- update to NSS 3.25

New functionality:
  * Implemented DHE key agreement for TLS 1.3
  * Added support for ChaCha with TLS 1.3
  * Added support for TLS 1.2 ciphersuites that use SHA384 as the PRF
  * In previous versions, when using client authentication with TLS 1.2,
    NSS only supported certificate_verify messages that used the same
    signature hash algorithm as used by the PRF. This limitation has
    been removed.
  * Several functions have been added to the public API of the
    NSS Cryptoki Framework.
  New functions:
  * NSSCKFWSlot_GetSlotID
  * NSSCKFWSession_GetFWSlot
  * NSSCKFWInstance_DestroySessionHandle
  * NSSCKFWInstance_FindSessionHandle
  Notable changes:
  * An SSL socket can no longer be configured to allow both TLS 1.3 and SSLv3
  * Regression fix: NSS no longer reports a failure if an application
    attempts to disable the SSLv2 protocol.
  * The list of trusted CA certificates has been updated to version 2.8
  * The following CA certificate was Removed
    Sonera Class1 CA
  * The following CA certificates were Added
    Hellenic Academic and Research Institutions RootCA 2015
    Hellenic Academic and Research Institutions ECC RootCA 2015
    Certplus Root CA G1
    Certplus Root CA G2
    OpenTrust Root CA G1
    OpenTrust Root CA G2

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=221

mozilla-nss.changes

@@ -1,3 +1,38 @@
+-------------------------------------------------------------------
+Mon Aug 22 13:02:08 UTC 2016 - wr@rosenauer.org
+
+- update to NSS 3.25
+  New functionality:
+  * Implemented DHE key agreement for TLS 1.3
+  * Added support for ChaCha with TLS 1.3
+  * Added support for TLS 1.2 ciphersuites that use SHA384 as the PRF
+  * In previous versions, when using client authentication with TLS 1.2,
+    NSS only supported certificate_verify messages that used the same
+    signature hash algorithm as used by the PRF. This limitation has
+    been removed.
+  * Several functions have been added to the public API of the
+    NSS Cryptoki Framework.
+  New functions:
+  * NSSCKFWSlot_GetSlotID
+  * NSSCKFWSession_GetFWSlot
+  * NSSCKFWInstance_DestroySessionHandle
+  * NSSCKFWInstance_FindSessionHandle
+  Notable changes:
+  * An SSL socket can no longer be configured to allow both TLS 1.3 and SSLv3
+  * Regression fix: NSS no longer reports a failure if an application
+    attempts to disable the SSLv2 protocol.
+  * The list of trusted CA certificates has been updated to version 2.8
+  * The following CA certificate was Removed
+    Sonera Class1 CA
+  * The following CA certificates were Added
+    Hellenic Academic and Research Institutions RootCA 2015
+    Hellenic Academic and Research Institutions ECC RootCA 2015
+    Certplus Root CA G1
+    Certplus Root CA G2
+    OpenTrust Root CA G1
+    OpenTrust Root CA G2
+    OpenTrust Root CA G3
+
 -------------------------------------------------------------------
 Mon Aug 22 12:54:15 UTC 2016 - wr@rosenauer.org
 

mozilla-nss.spec

@@ -25,7 +25,7 @@ BuildRequires:  mozilla-nspr-devel >= 4.12
 BuildRequires:  pkg-config
 BuildRequires:  sqlite-devel
 BuildRequires:  zlib-devel
-Version:        3.24
+Version:        3.25
 Release:        0
 # bug437293
 %ifarch ppc64
@@ -36,8 +36,8 @@ Summary:        Network Security Services
 License:        MPL-2.0
 Group:          System/Libraries
 Url:            http://www.mozilla.org/projects/security/pki/nss/
-Source:         https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_24_RTM/src/nss-%{version}.tar.gz
+Source:         https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_25_RTM/src/nss-%{version}.tar.gz
-# hg clone https://hg.mozilla.org/projects/nss nss-3.24/nss ; cd nss-3.24/nss ; hg up NSS_3_24_RTM
+# hg clone https://hg.mozilla.org/projects/nss nss-3.25/nss ; cd nss-3.25/nss ; hg up NSS_3_25_RTM
 #Source:         nss-%{version}.tar.gz
 Source1:        nss.pc.in
 Source3:        nss-config.in

nss-3.24.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:2f0841492f91cca473b73dec6cab9cf765a485e032d48d2e8ae7261e54c419ed
-size 7307782

nss-3.25.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5d1ad475da19d0c033a716350dc5f8a747999d3eba5ac07ee0368c5bad6e2359
+size 7338238

renegotiate-transitional.patch

@@ -1,22 +1,13 @@
 diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
+index dc83219..276f4a8 100644
 --- a/lib/ssl/sslsock.c
 +++ b/lib/ssl/sslsock.c
-@@ -72,17 +72,17 @@ static sslOptions ssl_defaults = {
+@@ -72,7 +72,7 @@ static sslOptions ssl_defaults = {
-     PR_FALSE,
+     PR_FALSE,              /* noLocks            */
-     /* v2CompatibleHello  */ /* now defaults to off in NSS 3.13 */
+     PR_FALSE,              /* enableSessionTickets */
-     PR_TRUE,                 /* detectRollBack     */
+     PR_FALSE,              /* enableDeflate      */
-     PR_FALSE,                /* noStepDown         */
+-    2,                     /* enableRenegotiation (default: requires extension) */
-     PR_FALSE,                /* bypassPKCS11       */
++    3,                     /* enableRenegotiation (default: requires extension) */
-     PR_FALSE,                /* noLocks            */
+     PR_FALSE,              /* requireSafeNegotiation */
-     PR_FALSE,                /* enableSessionTickets */
+     PR_FALSE,              /* enableFalseStart   */
-     PR_FALSE,                /* enableDeflate      */
+     PR_TRUE,               /* cbcRandomIV        */
--    2,                       /* enableRenegotiation (default: requires extension) */
-+    3,                       /* enableRenegotiation (default: requires extension) */
-     PR_FALSE,                /* requireSafeNegotiation */
-     PR_FALSE,                /* enableFalseStart   */
-     PR_TRUE,                 /* cbcRandomIV        */
-     PR_FALSE,                /* enableOCSPStapling */
-     PR_TRUE,                 /* enableNPN          */
-     PR_FALSE,                /* enableALPN         */
-     PR_TRUE,                 /* reuseServerECDHEKey */
-     PR_FALSE,                /* enableFallbackSCSV */