mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-08-15 08:53:07 +09:00
Update NSS to 3.32.1-RTM
This commit is contained in:
wolfbeast
Roy Tam
parent
f29876f120
commit
c91ef9012b
512 changed files with 83203 additions and 16839 deletions
2
security/nss/.gitignore
vendored
2
security/nss/.gitignore
vendored
|
|
@ -17,3 +17,5 @@ GTAGS
|
|||
.ycm_extra_conf.py*
|
||||
fuzz/libFuzzer/*
|
||||
fuzz/corpus
|
||||
fuzz/out
|
||||
.chk
|
||||
|
|
|
|||
|
|
@ -28,6 +28,7 @@ include $(CORE_DEPTH)/coreconf/config.mk
|
|||
|
||||
ifdef NSS_DISABLE_GTESTS
|
||||
DIRS := $(filter-out gtests,$(DIRS))
|
||||
DIRS := $(filter-out cpputil,$(DIRS))
|
||||
endif
|
||||
|
||||
#######################################################################
|
||||
|
|
@ -96,15 +97,6 @@ NSPR_CONFIGURE_ENV := $(filter-out -arch x86_64,$(NSPR_CONFIGURE_ENV))
|
|||
NSPR_CONFIGURE_ENV := $(filter-out -arch i386,$(NSPR_CONFIGURE_ENV))
|
||||
NSPR_CONFIGURE_ENV := $(filter-out -arch ppc,$(NSPR_CONFIGURE_ENV))
|
||||
|
||||
ifdef SANITIZER_CFLAGS
|
||||
ifdef BUILD_OPT
|
||||
NSPR_CONFIGURE_OPTS += --enable-debug-symbols
|
||||
endif
|
||||
NSPR_CONFIGURE_ENV += CFLAGS='$(SANITIZER_CFLAGS)' \
|
||||
CXXFLAGS='$(SANITIZER_CFLAGS)' \
|
||||
LDFLAGS='$(SANITIZER_LDFLAGS)'
|
||||
endif
|
||||
|
||||
#
|
||||
# Some pwd commands on Windows (for example, the pwd
|
||||
# command in Cygwin) return a pathname that begins
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
NSS_3_28_6_RTM
|
||||
NSS_3_32_1_RTM
|
||||
|
|
|
|||
1
security/nss/automation/abi-check/previous-nss-release
Normal file
1
security/nss/automation/abi-check/previous-nss-release
Normal file
|
|
@ -0,0 +1 @@
|
|||
NSS_3_31_BRANCH
|
||||
|
|
@ -19,6 +19,9 @@ proc_args()
|
|||
"--test-nss")
|
||||
TEST_NSS=1
|
||||
;;
|
||||
"--check-abi")
|
||||
CHECK_ABI=1
|
||||
;;
|
||||
"--build-jss")
|
||||
BUILD_JSS=1
|
||||
;;
|
||||
|
|
@ -40,6 +43,7 @@ proc_args()
|
|||
echo " --build-jss"
|
||||
echo " --test-nss"
|
||||
echo " --test-jss"
|
||||
echo " --check-abi"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
|
@ -215,6 +219,65 @@ test_nss()
|
|||
return ${RET}
|
||||
}
|
||||
|
||||
check_abi()
|
||||
{
|
||||
print_log "######## NSS ABI CHECK - ${BITS} bits - ${OPT} ########"
|
||||
print_log "######## creating temporary HG clones ########"
|
||||
|
||||
rm -rf ${HGDIR}/baseline
|
||||
mkdir ${HGDIR}/baseline
|
||||
BASE_NSS=`cat ${HGDIR}/nss/automation/abi-check/previous-nss-release`
|
||||
hg clone -u "${BASE_NSS}" "${HGDIR}/nss" "${HGDIR}/baseline/nss"
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "invalid tag in automation/abi-check/previous-nss-release"
|
||||
return 1
|
||||
fi
|
||||
|
||||
BASE_NSPR=NSPR_$(head -1 ${HGDIR}/baseline/nss/automation/release/nspr-version.txt | cut -d . -f 1-2 | tr . _)_BRANCH
|
||||
hg clone -u "${BASE_NSPR}" "${HGDIR}/nspr" "${HGDIR}/baseline/nspr"
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "invalid tag ${BASE_NSPR} derived from ${BASE_NSS} automation/release/nspr-version.txt"
|
||||
return 1
|
||||
fi
|
||||
|
||||
print_log "######## building older NSPR/NSS ########"
|
||||
pushd ${HGDIR}/baseline/nss
|
||||
|
||||
print_log "$ ${MAKE} ${NSS_BUILD_TARGET}"
|
||||
${MAKE} ${NSS_BUILD_TARGET} 2>&1 | tee -a ${LOG_ALL}
|
||||
RET=$?
|
||||
print_result "NSS - build - ${BITS} bits - ${OPT}" ${RET} 0
|
||||
if [ ${RET} -ne 0 ]; then
|
||||
tail -100 ${LOG_ALL}
|
||||
return ${RET}
|
||||
fi
|
||||
popd
|
||||
|
||||
ABI_REPORT=${OUTPUTDIR}/abi-diff.txt
|
||||
rm -f ${ABI_REPORT}
|
||||
PREVDIST=${HGDIR}/baseline/dist
|
||||
NEWDIST=${HGDIR}/dist
|
||||
ALL_SOs="libfreebl3.so libfreeblpriv3.so libnspr4.so libnss3.so libnssckbi.so libnssdbm3.so libnsssysinit.so libnssutil3.so libplc4.so libplds4.so libsmime3.so libsoftokn3.so libssl3.so"
|
||||
for SO in ${ALL_SOs}; do
|
||||
if [ ! -f nss/automation/abi-check/expected-report-$SO.txt ]; then
|
||||
touch nss/automation/abi-check/expected-report-$SO.txt
|
||||
fi
|
||||
abidiff --hd1 $PREVDIST/public/ --hd2 $NEWDIST/public \
|
||||
$PREVDIST/*/lib/$SO $NEWDIST/*/lib/$SO \
|
||||
> nss/automation/abi-check/new-report-$SO.txt
|
||||
diff -u nss/automation/abi-check/expected-report-$SO.txt \
|
||||
nss/automation/abi-check/new-report-$SO.txt >> ${ABI_REPORT}
|
||||
done
|
||||
|
||||
if [ -s ${ABI_REPORT} ]; then
|
||||
print_log "FAILED: there are new unexpected ABI changes"
|
||||
cat ${ABI_REPORT}
|
||||
return 1
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
test_jss()
|
||||
{
|
||||
print_log "######## JSS - tests - ${BITS} bits - ${OPT} ########"
|
||||
|
|
@ -243,6 +306,39 @@ test_jss()
|
|||
return ${RET}
|
||||
}
|
||||
|
||||
create_objdir_dist_link()
|
||||
{
|
||||
# compute relevant 'dist' OBJDIR_NAME subdirectory names for JSS and NSS
|
||||
OS_TARGET=`uname -s`
|
||||
OS_RELEASE=`uname -r | sed 's/-.*//' | sed 's/-.*//' | cut -d . -f1,2`
|
||||
CPU_TAG=_`uname -m`
|
||||
# OBJDIR_NAME_COMPILER appears to be defined for NSS but not JSS
|
||||
OBJDIR_NAME_COMPILER=_cc
|
||||
LIBC_TAG=_glibc
|
||||
IMPL_STRATEGY=_PTH
|
||||
if [ "${RUN_BITS}" = "64" ]; then
|
||||
OBJDIR_TAG=_${RUN_BITS}_${RUN_OPT}.OBJ
|
||||
else
|
||||
OBJDIR_TAG=_${RUN_OPT}.OBJ
|
||||
fi
|
||||
|
||||
# define NSS_OBJDIR_NAME
|
||||
NSS_OBJDIR_NAME=${OS_TARGET}${OS_RELEASE}${CPU_TAG}${OBJDIR_NAME_COMPILER}
|
||||
NSS_OBJDIR_NAME=${NSS_OBJDIR_NAME}${LIBC_TAG}${IMPL_STRATEGY}${OBJDIR_TAG}
|
||||
print_log "create_objdir_dist_link(): NSS_OBJDIR_NAME='${NSS_OBJDIR_NAME}'"
|
||||
|
||||
# define JSS_OBJDIR_NAME
|
||||
JSS_OBJDIR_NAME=${OS_TARGET}${OS_RELEASE}${CPU_TAG}
|
||||
JSS_OBJDIR_NAME=${JSS_OBJDIR_NAME}${LIBC_TAG}${IMPL_STRATEGY}${OBJDIR_TAG}
|
||||
print_log "create_objdir_dist_link(): JSS_OBJDIR_NAME='${JSS_OBJDIR_NAME}'"
|
||||
|
||||
if [ -e "${HGDIR}/dist/${NSS_OBJDIR_NAME}" ]; then
|
||||
SOURCE=${HGDIR}/dist/${NSS_OBJDIR_NAME}
|
||||
TARGET=${HGDIR}/dist/${JSS_OBJDIR_NAME}
|
||||
ln -s ${SOURCE} ${TARGET} >/dev/null 2>&1
|
||||
fi
|
||||
}
|
||||
|
||||
build_and_test()
|
||||
{
|
||||
if [ -n "${BUILD_NSS}" ]; then
|
||||
|
|
@ -255,7 +351,13 @@ build_and_test()
|
|||
[ $? -eq 0 ] || return 1
|
||||
fi
|
||||
|
||||
if [ -n "${CHECK_ABI}" ]; then
|
||||
check_abi
|
||||
[ $? -eq 0 ] || return 1
|
||||
fi
|
||||
|
||||
if [ -n "${BUILD_JSS}" ]; then
|
||||
create_objdir_dist_link
|
||||
build_jss
|
||||
[ $? -eq 0 ] || return 1
|
||||
fi
|
||||
|
|
@ -326,6 +428,7 @@ main()
|
|||
{
|
||||
VALID=0
|
||||
RET=1
|
||||
FAIL=0
|
||||
|
||||
for BITS in 32 64; do
|
||||
echo ${RUN_BITS} | grep ${BITS} > /dev/null
|
||||
|
|
@ -338,7 +441,10 @@ main()
|
|||
set_env
|
||||
run_all
|
||||
RET=$?
|
||||
print_log "### result of run_all is ${RET}"
|
||||
print_log "### result of run_all is ${RET}"
|
||||
if [ ${RET} -ne 0 ]; then
|
||||
FAIL=${RET}
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
|
|
@ -347,7 +453,7 @@ main()
|
|||
return 1
|
||||
fi
|
||||
|
||||
return ${RET}
|
||||
return ${FAIL}
|
||||
}
|
||||
|
||||
#function killallsub()
|
||||
|
|
@ -375,6 +481,8 @@ echo "tinderbox args: $0 $@"
|
|||
proc_args "$@"
|
||||
main
|
||||
|
||||
#RET=$?
|
||||
RET=$?
|
||||
print_log "### result of main is ${RET}"
|
||||
|
||||
#rm $IS_RUNNING_FILE
|
||||
#exit ${RET}
|
||||
exit ${RET}
|
||||
|
|
|
|||
26
security/nss/automation/clang-format/Dockerfile
Normal file
26
security/nss/automation/clang-format/Dockerfile
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
FROM ubuntu:16.04
|
||||
MAINTAINER Franziskus Kiefer <franziskuskiefer@gmail.com>
|
||||
|
||||
RUN useradd -d /home/worker -s /bin/bash -m worker
|
||||
WORKDIR /home/worker
|
||||
|
||||
# Install dependencies.
|
||||
ADD setup.sh /tmp/setup.sh
|
||||
RUN bash /tmp/setup.sh
|
||||
|
||||
# Change user.
|
||||
USER worker
|
||||
|
||||
# Env variables.
|
||||
ENV HOME /home/worker
|
||||
ENV SHELL /bin/bash
|
||||
ENV USER worker
|
||||
ENV LOGNAME worker
|
||||
ENV HOSTNAME taskcluster-worker
|
||||
ENV LANG en_US.UTF-8
|
||||
ENV LC_ALL en_US.UTF-8
|
||||
ENV HOST localhost
|
||||
ENV DOMSUF localdomain
|
||||
|
||||
# Entrypoint.
|
||||
ENTRYPOINT ["/home/worker/nss/automation/clang-format/run_clang_format.sh"]
|
||||
67
security/nss/automation/clang-format/run_clang_format.sh
Normal file
67
security/nss/automation/clang-format/run_clang_format.sh
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
if [[ $(id -u) -eq 0 ]]; then
|
||||
# Drop privileges by re-running this script.
|
||||
# Note: this mangles arguments, better to avoid running scripts as root.
|
||||
exec su worker -c "$0 $*"
|
||||
fi
|
||||
|
||||
# Apply clang-format on the provided folder and verify that this doesn't change any file.
|
||||
# If any file differs after formatting, the script eventually exits with 1.
|
||||
# Any differences between formatted and unformatted files is printed to stdout to give a hint what's wrong.
|
||||
|
||||
# Includes a default set of directories NOT to clang-format on.
|
||||
blacklist=(
|
||||
"./automation" \
|
||||
"./coreconf" \
|
||||
"./doc" \
|
||||
"./pkg" \
|
||||
"./tests" \
|
||||
"./lib/libpkix" \
|
||||
"./lib/zlib" \
|
||||
"./lib/sqlite" \
|
||||
"./gtests/google_test" \
|
||||
"./.hg" \
|
||||
"./out" \
|
||||
)
|
||||
|
||||
top="$(dirname $0)/../.."
|
||||
cd "$top"
|
||||
|
||||
if [ $# -gt 0 ]; then
|
||||
dirs=("$@")
|
||||
else
|
||||
dirs=($(find . -maxdepth 2 -mindepth 1 -type d ! -path . \( ! -regex '.*/' \)))
|
||||
fi
|
||||
|
||||
format_folder()
|
||||
{
|
||||
for black in "${blacklist[@]}"; do
|
||||
if [[ "$1" == "$black"* ]]; then
|
||||
echo "skip $1"
|
||||
return 1
|
||||
fi
|
||||
done
|
||||
return 0
|
||||
}
|
||||
|
||||
for dir in "${dirs[@]}"; do
|
||||
if format_folder "$dir" ; then
|
||||
c="${dir//[^\/]}"
|
||||
echo "formatting $dir ..."
|
||||
depth=""
|
||||
if [ "${#c}" == "1" ]; then
|
||||
depth="-maxdepth 1"
|
||||
fi
|
||||
find "$dir" $depth -type f \( -name '*.[ch]' -o -name '*.cc' \) -exec clang-format -i {} \+
|
||||
fi
|
||||
done
|
||||
|
||||
TMPFILE=$(mktemp /tmp/$(basename $0).XXXXXX)
|
||||
trap 'rm $TMPFILE' exit
|
||||
if (cd $(dirname $0); hg root >/dev/null 2>&1); then
|
||||
hg diff --git "$top" | tee $TMPFILE
|
||||
else
|
||||
git -C "$top" diff | tee $TMPFILE
|
||||
fi
|
||||
[[ ! -s $TMPFILE ]]
|
||||
44
security/nss/automation/clang-format/setup.sh
Normal file
44
security/nss/automation/clang-format/setup.sh
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
# Update packages.
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get -y update && apt-get -y upgrade
|
||||
|
||||
# Install packages.
|
||||
apt_packages=()
|
||||
apt_packages+=('ca-certificates')
|
||||
apt_packages+=('curl')
|
||||
apt_packages+=('xz-utils')
|
||||
apt_packages+=('mercurial')
|
||||
apt_packages+=('git')
|
||||
apt_packages+=('locales')
|
||||
apt-get install -y --no-install-recommends ${apt_packages[@]}
|
||||
|
||||
# Download clang.
|
||||
curl -L http://releases.llvm.org/3.9.1/clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz -o clang.tar.xz
|
||||
curl -L http://releases.llvm.org/3.9.1/clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz.sig -o clang.tar.xz.sig
|
||||
# Verify the signature.
|
||||
gpg --keyserver pool.sks-keyservers.net --recv-keys B6C8F98282B944E3B0D5C2530FC3042E345AD05D
|
||||
gpg --verify clang.tar.xz.sig
|
||||
# Install into /usr/local/.
|
||||
tar xJvf *.tar.xz -C /usr/local --strip-components=1
|
||||
|
||||
# Cleanup.
|
||||
function cleanup() {
|
||||
rm -f clang.tar.xz clang.tar.xz.sig
|
||||
}
|
||||
trap cleanup ERR EXIT
|
||||
|
||||
locale-gen en_US.UTF-8
|
||||
dpkg-reconfigure locales
|
||||
|
||||
# Cleanup.
|
||||
rm -rf ~/.ccache ~/.cache
|
||||
apt-get autoremove -y
|
||||
apt-get clean
|
||||
apt-get autoclean
|
||||
|
||||
# We're done. Remove this script.
|
||||
rm $0
|
||||
57
security/nss/automation/ossfuzz/build.sh
Normal file
57
security/nss/automation/ossfuzz/build.sh
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
#!/bin/bash -eu
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
#
|
||||
################################################################################
|
||||
|
||||
# List of targets disabled for oss-fuzz.
|
||||
declare -A disabled=([pkcs8]=1)
|
||||
|
||||
# List of targets we want to fuzz in TLS and non-TLS mode.
|
||||
declare -A tls_targets=([tls-client]=1 [tls-server]=1 [dtls-client]=1 [dtls-server]=1)
|
||||
|
||||
# Helper function that copies a fuzzer binary and its seed corpus.
|
||||
copy_fuzzer()
|
||||
{
|
||||
local fuzzer=$1
|
||||
local name=$2
|
||||
|
||||
# Copy the binary.
|
||||
cp ../dist/Debug/bin/$fuzzer $OUT/$name
|
||||
|
||||
# Zip and copy the corpus, if any.
|
||||
if [ -d "$SRC/nss-corpus/$name" ]; then
|
||||
zip $OUT/${name}_seed_corpus.zip $SRC/nss-corpus/$name/*
|
||||
else
|
||||
zip $OUT/${name}_seed_corpus.zip $SRC/nss-corpus/*/*
|
||||
fi
|
||||
}
|
||||
|
||||
# Copy libFuzzer options
|
||||
cp fuzz/options/*.options $OUT/
|
||||
|
||||
# Build the library (non-TLS fuzzing mode).
|
||||
CXX="$CXX -stdlib=libc++" LDFLAGS="$CFLAGS" \
|
||||
./build.sh -c -v --fuzz=oss --fuzz --disable-tests
|
||||
|
||||
# Copy fuzzing targets.
|
||||
for fuzzer in $(find ../dist/Debug/bin -name "nssfuzz-*" -printf "%f\n"); do
|
||||
name=${fuzzer:8}
|
||||
if [ -z "${disabled[$name]:-}" ]; then
|
||||
[ -n "${tls_targets[$name]:-}" ] && name="${name}-no_fuzzer_mode"
|
||||
copy_fuzzer $fuzzer $name
|
||||
fi
|
||||
done
|
||||
|
||||
# Build the library again (TLS fuzzing mode).
|
||||
CXX="$CXX -stdlib=libc++" LDFLAGS="$CFLAGS" \
|
||||
./build.sh -c -v --fuzz=oss --fuzz=tls --disable-tests
|
||||
|
||||
# Copy dual mode targets in TLS mode.
|
||||
for name in "${!tls_targets[@]}"; do
|
||||
if [ -z "${disabled[$name]:-}" ]; then
|
||||
copy_fuzzer nssfuzz-$name $name
|
||||
fi
|
||||
done
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
4.13.1
|
||||
4.16
|
||||
|
||||
# The first line of this file must contain the human readable NSPR
|
||||
# version number, which is the minimum required version of NSPR
|
||||
|
|
|
|||
|
|
@ -10,11 +10,27 @@ import shutil
|
|||
import glob
|
||||
from optparse import OptionParser
|
||||
from subprocess import check_call
|
||||
from subprocess import check_output
|
||||
|
||||
nssutil_h = "lib/util/nssutil.h"
|
||||
softkver_h = "lib/softoken/softkver.h"
|
||||
nss_h = "lib/nss/nss.h"
|
||||
nssckbi_h = "lib/ckfw/builtins/nssckbi.h"
|
||||
abi_base_version_file = "automation/abi-check/previous-nss-release"
|
||||
|
||||
abi_report_files = ['automation/abi-check/expected-report-libfreebl3.so.txt',
|
||||
'automation/abi-check/expected-report-libfreeblpriv3.so.txt',
|
||||
'automation/abi-check/expected-report-libnspr4.so.txt',
|
||||
'automation/abi-check/expected-report-libnss3.so.txt',
|
||||
'automation/abi-check/expected-report-libnssckbi.so.txt',
|
||||
'automation/abi-check/expected-report-libnssdbm3.so.txt',
|
||||
'automation/abi-check/expected-report-libnsssysinit.so.txt',
|
||||
'automation/abi-check/expected-report-libnssutil3.so.txt',
|
||||
'automation/abi-check/expected-report-libplc4.so.txt',
|
||||
'automation/abi-check/expected-report-libplds4.so.txt',
|
||||
'automation/abi-check/expected-report-libsmime3.so.txt',
|
||||
'automation/abi-check/expected-report-libsoftokn3.so.txt',
|
||||
'automation/abi-check/expected-report-libssl3.so.txt']
|
||||
|
||||
def check_call_noisy(cmd, *args, **kwargs):
|
||||
print "Executing command:", cmd
|
||||
|
|
@ -132,6 +148,26 @@ def set_root_ca_version():
|
|||
sed_inplace('s/^\(#define *NSS_BUILTINS_LIBRARY_VERSION_MINOR *\).*$/\\1' + minor + '/', nssckbi_h)
|
||||
|
||||
def set_all_lib_versions(version, major, minor, patch, build):
|
||||
grep_major = check_output(['grep', 'define.*NSS_VMAJOR', nss_h])
|
||||
grep_minor = check_output(['grep', 'define.*NSS_VMINOR', nss_h])
|
||||
|
||||
old_major = int(grep_major.split()[2]);
|
||||
old_minor = int(grep_minor.split()[2]);
|
||||
|
||||
new_major = int(major)
|
||||
new_minor = int(minor)
|
||||
|
||||
if (old_major < new_major or (old_major == new_major and old_minor < new_minor)):
|
||||
print "You're increasing the minor (or major) version:"
|
||||
print "- erasing ABI comparison expectations"
|
||||
new_branch = "NSS_" + str(old_major) + "_" + str(old_minor) + "_BRANCH"
|
||||
print "- setting reference branch to the branch of the previous version: " + new_branch
|
||||
with open(abi_base_version_file, "w") as abi_base:
|
||||
abi_base.write("%s\n" % new_branch)
|
||||
for report_file in abi_report_files:
|
||||
with open(report_file, "w") as report_file_handle:
|
||||
report_file_handle.truncate()
|
||||
|
||||
set_full_lib_versions(version)
|
||||
set_major_versions(major)
|
||||
set_minor_versions(minor)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,30 @@
|
|||
FROM franziskus/xenial:aarch64
|
||||
MAINTAINER Franziskus Kiefer <franziskuskiefer@gmail.com>
|
||||
|
||||
RUN useradd -d /home/worker -s /bin/bash -m worker
|
||||
WORKDIR /home/worker
|
||||
|
||||
# Add build and test scripts.
|
||||
ADD bin /home/worker/bin
|
||||
RUN chmod +x /home/worker/bin/*
|
||||
|
||||
# Install dependencies.
|
||||
ADD setup.sh /tmp/setup.sh
|
||||
RUN bash /tmp/setup.sh
|
||||
|
||||
# Change user.
|
||||
# USER worker # See bug 1347473.
|
||||
|
||||
# Env variables.
|
||||
ENV HOME /home/worker
|
||||
ENV SHELL /bin/bash
|
||||
ENV USER worker
|
||||
ENV LOGNAME worker
|
||||
ENV HOSTNAME taskcluster-worker
|
||||
ENV LANG en_US.UTF-8
|
||||
ENV LC_ALL en_US.UTF-8
|
||||
ENV HOST localhost
|
||||
ENV DOMSUF localdomain
|
||||
|
||||
# Set a default command for debugging.
|
||||
CMD ["/bin/bash", "--login"]
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
if [ $(id -u) = 0 ]; then
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker $0
|
||||
fi
|
||||
|
||||
# Default values for testing.
|
||||
REVISION=${NSS_HEAD_REVISION:-default}
|
||||
REPOSITORY=${NSS_HEAD_REPOSITORY:-https://hg.mozilla.org/projects/nss}
|
||||
|
||||
# Clone NSS.
|
||||
for i in 0 2 5; do
|
||||
sleep $i
|
||||
hg clone -r $REVISION $REPOSITORY nss && exit 0
|
||||
rm -rf nss
|
||||
done
|
||||
exit 1
|
||||
42
security/nss/automation/taskcluster/docker-aarch64/setup.sh
Normal file
42
security/nss/automation/taskcluster/docker-aarch64/setup.sh
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
apt-get -y update
|
||||
apt-get -y install software-properties-common
|
||||
|
||||
# Add more repos
|
||||
add-apt-repository "deb http://ports.ubuntu.com/ xenial main restricted universe multiverse"
|
||||
add-apt-repository "deb http://ports.ubuntu.com/ xenial-security main restricted universe multiverse"
|
||||
add-apt-repository "deb http://ports.ubuntu.com/ xenial-updates main restricted universe multiverse"
|
||||
add-apt-repository "deb http://ports.ubuntu.com/ xenial-backports main restricted universe multiverse"
|
||||
|
||||
# Update.
|
||||
apt-get -y update
|
||||
apt-get -y dist-upgrade
|
||||
|
||||
apt_packages=()
|
||||
apt_packages+=('build-essential')
|
||||
apt_packages+=('ca-certificates')
|
||||
apt_packages+=('curl')
|
||||
apt_packages+=('libxml2-utils')
|
||||
apt_packages+=('zlib1g-dev')
|
||||
apt_packages+=('ninja-build')
|
||||
apt_packages+=('gyp')
|
||||
apt_packages+=('mercurial')
|
||||
apt_packages+=('locales')
|
||||
|
||||
# Install packages.
|
||||
apt-get install -y --no-install-recommends ${apt_packages[@]}
|
||||
|
||||
locale-gen en_US.UTF-8
|
||||
dpkg-reconfigure locales
|
||||
|
||||
# Cleanup.
|
||||
rm -rf ~/.ccache ~/.cache
|
||||
apt-get autoremove -y
|
||||
apt-get clean
|
||||
apt-get autoclean
|
||||
rm $0
|
||||
|
|
@ -12,6 +12,7 @@ apt_packages=()
|
|||
apt_packages+=('build-essential')
|
||||
apt_packages+=('ca-certificates')
|
||||
apt_packages+=('curl')
|
||||
apt_packages+=('locales')
|
||||
apt_packages+=('python-dev')
|
||||
apt_packages+=('python-pip')
|
||||
apt_packages+=('python-setuptools')
|
||||
|
|
|
|||
|
|
@ -0,0 +1,30 @@
|
|||
FROM ubuntu:16.04
|
||||
MAINTAINER Tim Taubert <ttaubert@mozilla.com>
|
||||
|
||||
RUN useradd -d /home/worker -s /bin/bash -m worker
|
||||
WORKDIR /home/worker
|
||||
|
||||
# Add build and test scripts.
|
||||
ADD bin /home/worker/bin
|
||||
RUN chmod +x /home/worker/bin/*
|
||||
|
||||
# Install dependencies.
|
||||
ADD setup.sh /tmp/setup.sh
|
||||
RUN bash /tmp/setup.sh
|
||||
|
||||
# Change user.
|
||||
USER worker
|
||||
|
||||
# Env variables.
|
||||
ENV HOME /home/worker
|
||||
ENV SHELL /bin/bash
|
||||
ENV USER worker
|
||||
ENV LOGNAME worker
|
||||
ENV HOSTNAME taskcluster-worker
|
||||
ENV LANG en_US.UTF-8
|
||||
ENV LC_ALL en_US.UTF-8
|
||||
ENV HOST localhost
|
||||
ENV DOMSUF localdomain
|
||||
|
||||
# Set a default command for debugging.
|
||||
CMD ["/bin/bash", "--login"]
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
if [ $(id -u) = 0 ]; then
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker $0
|
||||
fi
|
||||
|
||||
# Default values for testing.
|
||||
REVISION=${NSS_HEAD_REVISION:-default}
|
||||
REPOSITORY=${NSS_HEAD_REPOSITORY:-https://hg.mozilla.org/projects/nss}
|
||||
|
||||
# Clone NSS.
|
||||
for i in 0 2 5; do
|
||||
sleep $i
|
||||
hg clone -r $REVISION $REPOSITORY nss && exit 0
|
||||
rm -rf nss
|
||||
done
|
||||
exit 1
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
# Update packages.
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get -y update && apt-get -y upgrade
|
||||
|
||||
# Need this to add keys for PPAs below.
|
||||
apt-get install -y --no-install-recommends apt-utils
|
||||
|
||||
apt_packages=()
|
||||
apt_packages+=('ca-certificates')
|
||||
apt_packages+=('curl')
|
||||
apt_packages+=('locales')
|
||||
apt_packages+=('xz-utils')
|
||||
|
||||
# Latest Mercurial.
|
||||
apt_packages+=('mercurial')
|
||||
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 41BD8711B1F0EC2B0D85B91CF59CE3A8323293EE
|
||||
echo "deb http://ppa.launchpad.net/mercurial-ppa/releases/ubuntu xenial main" > /etc/apt/sources.list.d/mercurial.list
|
||||
|
||||
# Install packages.
|
||||
apt-get -y update
|
||||
apt-get install -y --no-install-recommends ${apt_packages[@]}
|
||||
|
||||
# Download clang.
|
||||
curl -LO http://releases.llvm.org/3.9.1/clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz
|
||||
curl -LO http://releases.llvm.org/3.9.1/clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz.sig
|
||||
# Verify the signature.
|
||||
gpg --keyserver pool.sks-keyservers.net --recv-keys B6C8F98282B944E3B0D5C2530FC3042E345AD05D
|
||||
gpg --verify *.tar.xz.sig
|
||||
# Install into /usr/local/.
|
||||
tar xJvf *.tar.xz -C /usr/local --strip-components=1
|
||||
# Cleanup.
|
||||
rm *.tar.xz*
|
||||
|
||||
locale-gen en_US.UTF-8
|
||||
dpkg-reconfigure locales
|
||||
|
||||
# Cleanup.
|
||||
rm -rf ~/.ccache ~/.cache
|
||||
apt-get autoremove -y
|
||||
apt-get clean
|
||||
apt-get autoclean
|
||||
rm $0
|
||||
|
|
@ -7,7 +7,7 @@ export DEBIAN_FRONTEND=noninteractive
|
|||
apt-get -y update && apt-get -y upgrade
|
||||
|
||||
# Need those to install newer packages below.
|
||||
apt-get install -y --no-install-recommends apt-utils curl ca-certificates
|
||||
apt-get install -y --no-install-recommends apt-utils curl ca-certificates locales
|
||||
|
||||
# Latest Mercurial.
|
||||
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 41BD8711B1F0EC2B0D85B91CF59CE3A8323293EE
|
||||
|
|
|
|||
33
security/nss/automation/taskcluster/docker-fuzz/Dockerfile
Normal file
33
security/nss/automation/taskcluster/docker-fuzz/Dockerfile
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
FROM ubuntu:16.04
|
||||
MAINTAINER Tim Taubert <ttaubert@mozilla.com>
|
||||
|
||||
RUN useradd -d /home/worker -s /bin/bash -m worker
|
||||
WORKDIR /home/worker
|
||||
|
||||
# Add build and test scripts.
|
||||
ADD bin /home/worker/bin
|
||||
RUN chmod +x /home/worker/bin/*
|
||||
|
||||
# Install dependencies.
|
||||
ADD setup.sh /tmp/setup.sh
|
||||
RUN bash /tmp/setup.sh
|
||||
|
||||
# Change user.
|
||||
USER worker
|
||||
|
||||
# Env variables.
|
||||
ENV HOME /home/worker
|
||||
ENV SHELL /bin/bash
|
||||
ENV USER worker
|
||||
ENV LOGNAME worker
|
||||
ENV HOSTNAME taskcluster-worker
|
||||
ENV LANG en_US.UTF-8
|
||||
ENV LC_ALL en_US.UTF-8
|
||||
ENV HOST localhost
|
||||
ENV DOMSUF localdomain
|
||||
|
||||
# LLVM 4.0
|
||||
ENV PATH "${PATH}:/home/worker/third_party/llvm-build/Release+Asserts/bin/"
|
||||
|
||||
# Set a default command for debugging.
|
||||
CMD ["/bin/bash", "--login"]
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
if [ $(id -u) = 0 ]; then
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker $0
|
||||
fi
|
||||
|
||||
# Default values for testing.
|
||||
REVISION=${NSS_HEAD_REVISION:-default}
|
||||
REPOSITORY=${NSS_HEAD_REPOSITORY:-https://hg.mozilla.org/projects/nss}
|
||||
|
||||
# Clone NSS.
|
||||
for i in 0 2 5; do
|
||||
sleep $i
|
||||
hg clone -r $REVISION $REPOSITORY nss && exit 0
|
||||
rm -rf nss
|
||||
done
|
||||
exit 1
|
||||
58
security/nss/automation/taskcluster/docker-fuzz/setup.sh
Normal file
58
security/nss/automation/taskcluster/docker-fuzz/setup.sh
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
# Update packages.
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get -y update && apt-get -y upgrade
|
||||
|
||||
# Need this to add keys for PPAs below.
|
||||
apt-get install -y --no-install-recommends apt-utils
|
||||
|
||||
apt_packages=()
|
||||
apt_packages+=('build-essential')
|
||||
apt_packages+=('ca-certificates')
|
||||
apt_packages+=('curl')
|
||||
apt_packages+=('git')
|
||||
apt_packages+=('gyp')
|
||||
apt_packages+=('libssl-dev')
|
||||
apt_packages+=('libxml2-utils')
|
||||
apt_packages+=('locales')
|
||||
apt_packages+=('ninja-build')
|
||||
apt_packages+=('pkg-config')
|
||||
apt_packages+=('zlib1g-dev')
|
||||
|
||||
# 32-bit builds
|
||||
apt_packages+=('gcc-multilib')
|
||||
apt_packages+=('g++-multilib')
|
||||
|
||||
# Latest Mercurial.
|
||||
apt_packages+=('mercurial')
|
||||
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 41BD8711B1F0EC2B0D85B91CF59CE3A8323293EE
|
||||
echo "deb http://ppa.launchpad.net/mercurial-ppa/releases/ubuntu xenial main" > /etc/apt/sources.list.d/mercurial.list
|
||||
|
||||
# Install packages.
|
||||
apt-get -y update
|
||||
apt-get install -y --no-install-recommends ${apt_packages[@]}
|
||||
|
||||
# 32-bit builds
|
||||
dpkg --add-architecture i386
|
||||
apt-get -y update
|
||||
apt-get install -y --no-install-recommends libssl-dev:i386
|
||||
|
||||
# Install LLVM/clang-4.0.
|
||||
mkdir clang-tmp
|
||||
git clone -n --depth 1 https://chromium.googlesource.com/chromium/src/tools/clang clang-tmp/clang
|
||||
git -C clang-tmp/clang checkout HEAD scripts/update.py
|
||||
clang-tmp/clang/scripts/update.py
|
||||
rm -fr clang-tmp
|
||||
|
||||
locale-gen en_US.UTF-8
|
||||
dpkg-reconfigure locales
|
||||
|
||||
# Cleanup.
|
||||
rm -rf ~/.ccache ~/.cache
|
||||
apt-get autoremove -y
|
||||
apt-get clean
|
||||
apt-get autoclean
|
||||
rm $0
|
||||
|
|
@ -12,6 +12,9 @@ RUN chmod +x /home/worker/bin/*
|
|||
ADD setup.sh /tmp/setup.sh
|
||||
RUN bash /tmp/setup.sh
|
||||
|
||||
# Change user.
|
||||
USER worker
|
||||
|
||||
# Env variables.
|
||||
ENV HOME /home/worker
|
||||
ENV SHELL /bin/bash
|
||||
|
|
@ -23,5 +26,8 @@ ENV LC_ALL en_US.UTF-8
|
|||
ENV HOST localhost
|
||||
ENV DOMSUF localdomain
|
||||
|
||||
# Rust + Go
|
||||
ENV PATH "${PATH}:/home/worker/.cargo/bin/:/usr/lib/go-1.6/bin"
|
||||
|
||||
# Set a default command for debugging.
|
||||
CMD ["/bin/bash", "--login"]
|
||||
|
|
|
|||
|
|
@ -16,6 +16,8 @@ apt_packages+=('curl')
|
|||
apt_packages+=('npm')
|
||||
apt_packages+=('git')
|
||||
apt_packages+=('golang-1.6')
|
||||
apt_packages+=('libxml2-utils')
|
||||
apt_packages+=('locales')
|
||||
apt_packages+=('ninja-build')
|
||||
apt_packages+=('pkg-config')
|
||||
apt_packages+=('zlib1g-dev')
|
||||
|
|
@ -45,11 +47,19 @@ echo "deb http://ppa.launchpad.net/ubuntu-toolchain-r/test/ubuntu xenial main" >
|
|||
apt-get -y update
|
||||
apt-get install -y --no-install-recommends ${apt_packages[@]}
|
||||
|
||||
# 32-bit builds
|
||||
ln -s /usr/include/x86_64-linux-gnu/zconf.h /usr/include
|
||||
# Download clang.
|
||||
curl -LO http://releases.llvm.org/4.0.0/clang+llvm-4.0.0-x86_64-linux-gnu-ubuntu-16.04.tar.xz
|
||||
curl -LO http://releases.llvm.org/4.0.0/clang+llvm-4.0.0-x86_64-linux-gnu-ubuntu-16.04.tar.xz.sig
|
||||
# Verify the signature.
|
||||
gpg --keyserver pool.sks-keyservers.net --recv-keys B6C8F98282B944E3B0D5C2530FC3042E345AD05D
|
||||
gpg --verify *.tar.xz.sig
|
||||
# Install into /usr/local/.
|
||||
tar xJvf *.tar.xz -C /usr/local --strip-components=1
|
||||
# Cleanup.
|
||||
rm *.tar.xz*
|
||||
|
||||
# Install clang-3.9 into /usr/local/.
|
||||
curl -L http://llvm.org/releases/3.9.0/clang+llvm-3.9.0-x86_64-linux-gnu-ubuntu-16.04.tar.xz | tar xJv -C /usr/local --strip-components=1
|
||||
# Install latest Rust (stable).
|
||||
su worker -c "curl https://sh.rustup.rs -sSf | sh -s -- -y"
|
||||
|
||||
locale-gen en_US.UTF-8
|
||||
dpkg-reconfigure locales
|
||||
|
|
|
|||
|
|
@ -5,7 +5,20 @@
|
|||
import merge from "./merge";
|
||||
import * as queue from "./queue";
|
||||
|
||||
const LINUX_IMAGE = {name: "linux", path: "automation/taskcluster/docker"};
|
||||
const LINUX_IMAGE = {
|
||||
name: "linux",
|
||||
path: "automation/taskcluster/docker"
|
||||
};
|
||||
|
||||
const LINUX_CLANG39_IMAGE = {
|
||||
name: "linux-clang-3.9",
|
||||
path: "automation/taskcluster/docker-clang-3.9"
|
||||
};
|
||||
|
||||
const FUZZ_IMAGE = {
|
||||
name: "fuzz",
|
||||
path: "automation/taskcluster/docker-fuzz"
|
||||
};
|
||||
|
||||
const WINDOWS_CHECKOUT_CMD =
|
||||
"bash -c \"hg clone -r $NSS_HEAD_REVISION $NSS_HEAD_REPOSITORY nss || " +
|
||||
|
|
@ -17,33 +30,45 @@ const WINDOWS_CHECKOUT_CMD =
|
|||
queue.filter(task => {
|
||||
if (task.group == "Builds") {
|
||||
// Remove extra builds on {A,UB}San and ARM.
|
||||
if (task.collection == "asan" || task.collection == "arm-debug" ||
|
||||
task.collection == "gyp-asan") {
|
||||
if (task.collection == "asan" || task.platform == "aarch64") {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Remove extra builds w/o libpkix for non-linux64-debug.
|
||||
if (task.symbol == "noLibpkix" &&
|
||||
(task.platform != "linux64" || task.collection != "debug")) {
|
||||
// Make modular builds only on Linux make.
|
||||
if (task.symbol == "modular" && task.collection != "make") {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
if (task.tests == "bogo") {
|
||||
// No BoGo tests on Windows.
|
||||
if (task.platform == "windows2012-64") {
|
||||
if (task.tests == "bogo" || task.tests == "interop") {
|
||||
// No windows
|
||||
if (task.platform == "windows2012-64" ||
|
||||
task.platform == "windows2012-32") {
|
||||
return false;
|
||||
}
|
||||
|
||||
// No BoGo tests on ARM.
|
||||
if (task.collection == "arm-debug") {
|
||||
// No ARM; TODO: enable
|
||||
if (task.platform == "aarch64") {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// GYP builds with -Ddisable_libpkix=1 by default.
|
||||
if ((task.collection == "gyp" || task.collection == "gyp-asan") &&
|
||||
task.tests == "chains") {
|
||||
// Only old make builds have -Ddisable_libpkix=0 and can run chain tests.
|
||||
if (task.tests == "chains" && task.collection != "make") {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (task.group == "Test") {
|
||||
// Don't run test builds on old make platforms
|
||||
if (task.collection == "make") {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// Don't run additional hardware tests on ARM (we don't have anything there).
|
||||
if (task.group == "Cipher" && task.platform == "aarch64" && task.env &&
|
||||
(task.env.NSS_DISABLE_PCLMUL == "1" || task.env.NSS_DISABLE_HW_AES == "1"
|
||||
|| task.env.NSS_DISABLE_AVX == "1")) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
|
@ -51,29 +76,18 @@ queue.filter(task => {
|
|||
});
|
||||
|
||||
queue.map(task => {
|
||||
if (task.collection == "asan" || task.collection == "gyp-asan") {
|
||||
if (task.collection == "asan") {
|
||||
// CRMF and FIPS tests still leak, unfortunately.
|
||||
if (task.tests == "crmf" || task.tests == "fips") {
|
||||
task.env.ASAN_OPTIONS = "detect_leaks=0";
|
||||
}
|
||||
}
|
||||
|
||||
if (task.collection == "arm-debug") {
|
||||
// These tests take quite some time on our poor ARM devices.
|
||||
if (task.tests == "chains" || (task.tests == "ssl" && task.cycle == "standard")) {
|
||||
task.maxRunTime = 14400;
|
||||
}
|
||||
}
|
||||
|
||||
// Windows is slow.
|
||||
if (task.platform == "windows2012-64" && task.tests == "chains") {
|
||||
task.maxRunTime = 7200;
|
||||
}
|
||||
|
||||
// Enable TLS 1.3 for every task.
|
||||
task.env = task.env || {};
|
||||
task.env.NSS_ENABLE_TLS_1_3 = "1";
|
||||
|
||||
return task;
|
||||
});
|
||||
|
||||
|
|
@ -81,58 +95,48 @@ queue.map(task => {
|
|||
|
||||
export default async function main() {
|
||||
await scheduleLinux("Linux 32 (opt)", {
|
||||
env: {BUILD_OPT: "1"},
|
||||
platform: "linux32",
|
||||
image: LINUX_IMAGE
|
||||
});
|
||||
}, "-m32 --opt");
|
||||
|
||||
await scheduleLinux("Linux 32 (debug)", {
|
||||
platform: "linux32",
|
||||
collection: "debug",
|
||||
image: LINUX_IMAGE
|
||||
});
|
||||
}, "-m32");
|
||||
|
||||
await scheduleLinux("Linux 64 (opt)", {
|
||||
env: {USE_64: "1", BUILD_OPT: "1"},
|
||||
platform: "linux64",
|
||||
image: LINUX_IMAGE
|
||||
});
|
||||
}, "--opt");
|
||||
|
||||
await scheduleLinux("Linux 64 (debug)", {
|
||||
env: {USE_64: "1"},
|
||||
platform: "linux64",
|
||||
collection: "debug",
|
||||
image: LINUX_IMAGE
|
||||
});
|
||||
|
||||
await scheduleLinux("Linux 64 (debug, gyp)", {
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh"
|
||||
],
|
||||
await scheduleLinux("Linux 64 (debug, make)", {
|
||||
env: {USE_64: "1"},
|
||||
platform: "linux64",
|
||||
collection: "gyp",
|
||||
image: LINUX_IMAGE
|
||||
image: LINUX_IMAGE,
|
||||
collection: "make",
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
|
||||
],
|
||||
});
|
||||
|
||||
await scheduleLinux("Linux 64 (debug, gyp, asan, ubsan)", {
|
||||
await scheduleLinux("Linux 32 (debug, make)", {
|
||||
platform: "linux32",
|
||||
image: LINUX_IMAGE,
|
||||
collection: "make",
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh -g -v --ubsan --asan"
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
|
||||
],
|
||||
env: {
|
||||
ASAN_OPTIONS: "detect_odr_violation=0", // bug 1316276
|
||||
UBSAN_OPTIONS: "print_stacktrace=1",
|
||||
NSS_DISABLE_ARENA_FREE_LIST: "1",
|
||||
NSS_DISABLE_UNLOAD: "1",
|
||||
CC: "clang",
|
||||
CCC: "clang++"
|
||||
},
|
||||
platform: "linux64",
|
||||
collection: "gyp-asan",
|
||||
image: LINUX_IMAGE
|
||||
});
|
||||
|
||||
await scheduleLinux("Linux 64 (ASan, debug)", {
|
||||
|
|
@ -142,49 +146,87 @@ export default async function main() {
|
|||
NSS_DISABLE_UNLOAD: "1",
|
||||
CC: "clang",
|
||||
CCC: "clang++",
|
||||
USE_UBSAN: "1",
|
||||
USE_ASAN: "1",
|
||||
USE_64: "1"
|
||||
},
|
||||
platform: "linux64",
|
||||
collection: "asan",
|
||||
image: LINUX_IMAGE
|
||||
});
|
||||
image: LINUX_IMAGE,
|
||||
features: ["allowPtrace"],
|
||||
}, "--ubsan --asan");
|
||||
|
||||
await scheduleWindows("Windows 2012 64 (debug, make)", {
|
||||
platform: "windows2012-64",
|
||||
collection: "make",
|
||||
env: {USE_64: "1"}
|
||||
}, "build.sh");
|
||||
|
||||
await scheduleWindows("Windows 2012 32 (debug, make)", {
|
||||
platform: "windows2012-32",
|
||||
collection: "make"
|
||||
}, "build.sh");
|
||||
|
||||
await scheduleWindows("Windows 2012 64 (opt)", {
|
||||
env: {BUILD_OPT: "1"}
|
||||
});
|
||||
platform: "windows2012-64",
|
||||
}, "build_gyp.sh --opt");
|
||||
|
||||
await scheduleWindows("Windows 2012 64 (debug)", {
|
||||
platform: "windows2012-64",
|
||||
collection: "debug"
|
||||
});
|
||||
}, "build_gyp.sh");
|
||||
|
||||
await scheduleWindows("Windows 2012 32 (opt)", {
|
||||
platform: "windows2012-32",
|
||||
}, "build_gyp.sh --opt -m32");
|
||||
|
||||
await scheduleWindows("Windows 2012 32 (debug)", {
|
||||
platform: "windows2012-32",
|
||||
collection: "debug"
|
||||
}, "build_gyp.sh -m32");
|
||||
|
||||
await scheduleFuzzing();
|
||||
|
||||
await scheduleTestBuilds();
|
||||
await scheduleFuzzing32();
|
||||
|
||||
await scheduleTools();
|
||||
|
||||
await scheduleLinux("Linux 32 (ARM, debug)", {
|
||||
image: "franziskus/nss-arm-ci",
|
||||
let aarch64_base = {
|
||||
image: "franziskus/nss-aarch64-ci",
|
||||
provisioner: "localprovisioner",
|
||||
collection: "arm-debug",
|
||||
workerType: "nss-rpi",
|
||||
platform: "linux32",
|
||||
maxRunTime: 7200,
|
||||
tier: 3
|
||||
});
|
||||
workerType: "nss-aarch64",
|
||||
platform: "aarch64",
|
||||
maxRunTime: 7200
|
||||
};
|
||||
|
||||
await scheduleLinux("Linux AArch64 (debug)",
|
||||
merge({
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh"
|
||||
],
|
||||
collection: "debug",
|
||||
}, aarch64_base)
|
||||
);
|
||||
|
||||
await scheduleLinux("Linux AArch64 (opt)",
|
||||
merge({
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh --opt"
|
||||
],
|
||||
collection: "opt",
|
||||
}, aarch64_base)
|
||||
);
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
|
||||
async function scheduleLinux(name, base) {
|
||||
async function scheduleLinux(name, base, args = "") {
|
||||
// Build base definition.
|
||||
let build_base = merge({
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh " + args
|
||||
],
|
||||
artifacts: {
|
||||
public: {
|
||||
|
|
@ -224,12 +266,12 @@ async function scheduleLinux(name, base) {
|
|||
// Extra builds.
|
||||
let extra_base = merge({group: "Builds"}, build_base);
|
||||
queue.scheduleTask(merge(extra_base, {
|
||||
name: `${name} w/ clang-3.9`,
|
||||
name: `${name} w/ clang-4.0`,
|
||||
env: {
|
||||
CC: "clang",
|
||||
CCC: "clang++",
|
||||
},
|
||||
symbol: "clang-3.9"
|
||||
symbol: "clang-4.0"
|
||||
}));
|
||||
|
||||
queue.scheduleTask(merge(extra_base, {
|
||||
|
|
@ -251,30 +293,54 @@ async function scheduleLinux(name, base) {
|
|||
}));
|
||||
|
||||
queue.scheduleTask(merge(extra_base, {
|
||||
name: `${name} w/ NSS_DISABLE_LIBPKIX=1`,
|
||||
env: {NSS_DISABLE_LIBPKIX: "1"},
|
||||
symbol: "noLibpkix"
|
||||
name: `${name} w/ modular builds`,
|
||||
env: {NSS_BUILD_MODULAR: "1"},
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh",
|
||||
],
|
||||
symbol: "modular"
|
||||
}));
|
||||
|
||||
await scheduleTestBuilds(merge(base, {group: "Test"}), args);
|
||||
|
||||
return queue.submit();
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
|
||||
function scheduleFuzzingRun(base, name, target, max_len, symbol = null, corpus = null) {
|
||||
const MAX_FUZZ_TIME = 300;
|
||||
|
||||
queue.scheduleTask(merge(base, {
|
||||
name,
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/fuzz.sh " +
|
||||
`${target} nss/fuzz/corpus/${corpus || target} ` +
|
||||
`-max_total_time=${MAX_FUZZ_TIME} ` +
|
||||
`-max_len=${max_len}`
|
||||
],
|
||||
symbol: symbol || name
|
||||
}));
|
||||
}
|
||||
|
||||
async function scheduleFuzzing() {
|
||||
let base = {
|
||||
env: {
|
||||
// bug 1316276
|
||||
ASAN_OPTIONS: "allocator_may_return_null=1:detect_odr_violation=0",
|
||||
ASAN_OPTIONS: "allocator_may_return_null=1:detect_stack_use_after_return=1",
|
||||
UBSAN_OPTIONS: "print_stacktrace=1",
|
||||
NSS_DISABLE_ARENA_FREE_LIST: "1",
|
||||
NSS_DISABLE_UNLOAD: "1",
|
||||
CC: "clang",
|
||||
CCC: "clang++"
|
||||
},
|
||||
features: ["allowPtrace"],
|
||||
platform: "linux64",
|
||||
collection: "fuzz",
|
||||
image: LINUX_IMAGE
|
||||
image: FUZZ_IMAGE
|
||||
};
|
||||
|
||||
// Build base definition.
|
||||
|
|
@ -301,9 +367,22 @@ async function scheduleFuzzing() {
|
|||
name: "Linux x64 (debug, fuzz)"
|
||||
}));
|
||||
|
||||
// The task that builds NSPR+NSS (TLS fuzzing mode).
|
||||
let task_build_tls = queue.scheduleTask(merge(build_base, {
|
||||
name: "Linux x64 (debug, TLS fuzz)",
|
||||
symbol: "B",
|
||||
group: "TLS",
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && " +
|
||||
"nss/automation/taskcluster/scripts/build_gyp.sh -g -v --fuzz=tls"
|
||||
],
|
||||
}));
|
||||
|
||||
// Schedule tests.
|
||||
queue.scheduleTask(merge(base, {
|
||||
parent: task_build,
|
||||
parent: task_build_tls,
|
||||
name: "Gtests",
|
||||
command: [
|
||||
"/bin/bash",
|
||||
|
|
@ -317,56 +396,155 @@ async function scheduleFuzzing() {
|
|||
kind: "test"
|
||||
}));
|
||||
|
||||
queue.scheduleTask(merge(base, {
|
||||
parent: task_build,
|
||||
name: "Cert",
|
||||
// Schedule fuzzing runs.
|
||||
let run_base = merge(base, {parent: task_build, kind: "test"});
|
||||
scheduleFuzzingRun(run_base, "CertDN", "certDN", 4096);
|
||||
scheduleFuzzingRun(run_base, "QuickDER", "quickder", 10000);
|
||||
|
||||
// Schedule MPI fuzzing runs.
|
||||
let mpi_base = merge(run_base, {group: "MPI"});
|
||||
let mpi_names = ["add", "addmod", "div", "expmod", "mod", "mulmod", "sqr",
|
||||
"sqrmod", "sub", "submod"];
|
||||
for (let name of mpi_names) {
|
||||
scheduleFuzzingRun(mpi_base, `MPI (${name})`, `mpi-${name}`, 4096, name);
|
||||
}
|
||||
scheduleFuzzingRun(mpi_base, `MPI (invmod)`, `mpi-invmod`, 256, "invmod");
|
||||
|
||||
// Schedule TLS fuzzing runs (non-fuzzing mode).
|
||||
let tls_base = merge(run_base, {group: "TLS"});
|
||||
scheduleFuzzingRun(tls_base, "TLS Client", "tls-client", 20000, "client-nfm",
|
||||
"tls-client-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "TLS Server", "tls-server", 20000, "server-nfm",
|
||||
"tls-server-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "DTLS Client", "dtls-client", 20000,
|
||||
"dtls-client-nfm", "dtls-client-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "DTLS Server", "dtls-server", 20000,
|
||||
"dtls-server-nfm", "dtls-server-no_fuzzer_mode");
|
||||
|
||||
// Schedule TLS fuzzing runs (fuzzing mode).
|
||||
let tls_fm_base = merge(tls_base, {parent: task_build_tls});
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Client", "tls-client", 20000, "client");
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Server", "tls-server", 20000, "server");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Client", "dtls-client", 20000, "dtls-client");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Server", "dtls-server", 20000, "dtls-server");
|
||||
|
||||
return queue.submit();
|
||||
}
|
||||
|
||||
async function scheduleFuzzing32() {
|
||||
let base = {
|
||||
env: {
|
||||
ASAN_OPTIONS: "allocator_may_return_null=1:detect_stack_use_after_return=1",
|
||||
UBSAN_OPTIONS: "print_stacktrace=1",
|
||||
NSS_DISABLE_ARENA_FREE_LIST: "1",
|
||||
NSS_DISABLE_UNLOAD: "1",
|
||||
CC: "clang",
|
||||
CCC: "clang++"
|
||||
},
|
||||
features: ["allowPtrace"],
|
||||
platform: "linux32",
|
||||
collection: "fuzz",
|
||||
image: FUZZ_IMAGE
|
||||
};
|
||||
|
||||
// Build base definition.
|
||||
let build_base = merge({
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/fuzz.sh " +
|
||||
"cert nss/fuzz/corpus/cert -max_total_time=300"
|
||||
"bin/checkout.sh && " +
|
||||
"nss/automation/taskcluster/scripts/build_gyp.sh -g -v --fuzz -m32"
|
||||
],
|
||||
// Need a privileged docker container to remove this.
|
||||
env: {ASAN_OPTIONS: "detect_leaks=0"},
|
||||
symbol: "SCert",
|
||||
artifacts: {
|
||||
public: {
|
||||
expires: 24 * 7,
|
||||
type: "directory",
|
||||
path: "/home/worker/artifacts"
|
||||
}
|
||||
},
|
||||
kind: "build",
|
||||
symbol: "B"
|
||||
}, base);
|
||||
|
||||
// The task that builds NSPR+NSS.
|
||||
let task_build = queue.scheduleTask(merge(build_base, {
|
||||
name: "Linux 32 (debug, fuzz)"
|
||||
}));
|
||||
|
||||
// The task that builds NSPR+NSS (TLS fuzzing mode).
|
||||
let task_build_tls = queue.scheduleTask(merge(build_base, {
|
||||
name: "Linux 32 (debug, TLS fuzz)",
|
||||
symbol: "B",
|
||||
group: "TLS",
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && " +
|
||||
"nss/automation/taskcluster/scripts/build_gyp.sh -g -v --fuzz=tls -m32"
|
||||
],
|
||||
}));
|
||||
|
||||
// Schedule tests.
|
||||
queue.scheduleTask(merge(base, {
|
||||
parent: task_build_tls,
|
||||
name: "Gtests",
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
|
||||
],
|
||||
env: {GTESTFILTER: "*Fuzz*"},
|
||||
tests: "ssl_gtests gtests",
|
||||
cycle: "standard",
|
||||
symbol: "Gtest",
|
||||
kind: "test"
|
||||
}));
|
||||
|
||||
queue.scheduleTask(merge(base, {
|
||||
parent: task_build,
|
||||
name: "SPKI",
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/fuzz.sh " +
|
||||
"spki nss/fuzz/corpus/spki -max_total_time=300"
|
||||
],
|
||||
// Need a privileged docker container to remove this.
|
||||
env: {ASAN_OPTIONS: "detect_leaks=0"},
|
||||
symbol: "SPKI",
|
||||
kind: "test"
|
||||
}));
|
||||
// Schedule fuzzing runs.
|
||||
let run_base = merge(base, {parent: task_build, kind: "test"});
|
||||
scheduleFuzzingRun(run_base, "CertDN", "certDN", 4096);
|
||||
scheduleFuzzingRun(run_base, "QuickDER", "quickder", 10000);
|
||||
|
||||
// Schedule MPI fuzzing runs.
|
||||
let mpi_base = merge(run_base, {group: "MPI"});
|
||||
let mpi_names = ["add", "addmod", "div", "expmod", "mod", "mulmod", "sqr",
|
||||
"sqrmod", "sub", "submod"];
|
||||
for (let name of mpi_names) {
|
||||
scheduleFuzzingRun(mpi_base, `MPI (${name})`, `mpi-${name}`, 4096, name);
|
||||
}
|
||||
scheduleFuzzingRun(mpi_base, `MPI (invmod)`, `mpi-invmod`, 256, "invmod");
|
||||
|
||||
// Schedule TLS fuzzing runs (non-fuzzing mode).
|
||||
let tls_base = merge(run_base, {group: "TLS"});
|
||||
scheduleFuzzingRun(tls_base, "TLS Client", "tls-client", 20000, "client-nfm",
|
||||
"tls-client-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "TLS Server", "tls-server", 20000, "server-nfm",
|
||||
"tls-server-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "DTLS Client", "dtls-client", 20000,
|
||||
"dtls-client-nfm", "dtls-client-no_fuzzer_mode");
|
||||
scheduleFuzzingRun(tls_base, "DTLS Server", "dtls-server", 20000,
|
||||
"dtls-server-nfm", "dtls-server-no_fuzzer_mode");
|
||||
|
||||
// Schedule TLS fuzzing runs (fuzzing mode).
|
||||
let tls_fm_base = merge(tls_base, {parent: task_build_tls});
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Client", "tls-client", 20000, "client");
|
||||
scheduleFuzzingRun(tls_fm_base, "TLS Server", "tls-server", 20000, "server");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Client", "dtls-client", 20000, "dtls-client");
|
||||
scheduleFuzzingRun(tls_fm_base, "DTLS Server", "dtls-server", 20000, "dtls-server");
|
||||
|
||||
return queue.submit();
|
||||
}
|
||||
|
||||
/*****************************************************************************/
|
||||
|
||||
async function scheduleTestBuilds() {
|
||||
let base = {
|
||||
platform: "linux64",
|
||||
collection: "gyp",
|
||||
group: "Test",
|
||||
image: LINUX_IMAGE
|
||||
};
|
||||
|
||||
async function scheduleTestBuilds(base, args = "") {
|
||||
// Build base definition.
|
||||
let build = merge({
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && " +
|
||||
"nss/automation/taskcluster/scripts/build_gyp.sh -g -v --test"
|
||||
"nss/automation/taskcluster/scripts/build_gyp.sh -g -v --test --ct-verif " + args
|
||||
],
|
||||
artifacts: {
|
||||
public: {
|
||||
|
|
@ -377,7 +555,7 @@ async function scheduleTestBuilds() {
|
|||
},
|
||||
kind: "build",
|
||||
symbol: "B",
|
||||
name: "Linux 64 (debug, gyp, test)"
|
||||
name: "Linux 64 (debug, test)"
|
||||
}, base);
|
||||
|
||||
// The task that builds NSPR+NSS.
|
||||
|
|
@ -397,6 +575,19 @@ async function scheduleTestBuilds() {
|
|||
symbol: "mpi",
|
||||
kind: "test"
|
||||
}));
|
||||
queue.scheduleTask(merge(base, {
|
||||
parent: task_build,
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
|
||||
],
|
||||
name: "Gtests",
|
||||
symbol: "Gtest",
|
||||
tests: "gtests",
|
||||
cycle: "standard",
|
||||
kind: "test"
|
||||
}));
|
||||
|
||||
return queue.submit();
|
||||
}
|
||||
|
|
@ -404,10 +595,9 @@ async function scheduleTestBuilds() {
|
|||
|
||||
/*****************************************************************************/
|
||||
|
||||
async function scheduleWindows(name, base) {
|
||||
async function scheduleWindows(name, base, build_script) {
|
||||
base = merge(base, {
|
||||
workerType: "nss-win2012r2",
|
||||
platform: "windows2012-64",
|
||||
env: {
|
||||
PATH: "c:\\mozilla-build\\python;c:\\mozilla-build\\msys\\local\\bin;" +
|
||||
"c:\\mozilla-build\\7zip;c:\\mozilla-build\\info-zip;" +
|
||||
|
|
@ -417,7 +607,6 @@ async function scheduleWindows(name, base) {
|
|||
"c:\\mozilla-build\\wget",
|
||||
DOMSUF: "localdomain",
|
||||
HOST: "localhost",
|
||||
USE_64: "1"
|
||||
}
|
||||
});
|
||||
|
||||
|
|
@ -425,7 +614,7 @@ async function scheduleWindows(name, base) {
|
|||
let build_base = merge(base, {
|
||||
command: [
|
||||
WINDOWS_CHECKOUT_CMD,
|
||||
"bash -c nss/automation/taskcluster/windows/build.sh"
|
||||
`bash -c 'nss/automation/taskcluster/windows/${build_script}'`
|
||||
],
|
||||
artifacts: [{
|
||||
expires: 24 * 7,
|
||||
|
|
@ -474,11 +663,26 @@ function scheduleTests(task_build, task_cert, test_base) {
|
|||
queue.scheduleTask(merge(no_cert_base, {
|
||||
name: "Bogo tests", symbol: "Bogo", tests: "bogo", cycle: "standard"
|
||||
}));
|
||||
queue.scheduleTask(merge(no_cert_base, {
|
||||
name: "Interop tests", symbol: "Interop", tests: "interop", cycle: "standard"
|
||||
}));
|
||||
queue.scheduleTask(merge(no_cert_base, {
|
||||
name: "Chains tests", symbol: "Chains", tests: "chains"
|
||||
}));
|
||||
queue.scheduleTask(merge(no_cert_base, {
|
||||
name: "Cipher tests", symbol: "Cipher", tests: "cipher"
|
||||
name: "Cipher tests", symbol: "Default", tests: "cipher", group: "Cipher"
|
||||
}));
|
||||
queue.scheduleTask(merge(no_cert_base, {
|
||||
name: "Cipher tests", symbol: "NoAESNI", tests: "cipher",
|
||||
env: {NSS_DISABLE_HW_AES: "1"}, group: "Cipher"
|
||||
}));
|
||||
queue.scheduleTask(merge(no_cert_base, {
|
||||
name: "Cipher tests", symbol: "NoPCLMUL", tests: "cipher",
|
||||
env: {NSS_DISABLE_PCLMUL: "1"}, group: "Cipher"
|
||||
}));
|
||||
queue.scheduleTask(merge(no_cert_base, {
|
||||
name: "Cipher tests", symbol: "NoAVX", tests: "cipher",
|
||||
env: {NSS_DISABLE_AVX: "1"}, group: "Cipher"
|
||||
}));
|
||||
queue.scheduleTask(merge(no_cert_base, {
|
||||
name: "EC tests", symbol: "EC", tests: "ec"
|
||||
|
|
@ -531,7 +735,6 @@ function scheduleTests(task_build, task_cert, test_base) {
|
|||
|
||||
async function scheduleTools() {
|
||||
let base = {
|
||||
image: LINUX_IMAGE,
|
||||
platform: "nss-tools",
|
||||
kind: "test"
|
||||
};
|
||||
|
|
@ -539,16 +742,18 @@ async function scheduleTools() {
|
|||
queue.scheduleTask(merge(base, {
|
||||
symbol: "clang-format-3.9",
|
||||
name: "clang-format-3.9",
|
||||
image: LINUX_CLANG39_IMAGE,
|
||||
command: [
|
||||
"/bin/bash",
|
||||
"-c",
|
||||
"bin/checkout.sh && nss/automation/taskcluster/scripts/run_clang_format.sh"
|
||||
"bin/checkout.sh && nss/automation/clang-format/run_clang_format.sh"
|
||||
]
|
||||
}));
|
||||
|
||||
queue.scheduleTask(merge(base, {
|
||||
symbol: "scan-build-3.9",
|
||||
name: "scan-build-3.9",
|
||||
symbol: "scan-build-4.0",
|
||||
name: "scan-build-4.0",
|
||||
image: LINUX_IMAGE,
|
||||
env: {
|
||||
USE_64: "1",
|
||||
CC: "clang",
|
||||
|
|
|
|||
|
|
@ -25,10 +25,18 @@ function fromNow(hours) {
|
|||
}
|
||||
|
||||
function parseRoutes(routes) {
|
||||
return [
|
||||
let rv = [
|
||||
`tc-treeherder.v2.${process.env.TC_PROJECT}.${process.env.NSS_HEAD_REVISION}.${process.env.NSS_PUSHLOG_ID}`,
|
||||
...routes
|
||||
];
|
||||
|
||||
// Notify about failures (except on try).
|
||||
if (process.env.TC_PROJECT != "nss-try") {
|
||||
rv.push(`notify.email.${process.env.TC_OWNER}.on-failed`,
|
||||
`notify.email.${process.env.TC_OWNER}.on-exception`);
|
||||
}
|
||||
|
||||
return rv;
|
||||
}
|
||||
|
||||
function parseFeatures(list) {
|
||||
|
|
@ -80,6 +88,7 @@ function parseTreeherder(def) {
|
|||
}
|
||||
|
||||
function convertTask(def) {
|
||||
let scopes = [];
|
||||
let dependencies = [];
|
||||
|
||||
let env = merge({
|
||||
|
|
@ -110,19 +119,24 @@ function convertTask(def) {
|
|||
payload.image = def.image;
|
||||
}
|
||||
|
||||
if (def.features) {
|
||||
payload.features = parseFeatures(def.features);
|
||||
}
|
||||
|
||||
if (def.artifacts) {
|
||||
payload.artifacts = parseArtifacts(def.artifacts);
|
||||
}
|
||||
|
||||
if (def.features) {
|
||||
payload.features = parseFeatures(def.features);
|
||||
|
||||
if (payload.features.allowPtrace) {
|
||||
scopes.push("docker-worker:feature:allowPtrace");
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
provisionerId: def.provisioner || "aws-provisioner-v1",
|
||||
workerType: def.workerType || "hg-worker",
|
||||
schedulerId: "task-graph-scheduler",
|
||||
|
||||
scopes,
|
||||
created: fromNow(0),
|
||||
deadline: fromNow(24),
|
||||
|
||||
|
|
|
|||
|
|
@ -22,8 +22,10 @@ function parseOptions(opts) {
|
|||
}
|
||||
|
||||
// Parse platforms.
|
||||
let allPlatforms = ["linux", "linux64", "linux64-asan", "win64", "arm",
|
||||
"linux64-gyp", "linux64-gyp-asan", "linux64-fuzz"];
|
||||
let allPlatforms = ["linux", "linux64", "linux64-asan",
|
||||
"win", "win64", "win-make", "win64-make",
|
||||
"linux64-make", "linux-make", "linux-fuzz",
|
||||
"linux64-fuzz", "aarch64"];
|
||||
let platforms = intersect(opts.platform.split(/\s*,\s*/), allPlatforms);
|
||||
|
||||
// If the given value is nonsense or "none" default to all platforms.
|
||||
|
|
@ -34,7 +36,7 @@ function parseOptions(opts) {
|
|||
// Parse unit tests.
|
||||
let aliases = {"gtests": "gtest"};
|
||||
let allUnitTests = ["bogo", "crmf", "chains", "cipher", "db", "ec", "fips",
|
||||
"gtest", "lowhash", "merge", "sdr", "smime", "tools",
|
||||
"gtest", "interop", "lowhash", "merge", "sdr", "smime", "tools",
|
||||
"ssl", "mpi", "scert", "spki"];
|
||||
let unittests = intersect(opts.unittests.split(/\s*,\s*/).map(t => {
|
||||
return aliases[t] || t;
|
||||
|
|
@ -82,11 +84,13 @@ function filter(opts) {
|
|||
// Filter unit tests.
|
||||
if (task.tests) {
|
||||
let found = opts.unittests.some(test => {
|
||||
// TODO: think of something more intelligent here.
|
||||
if (task.symbol.toLowerCase().startsWith("mpi") && test == "mpi") {
|
||||
if (task.group && task.group.toLowerCase() == "ssl" && test == "ssl") {
|
||||
return true;
|
||||
}
|
||||
return (task.group || task.symbol).toLowerCase().startsWith(test);
|
||||
if (task.group && task.group.toLowerCase() == "cipher" && test == "cipher") {
|
||||
return true;
|
||||
}
|
||||
return task.symbol.toLowerCase().startsWith(test);
|
||||
});
|
||||
|
||||
if (!found) {
|
||||
|
|
@ -105,12 +109,15 @@ function filter(opts) {
|
|||
let found = opts.platforms.some(platform => {
|
||||
let aliases = {
|
||||
"linux": "linux32",
|
||||
"linux-fuzz": "linux32",
|
||||
"linux64-asan": "linux64",
|
||||
"linux64-fuzz": "linux64",
|
||||
"linux64-gyp": "linux64",
|
||||
"linux64-gyp-asan": "linux64",
|
||||
"linux64-make": "linux64",
|
||||
"linux-make": "linux32",
|
||||
"win64-make": "windows2012-64",
|
||||
"win-make": "windows2012-32",
|
||||
"win64": "windows2012-64",
|
||||
"arm": "linux32"
|
||||
"win": "windows2012-32"
|
||||
};
|
||||
|
||||
// Check the platform name.
|
||||
|
|
@ -119,13 +126,10 @@ function filter(opts) {
|
|||
// Additional checks.
|
||||
if (platform == "linux64-asan") {
|
||||
keep &= coll("asan");
|
||||
} else if (platform == "arm") {
|
||||
keep &= coll("arm-opt") || coll("arm-debug");
|
||||
} else if (platform == "linux64-gyp") {
|
||||
keep &= coll("gyp");
|
||||
} else if (platform == "linux64-gyp-asan") {
|
||||
keep &= coll("gyp-asan");
|
||||
} else if (platform == "linux64-fuzz") {
|
||||
} else if (platform == "linux64-make" || platform == "linux-make" ||
|
||||
platform == "win64-make" || platform == "win-make") {
|
||||
keep &= coll("make");
|
||||
} else if (platform == "linux64-fuzz" || platform == "linux-fuzz") {
|
||||
keep &= coll("fuzz");
|
||||
} else {
|
||||
keep &= coll("opt") || coll("debug");
|
||||
|
|
@ -139,8 +143,8 @@ function filter(opts) {
|
|||
}
|
||||
|
||||
// Finally, filter by build type.
|
||||
let isDebug = coll("debug") || coll("asan") || coll("arm-debug") ||
|
||||
coll("gyp") || coll("fuzz");
|
||||
let isDebug = coll("debug") || coll("asan") || coll("make") ||
|
||||
coll("fuzz");
|
||||
return (isDebug && opts.builds.includes("d")) ||
|
||||
(!isDebug && opts.builds.includes("o"));
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,14 +1,17 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source $(dirname $0)/tools.sh
|
||||
source $(dirname "$0")/tools.sh
|
||||
|
||||
if [[ $(id -u) -eq 0 ]]; then
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker $0
|
||||
if [ -n "$NSS_BUILD_MODULAR" ]; then
|
||||
$(dirname "$0")/build_nspr.sh || exit $?
|
||||
$(dirname "$0")/build_util.sh || exit $?
|
||||
$(dirname "$0")/build_softoken.sh || exit $?
|
||||
$(dirname "$0")/build_nss.sh || exit $?
|
||||
exit
|
||||
fi
|
||||
|
||||
# Clone NSPR if needed.
|
||||
hg_clone https://hg.mozilla.org/projects/nspr nspr default
|
||||
hg_clone https://hg.mozilla.org/projects/nspr ./nspr default
|
||||
|
||||
# Build.
|
||||
make -C nss nss_build_all
|
||||
|
|
|
|||
|
|
@ -1,17 +1,12 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source $(dirname $0)/tools.sh
|
||||
|
||||
if [[ $(id -u) -eq 0 ]]; then
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker -c "$0 $*"
|
||||
fi
|
||||
source $(dirname "$0")/tools.sh
|
||||
|
||||
# Clone NSPR if needed.
|
||||
hg_clone https://hg.mozilla.org/projects/nspr nspr default
|
||||
hg_clone https://hg.mozilla.org/projects/nspr ./nspr default
|
||||
|
||||
# Build.
|
||||
nss/build.sh ${*--g -v}
|
||||
nss/build.sh -g -v "$@"
|
||||
|
||||
# Package.
|
||||
mkdir artifacts
|
||||
|
|
|
|||
18
security/nss/automation/taskcluster/scripts/build_nspr.sh
Normal file
18
security/nss/automation/taskcluster/scripts/build_nspr.sh
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
source $(dirname $0)/tools.sh
|
||||
|
||||
# Clone NSPR if needed.
|
||||
hg_clone https://hg.mozilla.org/projects/nspr nspr default
|
||||
|
||||
# Build.
|
||||
rm -rf dist
|
||||
make -C nss build_nspr
|
||||
|
||||
# Package.
|
||||
test -d artifacts || mkdir artifacts
|
||||
rm -rf dist-nspr
|
||||
mv dist dist-nspr
|
||||
tar cvfjh artifacts/dist-nspr.tar.bz2 dist-nspr
|
||||
39
security/nss/automation/taskcluster/scripts/build_nss.sh
Normal file
39
security/nss/automation/taskcluster/scripts/build_nss.sh
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
source $(dirname $0)/tools.sh
|
||||
source $(dirname $0)/split.sh
|
||||
|
||||
test -d dist-softoken || { echo "run build_softoken.sh first" 1>&2; exit 1; }
|
||||
|
||||
rm -rf nss-nss
|
||||
split_nss nss nss-nss
|
||||
|
||||
# Build.
|
||||
export NSS_BUILD_WITHOUT_SOFTOKEN=1
|
||||
export NSS_USE_SYSTEM_FREEBL=1
|
||||
|
||||
platform=`make -s -C nss platform`
|
||||
|
||||
export NSPR_LIB_DIR="$PWD/dist-nspr/$platform/lib"
|
||||
export NSSUTIL_LIB_DIR="$PWD/dist-util/$platform/lib"
|
||||
export FREEBL_LIB_DIR="$PWD/dist-softoken/$platform/lib"
|
||||
export SOFTOKEN_LIB_DIR="$PWD/dist-softoken/$platform/lib"
|
||||
export FREEBL_LIBS=-lfreebl
|
||||
|
||||
export NSS_NO_PKCS11_BYPASS=1
|
||||
export FREEBL_NO_DEPEND=1
|
||||
|
||||
export LIBRARY_PATH="$PWD/dist-nspr/$platform/lib:$PWD/dist-util/$platform/lib:$PWD/dist-softoken/$platform/lib"
|
||||
export LD_LIBRARY_PATH="$LIBRARY_PATH:$LD_LIBRARY_PATH"
|
||||
export INCLUDES="-I$PWD/dist-nspr/$platform/include -I$PWD/dist-util/public/nss -I$PWD/dist-softoken/public/nss"
|
||||
|
||||
rm -rf dist
|
||||
make -C nss-nss nss_build_all
|
||||
|
||||
# Package.
|
||||
test -d artifacts || mkdir artifacts
|
||||
rm -rf dist-nss
|
||||
mv dist dist-nss
|
||||
tar cvfjh artifacts/dist-nss.tar.bz2 dist-nss
|
||||
|
|
@ -0,0 +1,30 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
source $(dirname $0)/tools.sh
|
||||
source $(dirname $0)/split.sh
|
||||
|
||||
test -d dist-util || { echo "run build_util.sh first" 1>&2; exit 1; }
|
||||
|
||||
rm -rf nss-softoken
|
||||
split_softoken nss nss-softoken
|
||||
|
||||
# Build.
|
||||
platform=`make -s -C nss platform`
|
||||
export LIBRARY_PATH="$PWD/dist-nspr/$platform/lib:$PWD/dist-util/$platform/lib"
|
||||
export LD_LIBRARY_PATH="$LIBRARY_PATH:$LD_LIBRARY_PATH"
|
||||
export INCLUDES="-I$PWD/dist-nspr/$platform/include -I$PWD/dist-util/public/nss"
|
||||
export NSS_BUILD_SOFTOKEN_ONLY=1
|
||||
|
||||
rm -rf dist
|
||||
make -C nss-softoken nss_build_all
|
||||
|
||||
mv dist/private/nss/blapi.h dist/public/nss
|
||||
mv dist/private/nss/alghmac.h dist/public/nss
|
||||
|
||||
# Package.
|
||||
test -d artifacts || mkdir artifacts
|
||||
rm -rf dist-softoken
|
||||
mv dist dist-softoken
|
||||
tar cvfjh artifacts/dist-softoken.tar.bz2 dist-softoken
|
||||
25
security/nss/automation/taskcluster/scripts/build_util.sh
Normal file
25
security/nss/automation/taskcluster/scripts/build_util.sh
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
source $(dirname $0)/tools.sh
|
||||
source $(dirname $0)/split.sh
|
||||
|
||||
rm -rf nss-util
|
||||
split_util nss nss-util
|
||||
|
||||
# Build.
|
||||
platform=`make -s -C nss platform`
|
||||
export LIBRARY_PATH="$PWD/dist-nspr/$platform/lib"
|
||||
export LD_LIBRARY_PATH="$LIBRARY_PATH:$LD_LIBRARY_PATH"
|
||||
export INCLUDES="-I$PWD/dist-nspr/$platform/include"
|
||||
export NSS_BUILD_UTIL_ONLY=1
|
||||
|
||||
rm -rf dist
|
||||
make -C nss-util nss_build_all
|
||||
|
||||
# Package.
|
||||
test -d artifacts || mkdir artifacts
|
||||
rm -rf dist-util
|
||||
mv dist dist-util
|
||||
tar cvfjh artifacts/dist-util.tar.bz2 dist-util
|
||||
|
|
@ -1,11 +1,6 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
if [ $(id -u) = 0 ]; then
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker $0
|
||||
fi
|
||||
source $(dirname "$0")/tools.sh
|
||||
|
||||
mkdir -p /home/worker/artifacts
|
||||
|
||||
|
|
|
|||
|
|
@ -1,20 +1,32 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source $(dirname $0)/tools.sh
|
||||
source $(dirname "$0")/tools.sh
|
||||
|
||||
if [ $(id -u) = 0 ]; then
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker -c "$0 $*"
|
||||
fi
|
||||
type="$1"
|
||||
shift
|
||||
|
||||
# Fetch artifact if needed.
|
||||
fetch_dist
|
||||
|
||||
# Clone corpus.
|
||||
./nss/fuzz/clone_corpus.sh
|
||||
./nss/fuzz/config/clone_corpus.sh
|
||||
|
||||
# Ensure we have a corpus.
|
||||
if [ ! -d "nss/fuzz/corpus/$type" ]; then
|
||||
mkdir -p nss/fuzz/corpus/$type
|
||||
|
||||
set +x
|
||||
|
||||
# Create a corpus out of what we have.
|
||||
for f in $(find nss/fuzz/corpus -type f); do
|
||||
cp $f "nss/fuzz/corpus/$type"
|
||||
done
|
||||
|
||||
set -x
|
||||
fi
|
||||
|
||||
# Fetch objdir name.
|
||||
objdir=$(cat dist/latest)
|
||||
|
||||
# Run nssfuzz.
|
||||
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:dist/$objdir/lib dist/$objdir/bin/nssfuzz $*
|
||||
dist/$objdir/bin/nssfuzz-"$type" "$@"
|
||||
|
|
|
|||
|
|
@ -1,16 +1,6 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
source $(dirname $0)/tools.sh
|
||||
|
||||
if [ $(id -u) = 0 ]; then
|
||||
# Stupid Docker.
|
||||
echo "127.0.0.1 localhost.localdomain" >> /etc/hosts
|
||||
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker $0
|
||||
fi
|
||||
source $(dirname "$0")/tools.sh
|
||||
|
||||
# Fetch artifact if needed.
|
||||
fetch_dist
|
||||
|
|
|
|||
|
|
@ -1,63 +0,0 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
if [ $(id -u) -eq 0 ]; then
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker $0 "$@"
|
||||
fi
|
||||
|
||||
# Apply clang-format on the provided folder and verify that this doesn't change any file.
|
||||
# If any file differs after formatting, the script eventually exits with 1.
|
||||
# Any differences between formatted and unformatted files is printed to stdout to give a hint what's wrong.
|
||||
|
||||
# Includes a default set of directories.
|
||||
|
||||
if [ $# -gt 0 ]; then
|
||||
dirs=("$@")
|
||||
else
|
||||
top=$(dirname $0)/../../..
|
||||
dirs=( \
|
||||
"$top/cmd" \
|
||||
"$top/fuzz" \
|
||||
"$top/lib/base" \
|
||||
"$top/lib/certdb" \
|
||||
"$top/lib/certhigh" \
|
||||
"$top/lib/ckfw" \
|
||||
"$top/lib/crmf" \
|
||||
"$top/lib/cryptohi" \
|
||||
"$top/lib/dbm" \
|
||||
"$top/lib/dev" \
|
||||
"$top/lib/freebl" \
|
||||
"$top/lib/jar" \
|
||||
"$top/lib/nss" \
|
||||
"$top/lib/pk11wrap" \
|
||||
"$top/lib/pkcs7" \
|
||||
"$top/lib/pkcs12" \
|
||||
"$top/lib/pki" \
|
||||
"$top/lib/smime" \
|
||||
"$top/lib/softoken" \
|
||||
"$top/lib/ssl" \
|
||||
"$top/lib/sysinit" \
|
||||
"$top/lib/util" \
|
||||
"$top/gtests/common" \
|
||||
"$top/gtests/der_gtest" \
|
||||
"$top/gtests/freebl_gtest" \
|
||||
"$top/gtests/pk11_gtest" \
|
||||
"$top/gtests/ssl_gtest" \
|
||||
"$top/gtests/util_gtest" \
|
||||
)
|
||||
fi
|
||||
|
||||
for dir in "${dirs[@]}"; do
|
||||
find "$dir" -type f \( -name '*.[ch]' -o -name '*.cc' \) -exec clang-format -i {} \+
|
||||
done
|
||||
|
||||
TMPFILE=$(mktemp /tmp/$(basename $0).XXXXXX)
|
||||
trap 'rm $TMPFILE' exit
|
||||
if (cd $(dirname $0); hg root >/dev/null 2>&1); then
|
||||
hg diff --git "$top" | tee $TMPFILE
|
||||
else
|
||||
git -C "$top" diff | tee $TMPFILE
|
||||
fi
|
||||
[[ ! -s $TMPFILE ]]
|
||||
|
|
@ -1,15 +1,10 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source $(dirname $0)/tools.sh
|
||||
|
||||
if [ $(id -u) = 0 ]; then
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker $0 $@
|
||||
fi
|
||||
source $(dirname "$0")/tools.sh
|
||||
|
||||
# Clone NSPR if needed.
|
||||
if [ ! -d "nspr" ]; then
|
||||
hg_clone https://hg.mozilla.org/projects/nspr nspr default
|
||||
hg_clone https://hg.mozilla.org/projects/nspr ./nspr default
|
||||
fi
|
||||
|
||||
# Build.
|
||||
|
|
|
|||
|
|
@ -1,14 +1,6 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source $(dirname $0)/tools.sh
|
||||
|
||||
if [ $(id -u) = 0 ]; then
|
||||
# Stupid Docker.
|
||||
echo "127.0.0.1 localhost.localdomain" >> /etc/hosts
|
||||
|
||||
# Drop privileges by re-running this script.
|
||||
exec su worker $0
|
||||
fi
|
||||
source $(dirname "$0")/tools.sh
|
||||
|
||||
# Fetch artifact if needed.
|
||||
fetch_dist
|
||||
|
|
|
|||
154
security/nss/automation/taskcluster/scripts/split.sh
Normal file
154
security/nss/automation/taskcluster/scripts/split.sh
Normal file
|
|
@ -0,0 +1,154 @@
|
|||
copy_top()
|
||||
{
|
||||
srcdir_="$1"
|
||||
dstdir_="$2"
|
||||
files=`find "$srcdir_" -maxdepth 1 -mindepth 1 -type f`
|
||||
for f in $files; do
|
||||
cp -p "$f" "$dstdir_"
|
||||
done
|
||||
}
|
||||
|
||||
split_util() {
|
||||
nssdir="$1"
|
||||
dstdir="$2"
|
||||
|
||||
# Prepare a source tree only containing files to build nss-util:
|
||||
#
|
||||
# nss/dbm full directory
|
||||
# nss/coreconf full directory
|
||||
# nss top files only
|
||||
# nss/lib top files only
|
||||
# nss/lib/util full directory
|
||||
|
||||
# Copy everything.
|
||||
cp -R $nssdir $dstdir
|
||||
|
||||
# Skip gtests when building.
|
||||
sed '/^DIRS = /s/ cpputil gtests$//' $nssdir/manifest.mn > $dstdir/manifest.mn-t && mv $dstdir/manifest.mn-t $dstdir/manifest.mn
|
||||
|
||||
# Remove subdirectories that we don't want.
|
||||
rm -rf $dstdir/cmd
|
||||
rm -rf $dstdir/tests
|
||||
rm -rf $dstdir/lib
|
||||
rm -rf $dstdir/automation
|
||||
rm -rf $dstdir/gtests
|
||||
rm -rf $dstdir/cpputil
|
||||
rm -rf $dstdir/doc
|
||||
|
||||
# Start with an empty cmd lib directories to be filled selectively.
|
||||
mkdir $dstdir/cmd
|
||||
cp $nssdir/cmd/Makefile $dstdir/cmd
|
||||
cp $nssdir/cmd/manifest.mn $dstdir/cmd
|
||||
cp $nssdir/cmd/platlibs.mk $dstdir/cmd
|
||||
cp $nssdir/cmd/platrules.mk $dstdir/cmd
|
||||
|
||||
# Copy some files at the top and the util subdirectory recursively.
|
||||
mkdir $dstdir/lib
|
||||
cp $nssdir/lib/Makefile $dstdir/lib
|
||||
cp $nssdir/lib/manifest.mn $dstdir/lib
|
||||
cp -R $nssdir/lib/util $dstdir/lib/util
|
||||
}
|
||||
|
||||
split_softoken() {
|
||||
nssdir="$1"
|
||||
dstdir="$2"
|
||||
|
||||
# Prepare a source tree only containing files to build nss-softoken:
|
||||
#
|
||||
# nss/dbm full directory
|
||||
# nss/coreconf full directory
|
||||
# nss top files only
|
||||
# nss/lib top files only
|
||||
# nss/lib/freebl full directory
|
||||
# nss/lib/softoken full directory
|
||||
# nss/lib/softoken/dbm full directory
|
||||
|
||||
# Copy everything.
|
||||
cp -R $nssdir $dstdir
|
||||
|
||||
# Skip gtests when building.
|
||||
sed '/^DIRS = /s/ cpputil gtests$//' $nssdir/manifest.mn > $dstdir/manifest.mn-t && mv $dstdir/manifest.mn-t $dstdir/manifest.mn
|
||||
|
||||
# Remove subdirectories that we don't want.
|
||||
rm -rf $dstdir/cmd
|
||||
rm -rf $dstdir/tests
|
||||
rm -rf $dstdir/lib
|
||||
rm -rf $dstdir/pkg
|
||||
rm -rf $dstdir/automation
|
||||
rm -rf $dstdir/gtests
|
||||
rm -rf $dstdir/cpputil
|
||||
rm -rf $dstdir/doc
|
||||
|
||||
# Start with an empty lib directory and copy only what we need.
|
||||
mkdir $dstdir/lib
|
||||
copy_top $nssdir/lib $dstdir/lib
|
||||
cp -R $nssdir/lib/dbm $dstdir/lib/dbm
|
||||
cp -R $nssdir/lib/freebl $dstdir/lib/freebl
|
||||
cp -R $nssdir/lib/softoken $dstdir/lib/softoken
|
||||
cp -R $nssdir/lib/sqlite $dstdir/lib/sqlite
|
||||
|
||||
mkdir $dstdir/cmd
|
||||
copy_top $nssdir/cmd $dstdir/cmd
|
||||
cp -R $nssdir/cmd/bltest $dstdir/cmd/bltest
|
||||
cp -R $nssdir/cmd/ecperf $dstdir/cmd/ecperf
|
||||
cp -R $nssdir/cmd/fbectest $dstdir/cmd/fbectest
|
||||
cp -R $nssdir/cmd/fipstest $dstdir/cmd/fipstest
|
||||
cp -R $nssdir/cmd/lib $dstdir/cmd/lib
|
||||
cp -R $nssdir/cmd/lowhashtest $dstdir/cmd/lowhashtest
|
||||
cp -R $nssdir/cmd/shlibsign $dstdir/cmd/shlibsign
|
||||
|
||||
mkdir $dstdir/tests
|
||||
copy_top $nssdir/tests $dstdir/tests
|
||||
|
||||
cp -R $nssdir/tests/cipher $dstdir/tests/cipher
|
||||
cp -R $nssdir/tests/common $dstdir/tests/common
|
||||
cp -R $nssdir/tests/ec $dstdir/tests/ec
|
||||
cp -R $nssdir/tests/lowhash $dstdir/tests/lowhash
|
||||
|
||||
cp $nssdir/lib/util/verref.h $dstdir/lib/freebl
|
||||
cp $nssdir/lib/util/verref.h $dstdir/lib/softoken
|
||||
cp $nssdir/lib/util/verref.h $dstdir/lib/softoken/legacydb
|
||||
}
|
||||
|
||||
split_nss() {
|
||||
nssdir="$1"
|
||||
dstdir="$2"
|
||||
|
||||
# Prepare a source tree only containing files to build nss:
|
||||
#
|
||||
# nss/dbm full directory
|
||||
# nss/coreconf full directory
|
||||
# nss top files only
|
||||
# nss/lib top files only
|
||||
# nss/lib/freebl full directory
|
||||
# nss/lib/softoken full directory
|
||||
# nss/lib/softoken/dbm full directory
|
||||
|
||||
# Copy everything.
|
||||
cp -R $nssdir $dstdir
|
||||
|
||||
# Remove subdirectories that we don't want.
|
||||
rm -rf $dstdir/lib/freebl
|
||||
rm -rf $dstdir/lib/softoken
|
||||
rm -rf $dstdir/lib/util
|
||||
rm -rf $dstdir/cmd/bltest
|
||||
rm -rf $dstdir/cmd/fipstest
|
||||
rm -rf $dstdir/cmd/rsaperf_low
|
||||
|
||||
# Copy these headers until the upstream bug is accepted
|
||||
# Upstream https://bugzilla.mozilla.org/show_bug.cgi?id=820207
|
||||
cp $nssdir/lib/softoken/lowkeyi.h $dstdir/cmd/rsaperf
|
||||
cp $nssdir/lib/softoken/lowkeyti.h $dstdir/cmd/rsaperf
|
||||
|
||||
# Copy verref.h which will be needed later during the build phase.
|
||||
cp $nssdir/lib/util/verref.h $dstdir/lib/ckfw/builtins/verref.h
|
||||
cp $nssdir/lib/util/verref.h $dstdir/lib/nss/verref.h
|
||||
cp $nssdir/lib/util/verref.h $dstdir/lib/smime/verref.h
|
||||
cp $nssdir/lib/util/verref.h $dstdir/lib/ssl/verref.h
|
||||
cp $nssdir/lib/util/templates.c $dstdir/lib/nss/templates.c
|
||||
|
||||
# FIXME: Skip util_gtest because it links with libnssutil.a. Note
|
||||
# that we can't use libnssutil3.so instead, because util_gtest
|
||||
# depends on internal symbols not exported from the shared library.
|
||||
sed '/ util_gtest \\/d' $dstdir/gtests/manifest.mn > $dstdir/gtests/manifest.mn-t && mv $dstdir/gtests/manifest.mn-t $dstdir/gtests/manifest.mn
|
||||
}
|
||||
|
|
@ -2,11 +2,21 @@
|
|||
|
||||
set -v -e -x
|
||||
|
||||
if [[ $(id -u) -eq 0 ]]; then
|
||||
# Drop privileges by re-running this script.
|
||||
# Note: this mangles arguments, better to avoid running scripts as root.
|
||||
exec su worker -c "$0 $*"
|
||||
fi
|
||||
|
||||
# Usage: hg_clone repo dir [revision=@]
|
||||
hg_clone() {
|
||||
repo=$1
|
||||
dir=$2
|
||||
rev=${3:-@}
|
||||
if [ -d "$dir" ]; then
|
||||
hg pull -R "$dir" -ur "$rev" "$repo" && return
|
||||
rm -rf "$dir"
|
||||
fi
|
||||
for i in 0 2 5; do
|
||||
sleep $i
|
||||
hg clone -r "$rev" "$repo" "$dir" && return
|
||||
|
|
|
|||
|
|
@ -3,7 +3,11 @@
|
|||
set -v -e -x
|
||||
|
||||
# Set up the toolchain.
|
||||
source $(dirname $0)/setup.sh
|
||||
if [ "$USE_64" = 1 ]; then
|
||||
source $(dirname $0)/setup64.sh
|
||||
else
|
||||
source $(dirname $0)/setup32.sh
|
||||
fi
|
||||
|
||||
# Clone NSPR.
|
||||
hg_clone https://hg.mozilla.org/projects/nspr nspr default
|
||||
|
|
|
|||
34
security/nss/automation/taskcluster/windows/build_gyp.sh
Normal file
34
security/nss/automation/taskcluster/windows/build_gyp.sh
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
# Set up the toolchain.
|
||||
if [[ "$@" == *"-m32"* ]]; then
|
||||
source $(dirname $0)/setup32.sh
|
||||
else
|
||||
source $(dirname $0)/setup64.sh
|
||||
fi
|
||||
|
||||
# Install GYP.
|
||||
cd gyp
|
||||
python -m virtualenv test-env
|
||||
test-env/Scripts/python setup.py install
|
||||
test-env/Scripts/python -m pip install --upgrade pip
|
||||
test-env/Scripts/pip install --upgrade setuptools
|
||||
cd ..
|
||||
|
||||
export GYP_MSVS_OVERRIDE_PATH="${VSPATH}"
|
||||
export GYP_MSVS_VERSION="2015"
|
||||
export GYP="${PWD}/gyp/test-env/Scripts/gyp"
|
||||
|
||||
# Fool GYP.
|
||||
touch "${VSPATH}/VC/vcvarsall.bat"
|
||||
|
||||
# Clone NSPR.
|
||||
hg_clone https://hg.mozilla.org/projects/nspr nspr default
|
||||
|
||||
# Build with gyp.
|
||||
GYP=${GYP} ./nss/build.sh -g -v "$@"
|
||||
|
||||
# Package.
|
||||
7z a public/build/dist.7z dist
|
||||
|
|
@ -1,10 +1,26 @@
|
|||
[
|
||||
{
|
||||
"version": "Visual Studio 2015 Update 2 / SDK 10.0.10586.0/212",
|
||||
"size": 332442800,
|
||||
"digest": "995394a4a515c7cb0f8595f26f5395361a638870dd0bbfcc22193fe1d98a0c47126057d5999cc494f3f3eac5cb49160e79757c468f83ee5797298e286ef6252c",
|
||||
"version": "Visual Studio 2015 Update 3 14.0.25425.01 / SDK 10.0.14393.0",
|
||||
"size": 326656969,
|
||||
"digest": "babc414ffc0457d27f5a1ed24a8e4873afbe2f1c1a4075469a27c005e1babc3b2a788f643f825efedff95b79686664c67ec4340ed535487168a3482e68559bc7",
|
||||
"algorithm": "sha512",
|
||||
"filename": "vs2015u2.zip",
|
||||
"filename": "vs2015u3.zip",
|
||||
"unpack": true
|
||||
},
|
||||
{
|
||||
"version": "Ninja 1.7.1",
|
||||
"size": 184821,
|
||||
"digest": "e4f9a1ae624a2630e75264ba37d396d9c7407d6e6aea3763056210ba6e1387908bd31cf4037a6a3661a418e86c4d2761e0c333e6a3bd0d66549d2b0d72d3f43b",
|
||||
"algorithm": "sha512",
|
||||
"filename": "ninja171.zip",
|
||||
"unpack": true
|
||||
},
|
||||
{
|
||||
"size": 13063963,
|
||||
"visibility": "public",
|
||||
"digest": "47a19f8f863eab3414abab2b9e9bd901ab896c799b3d9254b456b2f59374b085b99de805e21069a0819f01eecb3f43f7e2395a8c644c04bcbfa5711261cca29d",
|
||||
"algorithm": "sha512",
|
||||
"filename": "gyp-2017-05-23.zip",
|
||||
"unpack": true
|
||||
}
|
||||
]
|
||||
|
|
|
|||
|
|
@ -2,6 +2,13 @@
|
|||
|
||||
set -v -e -x
|
||||
|
||||
export VSPATH="$(pwd)/vs2015u3"
|
||||
export NINJA_PATH="$(pwd)/ninja/bin"
|
||||
|
||||
export WINDOWSSDKDIR="${VSPATH}/SDK"
|
||||
export VS90COMNTOOLS="${VSPATH}/VC"
|
||||
export INCLUDE="${VSPATH}/VC/include:${VSPATH}/SDK/Include/10.0.14393.0/ucrt:${VSPATH}/SDK/Include/10.0.14393.0/shared:${VSPATH}/SDK/Include/10.0.14393.0/um"
|
||||
|
||||
# Usage: hg_clone repo dir [revision=@]
|
||||
hg_clone() {
|
||||
repo=$1
|
||||
|
|
@ -16,15 +23,4 @@ hg_clone() {
|
|||
}
|
||||
|
||||
hg_clone https://hg.mozilla.org/build/tools tools default
|
||||
|
||||
tools/scripts/tooltool/tooltool_wrapper.sh $(dirname $0)/releng.manifest https://api.pub.build.mozilla.org/tooltool/ non-existant-file.sh /c/mozilla-build/python/python.exe /c/builds/tooltool.py --authentication-file /c/builds/relengapi.tok -c /c/builds/tooltool_cache
|
||||
VSPATH="$(pwd)/vs2015u2"
|
||||
|
||||
export WINDOWSSDKDIR="${VSPATH}/SDK"
|
||||
export WIN32_REDIST_DIR="${VSPATH}/VC/redist/x64/Microsoft.VC140.CRT"
|
||||
export WIN_UCRT_REDIST_DIR="${VSPATH}/SDK/Redist/ucrt/DLLs/x64"
|
||||
|
||||
export PATH="${VSPATH}/VC/bin/amd64:${VSPATH}/VC/bin:${VSPATH}/SDK/bin/x64:${VSPATH}/VC/redist/x64/Microsoft.VC140.CRT:${VSPATH}/SDK/Redist/ucrt/DLLs/x64:${PATH}"
|
||||
|
||||
export INCLUDE="${VSPATH}/VC/include:${VSPATH}/SDK/Include/10.0.10586.0/ucrt:${VSPATH}/SDK/Include/10.0.10586.0/shared:${VSPATH}/SDK/Include/10.0.10586.0/um"
|
||||
export LIB="${VSPATH}/VC/lib/amd64:${VSPATH}/SDK/lib/10.0.10586.0/ucrt/x64:${VSPATH}/SDK/lib/10.0.10586.0/um/x64"
|
||||
|
|
|
|||
10
security/nss/automation/taskcluster/windows/setup32.sh
Normal file
10
security/nss/automation/taskcluster/windows/setup32.sh
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
source $(dirname $0)/setup.sh
|
||||
|
||||
export WIN32_REDIST_DIR="${VSPATH}/VC/redist/x86/Microsoft.VC140.CRT"
|
||||
export WIN_UCRT_REDIST_DIR="${VSPATH}/SDK/Redist/ucrt/DLLs/x86"
|
||||
export PATH="${NINJA_PATH}:${VSPATH}/VC/bin/amd64_x86:${VSPATH}/VC/bin/amd64:${VSPATH}/VC/bin:${VSPATH}/SDK/bin/x86:${VSPATH}/SDK/bin/x64:${VSPATH}/VC/redist/x86/Microsoft.VC140.CRT:${VSPATH}/VC/redist/x64/Microsoft.VC140.CRT:${VSPATH}/SDK/Redist/ucrt/DLLs/x86:${VSPATH}/SDK/Redist/ucrt/DLLs/x64:${PATH}"
|
||||
export LIB="${VSPATH}/VC/lib:${VSPATH}/SDK/lib/10.0.14393.0/ucrt/x86:${VSPATH}/SDK/lib/10.0.14393.0/um/x86"
|
||||
10
security/nss/automation/taskcluster/windows/setup64.sh
Normal file
10
security/nss/automation/taskcluster/windows/setup64.sh
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
set -v -e -x
|
||||
|
||||
source $(dirname $0)/setup.sh
|
||||
|
||||
export WIN32_REDIST_DIR="${VSPATH}/VC/redist/x64/Microsoft.VC140.CRT"
|
||||
export WIN_UCRT_REDIST_DIR="${VSPATH}/SDK/Redist/ucrt/DLLs/x64"
|
||||
export PATH="${NINJA_PATH}:${VSPATH}/VC/bin/amd64:${VSPATH}/VC/bin:${VSPATH}/SDK/bin/x64:${VSPATH}/VC/redist/x64/Microsoft.VC140.CRT:${VSPATH}/SDK/Redist/ucrt/DLLs/x64:${PATH}"
|
||||
export LIB="${VSPATH}/VC/lib/amd64:${VSPATH}/SDK/lib/10.0.14393.0/ucrt/x64:${VSPATH}/SDK/lib/10.0.14393.0/um/x64"
|
||||
|
|
@ -1,4 +1,10 @@
|
|||
#!/bin/bash
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
################################################################################
|
||||
#
|
||||
# This script builds NSS with gyp and ninja.
|
||||
#
|
||||
# This build system is still under development. It does not yet support all
|
||||
|
|
@ -6,41 +12,27 @@
|
|||
|
||||
set -e
|
||||
|
||||
source $(dirname $0)/coreconf/nspr.sh
|
||||
cwd=$(cd $(dirname $0); pwd -P)
|
||||
source "$cwd"/coreconf/nspr.sh
|
||||
source "$cwd"/coreconf/sanitizers.sh
|
||||
GYP=${GYP:-gyp}
|
||||
|
||||
# Usage info
|
||||
show_help() {
|
||||
cat << EOF
|
||||
show_help()
|
||||
{
|
||||
cat "$cwd"/help.txt
|
||||
}
|
||||
|
||||
Usage: ${0##*/} [-hcgv] [-j <n>] [--test] [--fuzz] [--scan-build[=output]]
|
||||
[-m32] [--opt|-o] [--asan] [--ubsan] [--sancov[=edge|bb|func]]
|
||||
[--pprof] [--msan]
|
||||
|
||||
This script builds NSS with gyp and ninja.
|
||||
|
||||
This build system is still under development. It does not yet support all
|
||||
the features or platforms that NSS supports.
|
||||
|
||||
NSS build tool options:
|
||||
|
||||
-h display this help and exit
|
||||
-c clean before build
|
||||
-g force a rebuild of gyp (and NSPR, because why not)
|
||||
-j <n> run at most <n> concurrent jobs
|
||||
-v verbose build
|
||||
-m32 do a 32-bit build on a 64-bit system
|
||||
--test ignore map files and export everything we have
|
||||
--fuzz enable fuzzing mode. this always enables test builds
|
||||
--scan-build run the build with scan-build (scan-build has to be in the path)
|
||||
--scan-build=/out/path sets the output path for scan-build
|
||||
--opt|-o do an opt build
|
||||
--asan do an asan build
|
||||
--ubsan do an ubsan build
|
||||
--msan do an msan build
|
||||
--sancov do sanitize coverage builds
|
||||
--sancov=func sets coverage to function level for example
|
||||
--pprof build with gperftool support
|
||||
EOF
|
||||
run_verbose()
|
||||
{
|
||||
if [ "$verbose" = 1 ]; then
|
||||
echo "$@"
|
||||
exec 3>&1
|
||||
else
|
||||
exec 3>/dev/null
|
||||
fi
|
||||
"$@" 1>&3 2>&3
|
||||
exec 3>&-
|
||||
}
|
||||
|
||||
if [ -n "$CCC" ] && [ -z "$CXX" ]; then
|
||||
|
|
@ -51,154 +43,171 @@ opt_build=0
|
|||
build_64=0
|
||||
clean=0
|
||||
rebuild_gyp=0
|
||||
rebuild_nspr=0
|
||||
target=Debug
|
||||
verbose=0
|
||||
fuzz=0
|
||||
fuzz_tls=0
|
||||
fuzz_oss=0
|
||||
no_local_nspr=0
|
||||
armhf=0
|
||||
|
||||
# parse parameters to store in config
|
||||
params=$(echo "$*" | perl -pe 's/-c|-v|-g|-j [0-9]*|-h//g' | perl -pe 's/^\s*(.*?)\s*$/\1/')
|
||||
params=$(echo "$params $CC $CCC" | tr " " "\n" | perl -pe '/^\s*$/d')
|
||||
params=$(echo "${params[*]}" | sort)
|
||||
|
||||
cwd=$(cd $(dirname $0); pwd -P)
|
||||
dist_dir="$cwd/../dist"
|
||||
gyp_params=(--depth="$cwd" --generator-output=".")
|
||||
nspr_params=()
|
||||
ninja_params=()
|
||||
|
||||
# try to guess sensible defaults
|
||||
arch=$(python "$cwd/coreconf/detect_host_arch.py")
|
||||
arch=$(python "$cwd"/coreconf/detect_host_arch.py)
|
||||
if [ "$arch" = "x64" -o "$arch" = "aarch64" ]; then
|
||||
build_64=1
|
||||
elif [ "$arch" = "arm" ]; then
|
||||
armhf=1
|
||||
fi
|
||||
|
||||
gyp_params=()
|
||||
ninja_params=()
|
||||
scanbuild=()
|
||||
|
||||
enable_fuzz()
|
||||
{
|
||||
fuzz=1
|
||||
nspr_sanitizer asan
|
||||
nspr_sanitizer ubsan
|
||||
nspr_sanitizer sancov edge
|
||||
gyp_params+=(-Duse_asan=1)
|
||||
gyp_params+=(-Duse_ubsan=1)
|
||||
gyp_params+=(-Duse_sancov=edge)
|
||||
|
||||
# Adding debug symbols even for opt builds.
|
||||
nspr_opt+=(--enable-debug-symbols)
|
||||
}
|
||||
|
||||
# parse command line arguments
|
||||
while [ $# -gt 0 ]; do
|
||||
case $1 in
|
||||
-c) clean=1 ;;
|
||||
-g) rebuild_gyp=1 ;;
|
||||
--gyp|-g) rebuild_gyp=1 ;;
|
||||
--nspr) nspr_clean; rebuild_nspr=1 ;;
|
||||
-j) ninja_params+=(-j "$2"); shift ;;
|
||||
-v) ninja_params+=(-v); verbose=1 ;;
|
||||
--test) gyp_params+=(-Dtest_build=1) ;;
|
||||
--fuzz) gyp_params+=(-Dtest_build=1 -Dfuzz=1); enable_fuzz ;;
|
||||
--scan-build) scanbuild=(scan-build) ;;
|
||||
--scan-build=?*) scanbuild=(scan-build -o "${1#*=}") ;;
|
||||
--fuzz) fuzz=1 ;;
|
||||
--fuzz=oss) fuzz=1; fuzz_oss=1 ;;
|
||||
--fuzz=tls) fuzz=1; fuzz_tls=1 ;;
|
||||
--scan-build) enable_scanbuild ;;
|
||||
--scan-build=?*) enable_scanbuild "${1#*=}" ;;
|
||||
--opt|-o) opt_build=1 ;;
|
||||
-m32|--m32) build_64=0 ;;
|
||||
--asan) gyp_params+=(-Duse_asan=1); nspr_sanitizer asan ;;
|
||||
--ubsan) gyp_params+=(-Duse_ubsan=1); nspr_sanitizer ubsan ;;
|
||||
--sancov) gyp_params+=(-Duse_sancov=edge); nspr_sanitizer sancov edge ;;
|
||||
--sancov=?*) gyp_params+=(-Duse_sancov="${1#*=}"); nspr_sanitizer sancov "${1#*=}" ;;
|
||||
--asan) enable_sanitizer asan ;;
|
||||
--msan) enable_sanitizer msan ;;
|
||||
--ubsan) enable_ubsan ;;
|
||||
--ubsan=?*) enable_ubsan "${1#*=}" ;;
|
||||
--sancov) enable_sancov ;;
|
||||
--sancov=?*) enable_sancov "${1#*=}" ;;
|
||||
--pprof) gyp_params+=(-Duse_pprof=1) ;;
|
||||
--msan) gyp_params+=(-Duse_msan=1); nspr_sanitizer msan ;;
|
||||
*) show_help; exit ;;
|
||||
--ct-verif) gyp_params+=(-Dct_verif=1) ;;
|
||||
--disable-tests) gyp_params+=(-Ddisable_tests=1) ;;
|
||||
--no-zdefs) gyp_params+=(-Dno_zdefs=1) ;;
|
||||
--system-sqlite) gyp_params+=(-Duse_system_sqlite=1) ;;
|
||||
--with-nspr=?*) set_nspr_path "${1#*=}"; no_local_nspr=1 ;;
|
||||
--system-nspr) set_nspr_path "/usr/include/nspr/:"; no_local_nspr=1 ;;
|
||||
--enable-libpkix) gyp_params+=(-Ddisable_libpkix=0) ;;
|
||||
*) show_help; exit 2 ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
if [ "$opt_build" = "1" ]; then
|
||||
if [ "$opt_build" = 1 ]; then
|
||||
target=Release
|
||||
nspr_opt+=(--disable-debug --enable-optimize)
|
||||
else
|
||||
target=Debug
|
||||
fi
|
||||
if [ "$build_64" == "1" ]; then
|
||||
nspr_opt+=(--enable-64bit)
|
||||
else
|
||||
if [ "$build_64" = 1 ]; then
|
||||
nspr_params+=(--enable-64bit)
|
||||
elif [ ! "$armhf" = 1 ]; then
|
||||
gyp_params+=(-Dtarget_arch=ia32)
|
||||
nspr_opt+=(--enable-x32)
|
||||
fi
|
||||
|
||||
# clone fuzzing stuff
|
||||
if [ "$fuzz" = "1" ]; then
|
||||
[ $verbose = 0 ] && exec 3>/dev/null || exec 3>&1
|
||||
|
||||
echo "[1/2] Cloning libFuzzer files ..."
|
||||
$cwd/fuzz/clone_libfuzzer.sh 1>&3 2>&3
|
||||
|
||||
echo "[2/2] Cloning fuzzing corpus ..."
|
||||
$cwd/fuzz/clone_corpus.sh 1>&3 2>&3
|
||||
|
||||
exec 3>&-
|
||||
fi
|
||||
|
||||
# check if we have to rebuild gyp
|
||||
if [ "$params" != "$(cat $cwd/out/config 2>/dev/null)" -o "$rebuild_gyp" == 1 -o "$clean" == 1 ]; then
|
||||
rebuild_gyp=1
|
||||
rm -rf "$cwd/../nspr/$target" # force NSPR to rebuild
|
||||
if [ "$fuzz" = 1 ]; then
|
||||
source "$cwd"/coreconf/fuzz.sh
|
||||
fi
|
||||
|
||||
# set paths
|
||||
target_dir="$cwd/out/$target"
|
||||
|
||||
# get the realpath of $dist_dir
|
||||
dist_dir=$(mkdir -p $dist_dir; cd $dist_dir; pwd -P)
|
||||
|
||||
# get object directory
|
||||
obj_dir="$dist_dir/$target"
|
||||
gyp_params+=(-Dnss_dist_dir=$dist_dir)
|
||||
gyp_params+=(-Dnss_dist_obj_dir=$obj_dir)
|
||||
gyp_params+=(-Dnspr_lib_dir=$obj_dir/lib)
|
||||
gyp_params+=(-Dnspr_include_dir=$obj_dir/include/nspr)
|
||||
target_dir="$cwd"/out/$target
|
||||
mkdir -p "$target_dir"
|
||||
dist_dir="$cwd"/../dist
|
||||
dist_dir=$(mkdir -p "$dist_dir"; cd "$dist_dir"; pwd -P)
|
||||
gyp_params+=(-Dnss_dist_dir="$dist_dir")
|
||||
|
||||
# -c = clean first
|
||||
if [ "$clean" = 1 ]; then
|
||||
rm -rf "$cwd/out"
|
||||
rm -rf "$cwd/../nspr/$target"
|
||||
nspr_clean
|
||||
rm -rf "$cwd"/out
|
||||
rm -rf "$dist_dir"
|
||||
fi
|
||||
|
||||
# This saves a canonical representation of arguments that we are passing to gyp
|
||||
# or the NSPR build so that we can work out if a rebuild is needed.
|
||||
# Caveat: This can fail for arguments that are position-dependent.
|
||||
# e.g., "-e 2 -f 1" and "-e 1 -f 2" canonicalize the same.
|
||||
check_config()
|
||||
{
|
||||
local newconf="$1".new oldconf="$1"
|
||||
shift
|
||||
mkdir -p $(dirname "$newconf")
|
||||
echo CC="$CC" >"$newconf"
|
||||
echo CCC="$CCC" >>"$newconf"
|
||||
echo CXX="$CXX" >>"$newconf"
|
||||
for i in "$@"; do echo $i; done | sort >>"$newconf"
|
||||
|
||||
# Note: The following diff fails if $oldconf isn't there as well, which
|
||||
# happens if we don't have a previous successful build.
|
||||
! diff -q "$newconf" "$oldconf" >/dev/null 2>&1
|
||||
}
|
||||
|
||||
gyp_config="$cwd"/out/gyp_config
|
||||
nspr_config="$cwd"/out/$target/nspr_config
|
||||
|
||||
# If we don't have a build directory make sure that we rebuild.
|
||||
if [ ! -d "$target_dir" ]; then
|
||||
rebuild_nspr=1
|
||||
rebuild_gyp=1
|
||||
elif [ ! -d "$dist_dir"/$target ]; then
|
||||
rebuild_nspr=1
|
||||
fi
|
||||
|
||||
# Update NSPR ${C,CXX,LD}FLAGS.
|
||||
nspr_set_flags $sanitizer_flags
|
||||
|
||||
if check_config "$nspr_config" "${nspr_params[@]}" \
|
||||
nspr_cflags="$nspr_cflags" \
|
||||
nspr_cxxflags="$nspr_cxxflags" \
|
||||
nspr_ldflags="$nspr_ldflags"; then
|
||||
rebuild_nspr=1
|
||||
fi
|
||||
|
||||
# Forward sanitizer flags.
|
||||
if [ ! -z "$sanitizer_flags" ]; then
|
||||
gyp_params+=(-Dsanitizer_flags="$sanitizer_flags")
|
||||
fi
|
||||
|
||||
if check_config "$gyp_config" "${gyp_params[@]}"; then
|
||||
rebuild_gyp=1
|
||||
fi
|
||||
|
||||
# save the chosen target
|
||||
mkdir -p $dist_dir
|
||||
echo $target > $dist_dir/latest
|
||||
mkdir -p "$dist_dir"
|
||||
echo $target > "$dist_dir"/latest
|
||||
|
||||
# pass on CC and CCC
|
||||
if [ "${#scanbuild[@]}" -gt 0 ]; then
|
||||
if [ -n "$CC" ]; then
|
||||
scanbuild+=(--use-cc="$CC")
|
||||
if [[ "$rebuild_nspr" = 1 && "$no_local_nspr" = 0 ]]; then
|
||||
nspr_build "${nspr_params[@]}"
|
||||
mv -f "$nspr_config".new "$nspr_config"
|
||||
fi
|
||||
if [ "$rebuild_gyp" = 1 ]; then
|
||||
if ! hash ${GYP} 2> /dev/null; then
|
||||
echo "Please install gyp" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
if [ -n "$CCC" ]; then
|
||||
scanbuild+=(--use-c++="$CCC")
|
||||
# These extra arguments aren't used in determining whether to rebuild.
|
||||
obj_dir="$dist_dir"/$target
|
||||
gyp_params+=(-Dnss_dist_obj_dir=$obj_dir)
|
||||
if [ "$no_local_nspr" = 0 ]; then
|
||||
set_nspr_path "$obj_dir/include/nspr:$obj_dir/lib"
|
||||
fi
|
||||
fi
|
||||
|
||||
# These steps can take a while, so don't overdo them.
|
||||
# Force a redo with -g.
|
||||
if [ "$rebuild_gyp" = 1 -o ! -d "$target_dir" ]; then
|
||||
build_nspr $verbose
|
||||
run_verbose run_scanbuild ${GYP} -f ninja "${gyp_params[@]}" "$cwd"/nss.gyp
|
||||
|
||||
# Run gyp.
|
||||
[ $verbose = 1 ] && set -v -x
|
||||
"${scanbuild[@]}" gyp -f ninja "${gyp_params[@]}" --depth="$cwd" \
|
||||
--generator-output="." "$cwd/nss.gyp"
|
||||
[ $verbose = 1 ] && set +v +x
|
||||
|
||||
# Store used parameters for next run.
|
||||
echo "$params" > "$cwd/out/config"
|
||||
mv -f "$gyp_config".new "$gyp_config"
|
||||
fi
|
||||
|
||||
# Run ninja.
|
||||
if which ninja >/dev/null 2>&1; then
|
||||
ninja=(ninja)
|
||||
elif which ninja-build >/dev/null 2>&1; then
|
||||
ninja=(ninja-build)
|
||||
if hash ninja 2>/dev/null; then
|
||||
ninja=ninja
|
||||
elif hash ninja-build 2>/dev/null; then
|
||||
ninja=ninja-build
|
||||
else
|
||||
echo "Please install ninja" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
"${scanbuild[@]}" $ninja -C "$target_dir" "${ninja_params[@]}"
|
||||
run_scanbuild $ninja -C "$target_dir" "${ninja_params[@]}"
|
||||
|
|
|
|||
|
|
@ -31,6 +31,29 @@ dumpbytes(unsigned char *buf, int len)
|
|||
printf("\n");
|
||||
}
|
||||
|
||||
int
|
||||
hasPositiveTrust(unsigned int trust)
|
||||
{
|
||||
if (trust & CERTDB_TRUSTED) {
|
||||
if (trust & CERTDB_TRUSTED_CA) {
|
||||
return PR_TRUE;
|
||||
} else {
|
||||
return PR_FALSE;
|
||||
}
|
||||
} else {
|
||||
if (trust & CERTDB_TRUSTED_CA) {
|
||||
return PR_TRUE;
|
||||
} else if (trust & CERTDB_VALID_CA) {
|
||||
return PR_TRUE;
|
||||
} else if (trust & CERTDB_TERMINAL_RECORD) {
|
||||
return PR_FALSE;
|
||||
} else {
|
||||
return PR_FALSE;
|
||||
}
|
||||
}
|
||||
return PR_FALSE;
|
||||
}
|
||||
|
||||
char *
|
||||
getTrustString(unsigned int trust)
|
||||
{
|
||||
|
|
@ -202,6 +225,11 @@ ConvertCertificate(SECItem *sdder, char *nickname, CERTCertTrust *trust,
|
|||
printf("CKA_VALUE MULTILINE_OCTAL\n");
|
||||
dumpbytes(sdder->data, sdder->len);
|
||||
printf("END\n");
|
||||
if (hasPositiveTrust(trust->sslFlags) ||
|
||||
hasPositiveTrust(trust->emailFlags) ||
|
||||
hasPositiveTrust(trust->objectSigningFlags)) {
|
||||
printf("CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE\n");
|
||||
}
|
||||
}
|
||||
|
||||
if ((trust->sslFlags | trust->emailFlags | trust->objectSigningFlags) ==
|
||||
|
|
|
|||
|
|
@ -917,6 +917,7 @@ setupIO(PLArenaPool *arena, bltestIO *input, PRFileDesc *file,
|
|||
SECItem *in;
|
||||
unsigned char *tok;
|
||||
unsigned int i, j;
|
||||
PRBool needToFreeFile = PR_FALSE;
|
||||
|
||||
if (file && (numBytes == 0 || file == PR_STDIN)) {
|
||||
/* grabbing data from a file */
|
||||
|
|
@ -924,6 +925,7 @@ setupIO(PLArenaPool *arena, bltestIO *input, PRFileDesc *file,
|
|||
if (rv != SECSuccess)
|
||||
return SECFailure;
|
||||
in = &fileData;
|
||||
needToFreeFile = PR_TRUE;
|
||||
} else if (str) {
|
||||
/* grabbing data from command line */
|
||||
fileData.data = (unsigned char *)str;
|
||||
|
|
@ -957,10 +959,7 @@ setupIO(PLArenaPool *arena, bltestIO *input, PRFileDesc *file,
|
|||
--in->len;
|
||||
if (in->data[in->len - 1] == '\r')
|
||||
--in->len;
|
||||
SECITEM_CopyItem(arena, &input->buf, in);
|
||||
if (rv != SECSuccess) {
|
||||
return SECFailure;
|
||||
}
|
||||
rv = SECITEM_CopyItem(arena, &input->buf, in);
|
||||
break;
|
||||
case bltestHexSpaceDelim:
|
||||
SECITEM_AllocItem(arena, &input->buf, in->len / 5);
|
||||
|
|
@ -986,7 +985,7 @@ setupIO(PLArenaPool *arena, bltestIO *input, PRFileDesc *file,
|
|||
break;
|
||||
}
|
||||
|
||||
if (file)
|
||||
if (needToFreeFile)
|
||||
SECITEM_FreeItem(&fileData, PR_FALSE);
|
||||
return rv;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -980,8 +980,6 @@ AddNameConstraints(void *extHandle)
|
|||
GEN_BREAK(SECFailure);
|
||||
}
|
||||
|
||||
(void)SEC_ASN1EncodeInteger(arena, ¤t->min, 0);
|
||||
|
||||
if (!GetGeneralName(arena, ¤t->name, PR_TRUE)) {
|
||||
GEN_BREAK(SECFailure);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1002,9 +1002,12 @@ ListModules(void)
|
|||
|
||||
/* look at each slot*/
|
||||
for (le = list->head; le; le = le->next) {
|
||||
char *token_uri = PK11_GetTokenURI(le->slot);
|
||||
printf("\n");
|
||||
printf(" slot: %s\n", PK11_GetSlotName(le->slot));
|
||||
printf(" token: %s\n", PK11_GetTokenName(le->slot));
|
||||
printf(" uri: %s\n", token_uri);
|
||||
PORT_Free(token_uri);
|
||||
}
|
||||
PK11_FreeSlotList(list);
|
||||
|
||||
|
|
|
|||
|
|
@ -17,14 +17,6 @@
|
|||
#include <conio.h>
|
||||
#endif
|
||||
|
||||
#if defined(__sun) && !defined(SVR4)
|
||||
extern int fclose(FILE *);
|
||||
extern int fprintf(FILE *, char *, ...);
|
||||
extern int isatty(int);
|
||||
extern char *sys_errlist[];
|
||||
#define strerror(errno) sys_errlist[errno]
|
||||
#endif
|
||||
|
||||
#include "nspr.h"
|
||||
#include "prtypes.h"
|
||||
#include "prtime.h"
|
||||
|
|
@ -52,9 +44,10 @@ static int
|
|||
UpdateRNG(void)
|
||||
{
|
||||
char randbuf[RAND_BUF_SIZE];
|
||||
int fd, count;
|
||||
int fd;
|
||||
int c;
|
||||
int rv = 0;
|
||||
size_t count;
|
||||
#ifdef XP_UNIX
|
||||
cc_t orig_cc_min;
|
||||
cc_t orig_cc_time;
|
||||
|
|
|
|||
|
|
@ -66,8 +66,11 @@ FindCRL(CERTCertDBHandle *certHandle, char *name, int type)
|
|||
return ((CERTSignedCrl *)NULL);
|
||||
}
|
||||
} else {
|
||||
SECITEM_CopyItem(NULL, &derName, &cert->derSubject);
|
||||
SECStatus rv = SECITEM_CopyItem(NULL, &derName, &cert->derSubject);
|
||||
CERT_DestroyCertificate(cert);
|
||||
if (rv != SECSuccess) {
|
||||
return ((CERTSignedCrl *)NULL);
|
||||
}
|
||||
}
|
||||
|
||||
crl = SEC_FindCrlByName(certHandle, &derName, type);
|
||||
|
|
|
|||
|
|
@ -1261,11 +1261,13 @@ DoChallengeResponse(SECKEYPrivateKey *privKey,
|
|||
return 908;
|
||||
}
|
||||
keyID = PK11_MakeIDFromPubKey(publicValue);
|
||||
SECITEM_FreeItem(publicValue, PR_TRUE);
|
||||
if (keyID == NULL) {
|
||||
printf("Could not make the keyID from the public value\n");
|
||||
return 909;
|
||||
}
|
||||
foundPrivKey = PK11_FindKeyByKeyID(privKey->pkcs11Slot, keyID, &pwdata);
|
||||
SECITEM_FreeItem(keyID, PR_TRUE);
|
||||
if (foundPrivKey == NULL) {
|
||||
printf("Could not find the private key corresponding to the public"
|
||||
" value.\n");
|
||||
|
|
|
|||
|
|
@ -9,7 +9,6 @@
|
|||
#include "basicutil.h"
|
||||
#include "pkcs11.h"
|
||||
#include "nspr.h"
|
||||
#include "secutil.h"
|
||||
#include <stdio.h>
|
||||
|
||||
#define __PASTE(x, y) x##y
|
||||
|
|
@ -27,70 +26,6 @@
|
|||
|
||||
#include "pkcs11f.h"
|
||||
|
||||
/* mapping between ECCurveName enum and pointers to ECCurveParams */
|
||||
static SECOidTag ecCurve_oid_map[] = {
|
||||
SEC_OID_UNKNOWN, /* ECCurve_noName */
|
||||
SEC_OID_ANSIX962_EC_PRIME192V1, /* ECCurve_NIST_P192 */
|
||||
SEC_OID_SECG_EC_SECP224R1, /* ECCurve_NIST_P224 */
|
||||
SEC_OID_ANSIX962_EC_PRIME256V1, /* ECCurve_NIST_P256 */
|
||||
SEC_OID_SECG_EC_SECP384R1, /* ECCurve_NIST_P384 */
|
||||
SEC_OID_SECG_EC_SECP521R1, /* ECCurve_NIST_P521 */
|
||||
SEC_OID_SECG_EC_SECT163K1, /* ECCurve_NIST_K163 */
|
||||
SEC_OID_SECG_EC_SECT163R1, /* ECCurve_NIST_B163 */
|
||||
SEC_OID_SECG_EC_SECT233K1, /* ECCurve_NIST_K233 */
|
||||
SEC_OID_SECG_EC_SECT233R1, /* ECCurve_NIST_B233 */
|
||||
SEC_OID_SECG_EC_SECT283K1, /* ECCurve_NIST_K283 */
|
||||
SEC_OID_SECG_EC_SECT283R1, /* ECCurve_NIST_B283 */
|
||||
SEC_OID_SECG_EC_SECT409K1, /* ECCurve_NIST_K409 */
|
||||
SEC_OID_SECG_EC_SECT409R1, /* ECCurve_NIST_B409 */
|
||||
SEC_OID_SECG_EC_SECT571K1, /* ECCurve_NIST_K571 */
|
||||
SEC_OID_SECG_EC_SECT571R1, /* ECCurve_NIST_B571 */
|
||||
SEC_OID_ANSIX962_EC_PRIME192V2,
|
||||
SEC_OID_ANSIX962_EC_PRIME192V3,
|
||||
SEC_OID_ANSIX962_EC_PRIME239V1,
|
||||
SEC_OID_ANSIX962_EC_PRIME239V2,
|
||||
SEC_OID_ANSIX962_EC_PRIME239V3,
|
||||
SEC_OID_ANSIX962_EC_C2PNB163V1,
|
||||
SEC_OID_ANSIX962_EC_C2PNB163V2,
|
||||
SEC_OID_ANSIX962_EC_C2PNB163V3,
|
||||
SEC_OID_ANSIX962_EC_C2PNB176V1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB191V1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB191V2,
|
||||
SEC_OID_ANSIX962_EC_C2TNB191V3,
|
||||
SEC_OID_ANSIX962_EC_C2PNB208W1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB239V1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB239V2,
|
||||
SEC_OID_ANSIX962_EC_C2TNB239V3,
|
||||
SEC_OID_ANSIX962_EC_C2PNB272W1,
|
||||
SEC_OID_ANSIX962_EC_C2PNB304W1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB359V1,
|
||||
SEC_OID_ANSIX962_EC_C2PNB368W1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB431R1,
|
||||
SEC_OID_SECG_EC_SECP112R1,
|
||||
SEC_OID_SECG_EC_SECP112R2,
|
||||
SEC_OID_SECG_EC_SECP128R1,
|
||||
SEC_OID_SECG_EC_SECP128R2,
|
||||
SEC_OID_SECG_EC_SECP160K1,
|
||||
SEC_OID_SECG_EC_SECP160R1,
|
||||
SEC_OID_SECG_EC_SECP160R2,
|
||||
SEC_OID_SECG_EC_SECP192K1,
|
||||
SEC_OID_SECG_EC_SECP224K1,
|
||||
SEC_OID_SECG_EC_SECP256K1,
|
||||
SEC_OID_SECG_EC_SECT113R1,
|
||||
SEC_OID_SECG_EC_SECT113R2,
|
||||
SEC_OID_SECG_EC_SECT131R1,
|
||||
SEC_OID_SECG_EC_SECT131R2,
|
||||
SEC_OID_SECG_EC_SECT163R1,
|
||||
SEC_OID_SECG_EC_SECT193R1,
|
||||
SEC_OID_SECG_EC_SECT193R2,
|
||||
SEC_OID_SECG_EC_SECT239K1,
|
||||
SEC_OID_UNKNOWN, /* ECCurve_WTLS_1 */
|
||||
SEC_OID_UNKNOWN, /* ECCurve_WTLS_8 */
|
||||
SEC_OID_UNKNOWN, /* ECCurve_WTLS_9 */
|
||||
SEC_OID_CURVE25519,
|
||||
SEC_OID_UNKNOWN /* ECCurve_pastLastCurve */
|
||||
};
|
||||
|
||||
typedef SECStatus (*op_func)(void *, void *, void *);
|
||||
typedef SECStatus (*pk11_op_func)(CK_SESSION_HANDLE, void *, void *, void *);
|
||||
|
||||
|
|
@ -106,6 +41,8 @@ typedef struct ThreadDataStr {
|
|||
int isSign;
|
||||
} ThreadData;
|
||||
|
||||
typedef SECItem SECKEYECParams;
|
||||
|
||||
void
|
||||
PKCS11Thread(void *data)
|
||||
{
|
||||
|
|
@ -373,30 +310,6 @@ PKCS11_Verify(CK_SESSION_HANDLE session, CK_OBJECT_HANDLE *hKey,
|
|||
return SECSuccess;
|
||||
}
|
||||
|
||||
static SECStatus
|
||||
ecName2params(ECCurveName curve, SECKEYECParams *params)
|
||||
{
|
||||
SECOidData *oidData = NULL;
|
||||
|
||||
if ((curve < ECCurve_noName) || (curve > ECCurve_pastLastCurve) ||
|
||||
((oidData = SECOID_FindOIDByTag(ecCurve_oid_map[curve])) == NULL)) {
|
||||
PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
SECITEM_AllocItem(NULL, params, (2 + oidData->oid.len));
|
||||
/*
|
||||
* params->data needs to contain the ASN encoding of an object ID (OID)
|
||||
* representing the named curve. The actual OID is in
|
||||
* oidData->oid.data so we simply prepend 0x06 and OID length
|
||||
*/
|
||||
params->data[0] = SEC_ASN1_OBJECT_ID;
|
||||
params->data[1] = oidData->oid.len;
|
||||
memcpy(params->data + 2, oidData->oid.data, oidData->oid.len);
|
||||
|
||||
return SECSuccess;
|
||||
}
|
||||
|
||||
/* Performs basic tests of elliptic curve cryptography over prime fields.
|
||||
* If tests fail, then it prints an error message, aborts, and returns an
|
||||
* error code. Otherwise, returns 0. */
|
||||
|
|
@ -422,7 +335,7 @@ ectest_curve_pkcs11(ECCurveName curve, int iterations, int numThreads)
|
|||
|
||||
ecParams.data = NULL;
|
||||
ecParams.len = 0;
|
||||
rv = ecName2params(curve, &ecParams);
|
||||
rv = SECU_ecName2params(curve, &ecParams);
|
||||
if (rv != SECSuccess) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
|
@ -541,9 +454,9 @@ ectest_curve_freebl(ECCurveName curve, int iterations, int numThreads,
|
|||
unsigned char sigData[256];
|
||||
unsigned char digestData[20];
|
||||
double signRate, deriveRate = 0;
|
||||
char genenc[3 + 2 * 2 * MAX_ECKEY_LEN];
|
||||
SECStatus rv = SECFailure;
|
||||
PLArenaPool *arena;
|
||||
SECItem ecEncodedParams = { siBuffer, NULL, 0 };
|
||||
|
||||
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
||||
if (!arena) {
|
||||
|
|
@ -555,28 +468,11 @@ ectest_curve_freebl(ECCurveName curve, int iterations, int numThreads,
|
|||
return SECFailure;
|
||||
}
|
||||
|
||||
ecParams.name = curve;
|
||||
ecParams.type = ec_params_named;
|
||||
ecParams.curveOID.data = NULL;
|
||||
ecParams.curveOID.len = 0;
|
||||
ecParams.curve.seed.data = NULL;
|
||||
ecParams.curve.seed.len = 0;
|
||||
ecParams.DEREncoding.data = NULL;
|
||||
ecParams.DEREncoding.len = 0;
|
||||
|
||||
ecParams.fieldID.size = ecCurve_map[curve]->size;
|
||||
ecParams.fieldID.type = fieldType;
|
||||
SECU_HexString2SECItem(arena, &ecParams.fieldID.u.prime, ecCurve_map[curve]->irr);
|
||||
SECU_HexString2SECItem(arena, &ecParams.curve.a, ecCurve_map[curve]->curvea);
|
||||
SECU_HexString2SECItem(arena, &ecParams.curve.b, ecCurve_map[curve]->curveb);
|
||||
genenc[0] = '0';
|
||||
genenc[1] = '4';
|
||||
genenc[2] = '\0';
|
||||
strcat(genenc, ecCurve_map[curve]->genx);
|
||||
strcat(genenc, ecCurve_map[curve]->geny);
|
||||
SECU_HexString2SECItem(arena, &ecParams.base, genenc);
|
||||
SECU_HexString2SECItem(arena, &ecParams.order, ecCurve_map[curve]->order);
|
||||
ecParams.cofactor = ecCurve_map[curve]->cofactor;
|
||||
rv = SECU_ecName2params(curve, &ecEncodedParams);
|
||||
if (rv != SECSuccess) {
|
||||
goto cleanup;
|
||||
}
|
||||
EC_FillParams(arena, &ecEncodedParams, &ecParams);
|
||||
|
||||
PORT_Memset(digestData, 0xa5, sizeof(digestData));
|
||||
digest.data = digestData;
|
||||
|
|
@ -586,7 +482,7 @@ ectest_curve_freebl(ECCurveName curve, int iterations, int numThreads,
|
|||
|
||||
rv = EC_NewKey(&ecParams, &ecPriv);
|
||||
if (rv != SECSuccess) {
|
||||
return SECFailure;
|
||||
goto cleanup;
|
||||
}
|
||||
ecPub.ecParams = ecParams;
|
||||
ecPub.publicValue = ecPriv->publicValue;
|
||||
|
|
@ -617,8 +513,11 @@ ectest_curve_freebl(ECCurveName curve, int iterations, int numThreads,
|
|||
}
|
||||
|
||||
cleanup:
|
||||
SECITEM_FreeItem(&ecEncodedParams, PR_FALSE);
|
||||
PORT_FreeArena(arena, PR_FALSE);
|
||||
PORT_FreeArena(ecPriv->ecParams.arena, PR_FALSE);
|
||||
if (ecPriv) {
|
||||
PORT_FreeArena(ecPriv->ecParams.arena, PR_FALSE);
|
||||
}
|
||||
return rv;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,6 @@
|
|||
#include "basicutil.h"
|
||||
#include "secder.h"
|
||||
#include "secitem.h"
|
||||
#include "secutil.h"
|
||||
#include "nspr.h"
|
||||
#include <stdio.h>
|
||||
|
||||
|
|
@ -89,26 +88,19 @@ ectest_ecdh_kat(ECDH_KAT *kat)
|
|||
SECItem answer = { siBuffer, NULL, 0 };
|
||||
SECItem answer2 = { siBuffer, NULL, 0 };
|
||||
SECItem derived = { siBuffer, NULL, 0 };
|
||||
char genenc[3 + 2 * 2 * MAX_ECKEY_LEN];
|
||||
SECItem ecEncodedParams = { siBuffer, NULL, 0 };
|
||||
int i;
|
||||
|
||||
rv = init_params(&ecParams, curve, &arena, kat->fieldType);
|
||||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
||||
if (!arena) {
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
SECU_HexString2SECItem(arena, &ecParams.fieldID.u.prime, ecCurve_map[curve]->irr);
|
||||
SECU_HexString2SECItem(arena, &ecParams.curve.a, ecCurve_map[curve]->curvea);
|
||||
SECU_HexString2SECItem(arena, &ecParams.curve.b, ecCurve_map[curve]->curveb);
|
||||
genenc[0] = '0';
|
||||
genenc[1] = '4';
|
||||
genenc[2] = '\0';
|
||||
PORT_Assert(PR_ARRAY_SIZE(genenc) >= PORT_Strlen(ecCurve_map[curve]->genx));
|
||||
PORT_Assert(PR_ARRAY_SIZE(genenc) >= PORT_Strlen(ecCurve_map[curve]->geny));
|
||||
strcat(genenc, ecCurve_map[curve]->genx);
|
||||
strcat(genenc, ecCurve_map[curve]->geny);
|
||||
SECU_HexString2SECItem(arena, &ecParams.base, genenc);
|
||||
SECU_HexString2SECItem(arena, &ecParams.order, ecCurve_map[curve]->order);
|
||||
rv = SECU_ecName2params(curve, &ecEncodedParams);
|
||||
if (rv != SECSuccess) {
|
||||
goto cleanup;
|
||||
}
|
||||
EC_FillParams(arena, &ecEncodedParams, &ecParams);
|
||||
|
||||
if (kat->our_pubhex) {
|
||||
SECU_HexString2SECItem(arena, &answer, kat->our_pubhex);
|
||||
|
|
@ -162,6 +154,7 @@ ectest_ecdh_kat(ECDH_KAT *kat)
|
|||
}
|
||||
|
||||
cleanup:
|
||||
SECITEM_FreeItem(&ecEncodedParams, PR_FALSE);
|
||||
PORT_FreeArena(arena, PR_FALSE);
|
||||
if (ecPriv) {
|
||||
PORT_FreeArena(ecPriv->ecParams.arena, PR_FALSE);
|
||||
|
|
|
|||
|
|
@ -25,7 +25,6 @@
|
|||
#endif
|
||||
|
||||
#include "secoid.h"
|
||||
#include "sslt.h"
|
||||
|
||||
extern long DER_GetInteger(const SECItem *src);
|
||||
|
||||
|
|
@ -733,97 +732,135 @@ SECU_SECItemHexStringToBinary(SECItem *srcdest)
|
|||
return SECSuccess;
|
||||
}
|
||||
|
||||
SSLNamedGroup
|
||||
groupNameToNamedGroup(char *name)
|
||||
SECItem *
|
||||
SECU_HexString2SECItem(PLArenaPool *arena, SECItem *item, const char *str)
|
||||
{
|
||||
if (PL_strlen(name) == 4) {
|
||||
if (!strncmp(name, "P256", 4)) {
|
||||
return ssl_grp_ec_secp256r1;
|
||||
}
|
||||
if (!strncmp(name, "P384", 4)) {
|
||||
return ssl_grp_ec_secp384r1;
|
||||
}
|
||||
if (!strncmp(name, "P521", 4)) {
|
||||
return ssl_grp_ec_secp521r1;
|
||||
}
|
||||
}
|
||||
if (PL_strlen(name) == 6) {
|
||||
if (!strncmp(name, "x25519", 6)) {
|
||||
return ssl_grp_ec_curve25519;
|
||||
}
|
||||
if (!strncmp(name, "FF2048", 6)) {
|
||||
return ssl_grp_ffdhe_2048;
|
||||
}
|
||||
if (!strncmp(name, "FF3072", 6)) {
|
||||
return ssl_grp_ffdhe_3072;
|
||||
}
|
||||
if (!strncmp(name, "FF4096", 6)) {
|
||||
return ssl_grp_ffdhe_4096;
|
||||
}
|
||||
if (!strncmp(name, "FF6144", 6)) {
|
||||
return ssl_grp_ffdhe_6144;
|
||||
}
|
||||
if (!strncmp(name, "FF8192", 6)) {
|
||||
return ssl_grp_ffdhe_8192;
|
||||
}
|
||||
int i = 0;
|
||||
int byteval = 0;
|
||||
int tmp = PORT_Strlen(str);
|
||||
|
||||
PORT_Assert(arena);
|
||||
PORT_Assert(item);
|
||||
|
||||
if ((tmp % 2) != 0) {
|
||||
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return ssl_grp_none;
|
||||
item = SECITEM_AllocItem(arena, item, tmp / 2);
|
||||
if (item == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
while (str[i]) {
|
||||
if ((str[i] >= '0') && (str[i] <= '9')) {
|
||||
tmp = str[i] - '0';
|
||||
} else if ((str[i] >= 'a') && (str[i] <= 'f')) {
|
||||
tmp = str[i] - 'a' + 10;
|
||||
} else if ((str[i] >= 'A') && (str[i] <= 'F')) {
|
||||
tmp = str[i] - 'A' + 10;
|
||||
} else {
|
||||
/* item is in arena and gets freed by the caller */
|
||||
return NULL;
|
||||
}
|
||||
|
||||
byteval = byteval * 16 + tmp;
|
||||
if ((i % 2) != 0) {
|
||||
item->data[i / 2] = byteval;
|
||||
byteval = 0;
|
||||
}
|
||||
i++;
|
||||
}
|
||||
|
||||
return item;
|
||||
}
|
||||
|
||||
/* mapping between ECCurveName enum and SECOidTags */
|
||||
static SECOidTag ecCurve_oid_map[] = {
|
||||
SEC_OID_UNKNOWN, /* ECCurve_noName */
|
||||
SEC_OID_ANSIX962_EC_PRIME192V1, /* ECCurve_NIST_P192 */
|
||||
SEC_OID_SECG_EC_SECP224R1, /* ECCurve_NIST_P224 */
|
||||
SEC_OID_ANSIX962_EC_PRIME256V1, /* ECCurve_NIST_P256 */
|
||||
SEC_OID_SECG_EC_SECP384R1, /* ECCurve_NIST_P384 */
|
||||
SEC_OID_SECG_EC_SECP521R1, /* ECCurve_NIST_P521 */
|
||||
SEC_OID_SECG_EC_SECT163K1, /* ECCurve_NIST_K163 */
|
||||
SEC_OID_SECG_EC_SECT163R1, /* ECCurve_NIST_B163 */
|
||||
SEC_OID_SECG_EC_SECT233K1, /* ECCurve_NIST_K233 */
|
||||
SEC_OID_SECG_EC_SECT233R1, /* ECCurve_NIST_B233 */
|
||||
SEC_OID_SECG_EC_SECT283K1, /* ECCurve_NIST_K283 */
|
||||
SEC_OID_SECG_EC_SECT283R1, /* ECCurve_NIST_B283 */
|
||||
SEC_OID_SECG_EC_SECT409K1, /* ECCurve_NIST_K409 */
|
||||
SEC_OID_SECG_EC_SECT409R1, /* ECCurve_NIST_B409 */
|
||||
SEC_OID_SECG_EC_SECT571K1, /* ECCurve_NIST_K571 */
|
||||
SEC_OID_SECG_EC_SECT571R1, /* ECCurve_NIST_B571 */
|
||||
SEC_OID_ANSIX962_EC_PRIME192V2,
|
||||
SEC_OID_ANSIX962_EC_PRIME192V3,
|
||||
SEC_OID_ANSIX962_EC_PRIME239V1,
|
||||
SEC_OID_ANSIX962_EC_PRIME239V2,
|
||||
SEC_OID_ANSIX962_EC_PRIME239V3,
|
||||
SEC_OID_ANSIX962_EC_C2PNB163V1,
|
||||
SEC_OID_ANSIX962_EC_C2PNB163V2,
|
||||
SEC_OID_ANSIX962_EC_C2PNB163V3,
|
||||
SEC_OID_ANSIX962_EC_C2PNB176V1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB191V1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB191V2,
|
||||
SEC_OID_ANSIX962_EC_C2TNB191V3,
|
||||
SEC_OID_ANSIX962_EC_C2PNB208W1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB239V1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB239V2,
|
||||
SEC_OID_ANSIX962_EC_C2TNB239V3,
|
||||
SEC_OID_ANSIX962_EC_C2PNB272W1,
|
||||
SEC_OID_ANSIX962_EC_C2PNB304W1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB359V1,
|
||||
SEC_OID_ANSIX962_EC_C2PNB368W1,
|
||||
SEC_OID_ANSIX962_EC_C2TNB431R1,
|
||||
SEC_OID_SECG_EC_SECP112R1,
|
||||
SEC_OID_SECG_EC_SECP112R2,
|
||||
SEC_OID_SECG_EC_SECP128R1,
|
||||
SEC_OID_SECG_EC_SECP128R2,
|
||||
SEC_OID_SECG_EC_SECP160K1,
|
||||
SEC_OID_SECG_EC_SECP160R1,
|
||||
SEC_OID_SECG_EC_SECP160R2,
|
||||
SEC_OID_SECG_EC_SECP192K1,
|
||||
SEC_OID_SECG_EC_SECP224K1,
|
||||
SEC_OID_SECG_EC_SECP256K1,
|
||||
SEC_OID_SECG_EC_SECT113R1,
|
||||
SEC_OID_SECG_EC_SECT113R2,
|
||||
SEC_OID_SECG_EC_SECT131R1,
|
||||
SEC_OID_SECG_EC_SECT131R2,
|
||||
SEC_OID_SECG_EC_SECT163R1,
|
||||
SEC_OID_SECG_EC_SECT193R1,
|
||||
SEC_OID_SECG_EC_SECT193R2,
|
||||
SEC_OID_SECG_EC_SECT239K1,
|
||||
SEC_OID_UNKNOWN, /* ECCurve_WTLS_1 */
|
||||
SEC_OID_UNKNOWN, /* ECCurve_WTLS_8 */
|
||||
SEC_OID_UNKNOWN, /* ECCurve_WTLS_9 */
|
||||
SEC_OID_CURVE25519,
|
||||
SEC_OID_UNKNOWN /* ECCurve_pastLastCurve */
|
||||
};
|
||||
|
||||
SECStatus
|
||||
parseGroupList(const char *arg, SSLNamedGroup **enabledGroups,
|
||||
unsigned int *enabledGroupsCount)
|
||||
SECU_ecName2params(ECCurveName curve, SECItem *params)
|
||||
{
|
||||
SSLNamedGroup *groups;
|
||||
char *str;
|
||||
char *p;
|
||||
unsigned int numValues = 0;
|
||||
unsigned int count = 0;
|
||||
SECOidData *oidData = NULL;
|
||||
|
||||
/* Count the number of groups. */
|
||||
str = PORT_Strdup(arg);
|
||||
if (!str) {
|
||||
return SECFailure;
|
||||
}
|
||||
p = strtok(str, ",");
|
||||
while (p) {
|
||||
++numValues;
|
||||
p = strtok(NULL, ",");
|
||||
}
|
||||
PORT_Free(str);
|
||||
str = NULL;
|
||||
groups = PORT_ZNewArray(SSLNamedGroup, numValues);
|
||||
if (!groups) {
|
||||
goto done;
|
||||
}
|
||||
|
||||
/* Get group names. */
|
||||
str = PORT_Strdup(arg);
|
||||
if (!str) {
|
||||
goto done;
|
||||
}
|
||||
p = strtok(str, ",");
|
||||
while (p) {
|
||||
SSLNamedGroup group = groupNameToNamedGroup(p);
|
||||
if (group == ssl_grp_none) {
|
||||
count = 0;
|
||||
goto done;
|
||||
}
|
||||
groups[count++] = group;
|
||||
p = strtok(NULL, ",");
|
||||
}
|
||||
|
||||
done:
|
||||
if (str) {
|
||||
PORT_Free(str);
|
||||
}
|
||||
if (!count) {
|
||||
PORT_Free(groups);
|
||||
if ((curve < ECCurve_noName) || (curve > ECCurve_pastLastCurve) ||
|
||||
((oidData = SECOID_FindOIDByTag(ecCurve_oid_map[curve])) == NULL)) {
|
||||
PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
*enabledGroupsCount = count;
|
||||
*enabledGroups = groups;
|
||||
if (SECITEM_AllocItem(NULL, params, (2 + oidData->oid.len)) == NULL) {
|
||||
return SECFailure;
|
||||
}
|
||||
/*
|
||||
* params->data needs to contain the ASN encoding of an object ID (OID)
|
||||
* representing the named curve. The actual OID is in
|
||||
* oidData->oid.data so we simply prepend 0x06 and OID length
|
||||
*/
|
||||
params->data[0] = SEC_ASN1_OBJECT_ID;
|
||||
params->data[1] = oidData->oid.len;
|
||||
memcpy(params->data + 2, oidData->oid.data, oidData->oid.len);
|
||||
|
||||
return SECSuccess;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@
|
|||
#include "base64.h"
|
||||
#include "secasn1.h"
|
||||
#include "secder.h"
|
||||
#include "sslt.h"
|
||||
#include "ecl-exp.h"
|
||||
#include <stdio.h>
|
||||
|
||||
#ifdef SECUTIL_NEW
|
||||
|
|
@ -81,6 +81,14 @@ SECU_SECItemToHex(const SECItem *item, char *dst);
|
|||
SECStatus
|
||||
SECU_SECItemHexStringToBinary(SECItem *srcdest);
|
||||
|
||||
/*
|
||||
** Read a hex string into a SecItem.
|
||||
*/
|
||||
extern SECItem *SECU_HexString2SECItem(PLArenaPool *arena, SECItem *item,
|
||||
const char *str);
|
||||
|
||||
extern SECStatus SECU_ecName2params(ECCurveName curve, SECItem *params);
|
||||
|
||||
/*
|
||||
*
|
||||
* Utilities for parsing security tools command lines
|
||||
|
|
@ -113,10 +121,6 @@ SECU_ParseCommandLine(int argc, char **argv, char *progName,
|
|||
char *
|
||||
SECU_GetOptionArg(const secuCommand *cmd, int optionNum);
|
||||
|
||||
SECStatus parseGroupList(const char *arg, SSLNamedGroup **enabledGroups,
|
||||
unsigned int *enabledGroupsCount);
|
||||
SSLNamedGroup groupNameToNamedGroup(char *name);
|
||||
|
||||
/*
|
||||
*
|
||||
* Error messaging
|
||||
|
|
|
|||
|
|
@ -32,7 +32,7 @@
|
|||
#include "certt.h"
|
||||
#include "certdb.h"
|
||||
|
||||
/* #include "secmod.h" */
|
||||
#include "secmod.h"
|
||||
#include "pk11func.h"
|
||||
#include "secoid.h"
|
||||
|
||||
|
|
@ -3229,6 +3229,10 @@ SEC_PrintCertificateAndTrust(CERTCertificate *cert,
|
|||
SECStatus rv;
|
||||
SECItem data;
|
||||
CERTCertTrust certTrust;
|
||||
PK11SlotList *slotList;
|
||||
PRBool falseAttributeFound = PR_FALSE;
|
||||
PRBool trueAttributeFound = PR_FALSE;
|
||||
const char *moz_policy_ca_info = NULL;
|
||||
|
||||
data.data = cert->derCert.data;
|
||||
data.len = cert->derCert.len;
|
||||
|
|
@ -3238,6 +3242,35 @@ SEC_PrintCertificateAndTrust(CERTCertificate *cert,
|
|||
if (rv) {
|
||||
return (SECFailure);
|
||||
}
|
||||
|
||||
slotList = PK11_GetAllSlotsForCert(cert, NULL);
|
||||
if (slotList) {
|
||||
PK11SlotListElement *se = PK11_GetFirstSafe(slotList);
|
||||
for (; se; se = PK11_GetNextSafe(slotList, se, PR_FALSE)) {
|
||||
CK_OBJECT_HANDLE handle = PK11_FindCertInSlot(se->slot, cert, NULL);
|
||||
if (handle != CK_INVALID_HANDLE) {
|
||||
PORT_SetError(0);
|
||||
if (PK11_HasAttributeSet(se->slot, handle,
|
||||
CKA_NSS_MOZILLA_CA_POLICY, PR_FALSE)) {
|
||||
trueAttributeFound = PR_TRUE;
|
||||
} else if (!PORT_GetError()) {
|
||||
falseAttributeFound = PR_TRUE;
|
||||
}
|
||||
}
|
||||
}
|
||||
PK11_FreeSlotList(slotList);
|
||||
}
|
||||
|
||||
if (trueAttributeFound) {
|
||||
moz_policy_ca_info = "true (attribute present)";
|
||||
} else if (falseAttributeFound) {
|
||||
moz_policy_ca_info = "false (attribute present)";
|
||||
} else {
|
||||
moz_policy_ca_info = "false (attribute missing)";
|
||||
}
|
||||
SECU_Indent(stdout, 1);
|
||||
printf("Mozilla-CA-Policy: %s\n", moz_policy_ca_info);
|
||||
|
||||
if (trust) {
|
||||
SECU_PrintTrustFlags(stdout, trust,
|
||||
"Certificate Trust Flags", 1);
|
||||
|
|
@ -3833,45 +3866,97 @@ SECU_ParseSSLVersionRangeString(const char *input,
|
|||
return SECSuccess;
|
||||
}
|
||||
|
||||
SECItem *
|
||||
SECU_HexString2SECItem(PLArenaPool *arena, SECItem *item, const char *str)
|
||||
SSLNamedGroup
|
||||
groupNameToNamedGroup(char *name)
|
||||
{
|
||||
int i = 0;
|
||||
int byteval = 0;
|
||||
int tmp = PORT_Strlen(str);
|
||||
|
||||
PORT_Assert(arena);
|
||||
PORT_Assert(item);
|
||||
|
||||
if ((tmp % 2) != 0) {
|
||||
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
item = SECITEM_AllocItem(arena, item, tmp / 2);
|
||||
if (item == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
while (str[i]) {
|
||||
if ((str[i] >= '0') && (str[i] <= '9')) {
|
||||
tmp = str[i] - '0';
|
||||
} else if ((str[i] >= 'a') && (str[i] <= 'f')) {
|
||||
tmp = str[i] - 'a' + 10;
|
||||
} else if ((str[i] >= 'A') && (str[i] <= 'F')) {
|
||||
tmp = str[i] - 'A' + 10;
|
||||
} else {
|
||||
/* item is in arena and gets freed by the caller */
|
||||
return NULL;
|
||||
if (PL_strlen(name) == 4) {
|
||||
if (!strncmp(name, "P256", 4)) {
|
||||
return ssl_grp_ec_secp256r1;
|
||||
}
|
||||
|
||||
byteval = byteval * 16 + tmp;
|
||||
if ((i % 2) != 0) {
|
||||
item->data[i / 2] = byteval;
|
||||
byteval = 0;
|
||||
if (!strncmp(name, "P384", 4)) {
|
||||
return ssl_grp_ec_secp384r1;
|
||||
}
|
||||
if (!strncmp(name, "P521", 4)) {
|
||||
return ssl_grp_ec_secp521r1;
|
||||
}
|
||||
}
|
||||
if (PL_strlen(name) == 6) {
|
||||
if (!strncmp(name, "x25519", 6)) {
|
||||
return ssl_grp_ec_curve25519;
|
||||
}
|
||||
if (!strncmp(name, "FF2048", 6)) {
|
||||
return ssl_grp_ffdhe_2048;
|
||||
}
|
||||
if (!strncmp(name, "FF3072", 6)) {
|
||||
return ssl_grp_ffdhe_3072;
|
||||
}
|
||||
if (!strncmp(name, "FF4096", 6)) {
|
||||
return ssl_grp_ffdhe_4096;
|
||||
}
|
||||
if (!strncmp(name, "FF6144", 6)) {
|
||||
return ssl_grp_ffdhe_6144;
|
||||
}
|
||||
if (!strncmp(name, "FF8192", 6)) {
|
||||
return ssl_grp_ffdhe_8192;
|
||||
}
|
||||
i++;
|
||||
}
|
||||
|
||||
return item;
|
||||
return ssl_grp_none;
|
||||
}
|
||||
|
||||
SECStatus
|
||||
parseGroupList(const char *arg, SSLNamedGroup **enabledGroups,
|
||||
unsigned int *enabledGroupsCount)
|
||||
{
|
||||
SSLNamedGroup *groups;
|
||||
char *str;
|
||||
char *p;
|
||||
unsigned int numValues = 0;
|
||||
unsigned int count = 0;
|
||||
|
||||
/* Count the number of groups. */
|
||||
str = PORT_Strdup(arg);
|
||||
if (!str) {
|
||||
return SECFailure;
|
||||
}
|
||||
p = strtok(str, ",");
|
||||
while (p) {
|
||||
++numValues;
|
||||
p = strtok(NULL, ",");
|
||||
}
|
||||
PORT_Free(str);
|
||||
str = NULL;
|
||||
groups = PORT_ZNewArray(SSLNamedGroup, numValues);
|
||||
if (!groups) {
|
||||
goto done;
|
||||
}
|
||||
|
||||
/* Get group names. */
|
||||
str = PORT_Strdup(arg);
|
||||
if (!str) {
|
||||
goto done;
|
||||
}
|
||||
p = strtok(str, ",");
|
||||
while (p) {
|
||||
SSLNamedGroup group = groupNameToNamedGroup(p);
|
||||
if (group == ssl_grp_none) {
|
||||
count = 0;
|
||||
goto done;
|
||||
}
|
||||
groups[count++] = group;
|
||||
p = strtok(NULL, ",");
|
||||
}
|
||||
|
||||
done:
|
||||
if (str) {
|
||||
PORT_Free(str);
|
||||
}
|
||||
if (!count) {
|
||||
PORT_Free(groups);
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
*enabledGroupsCount = count;
|
||||
*enabledGroups = groups;
|
||||
return SECSuccess;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -18,6 +18,7 @@
|
|||
#include "basicutil.h"
|
||||
#include "sslerr.h"
|
||||
#include "sslt.h"
|
||||
#include "blapi.h"
|
||||
|
||||
#define SEC_CT_PRIVATE_KEY "private-key"
|
||||
#define SEC_CT_PUBLIC_KEY "public-key"
|
||||
|
|
@ -402,11 +403,10 @@ SECStatus
|
|||
SECU_ParseSSLVersionRangeString(const char *input,
|
||||
const SSLVersionRange defaultVersionRange,
|
||||
SSLVersionRange *vrange);
|
||||
/*
|
||||
** Read a hex string into a SecItem.
|
||||
*/
|
||||
extern SECItem *SECU_HexString2SECItem(PLArenaPool *arena, SECItem *item,
|
||||
const char *str);
|
||||
|
||||
SECStatus parseGroupList(const char *arg, SSLNamedGroup **enabledGroups,
|
||||
unsigned int *enabledGroupsCount);
|
||||
SSLNamedGroup groupNameToNamedGroup(char *name);
|
||||
|
||||
/*
|
||||
*
|
||||
|
|
|
|||
|
|
@ -22,3 +22,4 @@ CSRCS = \
|
|||
lowhashtest.c \
|
||||
$(NULL)
|
||||
|
||||
USE_STATIC_LIBS = 1
|
||||
|
|
|
|||
|
|
@ -397,6 +397,7 @@ static void
|
|||
printModule(SECMODModule *module, int *count)
|
||||
{
|
||||
int slotCount = module->loaded ? module->slotCount : 0;
|
||||
char *modUri;
|
||||
int i;
|
||||
|
||||
if ((*count)++) {
|
||||
|
|
@ -408,6 +409,11 @@ printModule(SECMODModule *module, int *count)
|
|||
PR_fprintf(PR_STDOUT, "\tlibrary name: %s\n", module->dllName);
|
||||
}
|
||||
|
||||
modUri = PK11_GetModuleURI(module);
|
||||
if (modUri) {
|
||||
PR_fprintf(PR_STDOUT, "\t uri: %s\n", modUri);
|
||||
PORT_Free(modUri);
|
||||
}
|
||||
if (slotCount == 0) {
|
||||
PR_fprintf(PR_STDOUT,
|
||||
"\t slots: There are no slots attached to this module\n");
|
||||
|
|
@ -425,10 +431,12 @@ printModule(SECMODModule *module, int *count)
|
|||
/* Print slot and token names */
|
||||
for (i = 0; i < slotCount; i++) {
|
||||
PK11SlotInfo *slot = module->slots[i];
|
||||
|
||||
char *tokenUri = PK11_GetTokenURI(slot);
|
||||
PR_fprintf(PR_STDOUT, "\n");
|
||||
PR_fprintf(PR_STDOUT, "\t slot: %s\n", PK11_GetSlotName(slot));
|
||||
PR_fprintf(PR_STDOUT, "\ttoken: %s\n", PK11_GetTokenName(slot));
|
||||
PR_fprintf(PR_STDOUT, "\t uri: %s\n", tokenUri);
|
||||
PORT_Free(tokenUri);
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
|
@ -494,7 +502,7 @@ static char *disableReasonStr[] = {
|
|||
"could not verify token",
|
||||
"token not present"
|
||||
};
|
||||
static int numDisableReasonStr =
|
||||
static size_t numDisableReasonStr =
|
||||
sizeof(disableReasonStr) / sizeof(disableReasonStr[0]);
|
||||
|
||||
/***********************************************************************
|
||||
|
|
@ -513,7 +521,7 @@ ListModule(char *moduleName)
|
|||
CK_SLOT_INFO slotinfo;
|
||||
CK_TOKEN_INFO tokeninfo;
|
||||
char *ciphers, *mechanisms;
|
||||
PK11DisableReasons reason;
|
||||
size_t reasonIdx;
|
||||
Error rv = SUCCESS;
|
||||
|
||||
if (!moduleName) {
|
||||
|
|
@ -604,10 +612,10 @@ ListModule(char *moduleName)
|
|||
PR_fprintf(PR_STDOUT, PAD "Firmware Version: %d.%d\n",
|
||||
slotinfo.firmwareVersion.major, slotinfo.firmwareVersion.minor);
|
||||
if (PK11_IsDisabled(slot)) {
|
||||
reason = PK11_GetDisabledReason(slot);
|
||||
if (reason < numDisableReasonStr) {
|
||||
reasonIdx = PK11_GetDisabledReason(slot);
|
||||
if (reasonIdx < numDisableReasonStr) {
|
||||
PR_fprintf(PR_STDOUT, PAD "Status: DISABLED (%s)\n",
|
||||
disableReasonStr[reason]);
|
||||
disableReasonStr[reasonIdx]);
|
||||
} else {
|
||||
PR_fprintf(PR_STDOUT, PAD "Status: DISABLED\n");
|
||||
}
|
||||
|
|
|
|||
|
|
@ -14,7 +14,16 @@
|
|||
'mpi-test.c',
|
||||
],
|
||||
'dependencies': [
|
||||
'<(DEPTH)/lib/freebl/freebl.gyp:<(freebl_name)',
|
||||
'<(DEPTH)/exports.gyp:nss_exports',
|
||||
'<(DEPTH)/lib/util/util.gyp:nssutil3',
|
||||
'<(DEPTH)/lib/nss/nss.gyp:nss_static',
|
||||
'<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap_static',
|
||||
'<(DEPTH)/lib/cryptohi/cryptohi.gyp:cryptohi',
|
||||
'<(DEPTH)/lib/certhigh/certhigh.gyp:certhi',
|
||||
'<(DEPTH)/lib/certdb/certdb.gyp:certdb',
|
||||
'<(DEPTH)/lib/base/base.gyp:nssb',
|
||||
'<(DEPTH)/lib/dev/dev.gyp:nssdev',
|
||||
'<(DEPTH)/lib/pki/pki.gyp:nsspki',
|
||||
]
|
||||
}
|
||||
],
|
||||
|
|
@ -22,7 +31,18 @@
|
|||
'include_dirs': [
|
||||
'<(DEPTH)/lib/freebl/mpi',
|
||||
'<(DEPTH)/lib/util',
|
||||
]
|
||||
],
|
||||
# This uses test builds and has to set defines for MPI.
|
||||
'conditions': [
|
||||
[ 'target_arch=="ia32"', {
|
||||
'defines': [
|
||||
'MP_USE_UINT_DIGIT',
|
||||
'MP_ASSEMBLY_MULTIPLY',
|
||||
'MP_ASSEMBLY_SQUARE',
|
||||
'MP_ASSEMBLY_DIV_2DX1D',
|
||||
],
|
||||
}],
|
||||
],
|
||||
},
|
||||
'variables': {
|
||||
'module': 'nss'
|
||||
|
|
|
|||
|
|
@ -615,11 +615,7 @@ P12U_ExportPKCS12Object(char *nn, char *outfile, PK11SlotInfo *inSlot,
|
|||
}
|
||||
|
||||
if (certlist) {
|
||||
CERTCertificate *cert = NULL;
|
||||
node = CERT_LIST_HEAD(certlist);
|
||||
if (node) {
|
||||
cert = node->cert;
|
||||
}
|
||||
CERTCertificate *cert = CERT_LIST_HEAD(certlist)->cert;
|
||||
if (cert) {
|
||||
slot = cert->slot; /* use the slot from the first matching
|
||||
certificate to create the context . This is for keygen */
|
||||
|
|
@ -861,6 +857,9 @@ p12u_EnableAllCiphers()
|
|||
SEC_PKCS12EnableCipher(PKCS12_RC2_CBC_128, 1);
|
||||
SEC_PKCS12EnableCipher(PKCS12_DES_56, 1);
|
||||
SEC_PKCS12EnableCipher(PKCS12_DES_EDE3_168, 1);
|
||||
SEC_PKCS12EnableCipher(PKCS12_AES_CBC_128, 1);
|
||||
SEC_PKCS12EnableCipher(PKCS12_AES_CBC_192, 1);
|
||||
SEC_PKCS12EnableCipher(PKCS12_AES_CBC_256, 1);
|
||||
SEC_PKCS12SetPreferredCipher(PKCS12_DES_EDE3_168, 1);
|
||||
}
|
||||
|
||||
|
|
@ -1059,7 +1058,7 @@ main(int argc, char **argv)
|
|||
certCipher = PKCS12U_MapCipherFromString(cipherString, certKeyLen);
|
||||
/* If the user requested a cipher and we didn't find it, then
|
||||
* don't just silently not encrypt. */
|
||||
if (cipher == SEC_OID_UNKNOWN) {
|
||||
if (certCipher == SEC_OID_UNKNOWN) {
|
||||
PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
|
||||
SECU_PrintError(progName, "Algorithm: \"%s\"", cipherString);
|
||||
pk12uErrno = PK12UERR_INVALIDALGORITHM;
|
||||
|
|
|
|||
|
|
@ -32,9 +32,8 @@
|
|||
'<(DEPTH)/lib/dev/dev.gyp:nssdev',
|
||||
'<(DEPTH)/lib/base/base.gyp:nssb',
|
||||
'<(DEPTH)/lib/freebl/freebl.gyp:freebl',
|
||||
'<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap',
|
||||
'<(DEPTH)/lib/certhigh/certhigh.gyp:certhi',
|
||||
'<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3',
|
||||
'<(DEPTH)/lib/libpkix/libpkix.gyp:libpkix',
|
||||
],
|
||||
'conditions': [
|
||||
[ 'disable_dbm==0', {
|
||||
|
|
@ -43,21 +42,6 @@
|
|||
'<(DEPTH)/lib/softoken/legacydb/legacydb.gyp:nssdbm',
|
||||
],
|
||||
}],
|
||||
[ 'disable_libpkix==0', {
|
||||
'dependencies': [
|
||||
'<(DEPTH)/lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
|
||||
'<(DEPTH)/lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
|
||||
'<(DEPTH)/lib/libpkix/pkix/params/params.gyp:pkixparams',
|
||||
'<(DEPTH)/lib/libpkix/pkix/results/results.gyp:pkixresults',
|
||||
'<(DEPTH)/lib/libpkix/pkix/top/top.gyp:pkixtop',
|
||||
'<(DEPTH)/lib/libpkix/pkix/util/util.gyp:pkixutil',
|
||||
'<(DEPTH)/lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
|
||||
'<(DEPTH)/lib/libpkix/pkix/store/store.gyp:pkixstore',
|
||||
'<(DEPTH)/lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
|
||||
'<(DEPTH)/lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
|
||||
'<(DEPTH)/lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule'
|
||||
],
|
||||
}],
|
||||
]},{ # !use_static_libs
|
||||
'conditions': [
|
||||
['moz_fold_libs==0', {
|
||||
|
|
|
|||
|
|
@ -32,6 +32,12 @@ else
|
|||
DBMLIB = $(DIST)/lib/$(LIB_PREFIX)dbm.$(LIB_SUFFIX)
|
||||
endif
|
||||
|
||||
ifeq ($(NSS_BUILD_UTIL_ONLY),1)
|
||||
SECTOOL_LIB = $(NULL)
|
||||
else
|
||||
SECTOOL_LIB = $(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX)
|
||||
endif
|
||||
|
||||
ifdef USE_STATIC_LIBS
|
||||
|
||||
DEFINES += -DNSS_USE_STATIC_LIBS
|
||||
|
|
@ -70,20 +76,10 @@ endif
|
|||
endif
|
||||
|
||||
NSS_LIBS_1=
|
||||
SECTOOL_LIB=
|
||||
NSS_LIBS_2=
|
||||
NSS_LIBS_3=
|
||||
NSS_LIBS_4=
|
||||
|
||||
ifneq ($(NSS_BUILD_UTIL_ONLY),1)
|
||||
SECTOOL_LIB = \
|
||||
$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
|
||||
$(NULL)
|
||||
else
|
||||
SECTOOL_LIB = \
|
||||
$(NULL)
|
||||
endif
|
||||
|
||||
ifneq ($(NSS_BUILD_SOFTOKEN_ONLY),1)
|
||||
ifeq ($(OS_ARCH), WINNT)
|
||||
# breakdown for windows
|
||||
|
|
@ -121,9 +117,6 @@ NSS_LIBS_1 = \
|
|||
$(DIST)/lib/$(LIB_PREFIX)ssl.$(LIB_SUFFIX) \
|
||||
$(DIST)/lib/$(LIB_PREFIX)nss.$(LIB_SUFFIX) \
|
||||
$(NULL)
|
||||
SECTOOL_LIB = \
|
||||
$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
|
||||
$(NULL)
|
||||
NSS_LIBS_2 = \
|
||||
$(DIST)/lib/$(LIB_PREFIX)pkcs12.$(LIB_SUFFIX) \
|
||||
$(DIST)/lib/$(LIB_PREFIX)pkcs7.$(LIB_SUFFIX) \
|
||||
|
|
@ -201,7 +194,7 @@ ifeq ($(OS_ARCH), WINNT)
|
|||
|
||||
# $(PROGRAM) has explicit dependencies on $(EXTRA_LIBS)
|
||||
EXTRA_LIBS += \
|
||||
$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
|
||||
$(SECTOOL_LIB) \
|
||||
$(NSSUTIL_LIB_DIR)/$(IMPORT_LIB_PREFIX)nssutil3$(IMPORT_LIB_SUFFIX) \
|
||||
$(DIST)/lib/$(IMPORT_LIB_PREFIX)smime3$(IMPORT_LIB_SUFFIX) \
|
||||
$(DIST)/lib/$(IMPORT_LIB_PREFIX)ssl3$(IMPORT_LIB_SUFFIX) \
|
||||
|
|
@ -220,7 +213,7 @@ else
|
|||
|
||||
# $(PROGRAM) has explicit dependencies on $(EXTRA_LIBS)
|
||||
EXTRA_LIBS += \
|
||||
$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
|
||||
$(SECTOOL_LIB) \
|
||||
$(NULL)
|
||||
|
||||
ifeq ($(OS_ARCH), AIX)
|
||||
|
|
@ -231,9 +224,6 @@ endif
|
|||
# $(EXTRA_SHARED_LIBS) come before $(OS_LIBS), except on AIX.
|
||||
EXTRA_SHARED_LIBS += \
|
||||
-L$(DIST)/lib \
|
||||
-lssl3 \
|
||||
-lsmime3 \
|
||||
-lnss3 \
|
||||
-L$(NSSUTIL_LIB_DIR) \
|
||||
-lnssutil3 \
|
||||
-L$(NSPR_LIB_DIR) \
|
||||
|
|
@ -241,6 +231,14 @@ EXTRA_SHARED_LIBS += \
|
|||
-lplds4 \
|
||||
-lnspr4 \
|
||||
$(NULL)
|
||||
ifndef NSS_BUILD_UTIL_ONLY
|
||||
ifndef NSS_BUILD_SOFTOKEN_ONLY
|
||||
EXTRA_SHARED_LIBS += \
|
||||
-lssl3 \
|
||||
-lsmime3 \
|
||||
-lnss3
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
|
||||
ifdef SOFTOKEN_LIB_DIR
|
||||
|
|
|
|||
|
|
@ -159,7 +159,7 @@ static void
|
|||
PrintUsageHeader(const char *progName)
|
||||
{
|
||||
fprintf(stderr,
|
||||
"Usage: %s -n rsa_nickname -p port [-BDENRbjlmrsuvx] [-w password]\n"
|
||||
"Usage: %s -n rsa_nickname -p port [-BDENRZbjlmrsuvx] [-w password]\n"
|
||||
" [-t threads] [-i pid_file] [-c ciphers] [-Y] [-d dbdir] [-g numblocks]\n"
|
||||
" [-f password_file] [-L [seconds]] [-M maxProcs] [-P dbprefix]\n"
|
||||
" [-V [min-version]:[max-version]] [-a sni_name]\n"
|
||||
|
|
@ -169,7 +169,8 @@ PrintUsageHeader(const char *progName)
|
|||
" [-e ec_nickname]"
|
||||
#endif /* NSS_DISABLE_ECC */
|
||||
"\n"
|
||||
" -U [0|1] -H [0|1|2] -W [0|1]\n",
|
||||
" -U [0|1] -H [0|1|2] -W [0|1]\n"
|
||||
"\n",
|
||||
progName);
|
||||
}
|
||||
|
||||
|
|
@ -219,7 +220,7 @@ PrintParameterUsage()
|
|||
"-A <ca> Nickname of a CA used to sign a stapled cert status\n"
|
||||
"-U override default ECDHE ephemeral key reuse, 0: refresh, 1: reuse\n"
|
||||
"-H override default DHE server support, 0: disable, 1: enable, "
|
||||
" 2: require DH named groups\n"
|
||||
" 2: require DH named groups [RFC7919]\n"
|
||||
"-W override default DHE server weak parameters support, 0: disable, 1: enable\n"
|
||||
"-c Restrict ciphers\n"
|
||||
"-Y prints cipher values allowed for parameter -c and exits\n"
|
||||
|
|
@ -227,7 +228,8 @@ PrintParameterUsage()
|
|||
"-Q enables ALPN for HTTP/1.1 [RFC7301]\n"
|
||||
"-I comma separated list of enabled groups for TLS key exchange.\n"
|
||||
" The following values are valid:\n"
|
||||
" P256, P384, P521, x25519, FF2048, FF3072, FF4096, FF6144, FF8192\n",
|
||||
" P256, P384, P521, x25519, FF2048, FF3072, FF4096, FF6144, FF8192\n"
|
||||
"-Z enable 0-RTT (for TLS 1.3; also use -u)\n",
|
||||
stderr);
|
||||
}
|
||||
|
||||
|
|
@ -2305,7 +2307,9 @@ main(int argc, char **argv)
|
|||
if (SECU_ParseSSLVersionRangeString(optstate->value,
|
||||
enabledVersions, &enabledVersions) !=
|
||||
SECSuccess) {
|
||||
fprintf(stderr, "Bad version specified.\n");
|
||||
Usage(progName);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
|
|
|
|||
|
|
@ -84,7 +84,7 @@ Usage(char *progName)
|
|||
" where id can be a certificate nickname or email address\n"
|
||||
" -S create a CMS signed data message\n"
|
||||
" -G include a signing time attribute\n"
|
||||
" -H hash use hash (default:SHA1)\n"
|
||||
" -H hash use hash (default:SHA256)\n"
|
||||
" -N nick use certificate named \"nick\" for signing\n"
|
||||
" -P include a SMIMECapabilities attribute\n"
|
||||
" -T do not include content in CMS message\n"
|
||||
|
|
@ -1097,7 +1097,7 @@ main(int argc, char **argv)
|
|||
signOptions.signingTime = PR_FALSE;
|
||||
signOptions.smimeProfile = PR_FALSE;
|
||||
signOptions.encryptionKeyPreferenceNick = NULL;
|
||||
signOptions.hashAlgTag = SEC_OID_SHA1;
|
||||
signOptions.hashAlgTag = SEC_OID_SHA256;
|
||||
envelopeOptions.recipients = NULL;
|
||||
encryptOptions.recipients = NULL;
|
||||
encryptOptions.envmsg = NULL;
|
||||
|
|
|
|||
|
|
@ -199,8 +199,8 @@ sub signentity($$)
|
|||
# construct a new multipart/signed MIME entity consisting of the original content and
|
||||
# the signature
|
||||
#
|
||||
# (we assume that cmsutil generates a SHA1 digest)
|
||||
$out .= "Content-Type: multipart/signed; protocol=\"application/pkcs7-signature\"; micalg=sha1; boundary=\"${boundary}\"\n";
|
||||
# (we assume that cmsutil generates a SHA256 digest)
|
||||
$out .= "Content-Type: multipart/signed; protocol=\"application/pkcs7-signature\"; micalg=sha256; boundary=\"${boundary}\"\n";
|
||||
$out .= "\n"; # end of entity header
|
||||
$out .= "This is a cryptographically signed message in MIME format.\n"; # explanatory comment
|
||||
$out .= "\n--${boundary}\n";
|
||||
|
|
|
|||
|
|
@ -1350,6 +1350,7 @@ main(int argc, char **argv)
|
|||
if (SECU_ParseSSLVersionRangeString(optstate->value,
|
||||
enabledVersions, &enabledVersions) !=
|
||||
SECSuccess) {
|
||||
fprintf(stderr, "Bad version specified.\n");
|
||||
Usage(progName);
|
||||
}
|
||||
break;
|
||||
|
|
|
|||
|
|
@ -233,6 +233,9 @@ BufToHex(SECItem *outbuf)
|
|||
unsigned int i;
|
||||
|
||||
string = PORT_Alloc(len);
|
||||
if (!string) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
ptr = string;
|
||||
for (i = 0; i < outbuf->len; i++) {
|
||||
|
|
|
|||
|
|
@ -169,20 +169,6 @@ printSecurityInfo(PRFileDesc *fd)
|
|||
}
|
||||
}
|
||||
|
||||
void
|
||||
handshakeCallback(PRFileDesc *fd, void *client_data)
|
||||
{
|
||||
const char *secondHandshakeName = (char *)client_data;
|
||||
if (secondHandshakeName) {
|
||||
SSL_SetURL(fd, secondHandshakeName);
|
||||
}
|
||||
printSecurityInfo(fd);
|
||||
if (renegotiationsDone < renegotiationsToDo) {
|
||||
SSL_ReHandshake(fd, (renegotiationsToDo < 2));
|
||||
++renegotiationsDone;
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
PrintUsageHeader(const char *progName)
|
||||
{
|
||||
|
|
@ -192,7 +178,8 @@ PrintUsageHeader(const char *progName)
|
|||
"[-n nickname] [-Bafosvx] [-c ciphers] [-Y] [-Z]\n"
|
||||
"[-V [min-version]:[max-version]] [-K] [-T] [-U]\n"
|
||||
"[-r N] [-w passwd] [-W pwfile] [-q [-t seconds]] [-I groups]\n"
|
||||
"[-A requestfile] [-L totalconnections]",
|
||||
"[-A requestfile] [-L totalconnections]\n"
|
||||
"\n",
|
||||
progName);
|
||||
}
|
||||
|
||||
|
|
@ -256,9 +243,7 @@ PrintParameterUsage(void)
|
|||
fprintf(stderr, "%-20s Enforce using an IPv6 destination address\n", "-6");
|
||||
fprintf(stderr, "%-20s (Options -4 and -6 cannot be combined.)\n", "");
|
||||
fprintf(stderr, "%-20s Enable the extended master secret extension [RFC7627]\n", "-G");
|
||||
fprintf(stderr, "%-20s Require the use of FFDHE supported groups "
|
||||
"[I-D.ietf-tls-negotiated-ff-dhe]\n",
|
||||
"-H");
|
||||
fprintf(stderr, "%-20s Require the use of FFDHE supported groups [RFC7919]\n", "-H");
|
||||
fprintf(stderr, "%-20s Read from a file instead of stdin\n", "-A");
|
||||
fprintf(stderr, "%-20s Allow 0-RTT data (TLS 1.3 only)\n", "-Z");
|
||||
fprintf(stderr, "%-20s Disconnect and reconnect up to N times total\n", "-L");
|
||||
|
|
@ -889,6 +874,10 @@ restartHandshakeAfterServerCertIfNeeded(PRFileDesc *fd,
|
|||
|
||||
if (SSL_AuthCertificateComplete(fd, error) != SECSuccess) {
|
||||
rv = SECFailure;
|
||||
} else {
|
||||
/* restore the original error code, which could be reset by
|
||||
* SSL_AuthCertificateComplete */
|
||||
PORT_SetError(error);
|
||||
}
|
||||
|
||||
return rv;
|
||||
|
|
@ -923,13 +912,19 @@ PRUint16 portno = 443;
|
|||
int override = 0;
|
||||
char *requestString = NULL;
|
||||
PRInt32 requestStringLen = 0;
|
||||
PRBool requestSent = PR_FALSE;
|
||||
PRBool enableZeroRtt = PR_FALSE;
|
||||
|
||||
static int
|
||||
writeBytesToServer(PRFileDesc *s, PRPollDesc *pollset, const char *buf, int nb)
|
||||
writeBytesToServer(PRFileDesc *s, const char *buf, int nb)
|
||||
{
|
||||
SECStatus rv;
|
||||
const char *bufp = buf;
|
||||
PRPollDesc pollDesc;
|
||||
|
||||
pollDesc.in_flags = PR_POLL_WRITE | PR_POLL_EXCEPT;
|
||||
pollDesc.out_flags = 0;
|
||||
pollDesc.fd = s;
|
||||
|
||||
FPRINTF(stderr, "%s: Writing %d bytes to server\n",
|
||||
progName, nb);
|
||||
|
|
@ -956,12 +951,12 @@ writeBytesToServer(PRFileDesc *s, PRPollDesc *pollset, const char *buf, int nb)
|
|||
return EXIT_CODE_HANDSHAKE_FAILED;
|
||||
}
|
||||
|
||||
pollset[SSOCK_FD].in_flags = PR_POLL_WRITE | PR_POLL_EXCEPT;
|
||||
pollset[SSOCK_FD].out_flags = 0;
|
||||
pollDesc.in_flags = PR_POLL_WRITE | PR_POLL_EXCEPT;
|
||||
pollDesc.out_flags = 0;
|
||||
FPRINTF(stderr,
|
||||
"%s: about to call PR_Poll on writable socket !\n",
|
||||
progName);
|
||||
cc = PR_Poll(pollset, 1, PR_INTERVAL_NO_TIMEOUT);
|
||||
cc = PR_Poll(&pollDesc, 1, PR_INTERVAL_NO_TIMEOUT);
|
||||
if (cc < 0) {
|
||||
SECU_PrintError(progName,
|
||||
"PR_Poll failed");
|
||||
|
|
@ -975,6 +970,36 @@ writeBytesToServer(PRFileDesc *s, PRPollDesc *pollset, const char *buf, int nb)
|
|||
return 0;
|
||||
}
|
||||
|
||||
void
|
||||
handshakeCallback(PRFileDesc *fd, void *client_data)
|
||||
{
|
||||
const char *secondHandshakeName = (char *)client_data;
|
||||
if (secondHandshakeName) {
|
||||
SSL_SetURL(fd, secondHandshakeName);
|
||||
}
|
||||
printSecurityInfo(fd);
|
||||
if (renegotiationsDone < renegotiationsToDo) {
|
||||
SSL_ReHandshake(fd, (renegotiationsToDo < 2));
|
||||
++renegotiationsDone;
|
||||
}
|
||||
if (requestString && requestSent) {
|
||||
/* This data was sent in 0-RTT. */
|
||||
SSLChannelInfo info;
|
||||
SECStatus rv;
|
||||
|
||||
rv = SSL_GetChannelInfo(fd, &info, sizeof(info));
|
||||
if (rv != SECSuccess)
|
||||
return;
|
||||
|
||||
if (!info.earlyDataAccepted) {
|
||||
FPRINTF(stderr, "Early data rejected. Re-sending\n");
|
||||
writeBytesToServer(fd, requestString, requestStringLen);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#define REQUEST_WAITING (requestString && !requestSent)
|
||||
|
||||
static int
|
||||
run_client(void)
|
||||
{
|
||||
|
|
@ -988,7 +1013,8 @@ run_client(void)
|
|||
PRFileDesc *std_out;
|
||||
PRPollDesc pollset[2];
|
||||
PRBool wrStarted = PR_FALSE;
|
||||
char *requestStringInt = requestString;
|
||||
|
||||
requestSent = PR_FALSE;
|
||||
|
||||
/* Create socket */
|
||||
s = PR_OpenTCPSocket(addr.raw.family);
|
||||
|
|
@ -1245,7 +1271,7 @@ run_client(void)
|
|||
pollset[SSOCK_FD].in_flags = PR_POLL_EXCEPT |
|
||||
(clientSpeaksFirst ? 0 : PR_POLL_READ);
|
||||
pollset[STDIN_FD].fd = PR_GetSpecialFD(PR_StandardInput);
|
||||
if (!requestStringInt) {
|
||||
if (!REQUEST_WAITING) {
|
||||
pollset[STDIN_FD].in_flags = PR_POLL_READ;
|
||||
npds = 2;
|
||||
} else {
|
||||
|
|
@ -1295,7 +1321,7 @@ run_client(void)
|
|||
*/
|
||||
FPRINTF(stderr, "%s: ready...\n", progName);
|
||||
while ((pollset[SSOCK_FD].in_flags | pollset[STDIN_FD].in_flags) ||
|
||||
requestStringInt) {
|
||||
REQUEST_WAITING) {
|
||||
char buf[4000]; /* buffer for stdin */
|
||||
int nb; /* num bytes read from stdin. */
|
||||
|
||||
|
|
@ -1333,13 +1359,12 @@ run_client(void)
|
|||
"%s: PR_Poll returned 0x%02x for socket out_flags.\n",
|
||||
progName, pollset[SSOCK_FD].out_flags);
|
||||
}
|
||||
if (requestStringInt) {
|
||||
error = writeBytesToServer(s, pollset,
|
||||
requestStringInt, requestStringLen);
|
||||
if (REQUEST_WAITING) {
|
||||
error = writeBytesToServer(s, requestString, requestStringLen);
|
||||
if (error) {
|
||||
goto done;
|
||||
}
|
||||
requestStringInt = NULL;
|
||||
requestSent = PR_TRUE;
|
||||
pollset[SSOCK_FD].in_flags = PR_POLL_READ;
|
||||
}
|
||||
if (pollset[STDIN_FD].out_flags & PR_POLL_READ) {
|
||||
|
|
@ -1356,7 +1381,7 @@ run_client(void)
|
|||
/* EOF on stdin, stop polling stdin for read. */
|
||||
pollset[STDIN_FD].in_flags = 0;
|
||||
} else {
|
||||
error = writeBytesToServer(s, pollset, buf, nb);
|
||||
error = writeBytesToServer(s, buf, nb);
|
||||
if (error) {
|
||||
goto done;
|
||||
}
|
||||
|
|
@ -1487,7 +1512,7 @@ main(int argc, char **argv)
|
|||
/* XXX: 'B' was used in the past but removed in 3.28,
|
||||
* please leave some time before resuing it. */
|
||||
optstate = PL_CreateOptState(argc, argv,
|
||||
"46A:CDFGHI:KL:M:OR:STUV:WYZa:bc:d:fgh:m:n:op:qr:st:uvw:z");
|
||||
"46A:CDFGHI:KL:M:OR:STUV:W:YZa:bc:d:fgh:m:n:op:qr:st:uvw:z");
|
||||
while ((optstatus = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
|
||||
switch (optstate->option) {
|
||||
case '?':
|
||||
|
|
@ -1588,6 +1613,7 @@ main(int argc, char **argv)
|
|||
if (SECU_ParseSSLVersionRangeString(optstate->value,
|
||||
enabledVersions, &enabledVersions) !=
|
||||
SECSuccess) {
|
||||
fprintf(stderr, "Bad version specified.\n");
|
||||
Usage(progName);
|
||||
}
|
||||
break;
|
||||
|
|
|
|||
|
|
@ -145,6 +145,3 @@ ifeq (3,$(SYS_SQLITE3_VERSION_MAJOR))
|
|||
NSS_USE_SYSTEM_SQLITE = 1
|
||||
endif
|
||||
endif
|
||||
|
||||
include $(CORE_DEPTH)/coreconf/sanitizers.mk
|
||||
DARWIN_SDK_SHLIBFLAGS += $(SANITIZER_LDFLAGS)
|
||||
|
|
|
|||
|
|
@ -106,16 +106,6 @@ ifneq ($(OS_TARGET),Android)
|
|||
LIBC_TAG = _glibc
|
||||
endif
|
||||
|
||||
ifeq ($(OS_RELEASE),2.0)
|
||||
OS_REL_CFLAGS += -DLINUX2_0
|
||||
MKSHLIB = $(CC) -shared -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so) $(RPATH)
|
||||
ifdef MAPFILE
|
||||
MKSHLIB += -Wl,--version-script,$(MAPFILE)
|
||||
endif
|
||||
PROCESS_MAP_FILE = grep -v ';-' $< | \
|
||||
sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
|
||||
endif
|
||||
|
||||
ifdef BUILD_OPT
|
||||
ifeq (11,$(ALLOW_OPT_CODE_SIZE)$(OPT_CODE_SIZE))
|
||||
OPTIMIZER = -Os
|
||||
|
|
@ -139,15 +129,16 @@ ifeq ($(USE_PTHREADS),1)
|
|||
OS_PTHREAD = -lpthread
|
||||
endif
|
||||
|
||||
OS_CFLAGS = $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR
|
||||
OS_CFLAGS = $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR
|
||||
ifeq ($(KERNEL),Linux)
|
||||
OS_CFLAGS += -DLINUX -Dlinux
|
||||
endif
|
||||
OS_LIBS = $(OS_PTHREAD) -ldl -lc
|
||||
|
||||
ifdef USE_PTHREADS
|
||||
DEFINES += -D_REENTRANT
|
||||
endif
|
||||
|
||||
ARCH = linux
|
||||
|
||||
DSO_CFLAGS = -fPIC
|
||||
DSO_LDOPTS = -shared $(ARCHFLAG) -Wl,--gc-sections
|
||||
# The linker on Red Hat Linux 7.2 and RHEL 2.1 (GNU ld version 2.11.90.0.8)
|
||||
|
|
@ -156,10 +147,8 @@ DSO_LDOPTS = -shared $(ARCHFLAG) -Wl,--gc-sections
|
|||
# Also, -z defs conflicts with Address Sanitizer, which emits relocations
|
||||
# against the libsanitizer runtime built into the main executable.
|
||||
ZDEFS_FLAG = -Wl,-z,defs
|
||||
ifneq ($(USE_ASAN),1)
|
||||
DSO_LDOPTS += $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG))
|
||||
endif
|
||||
LDFLAGS += $(ARCHFLAG)
|
||||
LDFLAGS += $(ARCHFLAG) -z noexecstack
|
||||
|
||||
# On Maemo, we need to use the -rpath-link flag for even the standard system
|
||||
# library directories.
|
||||
|
|
@ -167,7 +156,6 @@ ifdef _SBOX_DIR
|
|||
LDFLAGS += -Wl,-rpath-link,/usr/lib:/lib
|
||||
endif
|
||||
|
||||
# INCLUDES += -I/usr/include -Y/usr/include/linux
|
||||
G++INCLUDES = -I/usr/include/g++
|
||||
|
||||
#
|
||||
|
|
@ -202,7 +190,6 @@ RPATH = -Wl,-rpath,'$$ORIGIN:/opt/sun/private/lib'
|
|||
endif
|
||||
endif
|
||||
|
||||
OS_REL_CFLAGS += -DLINUX2_1
|
||||
MKSHLIB = $(CC) $(DSO_LDOPTS) -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so) $(RPATH)
|
||||
|
||||
ifdef MAPFILE
|
||||
|
|
@ -220,5 +207,3 @@ OS_CFLAGS += --coverage
|
|||
LDFLAGS += --coverage
|
||||
DSO_LDOPTS += --coverage
|
||||
endif
|
||||
|
||||
include $(CORE_DEPTH)/coreconf/sanitizers.mk
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@
|
|||
# OS_TARGET User defined, or set to OS_ARCH
|
||||
# CPU_ARCH (from unmame -m or -p, ONLY on WINNT)
|
||||
# OS_CONFIG OS_TARGET + OS_RELEASE
|
||||
# OBJDIR_TAG (uses ASAN_TAG, GCOV_TAG, 64BIT_TAG)
|
||||
# OBJDIR_TAG (uses GCOV_TAG, 64BIT_TAG)
|
||||
# OBJDIR_NAME
|
||||
#######################################################################
|
||||
|
||||
|
|
@ -115,6 +115,20 @@ ifeq ($(OS_ARCH),Linux)
|
|||
ifneq ($(words $(OS_RELEASE)),1)
|
||||
OS_RELEASE := $(word 1,$(OS_RELEASE)).$(word 2,$(OS_RELEASE))
|
||||
endif
|
||||
KERNEL = Linux
|
||||
endif
|
||||
|
||||
# Since all uses of OS_ARCH that follow affect only userland, we can
|
||||
# merge other Glibc systems with Linux here.
|
||||
ifeq ($(OS_ARCH),GNU)
|
||||
OS_ARCH = Linux
|
||||
OS_RELEASE = 2.6
|
||||
KERNEL = GNU
|
||||
endif
|
||||
ifeq ($(OS_ARCH),GNU_kFreeBSD)
|
||||
OS_ARCH = Linux
|
||||
OS_RELEASE = 2.6
|
||||
KERNEL = FreeBSD
|
||||
endif
|
||||
|
||||
#
|
||||
|
|
@ -254,11 +268,6 @@ OS_CONFIG = $(OS_TARGET)$(OS_RELEASE)
|
|||
# to distinguish between debug and release builds.
|
||||
#
|
||||
|
||||
ifeq ($(USE_ASAN), 1)
|
||||
ASAN_TAG = _ASAN
|
||||
else
|
||||
ASAN_TAG =
|
||||
endif
|
||||
ifeq ($(USE_GCOV), 1)
|
||||
GCOV_TAG = _GCOV
|
||||
else
|
||||
|
|
@ -269,7 +278,7 @@ ifeq ($(USE_64), 1)
|
|||
else
|
||||
64BIT_TAG =
|
||||
endif
|
||||
OBJDIR_TAG_BASE=$(ASAN_TAG)$(GCOV_TAG)$(64BIT_TAG)
|
||||
OBJDIR_TAG_BASE=$(GCOV_TAG)$(64BIT_TAG)
|
||||
|
||||
ifdef BUILD_OPT
|
||||
OBJDIR_TAG = $(OBJDIR_TAG_BASE)_OPT
|
||||
|
|
|
|||
|
|
@ -6,15 +6,16 @@ import sys
|
|||
|
||||
def main():
|
||||
if sys.platform == 'win32':
|
||||
print 0
|
||||
print(0)
|
||||
else:
|
||||
cc = os.environ.get('CC', 'cc')
|
||||
try:
|
||||
cc_is_clang = 'clang' in subprocess.check_output([cc, '--version'])
|
||||
cc_is_clang = 'clang' in subprocess.check_output(
|
||||
[cc, '--version'], universal_newlines=True)
|
||||
except OSError:
|
||||
# We probably just don't have CC/cc.
|
||||
cc_is_clang = False
|
||||
print int(cc_is_clang)
|
||||
print(int(cc_is_clang))
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
|
|
|||
|
|
@ -24,39 +24,44 @@
|
|||
# building on.
|
||||
'target_arch%': '<(host_arch)',
|
||||
}],
|
||||
['OS=="linux"', {
|
||||
# FIPS-140 LOWHASH
|
||||
'freebl_name': 'freeblpriv3',
|
||||
}, {
|
||||
'freebl_name': 'freebl3',
|
||||
}],
|
||||
['OS=="mac"', {
|
||||
'use_system_sqlite%': 1,
|
||||
},{
|
||||
'use_system_sqlite%': 0,
|
||||
}],
|
||||
['OS=="mac" or OS=="win"', {
|
||||
'cc_use_gnu_ld%': 0,
|
||||
}, {
|
||||
'cc_use_gnu_ld%': 1,
|
||||
}],
|
||||
['OS=="win"', {
|
||||
'use_system_zlib%': 0,
|
||||
'nspr_libs%': ['nspr4.lib', 'plc4.lib', 'plds4.lib'],
|
||||
'nspr_libs%': ['libnspr4.lib', 'libplc4.lib', 'libplds4.lib'],
|
||||
'zlib_libs%': [],
|
||||
#TODO
|
||||
'moz_debug_flags%': '',
|
||||
'dll_prefix': '',
|
||||
'dll_suffix': 'dll',
|
||||
}, {
|
||||
'nspr_libs%': ['-lplds4', '-lplc4', '-lnspr4'],
|
||||
'use_system_zlib%': 1,
|
||||
}],
|
||||
['OS=="linux" or OS=="android"', {
|
||||
'nspr_libs%': ['-lplds4', '-lplc4', '-lnspr4'],
|
||||
'zlib_libs%': ['-lz'],
|
||||
'moz_debug_flags%': '-gdwarf-2',
|
||||
'optimize_flags%': '-O2',
|
||||
'dll_prefix': 'lib',
|
||||
'dll_suffix': 'so',
|
||||
}],
|
||||
['OS=="linux"', {
|
||||
'freebl_name': 'freeblpriv3',
|
||||
}, {
|
||||
'freebl_name': 'freebl3',
|
||||
}],
|
||||
['OS=="mac"', {
|
||||
'zlib_libs%': ['-lz'],
|
||||
'use_system_sqlite%': 1,
|
||||
'moz_debug_flags%': '-gdwarf-2 -gfull',
|
||||
'optimize_flags%': '-O2',
|
||||
'dll_prefix': 'lib',
|
||||
'dll_suffix': 'dylib',
|
||||
}, {
|
||||
'use_system_sqlite%': 0,
|
||||
'conditions': [
|
||||
['OS=="mac"', {
|
||||
'moz_debug_flags%': '-gdwarf-2 -gfull',
|
||||
'dll_suffix': 'dylib',
|
||||
}, {
|
||||
'moz_debug_flags%': '-gdwarf-2',
|
||||
'dll_suffix': 'so',
|
||||
}],
|
||||
],
|
||||
}],
|
||||
['"<(GENERATOR)"=="ninja"', {
|
||||
'cc_is_clang%': '<!(<(python) <(DEPTH)/coreconf/check_cc_clang.py)',
|
||||
|
|
@ -81,6 +86,7 @@
|
|||
'dll_suffix': '<(dll_suffix)',
|
||||
'freebl_name': '<(freebl_name)',
|
||||
'cc_is_clang%': '<(cc_is_clang)',
|
||||
'cc_use_gnu_ld%': '<(cc_use_gnu_ld)',
|
||||
# Some defaults
|
||||
'disable_tests%': 0,
|
||||
'disable_chachapoly%': 0,
|
||||
|
|
@ -91,16 +97,18 @@
|
|||
'moz_fold_libs%': 0,
|
||||
'moz_folded_library_name%': '',
|
||||
'ssl_enable_zlib%': 1,
|
||||
'use_asan%': 0,
|
||||
'use_ubsan%': 0,
|
||||
'use_msan%': 0,
|
||||
'use_sancov%': 0,
|
||||
'sanitizer_flags%': 0,
|
||||
'test_build%': 0,
|
||||
'no_zdefs%': 0,
|
||||
'fuzz%': 0,
|
||||
'fuzz_tls%': 0,
|
||||
'fuzz_oss%': 0,
|
||||
'sign_libs%': 1,
|
||||
'use_pprof%': 0,
|
||||
'ct_verif%': 0,
|
||||
'nss_public_dist_dir%': '<(nss_dist_dir)/public',
|
||||
'nss_private_dist_dir%': '<(nss_dist_dir)/private',
|
||||
'only_dev_random%': 1,
|
||||
},
|
||||
'target_defaults': {
|
||||
# Settings specific to targets should go here.
|
||||
|
|
@ -108,6 +116,8 @@
|
|||
'variables': {
|
||||
'mapfile%': '',
|
||||
'test_build%': 0,
|
||||
'debug_optimization_level%': '0',
|
||||
'release_optimization_level%': '2',
|
||||
},
|
||||
'standalone_static_library': 0,
|
||||
'include_dirs': [
|
||||
|
|
@ -115,13 +125,68 @@
|
|||
'<(nss_dist_dir)/private/<(module)',
|
||||
],
|
||||
'conditions': [
|
||||
[ 'OS=="linux"', {
|
||||
[ 'OS!="android" and OS!="mac" and OS!="win"', {
|
||||
'libraries': [
|
||||
'-lpthread',
|
||||
],
|
||||
}],
|
||||
[ 'OS=="linux"', {
|
||||
'libraries': [
|
||||
'-ldl',
|
||||
'-lc',
|
||||
],
|
||||
}],
|
||||
[ 'fuzz==1', {
|
||||
'variables': {
|
||||
'debug_optimization_level%': '1',
|
||||
},
|
||||
}],
|
||||
[ 'target_arch=="ia32" or target_arch=="x64"', {
|
||||
'defines': [
|
||||
'NSS_X86_OR_X64',
|
||||
],
|
||||
# For Windows.
|
||||
'msvs_settings': {
|
||||
'VCCLCompilerTool': {
|
||||
'PreprocessorDefinitions': [
|
||||
'NSS_X86_OR_X64',
|
||||
],
|
||||
},
|
||||
},
|
||||
}],
|
||||
[ 'target_arch=="ia32"', {
|
||||
'defines': [
|
||||
'NSS_X86',
|
||||
],
|
||||
# For Windows.
|
||||
'msvs_settings': {
|
||||
'VCCLCompilerTool': {
|
||||
'PreprocessorDefinitions': [
|
||||
'NSS_X86',
|
||||
],
|
||||
},
|
||||
},
|
||||
}],
|
||||
[ 'target_arch=="arm64" or target_arch=="aarch64"', {
|
||||
'defines': [
|
||||
'NSS_USE_64',
|
||||
],
|
||||
}],
|
||||
[ 'target_arch=="x64"', {
|
||||
'defines': [
|
||||
'NSS_X64',
|
||||
'NSS_USE_64',
|
||||
],
|
||||
# For Windows.
|
||||
'msvs_settings': {
|
||||
'VCCLCompilerTool': {
|
||||
'PreprocessorDefinitions': [
|
||||
'NSS_X64',
|
||||
'NSS_USE_64',
|
||||
],
|
||||
},
|
||||
},
|
||||
}],
|
||||
],
|
||||
'target_conditions': [
|
||||
# If we want to properly export a static library, and copy it to lib,
|
||||
|
|
@ -135,7 +200,7 @@
|
|||
'product_dir': '<(nss_dist_obj_dir)/lib'
|
||||
}],
|
||||
# mapfile handling
|
||||
[ 'test_build==0 and mapfile!=""', {
|
||||
[ 'mapfile!=""', {
|
||||
# Work around a gyp bug. Fixed upstream but not in Ubuntu packages:
|
||||
# https://chromium.googlesource.com/external/gyp/+/b85ad3e578da830377dbc1843aa4fbc5af17a192%5E%21/
|
||||
'sources': [
|
||||
|
|
@ -148,12 +213,12 @@
|
|||
],
|
||||
},
|
||||
'conditions': [
|
||||
[ 'OS=="linux" or OS=="android"', {
|
||||
[ 'cc_use_gnu_ld==1', {
|
||||
'ldflags': [
|
||||
'-Wl,--version-script,<(INTERMEDIATE_DIR)/out.>(mapfile)',
|
||||
],
|
||||
}],
|
||||
[ 'OS=="win"', {
|
||||
[ 'cc_use_gnu_ld!=1 and OS=="win"', {
|
||||
# On Windows, .def files are used directly as sources.
|
||||
'sources': [
|
||||
'>(mapfile)',
|
||||
|
|
@ -195,10 +260,16 @@
|
|||
# Shared library specific settings.
|
||||
[ '_type=="shared_library"', {
|
||||
'conditions': [
|
||||
[ 'OS=="linux" or OS=="android"', {
|
||||
[ 'cc_use_gnu_ld==1', {
|
||||
'ldflags': [
|
||||
'-Wl,--gc-sections',
|
||||
'-Wl,-z,defs',
|
||||
],
|
||||
'conditions': [
|
||||
['no_zdefs==0', {
|
||||
'ldflags': [
|
||||
'-Wl,-z,defs',
|
||||
],
|
||||
}],
|
||||
],
|
||||
}],
|
||||
],
|
||||
|
|
@ -251,10 +322,36 @@
|
|||
'LINUX2_1',
|
||||
'LINUX',
|
||||
'linux',
|
||||
],
|
||||
}],
|
||||
[ 'OS=="dragonfly" or OS=="freebsd"', {
|
||||
'defines': [
|
||||
'FREEBSD',
|
||||
],
|
||||
}],
|
||||
[ 'OS=="netbsd"', {
|
||||
'defines': [
|
||||
'NETBSD',
|
||||
],
|
||||
}],
|
||||
[ 'OS=="openbsd"', {
|
||||
'defines': [
|
||||
'OPENBSD',
|
||||
],
|
||||
}],
|
||||
['OS=="mac" or OS=="dragonfly" or OS=="freebsd" or OS=="netbsd" or OS=="openbsd"', {
|
||||
'defines': [
|
||||
'HAVE_BSD_FLOCK',
|
||||
],
|
||||
}],
|
||||
[ 'OS!="win"', {
|
||||
'defines': [
|
||||
'HAVE_STRERROR',
|
||||
'XP_UNIX',
|
||||
'_REENTRANT',
|
||||
],
|
||||
}],
|
||||
[ 'OS!="mac" and OS!="win"', {
|
||||
'cflags': [
|
||||
'-fPIC',
|
||||
'-pipe',
|
||||
|
|
@ -264,6 +361,9 @@
|
|||
'cflags_cc': [
|
||||
'-std=c++0x',
|
||||
],
|
||||
'ldflags': [
|
||||
'-z', 'noexecstack',
|
||||
],
|
||||
'conditions': [
|
||||
[ 'target_arch=="ia32"', {
|
||||
'cflags': ['-m32'],
|
||||
|
|
@ -273,89 +373,57 @@
|
|||
'cflags': ['-m64'],
|
||||
'ldflags': ['-m64'],
|
||||
}],
|
||||
[ 'use_pprof==1' , {
|
||||
],
|
||||
}],
|
||||
[ 'use_pprof==1 and OS!="android" and OS!="win"', {
|
||||
'conditions': [
|
||||
[ 'OS=="mac"', {
|
||||
'xcode_settings': {
|
||||
'OTHER_LDFLAGS': [ '-lprofiler' ],
|
||||
},
|
||||
}, {
|
||||
'ldflags': [ '-lprofiler' ],
|
||||
}],
|
||||
[ 'OS!="linux"', {
|
||||
'library_dirs': [
|
||||
'/usr/local/lib/',
|
||||
],
|
||||
}],
|
||||
],
|
||||
}],
|
||||
[ 'disable_werror==0 and (OS=="linux" or OS=="mac")', {
|
||||
[ 'disable_werror==0 and OS!="android" and OS!="win"', {
|
||||
'cflags': [
|
||||
'<!@(<(python) <(DEPTH)/coreconf/werror.py)',
|
||||
],
|
||||
'xcode_settings': {
|
||||
'OTHER_CFLAGS': [
|
||||
'<!@(<(python) <(DEPTH)/coreconf/werror.py)',
|
||||
],
|
||||
},
|
||||
}],
|
||||
[ 'fuzz==1', {
|
||||
[ 'fuzz_tls==1', {
|
||||
'cflags': [
|
||||
'-Wno-unused-function',
|
||||
]
|
||||
}],
|
||||
[ 'use_asan==1 or use_ubsan==1', {
|
||||
'cflags': ['-O1'],
|
||||
'-Wno-unused-variable',
|
||||
],
|
||||
'xcode_settings': {
|
||||
'GCC_OPTIMIZATION_LEVEL': '1', # -O1
|
||||
}
|
||||
}],
|
||||
[ 'use_asan==1', {
|
||||
'variables': {
|
||||
'asan_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py asan)',
|
||||
'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
|
||||
'OTHER_CFLAGS': [
|
||||
'-Wno-unused-function',
|
||||
'-Wno-unused-variable',
|
||||
],
|
||||
},
|
||||
'cflags': ['<@(asan_flags)'],
|
||||
'ldflags': ['<@(asan_flags)'],
|
||||
'ldflags!': ['<@(no_ldflags)'],
|
||||
}],
|
||||
[ 'sanitizer_flags!=0', {
|
||||
'cflags': ['<@(sanitizer_flags)'],
|
||||
'ldflags': ['<@(sanitizer_flags)'],
|
||||
'xcode_settings': {
|
||||
'OTHER_CFLAGS': ['<@(asan_flags)'],
|
||||
'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
|
||||
'OTHER_CFLAGS': ['<@(sanitizer_flags)'],
|
||||
# We want to pass -fsanitize=... to our final link call,
|
||||
# but not to libtool. OTHER_LDFLAGS is passed to both.
|
||||
# To trick GYP into doing what we want, we'll piggyback on
|
||||
# LIBRARY_SEARCH_PATHS, producing "-L/usr/lib -fsanitize=...".
|
||||
# The -L/usr/lib is redundant but innocuous: it's a default path.
|
||||
'LIBRARY_SEARCH_PATHS': ['/usr/lib <(asan_flags)'],
|
||||
},
|
||||
}],
|
||||
[ 'use_ubsan==1', {
|
||||
'variables': {
|
||||
'ubsan_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ubsan)',
|
||||
'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
|
||||
},
|
||||
'cflags': ['<@(ubsan_flags)'],
|
||||
'ldflags': ['<@(ubsan_flags)'],
|
||||
'ldflags!': ['<@(no_ldflags)'],
|
||||
'xcode_settings': {
|
||||
'OTHER_CFLAGS': ['<@(ubsan_flags)'],
|
||||
'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
|
||||
# See comment above.
|
||||
'LIBRARY_SEARCH_PATHS': ['/usr/lib <(ubsan_flags)'],
|
||||
},
|
||||
}],
|
||||
[ 'use_msan==1', {
|
||||
'variables': {
|
||||
'msan_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py msan)',
|
||||
'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
|
||||
},
|
||||
'cflags': ['<@(msan_flags)'],
|
||||
'ldflags': ['<@(msan_flags)'],
|
||||
'ldflags!': ['<@(no_ldflags)'],
|
||||
'xcode_settings': {
|
||||
'OTHER_CFLAGS': ['<@(msan_flags)'],
|
||||
'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
|
||||
# See comment above.
|
||||
'LIBRARY_SEARCH_PATHS': ['/usr/lib <(msan_flags)'],
|
||||
},
|
||||
}],
|
||||
[ 'use_sancov!=0', {
|
||||
'variables': {
|
||||
'sancov_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py sancov <(use_sancov))',
|
||||
'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
|
||||
},
|
||||
'cflags': ['<@(sancov_flags)'],
|
||||
'ldflags': ['<@(sancov_flags)'],
|
||||
'ldflags!': ['<@(no_ldflags)'],
|
||||
'xcode_settings': {
|
||||
'OTHER_CFLAGS': ['<@(sancov_flags)'],
|
||||
'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
|
||||
# See comment above.
|
||||
'LIBRARY_SEARCH_PATHS': ['/usr/lib <(sancov_flags)'],
|
||||
'LIBRARY_SEARCH_PATHS': ['/usr/lib <(sanitizer_flags)'],
|
||||
},
|
||||
}],
|
||||
[ 'OS=="android" and mozilla_client==0', {
|
||||
|
|
@ -368,9 +436,6 @@
|
|||
[ 'OS=="mac"', {
|
||||
'defines': [
|
||||
'DARWIN',
|
||||
'HAVE_STRERROR',
|
||||
'HAVE_BSD_FLOCK',
|
||||
'XP_UNIX',
|
||||
],
|
||||
'conditions': [
|
||||
[ 'target_arch=="ia32"', {
|
||||
|
|
@ -415,9 +480,9 @@
|
|||
'PreprocessorDefinitions': [
|
||||
'WIN32',
|
||||
],
|
||||
'AdditionalOptions': [ '/EHsc' ],
|
||||
},
|
||||
},
|
||||
|
||||
}],
|
||||
[ 'target_arch=="x64"', {
|
||||
'msvs_configuration_platform': 'x64',
|
||||
|
|
@ -430,6 +495,7 @@
|
|||
'WIN64',
|
||||
'_AMD64_',
|
||||
],
|
||||
'AdditionalOptions': [ '/EHsc' ],
|
||||
},
|
||||
},
|
||||
}],
|
||||
|
|
@ -451,7 +517,7 @@
|
|||
'Debug': {
|
||||
'inherit_from': ['Common'],
|
||||
'conditions': [
|
||||
[ 'OS=="linux" or OS=="android"', {
|
||||
[ 'OS!="mac" and OS!="win"', {
|
||||
'cflags': [
|
||||
'-g',
|
||||
'<(moz_debug_flags)',
|
||||
|
|
@ -460,14 +526,15 @@
|
|||
],
|
||||
#TODO: DEBUG_$USER
|
||||
'defines': ['DEBUG'],
|
||||
'cflags': [ '-O<(debug_optimization_level)' ],
|
||||
'xcode_settings': {
|
||||
'COPY_PHASE_STRIP': 'NO',
|
||||
'GCC_OPTIMIZATION_LEVEL': '0',
|
||||
'GCC_OPTIMIZATION_LEVEL': '<(debug_optimization_level)',
|
||||
'GCC_GENERATE_DEBUGGING_SYMBOLS': 'YES',
|
||||
},
|
||||
'msvs_settings': {
|
||||
'VCCLCompilerTool': {
|
||||
'Optimization': '0',
|
||||
'Optimization': '<(debug_optimization_level)',
|
||||
'BasicRuntimeChecks': '3',
|
||||
'RuntimeLibrary': '2', # /MD
|
||||
},
|
||||
|
|
@ -482,16 +549,15 @@
|
|||
# Common settings for release should go here.
|
||||
'Release': {
|
||||
'inherit_from': ['Common'],
|
||||
'defines': [
|
||||
'NDEBUG',
|
||||
],
|
||||
'defines': ['NDEBUG'],
|
||||
'cflags': [ '-O<(release_optimization_level)' ],
|
||||
'xcode_settings': {
|
||||
'DEAD_CODE_STRIPPING': 'YES', # -Wl,-dead_strip
|
||||
'GCC_OPTIMIZATION_LEVEL': '2', # -O2
|
||||
'GCC_OPTIMIZATION_LEVEL': '<(release_optimization_level)',
|
||||
},
|
||||
'msvs_settings': {
|
||||
'VCCLCompilerTool': {
|
||||
'Optimization': '2', # /Os
|
||||
'Optimization': '<(release_optimization_level)',
|
||||
'RuntimeLibrary': '2', # /MD
|
||||
},
|
||||
'VCLinkerTool': {
|
||||
|
|
@ -516,9 +582,9 @@
|
|||
},
|
||||
},
|
||||
'conditions': [
|
||||
[ 'OS=="linux" or OS=="android"', {
|
||||
[ 'cc_use_gnu_ld==1', {
|
||||
'variables': {
|
||||
'process_map_file': ['/bin/sh', '-c', '/bin/grep -v ";-" >(mapfile) | sed -e "s,;+,," -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,;," > >@(_outputs)'],
|
||||
'process_map_file': ['/bin/sh', '-c', '/usr/bin/env grep -v ";-" >(mapfile) | sed -e "s,;+,," -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,;," > >@(_outputs)'],
|
||||
},
|
||||
}],
|
||||
[ 'OS=="mac"', {
|
||||
|
|
|
|||
|
|
@ -10,3 +10,4 @@
|
|||
*/
|
||||
|
||||
#error "Do not include this header file."
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ def main():
|
|||
if host_arch in ('amd64', 'x86_64'):
|
||||
host_arch = 'x64'
|
||||
elif fnmatch.fnmatch(host_arch, 'i?86') or host_arch == 'i86pc':
|
||||
host_arch = 'x64'
|
||||
host_arch = 'ia32'
|
||||
elif host_arch.startswith('arm'):
|
||||
host_arch = 'arm'
|
||||
elif host_arch.startswith('mips'):
|
||||
|
|
|
|||
41
security/nss/coreconf/fuzz.sh
Normal file
41
security/nss/coreconf/fuzz.sh
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
#!/usr/bin/env bash
|
||||
# This file is used by build.sh to setup fuzzing.
|
||||
|
||||
set +e
|
||||
|
||||
# Default to clang if CC is not set.
|
||||
if [ -z "$CC" ]; then
|
||||
command -v clang &> /dev/null 2>&1
|
||||
if [ $? != 0 ]; then
|
||||
echo "Fuzzing requires clang!"
|
||||
exit 1
|
||||
fi
|
||||
export CC=clang
|
||||
export CCC=clang++
|
||||
export CXX=clang++
|
||||
fi
|
||||
|
||||
gyp_params+=(-Dtest_build=1 -Dfuzz=1 -Dsign_libs=0)
|
||||
|
||||
# Add debug symbols even for opt builds.
|
||||
nspr_params+=(--enable-debug-symbols)
|
||||
|
||||
if [ "$fuzz_oss" = 1 ]; then
|
||||
gyp_params+=(-Dno_zdefs=1 -Dfuzz_oss=1)
|
||||
else
|
||||
enable_sanitizer asan
|
||||
# Ubsan doesn't build on 32-bit at the moment. Disable it.
|
||||
if [ "$build_64" = 1 ]; then
|
||||
enable_ubsan
|
||||
fi
|
||||
enable_sancov
|
||||
fi
|
||||
|
||||
if [ "$fuzz_tls" = 1 ]; then
|
||||
gyp_params+=(-Dfuzz_tls=1)
|
||||
fi
|
||||
|
||||
if [ ! -f "/usr/lib/libFuzzingEngine.a" ]; then
|
||||
echo "Cloning libFuzzer files ..."
|
||||
run_verbose "$cwd"/fuzz/config/clone_libfuzzer.sh
|
||||
fi
|
||||
|
|
@ -1,48 +1,59 @@
|
|||
#!/bin/bash
|
||||
#!/usr/bin/env bash
|
||||
# This script builds NSPR for NSS.
|
||||
#
|
||||
# This build system is still under development. It does not yet support all
|
||||
# the features or platforms that the regular NSPR build supports.
|
||||
|
||||
# variables
|
||||
nspr_opt=()
|
||||
nspr_cflags=
|
||||
nspr_cxxflags=
|
||||
nspr_ldflags=
|
||||
|
||||
nspr_sanitizer()
|
||||
# Try to avoid bmake on OS X and BSD systems
|
||||
if hash gmake 2>/dev/null; then
|
||||
make() { command gmake "$@"; }
|
||||
fi
|
||||
|
||||
nspr_set_flags()
|
||||
{
|
||||
nspr_cflags="$nspr_cflags $(python $cwd/coreconf/sanitizers.py $1 $2)"
|
||||
nspr_cxxflags="$nspr_cxxflags $(python $cwd/coreconf/sanitizers.py $1 $2)"
|
||||
nspr_ldflags="$nspr_ldflags $(python $cwd/coreconf/sanitizers.py $1 $2)"
|
||||
nspr_cflags="$CFLAGS $@"
|
||||
nspr_cxxflags="$CXXFLAGS $@"
|
||||
nspr_ldflags="$LDFLAGS $@"
|
||||
}
|
||||
|
||||
verbose()
|
||||
nspr_build()
|
||||
{
|
||||
CFLAGS=$nspr_cflags CXXFLAGS=$nspr_cxxflags LDFLAGS=$nspr_ldflags \
|
||||
CC=$CC CXX=$CCC ../configure "${nspr_opt[@]}" --prefix="$obj_dir"
|
||||
make -C "$cwd/../nspr/$target"
|
||||
make -C "$cwd/../nspr/$target" install
|
||||
}
|
||||
local nspr_dir="$cwd"/../nspr/$target
|
||||
mkdir -p "$nspr_dir"
|
||||
|
||||
silent()
|
||||
{
|
||||
echo "[1/3] configure NSPR ..."
|
||||
CFLAGS=$nspr_cflags CXXFLAGS=$nspr_cxxflags LDFLAGS=$nspr_ldflags \
|
||||
CC=$CC CXX=$CCC ../configure "${nspr_opt[@]}" --prefix="$obj_dir" 1> /dev/null
|
||||
echo "[2/3] make NSPR ..."
|
||||
make -C "$cwd/../nspr/$target" 1> /dev/null
|
||||
echo "[3/3] install NSPR ..."
|
||||
make -C "$cwd/../nspr/$target" install 1> /dev/null
|
||||
}
|
||||
|
||||
build_nspr()
|
||||
{
|
||||
mkdir -p "$cwd/../nspr/$target"
|
||||
cd "$cwd/../nspr/$target"
|
||||
if [ "$1" == 1 ]; then
|
||||
verbose
|
||||
else
|
||||
silent
|
||||
# These NSPR options are directory-specific, so they don't need to be
|
||||
# included in nspr_opt and changing them doesn't force a rebuild of NSPR.
|
||||
extra_params=(--prefix="$dist_dir"/$target)
|
||||
if [ "$opt_build" = 1 ]; then
|
||||
extra_params+=(--disable-debug --enable-optimize)
|
||||
fi
|
||||
|
||||
echo "NSPR [1/3] configure ..."
|
||||
pushd "$nspr_dir" >/dev/null
|
||||
CFLAGS="$nspr_cflags" CXXFLAGS="$nspr_cxxflags" \
|
||||
LDFLAGS="$nspr_ldflags" CC="$CC" CXX="$CCC" \
|
||||
run_verbose ../configure "${extra_params[@]}" "$@"
|
||||
popd >/dev/null
|
||||
echo "NSPR [2/3] make ..."
|
||||
run_verbose make -C "$nspr_dir"
|
||||
echo "NSPR [3/3] install ..."
|
||||
run_verbose make -C "$nspr_dir" install
|
||||
}
|
||||
|
||||
nspr_clean()
|
||||
{
|
||||
rm -rf "$cwd"/../nspr/$target
|
||||
}
|
||||
|
||||
set_nspr_path()
|
||||
{
|
||||
local include=$(echo "$1" | cut -d: -f1)
|
||||
local lib=$(echo "$1" | cut -d: -f2)
|
||||
gyp_params+=(-Dnspr_include_dir="$include")
|
||||
gyp_params+=(-Dnspr_lib_dir="$lib")
|
||||
}
|
||||
|
|
|
|||
63
security/nss/coreconf/precommit.clang-format.sh
Normal file
63
security/nss/coreconf/precommit.clang-format.sh
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
#!/usr/bin/env bash
|
||||
# This is a pre-commit hook for use with either mercurial or git.
|
||||
#
|
||||
# Install this by running the script with an argument of "install".
|
||||
#
|
||||
# All that does is add the following lines to .hg/hgrc:
|
||||
#
|
||||
# [hook]
|
||||
# pretxncommit.clang-format = [ ! -x ./coreconf/precommit.clang-format.sh ] || ./coreconf/precommit.clang-format.sh
|
||||
#
|
||||
# Or installs a symlink to .git/hooks/precommit:
|
||||
# $ ln -s ../../coreconf/precommit.clang-format.sh .git/hooks/pre-commit
|
||||
|
||||
hash clang-format || exit 1
|
||||
[ "$(hg root 2>/dev/null)" = "$PWD" ] && hg=1 || hg=0
|
||||
[ "$(git rev-parse --show-toplevel 2>/dev/null)" = "$PWD" ] && git=1 || git=0
|
||||
|
||||
if [ "$1" = "install" ]; then
|
||||
if [ "$hg" -eq 1 ]; then
|
||||
hgrc="$(hg root)"/.hg/hgrc
|
||||
if ! grep -q '^pretxncommit.clang-format' "$hgrc"; then
|
||||
echo '[hooks]' >> "$hgrc"
|
||||
echo 'pretxncommit.clang-format = [ ! -x ./coreconf/precommit.clang-format.sh ] || ./coreconf/precommit.clang-format.sh' >> "$hgrc"
|
||||
echo "Installed mercurial pretxncommit hook"
|
||||
exit
|
||||
fi
|
||||
fi
|
||||
if [ "$git" -eq 1 ]; then
|
||||
hook="$(git rev-parse --show-toplevel)"/.git/hooks/pre-commit
|
||||
if [ ! -e "$hook" ]; then
|
||||
ln -s ../../coreconf/precommit.clang-format.sh "$hook"
|
||||
echo "Installed git pre-commit hook"
|
||||
exit
|
||||
fi
|
||||
fi
|
||||
echo "Hook already installed, or not in NSS repo"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
err=0
|
||||
files=()
|
||||
if [ "$hg" -eq 1 ]; then
|
||||
files=($(hg status -m -a --rev tip^:tip | cut -f 2 -d ' ' -))
|
||||
fi
|
||||
if [ "$git" -eq 1 ]; then
|
||||
files=($(git status --porcelain | sed '/^[MACU]/{s/..//;p;};/^R/{s/^.* -> //;p;};d'))
|
||||
fi
|
||||
tmp=$(mktemp)
|
||||
trap 'rm -f "$tmp"' ERR EXIT
|
||||
for f in "${files[@]}"; do
|
||||
ext="${f##*.}"
|
||||
if [ "$ext" = "c" -o "$ext" = "h" -o "$ext" = "cc" ]; then
|
||||
[ "$hg" -eq 1 ] && hg cat -r tip "$f" > "$tmp"
|
||||
[ "$git" -eq 1 ] && git show :"$f" > "$tmp"
|
||||
if ! cat "$tmp" | clang-format -assume-filename="$f" | \
|
||||
diff -q "$tmp" - >/dev/null; then
|
||||
[ "$err" -eq 0 ] && echo "Formatting errors found in:" 1>&2
|
||||
echo " $f" 1>&2
|
||||
err=1
|
||||
fi
|
||||
fi
|
||||
done
|
||||
exit "$err"
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
# Address Sanitizer support; include this in OS-specific .mk files
|
||||
# *after* defining the variables that are appended to here.
|
||||
|
||||
ifeq ($(USE_ASAN), 1)
|
||||
SANITIZER_FLAGS_COMMON = -fsanitize=address
|
||||
|
||||
ifeq ($(USE_UBSAN), 1)
|
||||
SANITIZER_FLAGS_COMMON += -fsanitize=undefined -fno-sanitize-recover=undefined
|
||||
endif
|
||||
|
||||
ifeq ($(FUZZ), 1)
|
||||
SANITIZER_FLAGS_COMMON += -fsanitize-coverage=edge
|
||||
endif
|
||||
|
||||
SANITIZER_FLAGS_COMMON += $(EXTRA_SANITIZER_FLAGS)
|
||||
SANITIZER_CFLAGS = $(SANITIZER_FLAGS_COMMON)
|
||||
SANITIZER_LDFLAGS = $(SANITIZER_FLAGS_COMMON)
|
||||
OS_CFLAGS += $(SANITIZER_CFLAGS)
|
||||
LDFLAGS += $(SANITIZER_LDFLAGS)
|
||||
|
||||
# ASan needs frame pointers to save stack traces for allocation/free sites.
|
||||
# (Warning: some platforms, like ARM Linux in Thumb mode, don't have useful
|
||||
# frame pointers even with this option.)
|
||||
SANITIZER_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
|
||||
|
||||
ifdef BUILD_OPT
|
||||
# You probably want to be able to get debug info for failures, even with an
|
||||
# optimized build.
|
||||
OPTIMIZER += -g
|
||||
else
|
||||
# Try maintaining reasonable performance, ASan and UBSan slow things down.
|
||||
OPTIMIZER += -O1
|
||||
endif
|
||||
|
||||
endif
|
||||
|
|
@ -5,14 +5,16 @@ import sys
|
|||
|
||||
def main():
|
||||
if len(sys.argv) < 2:
|
||||
raise Exception('Specify either "ld", asan", "msan", "sancov" or "ubsan" as argument.')
|
||||
raise Exception('Specify either "asan", "msan", "sancov" or "ubsan" as argument.')
|
||||
|
||||
sanitizer = sys.argv[1]
|
||||
if sanitizer == "ubsan":
|
||||
print('-fsanitize=undefined -fno-sanitize-recover=undefined ', end='')
|
||||
if len(sys.argv) < 3:
|
||||
raise Exception('ubsan requires another argument.')
|
||||
print('-fsanitize='+sys.argv[2]+' -fno-sanitize-recover=undefined ', end='')
|
||||
return
|
||||
if sanitizer == "asan":
|
||||
print('-fsanitize=address ', end='')
|
||||
print('-fsanitize=address -fsanitize-address-use-after-scope ', end='')
|
||||
print('-fno-omit-frame-pointer -fno-optimize-sibling-calls ', end='')
|
||||
return
|
||||
if sanitizer == "msan":
|
||||
|
|
@ -25,12 +27,7 @@ def main():
|
|||
print('-fsanitize-coverage='+sys.argv[2]+' ', end='')
|
||||
return
|
||||
|
||||
# We have to remove this from the ld flags when building asan.
|
||||
if sanitizer == "ld":
|
||||
print('-Wl,-z,defs ', end='')
|
||||
return
|
||||
|
||||
raise Exception('Specify either "ld", asan", "msan", "sancov" or "ubsan" as argument.')
|
||||
raise Exception('Specify either "asan", "msan", "sancov" or "ubsan" as argument.')
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
|
|
|||
78
security/nss/coreconf/sanitizers.sh
Normal file
78
security/nss/coreconf/sanitizers.sh
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
#!/usr/bin/env bash
|
||||
# This file is used by build.sh to setup sanitizers.
|
||||
|
||||
sanitizer_flags=""
|
||||
sanitizers=()
|
||||
|
||||
# This tracks what sanitizers are enabled so they don't get enabled twice. This
|
||||
# means that doing things that enable the same sanitizer twice (such as enabling
|
||||
# both --asan and --fuzz) is order-dependent: only the first is used.
|
||||
enable_sanitizer()
|
||||
{
|
||||
local san="$1"
|
||||
for i in "${sanitizers[@]}"; do
|
||||
[ "$san" = "$i" ] && return
|
||||
done
|
||||
sanitizers+=("$san")
|
||||
|
||||
if [ -z "$sanitizer_flags" ]; then
|
||||
gyp_params+=(-Dno_zdefs=1)
|
||||
fi
|
||||
|
||||
local cflags=$(python $cwd/coreconf/sanitizers.py "$@")
|
||||
sanitizer_flags="$sanitizer_flags $cflags"
|
||||
}
|
||||
|
||||
enable_sancov()
|
||||
{
|
||||
local clang_version=$($CC --version | grep -oE '([0-9]{1,}\.)+[0-9]{1,}')
|
||||
if [[ ${clang_version:0:1} -lt 4 && ${clang_version:0:1} -eq 3 && ${clang_version:2:1} -lt 9 ]]; then
|
||||
echo "Need at least clang-3.9 (better 4.0) for sancov." 1>&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local sancov
|
||||
if [ -n "$1" ]; then
|
||||
sancov="$1"
|
||||
elif [ "${clang_version:0:3}" = "3.9" ]; then
|
||||
sancov=edge,indirect-calls,8bit-counters
|
||||
else
|
||||
sancov=trace-pc-guard,trace-cmp
|
||||
fi
|
||||
enable_sanitizer sancov "$sancov"
|
||||
}
|
||||
|
||||
enable_ubsan()
|
||||
{
|
||||
local ubsan
|
||||
if [ -n "$1" ]; then
|
||||
ubsan="$1"
|
||||
else
|
||||
ubsan=bool,signed-integer-overflow,shift,vptr
|
||||
fi
|
||||
enable_sanitizer ubsan "$ubsan"
|
||||
}
|
||||
|
||||
# Not strictly a sanitizer, but the pattern fits
|
||||
scanbuild=()
|
||||
enable_scanbuild()
|
||||
{
|
||||
[ "${#scanbuild[@]}" -gt 0 ] && return
|
||||
|
||||
scanbuild=(scan-build)
|
||||
if [ -n "$1" ]; then
|
||||
scanbuild+=(-o "$1")
|
||||
fi
|
||||
# pass on CC and CCC to scanbuild
|
||||
if [ -n "$CC" ]; then
|
||||
scanbuild+=(--use-cc="$CC")
|
||||
fi
|
||||
if [ -n "$CCC" ]; then
|
||||
scanbuild+=(--use-c++="$CCC")
|
||||
fi
|
||||
}
|
||||
|
||||
run_scanbuild()
|
||||
{
|
||||
"${scanbuild[@]}" "$@"
|
||||
}
|
||||
|
|
@ -7,7 +7,8 @@ def main():
|
|||
cc = os.environ.get('CC', 'cc')
|
||||
sink = open(os.devnull, 'wb')
|
||||
try:
|
||||
cc_is_clang = 'clang' in subprocess.check_output([cc, '--version'], stderr=sink)
|
||||
cc_is_clang = 'clang' in subprocess.check_output(
|
||||
[cc, '--version'], universal_newlines=True, stderr=sink)
|
||||
except OSError:
|
||||
# We probably just don't have CC/cc.
|
||||
return
|
||||
|
|
@ -25,6 +26,7 @@ def main():
|
|||
try:
|
||||
v = subprocess.check_output([cc, '-dumpversion'], stderr=sink)
|
||||
v = v.strip(' \r\n').split('.')
|
||||
v = list(map(int, v))
|
||||
if v[0] < 4 or (v[0] == 4 and v[1] < 8):
|
||||
# gcc 4.8 minimum
|
||||
return False
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue