Skip to content
This repository was archived by the owner on Jul 9, 2025. It is now read-only.

Commit b2d3591

Browse files
AndreeaPavelAndreeaPavel
committed
Merge mozilla-inbound to mozilla-central. a=merge
--HG-- extra : amend_source : 195a9fee199856b4fedbe199345d31161fedfc39
2 parents 49207fb + 1290444 commit b2d3591

File tree

25 files changed

+1248
-58
lines changed

25 files changed

+1248
-58
lines changed

‎security/manager/ssl/RootHashes.inc

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,12 @@ static const struct CertAuthorityHash ROOT_TABLE[] = {
9999
0x1B, 0xB4, 0xAF, 0xAC, 0xF0, 0xAA, 0x9A, 0x58, 0xB5, 0xD5, 0x7A, 0x33, 0x8A, 0x3A, 0xFB, 0xCB },
100100
51 /* Bin Number */
101101
},
102+
{
103+
/* emSign_Root_CA___C1 */
104+
{ 0x12, 0x56, 0x09, 0xAA, 0x30, 0x1D, 0xA0, 0xA2, 0x49, 0xB9, 0x7A, 0x82, 0x39, 0xCB, 0x6A, 0x34,
105+
0x21, 0x6F, 0x44, 0xDC, 0xAC, 0x9F, 0x39, 0x54, 0xB1, 0x42, 0x92, 0xF2, 0xE8, 0xC8, 0x60, 0x8F },
106+
208 /* Bin Number */
107+
},
102108
{
103109
/* Global_Chambersign_Root___2008 */
104110
{ 0x13, 0x63, 0x35, 0x43, 0x93, 0x34, 0xA7, 0x69, 0x80, 0x16, 0xA0, 0xD3, 0x24, 0xDE, 0x72, 0x28,
@@ -309,6 +315,12 @@ static const struct CertAuthorityHash ROOT_TABLE[] = {
309315
0x8F, 0xF6, 0x1E, 0x17, 0x08, 0xDF, 0x68, 0x81, 0x72, 0x48, 0x49, 0xCD, 0x5D, 0x27, 0xCB, 0x69 },
310316
30 /* Bin Number */
311317
},
318+
{
319+
/* emSign_Root_CA___G1 */
320+
{ 0x40, 0xF6, 0xAF, 0x03, 0x46, 0xA9, 0x9A, 0xA1, 0xCD, 0x1D, 0x55, 0x5A, 0x4E, 0x9C, 0xCE, 0x62,
321+
0xC7, 0xF9, 0x63, 0x46, 0x03, 0xEE, 0x40, 0x66, 0x15, 0x83, 0x3D, 0xC8, 0xC8, 0xD0, 0x03, 0x67 },
322+
206 /* Bin Number */
323+
},
312324
{
313325
/* OISTE_WISeKey_Global_Root_GA_CA */
314326
{ 0x41, 0xC9, 0x23, 0x86, 0x6A, 0xB4, 0xCA, 0xD6, 0xB7, 0xAD, 0x57, 0x80, 0x81, 0x58, 0x2E, 0x02,
@@ -447,6 +459,12 @@ static const struct CertAuthorityHash ROOT_TABLE[] = {
447459
0x5A, 0x5B, 0x2B, 0x45, 0x7D, 0x81, 0xF3, 0x69, 0x2B, 0x61, 0x0A, 0x98, 0x67, 0x2F, 0x0E, 0x1B },
448460
139 /* Bin Number */
449461
},
462+
{
463+
/* Hongkong_Post_Root_CA_3 */
464+
{ 0x5A, 0x2F, 0xC0, 0x3F, 0x0C, 0x83, 0xB0, 0x90, 0xBB, 0xFA, 0x40, 0x60, 0x4B, 0x09, 0x88, 0x44,
465+
0x6C, 0x76, 0x36, 0x18, 0x3D, 0xF9, 0x84, 0x6E, 0x17, 0x10, 0x1A, 0x44, 0x7F, 0xB8, 0xEF, 0xD6 },
466+
210 /* Bin Number */
467+
},
450468
{
451469
/* TrustCor_ECA_1 */
452470
{ 0x5A, 0x88, 0x5D, 0xB1, 0x9C, 0x01, 0xD9, 0x12, 0xC5, 0x75, 0x93, 0x88, 0x93, 0x8C, 0xAF, 0xBB,
@@ -657,6 +675,12 @@ static const struct CertAuthorityHash ROOT_TABLE[] = {
657675
0x4A, 0xD6, 0x8B, 0x69, 0xB8, 0xEE, 0x88, 0x68, 0x4F, 0xF7, 0x11, 0x37, 0x58, 0x05, 0xB3, 0x48 },
658676
37 /* Bin Number */
659677
},
678+
{
679+
/* emSign_ECC_Root_CA___G3 */
680+
{ 0x86, 0xA1, 0xEC, 0xBA, 0x08, 0x9C, 0x4A, 0x8D, 0x3B, 0xBE, 0x27, 0x34, 0xC6, 0x12, 0xBA, 0x34,
681+
0x1D, 0x81, 0x3E, 0x04, 0x3C, 0xF9, 0xE8, 0xA8, 0x62, 0xCD, 0x5C, 0x57, 0xA3, 0x6B, 0xBE, 0x6B },
682+
207 /* Bin Number */
683+
},
660684
{
661685
/* EC_ACC */
662686
{ 0x88, 0x49, 0x7F, 0x01, 0x60, 0x2F, 0x31, 0x54, 0x24, 0x6A, 0xE2, 0x8C, 0x4D, 0x5A, 0xEF, 0x10,
@@ -897,6 +921,12 @@ static const struct CertAuthorityHash ROOT_TABLE[] = {
897921
0x6F, 0x05, 0x45, 0x27, 0xE8, 0x02, 0xEA, 0xA9, 0x2D, 0x59, 0x54, 0x44, 0x25, 0x8A, 0xFE, 0x71 },
898922
120 /* Bin Number */
899923
},
924+
{
925+
/* emSign_ECC_Root_CA___C3 */
926+
{ 0xBC, 0x4D, 0x80, 0x9B, 0x15, 0x18, 0x9D, 0x78, 0xDB, 0x3E, 0x1D, 0x8C, 0xF4, 0xF9, 0x72, 0x6A,
927+
0x79, 0x5D, 0xA1, 0x64, 0x3C, 0xA5, 0xF1, 0x35, 0x8E, 0x1D, 0xDB, 0x0E, 0xDC, 0x0D, 0x7E, 0xB3 },
928+
209 /* Bin Number */
929+
},
900930
{
901931
/* AffirmTrust_Premium_ECC */
902932
{ 0xBD, 0x71, 0xFD, 0xF6, 0xDA, 0x97, 0xE4, 0xCF, 0x62, 0xD1, 0x64, 0x7A, 0xDD, 0x25, 0x81, 0xB0,

‎security/manager/tools/KnownRootHashes.json

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1033,7 +1033,32 @@
10331033
"label": "Certigna_Root_CA",
10341034
"binNumber": 205,
10351035
"sha256Fingerprint": "1I09I+7bUKRZ5VGXYBwnd0udexjJTVoFlRGhAlC5MWg="
1036+
},
1037+
{
1038+
"label": "emSign_Root_CA___G1",
1039+
"binNumber": 206,
1040+
"sha256Fingerprint": "QPavA0apmqHNHVVaTpzOYsf5Y0YD7kBmFYM9yMjQA2c="
1041+
},
1042+
{
1043+
"label": "emSign_ECC_Root_CA___G3",
1044+
"binNumber": 207,
1045+
"sha256Fingerprint": "hqHsugicSo07vic0xhK6NB2BPgQ8+eioYs1cV6Nrvms="
1046+
},
1047+
{
1048+
"label": "emSign_Root_CA___C1",
1049+
"binNumber": 208,
1050+
"sha256Fingerprint": "ElYJqjAdoKJJuXqCOctqNCFvRNysnzlUsUKS8ujIYI8="
1051+
},
1052+
{
1053+
"label": "emSign_ECC_Root_CA___C3",
1054+
"binNumber": 209,
1055+
"sha256Fingerprint": "vE2AmxUYnXjbPh2M9PlyanldoWQ8pfE1jh3bDtwNfrM="
1056+
},
1057+
{
1058+
"label": "Hongkong_Post_Root_CA_3",
1059+
"binNumber": 210,
1060+
"sha256Fingerprint": "Wi/APwyDsJC7+kBgSwmIRGx2Nhg9+YRuFxAaRH+479Y="
10361061
}
10371062
],
1038-
"maxBin": 205
1063+
"maxBin": 210
10391064
}

‎security/nss/TAG-INFO

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
536fd7c9db5a
1+
a306d84e4c70

‎security/nss/cmd/strsclnt/strsclnt.c

Lines changed: 36 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,9 @@ static PRBool enableCertStatus = PR_FALSE;
121121

122122
PRIntervalTime maxInterval = PR_INTERVAL_NO_TIMEOUT;
123123

124+
static const SSLSignatureScheme *enabledSigSchemes = NULL;
125+
static unsigned int enabledSigSchemeCount = 0;
126+
124127
char *progName;
125128

126129
secuPWData pwdata = { PW_NONE, 0 };
@@ -143,7 +146,8 @@ Usage(void)
143146
"Usage: %s [-n nickname] [-p port] [-d dbdir] [-c connections]\n"
144147
" [-BDNovqs] [-f filename] [-N | -P percentage]\n"
145148
" [-w dbpasswd] [-C cipher(s)] [-t threads] [-W pwfile]\n"
146-
" [-V [min-version]:[max-version]] [-a sniHostName] hostname\n"
149+
" [-V [min-version]:[max-version]] [-a sniHostName]\n"
150+
" [-J signatureschemes] hostname\n"
147151
" where -v means verbose\n"
148152
" -o flag is interpreted as follows:\n"
149153
" 1 -o means override the result of server certificate validation.\n"
@@ -161,7 +165,17 @@ Usage(void)
161165
" -T enable the cert_status extension (OCSP stapling)\n"
162166
" -u enable TLS Session Ticket extension\n"
163167
" -z enable compression\n"
164-
" -g enable false start\n",
168+
" -g enable false start\n"
169+
" -J enable signature schemes\n"
170+
" This takes a comma separated list of signature schemes in preference\n"
171+
" order.\n"
172+
" Possible values are:\n"
173+
" rsa_pkcs1_sha1, rsa_pkcs1_sha256, rsa_pkcs1_sha384, rsa_pkcs1_sha512,\n"
174+
" ecdsa_sha1, ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384,\n"
175+
" ecdsa_secp521r1_sha512,\n"
176+
" rsa_pss_rsae_sha256, rsa_pss_rsae_sha384, rsa_pss_rsae_sha512,\n"
177+
" rsa_pss_pss_sha256, rsa_pss_pss_sha384, rsa_pss_pss_sha512,\n"
178+
" dsa_sha1, dsa_sha256, dsa_sha384, dsa_sha512\n",
165179
progName);
166180
exit(1);
167181
}
@@ -1158,6 +1172,14 @@ client_main(
11581172
errExit("error setting SSL/TLS version range ");
11591173
}
11601174

1175+
if (enabledSigSchemes) {
1176+
rv = SSL_SignatureSchemePrefSet(model_sock, enabledSigSchemes,
1177+
enabledSigSchemeCount);
1178+
if (rv < 0) {
1179+
errExit("SSL_SignatureSchemePrefSet");
1180+
}
1181+
}
1182+
11611183
if (bigBuf.data) { /* doing FDX */
11621184
rv = SSL_OptionSet(model_sock, SSL_ENABLE_FDX, 1);
11631185
if (rv < 0) {
@@ -1316,7 +1338,7 @@ main(int argc, char **argv)
13161338
/* XXX: 'B' was used in the past but removed in 3.28,
13171339
* please leave some time before resuing it. */
13181340
optstate = PL_CreateOptState(argc, argv,
1319-
"C:DNP:TUV:W:a:c:d:f:gin:op:qst:uvw:z");
1341+
"C:DJ:NP:TUV:W:a:c:d:f:gin:op:qst:uvw:z");
13201342
while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
13211343
switch (optstate->option) {
13221344
case 'C':
@@ -1330,6 +1352,15 @@ main(int argc, char **argv)
13301352
case 'I': /* reserved for OCSP multi-stapling */
13311353
break;
13321354

1355+
case 'J':
1356+
rv = parseSigSchemeList(optstate->value, &enabledSigSchemes, &enabledSigSchemeCount);
1357+
if (rv != SECSuccess) {
1358+
PL_DestroyOptState(optstate);
1359+
fprintf(stderr, "Bad signature scheme specified.\n");
1360+
Usage();
1361+
}
1362+
break;
1363+
13331364
case 'N':
13341365
NoReuse = 1;
13351366
break;
@@ -1516,6 +1547,8 @@ main(int argc, char **argv)
15161547

15171548
PL_strfree(hostName);
15181549

1550+
PORT_Free((SSLSignatureScheme *)enabledSigSchemes);
1551+
15191552
/* some final stats. */
15201553
printf(
15211554
"strsclnt: %ld cache hits; %ld cache misses, %ld cache not reusable\n"

‎security/nss/coreconf/coreconf.dep

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,4 @@
1010
*/
1111

1212
#error "Do not include this header file."
13+

‎security/nss/cpputil/scoped_ptrs_smime.h

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
2+
/* vim: set ts=2 et sw=2 tw=80: */
3+
/* This Source Code Form is subject to the terms of the Mozilla Public
4+
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
5+
* You can obtain one at http://mozilla.org/MPL/2.0/. */
6+
7+
#ifndef scoped_ptrs_smime_h__
8+
#define scoped_ptrs_smime_h__
9+
10+
#include <memory>
11+
#include "smime.h"
12+
13+
struct ScopedDeleteSmime {
14+
void operator()(NSSCMSMessage* id) { NSS_CMSMessage_Destroy(id); }
15+
};
16+
17+
template <class T>
18+
struct ScopedMaybeDeleteSmime {
19+
void operator()(T* ptr) {
20+
if (ptr) {
21+
ScopedDeleteSmime del;
22+
del(ptr);
23+
}
24+
}
25+
};
26+
27+
#define SCOPED(x) \
28+
typedef std::unique_ptr<x, ScopedMaybeDeleteSmime<x> > Scoped##x
29+
30+
SCOPED(NSSCMSMessage);
31+
32+
#undef SCOPED
33+
34+
#endif // scoped_ptrs_smime_h__

‎security/nss/doc/Makefile

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ all: prepare all-man all-html
2121
prepare: date-and-version
2222
mkdir -p html
2323
mkdir -p nroff
24-
24+
2525
clean:
2626
rm -f date.xml version.xml *.tar.bz2
2727
rm -f html/*.proc
@@ -45,11 +45,11 @@ version.xml:
4545

4646
nroff/%.1 : %.xml
4747
$(COMPILE.1) $<
48-
48+
4949
MANPAGES = \
5050
nroff/certutil.1 nroff/cmsutil.1 nroff/crlutil.1 nroff/pk12util.1 \
5151
nroff/modutil.1 nroff/ssltap.1 nroff/derdump.1 nroff/signtool.1 nroff/signver.1 \
52-
nroff/pp.1 nroff/vfychain.1 nroff/vfyserv.1
52+
nroff/pp.1 nroff/vfychain.1 nroff/vfyserv.1 nroff/nss-policy-check.1
5353

5454
all-man: prepare $(MANPAGES)
5555

@@ -64,6 +64,6 @@ html/%.html : %.xml
6464
HTMLPAGES = \
6565
html/certutil.html html/cmsutil.html html/crlutil.html html/pk12util.html html/modutil.html \
6666
html/ssltap.html html/derdump.html html/signtool.html html/signver.html html/pp.html \
67-
html/vfychain.html html/vfyserv.html
67+
html/vfychain.html html/vfyserv.html html/nss-policy-check.html
6868

6969
all-html: prepare $(HTMLPAGES)

‎security/nss/doc/certutil.xml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,10 @@ Use the -a argument to specify ASCII output.</para></listitem>
179179
For certificate requests, ASCII output defaults to standard output unless redirected.</para></listitem>
180180
</varlistentry>
181181

182+
<varlistentry>
183+
<term>--simple-self-signed</term>
184+
<listitem><para>When printing the certificate chain, don't search for a chain if issuer name equals to subject name.</para></listitem>
185+
</varlistentry>
182186
<varlistentry>
183187
<term>-b validity-time</term>
184188
<listitem><para>Specify a time at which a certificate is required to be valid. Use when checking certificate validity with the <option>-V</option> option. The format of the <emphasis>validity-time</emphasis> argument is <emphasis>YYMMDDHHMMSS[+HHMM|-HHMM|Z]</emphasis>, which allows offsets to be set relative to the validity end time. Specifying seconds (<emphasis>SS</emphasis>) is optional. When specifying an explicit time, use a Z at the end of the term, <emphasis>YYMMDDHHMMSSZ</emphasis>, to close it. When specifying an offset time, use <emphasis>YYMMDDHHMMSS+HHMM</emphasis> or <emphasis>YYMMDDHHMMSS-HHMM</emphasis> for adding or subtracting time, respectively.

‎security/nss/doc/nss-policy-check.xml

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3+
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
4+
<!ENTITY date SYSTEM "date.xml">
5+
<!ENTITY version SYSTEM "version.xml">
6+
]>
7+
8+
<refentry id="nss-policy-check">
9+
10+
<refentryinfo>
11+
<date>&date;</date>
12+
<title>NSS Security Tools</title>
13+
<productname>nss-tools</productname>
14+
<productnumber>&version;</productnumber>
15+
</refentryinfo>
16+
17+
<refmeta>
18+
<refentrytitle>NSS-POLICY-CHECK</refentrytitle>
19+
<manvolnum>1</manvolnum>
20+
</refmeta>
21+
22+
<refnamediv>
23+
<refname>nss-policy-check</refname>
24+
<refpurpose>nss-policy-check policy-file</refpurpose>
25+
</refnamediv>
26+
27+
<refsynopsisdiv>
28+
<cmdsynopsis>
29+
<command>nss-policy-check</command>
30+
</cmdsynopsis>
31+
</refsynopsisdiv>
32+
33+
<refsection id="description">
34+
<title>Description</title>
35+
<para><command>nss-policy-check</command> verifies crypto-policy configuration that controls certain crypto algorithms are allowed/disallowed to use in the NSS library.</para>
36+
37+
<para>The crypto-policy configuration can be stored in either a system-wide configuration file, specified with the POLICY_PATH and POLICY_FILE build options, or in the pkcs11.txt in NSS database.</para>
38+
</refsection>
39+
40+
<refsection id="basic-usage">
41+
<title>Usage and Examples</title>
42+
<para>To check the global crypto-policy configuration in <filename>/etc/crypto-policies/back-ends/nss.config</filename>:
43+
</para>
44+
<programlisting>$ nss-policy-check /etc/crypto-policies/back-ends/nss.config
45+
NSS-POLICY-INFO: LOADED-SUCCESSFULLY
46+
NSS-POLICY-INFO: PRIME256V1 is enabled for KX
47+
NSS-POLICY-INFO: PRIME256V1 is enabled for CERT-SIGNATURE
48+
NSS-POLICY-INFO: SECP256R1 is enabled for KX
49+
NSS-POLICY-INFO: SECP256R1 is enabled for CERT-SIGNATURE
50+
NSS-POLICY-INFO: SECP384R1 is enabled for KX
51+
NSS-POLICY-INFO: SECP384R1 is enabled for CERT-SIGNATURE
52+
...
53+
NSS-POLICY-INFO: NUMBER-OF-SSL-ALG-KX: 13
54+
NSS-POLICY-INFO: NUMBER-OF-SSL-ALG: 9
55+
NSS-POLICY-INFO: NUMBER-OF-CERT-SIG: 9
56+
...
57+
NSS-POLICY-INFO: ciphersuite TLS_AES_128_GCM_SHA256 is enabled
58+
NSS-POLICY-INFO: ciphersuite TLS_CHACHA20_POLY1305_SHA256 is enabled
59+
NSS-POLICY-INFO: ciphersuite TLS_AES_256_GCM_SHA384 is enabled
60+
...
61+
NSS-POLICY-INFO: NUMBER-OF-CIPHERSUITES: 24
62+
NSS-POLICY-INFO: NUMBER-OF-TLS-VERSIONS: 3
63+
NSS-POLICY-INFO: NUMBER-OF-DTLS-VERSIONS: 2
64+
</programlisting>
65+
<para>If there is a failure or warning, it will be prefixed with
66+
NSS-POLICY-FAIL or NSS-POLICY_WARN.
67+
</para>
68+
<para><command>nss-policy-check</command> exits with 2 if any
69+
failure is found, 1 if any warning is found, or 0 if no errors are
70+
found.</para>
71+
</refsection>
72+
73+
<!-- don't change -->
74+
<refsection id="resources">
75+
<title>Additional Resources</title>
76+
<para>For information about NSS and other tools related to NSS (like JSS), check out the NSS project wiki at <ulink url="http://www.mozilla.org/projects/security/pki/nss/">http://www.mozilla.org/projects/security/pki/nss/</ulink>. The NSS site relates directly to NSS code changes and releases.</para>
77+
<para>Mailing lists: https://lists.mozilla.org/listinfo/dev-tech-crypto</para>
78+
<para>IRC: Freenode at #dogtag-pki</para>
79+
</refsection>
80+
81+
<!-- fill in your name first; keep the other names for reference -->
82+
<refsection id="authors">
83+
<title>Authors</title>
84+
<para>The NSS tools were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</para>
85+
<para>
86+
Authors: Elio Maldonado &lt;emaldona@redhat.com>, Deon Lackey &lt;dlackey@redhat.com>.
87+
</para>
88+
</refsection>
89+
90+
<!-- don't change -->
91+
<refsection id="license">
92+
<title>LICENSE</title>
93+
<para>Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
94+
</para>
95+
</refsection>
96+
97+
</refentry>

‎security/nss/doc/pk12util.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@
108108
</varlistentry>
109109

110110
<varlistentry>
111-
<term>-n | --cert-key-len certKeyLength</term>
111+
<term>--cert-key-len certKeyLength</term>
112112
<listitem><para>Specify the desired length of the symmetric key to be used to encrypt the certificates and other meta-data.</para></listitem>
113113
</varlistentry>
114114

0 commit comments

Comments
 (0)