tls-server", 20000, "server-nfm",
|
||||
scheduleFuzzingRun(tls_base, "TLS Server", "tls-server", "server-nfm",
|
||||
"tls-server-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "DTLS Client", "dtls-client", 20000,
|
||||
scheduleFuzzingRun(tls_base, "DTLS Client", "dtls-client",
|
||||
"dtls-client-nfm", "dtls-client-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "DTLS Server", "dtls-server", 20000,
|
||||
scheduleFuzzingRun(tls_base, "DTLS Server", "dtls-server",
|
||||
"dtls-server-nfm", "dtls-server-no_fuzzer_mode");
|
||||
|
||||
// Schedule TLS fuzzing runs (fuzzing mode).
|
||||
let tls_fm_base = merge(tls_base, {parent: task_build_tls});
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Client", "tls-client", 20000, "client");
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Server", "tls-server", 20000, "server");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Client", "dtls-client", 20000, "dtls-client");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Server", "dtls-server", 20000, "dtls-server");
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Client", "tls-client", "client");
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Server", "tls-server", "server");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Client", "dtls-client", "dtls-client");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Server", "dtls-server", "dtls-server");
|
||||
|
||||
return queue.submit();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,18 +11,24 @@ fetch_dist
|
|||
|
||||
# Create and change to corpus directory.
|
||||
mkdir -p "nss/fuzz/corpus/$corpus"
|
||||
cd "nss/fuzz/corpus/$corpus"
|
||||
pushd "nss/fuzz/corpus/$corpus"
|
||||
|
||||
# Fetch and unzip the public OSS-Fuzz corpus.
|
||||
curl -O "https://storage.googleapis.com/nss-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/nss_$corpus/public.zip"
|
||||
unzip public.zip
|
||||
rm public.zip
|
||||
# Fetch and unzip the public OSS-Fuzz corpus. Handle the case that there
|
||||
# may be no corpus yet for new fuzz targets.
|
||||
code=$(curl -w "%{http_code}" -O "https://storage.googleapis.com/nss-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/nss_$corpus/public.zip")
|
||||
if [[ $code -eq 200 ]]; then
|
||||
unzip public.zip
|
||||
fi
|
||||
rm -f public.zip
|
||||
|
||||
# Change back to previous working directory.
|
||||
cd $OLDPWD
|
||||
popd
|
||||
|
||||
# Fetch objdir name.
|
||||
objdir=$(cat dist/latest)
|
||||
|
||||
# Get libFuzzer options.
|
||||
readarray -t options < <(python nss/fuzz/config/libfuzzer_options.py nss/fuzz/options/"$corpus".options)
|
||||
|
||||
# Run nssfuzz.
|
||||
dist/"$objdir"/bin/nssfuzz-"$target" "nss/fuzz/corpus/$corpus" "$@"
|
||||
dist/"$objdir"/bin/nssfuzz-"$target" "nss/fuzz/corpus/$corpus" "${options[@]}" "$@"
|
||||
|
|
|
|||
|
|
@ -139,6 +139,11 @@ while [ $# -gt 0 ]; do
|
|||
shift
|
||||
done
|
||||
|
||||
if [ "$opt_build" = 1 ] && [ "$fuzz" = 1 ]; then
|
||||
echo "Specifiying --opt with --fuzz is not supported." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -n "$python" ]; then
|
||||
gyp_params+=(-Dpython="$python")
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -200,7 +200,7 @@
|
|||
}],
|
||||
[ 'fuzz==1', {
|
||||
'variables': {
|
||||
'debug_optimization_level%': '1',
|
||||
'debug_optimization_level%': '3',
|
||||
},
|
||||
}],
|
||||
[ 'target_arch=="ia32" or target_arch=="x64"', {
|
||||
|
|
|
|||
|
|
@ -10,3 +10,4 @@
|
|||
*/
|
||||
|
||||
#error "Do not include this header file."
|
||||
|
||||
|
|
|
|||
|
|
@ -2,8 +2,8 @@
|
|||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||||
|
||||
#include <assert.h>
|
||||
#include <string.h>
|
||||
#include <cassert>
|
||||
#include <cstring>
|
||||
#include <random>
|
||||
#include <tuple>
|
||||
|
||||
|
|
@ -92,8 +92,10 @@ static vector<uint8_t *> ParseItems(uint8_t *Data, size_t Size) {
|
|||
return items;
|
||||
}
|
||||
|
||||
size_t ASN1MutatorFlipConstructed(uint8_t *Data, size_t Size, size_t MaxSize,
|
||||
unsigned int Seed) {
|
||||
namespace ASN1Mutators {
|
||||
|
||||
size_t FlipConstructed(uint8_t *Data, size_t Size, size_t MaxSize,
|
||||
unsigned int Seed) {
|
||||
auto items = ParseItems(Data, Size);
|
||||
|
||||
std::mt19937 rng(Seed);
|
||||
|
|
@ -106,8 +108,8 @@ size_t ASN1MutatorFlipConstructed(uint8_t *Data, size_t Size, size_t MaxSize,
|
|||
return Size;
|
||||
}
|
||||
|
||||
size_t ASN1MutatorChangeType(uint8_t *Data, size_t Size, size_t MaxSize,
|
||||
unsigned int Seed) {
|
||||
size_t ChangeType(uint8_t *Data, size_t Size, size_t MaxSize,
|
||||
unsigned int Seed) {
|
||||
auto items = ParseItems(Data, Size);
|
||||
|
||||
std::mt19937 rng(Seed);
|
||||
|
|
@ -120,3 +122,5 @@ size_t ASN1MutatorChangeType(uint8_t *Data, size_t Size, size_t MaxSize,
|
|||
|
||||
return Size;
|
||||
}
|
||||
|
||||
} // namespace ASN1Mutators
|
||||
|
|
|
|||
|
|
@ -2,15 +2,19 @@
|
|||
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
|
||||
* You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||||
|
||||
#ifndef asn1_mutators_h__
|
||||
#define asn1_mutators_h__
|
||||
#ifndef ASN1_MUTATORS_H_
|
||||
#define ASN1_MUTATORS_H_
|
||||
|
||||
#include <stdint.h>
|
||||
#include <cstddef>
|
||||
#include <cstdint>
|
||||
|
||||
size_t ASN1MutatorFlipConstructed(uint8_t *Data, size_t Size, size_t MaxSize,
|
||||
unsigned int Seed);
|
||||
size_t ASN1MutatorChangeType(uint8_t *Data, size_t Size, size_t MaxSize,
|
||||
unsigned int Seed);
|
||||
namespace ASN1Mutators {
|
||||
|
||||
#endif // asn1_mutators_h__
|
||||
size_t FlipConstructed(uint8_t *data, size_t size, size_t maxSize,
|
||||
unsigned int seed);
|
||||
size_t ChangeType(uint8_t *data, size_t size, size_t maxSize,
|
||||
unsigned int seed);
|
||||
|
||||
} // namespace ASN1Mutators
|
||||
|
||||
#endif // ASN1_MUTATORS_H_
|
||||
|
|
|
|||
|
|
@ -1,4 +1,7 @@
|
|||
#!/usr/bin/env python3
|
||||
#!/usr/bin/env python
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
import argparse
|
||||
import hashlib
|
||||
|
|
@ -101,7 +104,7 @@ def brrrrr(hosts, args):
|
|||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("--nss",
|
||||
parser.add_argument("--nss-build",
|
||||
required=True,
|
||||
help="e.g. /path/to/dist/Debug")
|
||||
parser.add_argument("--hosts", required=True)
|
||||
|
|
@ -113,8 +116,10 @@ def main():
|
|||
with open(args.hosts, "r") as f:
|
||||
hosts = f.read().splitlines()
|
||||
|
||||
os.makedirs(os.path.join(args.output, "client"), exist_ok=True)
|
||||
os.makedirs(os.path.join(args.output, "server"), exist_ok=True)
|
||||
# For use in automation (e.g. MozillaSecurity/orion), the output
|
||||
# corpus directories should follow the following scheme: $name-corpus.
|
||||
os.makedirs(os.path.join(args.output, "tls-server-corpus"), exist_ok=True)
|
||||
os.makedirs(os.path.join(args.output, "tls-client-corpus"), exist_ok=True)
|
||||
|
||||
chunks = itertools.batched(hosts, len(hosts) // args.threads)
|
||||
threads = []
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
#!/usr/bin/env python
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
|
||||
import sys
|
||||
import toml
|
||||
|
||||
|
||||
def main():
|
||||
with open(sys.argv[1], "r") as f:
|
||||
data = toml.load(f)
|
||||
|
||||
for key, value in data["libfuzzer"].items():
|
||||
print(f"-{key}={value}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
|
@ -44,6 +44,7 @@
|
|||
'<(DEPTH)/lib/util/util.gyp:nssutil',
|
||||
'<(DEPTH)/lib/nss/nss.gyp:nss_static',
|
||||
'<(DEPTH)/lib/pkcs7/pkcs7.gyp:pkcs7',
|
||||
'<(DEPTH)/lib/pkcs12/pkcs12.gyp:pkcs12',
|
||||
# This is a static build of pk11wrap, softoken, and freebl.
|
||||
'<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap_static',
|
||||
'<(DEPTH)/lib/libpkix/libpkix.gyp:libpkix',
|
||||
|
|
@ -113,6 +114,19 @@
|
|||
'fuzz_base',
|
||||
],
|
||||
},
|
||||
{
|
||||
'target_name': 'nssfuzz-pkcs12',
|
||||
'type': 'executable',
|
||||
'sources': [
|
||||
'asn1_mutators.cc',
|
||||
'pkcs12_target.cc',
|
||||
],
|
||||
'dependencies': [
|
||||
'<(DEPTH)/cpputil/cpputil.gyp:cpputil',
|
||||
'<(DEPTH)/exports.gyp:nss_exports',
|
||||
'fuzz_base',
|
||||
],
|
||||
},
|
||||
{
|
||||
'target_name': 'nssfuzz-quickder',
|
||||
'type': 'executable',
|
||||
|
|
@ -351,6 +365,7 @@
|
|||
'nssfuzz-dtls-client',
|
||||
'nssfuzz-dtls-server',
|
||||
'nssfuzz-pkcs8',
|
||||
'nssfuzz-pkcs12',
|
||||
'nssfuzz-quickder',
|
||||
'nssfuzz-tls-client',
|
||||
'nssfuzz-tls-server',
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
[libfuzzer]
|
||||
max_len = 16777215
|
||||
rss_limit_mb = 4096
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
/* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||||
|
||||
#include <cassert>
|
||||
#include <cstddef>
|
||||
#include <cstdint>
|
||||
#include <memory>
|
||||
|
||||
#include "nss_scoped_ptrs.h"
|
||||
#include "p12.h"
|
||||
#include "pk11pub.h"
|
||||
#include "seccomon.h"
|
||||
|
||||
#include "asn1_mutators.h"
|
||||
#include "shared.h"
|
||||
|
||||
static SECItem* nicknameCollision(SECItem* oldNick, PRBool* cancel,
|
||||
void* wincx) {
|
||||
*cancel = true;
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
||||
static std::unique_ptr<NSSDatabase> db(new NSSDatabase());
|
||||
|
||||
ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
|
||||
assert(slot);
|
||||
|
||||
// Initialize the decoder.
|
||||
SECItem pwItem = {siBuffer, nullptr, 0};
|
||||
ScopedSEC_PKCS12DecoderContext dcx(
|
||||
SEC_PKCS12DecoderStart(&pwItem, slot.get(), nullptr, nullptr, nullptr,
|
||||
nullptr, nullptr, nullptr));
|
||||
assert(dcx);
|
||||
|
||||
SECStatus rv = SEC_PKCS12DecoderUpdate(dcx.get(), (unsigned char*)data, size);
|
||||
if (rv != SECSuccess) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
// Verify the blob.
|
||||
rv = SEC_PKCS12DecoderVerify(dcx.get());
|
||||
if (rv != SECSuccess) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
// Validate bags.
|
||||
rv = SEC_PKCS12DecoderValidateBags(dcx.get(), nicknameCollision);
|
||||
if (rv != SECSuccess) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
// Import cert and key.
|
||||
rv = SEC_PKCS12DecoderImportBags(dcx.get());
|
||||
if (rv != SECSuccess) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
extern "C" size_t LLVMFuzzerCustomMutator(uint8_t* data, size_t size,
|
||||
size_t maxSize, unsigned int seed) {
|
||||
return CustomMutate(
|
||||
Mutators({ASN1Mutators::FlipConstructed, ASN1Mutators::ChangeType}), data,
|
||||
size, maxSize, seed);
|
||||
}
|
||||
|
|
@ -2,8 +2,9 @@
|
|||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||||
|
||||
#include <cstddef>
|
||||
#include <cstdint>
|
||||
#include <memory>
|
||||
#include <vector>
|
||||
|
||||
#include "keyhi.h"
|
||||
#include "pk11pub.h"
|
||||
|
|
@ -11,17 +12,16 @@
|
|||
#include "asn1_mutators.h"
|
||||
#include "shared.h"
|
||||
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||
SECItem data = {siBuffer, (unsigned char *)Data, (unsigned int)Size};
|
||||
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||
static std::unique_ptr<NSSDatabase> db(new NSSDatabase());
|
||||
assert(db != nullptr);
|
||||
|
||||
PK11SlotInfo *slot = PK11_GetInternalSlot();
|
||||
assert(slot != nullptr);
|
||||
assert(slot);
|
||||
|
||||
SECItem derPki = {siBuffer, (unsigned char *)data, (unsigned int)size};
|
||||
|
||||
SECKEYPrivateKey *key = nullptr;
|
||||
if (PK11_ImportDERPrivateKeyInfoAndReturnKey(slot, &data, nullptr, nullptr,
|
||||
if (PK11_ImportDERPrivateKeyInfoAndReturnKey(slot, &derPki, nullptr, nullptr,
|
||||
false, false, KU_ALL, &key,
|
||||
nullptr) == SECSuccess) {
|
||||
SECKEY_DestroyPrivateKey(key);
|
||||
|
|
@ -32,8 +32,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
|||
}
|
||||
|
||||
extern "C" size_t LLVMFuzzerCustomMutator(uint8_t *data, size_t size,
|
||||
size_t max_size, unsigned int seed) {
|
||||
size_t maxSize, unsigned int seed) {
|
||||
return CustomMutate(
|
||||
Mutators({ASN1MutatorFlipConstructed, ASN1MutatorChangeType}), data, size,
|
||||
max_size, seed);
|
||||
Mutators({ASN1Mutators::FlipConstructed, ASN1Mutators::ChangeType}), data,
|
||||
size, maxSize, seed);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -87,6 +87,6 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
|||
extern "C" size_t LLVMFuzzerCustomMutator(uint8_t *data, size_t size,
|
||||
size_t max_size, unsigned int seed) {
|
||||
return CustomMutate(
|
||||
Mutators({ASN1MutatorFlipConstructed, ASN1MutatorChangeType}), data, size,
|
||||
max_size, seed);
|
||||
Mutators({ASN1Mutators::FlipConstructed, ASN1Mutators::ChangeType}), data,
|
||||
size, max_size, seed);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -67,17 +67,30 @@ void DoHandshake(PRFileDesc* fd, bool isServer) {
|
|||
}
|
||||
|
||||
SECStatus DummyCompressionEncode(const SECItem* input, SECItem* output) {
|
||||
if (!input || !input->data || input->len == 0 || !output) {
|
||||
PR_SetError(SEC_ERROR_INVALID_ARGS, 0);
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
SECITEM_CopyItem(nullptr, output, input);
|
||||
PORT_Memcpy(output->data, input->data, output->len);
|
||||
|
||||
return SECSuccess;
|
||||
}
|
||||
|
||||
SECStatus DummyCompressionDecode(const SECItem* input, unsigned char* output,
|
||||
size_t outputLen, size_t* usedLen) {
|
||||
assert(input->len == outputLen);
|
||||
if (!input || !input->data || input->len == 0 || !output || outputLen == 0) {
|
||||
PR_SetError(SEC_ERROR_INVALID_ARGS, 0);
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
if (input->len > outputLen) {
|
||||
PR_SetError(SEC_ERROR_BAD_DATA, 0);
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
PORT_Memcpy(output, input->data, input->len);
|
||||
*usedLen = outputLen;
|
||||
*usedLen = input->len;
|
||||
|
||||
return SECSuccess;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -132,5 +132,84 @@ TEST_F(Pkcs11KbkdfTest, TestAdditionalKey) {
|
|||
sizeof(expectedAdditional) / sizeof(*expectedAdditional));
|
||||
}
|
||||
|
||||
TEST_F(Pkcs11KbkdfTest, TestPRFs) {
|
||||
// Table 161 of PKCS#11 v3.0 / Table 192 of PKCS#11 v3.1.
|
||||
CK_SP800_108_PRF_TYPE allowedPRFs[] = {CKM_SHA_1_HMAC,
|
||||
CKM_SHA224_HMAC,
|
||||
CKM_SHA256_HMAC,
|
||||
CKM_SHA384_HMAC,
|
||||
CKM_SHA512_HMAC,
|
||||
CKM_SHA3_224_HMAC,
|
||||
CKM_SHA3_256_HMAC,
|
||||
CKM_SHA3_384_HMAC,
|
||||
CKM_SHA3_512_HMAC,
|
||||
/* CKM_DES3_CMAC, */
|
||||
CKM_AES_CMAC};
|
||||
CK_SP800_108_PRF_TYPE disallowedPRFs[] = {CKM_MD2_HMAC,
|
||||
CKM_MD5_HMAC,
|
||||
CKM_RIPEMD128_HMAC,
|
||||
CKM_RIPEMD160_HMAC};
|
||||
|
||||
CK_BYTE inputKey[] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
|
||||
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f};
|
||||
|
||||
CK_SP800_108_COUNTER_FORMAT iterator = {CK_FALSE, 8};
|
||||
CK_BYTE fixedData[] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
|
||||
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f};
|
||||
|
||||
CK_PRF_DATA_PARAM dataParams[] = {
|
||||
{CK_SP800_108_BYTE_ARRAY, fixedData,
|
||||
sizeof(fixedData) / sizeof(*fixedData)},
|
||||
{CK_SP800_108_ITERATION_VARIABLE, &iterator, sizeof(iterator)}};
|
||||
|
||||
CK_KEY_TYPE ckGeneric = CKK_GENERIC_SECRET;
|
||||
CK_OBJECT_CLASS ckClass = CKO_SECRET_KEY;
|
||||
CK_ULONG derivedLength = 16;
|
||||
|
||||
CK_ATTRIBUTE derivedTemplate[] = {
|
||||
{CKA_CLASS, &ckClass, sizeof(ckClass)},
|
||||
{CKA_KEY_TYPE, &ckGeneric, sizeof(ckGeneric)},
|
||||
{CKA_VALUE_LEN, &derivedLength, sizeof(derivedLength)}};
|
||||
|
||||
CK_OBJECT_HANDLE keyHandle;
|
||||
CK_DERIVED_KEY derivedKey = {
|
||||
derivedTemplate, sizeof(derivedTemplate) / sizeof(*derivedTemplate),
|
||||
&keyHandle};
|
||||
|
||||
SECItem keyItem = {siBuffer, inputKey, sizeof(inputKey) / sizeof(*inputKey)};
|
||||
|
||||
for (CK_SP800_108_PRF_TYPE prfType : allowedPRFs) {
|
||||
ScopedPK11SymKey p11Key = ImportKey(prfType, &keyItem);
|
||||
|
||||
CK_SP800_108_KDF_PARAMS kdfParams = {
|
||||
prfType, sizeof(dataParams) / sizeof(*dataParams), dataParams, 1,
|
||||
&derivedKey};
|
||||
SECItem paramsItem = {siBuffer, (unsigned char *)&kdfParams,
|
||||
sizeof(kdfParams)};
|
||||
|
||||
ScopedPK11SymKey result(PK11_Derive(p11Key.get(), CKM_SP800_108_COUNTER_KDF,
|
||||
¶msItem, CKM_SHA512_HMAC, CKA_SIGN,
|
||||
derivedLength));
|
||||
ASSERT_NE(result, nullptr);
|
||||
|
||||
ASSERT_EQ(PK11_ExtractKeyValue(result.get()), SECSuccess);
|
||||
}
|
||||
|
||||
for (CK_SP800_108_PRF_TYPE prfType : disallowedPRFs) {
|
||||
ScopedPK11SymKey p11Key = ImportKey(prfType, &keyItem);
|
||||
|
||||
CK_SP800_108_KDF_PARAMS kdfParams = {
|
||||
prfType, sizeof(dataParams) / sizeof(*dataParams), dataParams, 1,
|
||||
&derivedKey};
|
||||
SECItem paramsItem = {siBuffer, (unsigned char *)&kdfParams,
|
||||
sizeof(kdfParams)};
|
||||
|
||||
ScopedPK11SymKey result(PK11_Derive(p11Key.get(), CKM_SP800_108_COUNTER_KDF,
|
||||
¶msItem, CKM_SHA512_HMAC, CKA_SIGN,
|
||||
derivedLength));
|
||||
ASSERT_EQ(result, nullptr);
|
||||
}
|
||||
}
|
||||
|
||||
// Close the namespace
|
||||
} // namespace nss_test
|
||||
|
|
|
|||
|
|
@ -2,6 +2,9 @@
|
|||
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
|
||||
* You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||||
|
||||
#include <limits>
|
||||
#include <unordered_set>
|
||||
|
||||
#include "blapi.h"
|
||||
#include "ssl.h"
|
||||
#include "sslimpl.h"
|
||||
|
|
@ -19,6 +22,53 @@ namespace nss_test {
|
|||
#define FUZZ_P(c, f) TEST_P(c, DISABLED_Fuzz_##f)
|
||||
#endif
|
||||
|
||||
static std::unordered_set<PRInt32> gFuzzedSslOptions = {
|
||||
SSL_SECURITY, // irrelevant
|
||||
SSL_SOCKS, // irrelevant
|
||||
SSL_REQUEST_CERTIFICATE, // tls_server_fuzz_target
|
||||
SSL_HANDSHAKE_AS_CLIENT, // irrelevant
|
||||
SSL_HANDSHAKE_AS_SERVER, // irrelevant
|
||||
SSL_ENABLE_SSL2, // obsolete
|
||||
SSL_ENABLE_SSL3, // obsolete
|
||||
SSL_NO_CACHE, // tls_client_fuzz_target, tls_server_fuzz_target
|
||||
SSL_REQUIRE_CERTIFICATE, // tls_server_fuzz_target
|
||||
SSL_ENABLE_FDX,
|
||||
SSL_V2_COMPATIBLE_HELLO, // obsolete
|
||||
SSL_ENABLE_TLS, // obsolete
|
||||
SSL_ROLLBACK_DETECTION,
|
||||
SSL_NO_STEP_DOWN, // unsupported
|
||||
SSL_BYPASS_PKCS11, // unsupported
|
||||
SSL_NO_LOCKS, // tls_client_fuzz_target. tls_server_fuzz_target
|
||||
SSL_ENABLE_SESSION_TICKETS, // tls_client_fuzz_target,
|
||||
// tls_server_fuzz_target
|
||||
SSL_ENABLE_DEFLATE, // tls_client_fuzz_target, tls_server_fuzz_target
|
||||
SSL_ENABLE_RENEGOTIATION,
|
||||
SSL_REQUIRE_SAFE_NEGOTIATION, // tls_client_fuzz_target,
|
||||
// tls_server_fuzz_target
|
||||
SSL_ENABLE_FALSE_START, // tls_client_fuzz_target
|
||||
SSL_CBC_RANDOM_IV, // tls_client_fuzz_target, tls_server_fuzz_target
|
||||
SSL_ENABLE_OCSP_STAPLING, // tls_client_fuzz_target
|
||||
SSL_ENABLE_NPN, // defunct
|
||||
SSL_ENABLE_ALPN, // tls_client_fuzz_target, tls_server_fuzz_target
|
||||
SSL_REUSE_SERVER_ECDHE_KEY,
|
||||
SSL_ENABLE_FALLBACK_SCSV, // tls_client_fuzz_target,
|
||||
// tls_server_fuzz_target
|
||||
SSL_ENABLE_SERVER_DHE,
|
||||
SSL_ENABLE_EXTENDED_MASTER_SECRET, // tls_client_fuzz_target,
|
||||
// tls_server_fuzz_target
|
||||
SSL_ENABLE_SIGNED_CERT_TIMESTAMPS,
|
||||
SSL_REQUIRE_DH_NAMED_GROUPS, // tls_client_fuzz_target
|
||||
SSL_ENABLE_0RTT_DATA, // tls_client_fuzz_target, tls_server_fuzz_target
|
||||
SSL_RECORD_SIZE_LIMIT,
|
||||
SSL_ENABLE_TLS13_COMPAT_MODE, // tls_client_fuzz_target
|
||||
SSL_ENABLE_DTLS_SHORT_HEADER, SSL_ENABLE_HELLO_DOWNGRADE_CHECK,
|
||||
SSL_ENABLE_V2_COMPATIBLE_HELLO,
|
||||
SSL_ENABLE_POST_HANDSHAKE_AUTH, // tls_client_fuzz_target
|
||||
SSL_ENABLE_DELEGATED_CREDENTIALS, SSL_SUPPRESS_END_OF_EARLY_DATA,
|
||||
SSL_ENABLE_GREASE, // tls_client_fuzz_target, tls_server_fuzz_target
|
||||
SSL_ENABLE_CH_EXTENSION_PERMUTATION, // tls_client_fuzz_target
|
||||
};
|
||||
|
||||
const uint8_t kShortEmptyFinished[8] = {0};
|
||||
const uint8_t kLongEmptyFinished[128] = {0};
|
||||
|
||||
|
|
@ -241,6 +291,21 @@ FUZZ_P(TlsFuzzTest, UnencryptedSessionTickets) {
|
|||
client_->CheckCipherSuite(static_cast<uint16_t>(suite));
|
||||
}
|
||||
|
||||
class MiscFuzzTest : public ::testing::Test {};
|
||||
|
||||
FUZZ_F(MiscFuzzTest, UnfuzzedSslOption) {
|
||||
PRIntn val;
|
||||
SECStatus rv;
|
||||
|
||||
for (PRInt32 option = 0; option < std::numeric_limits<PRUint8>::max();
|
||||
++option) {
|
||||
rv = SSL_OptionGetDefault(option, &val);
|
||||
// The return value should either be a failure (=> there is no such
|
||||
// option) or the the option should be in the fuzzed options.
|
||||
EXPECT_TRUE(rv == SECFailure || gFuzzedSslOptions.count(option));
|
||||
}
|
||||
}
|
||||
|
||||
INSTANTIATE_TEST_SUITE_P(
|
||||
FuzzStream, TlsFuzzTest,
|
||||
::testing::Combine(TlsConnectTestBase::kTlsVariantsStream,
|
||||
|
|
|
|||
|
|
@ -180,6 +180,10 @@ static const unsigned int FATAL_ERROR_FLAG = 0x800;
|
|||
MOZILLA_PKIX_MAP(ERROR_SELF_SIGNED_CERT, 55, \
|
||||
MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT) \
|
||||
MOZILLA_PKIX_MAP(ERROR_MITM_DETECTED, 56, MOZILLA_PKIX_ERROR_MITM_DETECTED) \
|
||||
MOZILLA_PKIX_MAP(ERROR_INSUFFICIENT_CERTIFICATE_TRANSPARENCY, 57, \
|
||||
MOZILLA_PKIX_ERROR_INSUFFICIENT_CERTIFICATE_TRANSPARENCY) \
|
||||
MOZILLA_PKIX_MAP(ERROR_ISSUER_NO_LONGER_TRUSTED, 58, \
|
||||
MOZILLA_PKIX_ERROR_ISSUER_NO_LONGER_TRUSTED) \
|
||||
MOZILLA_PKIX_MAP(FATAL_ERROR_INVALID_ARGS, FATAL_ERROR_FLAG | 1, \
|
||||
SEC_ERROR_INVALID_ARGS) \
|
||||
MOZILLA_PKIX_MAP(FATAL_ERROR_INVALID_STATE, FATAL_ERROR_FLAG | 2, \
|
||||
|
|
|
|||
|
|
@ -94,6 +94,8 @@ enum ErrorCode {
|
|||
MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED = ERROR_BASE + 13,
|
||||
MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT = ERROR_BASE + 14,
|
||||
MOZILLA_PKIX_ERROR_MITM_DETECTED = ERROR_BASE + 15,
|
||||
MOZILLA_PKIX_ERROR_INSUFFICIENT_CERTIFICATE_TRANSPARENCY = ERROR_BASE + 16,
|
||||
MOZILLA_PKIX_ERROR_ISSUER_NO_LONGER_TRUSTED = ERROR_BASE + 17,
|
||||
END_OF_LIST
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -389,6 +389,13 @@ RegisterErrorTable()
|
|||
{ "MOZILLA_PKIX_ERROR_MITM_DETECTED",
|
||||
"Your connection is being intercepted by a TLS proxy. Uninstall it if "
|
||||
"possible or configure your device to trust its root certificate." },
|
||||
{ "MOZILLA_PKIX_ERROR_INSUFFICIENT_CERTIFICATE_TRANSPARENCY",
|
||||
"The server presented insufficient certificate transparency information."
|
||||
" Its certificate may not have been publicly disclosed, and it may have "
|
||||
"been misissued." },
|
||||
{ "MOZILLA_PKIX_ERROR_ISSUER_NO_LONGER_TRUSTED",
|
||||
"The certificate was issued by a certificate authority that is no longer"
|
||||
" trusted to issue new certificates." },
|
||||
};
|
||||
// Note that these error strings are not localizable.
|
||||
// When these strings change, update the localization information too.
|
||||
|
|
|
|||
|
|
@ -22,9 +22,9 @@
|
|||
* The format of the version string should be
|
||||
* "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
|
||||
*/
|
||||
#define NSS_VERSION "3.105" _NSS_CUSTOMIZED " Beta"
|
||||
#define NSS_VERSION "3.106" _NSS_CUSTOMIZED " Beta"
|
||||
#define NSS_VMAJOR 3
|
||||
#define NSS_VMINOR 105
|
||||
#define NSS_VMINOR 106
|
||||
#define NSS_VPATCH 0
|
||||
#define NSS_VBUILD 0
|
||||
#define NSS_BETA PR_TRUE
|
||||
|
|
|
|||
|
|
@ -264,6 +264,27 @@ failure:
|
|||
return CKR_MECHANISM_PARAM_INVALID;
|
||||
}
|
||||
|
||||
static PRBool kbkdf_ValidPRF(CK_SP800_108_PRF_TYPE prf) {
|
||||
// See Table 161 of PKCS#11 v3.0 or Table 192 of PKCS#11 v3.1.
|
||||
switch (prf) {
|
||||
case CKM_AES_CMAC:
|
||||
/* case CKM_DES3_CMAC: */
|
||||
return PR_TRUE;
|
||||
case CKM_SHA_1_HMAC:
|
||||
case CKM_SHA224_HMAC:
|
||||
case CKM_SHA256_HMAC:
|
||||
case CKM_SHA384_HMAC:
|
||||
case CKM_SHA512_HMAC:
|
||||
case CKM_SHA3_224_HMAC:
|
||||
case CKM_SHA3_256_HMAC:
|
||||
case CKM_SHA3_384_HMAC:
|
||||
case CKM_SHA3_512_HMAC:
|
||||
/* Valid HMAC <-> HASH isn't NULL */
|
||||
return sftk_HMACMechanismToHash(prf) != HASH_AlgNULL;
|
||||
}
|
||||
return PR_FALSE;
|
||||
}
|
||||
|
||||
static CK_RV
|
||||
kbkdf_ValidateParameters(CK_MECHANISM_TYPE mech, const CK_SP800_108_KDF_PARAMS *params, CK_ULONG keySize)
|
||||
{
|
||||
|
|
@ -273,14 +294,7 @@ kbkdf_ValidateParameters(CK_MECHANISM_TYPE mech, const CK_SP800_108_KDF_PARAMS *
|
|||
|
||||
/* Start with checking the prfType as a mechanism against a list of
|
||||
* PRFs allowed by PKCS#11 v3.0. */
|
||||
if (!(/* The following types aren't defined in NSS yet. */
|
||||
/* params->prfType != CKM_3DES_CMAC && */
|
||||
params->prfType == CKM_AES_CMAC || /* allow */
|
||||
/* We allow any HMAC except MD2 and MD5. */
|
||||
params->prfType != CKM_MD2_HMAC || /* disallow */
|
||||
params->prfType != CKM_MD5_HMAC || /* disallow */
|
||||
sftk_HMACMechanismToHash(params->prfType) != HASH_AlgNULL /* Valid HMAC <-> HASH isn't NULL */
|
||||
)) {
|
||||
if (!kbkdf_ValidPRF(params->prfType)) {
|
||||
return CKR_MECHANISM_PARAM_INVALID;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -7503,8 +7503,9 @@ NSC_DeriveKey(CK_SESSION_HANDLE hSession,
|
|||
/*
|
||||
* now lets create an object to hang the attributes off of
|
||||
*/
|
||||
PORT_Assert(phKey);
|
||||
*phKey = CK_INVALID_HANDLE;
|
||||
if (phKey) {
|
||||
*phKey = CK_INVALID_HANDLE;
|
||||
}
|
||||
|
||||
key = sftk_NewObject(slot); /* fill in the handle later */
|
||||
if (key == NULL) {
|
||||
|
|
@ -9050,7 +9051,9 @@ NSC_DeriveKey(CK_SESSION_HANDLE hSession,
|
|||
crv = sftk_handleObject(key, session);
|
||||
session->lastOpWasFIPS = key->isFIPS;
|
||||
sftk_FreeSession(session);
|
||||
*phKey = key->handle;
|
||||
if (phKey) {
|
||||
*phKey = key->handle;
|
||||
}
|
||||
sftk_FreeObject(key);
|
||||
}
|
||||
return crv;
|
||||
|
|
|
|||
|
|
@ -17,9 +17,9 @@
|
|||
* The format of the version string should be
|
||||
* "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
|
||||
*/
|
||||
#define SOFTOKEN_VERSION "3.105" SOFTOKEN_ECC_STRING " Beta"
|
||||
#define SOFTOKEN_VERSION "3.106" SOFTOKEN_ECC_STRING " Beta"
|
||||
#define SOFTOKEN_VMAJOR 3
|
||||
#define SOFTOKEN_VMINOR 105
|
||||
#define SOFTOKEN_VMINOR 106
|
||||
#define SOFTOKEN_VPATCH 0
|
||||
#define SOFTOKEN_VBUILD 0
|
||||
#define SOFTOKEN_BETA PR_TRUE
|
||||
|
|
|
|||
|
|
@ -19,9 +19,9 @@
|
|||
* The format of the version string should be
|
||||
* "<major version>.<minor version>[.<patch level>[.<build number>]][ <Beta>]"
|
||||
*/
|
||||
#define NSSUTIL_VERSION "3.105 Beta"
|
||||
#define NSSUTIL_VERSION "3.106 Beta"
|
||||
#define NSSUTIL_VMAJOR 3
|
||||
#define NSSUTIL_VMINOR 105
|
||||
#define NSSUTIL_VMINOR 106
|
||||
#define NSSUTIL_VPATCH 0
|
||||
#define NSSUTIL_VBUILD 0
|
||||
#define NSSUTIL_BETA PR_TRUE
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче