2019-09-23 Daiki Ueno <dueno@redhat.com>
* gtests/ssl_gtest/ssl_recordsize_unittest.cc, lib/ssl/ssl3con.c,
tests/tlsfuzzer/config.json.in, tests/tlsfuzzer/tlsfuzzer.sh:
Bug 1580286, account for IV size when checking TLS 1.2 records, r=mt
Summary: This increases the limit of record expansion by 16 so that
it doesn't reject maximum block padding when HMAC-SHA384 is used.
To test this, tlsfuzzer is updated to the latest version (commit
80d7932ead1d8dae6e555cfd2b1c4c5beb2847df).
Reviewers: mt
Reviewed By: mt
Bug #: 1580286
[03039d4fad57] [tip]
2019-09-20 Kai Engert <kaie@kuix.de>
* tests/smime/smime.sh:
Bug 1577448 - Create additional nested S/MIME test messages for
Thunderbird. r=jcj
[57977ceea00e]
2019-09-19 Kai Engert <kaie@kuix.de>
* automation/taskcluster/docker-gcc-4.4/Dockerfile,
automation/taskcluster/graph/src/try_syntax.js,
automation/taskcluster/scripts/build.sh,
automation/taskcluster/scripts/build_gyp.sh,
automation/taskcluster/scripts/build_nspr.sh,
automation/taskcluster/scripts/check_abi.sh,
automation/taskcluster/scripts/gen_coverage_report.sh,
automation/taskcluster/scripts/run_coverity.sh,
automation/taskcluster/scripts/run_scan_build.sh,
automation/taskcluster/windows/build.sh,
automation/taskcluster/windows/build_gyp.sh:
Bug 1399095 - Allow nss-try to be used to test NSPR changes.
r=kjacobs
[6e1a8a7cb469]
2019-09-16 Marcus Burghardt <mburghardt@mozilla.com>
* gtests/ssl_gtest/manifest.mn,
gtests/ssl_gtest/ssl_cipherorder_unittest.cc,
gtests/ssl_gtest/ssl_gtest.gyp, lib/ssl/ssl3con.c, lib/ssl/sslexp.h,
lib/ssl/sslsock.c:
Bug 1267894 - New functions for CipherSuites Ordering and gtests.
r=jcj,kjacobs,mt
Created two new experimental functions which permit the caller
change the default order of CipherSuites used during the handshake.
[2deb38fc1d68]
2019-09-18 Christian Weisgerber <naddy@mips.inka.de>
* tests/policy/policy.sh, tests/ssl/ssl.sh:
Bug 1581507 - Fix unportable grep expression in test scripts
r=marcusburghardt
[edc1e405afa4]
2019-09-18 Franziskus Kiefer <franziskuskiefer@gmail.com>
* lib/jar/jarfile.c:
Bug 1234830 - [CID 1242894][CID 1242852] unused values.
r=kaie,r=kjacobs
[b6d3f5c95aad]
2019-09-18 Kai Engert <kaie@kuix.de>
* cmd/symkeyutil/symkeyutil.c:
Bug 1581759 - fix incorrect if condition in symkeyutil. r=kjacobs
[306550105228]
Differential Revision: https://phabricator.services.mozilla.com/D46967
--HG--
extra : moz-landing-system : lando
2019-09-18 Kevin Jacobs <kjacobs@mozilla.com>
* cmd/lib/derprint.c:
Bug 1581024 - Check for pointer wrap in derprint.c. r=jcj
Check for pointer wrap on output-length check in the derdump
utility.
[a3ee4f26b4c1] [tip]
2019-09-18 Giulio Benetti <giulio.benetti@micronovasrl.com>
* lib/freebl/gcm-aarch64.c:
Bug 1580126 - Fix build failure on aarch64_be while building
freebl/gcm r=kjacobs
Build failure is caused by different #ifdef conditions in gcm.c and
gcm-aarch64.c that leads to double declaration of the same gcm_*
functions.
Fix #ifdef condition in gcm-aarch64.c making it the same as the one
in gcm.c.
Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
[fa0d958de0c3]
2019-09-17 Kai Engert <kaie@kuix.de>
* automation/taskcluster/graph/src/extend.js:
Bug 1385039 - Build NSPR tests as part of NSS continuous
integration. r=kjacobs
[cc97f1a93038]
2019-09-17 Landry Breuil <landry@openbsd.org>
* lib/freebl/Makefile:
Bug 1581391 - include gcm-aarch64 on all unices, not only linux
r=kjacobs
[e7b4f293fa4e]
2019-09-17 Martin Thomson <mt@lowentropy.net>
* mach:
Bug 1581041 - Rename mach-commands to mach-completion, r=jcj
This means that we can point our completion at the gecko one.
[bc91272fcbdc]
2019-09-16 Jenine <jenine_c@outlook.com>
* cmd/pk11importtest/pk11importtest.c, lib/softoken/pkcs11.c:
Bug 1558313 - Fix clang warnings in pk11importtest.c and pkcs11.c
r=marcusburghardt
[4569b745f74e]
2019-09-13 Daiki Ueno <dueno@redhat.com>
* lib/certhigh/certvfy.c:
Bug 1542207, fix policy check on signature algorithms, r=rrelyea
Reviewers: rrelyea
Reviewed By: rrelyea
Bug #: 1542207
[ed8a41d16c1c]
2019-09-05 Daiki Ueno <dueno@redhat.com>
* lib/freebl/drbg.c:
Bug 1560329, drbg: perform continuous test on entropy source,
r=rrelyea
Summary: FIPS 140-2 section 4.9.2 requires a conditional self test
to check that consecutive entropy blocks from the system are
different. As neither getentropy() nor /dev/urandom provides that
check on the output, this adds the self test at caller side.
Reviewers: rrelyea
Reviewed By: rrelyea
Bug #: 1560329
[c66dd879d16a]
2019-09-06 Martin Thomson <mt@lowentropy.net>
* automation/taskcluster/graph/src/queue.js:
Bug 1579290 - Disable LSAN during builds, r=ueno
Summary: See the bug description for details.
[f28f3d7b7cf0]
2019-09-13 Kai Engert <kaie@kuix.de>
* Makefile, build.sh, coreconf/nspr.sh, help.txt:
Bug 1385061 - Build NSPR tests with NSS make; Add gyp parameters to
build/run NSPR tests. r=jcj
[8b4a226f7d23]
2019-09-11 Kai Engert <kaie@kuix.de>
* nss.gyp:
Bug 1577359 - Build atob and btoa for Thunderbird. r=jcj
[1fe61aadaf57]
2019-09-10 Marcus Burghardt <mburghardt@mozilla.com>
* cmd/pk12util/pk12util.c:
Bug 1579036 - Define error when trying to export non-existent cert
with pk12util. r=jcj
[65ab97f03c89]
2019-09-04 Martin Thomson <mt@lowentropy.net>
* gtests/mozpkix_gtest/pkixder_input_tests.cpp:
Bug 1578626 - Remove undefined nullptr decrement, r=keeler
Summary: This uses uintptr_t to avoid the worst. It still looks
terrible and might trip static analysis warnings, but the
reinterpret_cast should hide that.
This assumes that sizeof(uintptr_t) == sizeof(void*), so I've added
an assertion so that we'll at least fail the test on those systems.
(We could use GTEST_SKIP instead, but we don't have that in the
version of gtest that we use.)
Reviewers: keeler
Tags: #secure-revision
Bug #: 1578626
[d2485b1c997e]
2019-09-05 Marcus Burghardt <mburghardt@mozilla.com>
* gtests/pk11_gtest/pk11_find_certs_unittest.cc:
Bug 1578751 - Ensure a consistent style for
pk11_find_certs_unittest.cc. r=jcj
Adjusted the style and clang-format after the changes in some var
names.
[e95fee7f59e5]
Differential Revision: https://phabricator.services.mozilla.com/D46246
--HG--
extra : moz-landing-system : lando
2019-08-30 Alexander Scheel <ascheel@redhat.com>
* automation/taskcluster/scripts/build_softoken.sh,
cmd/lib/pk11table.c, gtests/pk11_gtest/pk11_aes_cmac_unittest.cc,
gtests/pk11_gtest/pk11_gtest.gyp, lib/pk11wrap/debug_module.c,
lib/pk11wrap/pk11mech.c, lib/softoken/pkcs11.c,
lib/softoken/pkcs11c.c, lib/util/pkcs11t.h:
Bug 1570501 - Expose AES-CMAC in PKCS #11 API, r=mt
[cf0df88aa807] [tip]
* cpputil/freebl_scoped_ptrs.h, gtests/freebl_gtest/cmac_unittests.cc,
gtests/freebl_gtest/freebl_gtest.gyp, lib/freebl/blapi.h,
lib/freebl/cmac.c, lib/freebl/cmac.h, lib/freebl/exports.gyp,
lib/freebl/freebl_base.gypi, lib/freebl/ldvector.c,
lib/freebl/loader.c, lib/freebl/loader.h, lib/freebl/manifest.mn:
Bug 1570501 - Add AES-CMAC implementation to freebl, r=mt
[a42c6882ba1b]
2019-09-05 David Cooper <dcooper16@gmail.com>
* lib/smime/cmssiginfo.c:
Bug 657379 - NSS uses the wrong OID for signatureAlgorithm field of
signerInfo in CMS for DSA and ECDSA. r=rrelyea
[7a83b248de30]
2019-09-05 Daiki Ueno <dueno@redhat.com>
* lib/freebl/drbg.c:
Backed out changeset 934c8d0e7aba
It turned out to cause some new errors in LSan; backing out for now.
[34a254dd1357]
* lib/freebl/drbg.c:
Bug 1560329, drbg: perform continuous test on entropy source,
r=rrelyea
Summary: FIPS 140-2 section 4.9.2 requires a conditional self test
to check that consecutive entropy blocks from the system are
different. As neither getentropy() nor /dev/urandom provides that
check on the output, this adds the self test at caller side.
Reviewers: rrelyea
Reviewed By: rrelyea
Bug #: 1560329
[934c8d0e7aba]
2019-08-30 Kevin Jacobs <kjacobs@mozilla.com>
* coreconf/WIN32.mk:
Bug 1576664 - Remove -mms-bitfields from win32 makefile r=jcj
[bf4de7985f3d]
2019-08-29 Dana Keeler <dkeeler@mozilla.com>
* automation/abi-check/expected-report-libnss3.so.txt,
gtests/pk11_gtest/pk11_find_certs_unittest.cc, lib/nss/nss.def,
lib/pk11wrap/pk11cert.c, lib/pk11wrap/pk11pub.h:
bug 1577038 - add PK11_GetCertsFromPrivateKey r=jcj,kjacobs
PK11_GetCertFromPrivateKey only returns one certificate with a
public key that matches the given private key. This change
introduces PK11_GetCertsFromPrivateKey, which returns a list of all
certificates with public keys that match the given private key.
[9befa8d296c0]
2019-08-30 J.C. Jones <jjones@mozilla.com>
* automation/abi-check/previous-nss-release, lib/nss/nss.h,
lib/softoken/softkver.h, lib/util/nssutil.h:
Set version numbers to 3.47 beta
[685cea0a7b48]
* lib/nss/nss.h, lib/softoken/softkver.h, lib/util/nssutil.h:
Set version numbers to 3.46 final
[decbf7bd40fd] [NSS_3_46_RTM]
Differential Revision: https://phabricator.services.mozilla.com/D44927
--HG--
extra : moz-landing-system : lando
2019-08-30 J.C. Jones <jjones@mozilla.com>
* lib/nss/nss.h, lib/softoken/softkver.h, lib/util/nssutil.h:
Set version numbers to 3.46 final
[decbf7bd40fd] [NSS_3_46_RTM]
2019-08-27 J.C. Jones <jjones@mozilla.com>
* .hgtags:
Added tag NSS_3_46_BETA2 for changeset 24b0fc700203
[29cd579e74e4]
Differential Revision: https://phabricator.services.mozilla.com/D44206
--HG--
extra : moz-landing-system : lando
2019-08-27 Kevin Jacobs <kjacobs@mozilla.com>
* automation/taskcluster/graph/src/extend.js,
automation/taskcluster/scripts/build_gyp.sh,
automation/taskcluster/windows/build_gyp.sh, fuzz/fuzz.gyp,
gtests/pk11_gtest/pk11_gtest.gyp,
gtests/softoken_gtest/softoken_gtest.gyp, tests/all.sh,
tests/ssl/ssl.sh:
Bug 1485533 - Close gaps in taskcluster SSL testing. r=mt
This patch increases SSL testing on taskcluster, specifically,
running an additional 395 tests on each SSL cycle (more for FIPS
targets), and adding a new 'stress' cycle.
Notable changes:
1) This patch removes SSL stress tests from the default
`NSS_SSL_RUN` list in all.sh and ssl.sh. If stress tests are needed,
this variable must be set to include.
2) The "normal_normal" case is added to `NSS_SSL_TESTS` for all
targets. FIPS targets also run "normal_fips", "fips_normal", and
"fips_fips".
3) `--enable-libpkix` is now set for all taskcluster "build.sh"
builds in order to support a number of OCSP tests that were
previously not run.
[24b0fc700203] [NSS_3_46_BETA2]
2019-08-23 Edouard Oger <eoger@fastmail.com>
* lib/sqlite/Makefile, lib/sqlite/sqlite.gyp:
Bug 1549847 - Ignore sqlite compilation warnings. r=mt
[7f146eb7adac]
2019-08-23 J.C. Jones <jjones@mozilla.com>
* .hgtags:
Added tag NSS_3_46_BETA1 for changeset 44aa330de2aa
[d3035cc9dc73]
Differential Revision: https://phabricator.services.mozilla.com/D43724
--HG--
extra : moz-landing-system : lando
2019-08-23 Kevin Jacobs <kjacobs@mozilla.com>
* tests/common/cleanup.sh:
Bug 1560593 - Check that BUILD_OPT is defined before testing its
value. r=jcj
[44aa330de2aa] [NSS_3_46_BETA1]
* cmd/strsclnt/strsclnt.c:
Bug 1575968 - Add strsclnt option to enforce the use of either IPv4
or IPv6 r=jcj
[da284d8993ea]
2019-08-23 Marcus Burghardt <mburghardt@mozilla.com>
* gtests/softoken_gtest/softoken_gtest.cc:
Bug 1573942 - Gtest for pkcs11.txt with different breaking line
formats. r=kjacobs
[d07a07eb0e40]
2019-08-21 Kevin Jacobs <kjacobs@mozilla.com>
* lib/util/utilmod.c:
Bug 1564284: Added check for CR + LF, r=marcusburghardt,kjacobs
Looks good and it was already tested locally with this gtest patch:
[d1d2e1e320cd]
2019-08-22 Martin Thomson <mt@lowentropy.net>
* lib/ssl/ssl3con.c:
Bug 1528666 - Formatting, a=bustage
[60eeac76c8ec]
2019-08-20 Martin Thomson <martin.thomson@gmail.com>
* gtests/ssl_gtest/ssl_0rtt_unittest.cc,
gtests/ssl_gtest/ssl_resumption_unittest.cc, lib/ssl/ssl3con.c:
Bug 1528666 - Correct resumption validation checks, r=jcj
We allowed cross-suite resumption before, but it didn't work. This
enables that for clients.
As a secondary minor tweak, clients will no longer validate the
availability of a cipher suite based on their configured version
range when attempting resumption. Instead, they will check whether
the suite works for the version in the session that they are
attempting to resume. In theory, this doesn't change anything
because the previous session should not have selected an
incompatible combination of version and cipher suite, but it's worth
being extra precise.
[cab2c8905214]
2019-08-22 Martin Thomson <mt@lowentropy.net>
* gtests/ssl_gtest/ssl_auth_unittest.cc,
gtests/ssl_gtest/ssl_resumption_unittest.cc, lib/ssl/ssl3con.c:
Bug 1568803 - More tests for client certificate authentication,
r=kjacobs
These were previously disabled because of difficulties (at the time)
in writing these tests for TLS 1.3. The framework, and my
understanding of it, has since improved, so these tests can be
restored and expanded. This exposed a minor correctness issue that
is also corrected.
[95f97d31c313]
Differential Revision: https://phabricator.services.mozilla.com/D43308
--HG--
extra : moz-landing-system : lando
Revset: reverse(89aa19677e37~-1::bbfc55939d75)
2019-08-14 Kevin Jacobs <kjacobs@mozilla.com>
* gtests/ssl_gtest/tls_agent.cc:
Bug 1572593 - Re-revert call to CheckCertReqAgainstDefaultCAs to
avoid memory leak (filed as bug 1573945). r=jcj
Revert back to the changes Franziskus had made. Updated the in-
source bug number to point to the new memleak bug.
Differential Revision:
https://phabricator.services.mozilla.com/D42020
[bbfc55939d75] [tip]
2019-08-12 Kevin Jacobs <kjacobs@mozilla.com>
* gtests/freebl_gtest/freebl_gtest.gyp,
gtests/mozpkix_gtest/mozpkix_gtest.gyp:
Bug 1415118 - Fix --enable-libpkix builds from build.sh r=mt,jcj
Differential Revision:
https://phabricator.services.mozilla.com/D41617
[f8926908be71]
2019-08-14 J.C. Jones <jjones@mozilla.com>
* gtests/ssl_gtest/tls_agent.cc, lib/ssl/ssl3ext.c:
Bug 1572593 - Reset advertised extensions in ssl_ConstructExtensions
r=mt,kjacobs
Reset the list of advertised extensions before sending a new set.
This reverts the changes of https://hg.mozilla.org/projects/nss/rev/
1ca362213631d6edc885b6b965b52ecffcf29afd
Differential Revision:
https://phabricator.services.mozilla.com/D41302
[b03ff661491e]
2019-08-14 Kevin Jacobs <kjacobs@mozilla.com>
* lib/freebl/ctr.c:
Bug 1539788 - UBSAN fixup for 128b counter. r=mt,jcj
Differential Revision:
https://phabricator.services.mozilla.com/D41884
[9d1f5e71773d]
2019-08-13 Kevin Jacobs <kjacobs@mozilla.com>
* lib/freebl/chacha20poly1305.c, lib/freebl/ctr.c, lib/freebl/gcm.c,
lib/freebl/intel-gcm-wrap.c, lib/freebl/rsapkcs.c:
Bug 1539788 - Add length checks for cryptographic primitives
r=mt,jcj
This patch adds additional length checks around cryptographic
primitives.
Differential Revision:
https://phabricator.services.mozilla.com/D36079
[dfd6996fe742]
2019-08-13 Marcus Burghardt <mburghardt@mozilla.com>
* gtests/freebl_gtest/mpi_unittest.cc, lib/freebl/mpi/README,
lib/freebl/mpi/mpi.c, lib/freebl/mpi/mpi.h:
Bug 1542077 - Added extra controls and tests to mp_set_int and
mp_set_ulong. r=jcj,kjacobs
Differential Revision:
https://phabricator.services.mozilla.com/D40649
[9bc47e69613e]
2019-08-13 J.C. Jones <jjones@mozilla.com>
* gtests/ssl_gtest/ssl_resumption_unittest.cc,
gtests/ssl_gtest/tls_agent.cc:
Bug 1572791 - Fixup clang-format r=bustage
[ec113de50cdd]
* gtests/ssl_gtest/tls_agent.cc,
gtests/ssl_gtest/tls_subcerts_unittest.cc, lib/ssl/tls13subcerts.c:
Bug 1572791 - Check for nulls in SSLExp_DelegateCredential and its
tests r=kjacobs
This particularly catches test errors in tls_subcerts_unittest when
the profile is stale.
Differential Revision:
https://phabricator.services.mozilla.com/D41429
[ed5067857563]
2019-08-13 Kevin Jacobs <kjacobs@mozilla.com>
* gtests/ssl_gtest/ssl_auth_unittest.cc,
gtests/ssl_gtest/ssl_cert_ext_unittest.cc,
gtests/ssl_gtest/ssl_resumption_unittest.cc,
gtests/ssl_gtest/tls_agent.cc:
Bug 1572791 - Fix ASAN cert errors when SSL gtests run on empty
profile r=jcj
Differential Revision:
https://phabricator.services.mozilla.com/D41787
[cef2aa7f3b8c]
2019-08-09 Kevin Jacobs <kjacobs@mozilla.com>
* tests/common/cleanup.sh:
Bug 1560593 - Cleanup.sh to treat core dumps as test failures on
optimized builds. r=jcj
Differential Revision:
https://phabricator.services.mozilla.com/D41392
[360010725fdb]
Differential Revision: https://phabricator.services.mozilla.com/D42139
--HG--
extra : moz-landing-system : lando
Backed out changeset f019d4ffff53 (bug 1414735)for failing Gtest TransportTest.TestCipherMismatch and Xpcshell dom/presentation/tests/xpcshell/test_tcp_control_channel.js tests on a CLOSED TREE r=backout UPGRADE_NSS_RELEASE
J.C. Jones
Kevin Jacobs
Mihai Alexandru Michis
J.C. Jones
Martin Thomson
Kai Engert
Franziskus Kiefer
Tim Taubert
Andreea Pavel
Narcis Beleuzu
Csoregi Natalia
Rok Garbas