1320509 - Firefox < 52.0 fails to build --with-system-nss where NSS >= 3.28

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Jan Beich]

API breakage makes it harder to check NSS itself for regressions.

$ echo ac_add_options --with-system-nss >>.mozconfig
[...]
In file included from obj-x86_64-unknown-freebsd12.0/security/manager/ssl/Unified_cpp_security_manager_ssl1.cpp:110:
security/manager/ssl/nsNSSCallbacks.cpp:1074:10: error: use of undeclared
      identifier 'TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256'
    case TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256: value = 70; break;
         ^
security/manager/ssl/nsNSSCallbacks.cpp:1075:10: error: use of undeclared
      identifier 'TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256'
    case TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256: value = 71; break;
         ^
security/manager/ssl/nsNSSCallbacks.cpp:1076:10: error: use of undeclared
      identifier 'TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384'
    case TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384: value = 72; break;
         ^
3 errors generated.

Comment 1

[Eric Rescorla (:ekr)]

Attachment: 0001-Bug-1320509-Restore-defines-for-PSK-cipher-suites.-r.patch

Comment 2

[Eric Rescorla (:ekr)]

Thanks for the bug report. The attached patch to NSS should fix this.

I have removed the blocking flag as that bug is long-closed.

Comment 3

[Jan Beich]

Comment on attachment 8814626 [details] [diff] [review]
0001-Bug-1320509-Restore-defines-for-PSK-cipher-suites.-r.patch

I confirm the patch is enough to unbreak --with-system-nss on Firefox 51 and 50.

Comment 4

[Jan Beich]

(In reply to Eric Rescorla (:ekr) from comment #2)
> I have removed the blocking flag as that bug is long-closed.

Blocking regressing bug is a typical workflow for Core. The intent is to track fallout, so backporting a feature is more smooth. Does NSS do things differently?

Comment 5

[Eric Rescorla (:ekr)]

Reviewed at:
https://nss-review.dev.mozaws.net/D95

Landed as:
https://hg.mozilla.org/projects/nss/rev/c005f52f73d3bb0f6f9f46889c9711267ccd9981

Comment 6

[Jan Beich]

Can you backport the fix into NSS 3.28 ?

Comment 7

[Kai Engert [:KaiE:]]

(In reply to Jan Beich from comment #6)
> Can you backport the fix into NSS 3.28 ?

EKR, it seems this request makes sense, do you agree that we land the same patch into the 3.28 branch?

Comment 8

[Kai Engert [:KaiE:]]

Also asking Martin, so we potentially get "agreement for branch landing" more quickly.

Comment 9

[Eric Rescorla (:ekr)]

Yes, I am fine with someone backporting this to 3.28

Comment 10

[Kai Engert [:KaiE:]]

Pushed to NSS_3_28_BRANCH for NSS 3.28
https://hg.mozilla.org/projects/nss/rev/36e8e898af98

I assume this can be marked fixed.

I'm not sure why this bug got tracking flags for Firefox. I think they aren't needed, because this problem is with NSS code, not with Firefox code.

Comment 11

[Gerry Chang [:gchang]]

Per comment #10, mark 51 won't fix.