Update NSPR to 4.12 and NSS to 3.23 on iOS

nss/lib/util/secoid.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "secoid.h"
 #include "pkcs11t.h"
 #include "secitem.h"
 #include "secerr.h"
 #include "prenv.h"
 #include "plhash.h"
@@ skipping 145 matching lines @@
 #define ANSI_X962_SIGNATURE_OID ANSI_X962_OID, 0x04
 #define ANSI_X962_SPECIFY_OID   ANSI_X962_SIGNATURE_OID, 0x03
 
 /* for Camellia: iso(1) member-body(2) jisc(392)
  *    mitsubishi(200011) isl(61) security(1) algorithm(1)
  */
 #define MITSUBISHI_ALG 0x2a,0x83,0x08,0x8c,0x9a,0x4b,0x3d,0x01,0x01
 #define CAMELLIA_ENCRYPT_OID MITSUBISHI_ALG,1
 #define CAMELLIA_WRAP_OID    MITSUBISHI_ALG,3
 
+/* For IDEA: 1.3.6.1.4.1.188.7.1.1
+ */
+#define ASCOM_OID 0x2b,0x6,0x1,0x4,0x1,0xbc
+#define ASCOM_IDEA_ALG ASCOM_OID,0x7,0x1,0x1
+
 /* for SEED : iso(1) member-body(2) korea(410)
  *    kisa(200004) algorithm(1)
  */
 #define SEED_OID                 0x2a,0x83,0x1a,0x8c,0x9a,0x44,0x01
 
 #define CONST_OID static const unsigned char
 
 CONST_OID md2[]                                 = { DIGEST, 0x02 };
 CONST_OID md4[]                                 = { DIGEST, 0x04 };
 CONST_OID md5[]                                 = { DIGEST, 0x05 };
@@ skipping 276 matching lines @@
 CONST_OID pkixOCSPResponderExtendedKeyUsage[]   = { PKIX_KEY_USAGE, 9 };
 CONST_OID msExtendedKeyUsageTrustListSigning[]  = { MS_CRYPTO_EKU, 1 };
 
 /* OIDs for Netscape defined algorithms */
 CONST_OID netscapeSMimeKEA[]                    = { NETSCAPE_ALGS, 0x01 };
 
 /* Fortezza algorithm OIDs */
 CONST_OID skipjackCBC[]                         = { MISSI, 0x04 };
 CONST_OID dhPublicKey[]                         = { ANSI_X942_ALGORITHM, 0x1 };
 
+CONST_OID idea_CBC[]                            = { ASCOM_IDEA_ALG, 2 };
+CONST_OID aes128_GCM[]                          = { AES, 0x6 };
+CONST_OID aes192_GCM[]                          = { AES, 0x1a };
+CONST_OID aes256_GCM[]                          = { AES, 0x2e };
 CONST_OID aes128_ECB[]                          = { AES, 1 };
 CONST_OID aes128_CBC[]                          = { AES, 2 };
 #ifdef DEFINE_ALL_AES_CIPHERS
 CONST_OID aes128_OFB[]                          = { AES, 3 };
 CONST_OID aes128_CFB[]                          = { AES, 4 };
 #endif
 CONST_OID aes128_KEY_WRAP[]                     = { AES, 5 };
 
 CONST_OID aes192_ECB[]                          = { AES, 21 };
 CONST_OID aes192_CBC[]                          = { AES, 22 };
@@ skipping 100 matching lines @@
 
 CONST_OID seed_CBC[]                            = { SEED_OID, 4 };
 
 CONST_OID evIncorporationLocality[]     = { EV_NAME_ATTRIBUTE, 1 };
 CONST_OID evIncorporationState[]        = { EV_NAME_ATTRIBUTE, 2 };
 CONST_OID evIncorporationCountry[]      = { EV_NAME_ATTRIBUTE, 3 };
 
 #define OI(x) { siDEROID, (unsigned char *)x, sizeof x }
 #ifndef SECOID_NO_STRINGS
 #define OD(oid,tag,desc,mech,ext) { OI(oid), tag, desc, mech, ext }
+#define ODE(tag,desc,mech,ext) { { siDEROID, NULL, 0 }, tag, desc, mech, ext }
 #else
 #define OD(oid,tag,desc,mech,ext) { OI(oid), tag, 0, mech, ext }
+#define ODE(tag,desc,mech,ext) { { siDEROID, NULL, 0 }, tag, 0, mech, ext }
 #endif
 
 #if defined(NSS_ALLOW_UNSUPPORTED_CRITICAL)
 #define FAKE_SUPPORTED_CERT_EXTENSION   SUPPORTED_CERT_EXTENSION
 #else
 #define FAKE_SUPPORTED_CERT_EXTENSION UNSUPPORTED_CERT_EXTENSION
 #endif
 
 /*
  * NOTE: the order of these entries must mach the SECOidTag enum in secoidt.h!
@@ skipping 1038 matching lines @@
         CKM_INVALID_MECHANISM /* not yet defined */, INVALID_CERT_EXTENSION),
     OD( nistDSASignaturewithSHA256Digest,
         SEC_OID_NIST_DSA_SIGNATURE_WITH_SHA256_DIGEST,
         "DSA with SHA-256 Signature",
         CKM_INVALID_MECHANISM /* not yet defined */, INVALID_CERT_EXTENSION),
     OD( msExtendedKeyUsageTrustListSigning, 
         SEC_OID_MS_EXT_KEY_USAGE_CTL_SIGNING,
         "Microsoft Trust List Signing",
         CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
     OD( x520Name, SEC_OID_AVA_NAME,
-        "X520 Name",    CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION )
+        "X520 Name",    CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+
+    OD( aes128_GCM, SEC_OID_AES_128_GCM,
+        "AES-128-GCM", CKM_AES_GCM, INVALID_CERT_EXTENSION ),
+    OD( aes192_GCM, SEC_OID_AES_192_GCM,
+        "AES-192-GCM", CKM_AES_GCM, INVALID_CERT_EXTENSION ),
+    OD( aes256_GCM, SEC_OID_AES_256_GCM,
+        "AES-256-GCM", CKM_AES_GCM, INVALID_CERT_EXTENSION ),
+    OD( idea_CBC, SEC_OID_IDEA_CBC,
+        "IDEA_CBC", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+
+    ODE( SEC_OID_RC2_40_CBC,
+        "RC2-40-CBC", CKM_RC2_CBC, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_DES_40_CBC,
+        "DES-40-CBC", CKM_RC2_CBC, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_RC4_40,
+        "RC4-40", CKM_RC4, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_RC4_56,
+        "RC4-56", CKM_RC4, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_NULL_CIPHER,
+        "NULL cipher", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_HMAC_MD5,
+        "HMAC-MD5", CKM_MD5_HMAC, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_RSA,
+        "TLS RSA key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_DHE_RSA,
+        "TLS DHE-RSA key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_DHE_DSS,
+        "TLS DHE-DSS key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_DH_RSA,
+        "TLS DH-RSA key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_DH_DSS,
+        "TLS DH-DSS key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_DH_ANON,
+        "TLS DH-ANON key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_ECDHE_ECDSA,
+        "TLS ECDHE-ECDSA key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_ECDHE_RSA,
+        "TLS ECDHE-RSA key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_ECDH_ECDSA,
+        "TLS ECDH-ECDSA key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_ECDH_RSA,
+        "TLS ECDH-RSA key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_ECDH_ANON,
+        "TLS ECDH-ANON key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_RSA_EXPORT,
+        "TLS RSA-EXPORT key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_DHE_RSA_EXPORT,
+        "TLS DHE-RSA-EXPORT key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_DHE_DSS_EXPORT,
+        "TLS DHE-DSS-EXPORT key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_DH_RSA_EXPORT,
+        "TLS DH-RSA-EXPORT key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_DH_DSS_EXPORT,
+        "TLS DH-DSS-EXPORT key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_TLS_DH_ANON_EXPORT,
+        "TLS DH-ANON-EXPORT key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_APPLY_SSL_POLICY,
+        "Apply SSL policy (pseudo-OID)", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION ),
+    ODE( SEC_OID_CHACHA20_POLY1305,
+        "ChaCha20-Poly1305", CKM_NSS_CHACHA20_POLY1305, INVALID_CERT_EXTENSION ),
+
 };
 
 /* PRIVATE EXTENDED SECOID Table
  * This table is private. Its structure is opaque to the outside.
  * It is indexed by the same SECOidTag as the oids table above.
  * Every member of this struct must have accessor functions (set, get)
  * and those functions must operate by value, not by reference.
  * The addresses of the contents of this table must not be exposed 
  * by the accessor functions.
  */
@@ skipping 212 matching lines @@
 /* normal static table processing */
 static PLHashTable *oidhash     = NULL;
 static PLHashTable *oidmechhash = NULL;
 
 static PLHashNumber
 secoid_HashNumber(const void *key)
 {
     return (PLHashNumber)((char *)key - (char *)NULL);
 }
 
+#define DEF_FLAGS (NSS_USE_ALG_IN_CERT_SIGNATURE|NSS_USE_ALG_IN_SSL_KX|NSS_USE_ALG_IN_SSL_KX)

[svaldez, 2016/04/04 15:59:51]

nit: dupped

 static void
 handleHashAlgSupport(char * envVal)
 {
     char * myVal = PORT_Strdup(envVal);  /* Get a copy we can alter */
     char * arg   = myVal;
 
     while (arg && *arg) {
         char *   nextArg = PL_strpbrk(arg, ";");
         PRUint32 notEnable;
 
         if (nextArg) {
             while (*nextArg == ';') {
                 *nextArg++ = '\0';
             }
         }
-        notEnable = (*arg == '-') ? (NSS_USE_ALG_IN_CERT_SIGNATURE|NSS_USE_ALG_IN_SSL_KX) : 0;
+        notEnable = (*arg == '-') ? (DEF_FLAGS) : 0;
         if ((*arg == '+' || *arg == '-') && *++arg) { 
             int i;
 
             for (i = 1; i < SEC_OID_TOTAL; i++) {
                 if (oids[i].desc && strstr(arg, oids[i].desc)) {
                      xOids[i].notPolicyFlags = notEnable |
-                    (xOids[i].notPolicyFlags & ~(NSS_USE_ALG_IN_CERT_SIGNATURE|NSS_USE_ALG_IN_SSL_KX));
+                    (xOids[i].notPolicyFlags & ~(DEF_FLAGS));
                 }
             }
         }
         arg = nextArg;
     }
     PORT_Free(myVal);  /* can handle NULL argument OK */
 }
 
 SECStatus
 SECOID_Init(void)
 {
     PLHashEntry *entry;
     const SECOidData *oid;
     int i;
     char * envVal;
 
 #define NSS_VERSION_VARIABLE __nss_util_version
 #include "verref.h"
 
     if (oidhash) {
         return SECSuccess; /* already initialized */
     }
 
-    if (!PR_GetEnv("NSS_ALLOW_WEAK_SIGNATURE_ALG")) {
+    if (!PR_GetEnvSecure("NSS_ALLOW_WEAK_SIGNATURE_ALG")) {
         /* initialize any policy flags that are disabled by default */
         xOids[SEC_OID_MD2                           ].notPolicyFlags = ~0;
         xOids[SEC_OID_MD4                           ].notPolicyFlags = ~0;
         xOids[SEC_OID_MD5                           ].notPolicyFlags = ~0;
         xOids[SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION ].notPolicyFlags = ~0;
         xOids[SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION ].notPolicyFlags = ~0;
         xOids[SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION ].notPolicyFlags = ~0;
         xOids[SEC_OID_PKCS5_PBE_WITH_MD2_AND_DES_CBC].notPolicyFlags = ~0;
         xOids[SEC_OID_PKCS5_PBE_WITH_MD5_AND_DES_CBC].notPolicyFlags = ~0;
     }
 
-    envVal = PR_GetEnv("NSS_HASH_ALG_SUPPORT");
+    /* turn off NSS_USE_POLICY_IN_SSL by default */
+    xOids[SEC_OID_APPLY_SSL_POLICY].notPolicyFlags = NSS_USE_POLICY_IN_SSL;
+
+    envVal = PR_GetEnvSecure("NSS_HASH_ALG_SUPPORT");
     if (envVal)
         handleHashAlgSupport(envVal);
 
     if (secoid_InitDynOidData() != SECSuccess) {
         PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
         PORT_Assert(0); /* this function should never fail */
         return SECFailure;
     }
     
     oidhash = PL_NewHashTable(0, SECITEM_Hash, SECITEM_HashCompare,
@@ skipping 235 matching lines @@
 void UTIL_SetForkState(PRBool forked)
 {
     parentForkedAfterC_Initialize = forked;
 }
 
 const char *
 NSSUTIL_GetVersion(void)
 {
     return NSSUTIL_VERSION;
 }