Commit Graph

209 Commits

Author SHA256 Message Date
Wolfgang Rosenauer
d4c9f5a5cf - update to NSS 3.33
Notable changes
  * TLS compression is no longer supported. API calls that attempt
    to enable compression are accepted without failure. However,
    TLS compression will remain disabled.
  * This version of NSS uses a formally verified implementation of
    Curve25519 on 64-bit systems.
  * The compile time flag DISABLE_ECC has been removed.
  * When NSS is compiled without NSS_FORCE_FIPS=1 startup checks
    are not performed anymore.
  * Various minor improvements and correctness fixes.
  New functionality
  * When listing an NSS database using certutil -L, but the database
    hasn't yet been initialized with any non-empty or empty password,
    the text "Database needs user init" will be included in the listing.
  * When using certutil to set an inacceptable password in FIPS mode,
    a correct explanation of acceptable passwords will be printed.
  New functions
  * CERT_FindCertByIssuerAndSNCX - a variation of existing function
    CERT_FindCertByIssuerAndSN that accepts an additional password
    context parameter.
  * CERT_FindCertByNicknameOrEmailAddrCX - a variation of existing
    function CERT_FindCertByNicknameOrEmailAddr that accepts an
    additional password context parameter.
  * CERT_FindCertByNicknameOrEmailAddrForUsageCX - a variation of
    existing function CERT_FindCertByNicknameOrEmailAddrForUsage that
    accepts an additional password context parameter.
  * NSS_SecureMemcmpZero - check if a memory region is all zero in
    constant time.
  * PORT_ZAllocAligned - allocate aligned memory.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=250
2017-10-04 20:50:43 +00:00
Wolfgang Rosenauer
ee4c12609b - update to NSS 3.32.1
* no upstream changelog/releasenote provided

- update to NSS 3.32
  Notable changes
  * Various minor improvements and correctness fixes.
  * The Code Signing trust bit was turned off for all included root certificates.
  * The Websites (TLS/SSL) trust bit was turned off for the following
    root certificates:
    AddTrust Class 1 CA Root
    Swisscom Root CA 2
  * The following CA certificates were Removed:
    AddTrust Public CA Root
    AddTrust Qualified CA Root
    China Internet Network Information Center EV Certificates Root
    CNNIC ROOT
    ComSign Secured CA
    GeoTrust Global CA 2
    Secure Certificate Services
    Swisscom Root CA 1
    Swisscom Root EV CA 2
    Trusted Certificate Services
    UTN-USERFirst-Hardware
    UTN-USERFirst-Object
- requires NSPR 4.16

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=248
2017-09-21 07:14:07 +00:00
Wolfgang Rosenauer
7da2ef870f - update to NSS 3.31.1
* Potential deadlock when using an external PKCS#11 token (bmo#1381784)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=246
2017-09-12 08:58:38 +00:00
Wolfgang Rosenauer
279fac0f79 - removed obsolete nss-fix-hash.patch
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=244
2017-08-11 07:28:38 +00:00
Wolfgang Rosenauer
3acc6b79e5 - update to NSS 3.31
New functionality
  * Allow certificates to be specified by RFC7512 PKCS#11 URIs.
  * Allow querying a certificate object for its temporary or permanent
    storage status in a thread safe way.
  New functions
  * CERT_GetCertIsPerm - retrieve the permanent storage status attribute of a
    certificate in a thread safe way.
  * CERT_GetCertIsTemp - retrieve the temporary storage status attribute of a
    certificate in a thread safe way.
  * PK11_FindCertFromURI - find a certificate identified by the given URI.
  * PK11_FindCertsFromURI - find a list of certificates identified by the given
    URI.
  * PK11_GetModuleURI - retrieve the URI of the given module.
  * PK11_GetTokenURI - retrieve the URI of a token based on the given slot
    information.
  * PK11URI_CreateURI - create a new PK11URI object from a set of attributes.
  * PK11URI_DestroyURI - destroy a PK11URI object.
  * PK11URI_FormatURI - format a PK11URI object to a string.
  * PK11URI_GetPathAttribute - retrieve a path attribute with the given name.
  * PK11URI_GetQueryAttribute - retrieve a query attribute with the given name.
  * PK11URI_ParseURI - parse PKCS#11 URI and return a new PK11URI object.
  New macros
  * Several new macros that start with PK11URI_PATTR_ for path attributes defined
    in RFC7512.
  * Several new macros that start with PK11URI_QATTR_ for query attributes defined
    in RFC7512.
  Notable changes
  * The APIs that set a TLS version range have been changed to trim the requested
    range to the overlap with a systemwide crypto policy, if configured.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=243
2017-08-08 18:40:45 +00:00
Wolfgang Rosenauer
8a54093a7b - update to NSS 3.30.2
New Functionality
  * In the PKCS#11 root CA module (nssckbi), CAs with positive trust
    are marked with a new boolean attribute, CKA_NSS_MOZILLA_CA_POLICY,
    set to true. Applications that need to distinguish them from other
    other root CAs, may use the exported function PK11_HasAttributeSet.
  * Support for callback functions that can be used to monitor SSL/TLS
    alerts that are sent or received.
  New Functions
  * CERT_CompareAVA - performs a comparison of two CERTAVA structures,
    and returns a SECComparison result.
  * PK11_HasAttributeSet - allows to check if a PKCS#11 object in a
    given slot has a specific boolean attribute set.
  * SSL_AlertReceivedCallback - register a callback function, that will
    be called whenever an SSL/TLS alert is received
  * SSL_AlertSentCallback - register a callback function, that will be
    called whenever an SSL/TLS alert is sent
  * SSL_SetSessionTicketKeyPair - configures an asymmetric key pair,
    for use in wrapping session ticket keys, used by the server. This
    function currently only accepts an RSA public/private key pair.
  New Macros
  * PKCS12_AES_CBC_128, PKCS12_AES_CBC_192, PKCS12_AES_CBC_256
    cipher family identifiers corresponding to the PKCS#5 v2.1 AES
    based encryption schemes used in the PKCS#12 support in NSS
  * CKA_NSS_MOZILLA_CA_POLICY - identifier for a boolean PKCS#11
    attribute, that should be set to true, if a CA is present because
    of it's acceptance according to the Mozilla CA Policy
  Notable Changes
  * The TLS server code has been enhanced to support session tickets
    when no RSA certificate (e.g. only an ECDSA certificate) is configured.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=241
2017-04-26 21:50:12 +00:00
Wolfgang Rosenauer
607f63b358 (boo#1015499, bmo#1320695) (nss-bmo1320695.patch)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=239
2017-04-12 21:31:19 +00:00
Wolfgang Rosenauer
c072bb869b - Allow use of session tickets when there is no ticket wrapping key
(boo#1015499, bmo#1320695)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=238
2017-04-12 21:26:25 +00:00
Wolfgang Rosenauer
32ecde7ac4 - update to NSS 3.29.5
* Rare crashes in the base 64 decoder and encoder were fixed.
    (bmo#1344380)
  * A carry over bug in the RNG was fixed. (bmo#1345089)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=237
2017-04-09 08:24:38 +00:00
Wolfgang Rosenauer
0fddc4108c - update to NSS 3.29.3
* enables TLS 1.3 by default
- TLS 1.3 was already enabled in 3.28.x builds for openSUSE.
  This build option was removed.
- required for Firefox 53

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=235
2017-03-22 22:17:03 +00:00
Wolfgang Rosenauer
11f3cdd1a0 Accepting request 479929 from home:rguenther:branches:mozilla:Factory
- Add nss-fix-hash.patch to fix hash computation (and build with
  GCC 7 which complains about shifts of boolean values).

OBS-URL: https://build.opensuse.org/request/show/479929
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=233
2017-03-16 13:54:28 +00:00
Wolfgang Rosenauer
521acd1a2e - update to NSS 3.28.3
* This is a patch release to fix binary compatibility issues.
    NSS version 3.28, 3.28.1 and 3.28.2 contained changes that were
    in violation with the NSS compatibility promise.
    ECParams, which is part of the public API of the freebl/softokn
    parts of NSS, had been changed to include an additional attribute.
    That size increase caused crashes or malfunctioning with applications
    that use that data structure directly, or indirectly through
    ECPublicKey, ECPrivateKey, NSSLOWKEYPublicKey, NSSLOWKEYPrivateKey,
    or potentially other data structures that reference ECParams.
    The change has been reverted to the original state in bug
    bmo#1334108.
    SECKEYECPublicKey had been extended with a new attribute, named
    "encoding". If an application passed type SECKEYECPublicKey to NSS
    (as part of SECKEYPublicKey), the NSS library read the uninitialized
    attribute. With this NSS release SECKEYECPublicKey.encoding is
    deprecated. NSS no longer reads the attribute, and will always
    set it to ECPoint_Undefined. See bug bmo#1340103.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=231
2017-02-20 11:58:02 +00:00
Wolfgang Rosenauer
563cf68233 - update to NSS 3.28.2
This is a stability and compatibility release. Below is a summary of
  the changes.
  * Fixed a NSS 3.28 regression in the signature scheme flexibility that
    causes connectivity issues between iOS 8 clients and NSS servers
    with ECDSA certificates (bmo#1334114)
  * Fixed a possible crash on some Windows systems (bmo#1323150)
  * Fixed a compatibility issue with TLS clients that do not provide a
    list of supported key exchange groups (bmo#1330612)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=228
2017-02-12 07:39:39 +00:00
Wolfgang Rosenauer
0dac9b9d86 - raised the minimum softokn/freebl version to 3.28 as reported in
boo#1021636

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=226
2017-01-25 10:29:48 +00:00
Wolfgang Rosenauer
d5e09fcf99 - update to NSS 3.28.1
No new functionality is introduced in this release. This is a patch release to
  update the list of root CA certificates and address a minor TLS compatibility
  issue that some applications experienced with NSS 3.28.
  * The following CA certificates were Removed
    CN = Buypass Class 2 CA 1
    CN = Root CA Generalitat Valenciana
    OU = RSA Security 2048 V3
  * The following CA certificates were Added
    OU = AC RAIZ FNMT-RCM
    CN = Amazon Root CA 1
    CN = Amazon Root CA 2
    CN = Amazon Root CA 3
    CN = Amazon Root CA 4
    CN = LuxTrust Global Root 2
    CN = Symantec Class 1 Public Primary Certification Authority - G4
    CN = Symantec Class 1 Public Primary Certification Authority - G6
    CN = Symantec Class 2 Public Primary Certification Authority - G4
    CN = Symantec Class 2 Public Primary Certification Authority - G6
  * The version number of the updated root CA list has been set to 2.11
  * A misleading assertion/alert has been removed when NSS tries to flush data
    to the peer but the connection was already reset.
- update to NSS 3.28
  New functionality:
  * NSS includes support for TLS 1.3 draft -18. This includes a number
    of improvements to TLS 1.3:
    - The signed certificate timestamp, used in certificate
      transparency, is supported in TLS 1.3.
    - Key exporters for TLS 1.3 are supported. This includes the early
      key exporter, which can be used if 0-RTT is enabled. Note that

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=225
2017-01-18 22:18:23 +00:00
Wolfgang Rosenauer
d90646d547 - update to NSS 3.26.2
* required for Firefox 50.0
  Changes in 3.26
  New Functionality:
  * the selfserv test utility has been enhanced to support ALPN
    (HTTP/1.1) and 0-RTT
  * added support for the System-wide crypto policy available on
    Fedora Linux see http://fedoraproject.org/wiki/Changes/CryptoPolicy
  * introduced build flag NSS_DISABLE_LIBPKIX that allows compilation
    of NSS without the libpkix library
  Notable Changes:
  * The following CA certificate was Added
    CN = ISRG Root X1
  * NPN is disabled and ALPN is enabled by default
  * the NSS test suite now completes with the experimental TLS 1.3
    code enabled
  * several test improvements and additions, including a NIST known answer test
  Changes in 3.26.2
  * MD5 signature algorithms sent by the server in CertificateRequest
    messages are now properly ignored. Previously, with rare server
    configurations, an MD5 signature algorithm might have been selected
    for client authentication and caused the client to abort the
    connection soon after.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=223
2016-11-14 12:44:27 +00:00
Wolfgang Rosenauer
eae31781bc - update to NSS 3.25
New functionality:
  * Implemented DHE key agreement for TLS 1.3
  * Added support for ChaCha with TLS 1.3
  * Added support for TLS 1.2 ciphersuites that use SHA384 as the PRF
  * In previous versions, when using client authentication with TLS 1.2,
    NSS only supported certificate_verify messages that used the same
    signature hash algorithm as used by the PRF. This limitation has
    been removed.
  * Several functions have been added to the public API of the
    NSS Cryptoki Framework.
  New functions:
  * NSSCKFWSlot_GetSlotID
  * NSSCKFWSession_GetFWSlot
  * NSSCKFWInstance_DestroySessionHandle
  * NSSCKFWInstance_FindSessionHandle
  Notable changes:
  * An SSL socket can no longer be configured to allow both TLS 1.3 and SSLv3
  * Regression fix: NSS no longer reports a failure if an application
    attempts to disable the SSLv2 protocol.
  * The list of trusted CA certificates has been updated to version 2.8
  * The following CA certificate was Removed
    Sonera Class1 CA
  * The following CA certificates were Added
    Hellenic Academic and Research Institutions RootCA 2015
    Hellenic Academic and Research Institutions ECC RootCA 2015
    Certplus Root CA G1
    Certplus Root CA G2
    OpenTrust Root CA G1
    OpenTrust Root CA G2

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=221
2016-09-19 19:25:03 +00:00
Wolfgang Rosenauer
a4d9b31978 - fix build on certain toolchains (nss-uninitialized.patch)
jarfile.c:805:13: error: 'it' may be used uninitialized in this
  function [-Werror=maybe-uninitialized]

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=219
2016-08-22 12:58:09 +00:00
Wolfgang Rosenauer
10edbe58e9 - also sign libfreeblpriv3.so to allow FIPS mode again (boo#992236)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=217
2016-08-05 05:48:45 +00:00
Wolfgang Rosenauer
05db003205 - update to NSS 3.24
New functionality:
  * NSS softoken has been updated with the latest National Institute
    of Standards and Technology (NIST) guidance (as of 2015):
    - Software integrity checks and POST functions are executed on
      shared library load. These checks have been disabled by default,
      as they can cause a performance regression. To enable these
      checks, you must define symbol NSS_FORCE_FIPS when building NSS.
    - Counter mode and Galois/Counter Mode (GCM) have checks to
      prevent counter overflow.
    - Additional CSPs are zeroed in the code.
    - NSS softoken uses new guidance for how many Rabin-Miller tests
      are needed to verify a prime based on prime size.
  * NSS softoken has also been updated to allow NSS to run in FIPS
    Level 1 (no password). This mode is triggered by setting the
    database password to the empty string. In FIPS mode, you may move
    from Level 1 to Level 2 (by setting an appropriate password),
    but not the reverse.
  * A SSL_ConfigServerCert function has been added for configuring
    SSL/TLS server sockets with a certificate and private key. Use
    this new function in place of SSL_ConfigSecureServer,
    SSL_ConfigSecureServerWithCertChain, SSL_SetStapledOCSPResponses,
    and SSL_SetSignedCertTimestamps. SSL_ConfigServerCert automatically
    determines the certificate type from the certificate and private key.
    The caller is no longer required to use SSLKEAType explicitly to
    select a "slot" into which the certificate is configured (which
    incorrectly identifies a key agreement type rather than a certificate).
    Separate functions for configuring Online Certificate Status Protocol
    (OCSP) responses or Signed Certificate Timestamps are not needed,
    since these can be added to the optional SSLExtraServerCertData struct

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=216
2016-07-31 10:48:39 +00:00
Wolfgang Rosenauer
ec6a54a194 Accepting request 400673 from home:AndreasStieger:branches:mozilla:Factory
CVE-2016-1950 was already fixed in 3.22.3, add there.
Add CVE-2016-2834 to 3.23 section

OBS-URL: https://build.opensuse.org/request/show/400673
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=214
2016-06-08 12:57:14 +00:00
Wolfgang Rosenauer
f2c3469da1 - update to NSS 3.23
New functionality:
  * ChaCha20/Poly1305 cipher and TLS cipher suites now supported
  * Experimental-only support TLS 1.3 1-RTT mode (draft-11).
    This code is not ready for production use.
  New functions:
  * SSL_SetDowngradeCheckVersion - Set maximum version for new
    ServerRandom anti-downgrade mechanism. Clients that perform a
    version downgrade (which is generally a very bad idea) call this
    with the highest version number that they possibly support.
    This gives them access to the version downgrade protection from
    TLS 1.3.
  Notable changes:
  * The copy of SQLite shipped with NSS has been updated to version
    3.10.2
  * The list of TLS extensions sent in the TLS handshake has been
    reordered to increase compatibility of the Extended Master Secret
    with with servers
  * The build time environment variable NSS_ENABLE_ZLIB has been
    renamed to NSS_SSL_ENABLE_ZLIB
  * The build time environment variable NSS_DISABLE_CHACHAPOLY was
    added, which can be used to prevent compilation of the
    ChaCha20/Poly1305 code.
  * The following CA certificates were Removed
    - Staat der Nederlanden Root CA
    - NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado
    - NetLock Kozjegyzoi (Class A) Tanusitvanykiado
    - NetLock Uzleti (Class B) Tanusitvanykiado
    - NetLock Expressz (Class C) Tanusitvanykiado
    - VeriSign Class 1 Public PCA – G2

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=212
2016-05-26 20:20:47 +00:00
Wolfgang Rosenauer
fb6ae8911f Accepting request 390595 from home:michel_mno:branches:mozilla:Factory
-  add nss_gcc6_change.patch
to avoid build error in https://build.opensuse.org/package/show/openSUSE:Factory:Staging:Gcc6/mozilla-nss

OBS-URL: https://build.opensuse.org/request/show/390595
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=211
2016-04-18 20:51:42 +00:00
Wolfgang Rosenauer
a9a3622567 - update to NSS 3.22.3
* required for Firefox 46.0
  * Increase compatibility of TLS extended master secret,
    don't send an empty TLS extension last in the handshake
    (bmo#1243641)

- update to NSS 3.22.2
  New functionality:
  * RSA-PSS signatures are now supported (bmo#1215295)
  * Pseudorandom functions based on hashes other than SHA-1 are now supported
  * Enforce an External Policy on NSS from a config file (bmo#1009429)
  New functions:
  * PK11_SignWithMechanism - an extended version PK11_Sign()
  * PK11_VerifyWithMechanism - an extended version of PK11_Verify()
  * SSL_PeerSignedCertTimestamps - Get signed_certificate_timestamp
    TLS extension data
  * SSL_SetSignedCertTimestamps - Set signed_certificate_timestamp
    TLS extension data
  New types:
  * ssl_signed_cert_timestamp_xtn is added to SSLExtensionType
  * Constants for several object IDs are added to SECOidTag
  New macros:
  * SSL_ENABLE_SIGNED_CERT_TIMESTAMPS
  * NSS_USE_ALG_IN_SSL
  * NSS_USE_POLICY_IN_SSL
  * NSS_RSA_MIN_KEY_SIZE
  * NSS_DH_MIN_KEY_SIZE
  * NSS_DSA_MIN_KEY_SIZE
  * NSS_TLS_VERSION_MIN_POLICY
  * NSS_TLS_VERSION_MAX_POLICY

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=209
2016-04-05 05:56:14 +00:00
Wolfgang Rosenauer
4db1acbc24 - update to NSS 3.21.1 (bmo#969894)
* MFSA 2016-35/CVE-2016-1950 (bmo#1245528)
    Buffer overflow during ASN.1 decoding in NSS
    (fixed by requiring 3.21.1)
  * MFSA 2016-36/CVE-2016-1979 (bmo#1185033)
    Use-after-free during processing of DER encoded keys in NSS
    (fixed by requiring 3.21.1)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=207
2016-03-08 22:39:49 +00:00
Wolfgang Rosenauer
83afc800c1 - update to NSS 3.21.1
* required for Firefox 45.0
  * no upstream release notes available

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=206
2016-03-07 15:44:49 +00:00
Wolfgang Rosenauer
e133fb3c74 - added nss-bmo1236011.patch to fix compiler error (bmo#1236011)
- disabled testsuite as it currently breaks (bmo#1236340)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=204
2016-01-26 22:49:44 +00:00
Wolfgang Rosenauer
a13639ab95 - update to NSS 3.21
* required for Firefox 44.0
  New functionality:
  * certutil now supports a --rename option to change a nickname (bmo#1142209)
  * TLS extended master secret extension (RFC 7627) is supported (bmo#1117022)
  * New info functions added for use during mid-handshake callbacks (bmo#1084669)
  New Functions:
  * NSS_OptionSet - sets NSS global options
  * NSS_OptionGet - gets the current value of NSS global options
  * SECMOD_CreateModuleEx - Create a new SECMODModule structure from module name
    string, module parameters string, NSS specific parameters string, and NSS
    configuration parameter string. The module represented by the module
    structure is not loaded. The difference with SECMOD_CreateModule is the new
    function handles NSS configuration parameter strings.
  * SSL_GetPreliminaryChannelInfo - obtains information about a TLS channel prior
    to the handshake being completed, for use with the callbacks that are invoked
    during the handshake
  * SSL_SignaturePrefSet - configures the enabled signature and hash algorithms
    for TLS
  * SSL_SignaturePrefGet - retrieves the currently configured signature and hash
    algorithms
  * SSL_SignatureMaxCount - obtains the maximum number signature algorithms that
    can be configured with SSL_SignaturePrefSet
  * NSSUTIL_ArgParseModuleSpecEx - takes a module spec and breaks it into shared
    library string, module name string, module parameters string, NSS specific
    parameters string, and NSS configuration parameter strings. The returned
    strings must be freed by the caller. The difference with
    NSS_ArgParseModuleSpec is the new function handles NSS configuration
    parameter strings.
  * NSSUTIL_MkModuleSpecEx - take a shared library string, module name string,

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=203
2016-01-26 06:30:20 +00:00
Wolfgang Rosenauer
016b870c09 * MFSA 2015-150/CVE-2015-7575 (bmo#1158489)
MD5 signatures accepted within TLS 1.2 ServerKeyExchange in
    server signature

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=200
2015-12-26 07:22:03 +00:00
Wolfgang Rosenauer
3463e0c188 - update to NSS 3.20.2 (bnc#959888)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=199
2015-12-23 12:24:51 +00:00
Wolfgang Rosenauer
7b02230ef1 - update to NSS 3.20.2
- update to NSS 3.20.1 (bnc#952810)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=198
2015-12-20 10:13:48 +00:00
Wolfgang Rosenauer
262b0bfec9 - update to NSS 4.20.2
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=197
2015-12-19 17:14:46 +00:00
Wolfgang Rosenauer
aa77e12284 - update to NSS 4.20.1 (bnc#952810)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=195
2015-11-03 19:46:10 +00:00
Wolfgang Rosenauer
bac12b7d9e * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182 (bmo#1192028, bmo#1202868)
memory corruption issues

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=194
2015-11-03 17:24:16 +00:00
Wolfgang Rosenauer
107f9eab33 - update to NSS 4.20.1
* requires NSPR 4.10.10

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=193
2015-10-31 09:29:52 +00:00
Wolfgang Rosenauer
4453cedcca Accepting request 333502 from Java:Factory
Distribute libfreebl.a along other static libraries. It is needed for java 7 Sun Elliptical Curve Crypto provider

OBS-URL: https://build.opensuse.org/request/show/333502
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=191
2015-09-24 17:37:48 +00:00
Wolfgang Rosenauer
371f571e08 - update to NSS 3.20
New functionality:
  * The TLS library has been extended to support DHE ciphersuites in
    server applications.
  New Functions:
  * SSL_DHEGroupPrefSet - Configure the set of allowed/enabled DHE group
    parameters that can be used by NSS for a server socket.
  * SSL_EnableWeakDHEPrimeGroup - Enable the use of weak DHE group
    parameters that are smaller than the library default's minimum size.
  New Types:
  * SSLDHEGroupType - Enumerates the set of DHE parameters embedded in
    NSS that can be used with function SSL_DHEGroupPrefSet.
  New Macros:
  * SSL_ENABLE_SERVER_DHE - A socket option user to enable or disable
    DHE ciphersuites for a server socket.
  Notable Changes:
  * For backwards compatibility reasons, the server side implementation
    of the TLS library keeps all DHE ciphersuites disabled by default.
    They can be enabled with the new socket option SSL_ENABLE_SERVER_DHE
    and the SSL_OptionSet or the SSL_OptionSetDefault API.
  * The server side implementation of the TLS implementation does not
    support session tickets when using a DHE ciphersuite (see bmo#1174677).
  * Support for the following ciphersuites has been added:
    - TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
    - TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
    - TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
  * By default, the server side TLS implementation will use DHE
    parameters with a size of 2048 bits when using DHE ciphersuites.
  * NSS embeds fixed DHE parameters sized 2048, 3072, 4096, 6144 and
    8192 bits, which were copied from version 08 of the Internet-Draft

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=190
2015-09-24 10:20:12 +00:00
Wolfgang Rosenauer
e87238be07 Accepting request 333436 from Java:Factory
Add blapi.h and algmac.h, in order to be able to build sunec.jar in java 7

OBS-URL: https://build.opensuse.org/request/show/333436
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=189
2015-09-24 09:37:13 +00:00
Wolfgang Rosenauer
11da47024a (MFSA 2015-70/CVE-2015-4000)
* NSS incorrectly permits skipping of ServerKeyExchange
    (bmo#1086145) (MFSA 2015-71/CVE-2015-2721)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=187
2015-07-03 05:51:39 +00:00
Wolfgang Rosenauer
b075d41608 Accepting request 313427 from home:msmeissn:branches:mozilla:Factory
- as the .chk files are contained in libfreebl3 and libsoftokn
  directly, provide the -hmac alias names to help :42 building.

OBS-URL: https://build.opensuse.org/request/show/313427
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=185
2015-06-24 17:52:00 +00:00
Wolfgang Rosenauer
c13c2fe84e - update to 3.19.2
* required for Firefox 39.0
  * No new functionality is introduced in this release. This release
    addresses a backwards compatibility issue with the NSS 3.19.1
    release.
  * In NSS 3.19.1, the minimum key sizes that the freebl cryptographic
    implementation (part of the softoken cryptographic module used
    by default by NSS) was willing to generate or use was increased
    - for RSA keys, to 512 bits, and for DH keys, 1023 bits. This
    was done as part of a security fix for Bug 1138554 / CVE-2015-4000.
    Applications that requested or attempted to use keys smaller
    then the minimum size would fail. However,  this change in behaviour
    unintentionally broke existing NSS applications that need to
    generate or use such keys, via APIs such as
    SECKEY_CreateRSAPrivateKey or SECKEY_CreateDHPrivateKey.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=184
2015-06-23 06:04:19 +00:00
Wolfgang Rosenauer
468ec67421 Notable Changes:
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=182
2015-06-01 07:53:45 +00:00
Wolfgang Rosenauer
8cb655bd59 - update to 3.19.1
No new functionality is introduced in this release. This patch
  release includes a fix for the recently published logjam attack.
Notable Changes:
  * The minimum strength of keys that libssl will accept for
    finite field algorithms (RSA, Diffie-Hellman, and DSA) have
    been increased to 1023 bits (bmo#1138554).
  * NSS reports the bit length of keys more accurately.  Thus,
    the SECKEY_PublicKeyStrength and SECKEY_PublicKeyStrengthInBits
    functions could report smaller values for values that have
    leading zero values. This affects the key strength values that
    are reported by SSL_GetChannelInfo.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=180
2015-05-31 13:26:05 +00:00
Wolfgang Rosenauer
fac2c66773 - update to 3.19
* Firefox target release 39
  New functionality:
  * For some certificates, such as root CA certificates, that don't
    embed any constraints, NSS might impose additional constraints,
    such as name constraints. A new API has been added that allows
    to lookup imposed constraints.
  * It is possible to override the directory in which the NSS build
    system will look for the sqlite library.
  New Functions:
  * CERT_GetImposedNameConstraints
  Notable Changes:
  * The SSL 3 protocol has been disabled by default.
  * NSS now more strictly validates TLS extensions and will fail a
    handshake that contains malformed extensions.
  * Fixed a bug related to the ordering of TLS handshake messages.
  * In TLS 1.2 handshakes, NSS advertises support for the SHA512
    hash algorithm, in order to be compatible with TLS servers
    that use certificates with a SHA512 signature.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=179
2015-05-23 08:54:34 +00:00
Wolfgang Rosenauer
aac1edd658 - update to 3.18.1
* Firefox target release 38
  * No new functionality is introduced in this release.
  Notable Changes:
  * The following CA certificate had the Websites and Code Signing
    trust bits restored to their original state to allow more time
    to develop a better transition strategy for affected sites:
    - OU = Equifax Secure Certificate Authority
  * The following CA certificate was removed:
    - CN = e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi
  * The following intermediate CA certificate has been added as
    actively distrusted because it was mis-used to issue certificates
    for domain names the holder did not own or control:
    - CN=MCSHOLDING TEST, O=MCSHOLDING, C=EG
  * The version number of the updated root CA list has been set
    to 2.4

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=177
2015-04-23 06:38:33 +00:00
Wolfgang Rosenauer
61e5bbef43 - add the changes file as source so the .src.rpm builds (used for
fake build time)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=176
2015-04-03 20:30:47 +00:00
Wolfgang Rosenauer
7803242e62 - update to 3.18
* Firefox target release 38
  New functionality:
  * When importing certificates and keys from a PKCS#12 source,
    it's now possible to override the nicknames, prior to importing
    them into the NSS database, using new API
    SEC_PKCS12DecoderRenameCertNicknames.
  * The tstclnt test utility program has new command-line options
    -C, -D, -b and -R.
    Use -C one, two or three times to print information about the
    certificates received from a server, and information about the
    locally found and trusted issuer certificates, to diagnose
    server side configuration issues. It is possible to run tstclnt
    without providing a database (-D). A PKCS#11 library that
    contains root CA certificates can be loaded by tstclnt, which
    may either be the nssckbi library provided by NSS (-b) or
    another compatible library (-R).
  New Functions:
  * SEC_CheckCrlTimes
  * SEC_GetCrlTimes
  * SEC_PKCS12DecoderRenameCertNicknames
  New Types:
  * SEC_PKCS12NicknameRenameCallback
  Notable Changes:
  * The highest TLS protocol version enabled by default has been
    increased from TLS 1.0 to TLS 1.2. Similarly, the highest DTLS
    protocol version enabled by default has been increased from
    DTLS 1.0 to DTLS 1.2.
  * The default key size used by certutil when creating an RSA key
    pair has been increased from 1024 bits to 2048 bits.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=175
2015-04-03 08:58:03 +00:00
Wolfgang Rosenauer
7e56ae74c1 - update to 3.17.4
* Firefox target release 36
  Notable Changes:
  * bmo#1084986: If an SSL/TLS connection fails, because client and
                 server don't have any common protocol version enabled,
		 NSS has been changed to report error code
		 SSL_ERROR_UNSUPPORTED_VERSION (instead of reporting
		 SSL_ERROR_NO_CYPHER_OVERLAP).
  * bmo#1112461: libpkix was fixed to prefer the newest certificate,
                 if multiple certificates match.
  * bmo#1094492: fixed a memory corruption issue during failure of
                 keypair generation.
  * bmo#1113632: fixed a failure to reload a PKCS#11 module in FIPS
                 mode.
  * bmo#1119983: fixed interoperability of NSS server code with a
                 LibreSSL client.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=173
2015-01-31 18:08:08 +00:00
Wolfgang Rosenauer
f2d1031ce6 - update to 3.17.3
* Firefox target release 36
  New functionality:
  * Support for TLS_FALLBACK_SCSV has been added to the ssltap and
    tstclnt utilities
  Notable Changes:
  * The QuickDER decoder now decodes lengths robustly
    (CVE-2014-1569)
  * The following 1024-bit CA certificates were removed:
    - GTE CyberTrust Global Root
    - Thawte Server CA
    - Thawte Premium Server CA
    - America Online Root Certification Authority 1
    - America Online Root Certification Authority 2
  * The following CA certificates had the Websites and Code Signing
    trust bits turned off:
    - Class 3 Public Primary Certification Authority - G2
    - Equifax Secure eBusiness CA-1
  * The following CA certificates were added:
    - COMODO RSA Certification Authority
    - USERTrust RSA Certification Authority
    - USERTrust ECC Certification Authority
    - GlobalSign ECC Root CA - R4
    - GlobalSign ECC Root CA - R5
  * the version number of the updated root CA list has been set
    to 2.2

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=171
2014-12-27 12:24:22 +00:00
Wolfgang Rosenauer
99b3c1bb3c - update to 3.17.2
Bugfix release
  * bmo#1049435 - Importing an RSA private key fails if p < q
  * bmo#1057161 - NSS hangs with 100% CPU on invalid EC key
  * bmo#1078669 - certutil crashes when using the --certVersion parameter

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=169
2014-10-16 19:19:00 +00:00
Wolfgang Rosenauer
d2eba15b73 * MFSA 2014-73/CVE-2014-1568 (bmo#1064636, bmo#1069405)
RSA Signature Forgery in NSS

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=167
2014-09-24 19:29:06 +00:00
Wolfgang Rosenauer
3fb5d49790 - update to 3.17.1 (bnc#897890)
* Change library's signature algorithm default to SHA256
  * Add support for draft-ietf-tls-downgrade-scsv
  * Add clang-cl support to the NSS build system
  * Implement TLS 1.3:
    * Part 1. Negotiate TLS 1.3
    * Part 2. Remove deprecated cipher suites andcompression.
  * Add support for little-endian powerpc64

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=166
2014-09-23 21:39:14 +00:00
Wolfgang Rosenauer
8b17b48d47 - update to 3.17
* required for Firefox 33
  New functionality:
  * When using ECDHE, the TLS server code may be configured to generate
    a fresh ephemeral ECDH key for each handshake, by setting the
    SSL_REUSE_SERVER_ECDHE_KEY socket option to PR_FALSE. The
    SSL_REUSE_SERVER_ECDHE_KEY option defaults to PR_TRUE, which means
    the server's ephemeral ECDH key is reused for multiple handshakes.
    This option does not affect the TLS client code, which always
    generates a fresh ephemeral ECDH key for each handshake.
  New Macros
  * SSL_REUSE_SERVER_ECDHE_KEY
  Notable Changes:
  * The manual pages for the certutil and pp tools have been updated to
    document the new parameters that had been added in NSS 3.16.2.
  * On Windows, the new build variable USE_STATIC_RTL can be used to
    specify the static C runtime library should be used. By default the
    dynamic C runtime library is used.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=164
2014-09-04 13:58:20 +00:00
Wolfgang Rosenauer
9fb0f9587a - update to 3.16.4 (bnc#894201)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=163
2014-09-02 18:14:14 +00:00
Wolfgang Rosenauer
c133651414 - update to 3.16.4
* now required for Firefox 32
  Notable Changes:
  * The following 1024-bit root CA certificate was restored to allow more
    time to develop a better transition strategy for affected sites. It was
    removed in NSS 3.16.3, but discussion in the mozilla.dev.security.policy
    forum led to the decision to keep this root included longer in order to
    give website administrators more time to update their web servers.
    - CN = GTE CyberTrust Global Root
  * In NSS 3.16.3, the 1024-bit "Entrust.net Secure Server Certification
    Authority" root CA certificate was removed. In NSS 3.16.4, a 2048-bit
    intermediate CA certificate has been included, without explicit trust.
    The intention is to mitigate the effects of the previous removal of the
    1024-bit Entrust.net root certificate, because many public Internet
    sites still use the "USERTrust Legacy Secure Server CA" intermediate
    certificate that is signed by the 1024-bit Entrust.net root certificate.
    The inclusion of the intermediate certificate is a temporary measure to
    allow those sites to function, by allowing them to find a trust path to
    another 2048-bit root CA certificate. The temporarily included
    intermediate certificate expires November 1, 2015.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=162
2014-08-12 11:04:16 +00:00
Wolfgang Rosenauer
0505423d6d - update to 3.16.3
* required for Firefox 32
  New Functions:
  * CERT_GetGeneralNameTypeFromString (This function was already added
    in NSS 3.16.2, however, it wasn't declared in a public header file.)
  Notable Changes:
  * The following 1024-bit CA certificates were removed
    - Entrust.net Secure Server Certification Authority
    - GTE CyberTrust Global Root
    - ValiCert Class 1 Policy Validation Authority
    - ValiCert Class 2 Policy Validation Authority
    - ValiCert Class 3 Policy Validation Authority
  * Additionally, the following CA certificate was removed as
    requested by the CA:
    - TDC Internet Root CA
  * The following CA certificates were added:
    - Certification Authority of WoSign
    - CA 沃通根证书
    - DigiCert Assured ID Root G2
    - DigiCert Assured ID Root G3
    - DigiCert Global Root G2
    - DigiCert Global Root G3
    - DigiCert Trusted Root G4
    - QuoVadis Root CA 1 G3
    - QuoVadis Root CA 2 G3
    - QuoVadis Root CA 3 G3
  * The Trust Bits were changed for the following CA certificates
    - Class 3 Public Primary Certification Authority
    - Class 3 Public Primary Certification Authority
    - Class 2 Public Primary Certification Authority - G2

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=160
2014-07-05 13:02:10 +00:00
Wolfgang Rosenauer
8f1ab3a949 - update to 3.16.1
* required for Firefox 31
  New functionality:
  * Added the "ECC" flag for modutil to select the module used for
    elliptic curve cryptography (ECC) operations.
  New Functions:
  * PK11_ExportDERPrivateKeyInfo/PK11_ExportPrivKeyInfo
    exports a private key in a DER-encoded ASN.1 PrivateKeyInfo type
    or a SECKEYPrivateKeyInfo structure. Only RSA private keys are
    supported now.
  * SECMOD_InternalToPubMechFlags
    converts from NSS-internal to public representation of mechanism
    flags
  New Types:
  * ssl_padding_xtn
    the value of this enum constant changed from the experimental
    value 35655 to the IANA-assigned value 21
  New Macros
  * PUBLIC_MECH_ECC_FLAG
    a public mechanism flag for elliptic curve cryptography (ECC)
    operations
  * SECMOD_ECC_FLAG
    an NSS-internal mechanism flag for elliptic curve cryptography
    (ECC) operations. This macro has the same numeric value as
    PUBLIC_MECH_ECC_FLAG.
  Notable Changes:
  * Imposed name constraints on the French government root CA ANSSI
    (DCISS).

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=158
2014-05-08 06:02:59 +00:00
Wolfgang Rosenauer
b45e5b8ae6 - update to 3.16
* required for Firefox 29
  * bmo#903885 - (CVE-2014-1492) In a wildcard certificate, the wildcard
    character should not be embedded within the U-label of an
    internationalized domain name. See the last bullet point in RFC 6125,
    Section 7.2.
  * Supports the Linux x32 ABI. To build for the Linux x32 target, set
    the environment variable USE_X32=1 when building NSS.
  New Functions:
  * NSS_CMSSignerInfo_Verify
  New Macros
  * TLS_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, etc.,
    cipher suites that were first defined in SSL 3.0 can now be referred
    to with their official IANA names in TLS, with the TLS_ prefix.
    Previously, they had to be referred to with their names in SSL 3.0,
    with the SSL_ prefix.
  Notable Changes:
  * ECC is enabled by default. It is no longer necessary to set the
    environment variable NSS_ENABLE_ECC=1 when building NSS. To disable
    ECC, set the environment variable NSS_DISABLE_ECC=1 when building NSS.
  * libpkix should not include the common name of CA as DNS names when
    evaluating name constraints.
  * AESKeyWrap_Decrypt should not return SECSuccess for invalid keys.
  * Fix a memory corruption in sec_pkcs12_new_asafe.
  * If the NSS_SDB_USE_CACHE environment variable is set, skip the runtime
    test sdb_measureAccess.
  * The built-in roots module has been updated to version 1.97, which
    adds, removes, and distrusts several certificates.
  * The atob utility has been improved to automatically ignore lines of
    text that aren't in base64 format.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=155
2014-03-21 21:54:13 +00:00
Wolfgang Rosenauer
ceb833b465 - update to 3.15.5
* required for Firefox 28
  * export FREEBL_LOWHASH to get the correct default headers
    (bnc#865539)
  New functionality
  * Added support for the TLS application layer protocol negotiation
    (ALPN) extension. Two SSL socket options, SSL_ENABLE_NPN and
    SSL_ENABLE_ALPN, can be used to control whether NPN or ALPN (or both)
    should be used for application layer protocol negotiation.
  * Added the TLS padding extension. The extension type value is 35655,
    which may change when an official extension type value is assigned
    by IANA. NSS automatically adds the padding extension to ClientHello
    when necessary.
  * Added a new macro CERT_LIST_TAIL, defined in certt.h, for getting
    the tail of a CERTCertList.
  Notable Changes
  * bmo#950129: Improve the OCSP fetching policy when verifying OCSP
    responses
  * bmo#949060: Validate the iov input argument (an array of PRIOVec
    structures) of ssl_WriteV (called via PR_Writev). Applications should
    still take care when converting struct iov to PRIOVec because the
    iov_len members of the two structures have different types
    (size_t vs. int). size_t is unsigned and may be larger than int.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=153
2014-02-25 12:02:07 +00:00
Wolfgang Rosenauer
d377e44364 Accepting request 223209 from home:aeneas_jaissle:branches:mozilla:Factory
BuildRequires mozilla-nspr-devel >= 4.9 to raise a 'unresolvable' and prevent distros with mozilla-nspr < 4.9 start building and just fail.

OBS-URL: https://build.opensuse.org/request/show/223209
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=152
2014-02-20 12:04:07 +00:00
Wolfgang Rosenauer
17f8bab0f2 * MFSA 2014-12/CVE-2014-1490/CVE-2014-1491
NSS ticket handling issues

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=150
2014-02-05 06:01:36 +00:00
Wolfgang Rosenauer
186557c50a * Reordered the cipher suites offered in SSL/TLS client hello
messages to match modern best practices.
  * Improved SSL/TLS false start. In addition to enabling the
    SSL_ENABLE_FALSE_START option, an application must now register
    a callback using the SSL_SetCanFalseStartCallback function.
  * When false start is enabled, libssl will sometimes return
    unencrypted, unauthenticated data from PR_Recv
    (CVE-2013-1740, bmo#919877)
  New functionality
  * Implemented OCSP querying using the HTTP GET method, which is
    the new default, and will fall back to the HTTP POST method.
  * Implemented OCSP server functionality for testing purposes
    (httpserv utility).
  * Support SHA-1 signatures with TLS 1.2 client authentication.
  * Added the --empty-password command-line option to certutil,
    to be used with -N: use an empty password when creating a new
    database.
  * Added the -w command-line option to pp: don't wrap long output
    lines.
  New functions
  * CERT_ForcePostMethodForOCSP
  * CERT_GetSubjectNameDigest
  * CERT_GetSubjectPublicKeyDigest
  * SSL_PeerCertificateChain
  * SSL_RecommendedCanFalseStart
  * SSL_SetCanFalseStartCallback
  New types
  * CERT_REV_M_FORCE_POST_METHOD_FOR_OCSP: When this flag is used,
    libpkix will never attempt to use the HTTP GET method for OCSP
    requests; it will always use POST.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=147
2014-01-09 10:24:37 +00:00
Wolfgang Rosenauer
58591dfdb2 - update to 3.15.4
* required for Firefox 27
  * regular CA root store update (1.96)
  * some OSCP improvments
  * other bugfixes
- removed obsolete char.patch

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=146
2014-01-07 08:49:30 +00:00
Wolfgang Rosenauer
09fb13cf21 - update to 3.15.3.1 (bnc#854367)
* includes certstore update (1.95) (bmo#946351)
    (explicitely distrust AC DG Tresor SSL)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=143
2013-12-09 12:35:34 +00:00
Wolfgang Rosenauer
a86677e628 Accepting request 209419 from openSUSE:Factory:PowerLE
fix ppc64le build, please forward to factory

OBS-URL: https://build.opensuse.org/request/show/209419
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=141
2013-12-04 17:44:48 +00:00
Wolfgang Rosenauer
38ebd6f8e7 - update to 3.15.3 (bnc#850148)
* fix CVE-2013-5605

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=139
2013-11-12 20:37:56 +00:00
Wolfgang Rosenauer
d14ddaa1f0 - update to 3.15.3
* CERT_VerifyCert returns SECSuccess (saying certificate is good)
    even for bad certificates, when the CERTVerifyLog log parameter
    is given (bmo#910438)
  * NSS advertises TLS 1.2 ciphersuites in a TLS 1.1 ClientHello
    (bmo#919677)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=138
2013-11-11 22:19:45 +00:00
Wolfgang Rosenauer
5e4a477e3f - update to 3.15.2 (bnc#842979)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=135
2013-09-28 08:24:06 +00:00
Wolfgang Rosenauer
5163190a91 - version 3.15.2
* Support for AES-GCM ciphersuites that use the SHA-256 PRF
  * MD2, MD4, and MD5 signatures are no longer accepted for OCSP
    or CRLs
  * Add PK11_CipherFinal macro
  * sizeof() used incorrectly
  * nssutil_ReadSecmodDB() leaks memory
  * Allow SSL_HandshakeNegotiatedExtension to be called before
    the handshake is finished.
  * Deprecate the SSL cipher policy code
  * Avoid uninitialized data read in the event of a decryption
    failure. (CVE-2013-1739)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=134
2013-09-28 08:17:22 +00:00
Wolfgang Rosenauer
a2949dce64 Accepting request 201249 from home:elvigia:branches:mozilla:Factory
-version 3.15.2
- Support for AES-GCM ciphersuites that use the SHA-256 PRF 
- MD2, MD4, and MD5 signatures are no longer accepted for OCSP 
  or CRLs, 
- Add PK11_CipherFinal macro
- sizeof() used incorrectly
- nssutil_ReadSecmodDB() leaks memory
- Allow SSL_HandshakeNegotiatedExtension to be called before 
  the handshake is finished.
- Deprecate the SSL cipher policy code
- (CVE-2013-1739) Avoid uninitialized data read in the 
   event of a decryption failure.

OBS-URL: https://build.opensuse.org/request/show/201249
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=133
2013-09-28 08:13:46 +00:00
Wolfgang Rosenauer
7dddfd6c24 Accepting request 182277 from home:lnussel:branches:Base:System
- fix 32bit requirement, it's without () actually

OBS-URL: https://build.opensuse.org/request/show/182277
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=131
2013-07-05 12:48:09 +00:00
Wolfgang Rosenauer
1256cc6819 - update to 3.15.1
* TLS 1.2 (RFC 5246) is supported. HMAC-SHA256 cipher suites
    (RFC 5246 and RFC 5289) are supported, allowing TLS to be used
    without MD5 and SHA-1.
    Note the following limitations:
      The hash function used in the signature for TLS 1.2 client
      authentication must be the hash function of the TLS 1.2 PRF,
      which is always SHA-256 in NSS 3.15.1.
      AES GCM cipher suites are not yet supported.
  * some bugfixes and improvements

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=128
2013-07-03 12:00:07 +00:00
Wolfgang Rosenauer
80c4a0174f Accepting request 181778 from home:lnussel:branches:Base:System
- require libnssckbi instead of mozilla-nss-certs so p11-kit can
  conflict with the latter (fate#314991)

OBS-URL: https://build.opensuse.org/request/show/181778
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=127
2013-07-03 10:36:27 +00:00
Wolfgang Rosenauer
506ad33ba3 - update to 3.15
* Packaging
    + removed obsolete patches
      * nss-disable-expired-testcerts.patch
      * bug-834091.patch
  * New Functionality
    + Support for OCSP Stapling (RFC 6066, Certificate Status
      Request) has been added for both client and server sockets.
      TLS client applications may enable this via a call to
      SSL_OptionSetDefault(SSL_ENABLE_OCSP_STAPLING, PR_TRUE);
    + Added function SECITEM_ReallocItemV2. It replaces function
      SECITEM_ReallocItem, which is now declared as obsolete.
    + Support for single-operation (eg: not multi-part) symmetric
      key encryption and decryption, via PK11_Encrypt and PK11_Decrypt.
    + certutil has been updated to support creating name constraints
      extensions.
  * New Functions
    in ssl.h
      SSL_PeerStapledOCSPResponse - Returns the server's stapled
        OCSP response, when used with a TLS client socket that
        negotiated the status_request extension.
      SSL_SetStapledOCSPResponses - Set's a stapled OCSP response
        for a TLS server socket to return when clients send the
        status_request extension.
    in ocsp.h
      CERT_PostOCSPRequest - Primarily intended for testing, permits
        the sending and receiving of raw OCSP request/responses.
    in secpkcs7.h
      SEC_PKCS7VerifyDetachedSignatureAtTime - Verifies a PKCS#7
        signature at a specific time other than the present time.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=124
2013-06-11 15:41:13 +00:00
Wolfgang Rosenauer
ddbab3a3b8 Accepting request 171078 from home:namtrac:bugfix
- Add Source URL, see https://en.opensuse.org/SourceUrls

OBS-URL: https://build.opensuse.org/request/show/171078
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=122
2013-04-16 11:16:38 +00:00
Wolfgang Rosenauer
a1f8432feb (nss-disable-expired-testcerts.patch)
(bug-834091.patch; bmo#834091)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=120
2013-04-03 07:43:24 +00:00
Wolfgang Rosenauer
1400caed25 * MFSA 2013-40/CVE-2013-0791 (bmo#629816)
Out-of-bounds array read in CERT_DecodeCertPackage

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=119
2013-04-02 21:31:01 +00:00
Wolfgang Rosenauer
15f7757c6e - disable tests with expired certificates
- add SEC_PKCS7VerifyDetachedSignatureAtTime using patch from
  mozilla tree to fulfill Firefox 21 requirements

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=118
2013-04-02 20:29:32 +00:00
Wolfgang Rosenauer
38168bf8bb - update to 3.14.3
* No new major functionality is introduced in this release. This
    release is a patch release to address CVE-2013-1620 (bmo#822365)
  * "certutil -a" was not correctly producing ASCII output as
    requested. (bmo#840714)
  * NSS 3.14.2 broke compilation with older versions of sqlite that
    lacked the SQLITE_FCNTL_TEMPFILENAME file control. NSS 3.14.3 now
    properly compiles when used with older versions of sqlite
    (bmo#837799) - remove system-sqlite.patch
- add aarch64 support

- added system-sqlite.patch (bmo#837799)
  * do not depend on latest sqlite just for a #define
- enable system sqlite usage again

- update to 3.14.2
  * required for Firefox >= 20
  * removed obsolete nssckbi update patch
- disable system sqlite usage since we depend on 3.7.15 which is
  not provided in any openSUSE distribution
  * add nss-sqlitename.patch to avoid any name clash

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=116
2013-02-28 22:53:05 +00:00
Wolfgang Rosenauer
99a81b336e - updated CA database (nssckbi-1.93.patch)
* MFSA 2013-20/CVE-2013-0743 (bmo#825022, bnc#796628)
    revoke mis-issued intermediate certificates from TURKTRUST

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=114
2013-01-08 17:55:59 +00:00
Wolfgang Rosenauer
e5e52b65d8 (bmo#825022, bnc#796628)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=113
2013-01-05 14:50:59 +00:00
Wolfgang Rosenauer
9e5952a272 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=111 2013-01-04 11:03:16 +00:00
Wolfgang Rosenauer
41f3cb6358 - updated CA database (nssckbi-1.93.patch) (bmo#825022)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=109
2012-12-30 18:06:05 +00:00
Wolfgang Rosenauer
9cd1b1b874 - update to 3.14.1 RTM
* minimal requirement for Gecko 20
  * several bugfixes

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=107
2012-12-18 13:54:06 +00:00
Wolfgang Rosenauer
eb3cdf4581 - update to 3.14 RTM
* Support for TLS 1.1 (RFC 4346)
  * Experimental support for DTLS 1.0 (RFC 4347) and DTLS-SRTP (RFC 5764)
  * Support for AES-CTR, AES-CTS, and AES-GCM
  * Support for Keying Material Exporters for TLS (RFC 5705)
  * Support for certificate signatures using the MD5 hash algorithm
    is now disabled by default
  * The NSS license has changed to MPL 2.0. Previous releases were
    released under a MPL 1.1/GPL 2.0/LGPL  2.1 tri-license. For more
    information about MPL 2.0, please see
    http://www.mozilla.org/MPL/2.0/FAQ.html. For an additional
    explanation on GPL/LGPL compatibility, see security/nss/COPYING
    in the source code.
  * Export and DES cipher suites are disabled by default. Non-ECC
    AES and Triple DES cipher suites are enabled by default
- disabled OCSP testcases since they need external network
  (nss-disable-ocsp-test.patch)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=105
2012-10-25 14:10:44 +00:00
Wolfgang Rosenauer
579c8a7cf9 - update to 3.13.6 RTM
* root CA update
  * other bugfixes

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=103
2012-08-16 04:53:56 +00:00
Wolfgang Rosenauer
20b5fe0209 - update to 3.13.5 RTM
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=101
2012-06-01 20:35:17 +00:00
Wolfgang Rosenauer
0c217ace95 Accepting request 113443 from mozilla
- update to 3.13.4 RTM
  * fixed some bugs
  * fixed cert verification regression in PKIX mode (bmo#737802)
    introduced in 3.13.2

OBS-URL: https://build.opensuse.org/request/show/113443
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=99
2012-04-13 19:11:33 +00:00
Wolfgang Rosenauer
8f7e6d6c4d - update to 3.13.3 RTM
- distrust Trustwave's MITM certificates (bmo#724929)
  - fix generic blacklisting mechanism (bmo#727204)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=97
2012-02-23 15:13:12 +00:00
Wolfgang Rosenauer
e36e0c6124 - update to 3.13.2 RTM
* requirement with Gecko >= 11
- removed obsolete patches
  * ckbi-1.88
  * pkcs11n-header-fix.patch

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=95
2012-02-17 08:35:36 +00:00
Wolfgang Rosenauer
f962eacea8 Accepting request 96964 from openSUSE:Factory:ARM
fix qemu workaround

OBS-URL: https://build.opensuse.org/request/show/96964
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=93
2011-12-18 17:50:41 +00:00
Wolfgang Rosenauer
7b17b9dfbc - Added a patch to fix errors in the pkcs11n.h header file.
(bmo#702090)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=90
2011-11-14 11:10:20 +00:00
Wolfgang Rosenauer
f7efd48411 - update to 3.13.1 RTM
* better SHA-224 support (bmo#647706)
  * fixed a regression (causing hangs in some situations)
    introduced in 3.13 (bmo#693228)
- update to 3.13.0 RTM
  * SSL 2.0 is disabled by default
  * A defense against the SSL 3.0 and TLS 1.0 CBC chosen plaintext
    attack demonstrated by Rizzo and Duong (CVE-2011-3389) is
    enabled by default. Set the SSL_CBC_RANDOM_IV SSL option to
    PR_FALSE to disable it.
  * SHA-224 is supported
  * Ported to iOS. (Requires NSPR 4.9.)
  * Added PORT_ErrorToString and PORT_ErrorToName to return the
    error message and symbolic name of an NSS error code
  * Added NSS_GetVersion to return the NSS version string
  * Added experimental support of RSA-PSS to the softoken only
  * NSS_NoDB_Init does not try to open /pkcs11.txt and /secmod.db
    anymore (bmo#641052, bnc#726096)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=89
2011-11-14 07:51:45 +00:00
Wolfgang Rosenauer
7a675fbd45 - make sure NSS_NoDB_Init does not try to use wrong certificate
databases (CVE-2011-3640, bnc#726096, bmo#641052)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=86
2011-11-05 12:00:04 +00:00
Wolfgang Rosenauer
84b82c7866 - explicitely distrust DigiCert Sdn. Bhd (bnc#728520, bmo#698753)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=85
2011-11-05 10:51:17 +00:00
Wolfgang Rosenauer
1c61842dc3 Accepting request 85842 from home:elvigia:branches:mozilla:Factory
- Workaround qemu-arm bugs.

OBS-URL: https://build.opensuse.org/request/show/85842
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=83
2011-10-01 07:54:39 +00:00
Wolfgang Rosenauer
ea9e232b33 more diginotar stuff
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=80
2011-09-09 05:52:50 +00:00
Petr Cerny
a6441bcebd - removed DigiNotar root certifiate from trusted db
(bmo#682927, bnc#714931)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=78
2011-09-02 15:49:39 +00:00
Wolfgang Rosenauer
79b9c0286e Accepting request 79634 from home:aturrini:branches:mozilla:Factory
Fixed typo in summary of mozilla-nss (libsoftokn3)

OBS-URL: https://build.opensuse.org/request/show/79634
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=76
2011-08-24 08:38:15 +00:00
Wolfgang Rosenauer
94d41f007f 3.12.11
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=74
2011-08-12 20:57:47 +00:00