Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Florian Franzmann (432f4926f30a2f3b3188c3f0358b7fc46adf9cff)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Florian Franzmann <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Florian Franzmann (432f4926f30a2f3b3188c3f0358b7fc46adf9cff)
  • Date: Tue, 2 Apr 2013 14:32:33 -0500

GIT changes to master grimoire by Florian Franzmann
<siflfran AT hawo.stw.uni-erlangen.de>:

crypto/nss/HISTORY | 5
crypto/nss/PRE_BUILD | 5
crypto/nss/nss-3.14.3_sync_with_upstream_softokn_changes.patch | 407
++++++++++
http/firefox/DETAILS | 6
http/firefox/HISTORY | 3
libs/nspr/DETAILS | 4
libs/nspr/HISTORY | 3
7 files changed, 427 insertions(+), 6 deletions(-)

New commits:
commit 432f4926f30a2f3b3188c3f0358b7fc46adf9cff
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>

http/firefox: version 20.0

commit 8ffe1be7f82f556c74b4d1fac110a68617d031ac
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>

crypto/nss: version 3.14.3

commit 94b69f918d3403bb97e47c04ccbbbb3c0c79ae4b
Author: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
Commit: Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>

libs/nspr: version 4.9.6

diff --git a/crypto/nss/HISTORY b/crypto/nss/HISTORY
index 7e3e899..04e5e6d 100644
--- a/crypto/nss/HISTORY
+++ b/crypto/nss/HISTORY
@@ -1,3 +1,8 @@
+2013-04-02 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+ * DETAILS: version 3.14.3
+ * nss-3.14.3_sync_with_upstream_softokn_changes.patch, PRE_BUILD:
+ apply patch from gentoo to fix compile error
+
2013-02-19 Remko van der Vossen <wich AT sourcemage.org>
* PRE_BUILD: fix patch apply if statement

diff --git a/crypto/nss/PRE_BUILD b/crypto/nss/PRE_BUILD
index 9828554..e1c1e62 100755
--- a/crypto/nss/PRE_BUILD
+++ b/crypto/nss/PRE_BUILD
@@ -10,5 +10,8 @@ fi &&

if [[ "$NSS_PEM" == "y" ]]; then
tar jxvf $SCRIPT_DIRECTORY/nss-pem-20100412.tar.bz2 &&
-patch -p0 < $SCRIPT_DIRECTORY/nss-enable-pem.patch
+patch -p0 < $SCRIPT_DIRECTORY/nss-enable-pem.patch &&
+if [[ $NSS_BRANCH == "3.14" || $NSS_BRANCH == "DEFAULT" ]]; then
+ patch -p1 <
$SPELL_DIRECTORY/nss-3.14.3_sync_with_upstream_softokn_changes.patch
+fi
fi
diff --git a/crypto/nss/nss-3.14.3_sync_with_upstream_softokn_changes.patch
b/crypto/nss/nss-3.14.3_sync_with_upstream_softokn_changes.patch
new file mode 100644
index 0000000..9611c13
--- /dev/null
+++ b/crypto/nss/nss-3.14.3_sync_with_upstream_softokn_changes.patch
@@ -0,0 +1,407 @@
+From d6dbecfea317a468be12423595e584f43d84d8ec Mon Sep 17 00:00:00 2001
+From: Elio Maldonado <emaldona AT redhat.com>
+Date: Sat, 9 Feb 2013 17:11:00 -0500
+Subject: [PATCH] Sync up with upstream softokn changes
+
+- Disable RSA OEP case in FormatBlock, RSA_OAEP support is experimental and
in a state of flux
+- Numerous change upstream due to the work for TLS/DTLS 'Lucky 13'
vulnerability CVE-2013-0169
+- It now compiles with the NSS_3_14_3_BETA1 source
+---
+ mozilla/security/nss/lib/ckfw/pem/rsawrapr.c | 338
+++++++-------------------
+ 1 files changed, 82 insertions(+), 256 deletions(-)
+
+diff --git a/mozilla/security/nss/lib/ckfw/pem/rsawrapr.c
b/mozilla/security/nss/lib/ckfw/pem/rsawrapr.c
+index 5ac4f39..3780d30 100644
+--- a/mozilla/security/nss/lib/ckfw/pem/rsawrapr.c
++++ b/mozilla/security/nss/lib/ckfw/pem/rsawrapr.c
+@@ -46,6 +46,7 @@
+ #include "sechash.h"
+ #include "base.h"
+
++#include "lowkeyi.h"
+ #include "secerr.h"
+
+ #define RSA_BLOCK_MIN_PAD_LEN 8
+@@ -54,9 +55,8 @@
+ #define RSA_BLOCK_PRIVATE_PAD_OCTET 0xff
+ #define RSA_BLOCK_AFTER_PAD_OCTET 0x00
+
+-#define OAEP_SALT_LEN 8
+-#define OAEP_PAD_LEN 8
+-#define OAEP_PAD_OCTET 0x00
++/* Needed for RSA-PSS functions */
++static const unsigned char eightZeros[] = { 0, 0, 0, 0, 0, 0, 0, 0 };
+
+ #define FLAT_BUFSIZE 512 /* bytes to hold flattened SHA1Context. */
+
+@@ -78,127 +78,39 @@ pem_PublicModulusLen(NSSLOWKEYPublicKey *pubk)
+ return 0;
+ }
+
+-static SHA1Context *SHA1_CloneContext(SHA1Context * original)
+-{
+- SHA1Context *clone = NULL;
+- unsigned char *pBuf;
+- int sha1ContextSize = SHA1_FlattenSize(original);
+- SECStatus frv;
+- unsigned char buf[FLAT_BUFSIZE];
+-
+- PORT_Assert(sizeof buf >= sha1ContextSize);
+- if (sizeof buf >= sha1ContextSize) {
+- pBuf = buf;
+- } else {
+- pBuf = nss_ZAlloc(NULL, sha1ContextSize);
+- if (!pBuf)
+- goto done;
+- }
+-
+- frv = SHA1_Flatten(original, pBuf);
+- if (frv == SECSuccess) {
+- clone = SHA1_Resurrect(pBuf, NULL);
+- memset(pBuf, 0, sha1ContextSize);
+- }
+- done:
+- if (pBuf != buf)
+- nss_ZFreeIf(pBuf);
+- return clone;
++/* Constant time comparison of a single byte.
++ * Returns 1 iff a == b, otherwise returns 0.
++ * Note: For ranges of bytes, use constantTimeCompare.
++ */
++static unsigned char constantTimeEQ8(unsigned char a, unsigned char b) {
++ unsigned char c = ~(a - b | b - a);
++ c >>= 7;
++ return c;
+ }
+
+-/*
+- * Modify data by XORing it with a special hash of salt.
++/* Constant time comparison of a range of bytes.
++ * Returns 1 iff len bytes of a are identical to len bytes of b, otherwise
++ * returns 0.
+ */
+-static SECStatus
+-oaep_xor_with_h1(unsigned char *data, unsigned int datalen,
+- unsigned char *salt, unsigned int saltlen)
+-{
+- SHA1Context *sha1cx;
+- unsigned char *dp, *dataend;
+- unsigned char end_octet;
+-
+- sha1cx = SHA1_NewContext();
+- if (sha1cx == NULL) {
+- return SECFailure;
+- }
+-
+- /*
+- * Get a hash of salt started; we will use it several times,
+- * adding in a different end octet (x00, x01, x02, ...).
+- */
+- SHA1_Begin(sha1cx);
+- SHA1_Update(sha1cx, salt, saltlen);
+- end_octet = 0;
+-
+- dp = data;
+- dataend = data + datalen;
+-
+- while (dp < dataend) {
+- SHA1Context *sha1cx_h1;
+- unsigned int sha1len, sha1off;
+- unsigned char sha1[SHA1_LENGTH];
+-
+- /*
+- * Create hash of (salt || end_octet)
+- */
+- sha1cx_h1 = SHA1_CloneContext(sha1cx);
+- SHA1_Update(sha1cx_h1, &end_octet, 1);
+- SHA1_End(sha1cx_h1, sha1, &sha1len, sizeof(sha1));
+- SHA1_DestroyContext(sha1cx_h1, PR_TRUE);
+- PORT_Assert(sha1len == SHA1_LENGTH);
+-
+- /*
+- * XOR that hash with the data.
+- * When we have fewer than SHA1_LENGTH octets of data
+- * left to xor, use just the low-order ones of the hash.
+- */
+- sha1off = 0;
+- if ((dataend - dp) < SHA1_LENGTH)
+- sha1off = SHA1_LENGTH - (dataend - dp);
+- while (sha1off < SHA1_LENGTH)
+- *dp++ ^= sha1[sha1off++];
+-
+- /*
+- * Bump for next hash chunk.
+- */
+- end_octet++;
+- }
+-
+- SHA1_DestroyContext(sha1cx, PR_TRUE);
+- return SECSuccess;
++static unsigned char constantTimeCompare(const unsigned char *a,
++ const unsigned char *b,
++ unsigned int len) {
++ unsigned char tmp = 0;
++ unsigned int i;
++ for (i = 0; i < len; ++i, ++a, ++b)
++ tmp |= *a ^ *b;
++ return constantTimeEQ8(0x00, tmp);
+ }
+
+-/*
+- * Modify salt by XORing it with a special hash of data.
++/* Constant time conditional.
++ * Returns a if c is 1, or b if c is 0. The result is undefined if c is
++ * not 0 or 1.
+ */
+-static SECStatus
+-oaep_xor_with_h2(unsigned char *salt, unsigned int saltlen,
+- unsigned char *data, unsigned int datalen)
++static unsigned int constantTimeCondition(unsigned int c,
++ unsigned int a,
++ unsigned int b)
+ {
+- unsigned char sha1[SHA1_LENGTH];
+- unsigned char *psalt, *psha1, *saltend;
+- SECStatus rv;
+-
+- /*
+- * Create a hash of data.
+- */
+- rv = SHA1_HashBuf(sha1, data, datalen);
+- if (rv != SECSuccess) {
+- return rv;
+- }
+-
+- /*
+- * XOR the low-order octets of that hash with salt.
+- */
+- PORT_Assert(saltlen <= SHA1_LENGTH);
+- saltend = salt + saltlen;
+- psalt = salt;
+- psha1 = sha1 + SHA1_LENGTH - saltlen;
+- while (psalt < saltend) {
+- *psalt++ ^= *psha1++;
+- }
+-
+- return SECSuccess;
++ return (~(c - 1) & a) | ((c - 1) & b);
+ }
+
+ /*
+@@ -212,7 +124,7 @@ static unsigned char *rsa_FormatOneBlock(unsigned
modulusLen,
+ unsigned char *block;
+ unsigned char *bp;
+ int padLen;
+- int i;
++ int i, j;
+ SECStatus rv;
+
+ block = (unsigned char *) nss_ZAlloc(NULL, modulusLen);
+@@ -260,124 +172,58 @@ static unsigned char *rsa_FormatOneBlock(unsigned
modulusLen,
+ */
+ case RSA_BlockPublic:
+
+- /*
+- * 0x00 || BT || Pad || 0x00 || ActualData
+- * 1 1 padLen 1 data->len
+- * Pad is all non-zero random bytes.
+- */
+- padLen = modulusLen - data->len - 3;
+- PORT_Assert(padLen >= RSA_BLOCK_MIN_PAD_LEN);
+- if (padLen < RSA_BLOCK_MIN_PAD_LEN) {
+- nss_ZFreeIf(block);
+- return NULL;
+- }
+- for (i = 0; i < padLen; i++) {
+- /* Pad with non-zero random data. */
+- do {
+- rv = RNG_GenerateGlobalRandomBytes(bp + i, 1);
+- } while (rv == SECSuccess
+- && bp[i] == RSA_BLOCK_AFTER_PAD_OCTET);
+- if (rv != SECSuccess) {
+- nss_ZFreeIf(block);
+- return NULL;
+- }
+- }
+- bp += padLen;
+- *bp++ = RSA_BLOCK_AFTER_PAD_OCTET;
+- nsslibc_memcpy(bp, data->data, data->len);
+-
+- break;
+-
+- /*
+- * Blocks intended for public-key operation, using
+- * Optimal Asymmetric Encryption Padding (OAEP).
+- */
+- case RSA_BlockOAEP:
+- /*
+- * 0x00 || BT || Modified2(Salt) || Modified1(PaddedData)
+- * 1 1 OAEP_SALT_LEN OAEP_PAD_LEN + data->len [+ N]
+- *
+- * where:
+- * PaddedData is "Pad1 || ActualData [|| Pad2]"
+- * Salt is random data.
+- * Pad1 is all zeros.
+- * Pad2, if present, is random data.
+- * (The "modified" fields are all the same length as the original
+- * unmodified values; they are just xor'd with other values.)
+- *
+- * Modified1 is an XOR of PaddedData with a special octet
+- * string constructed of iterated hashing of Salt (see below).
+- * Modified2 is an XOR of Salt with the low-order octets of
+- * the hash of Modified1 (see farther below ;-).
+- *
+- * Whew!
+- */
+-
+-
+- /*
+- * Salt
+- */
+- rv = RNG_GenerateGlobalRandomBytes(bp, OAEP_SALT_LEN);
+- if (rv != SECSuccess) {
+- nss_ZFreeIf(block);
+- return NULL;
+- }
+- bp += OAEP_SALT_LEN;
+-
+- /*
+- * Pad1
+- */
+- nsslibc_memset(bp, OAEP_PAD_OCTET, OAEP_PAD_LEN);
+- bp += OAEP_PAD_LEN;
+-
+- /*
+- * Data
+- */
+- nsslibc_memcpy(bp, data->data, data->len);
+- bp += data->len;
+-
+- /*
+- * Pad2
+- */
+- if (bp < (block + modulusLen)) {
+- rv = RNG_GenerateGlobalRandomBytes(bp,
+- block - bp + modulusLen);
+- if (rv != SECSuccess) {
+- nss_ZFreeIf(block);
+- return NULL;
+- }
+- }
+-
+- /*
+- * Now we have the following:
+- * 0x00 || BT || Salt || PaddedData
+- * (From this point on, "Pad1 || Data [|| Pad2]" is treated
+- * as the one entity PaddedData.)
+- *
+- * We need to turn PaddedData into Modified1.
+- */
+- if (oaep_xor_with_h1(block + 2 + OAEP_SALT_LEN,
+- modulusLen - 2 - OAEP_SALT_LEN,
+- block + 2, OAEP_SALT_LEN) != SECSuccess) {
+- nss_ZFreeIf(block);
+- return NULL;
+- }
+-
+- /*
+- * Now we have:
+- * 0x00 || BT || Salt || Modified1(PaddedData)
+- *
+- * The remaining task is to turn Salt into Modified2.
+- */
+- if (oaep_xor_with_h2(block + 2, OAEP_SALT_LEN,
+- block + 2 + OAEP_SALT_LEN,
+- modulusLen - 2 - OAEP_SALT_LEN) !=
+- SECSuccess) {
+- nss_ZFreeIf(block);
+- return NULL;
+- }
+-
+- break;
++ /*
++ * 0x00 || BT || Pad || 0x00 || ActualData
++ * 1 1 padLen 1 data->len
++ * Pad is all non-zero random bytes.
++ *
++ * Build the block left to right.
++ * Fill the entire block from Pad to the end with random bytes.
++ * Use the bytes after Pad as a supply of extra random bytes from
++ * which to find replacements for the zero bytes in Pad.
++ * If we need more than that, refill the bytes after Pad with
++ * new random bytes as necessary.
++ */
++ padLen = modulusLen - (data->len + 3);
++ PORT_Assert (padLen >= RSA_BLOCK_MIN_PAD_LEN);
++ if (padLen < RSA_BLOCK_MIN_PAD_LEN) {
++ nss_ZFreeIf (block);
++ return NULL;
++ }
++ j = modulusLen - 2;
++ rv = RNG_GenerateGlobalRandomBytes(bp, j);
++ if (rv == SECSuccess) {
++ for (i = 0; i < padLen; ) {
++ unsigned char repl;
++ /* Pad with non-zero random data. */
++ if (bp[i] != RSA_BLOCK_AFTER_PAD_OCTET) {
++ ++i;
++ continue;
++ }
++ if (j <= padLen) {
++ rv = RNG_GenerateGlobalRandomBytes(bp + padLen,
++ modulusLen - (2 + padLen));
++ if (rv != SECSuccess)
++ break;
++ j = modulusLen - 2;
++ }
++ do {
++ repl = bp[--j];
++ } while (repl == RSA_BLOCK_AFTER_PAD_OCTET && j > padLen);
++ if (repl != RSA_BLOCK_AFTER_PAD_OCTET) {
++ bp[i++] = repl;
++ }
++ }
++ }
++ if (rv != SECSuccess) {
++ /*sftk_fatalError = PR_TRUE;*/
++ nss_ZFreeIf (block);
++ return NULL;
++ }
++ bp += padLen;
++ *bp++ = RSA_BLOCK_AFTER_PAD_OCTET;
++ nsslibc_memcpy(bp, data->data, data->len);
++ break;
+
+ default:
+ PORT_Assert(0);
+@@ -427,26 +273,6 @@ rsa_FormatBlock(SECItem * result, unsigned modulusLen,
+
+ break;
+
+- case RSA_BlockOAEP:
+- /*
+- * 0x00 || BT || M1(Salt) || M2(Pad1||ActualData[||Pad2])
+- *
+- * The "2" below is the first octet + the second octet.
+- * (The other fields do not contain the clear values, but are
+- * the same length as the clear values.)
+- */
+- PORT_Assert(data->len <= (modulusLen - (2 + OAEP_SALT_LEN
+- + OAEP_PAD_LEN)));
+-
+- result->data = rsa_FormatOneBlock(modulusLen, blockType, data);
+- if (result->data == NULL) {
+- result->len = 0;
+- return SECFailure;
+- }
+- result->len = modulusLen;
+-
+- break;
+-
+ case RSA_BlockRaw:
+ /*
+ * Pad || ActualData
+--
+1.7.1
+
+
diff --git a/http/firefox/DETAILS b/http/firefox/DETAILS
index 3a8fb71..59f0513 100755
--- a/http/firefox/DETAILS
+++ b/http/firefox/DETAILS
@@ -1,13 +1,13 @@
SPELL=firefox
if [[ $FIREFOX_CVS == y ]]; then
- VERSION=19.0
+ VERSION=20.0
SOURCE=$SPELL-$VERSION.source.tar.bz2
SOURCE2=$SOURCE.asc
SOURCE_GPG=firefox.gpg:$SOURCE2:UPSTREAM_KEY

SOURCE_URL[0]=http://releases.mozilla.org/pub/mozilla.org/${SPELL}/releases/${VERSION}/source/${SOURCE}
SOURCE2_URL[0]=$SOURCE_URL.asc
else
- VERSION=19.0.2
+ VERSION=20.0
SOURCE=$SPELL-$VERSION.source.tar.bz2
SOURCE2=$SOURCE.asc
SOURCE_GPG=firefox.gpg:$SOURCE2:UPSTREAM_KEY
@@ -15,7 +15,7 @@ else

SOURCE_URL[1]=ftp://ftp.mozilla.org/pub/$SPELL/releases/$VERSION/source/$SOURCE

SOURCE_URL[2]=ftp://ftp.in2p3.fr/pub/mozilla/$SPELL/releases/$VERSION/source/$SOURCE
SOURCE2_URL[0]=$SOURCE_URL.asc
- SECURITY_PATCH=62
+ SECURITY_PATCH=63
fi
SOURCE2_IGNORE=signature
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
diff --git a/http/firefox/HISTORY b/http/firefox/HISTORY
index ead19ea..046cab4 100644
--- a/http/firefox/HISTORY
+++ b/http/firefox/HISTORY
@@ -1,3 +1,6 @@
+2013-04-02 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+ * DETAILS: version 20.0, SECURITY_PATCH++
+
2013-03-22 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
* BUILD: disable avx support for all versions of gcc >= 4.6

diff --git a/libs/nspr/DETAILS b/libs/nspr/DETAILS
index 9fe1e80..e88d0b6 100755
--- a/libs/nspr/DETAILS
+++ b/libs/nspr/DETAILS
@@ -1,11 +1,11 @@
SPELL=nspr
- VERSION=4.9.5
+ VERSION=4.9.6
SOURCE=$SPELL-$VERSION.tar.gz
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"

SOURCE_URL[0]=http://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v$VERSION/src/$SOURCE
WEB_SITE=http://www.mozilla.org/projects/nspr/
ENTERED=20050512
-
SOURCE_HASH=sha512:cbe60e4c5265863fa3250d7c16a2727d3a4a8762d17bc63d044ec88d11758fe9f54f54c08e198db6278ee68c55edd88f7c4bc5db9bdc46bdea4e4cf9eb277f27
+
SOURCE_HASH=sha512:635abfbf982d073803a76dc413097b7ac38d415c395e4a018d024f4620903e494b08f6e659ce0dfab06dc73eb7979c92824701bb613f8519b151e686811d3300
# SOURCE_GPG=gurus.gpg:$SOURCE.sig:WORKS_FOR_ME
LICENSE[0]=MPL
GATHER_DOCS=no
diff --git a/libs/nspr/HISTORY b/libs/nspr/HISTORY
index b08a0d7..246f15d 100644
--- a/libs/nspr/HISTORY
+++ b/libs/nspr/HISTORY
@@ -1,3 +1,6 @@
+2013-04-02 Florian Franzmann <siflfran AT hawo.stw.uni-erlangen.de>
+ * DETAILS: version 4.9.6
+
2013-02-05 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: 4.9.5




  • [SM-Commit] GIT changes to master grimoire by Florian Franzmann (432f4926f30a2f3b3188c3f0358b7fc46adf9cff), Florian Franzmann, 04/02/2013

Archive powered by MHonArc 2.6.24.

Top of Page