Commit graph

203 commits

Author SHA1 Message Date
roytam1
43cfc69b25 imported changes from mozilla NSS:
- Bug 1759794 - protect SFTKSlot needLogin with slotLock. r=rrelyea (1bbd8d8c)
- Bug 1771497 - Uninitialized value in cert_VerifyCertChainOld. r=nss-reviewers,djackson (23be110c)
- Bug 1771495 - unchecked return code in sec_DecodeSigAlg. r=nss-reviewers,djackson (d4fb4b83)
- Bug 1771498 - Uninitialized value in cert_ComputeCertType. r=djackson (b28bc4cd)
- Bug 1764392 - Add DigitCert Roots r=nss-reviewers,jschanck (0863d9ec)
- Bug 1768970 - Add Certainly Roots. r=nss-reviewers,jschanck (6307e75b)
- Bug 1770267 - Add E-Tugra Roots. r=nss-reviewers,jschanck (9555008f)
- Bug 1759815 - Remove Hellenic Academic 2011 Root. r=nss-reviewers,jschanck (9c2cbf14)
- Bug 1764206 - Bump nssckbi version number for June. r=nss-reviewers,jschanck (b3acf3d9)
2022-06-17 11:00:44 +08:00
roytam1
5618d02caf import from nss upstream: Bug 1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple r=#nss-reviewers,kaie (118b893f8e) 2022-06-02 10:10:47 +08:00
roytam1
6de07653b9 Merge remote-tracking branch 'origin/tracking' into custom 2022-04-28 10:45:19 +08:00
Moonchild
eaf9e756a0 Issue #21 - Remove remaining telemetry structs, callers and flags. 2022-04-28 10:33:44 +08:00
Moonchild
8d800b1cb0 Issue #21 - Remove Telemetry plumbing and fix build.
Note this won't give working applications. Requires FE changes and
additional js module changes (next part).
2022-04-28 10:25:48 +08:00
roytam1
059e35a463 Merge remote-tracking branch 'origin/tracking' into custom 2022-04-21 21:59:16 +08:00
FranklinDM
031a928950 Issue #738 - Follow-up: Remove explicit session cache cleanup routine from ShutdownNSS
This is no longer needed because the call to SSL_ConfigServerSessionIDCache on startup was already removed (see 1425f020c47b3cbe134f71717299714aead28502), meaning LocksInitializedEarly does not become true and only causes an assertion on debug builds.

On the other hand, SSL_ClearSessionCache is already called on XPCOM shutdown and calling it again here is redundant.

Additional context: https://bugzilla.mozilla.org/show_bug.cgi?id=1485087#c5

Based on https://bugzilla.mozilla.org/show_bug.cgi?id=1485087
2022-04-21 21:46:24 +08:00
roytam1
eb6e4fbafe zlib: also pick up 4346a16853 2022-04-10 23:05:55 +08:00
roytam1
21d56c9c93 nss: update in-tree zlib to 1.2.11 with CVE-2018-25032 fix 2022-04-01 23:56:16 +08:00
roytam1
3336114a36 [NSS] ported mozilla upstream changes:
- Bug 1552254 internal_error alert on Certificate Request with sha1+ecdsa in TLS 1.3 (be6a9782)
- Bug 1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate. r=rrelyea (800111fa)
- Bug 1756271 - Remove token member from NSSSlot struct. r=rrelyea (55052f78)
- Bug 1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun. r=nss-reviewers,jschanck (2f2c8564)
- Bug 1755264 - TLS 1.3 Illegal legacy_version handling/alerts. r=djackson (7d931c59)
- Bug 1751305 - Remove expired explicitly distrusted certificates from certdata.txt. r=KathleenWilson (b722e523)
- Bug 1751298 - Add Telia Root CA v2 root certificate. r=KathleenWilson (1fcbbd7e)
- Bug 1754890 - Add two D-TRUST 2020 root certificates. r=KathleenWilson (f63fb86d)
2022-03-25 23:38:11 +08:00
roytam1
c403014cbe imported changes from mozilla NSS:
- Bug 1755555 - Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots. r=rrelyea (a36477f0)
- Bug 1370866 - Check return value of PK11Slot_GetNSSToken. r=djackson (d7e8c2df)
- Bug 1751157 - Throw illegal_parameter alert for illegal extensions in handshake message. r=djackson (8fd5ca0c)
2022-02-25 13:02:18 +08:00
roytam1
e3fb994063 Bug 1735028 - check for missing signedData field r=keeler 2022-01-19 10:25:05 +08:00
roytam1
5b0d1f871a imported changes from mozilla NSS:
- Bug 1737470 - Ensure DER encoded signatures are within size limits. r=jschanck,mt,bbeurdouche,rrelyea
- Bug 1735028 - check for missing signedData field r=keeler
and bump patch version.
2021-12-27 10:42:03 +08:00
roytam1
fceddf74e6 update NSS builtin certstore to Dec 2021 version from mozilla upstream. 2021-12-20 09:20:26 +08:00
roytam1
b7cc29620e security/pkix: align pkix with nss' mozpkix bug966856 fix 2021-12-17 22:10:56 +08:00
roytam1
2a8bbf94bb security/pkix: align pkix with nss' mozpkix and fix CheckRevocation API type in application codes 2021-12-17 22:09:38 +08:00
roytam1
a140666918 imported changes from mozilla NSS:
- Bug 966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses r=jschanck,djackson (78d2f4a3)
2021-12-17 16:54:54 +08:00
roytam1
190b620c2d partly import changes from tenfourfox:
- first rolling release: update to 91ESR EV and roots, TZs, TLDs (d7c93b6cf)
- security: M1730935, M1735152, M1730048 (1603b00d0)
2021-11-01 10:39:52 +08:00
roytam1
423d61a6f8 import changes from mozilla nss repo:
- Bug 1662515 - Fix incorrect alert after successful decryption r=djackson
- Bug 1721476 sqlite 3.34 changed it's open semantics, causing nss failures.
- Bug 1728394 - Add TunTrust Root CA certificate to NSS. r=KathleenWilson
- Bug 1717707 - Add HARICA TLS RSA Root CA 2021. r=KathleenWilson
- Bug 1717707 - Add HARICA TLS ECC Root CA 2021. r=KathleenWilson
- Bug 1717707 - Add HARICA Client RSA Root CA 2021. r=KathleenWilson
- Bug 1717707 - Add HARICA Client ECC Root CA 2021. r=KathleenWilson
2021-09-10 11:57:20 +08:00
roytam1
6026e19d20 update NSS builtin certstore to May 2021 version from mozilla upstream. 2021-05-31 10:23:28 +08:00
roytam1
4992a2fd18 Merge remote-tracking branch 'origin/master' into custom 2021-03-16 10:32:41 +08:00
Moonchild
ed26fe34af Issue #1746 - Update pkix code with later NSS code. 2021-03-16 09:49:44 +08:00
roytam1
75da290189 Merge remote-tracking branch 'origin/master' into custom 2021-02-25 09:43:06 +08:00
Moonchild
9fd40b1c93 Issue #457 - Remove duplicate PKCS11 definitions 2021-02-25 09:26:44 +08:00
Moonchild
ef29cca224 [security] Hold mutex when accessing TSI fields. 2021-02-25 09:26:42 +08:00
roytam1
c082741e8a import changes from mozilla nss repo:
- Bug 1682863 - Revert nssSlot_IsTokenPresent to 3.58 after ongoing Fx hangs with slow PKCS11 devices. r=bbeurdouche
- Bug 1680400 - Fix memory leak in PK11_UnwrapPrivKey. r=bbeurdouche
2020-12-30 08:33:37 +08:00
roytam1
ecf2071a46 import changes from mozilla nss repo:
- Bug 1641480, TLS 1.3: tighten CCS handling in compatibility mode, r=mt
- Bug 1672703, always tolerate the first CCS in TLS 1.3, r=mt
- Bug 1663661 - Guard against NULL token in nssSlot_IsTokenPresent. r=jcj
- Bug 1607449 - Lock cert->nssCertificate to prevent data race. r=jcj,keeler
- Bug 1679290 - Don't hold slot lock when taking session lock r=bbeurdouche
2020-12-02 10:52:47 +08:00
roytam1
ee3eabdb1e sync NSS builtin cert store up to mozilla nss hg rev f8c49b33:
- Bug 1670769 - Remove 10 GeoTrust, thawte, and VeriSign root certs from NSS. r=kjacobs,KathleenWilson
- Bug 1678166 - Add NAVER Global Root Certification Authority root cert to NSS. r=bbeurdouche,KathleenWilson
- Bug 1678189 - December 2020 batch of root changes, NSS_BUILTINS_LIBRARY_VERSION 2.46. r=bbeurdouche
2020-12-02 10:04:43 +08:00
roytam1
ee11f1749b Merge remote-tracking branch 'origin/master' into custom 2020-12-02 09:58:28 +08:00
Moonchild
d8fdbcd88c [NSS] Version and build bump 2020-12-02 09:57:49 +08:00
Moonchild
b71804f4a3 [NSS] Update root certificates. 2020-12-02 09:57:48 +08:00
roytam1
eb8926eb17 Merge remote-tracking branch 'origin/master' into custom 2020-11-19 21:12:48 +08:00
adesh
2924d30a83 Issue #1280 - Follow-up: Get rid of HPKP pinning mode.
This was a leftover from HPKP removal.

Also remove a couple of unused variables from security/manager/ssl/nsSiteSecurityService.cpp.
2020-11-19 21:11:43 +08:00
roytam1
4903a8dfa9 Merge remote-tracking branch 'origin/master' into custom 2020-10-30 09:27:13 +08:00
Moonchild
a77ab3da7f Issue #1656 - Nuke the remaining vim lines in UXP
Closes #1656
2020-10-30 09:09:20 +08:00
roytam1
75e16e5121 partly import changes from tenfourfox:
- #627: M1631583 M1631597 M1636771 M1637222 M1649316 M1651520 (2373458b5)
- #627: M1631573 (0abd0fc5d)
2020-10-09 21:23:26 +08:00
roytam1
56aaf6a15a Merge remote-tracking branch 'origin/master' into custom 2020-09-25 22:18:48 +08:00
Moonchild
9305760571 Issue #1656 - Part 9: Single-line-comment style. 2020-09-25 22:07:00 +08:00
Moonchild
d5919942ff Issue #1656 - Part 8: Devtools and misc. 2020-09-25 22:06:55 +08:00
Moonchild
0cd673d720 Issue #1656 - Part 6: Clean up the build files 2020-09-25 22:04:23 +08:00
Moonchild
538b420319 Issue #1656 - Part 4: Manual cleanup 2020-09-25 22:04:20 +08:00
Moonchild
d7a4abc3d4 Issue #1656 - Part 4: Tackle *.idl, *.css, *.ipdlh, *.webidl, *.cc 2020-09-25 22:04:18 +08:00
Moonchild
30df895eb2 Issue #1656 - Part 3: Nuke more vim config lines in the tree.
Another S&R run with some smarter matching.
2020-09-25 22:04:17 +08:00
Moonchild
8c395520d9 Issue #1656 - Part 1: Nuke most vim config lines in the tree.
Since these are just interpreted comments, there's 0 impact on actual code.
This removes all lines that match /* vim: set(.*)tw=80: */ with S&R -- there are
a few others scattered around which will be removed manually in a second part.
2020-09-25 22:04:12 +08:00
roytam1
64ccce7c22 partly import changes from tenfourfox:
- #622: M1660537 M1641487(modified) M1645492 (291688840)
2020-09-19 07:15:01 +08:00
roytam1
06a2891ef7 import certdata changes from NSS upstream:
- Bug 1651211 - Remove EE Certification Centre Root CA root cert. r=KathleenWilson,jcj
- Bug 1653092 - Disable server trust bit for OISTE WISeKey Global Root GA CA root cert. r=KathleenWilson,jcj
- Bug 1656077 - Remove Taiwan Government Root Certification Authority root cert. r=KathleenWilson,jcj
- Bug 1663049 - Add SecureTrust's Trustwave Global root certificates to NSS. r=KathleenWilson,jcj
- Bug 1663049 - September 2020 batch of root changes, NSS_BUILTINS_LIBRARY_VERSION 2.44. r=jcj
2020-09-19 07:05:30 +08:00
roytam1
1455a4fcbd import change from tenfourfox:
- fix overzealous assertion (M1531906) (af9a8236e)
2020-09-19 07:05:02 +08:00
roytam1
8fd5fd8690 Merge remote-tracking branch 'origin/master' into custom 2020-09-16 21:19:55 +08:00
adeshkp
f7b02cecab Issue #1280 - Remove hostname parameter to trust domain.
Host name was purely being used for HPKP and since HPKP is killed,
this can also go. Currently it doesn't do anything other than
generating build warnings.
2020-09-16 21:11:01 +08:00
Roy Tam
8015bb7004 update NSS as-of pm27 rev 7606140ee 2020-09-04 22:55:34 +08:00