rpms/nss
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-182558

Browse Source 
- remove pk12 and smime policy checks
This commit is contained in:
Robert Relyea 2026-06-25 13:37:41 -07:00
parent e0164ae30e
commit 634c4fe626
5 changed files with 407 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

262
nss-3.124-fix-ed-key-storage.patch → nss-3.124-el9-fix-ed-key-storage.patch
View File

@ -1,7 +1,19 @@
# HG changeset patch
# User Robert Relyea <rrelyea@redhat.com>
# Date 1781049891 25200
# Tue Jun 09 17:04:51 2026 -0700
# Branch NSS_3_124_BRANCH
# Node ID 06a3884cf6203361c0f25221b132233356e0c415
# Parent c05574d73be6479439416e07fa31fb3f0ce553b7
nss-3.124_el9-fix-ed-key-storage.patch
diff --git a/cmd/lib/secutil.c b/cmd/lib/secutil.c
--- a/cmd/lib/secutil.c
+++ b/cmd/lib/secutil.c
@@ -1603,10 +1603,18 @@
@@ -1600,16 +1600,24 @@ secu_PrintSubjectPublicKeyInfo(FILE *out
case dsaKey:
SECU_PrintDSAPublicKey(out, pk, "DSA Public Key", level + 1);
break;
case ecKey:
secu_PrintECPublicKey(out, pk, "EC Public Key", level + 1);
@ -20,10 +32,16 @@ diff --git a/cmd/lib/secutil.c b/cmd/lib/secutil.c
break;
case kyberKey:
SECU_PrintMLKEMPublicKey(out, pk, "ML-KEM Public Key", level + 1);
break;
diff --git a/cmd/pk11importtest/pk11importtest.c b/cmd/pk11importtest/pk11importtest.c
--- a/cmd/pk11importtest/pk11importtest.c
+++ b/cmd/pk11importtest/pk11importtest.c
@@ -191,10 +191,12 @@
@@ -188,16 +188,18 @@ static const char *const usageInfo[] = {
" -f pwFile file to fetch the password from",
" -p pwString password",
" -n force pub key to be rebuilt",
" -r skip rsa test",
" -D skip dsa test",
" -h skip dh test",
@ -36,7 +54,13 @@ diff --git a/cmd/pk11importtest/pk11importtest.c b/cmd/pk11importtest/pk11import
static void
Usage(char *progName, FILE *outFile)
@@ -216,10 +218,12 @@
{
int i;
fprintf(outFile, "Usage: %s [ commands ] options\n", progName);
@@ -213,46 +215,52 @@ enum {
opt_PWFile,
opt_PWString,
opt_NoPub,
opt_NoRSA,
opt_NoDSA,
opt_NoDH,
@ -49,7 +73,10 @@ diff --git a/cmd/pk11importtest/pk11importtest.c b/cmd/pk11importtest/pk11import
static secuCommandFlag options[] = {
{ /* opt_CertDir */ 'd', PR_TRUE, 0, PR_FALSE },
{ /* opt_KeySize */ 'k', PR_TRUE, 0, PR_FALSE },
@@ -230,10 +234,12 @@
{ /* opt_ECCurve */ 'C', PR_TRUE, 0, PR_FALSE },
{ /* opt_PWFile */ 'f', PR_TRUE, 0, PR_FALSE },
{ /* opt_PWString */ 'p', PR_TRUE, 0, PR_FALSE },
{ /* opt_NoPub */ 'n', PR_FALSE, 0, PR_FALSE },
{ /* opt_NoRSA */ 'r', PR_FALSE, 0, PR_FALSE },
{ /* opt_NoDSA */ 'D', PR_FALSE, 0, PR_FALSE },
{ /* opt_NoDH */ 'h', PR_FALSE, 0, PR_FALSE },
@ -62,7 +89,12 @@ diff --git a/cmd/pk11importtest/pk11importtest.c b/cmd/pk11importtest/pk11import
int
main(int argc, char **argv)
{
@@ -246,10 +252,12 @@
char *progName;
SECStatus rv;
secuCommand args;
PK11SlotInfo *slot = NULL;
PRBool failed = PR_FALSE;
secuPWData pwArgs = { PW_NONE, 0 };
PRBool doRSA = PR_TRUE;
PRBool doDSA = PR_TRUE;
PRBool doDH = PR_FALSE; /* NSS currently can't export wrapped DH keys */
@ -75,7 +107,13 @@ diff --git a/cmd/pk11importtest/pk11importtest.c b/cmd/pk11importtest/pk11import
int keySize;
args.numCommands = 0;
@@ -410,10 +418,55 @@
args.numOptions = sizeof(options) / sizeof(secuCommandFlag);
args.commands = NULL;
args.options = options;
@@ -407,16 +415,61 @@ main(int argc, char **argv)
CKM_ML_KEM_KEY_PAIR_GEN,
noPub, &paramSet, &pwArgs);
if (rv != SECSuccess) {
fprintf(stderr, "MLKEM Import Failed!\n");
failed = PR_TRUE;
}
@ -131,10 +169,16 @@ diff --git a/cmd/pk11importtest/pk11importtest.c b/cmd/pk11importtest/pk11import
}
if (slot) {
PK11_FreeSlot(slot);
}
diff --git a/lib/softoken/lowkey.c b/lib/softoken/lowkey.c
--- a/lib/softoken/lowkey.c
+++ b/lib/softoken/lowkey.c
@@ -43,10 +43,15 @@
@@ -40,16 +40,21 @@ const SEC_ASN1Template nsslowkey_Private
{ SEC_ASN1_INLINE | SEC_ASN1_XTRN,
offsetof(NSSLOWKEYPrivateKeyInfo, algorithm),
SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
{ SEC_ASN1_OCTET_STRING,
offsetof(NSSLOWKEYPrivateKeyInfo, privateKey) },
{ SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
@ -150,7 +194,13 @@ diff --git a/lib/softoken/lowkey.c b/lib/softoken/lowkey.c
const SEC_ASN1Template nsslowkey_SubjectPublicKeyInfoTemplate[] = {
{ SEC_ASN1_SEQUENCE, 0, NULL, sizeof(NSSLOWKEYSubjectPublicKeyInfo) },
@@ -399,10 +404,12 @@
{ SEC_ASN1_INLINE | SEC_ASN1_XTRN,
offsetof(NSSLOWKEYSubjectPublicKeyInfo, algorithm),
SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
@@ -396,16 +401,18 @@ nsslowkey_ConvertToPublicKey(NSSLOWKEYPr
break;
rv = SECITEM_CopyItem(arena, &pubk->u.dh.base,
&privk->u.dh.base);
if (rv == SECSuccess)
return pubk;
}
@ -163,7 +213,13 @@ diff --git a/lib/softoken/lowkey.c b/lib/softoken/lowkey.c
if (pubk != NULL) {
SECStatus rv;
@@ -631,10 +638,12 @@
pubk->arena = arena;
pubk->keyType = privk->keyType;
@@ -628,16 +635,18 @@ nsslowkey_CopyPrivateKey(NSSLOWKEYPrivat
if (rv != SECSuccess)
break;
rv = SECITEM_CopyItem(poolp, &(returnKey->u.dh.base),
&(privKey->u.dh.base));
if (rv != SECSuccess)
break;
@ -176,10 +232,16 @@ diff --git a/lib/softoken/lowkey.c b/lib/softoken/lowkey.c
if (rv != SECSuccess)
break;
rv = SECITEM_CopyItem(poolp, &(returnKey->u.ec.publicValue),
&(privKey->u.ec.publicValue));
if (rv != SECSuccess)
break;
diff --git a/lib/softoken/lowkeyti.h b/lib/softoken/lowkeyti.h
--- a/lib/softoken/lowkeyti.h
+++ b/lib/softoken/lowkeyti.h
@@ -48,10 +48,11 @@
@@ -45,16 +45,17 @@ typedef struct NSSLOWKEYAttributeStr NSS
** A PKCS#8 private key info object
*/
struct NSSLOWKEYPrivateKeyInfoStr {
PLArenaPool *arena;
SECItem version;
SECAlgorithmID algorithm;
@ -191,7 +253,13 @@ diff --git a/lib/softoken/lowkeyti.h b/lib/softoken/lowkeyti.h
#define NSSLOWKEY_PRIVATE_KEY_INFO_VERSION 0 /* what we *create* */
struct NSSLOWKEYSubjectPublicKeyInfoStr {
@@ -65,12 +66,14 @@
PLArenaPool *arena;
SECAlgorithmID algorithm;
SECItem subjectPublicKey;
@@ -62,18 +63,20 @@ struct NSSLOWKEYSubjectPublicKeyInfoStr
typedef struct NSSLOWKEYSubjectPublicKeyInfoStr NSSLOWKEYSubjectPublicKeyInfo;
typedef enum {
NSSLOWKEYNullKey = 0,
NSSLOWKEYRSAKey = 1,
NSSLOWKEYDSAKey = 2,
@ -208,10 +276,16 @@ diff --git a/lib/softoken/lowkeyti.h b/lib/softoken/lowkeyti.h
/* ML KEM low structures packages a key with it's parameters.
* The ML KEM freebl didn't define these because all the functions
* take raw keys and param separately */
typedef struct MLKEMPrivateKeyStr MLKEMPrivateKey;
typedef struct MLKEMPublicKeyStr MLKEMPublicKey;
diff --git a/lib/softoken/pkcs11.c b/lib/softoken/pkcs11.c
--- a/lib/softoken/pkcs11.c
+++ b/lib/softoken/pkcs11.c
@@ -2223,13 +2223,18 @@
@@ -2220,19 +2220,24 @@ sftk_GetPubKey(SFTKObject *object, CK_KE
crv = sftk_Attribute2SSecItem(arena, &pubKey->u.dh.base,
object, CKA_BASE);
if (crv != CKR_OK)
break;
crv = sftk_Attribute2SSecItem(arena, &pubKey->u.dh.publicValue,
object, CKA_VALUE);
@ -230,7 +304,13 @@ diff --git a/lib/softoken/pkcs11.c b/lib/softoken/pkcs11.c
object, CKA_EC_PARAMS);
if (crv != CKR_OK)
break;
@@ -2451,13 +2456,18 @@
/* Fill out the rest of the ecParams structure
* based on the encoded params
@@ -2448,19 +2453,24 @@ sftk_mkPrivKey(SFTKObject *object, CK_KE
itemTemplateCount++;
SFTK_SET_ITEM_TEMPLATE(itemTemplate, itemTemplateCount,
&privKey->u.dh.privateValue, CKA_VALUE);
itemTemplateCount++;
/* privKey was zero'd so public value is already set to NULL, 0
* if we don't set it explicitly */
@ -249,7 +329,13 @@ diff --git a/lib/softoken/pkcs11.c b/lib/softoken/pkcs11.c
object, CKA_EC_PARAMS);
if (crv != CKR_OK)
break;
@@ -2514,10 +2524,11 @@
/* Fill out the rest of the ecParams structure
* based on the encoded params
@@ -2511,16 +2521,17 @@ sftk_mkPrivKey(SFTKObject *object, CK_KE
break;
#ifndef NSS_DISABLE_KYBER
case CKK_NSS_KYBER:
#endif
case CKK_NSS_ML_KEM:
@ -261,10 +347,16 @@ diff --git a/lib/softoken/pkcs11.c b/lib/softoken/pkcs11.c
if (crv != CKR_OK) {
crv = sftk_GetULongAttribute(object, CKA_NSS_PARAMETER_SET,
&paramSet);
if (crv != CKR_OK) {
break;
}
diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
--- a/lib/softoken/pkcs11c.c
+++ b/lib/softoken/pkcs11c.c
@@ -6465,12 +6465,10 @@
@@ -6462,35 +6462,31 @@ NSC_GenerateKeyPair(CK_SESSION_HANDLE hS
unsigned char seedData[KYBER_KEYPAIR_COIN_BYTES];
/* generate the seed here so we can record it with
* the private key */
seed.data = seedData;
seed.len = sizeof(seedData);
@ -277,7 +369,11 @@ diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
}
KyberParams kyberParams = sftk_kyber_PK11ParamToInternal(genParamSet);
@@ -6482,12 +6480,10 @@
if (!sftk_kyber_AllocPrivKeyItem(kyberParams, &privKey)) {
crv = CKR_HOST_MEMORY;
goto kyber_done;
}
if (!sftk_kyber_AllocPubKeyItem(kyberParams, &pubKey)) {
crv = CKR_HOST_MEMORY;
goto kyber_done;
}
@ -290,7 +386,13 @@ diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
}
crv = sftk_AddAttributeType(publicKey, CKA_VALUE, sftk_item_expand(&pubKey));
@@ -6902,10 +6898,11 @@
if (crv != CKR_OK) {
goto kyber_done;
}
@@ -6899,16 +6895,17 @@ sftk_PackagePrivateKey(SFTKObject *key,
dummy = SEC_ASN1EncodeItem(arena, &pki->privateKey, lk,
nsslowkey_DSAPrivateKeyExportTemplate);
prepare_low_pqg_params_for_asn1(&lk->u.dsa.params);
param = SEC_ASN1EncodeItem(NULL, NULL, &(lk->u.dsa.params),
nsslowkey_PQGParamsTemplate);
algorithm = SEC_OID_ANSIX9_DSA_SIGNATURE;
@ -302,7 +404,13 @@ diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
* to be in bits before ASN encoding and readjust
* immediately after.
*
@@ -6926,12 +6923,30 @@
* Since the SECG specification recommends not including the
* parameters as part of ECPrivateKey, we zero out the curveOID
* length before encoding and restore it later.
@@ -6923,18 +6920,36 @@ sftk_PackagePrivateKey(SFTKObject *key,
#ifdef EC_DEBUG
fordebug = &pki->privateKey;
SEC_PRINT("sftk_PackagePrivateKey()", "PrivateKey", lk->keyType,
fordebug);
#endif
@ -335,7 +443,13 @@ diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
SECItem seed = { siBuffer, NULL, 0 };
SECItem rawKey = { siBuffer, NULL, 0 };
dummy = NULL;
@@ -7258,10 +7273,12 @@
switch (lk->u.mlkem.mlkemParams) {
case params_ml_kem768:
@@ -7255,16 +7270,18 @@ sftk_unwrapPrivateKey(SFTKObject *key, S
SECStatus rv = SECFailure;
const SEC_ASN1Template *keyTemplate, *paramTemplate;
void *paramDest = NULL;
PLArenaPool *arena;
NSSLOWKEYPrivateKey *lpk = NULL;
NSSLOWKEYPrivateKeyInfo *pki = NULL;
@ -348,7 +462,13 @@ diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
if (!arena) {
return SECFailure;
}
@@ -7283,11 +7300,12 @@
pki = (NSSLOWKEYPrivateKeyInfo *)PORT_ArenaZAlloc(arena,
sizeof(NSSLOWKEYPrivateKeyInfo));
@@ -7280,17 +7297,18 @@ sftk_unwrapPrivateKey(SFTKObject *key, S
lpk = (NSSLOWKEYPrivateKey *)PORT_ArenaZAlloc(arena,
sizeof(NSSLOWKEYPrivateKey));
if (lpk == NULL) {
goto loser;
}
@ -362,7 +482,13 @@ diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
keyTemplate = nsslowkey_RSAPrivateKeyTemplate;
paramTemplate = NULL;
paramDest = NULL;
@@ -7309,10 +7327,46 @@
lpk->keyType = NSSLOWKEYRSAKey;
prepare_low_rsa_priv_key_for_asn1(lpk);
break;
@@ -7306,16 +7324,52 @@ sftk_unwrapPrivateKey(SFTKObject *key, S
case SEC_OID_ANSIX962_EC_PUBLIC_KEY:
keyTemplate = nsslowkey_ECPrivateKeyTemplate;
paramTemplate = NULL;
paramDest = &(lpk->u.ec.ecParams.DEREncoding);
lpk->keyType = NSSLOWKEYECKey;
prepare_low_ec_priv_key_for_asn1(lpk);
@ -409,7 +535,13 @@ diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
goto mlkem_next;
case SEC_OID_ML_KEM_1024:
paramSet = CKP_ML_KEM_1024;
@@ -7344,30 +7398,31 @@
mlkem_next:
lpk->keyType = NSSLOWKEYMLKEMKey;
goto pq_next;
@@ -7341,36 +7395,37 @@ sftk_unwrapPrivateKey(SFTKObject *key, S
case SEC_ASN1_OCTET_STRING:
keyTemplate = nsslowkey_PQPrivateKeyTemplate;
break;
case SEC_ASN1_CONSTRUCTED | SEC_ASN1_SEQUENCE:
keyTemplate = nsslowkey_PQBothSeedAndPrivateKeyTemplate;
break;
@ -448,7 +580,13 @@ diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
/* convert length in bits to length in bytes */
lpk->u.ec.publicValue.len >>= 3;
rv = SECITEM_CopyItem(arena,
@@ -7560,13 +7615,19 @@
&(lpk->u.ec.ecParams.DEREncoding),
&(pki->algorithm.parameters));
if (rv != SECSuccess) {
@@ -7557,19 +7612,25 @@ sftk_unwrapPrivateKey(SFTKObject *key, S
break;
#ifdef notdef
case NSSLOWKEYDHKey:
template = dhTemplate;
templateCount = sizeof(dhTemplate) / sizeof(CK_ATTRIBUTE);
keyType = CKK_DH;
@ -469,10 +607,16 @@ diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
if (!sftk_hasAttribute(key, CKA_NSS_DB)) {
if (lpk->u.ec.publicValue.len == 0) {
crv = CKR_KEY_TYPE_INCONSISTENT;
goto loser;
}
crv = sftk_AddAttributeType(key, CKA_NSS_DB,
diff --git a/lib/softoken/pkcs11u.c b/lib/softoken/pkcs11u.c
--- a/lib/softoken/pkcs11u.c
+++ b/lib/softoken/pkcs11u.c
@@ -1642,10 +1642,12 @@
@@ -1639,16 +1639,18 @@ stfk_CopyTokenPrivateKey(SFTKObject *des
crv = stfk_CopyTokenAttributes(destObject, src_to, mldsaPrivKeyAttrs,
mldsaPrivKeyAttrsCount);
break;
case CKK_DH:
crv = stfk_CopyTokenAttributes(destObject, src_to, dhPrivKeyAttrs,
dhPrivKeyAttrsCount);
@ -485,7 +629,13 @@ diff --git a/lib/softoken/pkcs11u.c b/lib/softoken/pkcs11u.c
break;
default:
crv = CKR_DEVICE_ERROR; /* shouldn't happen unless we store more types
@@ -1706,10 +1708,12 @@
* of token keys into our database. */
}
fail:
@@ -1703,16 +1705,18 @@ stfk_CopyTokenPublicKey(SFTKObject *dest
crv = stfk_CopyTokenAttributes(destObject, src_to, mldsaPubKeyAttrs,
mldsaPubKeyAttrsCount);
break;
case CKK_DH:
crv = stfk_CopyTokenAttributes(destObject, src_to, dhPubKeyAttrs,
dhPubKeyAttrsCount);
@ -498,10 +648,16 @@ diff --git a/lib/softoken/pkcs11u.c b/lib/softoken/pkcs11u.c
break;
default:
crv = CKR_DEVICE_ERROR; /* shouldn't happen unless we store more types
* of token keys into our database. */
}
fail:
diff --git a/lib/util/secoid.c b/lib/util/secoid.c
--- a/lib/util/secoid.c
+++ b/lib/util/secoid.c
@@ -640,14 +640,14 @@
@@ -637,20 +637,20 @@ CONST_OID curve25519[] = { 0x2B, 0x06, 0
Binary encoding: 3005 0603 2B65 70
The same algorithm identifiers are used for identifying a public key,
a private key, and a signature (for the two EdDSA related OIDs).
Additional encoding information is provided below for each of these
locations.
@ -519,7 +675,13 @@ diff --git a/lib/util/secoid.c b/lib/util/secoid.c
/*
* ML-DSA OIDs
* https://csrc.nist.gov/projects/computer-security-objects-register/algorithm-registration
@@ -1869,15 +1869,18 @@
*/
CONST_OID mlDsa44[] = { DSA2, 17 };
CONST_OID mlDsa65[] = { DSA2, 18 };
@@ -1866,21 +1866,24 @@ const static SECOidData oids[SEC_OID_TOT
OD(hmac_sha3_224, SEC_OID_HMAC_SHA3_224, "HMAC SHA3-224", CKM_SHA3_224_HMAC, INVALID_CERT_EXTENSION),
OD(hmac_sha3_256, SEC_OID_HMAC_SHA3_256, "HMAC SHA3-256", CKM_SHA3_256_HMAC, INVALID_CERT_EXTENSION),
OD(hmac_sha3_384, SEC_OID_HMAC_SHA3_384, "HMAC SHA3-384", CKM_SHA3_384_HMAC, INVALID_CERT_EXTENSION),
OD(hmac_sha3_512, SEC_OID_HMAC_SHA3_512, "HMAC SHA3-512", CKM_SHA3_512_HMAC, INVALID_CERT_EXTENSION),
ODE(SEC_OID_XYBER768D00,
@ -542,10 +704,16 @@ diff --git a/lib/util/secoid.c b/lib/util/secoid.c
"Eliptic Curve Diffie-Hellman Single Pass Standard with SHA1 KDF", CKM_ECDH1_DERIVE,
INVALID_CERT_EXTENSION),
OD(dhSinglePassstdDHsha224kdfscheme, SEC_OID_DHSINGLEPASS_STDDH_SHA224KDF_SCHEME,
"Eliptic Curve Diffie-Hellman Single Pass Standard with SHA224 KDF", CKM_ECDH1_DERIVE,
INVALID_CERT_EXTENSION),
OD(dhSinglePassstdDHsha256kdfscheme, SEC_OID_DHSINGLEPASS_STDDH_SHA256KDF_SCHEME,
diff --git a/lib/util/secoidt.h b/lib/util/secoidt.h
--- a/lib/util/secoidt.h
+++ b/lib/util/secoidt.h
@@ -512,12 +512,12 @@
@@ -509,18 +509,18 @@ typedef enum {
SEC_OID_HMAC_SHA3_224 = 368,
SEC_OID_HMAC_SHA3_256 = 369,
SEC_OID_HMAC_SHA3_384 = 370,
SEC_OID_HMAC_SHA3_512 = 371,
@ -560,7 +728,13 @@ diff --git a/lib/util/secoidt.h b/lib/util/secoidt.h
SEC_OID_DHSINGLEPASS_STDDH_SHA224KDF_SCHEME = 376,
SEC_OID_DHSINGLEPASS_STDDH_SHA256KDF_SCHEME = 377,
SEC_OID_DHSINGLEPASS_STDDH_SHA384KDF_SCHEME = 378,
@@ -561,10 +561,14 @@
SEC_OID_DHSINGLEPASS_STDDH_SHA512KDF_SCHEME = 379,
SEC_OID_DHSINGLEPASS_COFACTORDH_SHA1KDF_SCHEME = 380,
SEC_OID_DHSINGLEPASS_COFACTORDH_SHA224KDF_SCHEME = 381,
@@ -558,16 +558,20 @@ typedef enum {
/* ML-DSA Public keys and signatures use the same identifier */
#define SEC_OID_ML_DSA_44_SIGNATURE SEC_OID_ML_DSA_44
#define SEC_OID_ML_DSA_44_PUBLIC_KEY SEC_OID_ML_DSA_44
#define SEC_OID_ML_DSA_65_SIGNATURE SEC_OID_ML_DSA_65
#define SEC_OID_ML_DSA_65_PUBLIC_KEY SEC_OID_ML_DSA_65
#define SEC_OID_ML_DSA_87_SIGNATURE SEC_OID_ML_DSA_87
@ -575,10 +749,16 @@ diff --git a/lib/util/secoidt.h b/lib/util/secoidt.h
UNSUPPORTED_CERT_EXTENSION = 1,
SUPPORTED_CERT_EXTENSION = 2
} SECSupportExtenTag;
struct SECOidDataStr {
SECItem oid;
diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
--- a/tests/tools/tools.sh
+++ b/tests/tools/tools.sh
@@ -126,10 +126,11 @@
@@ -123,16 +123,17 @@ tools_init()
cp ${QADIR}/tools/PKCS5WithImplicitKDF.p12 ${TOOLSDIR}/data
cp ${QADIR}/tools/pbmac1-valid-sha256.p12 ${TOOLSDIR}/data
cp ${QADIR}/tools/pbmac1-valid-sha256-sha512.p12 ${TOOLSDIR}/data
cp ${QADIR}/tools/pbmac1-valid-sha512.p12 ${TOOLSDIR}/data
cp ${QADIR}/tools/pbmac1-invalid-bad-iter.p12 ${TOOLSDIR}/data
cp ${QADIR}/tools/pbmac1-invalid-bad-salt.p12 ${TOOLSDIR}/data
@ -590,7 +770,13 @@ diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
cp ${QADIR}/tools/openssl-ml-kem-768-both.p12 ${TOOLSDIR}/data
cp ${QADIR}/tools/openssl-ml-kem-1024-seed.p12 ${TOOLSDIR}/data
cp ${QADIR}/tools/openssl-ml-kem-1024-priv.p12 ${TOOLSDIR}/data
@@ -534,10 +535,21 @@
cp ${QADIR}/tools/openssl-ml-kem-1024-both.p12 ${TOOLSDIR}/data
@@ -531,16 +532,27 @@ tools_p12_import_rsa_pss_private_key()
${BINDIR}/certutil -d ${P_R_COPYDIR} -K -f ${R_PWFILE} | grep '^<[0-9 ]*> *rsaPss'
ret=$?
html_msg $ret 0 "Listing RSA-PSS private key imported from PKCS#12 file"
check_tmpfile
return $ret
@ -612,7 +798,13 @@ diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
echo "$SCRIPTNAME: Testing ml-kem compatibility with pkcs12 --------------"
for i in 768 1024
do
@@ -614,10 +626,11 @@
for j in 'seed' 'priv' 'both'
do
echo "${BINDIR}/pk12util -i ${TOOLSDIR}/data/openssl-ml-kem-$i-$j.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -W 'test' 2>&1"
@@ -611,16 +623,17 @@ tools_p12()
tools_p12_export_list_import_all_pkcs12v2pbe_ciphers
else
tools_p12_export_list_import_most_ciphers
fi
tools_p12_export_with_none_ciphers
tools_p12_export_with_invalid_ciphers
@ -622,6 +814,8 @@ diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
tools_p12_ml_kem_import
if using_sql; then
tools_p12_import_rsa_pss_private_key
tools_p12_policy
#tools_p12_policy
fi
}
############################## tools_sign ##############################

12
nss-3.124-ml-dsa-test-for-sign-verify-pkcs12.patch → nss-3.124-el9-ml-dsa-test-for-sign-verify-pkcs12.patch
View File

@ -1,11 +1,11 @@
# HG changeset patch
# User Robert Relyea <rrelyea@redhat.com>
# Date 1780515403 25200
# Wed Jun 03 12:36:43 2026 -0700
# Date 1781050448 25200
# Tue Jun 09 17:14:08 2026 -0700
# Branch NSS_3_124_BRANCH
# Node ID eaa726433f362aed5f4cdc40fe0b6aa813d99ed7
# Parent 8136ca511f641717eb0b88becf947767a0335eab
nss-3.124-ml-dsa-test-for-sign-verify-pkcs12.patch
# Node ID 07371c5f55e422e28311ef00131462bcf2058882
# Parent d6768ddf181e1f22b2b07b427eb2af4cf78d1d28
nss-3.124-el9-ml-dsa-test-for-sign-verify-pkcs12.patch
diff --git a/cmd/certutil/certutil.c b/cmd/certutil/certutil.c
--- a/cmd/certutil/certutil.c
@ -647,7 +647,7 @@ diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
tools_p12_ml_kem_import
if using_sql; then
tools_p12_import_rsa_pss_private_key
tools_p12_policy
#tools_p12_policy
fi
}

160
nss-3.124-no-p12-smime-policy.patch Normal file
View File

@ -0,0 +1,160 @@
# HG changeset patch
# User Robert Relyea <rrelyea@redhat.com>
# Date 1781048663 25200
# Tue Jun 09 16:44:23 2026 -0700
# Branch NSS_3_124_BRANCH
# Node ID f11e37ce2019be68e879875d774c770cf0a4c94a
# Parent a1ec20318f4fa9feeb4be2bc7339d573b4d78e27
nss-3.124-no-p12-smime-policy.patch
diff --git a/lib/pkcs12/p12plcy.c b/lib/pkcs12/p12plcy.c
--- a/lib/pkcs12/p12plcy.c
+++ b/lib/pkcs12/p12plcy.c
@@ -32,27 +32,31 @@ static pkcs12SuiteMap pkcs12SuiteMaps[]
{ SEC_OID_UNKNOWN, 0, PKCS12_NULL, PR_FALSE, PR_FALSE },
{ SEC_OID_UNKNOWN, 0, 0L, PR_FALSE, PR_FALSE }
};
/* determine if algid is an algorithm which is allowed */
static PRBool
sec_PKCS12Allowed(SECOidTag alg, PRUint32 needed)
{
+#ifdef notdef
PRUint32 policy;
SECStatus rv;
rv = NSS_GetAlgorithmPolicy(alg, &policy);
if (rv != SECSuccess) {
return PR_FALSE;
}
if ((policy & needed) == needed) {
return PR_TRUE;
}
return PR_FALSE;
+#else
+ return PR_TRUE;
+#endif
}
PRBool
SEC_PKCS12CipherAllowed(SECOidTag pbeAlg, SECOidTag hmacAlg)
{
SECOidTag cipherAlg = SEC_PKCS5GetCryptoFromAlgTag(pbeAlg);
SECOidTag hashAlg = SEC_PKCS5GetHashFromAlgTag(pbeAlg);
if (cipherAlg == SEC_OID_UNKNOWN) {
diff --git a/lib/smime/smimeutil.c b/lib/smime/smimeutil.c
--- a/lib/smime/smimeutil.c
+++ b/lib/smime/smimeutil.c
@@ -197,16 +197,17 @@ smime_get_policy_tag_from_key_length(SEC
return SEC_OID_UNKNOWN;
}
return algtag;
}
PRBool
smime_allowed_by_policy(SECOidTag algtag, PRUint32 neededPolicy)
{
+#ifdef notdef
PRUint32 policyFlags;
/* some S/MIME algs map to the same underlying KEA mechanism,
* collaps them here */
if ((neededPolicy & (NSS_USE_ALG_IN_SMIME_KX | NSS_USE_ALG_IN_SMIME_KX_LEGACY)) != 0) {
CK_MECHANISM_TYPE mechType = PK11_AlgtagToMechanism(algtag);
switch (mechType) {
case CKM_ECDH1_DERIVE:
@@ -216,16 +217,17 @@ smime_allowed_by_policy(SECOidTag algtag
}
}
if ((NSS_GetAlgorithmPolicy(algtag, &policyFlags) == SECFailure) ||
((policyFlags & neededPolicy) != neededPolicy)) {
PORT_SetError(SEC_ERROR_BAD_EXPORT_ALGORITHM);
return PR_FALSE;
}
+#endif
return PR_TRUE;
}
/*
* We'll need this for the fake policy oids for RC2, but the
* rest of these should be moved to pk11wrap for generic
* algtag to key size values. We already need this for
* sec_pkcs5v2_key_length_by oid.
@@ -480,28 +482,34 @@ smime_init_once(void *arg)
return PR_FAILURE;
}
algorithm_list_lock = PR_NewLock();
if (algorithm_list_lock == NULL) {
*error = PORT_GetError();
return PR_FAILURE;
}
+#ifdef notdef
/* At initialization time, we need to set up the defaults. We first
* look to see if the system or application has set up certain algorithms
* by policy. If they have set up values by policy we'll only allow those
* algorithms. We'll then look to see if any algorithms are enabled by
* the application. */
rv = NSS_GetAlgorithmPolicyAll(NSS_USE_ALG_IN_SMIME_LEGACY,
NSS_USE_ALG_IN_SMIME_LEGACY,
&tags, &tagCount);
if (tags) {
PORT_Free(tags);
tags = NULL;
}
+#else
+ /* just initialize the old maps */
+ rv = SECSuccess;
+ tagCount = 0;
+#endif
if ((rv != SECSuccess) || (tagCount == 0)) {
/* No algorithms have been enabled by policy (either by the system
* or by the application, we then will use the traditional default
* algorithms from the policy map */
for (i = smime_legacy_map_count - 1; i >= 0; i--) {
SECOidTag policytag = smime_legacy_map[i].policytag;
/* this enables the algorithm by policy. We need this or
* the policy code will reject attempts to use it */
diff --git a/tests/smime/smime.sh b/tests/smime/smime.sh
--- a/tests/smime/smime.sh
+++ b/tests/smime/smime.sh
@@ -898,13 +898,13 @@ smime_cleanup()
}
################## main #################################################
smime_init
smime_main
smime_data_tb
smime_p7
-if using_sql ; then
- smime_policy
-fi
+#if using_sql ; then
+# smime_policy
+#fi
smime_cleanup
diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
--- a/tests/tools/tools.sh
+++ b/tests/tools/tools.sh
@@ -614,17 +614,17 @@ tools_p12()
fi
tools_p12_export_with_none_ciphers
tools_p12_export_with_invalid_ciphers
tools_p12_import_old_files
tools_p12_import_pbmac1_samples
tools_p12_ml_kem_import
if using_sql; then
tools_p12_import_rsa_pss_private_key
- tools_p12_policy
+#tools_p12_policy
fi
}
############################## tools_sign ##############################
# local shell function pk12util uses a hardcoded tmp file, if this exists
# and is owned by another user we don't get reasonable errormessages
########################################################################
check_tmpfile()

11
nss-3.124-turn_off_non_dbm_tests.patch
View File

@ -1,3 +1,12 @@
# HG changeset patch
# User Robert Relyea <rrelyea@redhat.com>
# Date 1782418183 25200
# Thu Jun 25 13:09:43 2026 -0700
# Branch NSS_3_124_BRANCH
# Node ID f5b50861c24c1fd94f4326b3e4c7eb0ab9568bf3
# Parent 56214dd5d6d50d71c3637d7f0e4279c9e119018f
nss-3.124-turn_off_non_dbm_tests.patch
diff --git a/cmd/pk11importtest/pk11importtest.c b/cmd/pk11importtest/pk11importtest.c
--- a/cmd/pk11importtest/pk11importtest.c
+++ b/cmd/pk11importtest/pk11importtest.c
@ -876,7 +885,7 @@ diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
+ tools_p12_ml_dsa_import
+ tools_p12_ml_kem_import
tools_p12_import_rsa_pss_private_key
tools_p12_policy
#tools_p12_policy
fi
}

6
nss.spec
View File

@ -173,9 +173,9 @@ Patch22: nss-3.112-disable-md5.patch
Patch24: nss-3.71-fix-lto-gtests.patch
Patch26: nss-3.124-disable-ech.patch
Patch27: nss-3.124-el8-revert-libpkix-default.patch
Patch28: nss-3.124-no-p12-smime-policy.patch
Patch37: nss-3.124-allow-hash-override-pss.patch
Patch40: nss-3.90-dh-test-update.patch
Patch41: nss-3.124-ppc_no_init.patch
# https://bugzilla.mozilla.org/show_bug.cgi?id=676100
@ -184,7 +184,7 @@ Patch43: nss-3.124-tools-test-fix.patch
#in process upstream
Patch50: nss-3.124-fips-key-import-fix.patch
Patch51: nss-3.124-fix-ed-key-storage.patch
Patch51: nss-3.124-el9-fix-ed-key-storage.patch
Patch52: nss-3.124-indicators-prf.patch
Patch53: nss-3.124-annocheck.fix.patch
Patch54: nss-3.124-disable-kyber-test.patch
@ -193,7 +193,7 @@ Patch55: nss-3.124-fix-old-compiler-issue.patch
Patch60: nss-3.118-ml-dsa-leancrypto.patch
Patch61: nss-3.118-ml-dsa-tls.patch
Patch62: nss-3.124-prefer-all-hybrid.patch
Patch65: nss-3.124-ml-dsa-test-for-sign-verify-pkcs12.patch
Patch65: nss-3.124-el9-ml-dsa-test-for-sign-verify-pkcs12.patch
Patch66: nss-3.124-ml-dsa-tls-test.patch
Patch67: nss-3.118-ml-dsa-unittests.patch
Patch68: nss-3.123-fix-mldsa-import-regeneration.patch