Bug 1622033 - Disable flag for SEED deprecation. r=kjacobs,rrelyea

Differential Revision: https://phabricator.services.mozilla.com/D70672 --HG-- extra : moz-landing-system : lando
sailfishos-mirror · May 5, 2020 · ed3b7ab · ed3b7ab
1 parent 8ab9e21
commit ed3b7ab
Show file tree

Hide file tree

Showing 13 changed files with 163 additions and 27 deletions.
diff --git a/cmd/bltest/blapitest.c b/cmd/bltest/blapitest.c
@@ -622,21 +622,23 @@ typedef enum {
     bltestAES_GCM,      /* .                     */
     bltestCAMELLIA_ECB, /* .                     */
     bltestCAMELLIA_CBC, /* .                     */
-    bltestSEED_ECB,     /* SEED algorithm      */
-    bltestSEED_CBC,     /* SEED algorithm      */
-    bltestCHACHA20,     /* ChaCha20 + Poly1305   */
-    bltestRSA,          /* Public Key Ciphers    */
-    bltestRSA_OAEP,     /* . (Public Key Enc.)   */
-    bltestRSA_PSS,      /* . (Public Key Sig.)   */
-    bltestECDSA,        /* . (Public Key Sig.)   */
-    bltestDSA,          /* . (Public Key Sig.)   */
-    bltestMD2,          /* Hash algorithms       */
-    bltestMD5,          /* .             */
-    bltestSHA1,         /* .             */
-    bltestSHA224,       /* .             */
-    bltestSHA256,       /* .             */
-    bltestSHA384,       /* .             */
-    bltestSHA512,       /* .             */
+#ifndef NSS_DISABLE_DEPRECATED_SEED
+    bltestSEED_ECB, /* SEED algorithm      */
+    bltestSEED_CBC, /* SEED algorithm      */
+#endif
+    bltestCHACHA20, /* ChaCha20 + Poly1305   */
+    bltestRSA,      /* Public Key Ciphers    */
+    bltestRSA_OAEP, /* . (Public Key Enc.)   */
+    bltestRSA_PSS,  /* . (Public Key Sig.)   */
+    bltestECDSA,    /* . (Public Key Sig.)   */
+    bltestDSA,      /* . (Public Key Sig.)   */
+    bltestMD2,      /* Hash algorithms       */
+    bltestMD5,      /* .             */
+    bltestSHA1,     /* .             */
+    bltestSHA224,   /* .             */
+    bltestSHA256,   /* .             */
+    bltestSHA384,   /* .             */
+    bltestSHA512,   /* .             */
     NUMMODES
 } bltestCipherMode;
 
@@ -660,8 +662,10 @@ static char *mode_strings[] =
       "aes_gcm",
       "camellia_ecb",
       "camellia_cbc",
+#ifndef NSS_DISABLE_DEPRECATED_SEED
       "seed_ecb",
       "seed_cbc",
+#endif
       "chacha20_poly1305",
       "rsa",
       "rsa_oaep",
@@ -792,8 +796,12 @@ struct bltestCipherInfoStr {
 PRBool
 is_symmkeyCipher(bltestCipherMode mode)
 {
-    /* change as needed! */
+/* change as needed! */
+#ifndef NSS_DISABLE_DEPRECATED_SEED
     if (mode >= bltestDES_ECB && mode <= bltestSEED_CBC)
+#else
+    if (mode >= bltestDES_ECB && mode <= bltestCAMELLIA_CBC)
+#endif
         return PR_TRUE;
     return PR_FALSE;
 }
@@ -880,7 +888,9 @@ cipher_requires_IV(bltestCipherMode mode)
         case bltestAES_CTR:
         case bltestAES_GCM:
         case bltestCAMELLIA_CBC:
+#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_CBC:
+#endif
         case bltestCHACHA20:
             return PR_TRUE;
         default:
@@ -1176,6 +1186,7 @@ camellia_Decrypt(void *cx, unsigned char *output, unsigned int *outputLen,
                             input, inputLen);
 }
 
+#ifndef NSS_DISABLE_DEPRECATED_SEED
 SECStatus
 seed_Encrypt(void *cx, unsigned char *output, unsigned int *outputLen,
              unsigned int maxOutputLen, const unsigned char *input,
@@ -1193,6 +1204,7 @@ seed_Decrypt(void *cx, unsigned char *output, unsigned int *outputLen,
     return SEED_Decrypt((SEEDContext *)cx, output, outputLen, maxOutputLen,
                         input, inputLen);
 }
+#endif /* NSS_DISABLE_DEPRECATED_SEED */
 
 SECStatus
 rsa_PublicKeyOp(void *cx, SECItem *output, const SECItem *input)
@@ -1587,6 +1599,7 @@ bltest_camellia_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
     return SECSuccess;
 }
 
+#ifndef NSS_DISABLE_DEPRECATED_SEED
 SECStatus
 bltest_seed_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
 {
@@ -1630,6 +1643,7 @@ bltest_seed_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
 
     return SECSuccess;
 }
+#endif /* NSS_DISABLE_DEPRECATED_SEED */
 
 SECStatus
 bltest_chacha20_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
@@ -2282,12 +2296,14 @@ cipherInit(bltestCipherInfo *cipherInfo, PRBool encrypt)
                               cipherInfo->input.pBuf.len);
             return bltest_camellia_init(cipherInfo, encrypt);
             break;
+#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_ECB:
         case bltestSEED_CBC:
             SECITEM_AllocItem(cipherInfo->arena, &cipherInfo->output.buf,
                               cipherInfo->input.pBuf.len);
             return bltest_seed_init(cipherInfo, encrypt);
             break;
+#endif /* NSS_DISABLE_DEPRECATED_SEED */
         case bltestCHACHA20:
             outlen = cipherInfo->input.pBuf.len + (encrypt ? 16 : 0);
             SECITEM_AllocItem(cipherInfo->arena, &cipherInfo->output.buf, outlen);
@@ -2586,10 +2602,12 @@ cipherFinish(bltestCipherInfo *cipherInfo)
         case bltestCAMELLIA_CBC:
             Camellia_DestroyContext((CamelliaContext *)cipherInfo->cx, PR_TRUE);
             break;
+#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_ECB:
         case bltestSEED_CBC:
             SEED_DestroyContext((SEEDContext *)cipherInfo->cx, PR_TRUE);
             break;
+#endif /* NSS_DISABLE_DEPRECATED_SEED */
         case bltestCHACHA20:
             ChaCha20Poly1305_DestroyContext((ChaCha20Poly1305Context *)
                                                 cipherInfo->cx,
@@ -2747,8 +2765,10 @@ dump_performance_info(bltestCipherInfo *infoList, double totalTimeInt,
         case bltestAES_GCM:
         case bltestCAMELLIA_ECB:
         case bltestCAMELLIA_CBC:
+#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_ECB:
         case bltestSEED_CBC:
+#endif
         case bltestRC2_ECB:
         case bltestRC2_CBC:
         case bltestRC4:
@@ -2939,19 +2959,23 @@ get_params(PLArenaPool *arena, bltestParams *params,
         case bltestAES_CTS:
         case bltestAES_CTR:
         case bltestCAMELLIA_CBC:
+#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_CBC:
             sprintf(filename, "%s/tests/%s/%s%d", testdir, modestr, "iv", j);
             load_file_data(arena, &params->sk.iv, filename, bltestBinary);
+#endif
         case bltestDES_ECB:
         case bltestDES_EDE_ECB:
         case bltestRC2_ECB:
         case bltestRC4:
         case bltestAES_ECB:
         case bltestCAMELLIA_ECB:
+#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_ECB:
             sprintf(filename, "%s/tests/%s/%s%d", testdir, modestr, "key", j);
             load_file_data(arena, &params->sk.key, filename, bltestBinary);
             break;
+#endif
 #ifdef NSS_SOFTOKEN_DOES_RC5
         case bltestRC5_ECB:
         case bltestRC5_CBC:

diff --git a/coreconf/config.gypi b/coreconf/config.gypi
@@ -99,6 +99,7 @@
     'disable_arm_hw_aes%': 0,
     'disable_tests%': 0,
     'disable_chachapoly%': 0,
+    'disable_deprecated_seed%': 0,
     'disable_dbm%': 1,
     'disable_libpkix%': 1,
     'disable_werror%': 0,
@@ -569,6 +570,11 @@
               'NSS_DISABLE_LIBPKIX',
             ],
           }],
+          [ 'disable_deprecated_seed==1', {
+            'defines': [
+              'NSS_DISABLE_DEPRECATED_SEED',
+            ],
+          }],
         ],
       },
       # Common settings for debug should go here.

diff --git a/coreconf/config.mk b/coreconf/config.mk
@@ -170,6 +170,10 @@ ifdef NSS_DISABLE_CHACHAPOLY
 DEFINES += -DNSS_DISABLE_CHACHAPOLY
 endif
 
+ifdef NSS_DISABLE_DEPRECATED_SEED
+DEFINES += -DNSS_DISABLE_DEPRECATED_SEED
+endif
+
 ifdef NSS_PKIX_NO_LDAP
 DEFINES += -DNSS_PKIX_NO_LDAP
 endif

diff --git a/gtests/pk11_gtest/pk11_encrypt_derive_unittest.cc b/gtests/pk11_gtest/pk11_encrypt_derive_unittest.cc
@@ -72,10 +72,12 @@ class EncryptDeriveTest
         return CKM_CAMELLIA_ECB_ENCRYPT_DATA;
       case CKM_CAMELLIA_CBC:
         return CKM_CAMELLIA_CBC_ENCRYPT_DATA;
+#ifndef NSS_DISABLE_DEPRECATED_SEED
       case CKM_SEED_ECB:
         return CKM_SEED_ECB_ENCRYPT_DATA;
       case CKM_SEED_CBC:
         return CKM_SEED_CBC_ENCRYPT_DATA;
+#endif
       default:
         ADD_FAILURE() << "Unknown mechanism";
         break;
@@ -93,7 +95,9 @@ class EncryptDeriveTest
       case CKM_DES3_ECB:
       case CKM_AES_ECB:
       case CKM_CAMELLIA_ECB:
+#ifndef NSS_DISABLE_DEPRECATED_SEED
       case CKM_SEED_ECB:
+#endif
         string_data.pData = toUcharPtr(kInput);
         string_data.ulLen = keysize();
         param.data = reinterpret_cast<uint8_t*>(&string_data);
@@ -110,7 +114,9 @@ class EncryptDeriveTest
 
       case CKM_AES_CBC:
       case CKM_CAMELLIA_CBC:
+#ifndef NSS_DISABLE_DEPRECATED_SEED
       case CKM_SEED_CBC:
+#endif
         aes_data.pData = toUcharPtr(kInput);
         aes_data.length = keysize();
         PORT_Memcpy(aes_data.iv, kIv, keysize());
@@ -132,14 +138,18 @@ class EncryptDeriveTest
       case CKM_DES3_ECB:
       case CKM_AES_ECB:
       case CKM_CAMELLIA_ECB:
+#ifndef NSS_DISABLE_DEPRECATED_SEED
       case CKM_SEED_ECB:
+#endif
         // No parameter needed here.
         break;
 
       case CKM_DES3_CBC:
       case CKM_AES_CBC:
       case CKM_CAMELLIA_CBC:
+#ifndef NSS_DISABLE_DEPRECATED_SEED
       case CKM_SEED_CBC:
+#endif
         param.data = toUcharPtr(kIv);
         param.len = keysize();
         break;
@@ -186,8 +196,13 @@ class EncryptDeriveTest
 TEST_P(EncryptDeriveTest, Test) { TestEncryptDerive(); }
 
 static const CK_MECHANISM_TYPE kEncryptDeriveMechanisms[] = {
-    CKM_DES3_ECB,     CKM_DES3_CBC,     CKM_AES_ECB,  CKM_AES_ECB, CKM_AES_CBC,
-    CKM_CAMELLIA_ECB, CKM_CAMELLIA_CBC, CKM_SEED_ECB, CKM_SEED_CBC};
+    CKM_DES3_ECB, CKM_DES3_CBC, CKM_AES_ECB, CKM_AES_ECB, CKM_AES_CBC,
+    CKM_CAMELLIA_ECB, CKM_CAMELLIA_CBC
+#ifndef NSS_DISABLE_DEPRECATED_SEED
+    ,
+    CKM_SEED_ECB, CKM_SEED_CBC
+#endif
+};
 
 INSTANTIATE_TEST_CASE_P(EncryptDeriveTests, EncryptDeriveTest,
                         ::testing::ValuesIn(kEncryptDeriveMechanisms));

diff --git a/gtests/pk11_gtest/pk11_seed_cbc_unittest.cc b/gtests/pk11_gtest/pk11_seed_cbc_unittest.cc
@@ -50,6 +50,7 @@ class Pkcs11SeedTest : public ::testing::Test {
   }
 };
 
+#ifndef NSS_DISABLE_DEPRECATED_SEED
 // The intention here is to test the arguments of these functions
 // The resulted content is already tested in EncryptDeriveTests.
 // SEED_CBC needs an IV of 16 bytes.
@@ -76,5 +77,6 @@ TEST_F(Pkcs11SeedTest, ECB_Singleblock) {
 TEST_F(Pkcs11SeedTest, ECB_Multiblock) {
   EncryptDecryptSeed(SECSuccess, 64, 64, CKM_SEED_ECB);
 }
+#endif
 
-}  // namespace nss_test
+}  // namespace nss_test
diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile
@@ -545,6 +545,10 @@ ifndef HAVE_INT128_SUPPORT
     DEFINES += -DKRML_VERIFIED_UINT128
 endif
 
+ifndef NSS_DISABLE_DEPRECATED_SEED
+	CSRCS += seed.c
+endif
+
 ifndef NSS_DISABLE_CHACHAPOLY
     ifeq ($(CPU_ARCH),x86_64)
         ifndef NSS_DISABLE_AVX2

diff --git a/lib/freebl/freebl_base.gypi b/lib/freebl/freebl_base.gypi
@@ -55,7 +55,7 @@
     'rijndael.c',
     'rsa.c',
     'rsapkcs.c',
-    'seed.c',
+    'sha512.c',
     'sha_fast.c',
     'shvfy.c',
     'sysrand.c',
@@ -162,6 +162,11 @@
         'verified/Hacl_Poly1305_32.c',
       ],
     }],
+    [ 'disable_deprecated_seed==0', {
+      'sources': [
+        'seed.c',
+      ],
+    }],
     [ 'fuzz==1', {
       'sources!': [ 'drbg.c' ],
       'sources': [ 'det_rng.c' ],

diff --git a/lib/freebl/ldvector.c b/lib/freebl/ldvector.c
@@ -6,6 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifdef FREEBL_NO_DEPEND
+#include "stubs.h"
 extern int FREEBL_InitStubs(void);
 #endif
 
@@ -14,6 +15,15 @@ extern int FREEBL_InitStubs(void);
 #include "alghmac.h"
 #include "hmacct.h"
 #include "blapii.h"
+#include "secerr.h"
+
+SECStatus
+FREEBL_Deprecated(void)
+{
+
+    PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);
+    return SECFailure;
+}
 
 static const struct FREEBLVectorStr vector =
     {
@@ -210,14 +220,23 @@ static const struct FREEBLVectorStr vector =
       PQG_DestroyParams,
       PQG_DestroyVerify,
 
-      /* End of Version 3.010. */
+/* End of Version 3.010. */
 
+#ifndef NSS_DISABLE_DEPRECATED_SEED
       SEED_InitContext,
       SEED_AllocateContext,
       SEED_CreateContext,
       SEED_DestroyContext,
       SEED_Encrypt,
       SEED_Decrypt,
+#else
+      (F_SEED_InitContext)FREEBL_Deprecated,
+      (F_SEED_AllocateContext)FREEBL_Deprecated,
+      (F_SEED_CreateContext)FREEBL_Deprecated,
+      (F_SEED_DestroyContext)FREEBL_Deprecated,
+      (F_SEED_Encrypt)FREEBL_Deprecated,
+      (F_SEED_Decrypt)FREEBL_Deprecated,
+#endif /* NSS_DISABLE_DEPRECATED_SEED */
 
       BL_Init,
       BL_SetForkState,