rpms / nss

Clone
Source Code
GIT

33effb import nss-3.71.0-7.el9

Authored and Committed by centosrcm 3 years ago
raw patch tree parent
9 files changed. 362 lines added. 200 lines removed.
.gitignore
file modified
+1 -3
.nss.metadata
file modified
+1 -3
SOURCES/cert8.db.xml
file removed
-59
SOURCES/key3.db.xml
file removed
-59
SOURCES/nss-3.71-camellia-pkcs12-doc.patch
file added
+20
SOURCES/nss-3.71-fix-lto-gtests.patch
file added
+36
SOURCES/nss-3.75-fix-pkcs12-passwords.patch
file added
+257
SOURCES/secmod.db.xml
file removed
-63
SPECS/nss.spec
file modified
+47 -13 
    import nss-3.71.0-7.el9
file modified
+1 -3
.gitignore CHANGED
@@ -1,7 +1,5 @@
1
- SOURCES/blank-cert8.db
1
+ SOURCES/PayPalEE.cert
2
2
SOURCES/blank-cert9.db
3
- SOURCES/blank-key3.db
4
3
SOURCES/blank-key4.db
5
- SOURCES/blank-secmod.db
6
4
SOURCES/nspr-4.32.tar.gz
7
5
SOURCES/nss-3.71.tar.gz
file modified
+1 -3
.nss.metadata CHANGED
@@ -1,7 +1,5 @@
1
- d272a7b58364862613d44261c5744f7a336bf177 SOURCES/blank-cert8.db
1
+ 5c92efcd23ae5dc57c4f0a3903d662365bca008c SOURCES/PayPalEE.cert
2
2
b5570125fbf6bfb410705706af48217a0817c03a SOURCES/blank-cert9.db
3
- 7f78b5bcecdb5005e7b803604b2ec9d1a9df2fb5 SOURCES/blank-key3.db
4
3
f9c9568442386da370193474de1b25c3f68cdaf6 SOURCES/blank-key4.db
5
- bd748cf6e1465a1bbe6e751b72ffc0076aff0b50 SOURCES/blank-secmod.db
6
4
28e05ef5cbe6e7cde239d3cdcccabf571ec73f69 SOURCES/nspr-4.32.tar.gz
7
5
b60e3e0a2765d4009347e08dc9792a4dc4aded03 SOURCES/nss-3.71.tar.gz
file removed
-59
SOURCES/cert8.db.xml DELETED
@@ -1,59 +0,0 @@
1
- <?xml version='1.0' encoding='utf-8'?>
2
- <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3
- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
4
- <!ENTITY date SYSTEM "date.xml">
5
- <!ENTITY version SYSTEM "version.xml">
6
- ]>
7
-
8
- <refentry id="cert8.db">
9
-
10
- <refentryinfo>
11
- <date>&date;</date>
12
- <title>Network Security Services</title>
13
- <productname>nss</productname>
14
- <productnumber>&version;</productnumber>
15
- </refentryinfo>
16
-
17
- <refmeta>
18
- <refentrytitle>cert8.db</refentrytitle>
19
- <manvolnum>5</manvolnum>
20
- </refmeta>
21
-
22
- <refnamediv>
23
- <refname>cert8.db</refname>
24
- <refpurpose>Legacy NSS certificate database</refpurpose>
25
- </refnamediv>
26
-
27
- <refsection id="description">
28
- <title>Description</title>
29
- <para><emphasis>cert8.db</emphasis> is an NSS certificate database.</para>
30
- <para>This certificate database is in the legacy database format. Consider migrating to cert9.db and key4.db which are the new sqlite-based shared database format with support for concurrent access.
31
- </para>
32
- </refsection>
33
-
34
- <refsection>
35
- <title>Files</title>
36
- <para><filename>/etc/pki/nssdb/cert8.db</filename></para>
37
- </refsection>
38
-
39
- <refsection>
40
- <title>See also</title>
41
- <para>cert9.db(5), key4.db(5), pkcs11.txt(5), </para>
42
- </refsection>
43
-
44
- <refsection id="authors">
45
- <title>Authors</title>
46
- <para>The nss libraries were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</para>
47
- <para>Authors: Elio Maldonado &lt;emaldona@redhat.com>.</para>
48
- </refsection>
49
-
50
- <!-- don't change -->
51
- <refsection id="license">
52
- <title>LICENSE</title>
53
- <para>Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
54
- </para>
55
-
56
- </refsection>
57
-
58
-
59
- </refentry>
file removed
-59
SOURCES/key3.db.xml DELETED
@@ -1,59 +0,0 @@
1
- <?xml version='1.0' encoding='utf-8'?>
2
- <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3
- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
4
- <!ENTITY date SYSTEM "date.xml">
5
- <!ENTITY version SYSTEM "version.xml">
6
- ]>
7
-
8
- <refentry id="key3.db">
9
-
10
- <refentryinfo>
11
- <date>&date;</date>
12
- <title>Network Security Services</title>
13
- <productname>nss</productname>
14
- <productnumber>&version;</productnumber>
15
- </refentryinfo>
16
-
17
- <refmeta>
18
- <refentrytitle>key3.db</refentrytitle>
19
- <manvolnum>5</manvolnum>
20
- </refmeta>
21
-
22
- <refnamediv>
23
- <refname>key3.db</refname>
24
- <refpurpose>Legacy NSS certificate database</refpurpose>
25
- </refnamediv>
26
-
27
- <refsection id="description">
28
- <title>Description</title>
29
- <para><emphasis>key3.db</emphasis> is an NSS certificate database.</para>
30
- <para>This is a key database in the legacy database format. Consider migrating to cert9.db and key4.db which which are the new sqlite-based shared database format with support for concurrent access.
31
- </para>
32
- </refsection>
33
-
34
- <refsection>
35
- <title>Files</title>
36
- <para><filename>/etc/pki/nssdb/key3.db</filename></para>
37
- </refsection>
38
-
39
- <refsection>
40
- <title>See also</title>
41
- <para>cert9.db(5), key4.db(5), pkcs11.txt(5), </para>
42
- </refsection>
43
-
44
- <refsection id="authors">
45
- <title>Authors</title>
46
- <para>The nss libraries were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</para>
47
- <para>Authors: Elio Maldonado &lt;emaldona@redhat.com>.</para>
48
- </refsection>
49
-
50
- <!-- don't change -->
51
- <refsection id="license">
52
- <title>LICENSE</title>
53
- <para>Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
54
- </para>
55
-
56
- </refsection>
57
-
58
-
59
- </refentry>
file added
+20
SOURCES/nss-3.71-camellia-pkcs12-doc.patch ADDED
@@ -0,0 +1,20 @@
1
+ diff -up ./doc/pk12util.xml.camellia ./doc/pk12util.xml
2
+ --- ./doc/pk12util.xml.camellia 2022-01-26 09:46:39.794919455 -0800
3
+ +++ ./doc/pk12util.xml 2022-01-26 09:54:58.277019760 -0800
4
+ @@ -317,7 +317,7 @@ Certificate Friendly Name: Thawte Fre
5
+
6
+ <refsection id="encryption">
7
+ <title>Password Encryption</title>
8
+ - <para>PKCS #12 provides for not only the protection of the private keys but also the certificate and meta-data associated with the keys. Password-based encryption is used to protect private keys on export to a PKCS #12 file and, optionally, the associated certificates. If no algorithm is specified, the tool defaults to using PKCS #12 SHA-1 and 3-key triple DES for private key encryption. When not in FIPS mode, PKCS #12 SHA-1 and 40-bit RC4 is used for certificate encryption. When in FIPS mode, there is no certificate encryption. If certificate encryption is not wanted, specify <userinput>"NONE"</userinput> as the argument of the <option>-C</option> option.</para>
9
+ + <para>PKCS #12 provides for not only the protection of the private keys but also the certificate and meta-data associated with the keys. Password-based encryption is used to protect private keys on export to a PKCS #12 file and, optionally, the associated certificates. If no algorithm is specified, the tool defaults to using AES-256-CBC for private key encryption and AES-128-CBC for certificate encryption. If certificate encryption is not wanted, specify <userinput>"NONE"</userinput> as the argument of the <option>-C</option> option.</para>
10
+ <para>The private key is always protected with strong encryption by default.</para>
11
+ <para>Several types of ciphers are supported.</para>
12
+ <variablelist>
13
+ @@ -327,6 +327,7 @@ Certificate Friendly Name: Thawte Fre
14
+ <listitem>
15
+ <itemizedlist>
16
+ <listitem><para>PBES2 with AES-CBC-Pad as underlying encryption scheme (<userinput>"AES-128-CBC"</userinput>, <userinput>"AES-192-CBC"</userinput>, and <userinput>"AES-256-CBC"</userinput>)</para></listitem>
17
+ + <listitem><para>PBES2 with CAMELLIA-CBC-Pad as underlying encryption scheme (<userinput>"CAMELLIA-128-CBC"</userinput>, <userinput>"CAMELLIA-192-CBC"</userinput>, and <userinput>"CAMELLIA-256-CBC"</userinput>)</para></listitem>
18
+ </itemizedlist>
19
+ </listitem>
20
+ </varlistentry>
file added
+36
SOURCES/nss-3.71-fix-lto-gtests.patch ADDED
@@ -0,0 +1,36 @@
1
+ diff --git a/gtests/ssl_gtest/tls_subcerts_unittest.cc b/gtests/ssl_gtest/tls_subcerts_unittest.cc
2
+ --- a/gtests/ssl_gtest/tls_subcerts_unittest.cc
3
+ +++ b/gtests/ssl_gtest/tls_subcerts_unittest.cc
4
+ @@ -8,23 +8,32 @@
5
+
6
+ #include "prtime.h"
7
+ #include "secerr.h"
8
+ #include "ssl.h"
9
+
10
+ #include "gtest_utils.h"
11
+ #include "tls_agent.h"
12
+ #include "tls_connect.h"
13
+ +#define LTO
14
+
15
+ namespace nss_test {
16
+
17
+ +#ifndef LTO
18
+ +// sigh this construction breaks LTO
19
+ const std::string kEcdsaDelegatorId = TlsAgent::kDelegatorEcdsa256;
20
+ const std::string kRsaeDelegatorId = TlsAgent::kDelegatorRsae2048;
21
+ const std::string kPssDelegatorId = TlsAgent::kDelegatorRsaPss2048;
22
+ const std::string kDCId = TlsAgent::kServerEcdsa256;
23
+ +#else
24
+ +#define kEcdsaDelegatorId TlsAgent::kDelegatorEcdsa256
25
+ +#define kRsaeDelegatorId TlsAgent::kDelegatorRsae2048
26
+ +#define kPssDelegatorId TlsAgent::kDelegatorRsaPss2048
27
+ +#define kDCId TlsAgent::kServerEcdsa256
28
+ +#endif
29
+ const SSLSignatureScheme kDCScheme = ssl_sig_ecdsa_secp256r1_sha256;
30
+ const PRUint32 kDCValidFor = 60 * 60 * 24 * 7 /* 1 week (seconds) */;
31
+
32
+ static void CheckPreliminaryPeerDelegCred(
33
+ const std::shared_ptr<TlsAgent>& client, bool expected,
34
+ PRUint32 key_bits = 0, SSLSignatureScheme sig_scheme = ssl_sig_none) {
35
+ EXPECT_NE(0U, (client->pre_info().valuesSet & ssl_preinfo_peer_auth));
36
+ EXPECT_EQ(expected, client->pre_info().peerDelegCred);
file added
+257
SOURCES/nss-3.75-fix-pkcs12-passwords.patch ADDED
@@ -0,0 +1,257 @@
1
+ diff --git a/cmd/pk12util/pk12util.c b/cmd/pk12util/pk12util.c
2
+ --- a/cmd/pk12util/pk12util.c
3
+ +++ b/cmd/pk12util/pk12util.c
4
+ @@ -660,16 +660,27 @@ P12U_ExportPKCS12Object(char *nn, char *
5
+ }
6
+
7
+ /* Password to use for PKCS12 file. */
8
+ pwitem = P12U_GetP12FilePassword(PR_TRUE, p12FilePw);
9
+ if (!pwitem) {
10
+ goto loser;
11
+ }
12
+
13
+ + /* we are passing UTF8, drop the NULL in the normal password value.
14
+ + * UCS2 conversion will add it back if necessary. This only affects
15
+ + * password > Blocksize of the Hash function and pkcs5v2 pbe (if password
16
+ + * <=Blocksize then the password is zero padded anyway, so an extra NULL
17
+ + * at the end has not effect). This is allows us to work with openssl and
18
+ + * gnutls. Older versions of NSS already fail to decrypt long passwords
19
+ + * in this case, so we aren't breaking anyone with this code */
20
+ + if ((pwitem->len > 1) && (!pwitem->data[pwitem->len-1])) {
21
+ + pwitem->len--;
22
+ + }
23
+ +
24
+ p12cxt = p12u_InitContext(PR_FALSE, outfile);
25
+ if (!p12cxt) {
26
+ SECU_PrintError(progName, "Initialization failed: %s", outfile);
27
+ pk12uErrno = PK12UERR_INIT_FILE;
28
+ goto loser;
29
+ }
30
+
31
+ if (certlist) {
32
+ diff --git a/lib/pkcs12/p12local.c b/lib/pkcs12/p12local.c
33
+ --- a/lib/pkcs12/p12local.c
34
+ +++ b/lib/pkcs12/p12local.c
35
+ @@ -903,31 +903,35 @@ sec_pkcs12_find_object(SEC_PKCS12SafeCon
36
+ i++;
37
+ }
38
+ }
39
+
40
+ PORT_SetError(SEC_ERROR_PKCS12_UNABLE_TO_LOCATE_OBJECT_BY_NAME);
41
+ return NULL;
42
+ }
43
+
44
+ -/* this function converts a password to unicode and encures that the
45
+ - * required double 0 byte be placed at the end of the string
46
+ +/* this function converts a password to unicode and ensures that the
47
+ + * required double 0 byte be placed at the end of the string (if zeroTerm
48
+ + * is set), or the 0 bytes at the end are dropped (if zeroTerm is not set).
49
+ */
50
+ PRBool
51
+ sec_pkcs12_convert_item_to_unicode(PLArenaPool *arena, SECItem *dest,
52
+ SECItem *src, PRBool zeroTerm,
53
+ PRBool asciiConvert, PRBool toUnicode)
54
+ {
55
+ PRBool success = PR_FALSE;
56
+ + int bufferSize;
57
+ +
58
+ if (!src || !dest) {
59
+ PORT_SetError(SEC_ERROR_INVALID_ARGS);
60
+ return PR_FALSE;
61
+ }
62
+
63
+ - dest->len = src->len * 3 + 2;
64
+ + bufferSize = src->len * 3 + 2;
65
+ + dest->len = bufferSize;
66
+ if (arena) {
67
+ dest->data = (unsigned char *)PORT_ArenaZAlloc(arena, dest->len);
68
+ } else {
69
+ dest->data = (unsigned char *)PORT_ZAlloc(dest->len);
70
+ }
71
+
72
+ if (!dest->data) {
73
+ dest->len = 0;
74
+ @@ -951,34 +955,44 @@ sec_pkcs12_convert_item_to_unicode(PLAre
75
+ if (!arena) {
76
+ PORT_Free(dest->data);
77
+ dest->data = NULL;
78
+ dest->len = 0;
79
+ }
80
+ return PR_FALSE;
81
+ }
82
+
83
+ - if ((dest->len >= 2) &&
84
+ - (dest->data[dest->len - 1] || dest->data[dest->len - 2]) && zeroTerm) {
85
+ - if (dest->len + 2 > 3 * src->len) {
86
+ - if (arena) {
87
+ - dest->data = (unsigned char *)PORT_ArenaGrow(arena,
88
+ - dest->data, dest->len,
89
+ - dest->len + 2);
90
+ - } else {
91
+ - dest->data = (unsigned char *)PORT_Realloc(dest->data,
92
+ - dest->len + 2);
93
+ + /* in some cases we need to add NULL terminations and in others
94
+ + * we need to drop null terminations */
95
+ + if (zeroTerm) {
96
+ + /* unicode adds two nulls a the end */
97
+ + if (toUnicode) {
98
+ + if ((dest->len >= 2) &&
99
+ + (dest->data[dest->len - 1] || dest->data[dest->len - 2])) {
100
+ + /* we've already allocated space for these new NULLs */
101
+ + PORT_Assert(dest->len + 2 <= bufferSize);
102
+ + dest->len += 2;
103
+ + dest->data[dest->len - 1] = dest->data[dest->len - 2] = 0;
104
+ }
105
+ -
106
+ - if (!dest->data) {
107
+ - return PR_FALSE;
108
+ + /* ascii/utf-8 adds just 1 */
109
+ + } else if ((dest->len >= 1) && dest->data[dest->len-1]) {
110
+ + PORT_Assert(dest->len + 1 <= bufferSize);
111
+ + dest->len ++;
112
+ + dest->data[dest->len-1] = 0;
113
+ + }
114
+ + } else {
115
+ + /* handle the drop case, no need to do any allocations here. */
116
+ + if (toUnicode) {
117
+ + while ((dest->len >=2) && !dest->data[dest->len - 1] &&
118
+ + !dest->data[dest->len - 2]) {
119
+ + dest->len -= 2;
120
+ }
121
+ + } else while (dest->len && !dest->data[dest->len-1]) {
122
+ + dest->len--;
123
+ }
124
+ - dest->len += 2;
125
+ - dest->data[dest->len - 1] = dest->data[dest->len - 2] = 0;
126
+ }
127
+
128
+ return PR_TRUE;
129
+ }
130
+
131
+ PRBool
132
+ sec_pkcs12_is_pkcs12_pbe_algorithm(SECOidTag algorithm)
133
+ {
134
+ @@ -1006,27 +1020,28 @@ sec_pkcs12_is_pkcs12_pbe_algorithm(SECOi
135
+ }
136
+ }
137
+
138
+ /* this function decodes a password from Unicode if necessary,
139
+ * according to the PBE algorithm.
140
+ *
141
+ * we assume that the pwitem is already encoded in Unicode by the
142
+ * caller. if the encryption scheme is not the one defined in PKCS
143
+ - * #12, decode the pwitem back into UTF-8. */
144
+ + * #12, decode the pwitem back into UTF-8. NOTE: UTF-8 strings are
145
+ + * used in the PRF without the trailing NULL */
146
+ PRBool
147
+ sec_pkcs12_decode_password(PLArenaPool *arena,
148
+ SECItem *result,
149
+ SECOidTag algorithm,
150
+ const SECItem *pwitem)
151
+ {
152
+ if (!sec_pkcs12_is_pkcs12_pbe_algorithm(algorithm))
153
+ return sec_pkcs12_convert_item_to_unicode(arena, result,
154
+ (SECItem *)pwitem,
155
+ - PR_TRUE, PR_FALSE, PR_FALSE);
156
+ + PR_FALSE, PR_FALSE, PR_FALSE);
157
+
158
+ return SECITEM_CopyItem(arena, result, pwitem) == SECSuccess;
159
+ }
160
+
161
+ /* this function encodes a password into Unicode if necessary,
162
+ * according to the PBE algorithm.
163
+ *
164
+ * we assume that the pwitem holds a raw password. if the encryption
165
+ diff --git a/tests/common/init.sh b/tests/common/init.sh
166
+ --- a/tests/common/init.sh
167
+ +++ b/tests/common/init.sh
168
+ @@ -78,25 +78,27 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOU
169
+
170
+ CERT_EXTENSIONS_DIR=${HOSTDIR}/cert_extensions
171
+ STAPLINGDIR=${HOSTDIR}/stapling
172
+ NOLOGINDIR=${HOSTDIR}/nologin
173
+ SSLGTESTDIR=${HOSTDIR}/ssl_gtests
174
+ GTESTDIR=${HOSTDIR}/gtests
175
+
176
+ PWFILE=${HOSTDIR}/tests.pw
177
+ + LONGPWFILE=${HOSTDIR}/tests.longpw
178
+ EMPTY_FILE=${HOSTDIR}/tests_empty
179
+ NOISE_FILE=${HOSTDIR}/tests_noise
180
+ CORELIST_FILE=${HOSTDIR}/clist
181
+
182
+ FIPSPWFILE=${HOSTDIR}/tests.fipspw
183
+ FIPSBADPWFILE=${HOSTDIR}/tests.fipsbadpw
184
+ FIPSP12PWFILE=${HOSTDIR}/tests.fipsp12pw
185
+
186
+ echo nss > ${PWFILE}
187
+ + echo "nss123456789012345678901234567890123456789012345678901234567890_" > ${LONGPWFILE}
188
+ echo > ${EMPTY_FILE}
189
+ echo "fIps140" > ${FIPSPWFILE}
190
+ echo "fips104" > ${FIPSBADPWFILE}
191
+ echo "pKcs12fips140" > ${FIPSP12PWFILE}
192
+
193
+ noise
194
+
195
+ P_SERVER_CADIR=${SERVER_CADIR}
196
+ @@ -656,16 +658,17 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOU
197
+ P_R_NOLOGINDIR="multiaccess:${D_NOLOGIN}"
198
+ P_R_EXT_SERVERDIR="multiaccess:${D_EXT_SERVER}"
199
+ P_R_EXT_CLIENTDIR="multiaccess:${D_EXT_CLIENT}"
200
+ P_R_IMPLICIT_INIT_DIR="multiaccess:${D_IMPLICIT_INIT}"
201
+ P_R_RSAPSSDIR="multiaccess:${D_RSAPSS}"
202
+ fi
203
+
204
+ R_PWFILE=../tests.pw
205
+ + R_LONGPWFILE=../tests.longpw
206
+ R_EMPTY_FILE=../tests_empty
207
+ R_NOISE_FILE=../tests_noise
208
+
209
+ R_FIPSPWFILE=../tests.fipspw
210
+ R_FIPSBADPWFILE=../tests.fipsbadpw
211
+ R_FIPSP12PWFILE=../tests.fipsp12pw
212
+
213
+ trap "Exit $0 Signal_caught" 2 3
214
+ diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
215
+ --- a/tests/tools/tools.sh
216
+ +++ b/tests/tools/tools.sh
217
+ @@ -382,16 +382,40 @@ tools_p12_export_list_import_with_defaul
218
+ check_tmpfile
219
+
220
+ echo "$SCRIPTNAME: Listing Alice's pk12 EC file -----------------"
221
+ echo "pk12util -l Alice-ec.p12 -w ${R_PWFILE}"
222
+ ${BINDIR}/pk12util -l Alice-ec.p12 -w ${R_PWFILE} 2>&1
223
+ ret=$?
224
+ html_msg $ret 0 "Listing Alice's pk12 EC file (pk12util -l)"
225
+ check_tmpfile
226
+ +
227
+ + echo "$SCRIPTNAME: Exporting Alice's email EC cert & key with long pw------"
228
+ + echo "pk12util -o Alice-ec-long.p12 -n \"Alice-ec\" -d ${P_R_ALICEDIR} -k ${R_PWFILE} \\"
229
+ + echo " -w ${R_LONGPWFILE}"
230
+ + ${BINDIR}/pk12util -o Alice-ec-long.p12 -n "Alice-ec" -d ${P_R_ALICEDIR} -k ${R_PWFILE} \
231
+ + -w ${R_LONGPWFILE} 2>&1
232
+ + ret=$?
233
+ + html_msg $ret 0 "Exporting Alice's email EC cert & key with long pw (pk12util -o)"
234
+ + check_tmpfile
235
+ + verify_p12 Alice-ec-long.p12 "default" "default" "default"
236
+ +
237
+ + echo "$SCRIPTNAME: Importing Alice's email EC cert & key with long pw-----"
238
+ + echo "pk12util -i Alice-ec-long.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_LONGPWFILE}"
239
+ + ${BINDIR}/pk12util -i Alice-ec-long.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_LONGPWFILE} 2>&1
240
+ + ret=$?
241
+ + html_msg $ret 0 "Importing Alice's email EC cert & key with long pw (pk12util -i)"
242
+ + check_tmpfile
243
+ +
244
+ + echo "$SCRIPTNAME: Listing Alice's pk12 EC file with long pw ------------"
245
+ + echo "pk12util -l Alice-ec-long.p12 -w ${R_LONGPWFILE}"
246
+ + ${BINDIR}/pk12util -l Alice-ec-long.p12 -w ${R_LONGPWFILE} 2>&1
247
+ + ret=$?
248
+ + html_msg $ret 0 "Listing Alice's pk12 EC file with long pw (pk12util -l)"
249
+ + check_tmpfile
250
+ }
251
+
252
+ tools_p12_import_old_files()
253
+ {
254
+ echo "$SCRIPTNAME: Importing PKCS#12 files created with older NSS --------------"
255
+ echo "pk12util -i TestOldCA.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE}"
256
+ ${BINDIR}/pk12util -i ${TOOLSDIR}/data/TestOldCA.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE} 2>&1
257
+ ret=$?
file removed
-63
SOURCES/secmod.db.xml DELETED
@@ -1,63 +0,0 @@
1
- <?xml version='1.0' encoding='utf-8'?>
2
- <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3
- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
4
- <!ENTITY date SYSTEM "date.xml">
5
- <!ENTITY version SYSTEM "version.xml">
6
- ]>
7
-
8
- <refentry id="secmod.db">
9
-
10
- <refentryinfo>
11
- <date>&date;</date>
12
- <title>Network Security Services</title>
13
- <productname>nss</productname>
14
- <productnumber>&version;</productnumber>
15
- </refentryinfo>
16
-
17
- <refmeta>
18
- <refentrytitle>secmod.db</refentrytitle>
19
- <manvolnum>5</manvolnum>
20
- </refmeta>
21
-
22
- <refnamediv>
23
- <refname>secmod.db</refname>
24
- <refpurpose>Legacy NSS security modules database</refpurpose>
25
- </refnamediv>
26
-
27
- <refsection id="description">
28
- <title>Description</title>
29
- <para><emphasis>secmod.db</emphasis> is an NSS security modules database.</para>
30
- <para>The security modules database is used to keep track of the NSS security modules. The NSS security modules export their services via the PKCS #11 API which NSS uses as its Services Provider Interface.
31
- </para>
32
- <para>The command line utility <emphasis>modutil</emphasis> is used for managing PKCS #11 module information both within secmod.db files and within hardware tokens.
33
- </para>
34
- <para>For new applications the recommended way of tracking security modules is via the pkcs11.txt configuration file used in conjunction the new sqlite-based shared database format for certificate and key databases.
35
- </para>
36
- </refsection>
37
-
38
- <refsection>
39
- <title>Files</title>
40
- <para><filename>/etc/pki/nssdb/secmod.db</filename></para>
41
- </refsection>
42
-
43
- <refsection>
44
- <title>See also</title>
45
- <para>modutil(1), cert8.db(5), cert9.db(5), key3.db(5), key4.db(5), pkcs11.txt(5)</para>
46
- </refsection>
47
-
48
- <refsection id="authors">
49
- <title>Authors</title>
50
- <para>The nss libraries were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</para>
51
- <para>Authors: Elio Maldonado &lt;emaldona@redhat.com>.</para>
52
- </refsection>
53
-
54
- <!-- don't change -->
55
- <refsection id="license">
56
- <title>LICENSE</title>
57
- <para>Licensed under the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
58
- </para>
59
-
60
- </refsection>
61
-
62
-
63
- </refentry>
file modified
+47 -13
SPECS/nss.spec CHANGED
@@ -4,7 +4,7 @@
4
4
# - increment %%{nspr_version}, when updating the NSS part only
5
5
# - put the nss_release number here next to nspr, as they both
6
6
# need to be updated on a given release
7
- %global nss_release 3
7
+ %global nss_release 7
8
8
%global nspr_release %[ %nss_release+2]
9
9
%global nss_version 3.71.0
10
10
# only need to update this as we added new
@@ -90,22 +90,28 @@ Source6: nss-softokn-dracut-module-setup.sh
90
90
Source7: nss-softokn-dracut.conf
91
91
Source8: nss.pc.in
92
92
Source9: nss-config.in
93
+ %if %{with dbm}
93
94
Source10: blank-cert8.db
94
95
Source11: blank-key3.db
95
96
Source12: blank-secmod.db
97
+ %endif
96
98
Source13: blank-cert9.db
97
99
Source14: blank-key4.db
98
100
Source15: system-pkcs11.txt
99
101
Source16: setup-nsssysinit.sh
100
102
Source20: nss-config.xml
101
103
Source21: setup-nsssysinit.xml
102
- Source22: pkcs11.txt.xml
104
+ %if %{with dbm}
103
105
Source23: cert8.db.xml
104
- Source24: cert9.db.xml
105
106
Source25: key3.db.xml
106
- Source26: key4.db.xml
107
107
Source27: secmod.db.xml
108
+ %endif
109
+ Source22: pkcs11.txt.xml
110
+ Source24: cert9.db.xml
111
+ Source26: key4.db.xml
108
112
Source28: nss-p11-kit.config
113
+ Source30: PayPalEE.cert
114
+
109
115
110
116
Source100: nspr-%{nspr_archive_version}.tar.gz
111
117
Source101: nspr-config.xml
@@ -140,6 +146,12 @@ Patch50: nss-3.71-fips-module-name.patch
140
146
# upstream bug https://buzilla.mozilla.org/show_bug.cgi?id=1737470
141
147
Patch60: nss-3.67-cve-2021-43527.patch
142
148
Patch70: nss-3.67-cve-2021-43527-test.patch
149
+ # not upstreamable patch...
150
+ Patch80: nss-3.71-fix-lto-gtests.patch
151
+ # camellia pkcs12 docs.
152
+ patch85: nss-3.71-camellia-pkcs12-doc.patch
153
+ # fix issue with long passwords in pkcs12
154
+ patch90: nss-3.75-fix-pkcs12-passwords.patch
143
155
144
156
Patch100: nspr-config-pc.patch
145
157
Patch101: nspr-gcc-atomics.patch
@@ -301,6 +313,7 @@ Header files for doing development with the Netscape Portable Runtime.
301
313
%setup -q -T -b 0 -n %{name}-%{nss_archive_version}
302
314
mv ../nspr-%{nspr_archive_version}/nspr .
303
315
cp ./nspr/config/nspr-config.in ./nspr/config/nspr-config-pc.in
316
+ %{__cp} %{SOURCE30} -f ./nss/tests/libpkix/certs
304
317
305
318
%patch100 -p0 -b .flags
306
319
pushd nspr
@@ -361,7 +374,7 @@ popd
361
374
# Build NSS
362
375
#
363
376
# This package fails its testsuite with LTO. Disable LTO for now
364
- %global _lto_cflags %{nil}
377
+ #%%global _lto_cflags %%{nil}
365
378
366
379
#export FREEBL_NO_DEPEND=1
367
380
@@ -540,20 +553,22 @@ date +"%e %B %Y" | tr -d '\n' > date.xml
540
553
echo -n %{nss_version} > version.xml
541
554
542
555
# configuration files and setup script
543
- for m in %{SOURCE20} %{SOURCE21} %{SOURCE22}; do
556
+ for m in %{SOURCE20} %{SOURCE21} %{SOURCE22} %{SOURCE24} %{SOURCE26}; do
544
557
cp ${m} .
545
558
done
546
- for m in nss-config.xml setup-nsssysinit.xml pkcs11.txt.xml; do
559
+ for m in nss-config.xml setup-nsssysinit.xml pkcs11.txt.xml cert9.db.xml key4.db.xml; do
547
560
xmlto man ${m}
548
561
done
549
562
550
- # nss databases considered to be configuration files
551
- for m in %{SOURCE23} %{SOURCE24} %{SOURCE25} %{SOURCE26} %{SOURCE27}; do
563
+ %if %{with dbm}
564
+ # nss dbm databases
565
+ for m in %{SOURCE23} %{SOURCE25} %{SOURCE27}; do
552
566
cp ${m} .
553
567
done
554
- for m in cert8.db.xml cert9.db.xml key3.db.xml key4.db.xml secmod.db.xml; do
568
+ for m in cert8.db.xml key3.db.xml secmod.db.xml; do
555
569
xmlto man ${m}
556
570
done
571
+ %endif
557
572
558
573
559
574
%check
@@ -704,9 +719,11 @@ done
704
719
# Install the empty NSS db files
705
720
# Legacy db
706
721
mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/pki/nssdb
722
+ %if %{with dbm}
707
723
install -p -m 644 %{SOURCE10} $RPM_BUILD_ROOT/%{_sysconfdir}/pki/nssdb/cert8.db
708
724
install -p -m 644 %{SOURCE11} $RPM_BUILD_ROOT/%{_sysconfdir}/pki/nssdb/key3.db
709
725
install -p -m 644 %{SOURCE12} $RPM_BUILD_ROOT/%{_sysconfdir}/pki/nssdb/secmod.db
726
+ %endif
710
727
# Shared db
711
728
install -p -m 644 %{SOURCE13} $RPM_BUILD_ROOT/%{_sysconfdir}/pki/nssdb/cert9.db
712
729
install -p -m 644 %{SOURCE14} $RPM_BUILD_ROOT/%{_sysconfdir}/pki/nssdb/key4.db
@@ -782,13 +799,15 @@ install -c -m 644 ./dist/docs/nroff/pp.1 $RPM_BUILD_ROOT%{_datadir}/doc/nss-tool
782
799
%endif
783
800
784
801
# Copy the man pages for the configuration files
785
- for f in pkcs11.txt; do
802
+ for f in pkcs11.txt cert9.db key4.db; do
786
803
install -c -m 644 ${f}.5 $RPM_BUILD_ROOT%{_mandir}/man5/${f}.5
787
804
done
788
- # Copy the man pages for the nss databases
789
- for f in cert8.db cert9.db key3.db key4.db secmod.db; do
805
+ # Copy the man pages for the nss dbm databases
806
+ %if %{with dbm}
807
+ for f in cert8.db key3.db secmod.db; do
790
808
install -c -m 644 ${f}.5 $RPM_BUILD_ROOT%{_mandir}/man5/${f}.5
791
809
done
810
+ %endif
792
811
793
812
# Copy the crypto-policies configuration file
794
813
install -p -m 644 %{SOURCE28} $RPM_BUILD_ROOT/%{_sysconfdir}/crypto-policies/local.d
@@ -823,16 +842,20 @@ update-crypto-policies &> /dev/null || :
823
842
%{_libdir}/libssl3.so
824
843
%{_libdir}/libsmime3.so
825
844
%dir %{_sysconfdir}/pki/nssdb
845
+ %if %{with dbm}
826
846
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/cert8.db
827
847
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/key3.db
828
848
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/secmod.db
849
+ %endif
829
850
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/cert9.db
830
851
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/key4.db
831
852
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/pkcs11.txt
832
853
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/crypto-policies/local.d/nss-p11-kit.config
854
+ %if %{with dbm}
833
855
%doc %{_mandir}/man5/cert8.db.5*
834
856
%doc %{_mandir}/man5/key3.db.5*
835
857
%doc %{_mandir}/man5/secmod.db.5*
858
+ %endif
836
859
%doc %{_mandir}/man5/cert9.db.5*
837
860
%doc %{_mandir}/man5/key4.db.5*
838
861
%doc %{_mandir}/man5/pkcs11.txt.5*
@@ -1084,6 +1107,17 @@ update-crypto-policies &> /dev/null || :
1084
1107
1085
1108
1086
1109
%changelog
1110
+ * Wed Feb 16 2022 Bob Relyea <rrelyea@redhat.com> - 3.71.0-7
1111
+ - Fix handling of pkcs12 passwords for PKCS5v2 cases which causes failures
1112
+ on long passwords.
1113
+
1114
+ * Wed Jan 26 2022 Bob Relyea <rrelyea@redhat.com> - 3.71.0-6
1115
+ - update pkcs12 documentation to include camellia
1116
+ - turn on lto
1117
+
1118
+ * Wed Jan 12 2022 Bob Relyea <rrelyea@redhat.com> - 3.71.0-5
1119
+ - remove old dbm files from the build
1120
+
1087
1121
* Wed Dec 1 2021 Bob Relyea <rrelyea@redhat.com> - 3.71.0-2
1088
1122
- Fix CVE-2021-43527
1089
1123

Powered by Pagure 5.14.1

SSH Hostkey/Fingerprint | Documentation