Closed Bug 2088215 Opened 12 days ago Closed 11 days ago

Update NSS to new version 0326944d882cc3be055d96c5a82cd4c39682e8d5 from 2026-11-02 17:18:27 UTC

Categories

(Core :: Security: PSM, enhancement)

Product:
Core
Component:
Security: PSM
Type:
enhancement

Tracking

()

Status:
RESOLVED WONTFIX
Tracking Flags:
Tracking Status
firefox161 --- affected

People

(Reporter: update-bot, Assigned: jschanck)

References

Details

(Whiteboard: [3pl-filed][task_id: Uw41vs3sRuajWeg2iXrJTA])

This update covers 11 commits, including 4 new upstream commits I've never filed a bug on before. (They're the top 4.). Here are the overall diff statistics, and then the commit information.

security/nss/AGENTS.md | 188 +
security/nss/CLAUDE.md | 172 +-
security/nss/automation/release/bugzilla_cf_status_nss.py | 14 +-
security/nss/gtests/common/testvectors/chachapoly-long-vectors.h | 2453 ++++++++++
security/nss/gtests/freebl_gtest/chacha20poly1305_unittest.cc | 174 +
security/nss/gtests/freebl_gtest/freebl_gtest.gyp | 10 +
security/nss/gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc | 75 +-
security/nss/gtests/pk11_gtest/pk11_der_private_key_import_unittest.cc | 130 +
security/nss/gtests/pk11_gtest/pq_pkcs8.h | 60 +-
security/nss/gtests/ssl_gtest/ssl_loopback_unittest.cc | 18 +-
security/nss/gtests/ssl_gtest/ssl_resumption_unittest.cc | 390 +-
security/nss/gtests/ssl_gtest/tls_connect.cc | 13 +-
security/nss/gtests/ssl_gtest/tls_connect.h | 54 +-
security/nss/lib/cryptohi/seckey.c | 16 +-
security/nss/lib/freebl/Makefile | 6 +
security/nss/lib/freebl/chacha20poly1305.c | 49 +
security/nss/lib/freebl/freebl.gyp | 27 +-
security/nss/lib/pk11wrap/pk11pk12.c | 5 +
security/nss/lib/softoken/pkcs11c.c | 23 +-
security/nss/lib/softoken/sftkhmac.c | 4 +
security/nss/lib/ssl/dtlscon.c | 16 +-
security/nss/lib/ssl/sslencode.c | 25 +-
security/nss/lib/ssl/sslencode.h | 1 +
security/nss/lib/ssl/sslexp.h | 16 +
security/nss/lib/ssl/sslimpl.h | 12 +-
security/nss/lib/ssl/sslnonce.c | 685 +-
security/nss/lib/ssl/sslsock.c | 27 +-
security/nss/moz.yaml | 4 +-
28 files changed, 3959 insertions(+), 708 deletions(-)

0326944d882cc3be055d96c5a82cd4c39682e8d5 by Dennis Jackson <djackson@mozilla.com>

https://github.com/mozilla/nss/commit/0326944d882cc3be055d96c5a82cd4c39682e8d5
Authored: 2026-11-02 17:18:27 +0000
Committed: 2026-11-02 17:18:27 +0000

Bug 2082793 - Don't cache sessions when ECH was rejected r=nss-reviewers,aweine

Differential Revision: https://phabricator.services.mozilla.com/D334468

Files Modified:

  • lib/ssl/sslnonce.c

3ac2ee3f1c44f37c2ccbc3f004cbdab65dd4fae8 by Dennis Jackson <djackson@mozilla.com>

https://github.com/mozilla/nss/commit/3ac2ee3f1c44f37c2ccbc3f004cbdab65dd4fae8
Authored: 2026-11-02 17:18:07 +0000
Committed: 2026-11-02 17:18:07 +0000

Bug 2082792 - Keep DTLS handshake messages whole in the send buffer r=nss-reviewers,jschanck

Differential Revision: https://phabricator.services.mozilla.com/D334466

Files Modified:

  • lib/ssl/dtlscon.c
  • lib/ssl/sslencode.c
  • lib/ssl/sslimpl.h

e56c43654fb85f2bef5416d1ff5f21475046c055 by John Schanck <jschanck@mozilla.com>

https://github.com/mozilla/nss/commit/e56c43654fb85f2bef5416d1ff5f21475046c055
Authored: 2026-11-02 17:17:48 +0000
Committed: 2026-11-02 17:17:48 +0000

Bug 2082077 - Initialize sftk_MACCtx in sftk_MAC_Init. r=nss-reviewers,keeler

Differential Revision: https://phabricator.services.mozilla.com/D333905

Files Modified:

  • lib/softoken/sftkhmac.c

05dc7bf903e384097c5df08d801560cdbe635d3f by John Schanck <jschanck@mozilla.com>

https://github.com/mozilla/nss/commit/05dc7bf903e384097c5df08d801560cdbe635d3f
Authored: 2026-11-02 17:17:48 +0000
Committed: 2026-11-02 17:17:48 +0000

Bug 2082027 - reorder session context setup in sftk_doMACInit. r=nss-reviewers,keeler

Differential Revision: https://phabricator.services.mozilla.com/D333902

Files Modified:

  • lib/softoken/pkcs11c.c

52c38de2a65d7b5e576427df2a208b3a02e4aba9 by Goutam Tamvada <gtamvada@mozilla.com>

https://github.com/mozilla/nss/commit/52c38de2a65d7b5e576427df2a208b3a02e4aba9
Authored: 2026-10-29 19:10:33 +0000
Committed: 2026-10-29 19:10:33 +0000

Bug 2083840 - Move CLAUDE.md into AGENTS.md. r=nss-reviewers,jschanck

Differential Revision: https://phabricator.services.mozilla.com/D337750

--HG--
rename : CLAUDE.md => AGENTS.md

Files Added:

  • AGENTS.md

Files Modified:

  • CLAUDE.md

4bc03d2076707784b338a8687f16793f23d9f98d by Goutam Tamvada <gtamvada@mozilla.com>

https://github.com/mozilla/nss/commit/4bc03d2076707784b338a8687f16793f23d9f98d
Authored: 2026-10-29 19:10:33 +0000
Committed: 2026-10-29 19:10:33 +0000

Bug 2083840 - Add text to CLAUDE.md regarding code comments and searchfox-cli. r=nss-reviewers,jschanck

Differential Revision: https://phabricator.services.mozilla.com/D337749

Files Modified:

  • CLAUDE.md

f427ea8dfdd9ef58f0c654d759e5e1c306d3f9b9 by Anna <anna.weine@mozilla.com>

https://github.com/mozilla/nss/commit/f427ea8dfdd9ef58f0c654d759e5e1c306d3f9b9
Authored: 2026-10-29 16:14:13 +0000
Committed: 2026-10-29 16:14:13 +0000

Bug 2084251 - Fix cf_status_nss clearing base-release bugs on point releases. r=crypto-reviewers,jschanck

Differential Revision: https://phabricator.services.mozilla.com/D335664

Files Modified:

  • automation/release/bugzilla_cf_status_nss.py

ce819c9475b254768f4c811e4306c5f0a4fa6760 by Benjamin Beurdouche <bbeurdouche@mozilla.com>

https://github.com/mozilla/nss/commit/ce819c9475b254768f4c811e4306c5f0a4fa6760
Authored: 2026-10-28 22:00:46 +0000
Committed: 2026-10-28 22:00:46 +0000

Bug 2039884 - Use vectorized Hacl_Chacha20Poly1305_128 on aarch64 above 512 bytes. r=jschanck

Differential Revision: https://phabricator.services.mozilla.com/D300759

Files Added:

  • gtests/common/testvectors/chachapoly-long-vectors.h
  • gtests/freebl_gtest/chacha20poly1305_unittest.cc

Files Modified:

  • gtests/freebl_gtest/freebl_gtest.gyp
  • gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc
  • lib/freebl/Makefile
  • lib/freebl/chacha20poly1305.c
  • lib/freebl/freebl.gyp

b11848d2b5a78d69923f91ad011f2d0e0c4f9045 by Anna <anna.weine@mozilla.com>

https://github.com/mozilla/nss/commit/b11848d2b5a78d69923f91ad011f2d0e0c4f9045
Authored: 2026-10-28 14:32:09 +0000
Committed: 2026-10-28 14:32:09 +0000

Bug 2046805 - Add SSL_EnablePlaintextResumptionExport experimental API r=djackson

Differential Revision: https://phabricator.services.mozilla.com/D306164

Files Modified:

  • gtests/ssl_gtest/ssl_loopback_unittest.cc
  • gtests/ssl_gtest/ssl_resumption_unittest.cc
  • gtests/ssl_gtest/tls_connect.cc
  • gtests/ssl_gtest/tls_connect.h
  • lib/ssl/sslencode.c
  • lib/ssl/sslencode.h
  • lib/ssl/sslexp.h
  • lib/ssl/sslimpl.h
  • lib/ssl/sslnonce.c
  • lib/ssl/sslsock.c

35cef6ad1c1a1189230d4e19d15840c4bad9ca24 by Anna <anna.weine@mozilla.com>

https://github.com/mozilla/nss/commit/35cef6ad1c1a1189230d4e19d15840c4bad9ca24
Authored: 2026-10-28 14:32:09 +0000
Committed: 2026-10-28 14:32:09 +0000

Bug 2046805 - Collapse resumption token append boilerplate into macros r=jschanck

Differential Revision: https://phabricator.services.mozilla.com/D321267

Files Modified:

  • lib/ssl/sslnonce.c

8ba7deed92b6f3c0133dc4cbd643355adf8c5472 by Anna <anna.weine@mozilla.com>

https://github.com/mozilla/nss/commit/8ba7deed92b6f3c0133dc4cbd643355adf8c5472
Authored: 2026-10-28 11:08:00 +0000
Committed: 2026-10-28 11:08:00 +0000

Bug 2086058 - Reject not empty parameters in ML-KEM && ML-DSA AlgorithmIdentifiers r=crypto-reviewers,jschanck

Differential Revision: https://phabricator.services.mozilla.com/D337087

Files Modified:

  • gtests/pk11_gtest/pk11_der_private_key_import_unittest.cc
  • gtests/pk11_gtest/pq_pkcs8.h
  • lib/cryptohi/seckey.c
  • lib/pk11wrap/pk11pk12.c
  • lib/softoken/pkcs11c.c
Duplicate of this bug: 2087387

I've submitted a try run for this commit: https://treeherder.mozilla.org/jobs?repo=try&revision=2738c59a4eaf1415de800be3b264b7245f93dc18

All the jobs in the try run succeeded. Like literally all of them, there weren't
even any intermittents. That is pretty surprising to me, so maybe you should double
check to make sure I didn't misinterpret things and that the correct tests ran...

Anyway, I've done all I can, so I'm passing to you to review and land the patch.
When reviewing, please note that this is external code, which needs a full and
careful inspection - not a rubberstamp.

Assignee: nobody → jschanck

This doesn't have a phabricator revision.

Status: NEW → RESOLVED
Closed: 11 days ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.