1688685 - Upgrade Firefox 87 to use NSS 3.62

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Kevin Jacobs [:kjacobs]]

Tracking NSS 3.62 for Firefox 87. Ultimate tag will be NSS_3_62_RTM.

Comment 1

[Kevin Jacobs [:kjacobs]]

Attachment: Bug 1688685 - land NSS 92dcda94c1d4 UPGRADE_NSS_RELEASE, r=bbeurdouche

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a13d49d1516b
land NSS 92dcda94c1d4 UPGRADE_NSS_RELEASE, r=bbeurdouche

Comment 3

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/a13d49d1516b

Comment 4

[Benjamin Beurdouche [:beurdouche]]

Attachment: Bug 1688685 - land NSS fc3a4c142c16 UPGRADE_NSS_RELEASE, r=kjacobs

2021-02-04 Kevin Jacobs <[e-mail]>

* gtests/ssl_gtest/ssl_recordsize_unittest.cc, lib/ssl/ssl3ext.c:
Bug 1690583 - Fix CH padding extension size calculation. r=mt

Bug 1654332 changed the way that NSS constructs Client Hello
messages. `ssl_CalculatePaddingExtLen` now receives a
`clientHelloLength` value that includes the 4B handshake header.
This looks okay per the inline comment (which states that only the
record header is omitted from the length), but the function actually
assumes that the handshake header is also omitted.

This patch removes the addition of the handshake header length.
Those bytes are already included in the buffered CH.

[fc3a4c142c16] [tip]

* automation/abi-check/expected-report-libnss3.so.txt:
Bug 1690421 - Adjust 3.62 ABI report formatting for new libabigail.
r=bbeurdouche

[a1ed44dba32e]

2021-02-03 Kevin Jacobs <[e-mail]>

* automation/taskcluster/docker-builds/Dockerfile:
Bug 1690421 - Install packaged libabigail in docker-builds image
r=bbeurdouche

[3c719b620136]

2021-01-31 Kevin Jacobs <[e-mail]>

* cmd/selfserv/selfserv.c, cmd/tstclnt/tstclnt.c,
lib/ssl/tls13hashstate.c, lib/ssl/tls13hashstate.h:
Bug 1689228 - Minor ECH -09 fixes for interop testing, fuzzing. r=mt

A few minor ECH -09 fixes for interop testing and fuzzing:
- selfserv now takes a PKCS8 keypair for ECH. This is more
maintainable and significantly less terrible than parsing the
ECHConfigs and cobbling one together within selfserv (e.g. we can
support other KEMs without modifying the server).
- Get rid of the newline character in tstclnt retry_configs output.
- Fuzzer fixes in tls13_HandleHrrCookie:
 - We shouldn't use internal_error when PK11_HPKE_ImportContext fails.
Cookies are unprotected in fuzzer mode, so this can be expected to
occur.
 - Only restore the application token when recovering hash state,
otherwise the copy could happen twice, leaking one of the
allocations.

[8bbea1902024]

2021-01-25 Kevin Jacobs <[e-mail]>

* lib/ssl/ssl3exthandle.c:
Bug 1674819 - Fixup a51fae403328, enum type may be signed.
r=bbeurdouche

[2004338a2080]

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a488d5d3520c
land NSS fc3a4c142c16 UPGRADE_NSS_RELEASE, r=kjacobs

Comment 6

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/a488d5d3520c

Comment 7

[Benjamin Beurdouche [:beurdouche]]

Attachment: Bug 1688685 - land NSS NSS_3_62_BETA1 UPGRADE_NSS_RELEASE, r=mt

2021-02-05 Danh <[e-mail]>

* gtests/manifest.mn:
Bug 1688374 - Fix parallel build NSS-3.61 with make. r=kjacobs

[a5c857139b37] [NSS_3_62_BETA1]

2021-02-05 Robert Relyea <[e-mail]>

* lib/libpkix/pkix/util/pkix_tools.c:
Bug 1682044 pkix_Build_GatherCerts() + pkix_CacheCert_Add() can
corrupt "cachedCertTable"

Patch by Andrew Cagney Preliminary Review by Ryan Sleevie Tested
against all.sh rrelyea. r=kjacobs

(this bug is old)

pkix_Build_GatherCerts() has two code paths for creating the list
"certsFound":

 pkix_CacheCert_Lookup() this sets "certsFound" to a new list
"certsFound" and "cachedCertTable" share items but not the list

 pkix_CacheCert_Add(pkix_pl_Pk11CertStore_CertQuery()) this sets
"certsFound" to a new list; and then adds the list to
"cachedCertTable" "certsFound" and "cachedCertTable" share a linked
list

Because the latter doesn't create a separate list, deleting list
elements from "certsFound" can also delete list elements from within
"cacheCertTable". And if this happens while pkix_CacheCert_Lookup()
is trying to update the same element's reference, a core dump can
result.

In detail (note that reference counts may occasionally seem off by
1, its because data is being captured before function local
variables release their reference):

pkix_Build_GatherCerts() calls pkix_pl_Pk11CertStore_CertQuery()
(via a pointer) to sets "certsFound":

 PKIX_CHECK(getCerts (certStore, state->certSel, state->verifyNode,
&nbioContext, &certsFound, plContext), PKIX_GETCERTSFAILED);

it then calls:

 PKIX_CHECK(pkix_CacheCert_Add (certStore, certSelParams,
certsFound, plContext), PKIX_CACHECERTADDFAILED);
[dafda4eee75c]

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6c3c5675e3df
land NSS NSS_3_62_BETA1 UPGRADE_NSS_RELEASE, r=mt

Comment 9

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/6c3c5675e3df

Comment 10

[Benjamin Beurdouche [:beurdouche]]

Attachment: Bug 1688685 - land NSS NSS_3_62_RTM UPGRADE_NSS_RELEASE, r=beurdouche

2021-02-19 Benjamin Beurdouche <[e-mail]>

* lib/nss/nss.h, lib/softoken/softkver.h, lib/util/nssutil.h:
Set version numbers to 3.62 final
[a8e045a9fff6] [NSS_3_62_RTM] <NSS_3_62_BRANCH>

2021-02-15 Benjamin Beurdouche <[e-mail]>

* .hgtags:
Added tag NSS_3_62_BETA1 for changeset a5c857139b37
[145c269c82d6] <NSS_3_62_BRANCH>

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/73695b578c01
land NSS NSS_3_62_RTM UPGRADE_NSS_RELEASE, r=beurdouche

Comment 12

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/73695b578c01