wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-24 01:17:34 +09:00
Code Issues Projects Releases Packages Wiki Activity

re-introduce old nss im too tired for this

Browse source
This commit is contained in:
wuggy 2026-06-30 06:37:32 +01:00
commit 3a838106b9
2871 changed files with 1374431 additions and 1762417 deletions
Download patch file Download diff file Expand all files Collapse all files

5
security/nss/lib/mozpkix/include/pkix-test/pkixtestnss.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -42,7 +41,7 @@ TestKeyPair* CreateTestKeyPair(const TestPublicKeyAlgorithm publicKeyAlg,
const ScopedSECKEYPublicKey& publicKey,
const ScopedSECKEYPrivateKey& privateKey);
}
} // namespace pkix
} // namespace mozilla
}
} // namespace mozilla::pkix::test
#endif // mozilla_pkix_test_pkixtestnss_h

16
security/nss/lib/mozpkix/include/pkix-test/pkixtestutil.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -303,11 +302,10 @@ TestKeyPair* GenerateDSSKeyPair();
inline void DeleteTestKeyPair(TestKeyPair* keyPair) { delete keyPair; }
typedef std::unique_ptr<TestKeyPair> ScopedTestKeyPair;
Result TestVerifyECDSASignedData(Input data, DigestAlgorithm digestAlgorithm,
Input signature, Input subjectPublicKeyInfo);
Result TestVerifyRSAPKCS1SignedData(Input data, DigestAlgorithm digestAlgorithm,
Input signature,
Input subjectPublicKeyInfo);
Result TestVerifyECDSASignedDigest(const SignedDigest& signedDigest,
Input subjectPublicKeyInfo);
Result TestVerifyRSAPKCS1SignedDigest(const SignedDigest& signedDigest,
Input subjectPublicKeyInfo);
Result TestDigestBuf(Input item, DigestAlgorithm digestAlg,
/*out*/ uint8_t* digestBuf, size_t digestBufLen);
@ -432,8 +430,8 @@ class OCSPResponseContext final {
};
ByteString CreateEncodedOCSPResponse(OCSPResponseContext& context);
} // namespace test
} // namespace pkix
} // namespace mozilla
}
}
} // namespace mozilla::pkix::test
#endif // mozilla_pkix_test_pkixtestutil_h

5
security/nss/lib/mozpkix/include/pkix/Input.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -304,7 +303,7 @@ inline bool InputContains(const Input& input, uint8_t toFind) {
}
}
}
} // namespace pkix
} // namespace mozilla
}
} // namespace mozilla::pkix
#endif // mozilla_pkix_Input_h

7
security/nss/lib/mozpkix/include/pkix/Result.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -188,7 +187,7 @@ static const unsigned int FATAL_ERROR_FLAG = 0x800;
SEC_ERROR_LIBRARY_FAILURE) \
MOZILLA_PKIX_MAP(FATAL_ERROR_NO_MEMORY, FATAL_ERROR_FLAG | 4, \
SEC_ERROR_NO_MEMORY) \
/* nothing here */
/* nothing here */
enum class Result {
#define MOZILLA_PKIX_MAP(name, value, nss_name) name = value,
@ -213,7 +212,7 @@ inline Result NotReached(const char* /*explanation*/, Result result) {
assert(false);
return result;
}
} // namespace pkix
} // namespace mozilla
}
} // namespace mozilla::pkix
#endif // mozilla_pkix_Result_h

10
security/nss/lib/mozpkix/include/pkix/Time.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -111,9 +110,6 @@ Time Now();
// Note the epoch is the unix epoch (ie 00:00:00 UTC, 1 January 1970)
Time TimeFromEpochInSeconds(uint64_t secondsSinceEpoch);
// Note the epoch is the unix epoch (ie 00:00:00 UTC, 1 January 1970)
Result SecondsSinceEpochFromTime(Time time, uint64_t* outSeconds);
class Duration final {
public:
Duration(Time timeA, Time timeB)
@ -132,11 +128,9 @@ class Duration final {
}
private:
friend Result SecondsSinceEpochFromTime(Time time, uint64_t* outSeconds);
uint64_t durationInSeconds;
};
} // namespace pkix
} // namespace mozilla
}
} // namespace mozilla::pkix
#endif // mozilla_pkix_Time_h

7
security/nss/lib/mozpkix/include/pkix/pkix.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -117,8 +116,6 @@ Result BuildCertChain(TrustDomain& trustDomain, Input cert, Time time,
// - IP addresses are out of scope of RFC 6125, but this method accepts them for
// backward compatibility (see SearchNames in pkixnames.cpp)
// - A wildcard in a DNS-ID may only appear as the entirety of the first label.
// If the NameMatchingPolicy is omitted, a StrictNameMatchingPolicy is used.
Result CheckCertHostname(Input cert, Input hostname);
Result CheckCertHostname(Input cert, Input hostname,
NameMatchingPolicy& nameMatchingPolicy);
@ -156,7 +153,7 @@ Result VerifyEncodedOCSPResponse(
// requirement for another value. Empty extensions are also rejected.
Result CheckTLSFeaturesAreSatisfied(Input& cert,
const Input* stapledOCSPResponse);
} // namespace pkix
} // namespace mozilla
}
} // namespace mozilla::pkix
#endif // mozilla_pkix_pkix_h

47
security/nss/lib/mozpkix/include/pkix/pkixc.h
View file

@ -1,47 +0,0 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*/
#ifndef mozilla_pkix_pkixc_h
#define mozilla_pkix_pkixc_h
#include "prerror.h"
#include "stdint.h"
// VerifyCertificateChain will attempt to build a verified certificate chain
// starting from the 0th certificate in the given array to the indicated trust
// anchor. It returns true on success and false otherwise. No particular key
// usage is required, and no particular policy is required. The code signing
// extended key usage is required. No revocation checking is performed. RSA
// keys must be at least 2048 bits long, and EC keys must be from one of the
// curves secp256r1, secp384r1, or secp521r1. Only SHA256, SHA384, and SHA512
// are acceptable digest algorithms. When doing name checking, the subject
// common name field is ignored. At least one certificate must be provided.
// certificate is an array of pointers to certificates.
// certificateLengths is an array of the lengths of each certificate.
// numCertificates indicates how many certificates are in certificates.
// secondsSinceEpoch indicates the time at which the certificate chain must be
// valid, in seconds since the epoch.
// rootSHA256Hash identifies a trust anchor by the SHA256 hash of its contents.
// It must be an array of 32 bytes.
// hostname is a doman name for which the end-entity certificate must be valid.
// error will be set if and only if the return value is false. Its value may
// indicate why verification failed.
#ifdef __cplusplus
extern "C" {
#endif
bool VerifyCodeSigningCertificateChain(const uint8_t** certificates,
const uint16_t* certificateLengths,
size_t numCertificates,
uint64_t secondsSinceEpoch,
const uint8_t* rootSHA256Hash,
const uint8_t* hostname,
size_t hostnameLength,
/* out */ PRErrorCode* error);
#ifdef __cplusplus
}
#endif
#endif // mozilla_pkix_pkixc_h

5
security/nss/lib/mozpkix/include/pkix/pkixcheck.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -59,7 +58,7 @@ Result CheckValidity(Time time, Time notBefore, Time notAfter);
// Check that a subject has TLS Feature (rfc7633) requirements that match its
// potential issuer
Result CheckTLSFeatures(const BackCert& subject, BackCert& potentialIssuer);
} // namespace pkix
} // namespace mozilla
}
} // namespace mozilla::pkix
#endif // mozilla_pkix_pkixcheck_h

12
security/nss/lib/mozpkix/include/pkix/pkixder.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -488,7 +487,7 @@ inline Result OptionalExtensions(Reader& input, uint8_t tag,
Result DigestAlgorithmIdentifier(Reader& input,
/*out*/ DigestAlgorithm& algorithm);
enum class PublicKeyAlgorithm { RSA_PKCS1, RSA_PSS, ECDSA };
enum class PublicKeyAlgorithm { RSA_PKCS1, ECDSA, Uninitialized };
Result SignatureAlgorithmIdentifierValue(
Reader& input,
@ -524,11 +523,8 @@ struct SignedDataWithSignature final {
// certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
Result SignedData(Reader& input, /*out*/ Reader& tbs,
/*out*/ SignedDataWithSignature& signedDataWithSignature);
// Parses an ECDSASigValue (RFC 5480) into its components r and s.
Result ECDSASigValue(Input ecdsaSignature, /*out*/ Input& r, /*out*/ Input& s);
} // namespace der
} // namespace pkix
} // namespace mozilla
}
}
} // namespace mozilla::pkix::der
#endif // mozilla_pkix_pkixder_h

23
security/nss/lib/mozpkix/include/pkix/pkixnss.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -34,21 +33,15 @@ namespace pkix {
// Verifies the PKCS#1.5 signature on the given data using the given RSA public
// key.
Result VerifyRSAPKCS1SignedDataNSS(Input data, DigestAlgorithm digestAlgorithm,
Input signature, Input subjectPublicKeyInfo,
void* pkcs11PinArg);
// Verifies the RSA-PSS signature on the given data using the given RSA
// public key.
Result VerifyRSAPSSSignedDataNSS(Input data, DigestAlgorithm digestAlgorithm,
Input signature, Input subjectPublicKeyInfo,
void* pkcs11PinArg);
Result VerifyRSAPKCS1SignedDigestNSS(const SignedDigest& sd,
Input subjectPublicKeyInfo,
void* pkcs11PinArg);
// Verifies the ECDSA signature on the given data using the given ECC public
// key.
Result VerifyECDSASignedDataNSS(Input data, DigestAlgorithm digestAlgorithm,
Input signature, Input subjectPublicKeyInfo,
void* pkcs11PinArg);
Result VerifyECDSASignedDigestNSS(const SignedDigest& sd,
Input subjectPublicKeyInfo,
void* pkcs11PinArg);
// Computes the digest of the given data using the given digest algorithm.
//
@ -106,7 +99,7 @@ inline SECItem UnsafeMapInputToSECItem(Input input) {
"input.GetLength() must fit in a SECItem");
return result;
}
} // namespace pkix
} // namespace mozilla
}
} // namespace mozilla::pkix
#endif // mozilla_pkix_pkixnss_h

50
security/nss/lib/mozpkix/include/pkix/pkixtypes.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -52,6 +51,14 @@ enum class NamedCurve {
secp256r1 = 3,
};
struct SignedDigest final {
Input digest;
DigestAlgorithm digestAlgorithm;
Input signature;
void operator=(const SignedDigest&) = delete;
};
enum class EndEntityOrCA { MustBeEndEntity = 0, MustBeCA = 1 };
enum class KeyUsage : uint8_t {
@ -270,10 +277,10 @@ class TrustDomain {
virtual Result CheckRevocation(EndEntityOrCA endEntityOrCA,
const CertID& certID, Time time,
Time validityBeginning,
Duration validityDuration,
/*optional*/ const Input* stapledOCSPresponse,
/*optional*/ const Input* aiaExtension,
/*optional*/ const Input* sctExtension) = 0;
/*optional*/ const Input* aiaExtension) = 0;
// Check that the given digest algorithm is acceptable for use in signatures.
//
@ -297,22 +304,10 @@ class TrustDomain {
//
// CheckRSAPublicKeyModulusSizeInBits will be called before calling this
// function, so it is not necessary to repeat those checks here. However,
// VerifyRSAPKCS1SignedData *is* responsible for doing the mathematical
// VerifyRSAPKCS1SignedDigest *is* responsible for doing the mathematical
// verification of the public key validity as specified in NIST SP 800-56A.
virtual Result VerifyRSAPKCS1SignedData(Input data,
DigestAlgorithm digestAlgorithm,
Input signature,
Input subjectPublicKeyInfo) = 0;
// Verify the given RSA-PSS signature on the given digest using the
// given RSA public key.
//
// CheckRSAPublicKeyModulusSizeInBits will be called before calling this
// function, so it is not necessary to repeat those checks here.
virtual Result VerifyRSAPSSSignedData(Input data,
DigestAlgorithm digestAlgorithm,
Input signature,
Input subjectPublicKeyInfo) = 0;
virtual Result VerifyRSAPKCS1SignedDigest(const SignedDigest& signedDigest,
Input subjectPublicKeyInfo) = 0;
// Check that the given named ECC curve is acceptable for ECDSA signatures.
//
@ -327,12 +322,10 @@ class TrustDomain {
//
// CheckECDSACurveIsAcceptable will be called before calling this function,
// so it is not necessary to repeat that check here. However,
// VerifyECDSASignedData *is* responsible for doing the mathematical
// VerifyECDSASignedDigest *is* responsible for doing the mathematical
// verification of the public key validity as specified in NIST SP 800-56A.
virtual Result VerifyECDSASignedData(Input data,
DigestAlgorithm digestAlgorithm,
Input signature,
Input subjectPublicKeyInfo) = 0;
virtual Result VerifyECDSASignedDigest(const SignedDigest& signedDigest,
Input subjectPublicKeyInfo) = 0;
// Check that the validity duration is acceptable.
//
@ -401,14 +394,7 @@ class NameMatchingPolicy {
NameMatchingPolicy(const NameMatchingPolicy&) = delete;
void operator=(const NameMatchingPolicy&) = delete;
};
class StrictNameMatchingPolicy : public NameMatchingPolicy {
public:
virtual Result FallBackToCommonName(
Time notBefore,
/*out*/ FallBackToSearchWithinSubject& fallBacktoCommonName) override;
};
} // namespace pkix
} // namespace mozilla
}
} // namespace mozilla::pkix
#endif // mozilla_pkix_pkixtypes_h

17
security/nss/lib/mozpkix/include/pkix/pkixutil.h
View file

@ -1,5 +1,4 @@
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This code is made available to you under your choice of the following sets
* of licensing terms:
*/
@ -192,6 +191,18 @@ inline unsigned int DaysBeforeYear(unsigned int year) {
static const size_t MAX_DIGEST_SIZE_IN_BYTES = 512 / 8; // sha-512
Result DigestSignedData(TrustDomain& trustDomain,
const der::SignedDataWithSignature& signedData,
/*out*/ uint8_t (&digestBuf)[MAX_DIGEST_SIZE_IN_BYTES],
/*out*/ der::PublicKeyAlgorithm& publicKeyAlg,
/*out*/ SignedDigest& signedDigest);
Result VerifySignedDigest(TrustDomain& trustDomain,
der::PublicKeyAlgorithm publicKeyAlg,
const SignedDigest& signedDigest,
Input signerSubjectPublicKeyInfo);
// Combines DigestSignedData and VerifySignedDigest
Result VerifySignedData(TrustDomain& trustDomain,
const der::SignedDataWithSignature& signedData,
Input signerSubjectPublicKeyInfo);
@ -261,7 +272,7 @@ inline size_t DigestAlgorithmToSizeInBytes(DigestAlgorithm digestAlgorithm) {
MOZILLA_PKIX_UNREACHABLE_DEFAULT_ENUM
}
}
} // namespace pkix
} // namespace mozilla
}
} // namespace mozilla::pkix
#endif // mozilla_pkix_pkixutil_h