2020-01-03 J.C. Jones <jjones@mozilla.com>
* lib/nss/nss.h, lib/softoken/softkver.h, lib/util/nssutil.h:
Set version numbers to 3.49 final
[d41f5350554e] [NSS_3_49_RTM] <NSS_3_49_BRANCH>
2020-01-02 Kevin Jacobs <kjacobs@mozilla.com>
* gtests/ssl_gtest/ssl_version_unittest.cc, lib/ssl/ssl3con.c:
Bug 1513586 - Set downgrade sentinel for client TLS versions lower
than 1.2. r=mt
Per-[[ https://tools.ietf.org/html/rfc8446#section-4.1.3 | RFC 8446
]], the downgrade sentinel must be set by a TLS 1.3 server (and
should be set by a TLS 1.2 server) that negotiates TLS 1.0 or 1.1.
This patch corrects the behavior and adds a test.
[993717228da0]
2020-01-02 J.C. Jones <jjones@mozilla.com>
* .hgtags:
Added tag NSS_3_49_BETA1 for changeset 9ecd41cd2fa3
[62d36f2ee1cc]
Differential Revision: https://phabricator.services.mozilla.com/D58655
--HG--
extra : moz-landing-system : lando
The remote agent is an implementation of a subset of
the Chromium Remote Debugging Protocol (CDP) for Gecko.
For similar reasons as Marionette it needs the ability to call
nsCertOverrideService::SetDisableAllSecurityChecksAndLetAttackersInterceptMyData().
It calls this method from remote/domains/parent/Security.jsm which
implements the Security.setIgnoreCertificateErrors protocol method.
The remote agent is slated to replace Marionette, but there is
currently no timeline for this.
Differential Revision: https://phabricator.services.mozilla.com/D58435
--HG--
extra : moz-landing-system : lando
It must only be possible to call
nsCertOverrideService::SetDisableAllSecurityChecksAndLetAttackersInterceptMyData()
when Marionette is actually active, but the MOZ_MARIONETTE environment
variable can in theory be set by any user.
MOZ_MARIONETTE was introduced to support in-application restarts
so that the forked main process knows to re-initialise Marionette.
This makes it approximately equivalent to passing the --marionette flag.
Because Marionette can be started and stopped at runtime through
modifying the marionette.enabled preference, and Marionette never
resets MOZ_MARIONETTE, this makes it theoretically possible that
a future caller could circumvent this security check.
This is however not a security problem at present because the
method is only ever called from within testing/marionette/cert.js,
which itself is never called unless Marionette indeed is active.
Still, it would be safer for this to use nsIMarionette.running()
which returns true whenever the Marionette server is listening for
connections, and false when the Marionette automation protocol is
not enabled.
Differential Revision: https://phabricator.services.mozilla.com/D58434
--HG--
extra : moz-landing-system : lando
The remote agent is an implementation of a subset of
the Chromium Remote Debugging Protocol (CDP) for Gecko.
For similar reasons as Marionette it needs the ability to call
nsCertOverrideService::SetDisableAllSecurityChecksAndLetAttackersInterceptMyData().
It calls this method from remote/domains/parent/Security.jsm which
implements the Security.setIgnoreCertificateErrors protocol method.
The remote agent is slated to replace Marionette, but there is
currently no timeline for this.
Differential Revision: https://phabricator.services.mozilla.com/D58435
--HG--
extra : moz-landing-system : lando
It must only be possible to call
nsCertOverrideService::SetDisableAllSecurityChecksAndLetAttackersInterceptMyData()
when Marionette is actually active, but the MOZ_MARIONETTE environment
variable can in theory be set by any user.
MOZ_MARIONETTE was introduced to support in-application restarts
so that the forked main process knows to re-initialise Marionette.
This makes it approximately equivalent to passing the --marionette flag.
Because Marionette can be started and stopped at runtime through
modifying the marionette.enabled preference, and Marionette never
resets MOZ_MARIONETTE, this makes it theoretically possible that
a future caller could circumvent this security check.
This is however not a security problem at present because the
method is only ever called from within testing/marionette/cert.js,
which itself is never called unless Marionette indeed is active.
Still, it would be safer for this to use nsIMarionette.running()
which returns true whenever the Marionette server is listening for
connections, and false when the Marionette automation protocol is
not enabled.
Differential Revision: https://phabricator.services.mozilla.com/D58434
--HG--
extra : moz-landing-system : lando
2020-01-02 Giulio Benetti <giulio.benetti@benettiengineering.com>
* lib/ssl/sslsnce.c:
Bug 1606025 - Remove -Wmaybe-uninitialized warning in sslsnce.c
r=jcj
(Amended by jcj to also set privKeyCopy to NULL)
[9ecd41cd2fa3] [NSS_3_49_BETA1]
* lib/freebl/gcm.h:
Bug 1606119 - Fix PPC HW Crypto build failure r=jcj
All Altivec *_be() functions are supported from gcc version 8.x not
5.x so modify gcc version check that at the moment cause build
failure due to missing Altivec *_be() functions.
[7ab634a7d772]
2020-01-01 Alex Henrie <alexhenrie24@gmail.com>
* cmd/modutil/install-ds.c:
Bug 1605545 - Fix memory leak in Pk11Install_Platform_Generate. r=mt
[748b308170a4]
Differential Revision: https://phabricator.services.mozilla.com/D58541
--HG--
extra : moz-landing-system : lando
2019-12-20 J.C. Jones <jjones@mozilla.com>
* lib/freebl/verified/FStar.c, lib/freebl/verified/FStar.h,
lib/freebl/verified/Hacl_Chacha20.c,
lib/freebl/verified/Hacl_Chacha20.h,
lib/freebl/verified/Hacl_Chacha20Poly1305_128.c,
lib/freebl/verified/Hacl_Chacha20Poly1305_128.h,
lib/freebl/verified/Hacl_Chacha20Poly1305_32.c,
lib/freebl/verified/Hacl_Chacha20Poly1305_32.h,
lib/freebl/verified/Hacl_Chacha20_Vec128.c,
lib/freebl/verified/Hacl_Chacha20_Vec128.h,
lib/freebl/verified/Hacl_Curve25519.c,
lib/freebl/verified/Hacl_Curve25519.h,
lib/freebl/verified/Hacl_Curve25519_51.c,
lib/freebl/verified/Hacl_Curve25519_51.h,
lib/freebl/verified/Hacl_Kremlib.h,
lib/freebl/verified/Hacl_Poly1305_128.c,
lib/freebl/verified/Hacl_Poly1305_128.h,
lib/freebl/verified/Hacl_Poly1305_32.c,
lib/freebl/verified/Hacl_Poly1305_32.h,
lib/freebl/verified/Hacl_Poly1305_64.c,
lib/freebl/verified/Hacl_Poly1305_64.h,
lib/freebl/verified/kremlib.h, lib/freebl/verified/kremlib_base.h,
lib/freebl/verified/kremlin/include/kremlin/internal/callconv.h,
lib/freebl/verified/kremlin/include/kremlin/internal/compat.h,
lib/freebl/verified/kremlin/include/kremlin/internal/target.h,
lib/freebl/verified/kremlin/include/kremlin/internal/types.h,
lib/freebl/verified/kremlin/include/kremlin/lowstar_endianness.h,
lib/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt128.h, li
b/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt128_Verifie
d.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt_8_1
6_32_64.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/LowStar_
Endianness.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar
_uint128_gcc64.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/f
star_uint128_msvc.h, lib/freebl/verified/libintvector.h,
lib/freebl/verified/specs/Spec.CTR.fst,
lib/freebl/verified/specs/Spec.Chacha20.fst,
lib/freebl/verified/specs/Spec.Curve25519.fst,
lib/freebl/verified/specs/Spec.Poly1305.fst,
lib/freebl/verified/vec128.h:
Backed out changeset c351b2f60b40 (Bug 1574643) for crashes on early
SSE4 CPUs
[b6eb18f04260] [tip]
* automation/saw/chacha20.saw, automation/taskcluster/docker-
builds/Dockerfile, automation/taskcluster/docker-
hacl/B6C8F98282B944E3B0D5C2530FC3042E345AD05D.asc,
automation/taskcluster/docker-hacl/Dockerfile,
automation/taskcluster/docker-hacl/bin/checkout.sh,
automation/taskcluster/docker-hacl/license.txt,
automation/taskcluster/docker-hacl/setup-user.sh,
automation/taskcluster/docker-hacl/setup.sh,
automation/taskcluster/graph/src/extend.js,
automation/taskcluster/scripts/run_hacl.sh,
gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc,
lib/freebl/Makefile, lib/freebl/blapii.h, lib/freebl/blinit.c,
lib/freebl/chacha20poly1305.c, lib/freebl/det_rng.c,
lib/freebl/ecl/curve25519_64.c, lib/freebl/freebl.gyp,
lib/freebl/freebl_base.gypi, nss-tool/hw-support.c:
Backed out changeset ac51d2490f9c (Bug 1574643) for crashes on early
SSE4 CPUs
[f6d8c73584e0]
2019-12-19 Giulio Benetti <giulio.benetti@benettiengineering.com>
* coreconf/Linux.mk, coreconf/config.gypi:
Bug 1602288 - Fix build failure due to missing posix signal.h
r=kjacobs
[82bae6299c8e]
2019-12-12 Makoto Kato <m_kato@ga2.so-net.ne.jp>
* lib/freebl/blinit.c, lib/freebl/ctr.c, lib/freebl/freebl.gyp,
lib/freebl/rijndael.c:
Bug 1588714 - Implement CheckARMSupport for Win64/aarch64. r=kjacobs
aarch64 doesn't have `cpuid` like instruction set. Actually, we use
getauxval system call on Linux/aarch64 to check CPU features.
Windows has `IsProcessorFeaturePresent` API to get CPU features, so
we should use it to check whether current CPU supports ARM Crypto
extension.
[3ba8a584ddea]
Differential Revision: https://phabricator.services.mozilla.com/D58060
--HG--
extra : moz-landing-system : lando
Bug 1603999 changed the environment so that whether you can enter the chroot is
passed as the first character in the environment variable. This caused all
content processes that don't enter the chroot to crash. This can happen
trivially with any sandbox level < 4.
Differential Revision: https://phabricator.services.mozilla.com/D57927
--HG--
extra : moz-landing-system : lando
This changeset is a simple find and replace of `MOZ_FALLTHROUGH` and `[[fallthrough]]`.
Unfortunately, the MOZ_FALLTHROUGH_ASSERT macro (to assert on case fallthrough in debug builds) is still necessary after switching from [[clang::fallthrough]] to [[fallthrough]] because:
* MOZ_ASSERT(false) followed by [[fallthrough]] triggers a -Wunreachable-code warning in DEBUG builds
* but MOZ_ASSERT(false) without [[fallthrough]] triggers a -Wimplicit-fallthrough warning in NDEBUG builds.
Differential Revision: https://phabricator.services.mozilla.com/D56440
--HG--
extra : moz-landing-system : lando
2019-12-18 Franziskus Kiefer <franziskuskiefer@gmail.com>
* automation/saw/chacha20.saw, automation/taskcluster/docker-
builds/Dockerfile, automation/taskcluster/docker-
hacl/B6C8F98282B944E3B0D5C2530FC3042E345AD05D.asc,
automation/taskcluster/docker-hacl/Dockerfile,
automation/taskcluster/docker-hacl/bin/checkout.sh,
automation/taskcluster/docker-hacl/license.txt,
automation/taskcluster/docker-hacl/setup-user.sh,
automation/taskcluster/docker-hacl/setup.sh,
automation/taskcluster/graph/src/extend.js,
automation/taskcluster/scripts/run_hacl.sh,
gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc,
lib/freebl/Makefile, lib/freebl/blapii.h, lib/freebl/blinit.c,
lib/freebl/chacha20poly1305.c, lib/freebl/det_rng.c,
lib/freebl/ecl/curve25519_64.c, lib/freebl/freebl.gyp,
lib/freebl/freebl_base.gypi, nss-tool/hw-support.c:
Bug 1574643 - NSS changes for haclv2 r=jcj,kjacobs
This patch contains the changes in NSS, necessary to pick up HACL*v2
in D55413. It has a couple of TODOs:
* The chacha20 saw verification fails for some reason; it's disabled
pending Bug 1604130.
* The hacl task on CI requires Bug 1593647 to get fixed.
Depends on D55413.
[ac51d2490f9c] [tip]
* lib/freebl/verified/FStar.c, lib/freebl/verified/FStar.h,
lib/freebl/verified/Hacl_Chacha20.c,
lib/freebl/verified/Hacl_Chacha20.h,
lib/freebl/verified/Hacl_Chacha20Poly1305_128.c,
lib/freebl/verified/Hacl_Chacha20Poly1305_128.h,
lib/freebl/verified/Hacl_Chacha20Poly1305_32.c,
lib/freebl/verified/Hacl_Chacha20Poly1305_32.h,
lib/freebl/verified/Hacl_Chacha20_Vec128.c,
lib/freebl/verified/Hacl_Chacha20_Vec128.h,
lib/freebl/verified/Hacl_Curve25519.c,
lib/freebl/verified/Hacl_Curve25519.h,
lib/freebl/verified/Hacl_Curve25519_51.c,
lib/freebl/verified/Hacl_Curve25519_51.h,
lib/freebl/verified/Hacl_Kremlib.h,
lib/freebl/verified/Hacl_Poly1305_128.c,
lib/freebl/verified/Hacl_Poly1305_128.h,
lib/freebl/verified/Hacl_Poly1305_32.c,
lib/freebl/verified/Hacl_Poly1305_32.h,
lib/freebl/verified/Hacl_Poly1305_64.c,
lib/freebl/verified/Hacl_Poly1305_64.h,
lib/freebl/verified/kremlib.h, lib/freebl/verified/kremlib_base.h,
lib/freebl/verified/kremlin/include/kremlin/internal/callconv.h,
lib/freebl/verified/kremlin/include/kremlin/internal/compat.h,
lib/freebl/verified/kremlin/include/kremlin/internal/target.h,
lib/freebl/verified/kremlin/include/kremlin/internal/types.h,
lib/freebl/verified/kremlin/include/kremlin/lowstar_endianness.h,
lib/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt128.h, li
b/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt128_Verifie
d.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/FStar_UInt_8_1
6_32_64.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/LowStar_
Endianness.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar
_uint128_gcc64.h, lib/freebl/verified/kremlin/kremlib/dist/minimal/f
star_uint128_msvc.h, lib/freebl/verified/libintvector.h,
lib/freebl/verified/specs/Spec.CTR.fst,
lib/freebl/verified/specs/Spec.Chacha20.fst,
lib/freebl/verified/specs/Spec.Curve25519.fst,
lib/freebl/verified/specs/Spec.Poly1305.fst,
lib/freebl/verified/vec128.h:
Bug 1574643 - haclv2 code r=kjacobs
This updates the in-tree version of our existing HACL* code to v2,
replacing what we have already. Once this landed NSS can pick up
more (faster) code from HACL*.
[c351b2f60b40]
Differential Revision: https://phabricator.services.mozilla.com/D57821
--HG--
extra : moz-landing-system : lando
- make the fork server use the same sandbox level as content processes to make preloading work correctly.
- pass |canChroot| through env instead of hard coding.
Differential Revision: https://phabricator.services.mozilla.com/D57221
--HG--
extra : moz-landing-system : lando
Intermediate preloading telemetry is overwhelmingly "failedToObserve", which at
the moment is a catch-all indicating that something in
updatePreloadedIntermediates failed. We need to figure out why, so this patch
re-purposes the categories "emptyAttachment", "failedToFetch", and
"unexpectedLength", which are currently not used, to indicate failures in
specific sub-operations in that function.
Differential Revision: https://phabricator.services.mozilla.com/D57676
--HG--
extra : moz-landing-system : lando
The OS APIs used by the osclientcerts module aren't guaranteed to be
thread-safe. To deal with this, this patch introduces a dedicated thread to
perform these operations.
Differential Revision: https://phabricator.services.mozilla.com/D56465
--HG--
extra : moz-landing-system : lando
2019-11-25 Robert Relyea <rrelyea@redhat.com>
* lib/softoken/legacydb/keydb.c, lib/softoken/legacydb/lgcreate.c,
lib/softoken/legacydb/lgdb.h, lib/softoken/legacydb/lginit.c,
lib/softoken/lgglue.c, lib/softoken/lowpbe.c, lib/softoken/lowpbe.h,
lib/softoken/pkcs11c.c, lib/softoken/pkcs11i.h,
lib/softoken/pkcs11u.c, lib/softoken/sdb.c, lib/softoken/sdb.h,
lib/softoken/sftkdb.c, lib/softoken/sftkdb.h,
lib/softoken/sftkdbti.h, lib/softoken/sftkpwd.c, lib/util/pkcs11n.h:
Bug 1585189 - Changed the algorithm used to encrypt NSS database
entries, from 3DES to AES256.
Our NSS DB uses 3DES internally to encrypt their entries. This patch
changes the default algorithm for AES256 to increase the security.
This patch also adds code to use AES Wrap in the future. It also
adds an integrity check to the AES256 CBC. The change only affects
sqlite databases.
bob
[fc636973ad06] [tip]
2019-12-12 Kevin Jacobs <kjacobs@mozilla.com>
* gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc,
lib/softoken/pkcs11c.c:
Bug 1603257 - Fix UBSAN issue in softoken CKM_NSS_CHACHA20_CTR
initialization r=mt
This patch adds an explicit cast to fix a UBSAN issue that was
flagged in https://treeherder.mozilla.org/#/jobs?repo=nss-
try&selectedJob=280720441.
It also updates the test to use a random IV.
[9ca79efd6d29]
2019-12-10 Kevin Jacobs <kjacobs@mozilla.com>
* gtests/ssl_gtest/ssl_hrr_unittest.cc:
Bug 1590001 - Additional HRR Tests. r=mt
This patch adds new tests for version limitations after a HRR.
[8a2bd40e7f89]
2019-12-11 Martin Thomson <mt@lowentropy.net>
* gtests/ssl_gtest/ssl_hrr_unittest.cc:
Bug 1600144 - clang-format, a=bustage
[014f37ecee3e]
2019-11-29 Martin Thomson <mt@lowentropy.net>
* gtests/ssl_gtest/ssl_hrr_unittest.cc, lib/ssl/dtlscon.c:
Bug 1600144 - Treat ClientHello with message_seq of 1 as a second
ClientHello, r=kjacobs
Summary: The logic that deals with stateless HelloRetryRequest in
DTLS allows this one-off increment to the message_seq field in case
the server was operating statelessly. However, when it does, it
should insist on the ClientHello carrying a cookie; concretely, it
should set the flag that says that a HelloRetryRequest was sent,
even if it doesn't currently remember that it sent one. That is the
only way that this condition could be met.
[f55fe2a2dab9]
2019-12-11 Martin Thomson <mt@lowentropy.net>
* gtests/ssl_gtest/tls_esni_unittest.cc:
Bug 1603027 - clang-format, a=bustage
[ca9adb8eb899]
2019-12-11 EKR <ekr@rtfm.com>
* gtests/ssl_gtest/tls_esni_unittest.cc:
Bug 1603027 - Check that ESNI gets regenerated with HRR r=mt
[6655d8a1f4bd]
2019-12-09 Andi-Bogdan Postelnicu <bpostelnicu@mozilla.com>
* mach:
Bug 1598485 - Exclude files that are not part of the nss repository
from the analysis artifact. r=jcj
[38a1c27aadf3]
Differential Revision: https://phabricator.services.mozilla.com/D57470
--HG--
extra : moz-landing-system : lando
2019-12-06 Daiki Ueno <dueno@redhat.com>
* lib/pki/pki3hack.c:
Bug 1593167, certdb: propagate trust information if trust module is
loaded afterwards, r=rrelyea,keeler
Summary: When the builtin trust module is loaded after some temp
certs being created, these temp certs are usually not accompanied by
trust information. This causes a problem in Firefox as it loads the
module from a separate thread while accessing the network cache
which populates temp certs.
This change makes it properly roll up the trust information, if a
temp cert doesn't have trust information.
Reviewers: rrelyea, keeler
Reviewed By: rrelyea, keeler
Subscribers: reviewbot, heftig
Bug #: 1593167
[c46bc59ce7d4] [tip]
2019-11-08 Martin Thomson <mt@lowentropy.net>
* lib/ssl/tls13subcerts.c:
Bug 1594965 - Include saltLength in DC SPKI, r=kjacobs
Summary: I discovered this when validating new additions to our root
store policy. The encodings there didn't line up with what we were
producing with DC.
[661058254ade]
2019-12-04 J.C. Jones <jjones@mozilla.com>
* automation/release/nss-release-helper.py:
Bug 1535787 - Further improvements to the release-helper API r=mt
[7baba392bf8b]
* automation/release/nss-release-helper.py:
Bug 1535787 - flake8 style updates to nss-release-helper.py
r=kjacobs
Depends on D23757
[b31e68a789fa]
* automation/release/nss-release-helper.py:
Bug 1535787 - Use Python for the regexes in nss-release-helper
r=keeler,kjacobs
automation/release/nss-release-helper.py doesn't actually edit the
files correctly on MacOS due to differences between GNU and BSD sed.
It's python, so let's just use python regexes.
[92271739e848]
2019-12-04 Franziskus Kiefer <franziskuskiefer@gmail.com>
* automation/taskcluster/graph/src/extend.js,
automation/taskcluster/graph/src/queue.js,
automation/taskcluster/scripts/check_abi.sh, build.sh,
coreconf/config.gypi, help.txt, lib/freebl/freebl_base.gypi, mach,
tests/all.sh, tests/common/init.sh, tests/remote/Makefile:
Bug 1594933 - disable libnssdbm by default; keep build on CI, r=jcj
Disale libnssdbm by default and add flag to enable it in builds. On
CI a build and certs test with enabled legacy DB are added.
Note that for some reason the coverage build fails. I have no idea
why. I'm open for ideas.
[c1fad130dce2]
2019-12-03 Makoto Kato <m_kato@ga2.so-net.ne.jp>
* lib/freebl/Makefile, lib/freebl/freebl.gyp, lib/freebl/gcm-
arm32-neon.c, lib/freebl/gcm.c:
Bug 1562548 - Improve GCM perfomance on aarch32 using NEON.
r=kjacobs
Optimize GCM perfomance using
https://conradoplg.cryptoland.net/files/2010/12/gcm14.pdf via ARM's
NEON.
[a9ba652046e6]
2019-12-03 J.C. Jones <jjones@mozilla.com>
* automation/abi-check/expected-report-libssl3.so.txt, automation/abi-
check/previous-nss-release, lib/nss/nss.h, lib/softoken/softkver.h,
lib/util/nssutil.h:
Set version numbers to 3.49 beta
[3051793c68fc]
2019-12-02 J.C. Jones <jjones@mozilla.com>
* .hgtags:
Added tag NSS_3_48_BETA1 for changeset 77976f3fefca
[06d5b4f91a9c]
Differential Revision: https://phabricator.services.mozilla.com/D56378
--HG--
extra : moz-landing-system : lando
This change modifies all tests that use key3/cert8 to use the new files. It
removes test_sdr_upgraded_with_password, as without the upgrade part that is now
the same test as test_sdr_preexisting_with_password.
Differential Revision: https://phabricator.services.mozilla.com/D55708
--HG--
rename : security/manager/ssl/tests/unit/test_sdr_preexisting/key4.db => security/manager/ssl/tests/unit/test_broken_fips/key4.db
extra : moz-landing-system : lando
This change modifies all tests that use key3/cert8 to use the new files. It
removes test_sdr_upgraded_with_password, as without the upgrade part that is now
the same test as test_sdr_preexisting_with_password.
Differential Revision: https://phabricator.services.mozilla.com/D55708
--HG--
rename : security/manager/ssl/tests/unit/test_sdr_preexisting/key4.db => security/manager/ssl/tests/unit/test_broken_fips/key4.db
extra : moz-landing-system : lando
This is generally pretty straightforward, and rewrites nearly all calls. It
skips the ones that it can detect using frame script globals like
`sendAsyncMessage`, though.
Differential Revision: https://phabricator.services.mozilla.com/D53740
--HG--
extra : moz-landing-system : lando
This change removes the legacy libnssdbm database that we migrated away from since Firefox 60.
This change modifies all tests that use key3/cert8 to use the new files. It
removes test_sdr_upgraded_with_password, as without the upgrade part that is now
the same test as test_sdr_preexisting_with_password. It otherwise removes support for libnssdbm everywhere in Gecko.
Differential Revision: https://phabricator.services.mozilla.com/D55708
--HG--
rename : security/manager/ssl/tests/unit/test_sdr_preexisting/key4.db => security/manager/ssl/tests/unit/test_broken_fips/key4.db
extra : moz-landing-system : lando
Bug 1267643 changed how gecko finds client certificates to offer to the user to
use. This change was too permissive, so we reintroduced some filtering in bug
1590888 and bug 1592532. All of these changes together were too restrictive and
filtered out CA certificates, which some users evidently use as client
certificates. This bug removes the restriction that client certificates not be
CA certificates and hopefully arrives at pre-bug 1267643 behavior.
Differential Revision: https://phabricator.services.mozilla.com/D56618
--HG--
extra : moz-landing-system : lando
The test starts timed out after applying the changes in P1-P3. The main reason is that P1-P3 ensure SWM and the QuotaManger clear their storage in any condition in clear data service. However, since the SWM adds a shutdown blocker during the initialization and it's initialized during the profile-change-teardown because of the changes and the test scenario.
To fix that, ideally, SWM should differentiate if it's initialized before or during the profile-change-teardown and that requires a non-small change. Since we haven't got this signature in the real world and similar cases (SWM gets initialized during profile-change-teardown) have been taken care of, this patch only adds a workaround to avoid the issue.
Differential Revision: https://phabricator.services.mozilla.com/D56526
--HG--
extra : moz-landing-system : lando
To evaluate the performance impact of CRLite over OCSP, we need to measure when
CRLite is (presumably) faster and by how much. To do this, we measure the
duration of the respective operations and when both occur for the same
verification, we make a note in the appropriate histogram of how much faster
one was than the other.
data-review+ was already given in bug 1488865 comment 5
Differential Revision: https://phabricator.services.mozilla.com/D56508
--HG--
extra : moz-landing-system : lando
This is generally pretty straightforward, and rewrites nearly all calls. It
skips the ones that it can detect using frame script globals like
`sendAsyncMessage`, though.
Differential Revision: https://phabricator.services.mozilla.com/D53740
--HG--
extra : moz-landing-system : lando
If we turn on Rust PGO, the build system can't deal with the mixture of this NO_PGO library along with its PGO'ed Rust dependency. It seems that this NO_PGO might have been a copy/paste artifact anyway, so let's go ahead and remove it.
Differential Revision: https://phabricator.services.mozilla.com/D56587
--HG--
extra : moz-landing-system : lando
Most of these fixes involve fixing test XUL to not use <dialog> as a top level element or replacing calls to document.documentElement that expect it to return the dialog, now that the dialog is not the top level element anymore.
Differential Revision: https://phabricator.services.mozilla.com/D53722
--HG--
extra : moz-landing-system : lando
This patch also includes necessary JS changes to support this. Most commonly, the dialog was accessed with document.documentElement, which needed to be changed now that the dialog is not the top level element.
Differential Revision: https://phabricator.services.mozilla.com/D52411
--HG--
extra : moz-landing-system : lando
