[NSS] ported mozilla upstream changes:

- Bug 1552254 internal_error alert on Certificate Request with sha1+ecdsa in TLS 1.3 (be6a9782)
- Bug 1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate. r=rrelyea (800111fa)
- Bug 1756271 - Remove token member from NSSSlot struct. r=rrelyea (55052f78)
- Bug 1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun. r=nss-reviewers,jschanck (2f2c8564)
- Bug 1755264 - TLS 1.3 Illegal legacy_version handling/alerts. r=djackson (7d931c59)
- Bug 1751305 - Remove expired explicitly distrusted certificates from certdata.txt. r=KathleenWilson (b722e523)
- Bug 1751298 - Add Telia Root CA v2 root certificate. r=KathleenWilson (1fcbbd7e)
- Bug 1754890 - Add two D-TRUST 2020 root certificates. r=KathleenWilson (f63fb86d)

security/nss/gtests/base_gtest/Makefile

@@ -0,0 +1,43 @@
+#! gmake
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# (1) Include initial platform-independent assignments (MANDATORY).   #
+#######################################################################
+
+include manifest.mn
+
+#######################################################################
+# (2) Include "global" configuration information. (OPTIONAL)          #
+#######################################################################
+
+include $(CORE_DEPTH)/coreconf/config.mk
+
+#######################################################################
+# (3) Include "component" configuration information. (OPTIONAL)       #
+#######################################################################
+
+
+#######################################################################
+# (4) Include "local" platform-dependent assignments (OPTIONAL).      #
+#######################################################################
+
+include ../common/gtest.mk
+
+#######################################################################
+# (5) Execute "global" rules. (OPTIONAL)                              #
+#######################################################################
+
+include $(CORE_DEPTH)/coreconf/rules.mk
+
+#######################################################################
+# (6) Execute "component" rules. (OPTIONAL)                           #
+#######################################################################
+
+
+#######################################################################
+# (7) Execute "local" rules. (OPTIONAL).                              #
+#######################################################################

security/nss/gtests/base_gtest/base_gtest.gyp

@@ -0,0 +1,31 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../common/gtest.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'base_gtest',
+      'type': 'executable',
+      'sources': [
+        'utf8_unittest.cc',
+        '<(DEPTH)/gtests/common/gtests.cc'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/gtests/google_test/google_test.gyp:gtest',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3',
+        '<(DEPTH)/lib/ssl/ssl.gyp:ssl3',
+        '<(DEPTH)/lib/nss/nss.gyp:nss3',
+        '<(DEPTH)/lib/smime/smime.gyp:smime3',
+        '<(DEPTH)/lib/base/base.gyp:nssb',
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}

security/nss/gtests/base_gtest/manifest.mn

@@ -0,0 +1,23 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+CORE_DEPTH = ../..
+DEPTH      = ../..
+MODULE = nss
+
+CPPSRCS = \
+      utf8_unittest.cc \
+      $(NULL)
+
+INCLUDES += -I$(CORE_DEPTH)/gtests/google_test/gtest/include \
+            -I$(CORE_DEPTH)/gtests/common \
+            -I$(CORE_DEPTH)/cpputil
+
+REQUIRES = nspr nss libdbm gtest
+
+PROGRAM = base_gtest
+
+EXTRA_LIBS = $(DIST)/lib/$(LIB_PREFIX)gtest.$(LIB_SUFFIX) $(EXTRA_OBJS) \
+             $(DIST)/lib/$(LIB_PREFIX)nssb.$(LIB_SUFFIX) \
+             $(DIST)/lib/$(LIB_PREFIX)gtestutil.$(LIB_SUFFIX)

security/nss/gtests/base_gtest/utf8_unittest.cc

@@ -0,0 +1,150 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "gtest/gtest.h"
+
+#include "nss.h"
+#include "base.h"
+#include "secerr.h"
+
+namespace nss_test {
+
+class Utf8Test : public ::testing::Test {};
+
+// Tests nssUTF8_Length rejects overlong forms, surrogates, etc.
+TEST_F(Utf8Test, Utf8Length) {
+  PRStatus status;
+
+  EXPECT_EQ(0u, nssUTF8_Length("", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+
+  // U+0000..U+007F
+  EXPECT_EQ(1u, nssUTF8_Length("\x01", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(1u, nssUTF8_Length("\x7F", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+
+  // lone trailing byte
+  EXPECT_EQ(0u, nssUTF8_Length("\x80", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xBF", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+
+  // overlong U+0000..U+007F
+  EXPECT_EQ(0u, nssUTF8_Length("\xC0\x80", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xC1\xBF", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+
+  // U+0080..U+07FF
+  EXPECT_EQ(2u, nssUTF8_Length("\xC2\x80", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(2u, nssUTF8_Length("\xDF\xBF", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+
+  // overlong U+0000..U+07FF
+  EXPECT_EQ(0u, nssUTF8_Length("\xE0\x80\x80", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xE0\x9F\xBF", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+
+  // U+0800..U+D7FF
+  EXPECT_EQ(3u, nssUTF8_Length("\xE0\xA0\x80", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(3u, nssUTF8_Length("\xE0\xBF\xBF", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(3u, nssUTF8_Length("\xE1\x80\x80", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(3u, nssUTF8_Length("\xEC\xBF\xBF", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(3u, nssUTF8_Length("\xED\x80\x80", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(3u, nssUTF8_Length("\xED\x9F\xBF", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+
+  // lone surrogate
+  EXPECT_EQ(0u, nssUTF8_Length("\xED\xA0\x80", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xED\xBF\xBF", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+
+  // U+E000..U+FFFF
+  EXPECT_EQ(3u, nssUTF8_Length("\xEE\x80\x80", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(3u, nssUTF8_Length("\xEF\xBF\xBF", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+
+  // overlong U+0000..U+FFFF
+  EXPECT_EQ(0u, nssUTF8_Length("\xF0\x80\x80\x80", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xF0\x8F\xBF\xBF", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+
+  // U+10000..U+10FFFF
+  EXPECT_EQ(4u, nssUTF8_Length("\xF0\x90\x80\x80", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(4u, nssUTF8_Length("\xF0\xBF\xBF\xBF", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(4u, nssUTF8_Length("\xF1\x80\x80\x80", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(4u, nssUTF8_Length("\xF3\xBF\xBF\xBF", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(4u, nssUTF8_Length("\xF4\x80\x80\x80", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+  EXPECT_EQ(4u, nssUTF8_Length("\xF4\x8F\xBF\xBF", &status));
+  EXPECT_EQ(PR_SUCCESS, status);
+
+  // out of Unicode range
+  EXPECT_EQ(0u, nssUTF8_Length("\xF4\x90\x80\x80", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xF4\xBF\xBF\xBF", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xF5\x80\x80\x80", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xF7\xBF\xBF\xBF", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+
+  // former 5-byte sequence
+  EXPECT_EQ(0u, nssUTF8_Length("\xF8\x80\x80\x80\x80", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xFB\xBF\xBF\xBF\xBF", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+
+  // former 6-byte sequence
+  EXPECT_EQ(0u, nssUTF8_Length("\xFC\x80\x80\x80\x80\x80", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xFD\xBF\xBF\xBF\xBF\xBF", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+
+  // invalid lead byte
+  EXPECT_EQ(0u, nssUTF8_Length("\xFE", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+  EXPECT_EQ(0u, nssUTF8_Length("\xFF", &status));
+  EXPECT_EQ(PR_FAILURE, status);
+  EXPECT_EQ(NSS_ERROR_INVALID_STRING, NSS_GetError());
+
+  nss_DestroyErrorStack();
+}
+}

security/nss/gtests/manifest.mn

@@ -19,6 +19,7 @@ endif
 ifneq ($(NSS_BUILD_SOFTOKEN_ONLY),1)
 ifneq ($(NSS_BUILD_UTIL_ONLY),1)
 NSS_SRCDIRS = \
+	base_gtest \
 	certdb_gtest \
 	certhigh_gtest \
 	cryptohi_gtest \

security/nss/gtests/ssl_gtest/ssl_auth_unittest.cc

@@ -268,6 +268,126 @@ static SECStatus GetClientAuthDataHook(void* self, PRFileDesc* fd,
   return SECSuccess;
 }
 
+typedef struct AutoClientTestStr {
+  SECStatus result;
+  const std::string cert;
+} AutoClientTest;
+
+typedef struct AutoClientResultsStr {
+  AutoClientTest isRsa2048;
+  AutoClientTest isClient;
+  AutoClientTest isNull;
+  bool hookCalled;
+} AutoClientResults;
+
+void VerifyClientCertMatch(CERTCertificate* clientCert,
+                           const std::string expectedName) {
+  const char* name = clientCert->nickname;
+  std::cout << "Match name=\"" << name << "\" expected=\"" << expectedName
+            << "\"" << std::endl;
+  EXPECT_TRUE(PORT_Strcmp(name, expectedName.c_str()) == 0)
+      << " Certmismatch: \"" << name << "\" != \"" << expectedName << "\"";
+}
+
+static SECStatus GetAutoClientAuthDataHook(void* expectResults, PRFileDesc* fd,
+                                           CERTDistNames* caNames,
+                                           CERTCertificate** clientCert,
+                                           SECKEYPrivateKey** clientKey) {
+  AutoClientResults& results = *(AutoClientResults*)expectResults;
+  SECStatus rv;
+
+  results.hookCalled = true;
+  *clientCert = NULL;
+  *clientKey = NULL;
+  rv = NSS_GetClientAuthData((void*)TlsAgent::kRsa2048.c_str(), fd, caNames,
+                             clientCert, clientKey);
+  if (rv == SECSuccess) {
+    VerifyClientCertMatch(*clientCert, results.isRsa2048.cert);
+    CERT_DestroyCertificate(*clientCert);
+    SECKEY_DestroyPrivateKey(*clientKey);
+    *clientCert = NULL;
+    *clientKey = NULL;
+  }
+  EXPECT_EQ(results.isRsa2048.result, rv);
+
+  rv = NSS_GetClientAuthData((void*)TlsAgent::kClient.c_str(), fd, caNames,
+                             clientCert, clientKey);
+  if (rv == SECSuccess) {
+    VerifyClientCertMatch(*clientCert, results.isClient.cert);
+    CERT_DestroyCertificate(*clientCert);
+    SECKEY_DestroyPrivateKey(*clientKey);
+    *clientCert = NULL;
+    *clientKey = NULL;
+  }
+  EXPECT_EQ(results.isClient.result, rv);
+  EXPECT_EQ(*clientCert, nullptr);
+  EXPECT_EQ(*clientKey, nullptr);
+  rv = NSS_GetClientAuthData(NULL, fd, caNames, clientCert, clientKey);
+  if (rv == SECSuccess) {
+    VerifyClientCertMatch(*clientCert, results.isNull.cert);
+    // return this result
+  }
+  EXPECT_EQ(results.isNull.result, rv);
+  return rv;
+}
+
+// while I would have liked to use a new INSTANTIATE macro the
+// generates the following three tests, figuring out how to make that
+// work on top of the existing TlsConnect* plumbing hurts my head.
+TEST_P(TlsConnectTls12, AutoClientSelectRsaPss) {
+  AutoClientResults rsa = {{SECSuccess, TlsAgent::kRsa2048},
+                           {SECSuccess, TlsAgent::kClient},
+                           {SECSuccess, TlsAgent::kDelegatorRsaPss2048},
+                           false};
+  static const SSLSignatureScheme kSchemes[] = {ssl_sig_rsa_pss_pss_sha256,
+                                                ssl_sig_rsa_pkcs1_sha256,
+                                                ssl_sig_rsa_pkcs1_sha1};
+  Reset("rsa_pss_noparam");
+  client_->SetupClientAuth();
+  server_->RequestClientAuth(true);
+  EXPECT_EQ(SECSuccess,
+            SSL_GetClientAuthDataHook(client_->ssl_fd(),
+                                      GetAutoClientAuthDataHook, (void*)&rsa));
+  server_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
+  client_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
+  Connect();
+  EXPECT_TRUE(rsa.hookCalled);
+}
+
+TEST_P(TlsConnectTls12, AutoClientSelectEcc) {
+  AutoClientResults ecc = {{SECFailure, TlsAgent::kClient},
+                           {SECFailure, TlsAgent::kClient},
+                           {SECSuccess, TlsAgent::kDelegatorEcdsa256},
+                           false};
+  static const SSLSignatureScheme kSchemes[] = {ssl_sig_ecdsa_secp256r1_sha256};
+  client_->SetupClientAuth();
+  server_->RequestClientAuth(true);
+  EXPECT_EQ(SECSuccess,
+            SSL_GetClientAuthDataHook(client_->ssl_fd(),
+                                      GetAutoClientAuthDataHook, (void*)&ecc));
+  server_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
+  client_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
+  Connect();
+  EXPECT_TRUE(ecc.hookCalled);
+}
+
+TEST_P(TlsConnectTls12, AutoClientSelectDsa) {
+  AutoClientResults dsa = {{SECFailure, TlsAgent::kClient},
+                           {SECFailure, TlsAgent::kClient},
+                           {SECSuccess, TlsAgent::kServerDsa},
+                           false};
+  static const SSLSignatureScheme kSchemes[] = {ssl_sig_dsa_sha256};
+  client_->SetupClientAuth();
+  server_->RequestClientAuth(true);
+  EXPECT_EQ(SECSuccess,
+            SSL_GetClientAuthDataHook(client_->ssl_fd(),
+                                      GetAutoClientAuthDataHook, (void*)&dsa));
+  server_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
+  client_->SetSignatureSchemes(kSchemes, PR_ARRAY_SIZE(kSchemes));
+  Connect();
+  EXPECT_TRUE(dsa.hookCalled);
+}
+
 TEST_F(TlsConnectStreamTls13, PostHandshakeAuthMultiple) {
   client_->SetupClientAuth();
   EXPECT_EQ(SECSuccess, SSL_OptionSet(client_->ssl_fd(),

security/nss/gtests/ssl_gtest/ssl_version_unittest.cc

@@ -327,13 +327,24 @@ TEST_F(TlsConnectStreamTls13, Tls14ClientHelloWithSupportedVersions) {
   ASSERT_LT(static_cast<uint32_t>(SSL_LIBRARY_VERSION_TLS_1_2), version);
 }
 
-// Offer 1.3 but with ClientHello.legacy_version == SSL 3.0. This
+// Offer 1.3 but with Server/ClientHello.legacy_version == SSL 3.0. This
 // causes a protocol version alert.  See RFC 8446 Appendix D.5.
 TEST_F(TlsConnectStreamTls13, Ssl30ClientHelloWithSupportedVersions) {
   MakeTlsFilter<TlsClientHelloVersionSetter>(client_, SSL_LIBRARY_VERSION_3_0);
   ConnectExpectAlert(server_, kTlsAlertProtocolVersion);
 }
 
+TEST_F(TlsConnectStreamTls13, Ssl30ServerHelloWithSupportedVersions) {
+  MakeTlsFilter<TlsServerHelloVersionSetter>(server_, SSL_LIBRARY_VERSION_3_0);
+  StartConnect();
+  client_->ExpectSendAlert(kTlsAlertProtocolVersion);
+  /* Since the handshake is not finished the client will send an unencrypted
+   * alert. The server is expected to close the connection with a unexpected
+   * message alert. */
+  server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
+  Handshake();
+}
+
 INSTANTIATE_TEST_CASE_P(
     TlsDowngradeSentinelTest, TlsDowngradeTest,
     ::testing::Combine(TlsConnectTestBase::kTlsVariantsStream,

security/nss/gtests/ssl_gtest/tls_filter.cc

@@ -1060,6 +1060,14 @@ PacketFilter::Action TlsClientHelloVersionSetter::FilterHandshake(
   return CHANGE;
 }
 
+PacketFilter::Action TlsServerHelloVersionSetter::FilterHandshake(
+    const HandshakeHeader& header, const DataBuffer& input,
+    DataBuffer* output) {
+  *output = input;
+  output->Write(0, version_, 2);
+  return CHANGE;
+}
+
 PacketFilter::Action SelectedCipherSuiteReplacer::FilterHandshake(
     const HandshakeHeader& header, const DataBuffer& input,
     DataBuffer* output) {

security/nss/gtests/ssl_gtest/tls_filter.h

@@ -669,6 +669,21 @@ class TlsClientHelloVersionSetter : public TlsHandshakeFilter {
   uint16_t version_;
 };
 
+// Set the version number in the ServerHello.
+class TlsServerHelloVersionSetter : public TlsHandshakeFilter {
+ public:
+  TlsServerHelloVersionSetter(const std::shared_ptr<TlsAgent>& a,
+                              uint16_t version)
+      : TlsHandshakeFilter(a, {kTlsHandshakeServerHello}), version_(version) {}
+
+  virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
+                                               const DataBuffer& input,
+                                               DataBuffer* output);
+
+ private:
+  uint16_t version_;
+};
+
 // Damages the last byte of a handshake message.
 class TlsLastByteDamager : public TlsHandshakeFilter {
  public: