Replace NSS with Pale Moon's

security/nss/lib/libpkix/pkix_pl_nss/Makefile

@@ -26,7 +26,6 @@ include $(CORE_DEPTH)/coreconf/config.mk
 # (4) Include "local" platform-dependent assignments (OPTIONAL).      #
 #######################################################################
 
-include config.mk
 
 #######################################################################
 # (5) Execute "global" rules. (OPTIONAL)                              #
@@ -43,6 +42,3 @@ include $(CORE_DEPTH)/coreconf/rules.mk
 #######################################################################
 # (7) Execute "local" rules. (OPTIONAL).                              #
 #######################################################################
-
-export:: private_export
-

security/nss/lib/libpkix/pkix_pl_nss/config.mk

@@ -1,15 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-#
-#  Override TARGETS variable so that only static libraries
-#  are specifed as dependencies within rules.mk.
-#
-
-TARGETS        = $(LIBRARY)
-SHARED_LIBRARY =
-IMPORT_LIBRARY =
-PROGRAM        =
-

security/nss/lib/libpkix/pkix_pl_nss/module/Makefile

@@ -26,7 +26,26 @@ include $(CORE_DEPTH)/coreconf/config.mk
 # (4) Include "local" platform-dependent assignments (OPTIONAL).      #
 #######################################################################
 
-include config.mk
+ifdef NSS_PKIX_NO_LDAP
+LDAP_HEADERS =
+LDAP_CSRCS =
+else
+LDAP_HEADERS = \
+	pkix_pl_ldapt.h \
+	pkix_pl_ldapcertstore.h \
+	pkix_pl_ldapresponse.h \
+	pkix_pl_ldaprequest.h \
+	pkix_pl_ldapdefaultclient.h \
+ 	$(NULL)
+ 
+LDAP_CSRCS = \
+	pkix_pl_ldaptemplates.c \
+	pkix_pl_ldapcertstore.c \
+	pkix_pl_ldapresponse.c \
+	pkix_pl_ldaprequest.c \
+	pkix_pl_ldapdefaultclient.c \
+ 	$(NULL)
+endif
 
 #######################################################################
 # (5) Execute "global" rules. (OPTIONAL)                              #
@@ -44,5 +63,4 @@ include $(CORE_DEPTH)/coreconf/rules.mk
 # (7) Execute "local" rules. (OPTIONAL).                              #
 #######################################################################
 
-export:: private_export
 

security/nss/lib/libpkix/pkix_pl_nss/module/config.mk

@@ -1,35 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-#
-#  Override TARGETS variable so that only static libraries
-#  are specifed as dependencies within rules.mk.
-#
-
-TARGETS        = $(LIBRARY)
-SHARED_LIBRARY =
-IMPORT_LIBRARY =
-PROGRAM        =
-
-ifdef NSS_PKIX_NO_LDAP
-LDAP_HEADERS =
-LDAP_CSRCS =
-else
-LDAP_HEADERS = \
-	pkix_pl_ldapt.h \
-	pkix_pl_ldapcertstore.h \
-	pkix_pl_ldapresponse.h \
-	pkix_pl_ldaprequest.h \
-	pkix_pl_ldapdefaultclient.h \
- 	$(NULL)
- 
-LDAP_CSRCS = \
-	pkix_pl_ldaptemplates.c \
-	pkix_pl_ldapcertstore.c \
-	pkix_pl_ldapresponse.c \
-	pkix_pl_ldaprequest.c \
-	pkix_pl_ldapdefaultclient.c \
- 	$(NULL)
-endif

security/nss/lib/libpkix/pkix_pl_nss/module/manifest.mn

@@ -4,9 +4,6 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 CORE_DEPTH = ../../../..
 
-EXPORTS = \
-	$(NULL)
-
 PRIVATE_EXPORTS = \
 	pkix_pl_aiamgr.h \
 	pkix_pl_colcertstore.h \
@@ -22,7 +19,6 @@ MODULE = nss
 
 DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSHLIB_VERSION=\"$(LIBRARY_VERSION)\"
 
-
 CSRCS = \
 	pkix_pl_aiamgr.c \
 	pkix_pl_colcertstore.c \
@@ -35,4 +31,4 @@ CSRCS = \
 	$(NULL)
 
 LIBRARY_NAME = pkixmodule
-
+SHARED_LIBRARY = $(NULL)

security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_ldapcertstore.c

@@ -309,7 +309,7 @@ pkix_pl_LdapCertStore_BuildCrlList(
                             }
                             /* pkix crl own the der. */
                             PKIX_CHECK(
-                                pkix_pl_CRL_CreateWithSignedCRL(nssCrl, 
+                                pkix_pl_CRL_CreateWithSignedCRL(nssCrl,
                                        derCrlCopy, NULL, &crl, plContext),
                                 PKIX_CRLCREATEWITHSIGNEDCRLFAILED);
                             /* Left control over memory pointed by derCrlCopy and
@@ -427,7 +427,7 @@ pkix_pl_LdapCertStore_DestroyAVAList(
 static PKIX_Error *
 pkix_pl_LdapCertStore_MakeNameAVAList(
         PLArenaPool *arena,
-        PKIX_PL_X500Name *subjectName, 
+        PKIX_PL_X500Name *subjectName,
         LDAPNameComponent ***pList,
         void *plContext)
 {
@@ -874,55 +874,52 @@ pkix_pl_LdapCertStore_GetCRL(
                         PKIX_LISTGETLENGTHFAILED);
 
                 if (numNames > 0) {
-                        for (thisName = 0; thisName < numNames; thisName++) {
-                                PKIX_CHECK(PKIX_List_GetItem
-                                (issuerNames,
-                                thisName,
-                                (PKIX_PL_Object **)&issuer,
+                        /*
+                                * LDAP Servers don't seem to be able to handle
+                                * requests with more than more than one name.
+                                * So only use first name.
+                                */
+                        PKIX_CHECK(PKIX_List_GetItem
+                        (issuerNames,
+                        thisName,
+                        (PKIX_PL_Object **)&issuer,
+                        plContext),
+                        PKIX_LISTGETITEMFAILED);
+
+                        PKIX_CHECK
+                                (pkix_pl_LdapCertStore_MakeNameAVAList
+                                (requestArena,
+                                issuer,
+                                &(requestParams.nc),
                                 plContext),
-                                PKIX_LISTGETITEMFAILED);
+                                PKIX_LDAPCERTSTOREMAKENAMEAVALISTFAILED);
 
-                                PKIX_CHECK
-                                        (pkix_pl_LdapCertStore_MakeNameAVAList
-                                        (requestArena,
-                                        issuer,
-                                        &(requestParams.nc),
-                                        plContext),
-                                        PKIX_LDAPCERTSTOREMAKENAMEAVALISTFAILED);
-
-                                PKIX_DECREF(issuer);
-
-                                if (*requestParams.nc == NULL) {
-                                        /*
-                                         * The issuer may not include any
-                                         * components that we know how to
-                                         * encode. We do not return an error,
-                                         * because the caller did not
-                                         * necessarily do anything wrong, but
-                                         * we return an empty List.
-                                         */
-                                        PKIX_PL_NSSCALL
-                                                (CERTSTORE, PORT_FreeArena,
-                                                (requestArena, PR_FALSE));
-
-                                        PKIX_CHECK(PKIX_List_Create
-                                                (&filteredCRLs, plContext),
-                                                PKIX_LISTCREATEFAILED);
-
-                                        PKIX_CHECK(PKIX_List_SetImmutable
-                                                (filteredCRLs, plContext),
-                                               PKIX_LISTSETIMMUTABLEFAILED);
-
-                                        *pNBIOContext = NULL;
-                                        *pCrlList = filteredCRLs;
-                                        goto cleanup;
-                                }
+                        PKIX_DECREF(issuer);
 
+                        if (*requestParams.nc == NULL) {
                                 /*
-                                 * LDAP Servers don't seem to be able to handle
-                                 * requests with more than more than one name.
-                                 */
-                                break;
+                                        * The issuer may not include any
+                                        * components that we know how to
+                                        * encode. We do not return an error,
+                                        * because the caller did not
+                                        * necessarily do anything wrong, but
+                                        * we return an empty List.
+                                        */
+                                PKIX_PL_NSSCALL
+                                        (CERTSTORE, PORT_FreeArena,
+                                        (requestArena, PR_FALSE));
+
+                                PKIX_CHECK(PKIX_List_Create
+                                        (&filteredCRLs, plContext),
+                                        PKIX_LISTCREATEFAILED);
+
+                                PKIX_CHECK(PKIX_List_SetImmutable
+                                        (filteredCRLs, plContext),
+                                        PKIX_LISTSETIMMUTABLEFAILED);
+
+                                *pNBIOContext = NULL;
+                                *pCrlList = filteredCRLs;
+                                goto cleanup;
                         }
                 } else {
                         PKIX_ERROR(PKIX_IMPOSSIBLECRITERIONFORCRLQUERY);

security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_nsscontext.c

@@ -54,6 +54,7 @@ PKIX_PL_NssContext_Create(
         context->crlReloadDelay = PKIX_DEFAULT_CRL_RELOAD_DELAY_SECONDS;
         context->badDerCrlReloadDelay =
                              PKIX_DEFAULT_BAD_CRL_RELOAD_DELAY_SECONDS;
+        context->certSignatureCheck = PKIX_TRUE;
         context->chainVerifyCallback.isChainValid = NULL;
         context->chainVerifyCallback.isChainValidArg = NULL;
         *pNssContext = context;
@@ -160,6 +161,75 @@ pkix_pl_NssContext_SetCertUsage(
         PKIX_RETURN(CONTEXT);
 }
 
+/*
+ * FUNCTION: pkix_pl_NssContext_GetCertSignatureCheck
+ * DESCRIPTION:
+ *
+ *  This function obtains the platform-dependent flag to turn on or off
+ *  signature checks.
+ *
+ * PARAMETERS:
+ *  "nssContext"
+ *      The address of the context object whose wincx parameter is to be
+ *      obtained. Must be non-NULL.
+ *  "pCheckSig"
+ *      The address where the result is stored. Must be non-NULL.
+ * THREAD SAFETY:
+ *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
+ * RETURNS:
+ *  Returns NULL if the function succeeds.
+ *  Returns a Fatal Error if the function fails in an unrecoverable way.
+ */
+PKIX_Error *
+pkix_pl_NssContext_GetCertSignatureCheck(
+        PKIX_PL_NssContext *nssContext,
+        PKIX_Boolean *pCheckSig)
+{
+        void *plContext = NULL;
+
+        PKIX_ENTER(CONTEXT, "pkix_pl_NssContext_GetCertUsage");
+        PKIX_NULLCHECK_TWO(nssContext, pCheckSig);
+
+        *pCheckSig = nssContext->certSignatureCheck;
+
+        PKIX_RETURN(CONTEXT);
+}
+
+/*
+ * FUNCTION: pkix_pl_NssContext_SetCertSignatureCheck
+ * DESCRIPTION:
+ *
+ *  This function sets the check signature flag in
+ *  the context object pointed to by "nssContext" to the value provided in
+ *  "checkSig".
+ *
+ * PARAMETERS:
+ *  "checkSig"
+ *      Boolean that tells whether or not to check the signatues on certs.
+ *  "nssContext"
+ *      The address of the context object whose wincx parameter is to be
+ *      obtained. Must be non-NULL.
+ * THREAD SAFETY:
+ *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
+ * RETURNS:
+ *  Returns NULL if the function succeeds.
+ *  Returns a Fatal Error if the function fails in an unrecoverable way.
+ */
+PKIX_Error *
+pkix_pl_NssContext_SetCertSignatureCheck(
+        PKIX_Boolean checkSig,
+        PKIX_PL_NssContext *nssContext)
+{
+        void *plContext = NULL;
+
+        PKIX_ENTER(CONTEXT, "pkix_pl_NssContext_SetCertUsage");
+        PKIX_NULLCHECK_ONE(nssContext);
+
+        nssContext->certSignatureCheck =  checkSig;
+
+        PKIX_RETURN(CONTEXT);
+}
+
 /*
  * FUNCTION: pkix_pl_NssContext_GetWincx
  * DESCRIPTION:

security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_nsscontext.h

@@ -27,6 +27,7 @@ struct PKIX_PL_NssContextStruct {
         PRTime crlReloadDelay;
         PRTime badDerCrlReloadDelay;
         CERTChainVerifyCallback chainVerifyCallback;
+        PKIX_Boolean certSignatureCheck;
 };
 
 PKIX_Error *
@@ -38,6 +39,14 @@ PKIX_Error *
 pkix_pl_NssContext_SetCertUsage
         (SECCertificateUsage certUsage, PKIX_PL_NssContext *nssContext);
 
+PKIX_Error *
+pkix_pl_NssContext_GetCertSignatureCheck
+        (PKIX_PL_NssContext *nssContext, PKIX_Boolean *pCheckSig);
+
+PKIX_Error *
+pkix_pl_NssContext_SetCertSignatureCheck
+        (PKIX_Boolean checkSig, PKIX_PL_NssContext *nssContext);
+
 PKIX_Error *
 pkix_pl_NssContext_GetWincx(PKIX_PL_NssContext *nssContext, void **pWincx);
 

security/nss/lib/libpkix/pkix_pl_nss/pki/Makefile

@@ -26,7 +26,6 @@ include $(CORE_DEPTH)/coreconf/config.mk
 # (4) Include "local" platform-dependent assignments (OPTIONAL).      #
 #######################################################################
 
-include config.mk
 
 #######################################################################
 # (5) Execute "global" rules. (OPTIONAL)                              #
@@ -44,6 +43,5 @@ include $(CORE_DEPTH)/coreconf/rules.mk
 # (7) Execute "local" rules. (OPTIONAL).                              #
 #######################################################################
 
-export:: private_export
 
 

security/nss/lib/libpkix/pkix_pl_nss/pki/config.mk

@@ -1,15 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-#
-#  Override TARGETS variable so that only static libraries
-#  are specifed as dependencies within rules.mk.
-#
-
-TARGETS        = $(LIBRARY)
-SHARED_LIBRARY =
-IMPORT_LIBRARY =
-PROGRAM        =
-

security/nss/lib/libpkix/pkix_pl_nss/pki/manifest.mn

@@ -4,9 +4,6 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 CORE_DEPTH = ../../../..
 
-EXPORTS = \
-	$(NULL)
-
 PRIVATE_EXPORTS = \
 	pkix_pl_basicconstraints.h \
 	pkix_pl_cert.h \
@@ -50,4 +47,4 @@ CSRCS = \
 	$(NULL)
 
 LIBRARY_NAME = pkixpki
-
+SHARED_LIBRARY = $(NULL)

security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_cert.c

@@ -2811,14 +2811,23 @@ PKIX_PL_Cert_VerifySignature(
         PKIX_PL_Cert *cachedCert = NULL;
         PKIX_Error *verifySig = NULL;
         PKIX_Error *cachedSig = NULL;
+        PKIX_Error *checkSig = NULL;
         SECStatus status;
         PKIX_Boolean certEqual = PKIX_FALSE;
         PKIX_Boolean certInHash = PKIX_FALSE;
+        PKIX_Boolean checkCertSig = PKIX_TRUE;
         void* wincx = NULL;
 
         PKIX_ENTER(CERT, "PKIX_PL_Cert_VerifySignature");
         PKIX_NULLCHECK_THREE(cert, cert->nssCert, pubKey);
 
+        /* if the cert check flag is off, skip the check */
+        checkSig = pkix_pl_NssContext_GetCertSignatureCheck(
+                   (PKIX_PL_NssContext *)plContext, &checkCertSig);
+        if ((checkCertSig == PKIX_FALSE) && (checkSig == NULL)) {
+            goto cleanup;
+        }
+
         verifySig = PKIX_PL_HashTable_Lookup
                         (cachedCertSigTable,
                         (PKIX_PL_Object *) pubKey,
@@ -2879,6 +2888,7 @@ cleanup:
         }
 
         PKIX_DECREF(cachedCert);
+        PKIX_DECREF(checkSig);
         PKIX_DECREF(verifySig);
         PKIX_DECREF(cachedSig);
 
@@ -3150,6 +3160,15 @@ PKIX_PL_Cert_CheckNameConstraints(
                 if (arena == NULL) {
                         PKIX_ERROR(PKIX_OUTOFMEMORY);
                 }
+                /* only check common Name if the usage requires it */
+                if (treatCommonNameAsDNSName) {
+                    SECCertificateUsage certificateUsage;
+                    certificateUsage = ((PKIX_PL_NssContext*)plContext)->certificateUsage;
+                    if ((certificateUsage != certificateUsageSSLServer) &&
+                        (certificateUsage != certificateUsageIPsec)) {
+                        treatCommonNameAsDNSName = PKIX_FALSE;
+                    }
+                }
 
                 /* This NSS call returns Subject Alt Names. If
                  * treatCommonNameAsDNSName is true, it also returns the

security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_nameconstraints.c

@@ -829,10 +829,15 @@ pkix_pl_CertNameConstraints_Create(
 
         if (nssNameConstraints == NULL) {
                 *pNameConstraints = NULL;
+                 /* we free the arnea here because PKIX_ERROR_RECEIVED
+                  * may not be set. Setting arena to NULL makes sure
+                  * we don't try to free it again (and makes scanners
+                  * happy). */
                 if (arena){
                         PKIX_CERTNAMECONSTRAINTS_DEBUG
                                 ("\t\tCalling PORT_FreeArena).\n");
                         PORT_FreeArena(arena, PR_FALSE);
+                        arena = NULL;
                 }
                 goto cleanup;
         }

security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocspresponse.c

@@ -741,7 +741,9 @@ pkix_pl_OcspResponse_VerifyResponse(
             PKIX_CERTVERIFYKEYUSAGEFAILED);
         rv = SECSuccess;
     } else {
-        rv = CERT_VerifyCert(response->handle, response->signerCert, PKIX_TRUE,
+        /* checkSig is !isRoot */
+        PRBool checkSig = response->signerCert->isRoot ? PR_FALSE : PR_TRUE;
+        rv = CERT_VerifyCert(response->handle, response->signerCert, checkSig,
                              certUsage, response->producedAt, NULL, NULL);
         if (rv != SECSuccess) {
             PKIX_ERROR(PKIX_CERTVERIFYKEYUSAGEFAILED);

security/nss/lib/libpkix/pkix_pl_nss/system/Makefile

@@ -26,7 +26,6 @@ include $(CORE_DEPTH)/coreconf/config.mk
 # (4) Include "local" platform-dependent assignments (OPTIONAL).      #
 #######################################################################
 
-include config.mk
 
 #######################################################################
 # (5) Execute "global" rules. (OPTIONAL)                              #
@@ -44,6 +43,5 @@ include $(CORE_DEPTH)/coreconf/rules.mk
 # (7) Execute "local" rules. (OPTIONAL).                              #
 #######################################################################
 
-export:: private_export
 
 

security/nss/lib/libpkix/pkix_pl_nss/system/config.mk

@@ -1,15 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-#
-#  Override TARGETS variable so that only static libraries
-#  are specifed as dependencies within rules.mk.
-#
-
-TARGETS        = $(LIBRARY)
-SHARED_LIBRARY =
-IMPORT_LIBRARY =
-PROGRAM        =
-

security/nss/lib/libpkix/pkix_pl_nss/system/manifest.mn

@@ -4,9 +4,6 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 CORE_DEPTH = ../../../..
 
-EXPORTS = \
-	$(NULL)
-
 PRIVATE_EXPORTS = \
 	pkix_pl_common.h \
 	pkix_pl_mem.h \
@@ -43,4 +40,4 @@ CSRCS = \
 	$(NULL)
 
 LIBRARY_NAME = pkixsystem
-
+SHARED_LIBRARY = $(NULL)

security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_string.c

@@ -439,7 +439,8 @@ PKIX_PL_Sprintf(
 
                                 tempString = va_arg(args, PKIX_PL_String *);
                                 if (tempString != NULL) {
-                                        PKIX_CHECK(PKIX_PL_String_GetEncoded
+                                        PKIX_CHECK_NO_GOTO(
+                                                PKIX_PL_String_GetEncoded
                                                 ((PKIX_PL_String*)
                                                 tempString,
                                                 PKIX_ESCASCII,
@@ -447,6 +448,12 @@ PKIX_PL_Sprintf(
                                                 &dummyLen,
                                                 plContext),
                                                 PKIX_STRINGGETENCODEDFAILED);
+                                        /* need to cleanup var args before
+                                         * we ditch out to cleanup. */
+                                        if (pkixErrorResult) {
+                                            va_end(args);
+                                            goto cleanup;
+                                        }
                                 } else {
                                         /* there may be a NULL in var_args */
                                         pArg = NULL;