Star0
23
代码
代码
Issues4
Pull Requests10
项目讨论
Wiki
分析
Star0
23
已合并
Update nss to version 3.126 #176
Funda Wang创建于 8月12日
Update nss to version 3.126 #176
已合并
Funda Wang创建于 8月12日
从已删除 :master合入到src-openeuler/nssmaster
共 6 个文件变更+116-166
M.gitattributes+1-1
@@ -1 +1 @@
1-nss-3.120.1.tar.gz filter=lfs diff=lfs merge=lfs -text1+*.gz filter=lfs diff=lfs merge=lfs -text
MFeature-nss-add-implement-of-SM2-signature-algorithm-without.patch+42-45
@@ -1,10 +1,10 @@
1From 13669c4ee94e3bc42801be9db55db1c0ca7308b2 Mon Sep 17 00:00:00 20011From 13669c4ee94e3bc42801be9db55db1c0ca7308b2 Mon Sep 17 00:00:00 2001
2From: Gong Zhile <gongzl.oerv@isrc.iscas.ac.cn>2From: Gong Zhile <gongzl.oerv@isrc.iscas.ac.cn>
3Date: Mon, 3 Nov 2025 17:04:25 +08003Date: Mon, 3 Nov 2025 17:04:25 +0800
4-Subject: [PATCH 3/4] nss add implement of SM2 signature algorithm without4+Subject: [PATCH] nss add implement of SM2 signature algorithm without
5- removed GFp funcs
6 5 
7Signed-off-by: Gong Zhile <gongzl.oerv@isrc.iscas.ac.cn>6Signed-off-by: Gong Zhile <gongzl.oerv@isrc.iscas.ac.cn>
7+Co-Authored-By: AtomCode (deepseek-v4-flash) <noreply@atomgit.com>
8---8---
9 cmd/certutil/keystuff.c | 2 +9 cmd/certutil/keystuff.c | 2 +
10 lib/cryptohi/cryptohi.h | 2 +10 lib/cryptohi/cryptohi.h | 2 +
@@ -34,7 +34,7 @@ Signed-off-by: Gong Zhile <gongzl.oerv@isrc.iscas.ac.cn>
34 create mode 100644 lib/freebl/sm2_z256_table.c34 create mode 100644 lib/freebl/sm2_z256_table.c
35 35 
36diff --git a/cmd/certutil/keystuff.c b/cmd/certutil/keystuff.c36diff --git a/cmd/certutil/keystuff.c b/cmd/certutil/keystuff.c
37-index 9b96bce91..8394ba5e5 10064437+index 9b96bce..8394ba5 100644
38--- a/cmd/certutil/keystuff.c38--- a/cmd/certutil/keystuff.c
39+++ b/cmd/certutil/keystuff.c39+++ b/cmd/certutil/keystuff.c
40@@ -467,6 +467,8 @@ static CurveNameTagPair nameTagPair[] = {40@@ -467,6 +467,8 @@ static CurveNameTagPair nameTagPair[] = {
@@ -47,7 +47,7 @@ index 9b96bce91..8394ba5e5 100644
47 47
48 static SECKEYECParams *48 static SECKEYECParams *
49diff --git a/lib/cryptohi/cryptohi.h b/lib/cryptohi/cryptohi.h49diff --git a/lib/cryptohi/cryptohi.h b/lib/cryptohi/cryptohi.h
50-index 818010fbd..cb9d43388 10064450+index 818010f..cb9d433 100644
51--- a/lib/cryptohi/cryptohi.h51--- a/lib/cryptohi/cryptohi.h
52+++ b/lib/cryptohi/cryptohi.h52+++ b/lib/cryptohi/cryptohi.h
53@@ -467,6 +467,8 @@ extern SECStatus VFY_VerifyDataWithAlgorithmID(const unsigned char *buf,53@@ -467,6 +467,8 @@ extern SECStatus VFY_VerifyDataWithAlgorithmID(const unsigned char *buf,
@@ -60,7 +60,7 @@ index 818010fbd..cb9d43388 100644
60 60
61 #endif /* _CRYPTOHI_H_ */61 #endif /* _CRYPTOHI_H_ */
62diff --git a/lib/cryptohi/seckey.c b/lib/cryptohi/seckey.c62diff --git a/lib/cryptohi/seckey.c b/lib/cryptohi/seckey.c
63-index 25ee347ce..f7f8f7875 10064463+index ac268e4..882a995 100644
64--- a/lib/cryptohi/seckey.c64--- a/lib/cryptohi/seckey.c
65+++ b/lib/cryptohi/seckey.c65+++ b/lib/cryptohi/seckey.c
66@@ -564,6 +564,7 @@ seckey_GetKeyType(SECOidTag tag)66@@ -564,6 +564,7 @@ seckey_GetKeyType(SECOidTag tag)
@@ -71,7 +71,7 @@ index 25ee347ce..f7f8f7875 100644
71 keyType = ecKey;71 keyType = ecKey;
72 break;72 break;
73 case SEC_OID_ED25519_PUBLIC_KEY:73 case SEC_OID_ED25519_PUBLIC_KEY:
74-@@ -1008,6 +1009,7 @@ SECKEY_ECParamsToKeySize(const SECItem *encodedParams)74+@@ -1208,6 +1209,7 @@ SECKEY_ECParamsToKeySize(const SECItem *encodedParams)
75 75
76 case SEC_OID_SECG_EC_SECP256K1:76 case SEC_OID_SECG_EC_SECP256K1:
77 case SEC_OID_ANSIX962_EC_PRIME256V1:77 case SEC_OID_ANSIX962_EC_PRIME256V1:
@@ -79,7 +79,7 @@ index 25ee347ce..f7f8f7875 100644
79 return 256;79 return 256;
80 80
81 case SEC_OID_ANSIX962_EC_C2PNB272W1:81 case SEC_OID_ANSIX962_EC_C2PNB272W1:
82-@@ -1158,6 +1160,7 @@ SECKEY_ECParamsToBasePointOrderLen(const SECItem *encodedParams)82+@@ -1365,6 +1367,7 @@ SECKEY_ECParamsToBasePointOrderLen(const SECItem *encodedParams)
83 83
84 case SEC_OID_SECG_EC_SECP256K1:84 case SEC_OID_SECG_EC_SECP256K1:
85 case SEC_OID_ANSIX962_EC_PRIME256V1:85 case SEC_OID_ANSIX962_EC_PRIME256V1:
@@ -88,10 +88,10 @@ index 25ee347ce..f7f8f7875 100644
88 88
89 case SEC_OID_ANSIX962_EC_C2PNB272W1:89 case SEC_OID_ANSIX962_EC_C2PNB272W1:
90diff --git a/lib/cryptohi/secsign.c b/lib/cryptohi/secsign.c90diff --git a/lib/cryptohi/secsign.c b/lib/cryptohi/secsign.c
91-index f4bbfc999..54edf647d 10064491+index 1b4ef60..ad9f6c9 100644
92--- a/lib/cryptohi/secsign.c92--- a/lib/cryptohi/secsign.c
93+++ b/lib/cryptohi/secsign.c93+++ b/lib/cryptohi/secsign.c
94-@@ -1147,3 +1147,45 @@ SEC_CreateSignatureAlgorithmID(PLArenaPool *arena,94+@@ -1185,3 +1185,45 @@ SEC_CreateSignatureAlgorithmID(PLArenaPool *arena,
95 95
96 return SECOID_SetAlgorithmID(arena, signAlgID, signAlgTag, newParams);96 return SECOID_SetAlgorithmID(arena, signAlgID, signAlgTag, newParams);
97 }97 }
@@ -138,10 +138,10 @@ index f4bbfc999..54edf647d 100644
138+ return SECSuccess;138+ return SECSuccess;
139+}139+}
140diff --git a/lib/cryptohi/secvfy.c b/lib/cryptohi/secvfy.c140diff --git a/lib/cryptohi/secvfy.c b/lib/cryptohi/secvfy.c
141-index e58b40223..2fea99040 100644141+index c383b9c..ef8aef3 100644
142--- a/lib/cryptohi/secvfy.c142--- a/lib/cryptohi/secvfy.c
143+++ b/lib/cryptohi/secvfy.c143+++ b/lib/cryptohi/secvfy.c
144-@@ -294,6 +294,8 @@ sec_GetEncAlgFromSigAlg(SECOidTag sigAlg)144+@@ -300,6 +300,8 @@ sec_GetEncAlgFromSigAlg(SECOidTag sigAlg)
145 case SEC_OID_ML_DSA_65:145 case SEC_OID_ML_DSA_65:
146 case SEC_OID_ML_DSA_87:146 case SEC_OID_ML_DSA_87:
147 return sigAlg;147 return sigAlg;
@@ -150,7 +150,7 @@ index e58b40223..2fea99040 100644
150 /* we don't implement MD4 hashes */150 /* we don't implement MD4 hashes */
151 case SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION:151 case SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION:
152 default:152 default:
153-@@ -588,6 +590,9 @@ sec_DecodeSigAlg(const SECKEYPublicKey *key, SECOidTag sigAlg,153+@@ -610,6 +612,9 @@ sec_DecodeSigAlg(const SECKEYPublicKey *key, SECOidTag sigAlg,
154 *hashalg = sigAlg;154 *hashalg = sigAlg;
155 /* decode params to get the sign context and set (mechparamsp) */155 /* decode params to get the sign context and set (mechparamsp) */
156 break;156 break;
@@ -161,7 +161,7 @@ index e58b40223..2fea99040 100644
161 case SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION:161 case SEC_OID_PKCS1_MD4_WITH_RSA_ENCRYPTION:
162 default:162 default:
163diff --git a/lib/freebl/ec.c b/lib/freebl/ec.c163diff --git a/lib/freebl/ec.c b/lib/freebl/ec.c
164-index 303553fe6..2194bb880 100644164+index 080f4ae..762da11 100644
165--- a/lib/freebl/ec.c165--- a/lib/freebl/ec.c
166+++ b/lib/freebl/ec.c166+++ b/lib/freebl/ec.c
167@@ -19,6 +19,7 @@167@@ -19,6 +19,7 @@
@@ -194,7 +194,7 @@ index 303553fe6..2194bb880 100644
194 case ECCurve25519:194 case ECCurve25519:
195 case ECCurve_NIST_P256:195 case ECCurve_NIST_P256:
196diff --git a/lib/freebl/ecdecode.c b/lib/freebl/ecdecode.c196diff --git a/lib/freebl/ecdecode.c b/lib/freebl/ecdecode.c
197-index a6e4241d9..7397bbc7b 100644197+index a6e4241..7397bbc 100644
198--- a/lib/freebl/ecdecode.c198--- a/lib/freebl/ecdecode.c
199+++ b/lib/freebl/ecdecode.c199+++ b/lib/freebl/ecdecode.c
200@@ -185,6 +185,11 @@ EC_FillParams(PLArenaPool *arena, const SECItem *encodedParams,200@@ -185,6 +185,11 @@ EC_FillParams(PLArenaPool *arena, const SECItem *encodedParams,
@@ -210,7 +210,7 @@ index a6e4241d9..7397bbc7b 100644
210 break;210 break;
211 };211 };
212diff --git a/lib/freebl/ecl/ecl-curve.h b/lib/freebl/ecl/ecl-curve.h212diff --git a/lib/freebl/ecl/ecl-curve.h b/lib/freebl/ecl/ecl-curve.h
213-index 1c9cb5db5..54bbff496 100644213+index 1c9cb5d..54bbff4 100644
214--- a/lib/freebl/ecl/ecl-curve.h214--- a/lib/freebl/ecl/ecl-curve.h
215+++ b/lib/freebl/ecl/ecl-curve.h215+++ b/lib/freebl/ecl/ecl-curve.h
216@@ -171,6 +171,38 @@ static const PRUint8 base25519[66] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,216@@ -171,6 +171,38 @@ static const PRUint8 base25519[66] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -261,7 +261,7 @@ index 1c9cb5db5..54bbff496 100644
261 };261 };
262 262
263diff --git a/lib/freebl/ecl/ecl-exp.h b/lib/freebl/ecl/ecl-exp.h263diff --git a/lib/freebl/ecl/ecl-exp.h b/lib/freebl/ecl/ecl-exp.h
264-index 14263c70f..8bf448680 100644264+index 14263c7..8bf4486 100644
265--- a/lib/freebl/ecl/ecl-exp.h265--- a/lib/freebl/ecl/ecl-exp.h
266+++ b/lib/freebl/ecl/ecl-exp.h266+++ b/lib/freebl/ecl/ecl-exp.h
267@@ -134,6 +134,8 @@ typedef enum {267@@ -134,6 +134,8 @@ typedef enum {
@@ -274,10 +274,10 @@ index 14263c70f..8bf448680 100644
274 } ECCurveName;274 } ECCurveName;
275 275
276diff --git a/lib/freebl/freebl_base.gypi b/lib/freebl/freebl_base.gypi276diff --git a/lib/freebl/freebl_base.gypi b/lib/freebl/freebl_base.gypi
277-index d41d320d7..7c03ef903 100644277+index 3d346fb..639fe01 100644
278--- a/lib/freebl/freebl_base.gypi278--- a/lib/freebl/freebl_base.gypi
279+++ b/lib/freebl/freebl_base.gypi279+++ b/lib/freebl/freebl_base.gypi
280-@@ -51,6 +51,9 @@280+@@ -49,6 +49,9 @@
281 'sha_fast.c',281 'sha_fast.c',
282 'shvfy.c',282 'shvfy.c',
283 'sm3.c',283 'sm3.c',
@@ -288,10 +288,10 @@ index d41d320d7..7c03ef903 100644
288 'tlsprfalg.c',288 'tlsprfalg.c',
289 'secmpi.c',289 'secmpi.c',
290diff --git a/lib/freebl/manifest.mn b/lib/freebl/manifest.mn290diff --git a/lib/freebl/manifest.mn b/lib/freebl/manifest.mn
291-index f8359fb3e..b90598d3d 100644291+index e0a7bb4..b50b0a2 100644
292--- a/lib/freebl/manifest.mn292--- a/lib/freebl/manifest.mn
293+++ b/lib/freebl/manifest.mn293+++ b/lib/freebl/manifest.mn
294-@@ -167,6 +167,9 @@ CSRCS = \294+@@ -166,6 +166,9 @@ CSRCS = \
295 $(LOWHASH_SRCS) \295 $(LOWHASH_SRCS) \
296 $(EXTRA_SRCS) \296 $(EXTRA_SRCS) \
297 sm3.c \297 sm3.c \
@@ -301,7 +301,7 @@ index f8359fb3e..b90598d3d 100644
301 $(NULL)301 $(NULL)
302 302
303 ifndef NSS_DISABLE_DEPRECATED_SEED303 ifndef NSS_DISABLE_DEPRECATED_SEED
304-@@ -197,6 +200,8 @@ ALL_HDRS = \304+@@ -196,6 +199,8 @@ ALL_HDRS = \
305 vis_proto.h \305 vis_proto.h \
306 seed.h \306 seed.h \
307 sm3.h \307 sm3.h \
@@ -312,7 +312,7 @@ index f8359fb3e..b90598d3d 100644
312 312
313diff --git a/lib/freebl/sm2.c b/lib/freebl/sm2.c313diff --git a/lib/freebl/sm2.c b/lib/freebl/sm2.c
314new file mode 100644314new file mode 100644
315-index 000000000..2d7af5a5c315+index 0000000..2d7af5a
316--- /dev/null316--- /dev/null
317+++ b/lib/freebl/sm2.c317+++ b/lib/freebl/sm2.c
318@@ -0,0 +1,284 @@318@@ -0,0 +1,284 @@
@@ -602,7 +602,7 @@ index 000000000..2d7af5a5c
602+}602+}
603diff --git a/lib/freebl/sm2.h b/lib/freebl/sm2.h603diff --git a/lib/freebl/sm2.h b/lib/freebl/sm2.h
604new file mode 100644604new file mode 100644
605-index 000000000..96d599c33605+index 0000000..96d599c
606--- /dev/null606--- /dev/null
607+++ b/lib/freebl/sm2.h607+++ b/lib/freebl/sm2.h
608@@ -0,0 +1,32 @@608@@ -0,0 +1,32 @@
@@ -640,7 +640,7 @@ index 000000000..96d599c33
640+640+
641diff --git a/lib/freebl/sm2_z256.c b/lib/freebl/sm2_z256.c641diff --git a/lib/freebl/sm2_z256.c b/lib/freebl/sm2_z256.c
642new file mode 100644642new file mode 100644
643-index 000000000..01f6d2f61643+index 0000000..01f6d2f
644--- /dev/null644--- /dev/null
645+++ b/lib/freebl/sm2_z256.c645+++ b/lib/freebl/sm2_z256.c
646@@ -0,0 +1,1687 @@646@@ -0,0 +1,1687 @@
@@ -2333,7 +2333,7 @@ index 000000000..01f6d2f61
2333+2333+
2334diff --git a/lib/freebl/sm2_z256.h b/lib/freebl/sm2_z256.h2334diff --git a/lib/freebl/sm2_z256.h b/lib/freebl/sm2_z256.h
2335new file mode 1006442335new file mode 100644
2336-index 000000000..ed8e00c8a2336+index 0000000..ed8e00c
2337--- /dev/null2337--- /dev/null
2338+++ b/lib/freebl/sm2_z256.h2338+++ b/lib/freebl/sm2_z256.h
2339@@ -0,0 +1,174 @@2339@@ -0,0 +1,174 @@
@@ -2513,7 +2513,7 @@ index 000000000..ed8e00c8a
2513+#endif2513+#endif
2514diff --git a/lib/freebl/sm2_z256_table.c b/lib/freebl/sm2_z256_table.c2514diff --git a/lib/freebl/sm2_z256_table.c b/lib/freebl/sm2_z256_table.c
2515new file mode 1006442515new file mode 100644
2516-index 000000000..38aa7d8112516+index 0000000..38aa7d8
2517--- /dev/null2517--- /dev/null
2518+++ b/lib/freebl/sm2_z256_table.c2518+++ b/lib/freebl/sm2_z256_table.c
2519@@ -0,0 +1,4835 @@2519@@ -0,0 +1,4835 @@
@@ -7353,10 +7353,10 @@ index 000000000..38aa7d811
7353+ },7353+ },
7354+};7354+};
7355diff --git a/lib/nss/nss.def b/lib/nss/nss.def7355diff --git a/lib/nss/nss.def b/lib/nss/nss.def
7356-index b0336cfa4..bf1b822c3 1006447356+index f2a5afe..d8ee427 100644
7357--- a/lib/nss/nss.def7357--- a/lib/nss/nss.def
7358+++ b/lib/nss/nss.def7358+++ b/lib/nss/nss.def
7359-@@ -1314,3 +1314,9 @@ PK11_UnwrapPrivKeyByKeyType;7359+@@ -1321,3 +1321,9 @@ PK11_IsAEAD;
7360 ;+ local:7360 ;+ local:
7361 ;+ *;7361 ;+ *;
7362 ;+};7362 ;+};
@@ -7367,10 +7367,10 @@ index b0336cfa4..bf1b822c3 100644
7367+;+ *;7367+;+ *;
7368+;+};7368+;+};
7369diff --git a/lib/util/pkcs11n.h b/lib/util/pkcs11n.h7369diff --git a/lib/util/pkcs11n.h b/lib/util/pkcs11n.h
7370-index ceda492fc..920333936 1006447370+index b8d216c..e920923 100644
7371--- a/lib/util/pkcs11n.h7371--- a/lib/util/pkcs11n.h
7372+++ b/lib/util/pkcs11n.h7372+++ b/lib/util/pkcs11n.h
7373-@@ -416,6 +416,8 @@7373+@@ -418,6 +418,8 @@
7374 7374
7375 /* SM algorithm (to be proposed to PKCS #11) */7375 /* SM algorithm (to be proposed to PKCS #11) */
7376 #define CKM_NSS_SM3 (CKM_NSS + 50)7376 #define CKM_NSS_SM3 (CKM_NSS + 50)
@@ -7380,10 +7380,10 @@ index ceda492fc..920333936 100644
7380 /*7380 /*
7381 * HISTORICAL:7381 * HISTORICAL:
7382diff --git a/lib/util/secoid.c b/lib/util/secoid.c7382diff --git a/lib/util/secoid.c b/lib/util/secoid.c
7383-index 84c6b7deb..197b6fa3d 1006447383+index a9e2a69..20bfc3e 100644
7384--- a/lib/util/secoid.c7384--- a/lib/util/secoid.c
7385+++ b/lib/util/secoid.c7385+++ b/lib/util/secoid.c
7386-@@ -632,6 +632,8 @@ CONST_OID curve25519[] = { 0x2B, 0x06, 0x01, 0x04, 0x01, 0xDA, 0x47, 0x0F, 0x017386+@@ -634,6 +634,8 @@ CONST_OID curve25519[] = { 0x2B, 0x06, 0x01, 0x04, 0x01, 0xDA, 0x47, 0x0F, 0x01
7387 * 1.2.156.197.1.4017387 * 1.2.156.197.1.401
7388 */7388 */
7389 CONST_OID sm3[] = { 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x11 };7389 CONST_OID sm3[] = { 0x2A, 0x81, 0x1C, 0xCF, 0x55, 0x01, 0x83, 0x11 };
@@ -7392,28 +7392,25 @@ index 84c6b7deb..197b6fa3d 100644
7392 7392
7393 /*7393 /*
7394 https://oid-rep.orange-labs.fr/get/1.3.101.1127394 https://oid-rep.orange-labs.fr/get/1.3.101.112
7395-@@ -1919,6 +1921,8 @@ const static SECOidData oids[SEC_OID_TOTAL] = {7395+@@ -1939,6 +1941,8 @@ const static SECOidData oids[SEC_OID_TOTAL] = {
7396- 7396+ "CMS AuthEnvelopedData",
7397- 7397+ CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
7398 OD(sm3, SEC_OID_SM3, "SM3", CKM_NSS_SM3, INVALID_CERT_EXTENSION),7398 OD(sm3, SEC_OID_SM3, "SM3", CKM_NSS_SM3, INVALID_CERT_EXTENSION),
7399+ OD(sm2, SEC_OID_SM2, "SM2", CKM_NSS_SM2, INVALID_CERT_EXTENSION),7399+ OD(sm2, SEC_OID_SM2, "SM2", CKM_NSS_SM2, INVALID_CERT_EXTENSION),
7400+ OD(sm2_with_sm3, SEC_OID_SM2_WITH_SM3, "SM2_WITH_SM3", CKM_NSS_SM2_WITH_SM3, INVALID_CERT_EXTENSION),7400+ OD(sm2_with_sm3, SEC_OID_SM2_WITH_SM3, "SM2_WITH_SM3", CKM_NSS_SM2_WITH_SM3, INVALID_CERT_EXTENSION),
7401+
7401 };7402 };
7402 7403
7403- /* PRIVATE EXTENDED SECOID Table
7404diff --git a/lib/util/secoidt.h b/lib/util/secoidt.h7404diff --git a/lib/util/secoidt.h b/lib/util/secoidt.h
7405-index b38058d76..c9b9694bd 1006447405+index 8153070..d959b6c 100644
7406--- a/lib/util/secoidt.h7406--- a/lib/util/secoidt.h
7407+++ b/lib/util/secoidt.h7407+++ b/lib/util/secoidt.h
7408-@@ -540,6 +540,8 @@ typedef enum {7408+@@ -547,6 +547,8 @@ typedef enum {
7409- SEC_OID_SECP384R1MLKEM1024 = 395,
7410 7409
7411- SEC_OID_SM3 = 396,7410+ SEC_OID_CMS_AUTH_ENVELOPED_DATA = 399,
7412-+ SEC_OID_SM2 = 397,7411+ SEC_OID_SM3 = 400,
7413-+ SEC_OID_SM2_WITH_SM3 = 398,7412++ SEC_OID_SM2 = 401,
7413++ SEC_OID_SM2_WITH_SM3 = 402,
7414 7414
7415 SEC_OID_TOTAL7415 SEC_OID_TOTAL
7416 } SECOidTag;7416 } SECOidTag;
7417---
7418-2.47.3
7419- 
MFeature-port-nss-support-SM3-digest-algorithm-to-NSS_3_117_R.patch+60-64
@@ -1,7 +1,7 @@
1From 1870928dbe6c68f745a27eee6691caf101041bfb Mon Sep 17 00:00:00 20011From 1870928dbe6c68f745a27eee6691caf101041bfb Mon Sep 17 00:00:00 2001
2From: Gong Zhile <gongzl.oerv@isrc.iscas.ac.cn>2From: Gong Zhile <gongzl.oerv@isrc.iscas.ac.cn>
3Date: Thu, 30 Oct 2025 21:04:27 +08003Date: Thu, 30 Oct 2025 21:04:27 +0800
4-Subject: [PATCH 2/4] port nss support SM3 digest algorithm to NSS_3_117_RTM4+Subject: [PATCH] port nss support SM3 digest algorithm to NSS_3_117_RTM
5 5 
6- Ported from original commit [PATCH 2/4] nss support SM3 digest algorithm6- Ported from original commit [PATCH 2/4] nss support SM3 digest algorithm
7- Resolved conflicts for NSS_3_117_RTM7- Resolved conflicts for NSS_3_117_RTM
@@ -9,6 +9,7 @@ Subject: [PATCH 2/4] port nss support SM3 digest algorithm to NSS_3_117_RTM
9 9 
10Co-authored-by: godcansee <liu332084460@foxmail.com>10Co-authored-by: godcansee <liu332084460@foxmail.com>
11Signed-off-by: Gong Zhile <gongzl.oerv@isrc.iscas.ac.cn>11Signed-off-by: Gong Zhile <gongzl.oerv@isrc.iscas.ac.cn>
12+Co-Authored-By: AtomCode (deepseek-v4-flash) <noreply@atomgit.com>
12---13---
13 lib/cryptohi/sechash.c | 16 +++++++14 lib/cryptohi/sechash.c | 16 +++++++
14 lib/freebl/blapi.h | 19 ++++++++15 lib/freebl/blapi.h | 19 ++++++++
@@ -25,17 +26,17 @@ Signed-off-by: Gong Zhile <gongzl.oerv@isrc.iscas.ac.cn>
25 lib/softoken/pkcs11.c | 1 +26 lib/softoken/pkcs11.c | 1 +
26 lib/softoken/pkcs11c.c | 3 ++27 lib/softoken/pkcs11c.c | 3 ++
27 lib/util/hasht.h | 2 +28 lib/util/hasht.h | 2 +
28- lib/util/nsshash.c | 2 +29+ lib/util/nsshash.c | 3 ++
29 lib/util/pkcs11n.h | 3 ++30 lib/util/pkcs11n.h | 3 ++
30- lib/util/secoid.c | 7 +++31+ lib/util/secoid.c | 6 +++
31- lib/util/secoidt.h | 3 +-32+ lib/util/secoidt.h | 1 +
32 lib/util/utilmodt.h | 1 +33 lib/util/utilmodt.h | 1 +
33 lib/util/utilpars.c | 1 +34 lib/util/utilpars.c | 1 +
34 lib/util/utilparst.h | 2 +-35 lib/util/utilparst.h | 2 +-
35- 22 files changed, 204 insertions(+), 4 deletions(-)36+ 22 files changed, 203 insertions(+), 3 deletions(-)
36 37 
37diff --git a/lib/cryptohi/sechash.c b/lib/cryptohi/sechash.c38diff --git a/lib/cryptohi/sechash.c b/lib/cryptohi/sechash.c
38-index cd701bd54..a9d20d543 10064439+index cd701bd..a9d20d5 100644
39--- a/lib/cryptohi/sechash.c40--- a/lib/cryptohi/sechash.c
40+++ b/lib/cryptohi/sechash.c41+++ b/lib/cryptohi/sechash.c
41@@ -85,6 +85,12 @@ sha512_NewContext(void)42@@ -85,6 +85,12 @@ sha512_NewContext(void)
@@ -69,7 +70,7 @@ index cd701bd54..a9d20d543 100644
69 70
70 const SECHashObject *71 const SECHashObject *
71diff --git a/lib/freebl/blapi.h b/lib/freebl/blapi.h72diff --git a/lib/freebl/blapi.h b/lib/freebl/blapi.h
72-index d9eacb2b9..4e942cdaf 10064473+index a4ce7ff..f71e188 100644
73--- a/lib/freebl/blapi.h74--- a/lib/freebl/blapi.h
74+++ b/lib/freebl/blapi.h75+++ b/lib/freebl/blapi.h
75@@ -1585,6 +1585,25 @@ extern SECStatus SHAKE_256_HashBuf(unsigned char *dest, unsigned int dest_len,76@@ -1585,6 +1585,25 @@ extern SECStatus SHAKE_256_HashBuf(unsigned char *dest, unsigned int dest_len,
@@ -99,7 +100,7 @@ index d9eacb2b9..4e942cdaf 100644
99 * implement TLS 1.0 Pseudo Random Function (PRF) and TLS P_hash function100 * implement TLS 1.0 Pseudo Random Function (PRF) and TLS P_hash function
100 */101 */
101diff --git a/lib/freebl/blapit.h b/lib/freebl/blapit.h102diff --git a/lib/freebl/blapit.h b/lib/freebl/blapit.h
102-index b61da1fbc..9e5e1c2ba 100644103+index 811fcc7..a4c7cd6 100644
103--- a/lib/freebl/blapit.h104--- a/lib/freebl/blapit.h
104+++ b/lib/freebl/blapit.h105+++ b/lib/freebl/blapit.h
105@@ -109,6 +109,7 @@ typedef int __BLAPI_DEPRECATED __attribute__((deprecated));106@@ -109,6 +109,7 @@ typedef int __BLAPI_DEPRECATED __attribute__((deprecated));
@@ -135,10 +136,10 @@ index b61da1fbc..9e5e1c2ba 100644
135 typedef struct SHA3ContextStr SHA3_224Context;136 typedef struct SHA3ContextStr SHA3_224Context;
136 typedef struct SHA3ContextStr SHA3_256Context;137 typedef struct SHA3ContextStr SHA3_256Context;
137diff --git a/lib/freebl/freebl_base.gypi b/lib/freebl/freebl_base.gypi138diff --git a/lib/freebl/freebl_base.gypi b/lib/freebl/freebl_base.gypi
138-index 8a695065c..d41d320d7 100644139+index 75d0989..3d346fb 100644
139--- a/lib/freebl/freebl_base.gypi140--- a/lib/freebl/freebl_base.gypi
140+++ b/lib/freebl/freebl_base.gypi141+++ b/lib/freebl/freebl_base.gypi
141-@@ -50,6 +50,7 @@142+@@ -48,6 +48,7 @@
142 'rsapkcs.c',143 'rsapkcs.c',
143 'sha_fast.c',144 'sha_fast.c',
144 'shvfy.c',145 'shvfy.c',
@@ -147,10 +148,10 @@ index 8a695065c..d41d320d7 100644
147 'tlsprfalg.c',148 'tlsprfalg.c',
148 'secmpi.c',149 'secmpi.c',
149diff --git a/lib/freebl/ldvector.c b/lib/freebl/ldvector.c150diff --git a/lib/freebl/ldvector.c b/lib/freebl/ldvector.c
150-index 5db54a026..c04e75c1a 100644151+index 420d567..2fd5251 100644
151--- a/lib/freebl/ldvector.c152--- a/lib/freebl/ldvector.c
152+++ b/lib/freebl/ldvector.c153+++ b/lib/freebl/ldvector.c
153-@@ -459,6 +459,17 @@ static const struct FREEBLVectorStr vector = {154+@@ -462,6 +462,17 @@ static const struct FREEBLVectorStr vector = {
154 EC_DecompressPublicKey,155 EC_DecompressPublicKey,
155 /* End of version 3.032 */156 /* End of version 3.032 */
156 157
@@ -169,10 +170,10 @@ index 5db54a026..c04e75c1a 100644
169 170
170 const FREEBLVector*171 const FREEBLVector*
171diff --git a/lib/freebl/loader.c b/lib/freebl/loader.c172diff --git a/lib/freebl/loader.c b/lib/freebl/loader.c
172-index 0a2db6175..1f1e98c8c 100644173+index cda69f9..42d5aea 100644
173--- a/lib/freebl/loader.c174--- a/lib/freebl/loader.c
174+++ b/lib/freebl/loader.c175+++ b/lib/freebl/loader.c
175-@@ -2958,6 +2958,97 @@ MLDSA_VerifyFinal(MLDSAContext *ctx, constSECItem *signature)176+@@ -2959,6 +2959,97 @@ MLDSA_VerifyFinal(MLDSAContext *ctx, const SECItem *signature)
176 return (vector->p_MLDSA_VerifyFinal)(ctx, signature);177 return (vector->p_MLDSA_VerifyFinal)(ctx, signature);
177 }178 }
178 179
@@ -271,14 +272,13 @@ index 0a2db6175..1f1e98c8c 100644
271 SECStatus272 SECStatus
272 EC_DecompressPublicKey(const SECItem *publicCompressed, const ECParams *params, SECItem *publicUncompressed)273 EC_DecompressPublicKey(const SECItem *publicCompressed, const ECParams *params, SECItem *publicUncompressed)
273diff --git a/lib/freebl/loader.h b/lib/freebl/loader.h274diff --git a/lib/freebl/loader.h b/lib/freebl/loader.h
274-index 6d75f75cc..00bed61f7 100644275+index 7b52a9b..ef43cae 100644
275--- a/lib/freebl/loader.h276--- a/lib/freebl/loader.h
276+++ b/lib/freebl/loader.h277+++ b/lib/freebl/loader.h
277-@@ -939,6 +939,21 @@ struct FREEBLVectorStr {278+@@ -943,6 +943,21 @@ struct FREEBLVectorStr {
278-
279 SECStatus (*p_EC_DecompressPublicKey)(const SECItem *publicCompressed, const ECParams *params, SECItem *publicUncompressed);279 SECStatus (*p_EC_DecompressPublicKey)(const SECItem *publicCompressed, const ECParams *params, SECItem *publicUncompressed);
280 /* Version 3.032 came to here */280 /* Version 3.032 came to here */
281-+281+
282+ SM3Context *(*p_SM3_NewContext)(void);282+ SM3Context *(*p_SM3_NewContext)(void);
283+ void (*p_SM3_DestroyContext)(SM3Context *cx, PRBool freeit);283+ void (*p_SM3_DestroyContext)(SM3Context *cx, PRBool freeit);
284+ void (*p_SM3_Begin)(SM3Context *cx);284+ void (*p_SM3_Begin)(SM3Context *cx);
@@ -293,14 +293,15 @@ index 6d75f75cc..00bed61f7 100644
293+ unsigned int (*p_SM3_FlattenSize)(SM3Context *cx);293+ unsigned int (*p_SM3_FlattenSize)(SM3Context *cx);
294+ SECStatus (*p_SM3_Flatten)(SM3Context *cx, unsigned char *space);294+ SECStatus (*p_SM3_Flatten)(SM3Context *cx, unsigned char *space);
295+ SM3Context *(*p_SM3_Resurrect)(unsigned char *space, void *arg);295+ SM3Context *(*p_SM3_Resurrect)(unsigned char *space, void *arg);
296- 296++
297 /* Add new function pointers at the end of this struct and bump297 /* Add new function pointers at the end of this struct and bump
298 * FREEBL_VERSION at the beginning of this file. */298 * FREEBL_VERSION at the beginning of this file. */
299+ };
299diff --git a/lib/freebl/manifest.mn b/lib/freebl/manifest.mn300diff --git a/lib/freebl/manifest.mn b/lib/freebl/manifest.mn
300-index 78cbf349a..f8359fb3e 100644301+index 5bc25b4..e0a7bb4 100644
301--- a/lib/freebl/manifest.mn302--- a/lib/freebl/manifest.mn
302+++ b/lib/freebl/manifest.mn303+++ b/lib/freebl/manifest.mn
303-@@ -166,6 +166,7 @@ CSRCS = \304+@@ -165,6 +165,7 @@ CSRCS = \
304 $(STUBS_SRCS) \305 $(STUBS_SRCS) \
305 $(LOWHASH_SRCS) \306 $(LOWHASH_SRCS) \
306 $(EXTRA_SRCS) \307 $(EXTRA_SRCS) \
@@ -308,7 +309,7 @@ index 78cbf349a..f8359fb3e 100644
308 $(NULL)309 $(NULL)
309 310
310 ifndef NSS_DISABLE_DEPRECATED_SEED311 ifndef NSS_DISABLE_DEPRECATED_SEED
311-@@ -195,6 +196,7 @@ ALL_HDRS = \312+@@ -194,6 +195,7 @@ ALL_HDRS = \
312 shsign.h \313 shsign.h \
313 vis_proto.h \314 vis_proto.h \
314 seed.h \315 seed.h \
@@ -317,10 +318,10 @@ index 78cbf349a..f8359fb3e 100644
317 318
318 319
319diff --git a/lib/freebl/rawhash.c b/lib/freebl/rawhash.c320diff --git a/lib/freebl/rawhash.c b/lib/freebl/rawhash.c
320-index 6968ba0fc..2182658a2 100644321+index 6968ba0..5aeaddd 100644
321--- a/lib/freebl/rawhash.c322--- a/lib/freebl/rawhash.c
322+++ b/lib/freebl/rawhash.c323+++ b/lib/freebl/rawhash.c
323-@@ -161,6 +161,17 @@ const SECHashObject SECRawHashObjects[] = {324+@@ -231,6 +231,17 @@ const SECHashObject SECRawHashObjects[] = {
324 SHA3_512_BLOCK_LENGTH,325 SHA3_512_BLOCK_LENGTH,
325 HASH_AlgSHA3_512,326 HASH_AlgSHA3_512,
326 NULL },327 NULL },
@@ -336,13 +337,13 @@ index 6968ba0fc..2182658a2 100644
336+ HASH_AlgSM3,337+ HASH_AlgSM3,
337+ NULL },338+ NULL },
338 };339 };
339- 340+
340 const SECHashObject *341 const SECHashObject *
341diff --git a/lib/pk11wrap/pk11pars.c b/lib/pk11wrap/pk11pars.c342diff --git a/lib/pk11wrap/pk11pars.c b/lib/pk11wrap/pk11pars.c
342-index 845e38d18..45bc14e00 100644343+index 45ebf9c..68db4b6 100644
343--- a/lib/pk11wrap/pk11pars.c344--- a/lib/pk11wrap/pk11pars.c
344+++ b/lib/pk11wrap/pk11pars.c345+++ b/lib/pk11wrap/pk11pars.c
345-@@ -353,6 +353,9 @@ static const oidValDef hashOptList[] = {346+@@ -366,6 +366,9 @@ static const oidValDef hashOptList[] = {
346 { CIPHER_NAME("SHA512"), SEC_OID_SHA512,347 { CIPHER_NAME("SHA512"), SEC_OID_SHA512,
347 NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE | NSS_USE_ALG_IN_SMIME |348 NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE | NSS_USE_ALG_IN_SMIME |
348 NSS_USE_ALG_IN_PKCS12 },349 NSS_USE_ALG_IN_PKCS12 },
@@ -353,10 +354,10 @@ index 845e38d18..45bc14e00 100644
353 NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE | NSS_USE_ALG_IN_SMIME |354 NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE | NSS_USE_ALG_IN_SMIME |
354 NSS_USE_ALG_IN_PKCS12 },355 NSS_USE_ALG_IN_PKCS12 },
355diff --git a/lib/pk11wrap/pk11slot.c b/lib/pk11wrap/pk11slot.c356diff --git a/lib/pk11wrap/pk11slot.c b/lib/pk11wrap/pk11slot.c
356-index 5e4432010..002acacd6 100644357+index f0f5049..91c8552 100644
357--- a/lib/pk11wrap/pk11slot.c358--- a/lib/pk11wrap/pk11slot.c
358+++ b/lib/pk11wrap/pk11slot.c359+++ b/lib/pk11wrap/pk11slot.c
359-@@ -52,6 +52,7 @@ const PK11DefaultArrayEntry PK11_DefaultArray[] = {360+@@ -51,6 +51,7 @@ const PK11DefaultArrayEntry PK11_DefaultArray[] = {
360 { "SHA512", SECMOD_SHA512_FLAG, CKM_SHA512 },361 { "SHA512", SECMOD_SHA512_FLAG, CKM_SHA512 },
361 { "MD5", SECMOD_MD5_FLAG, CKM_MD5 },362 { "MD5", SECMOD_MD5_FLAG, CKM_MD5 },
362 { "MD2", SECMOD_MD2_FLAG, CKM_MD2 },363 { "MD2", SECMOD_MD2_FLAG, CKM_MD2 },
@@ -364,7 +365,7 @@ index 5e4432010..002acacd6 100644
364 { "SSL", SECMOD_SSL_FLAG, CKM_SSL3_PRE_MASTER_KEY_GEN },365 { "SSL", SECMOD_SSL_FLAG, CKM_SSL3_PRE_MASTER_KEY_GEN },
365 { "TLS", SECMOD_TLS_FLAG, CKM_TLS_MASTER_KEY_DERIVE },366 { "TLS", SECMOD_TLS_FLAG, CKM_TLS_MASTER_KEY_DERIVE },
366 { "SKIPJACK", SECMOD_FORTEZZA_FLAG, CKM_SKIPJACK_CBC64 },367 { "SKIPJACK", SECMOD_FORTEZZA_FLAG, CKM_SKIPJACK_CBC64 },
367-@@ -96,7 +97,8 @@ static PK11SlotList368+@@ -95,7 +96,8 @@ static PK11SlotList
368 pk11_randomSlotList,369 pk11_randomSlotList,
369 pk11_sha256SlotList,370 pk11_sha256SlotList,
370 pk11_sha512SlotList, /* slots do SHA512 and SHA384 */371 pk11_sha512SlotList, /* slots do SHA512 and SHA384 */
@@ -374,7 +375,7 @@ index 5e4432010..002acacd6 100644
374 375
375 /************************************************************376 /************************************************************
376 * Generic Slot List and Slot List element manipulations377 * Generic Slot List and Slot List element manipulations
377-@@ -878,6 +880,7 @@ PK11_InitSlotLists(void)378+@@ -887,6 +889,7 @@ PK11_InitSlotLists(void)
378 pk11_InitSlotListStatic(&pk11_sha256SlotList);379 pk11_InitSlotListStatic(&pk11_sha256SlotList);
379 pk11_InitSlotListStatic(&pk11_sha512SlotList);380 pk11_InitSlotListStatic(&pk11_sha512SlotList);
380 pk11_InitSlotListStatic(&pk11_mldsaSlotList);381 pk11_InitSlotListStatic(&pk11_mldsaSlotList);
@@ -382,7 +383,7 @@ index 5e4432010..002acacd6 100644
382 return SECSuccess;383 return SECSuccess;
383 }384 }
384 385
385-@@ -905,6 +908,7 @@ PK11_DestroySlotLists(void)386+@@ -914,6 +917,7 @@ PK11_DestroySlotLists(void)
386 pk11_FreeSlotListStatic(&pk11_sha256SlotList);387 pk11_FreeSlotListStatic(&pk11_sha256SlotList);
387 pk11_FreeSlotListStatic(&pk11_sha512SlotList);388 pk11_FreeSlotListStatic(&pk11_sha512SlotList);
388 pk11_FreeSlotListStatic(&pk11_mldsaSlotList);389 pk11_FreeSlotListStatic(&pk11_mldsaSlotList);
@@ -390,7 +391,7 @@ index 5e4432010..002acacd6 100644
390 return;391 return;
391 }392 }
392 393
393-@@ -2472,7 +2476,8 @@ PK11_GetBestSlotMultipleWithAttributes(CK_MECHANISM_TYPE *type,394+@@ -2487,7 +2491,8 @@ PK11_GetBestSlotMultipleWithAttributes(CK_MECHANISM_TYPE *type,
394 (type[i] != CKM_SHA384) &&395 (type[i] != CKM_SHA384) &&
395 (type[i] != CKM_SHA512) &&396 (type[i] != CKM_SHA512) &&
396 (type[i] != CKM_MD5) &&397 (type[i] != CKM_MD5) &&
@@ -401,7 +402,7 @@ index 5e4432010..002acacd6 100644
401 break;402 break;
402 }403 }
403diff --git a/lib/pk11wrap/secmod.h b/lib/pk11wrap/secmod.h404diff --git a/lib/pk11wrap/secmod.h b/lib/pk11wrap/secmod.h
404-index fee21d6b8..a0a1483f2 100644405+index fee21d6..a0a1483 100644
405--- a/lib/pk11wrap/secmod.h406--- a/lib/pk11wrap/secmod.h
406+++ b/lib/pk11wrap/secmod.h407+++ b/lib/pk11wrap/secmod.h
407@@ -30,6 +30,7 @@408@@ -30,6 +30,7 @@
@@ -413,10 +414,10 @@ index fee21d6b8..a0a1483f2 100644
413 #define PUBLIC_MECH_RANDOM_FLAG 0x08000000ul414 #define PUBLIC_MECH_RANDOM_FLAG 0x08000000ul
414 #define PUBLIC_MECH_FRIENDLY_FLAG 0x10000000ul415 #define PUBLIC_MECH_FRIENDLY_FLAG 0x10000000ul
415diff --git a/lib/softoken/pkcs11.c b/lib/softoken/pkcs11.c416diff --git a/lib/softoken/pkcs11.c b/lib/softoken/pkcs11.c
416-index 6bd4ac913..8e7be30b1 100644417+index d5f5021..010d9ca 100644
417--- a/lib/softoken/pkcs11.c418--- a/lib/softoken/pkcs11.c
418+++ b/lib/softoken/pkcs11.c419+++ b/lib/softoken/pkcs11.c
419-@@ -517,6 +517,7 @@ static const struct mechanismList mechanisms[] = {420+@@ -518,6 +518,7 @@ static const struct mechanismList mechanisms[] = {
420 { CKM_NSS_TLS_PRF_GENERAL_SHA256,421 { CKM_NSS_TLS_PRF_GENERAL_SHA256,
421 { 0, 512, CKF_SN_VR },422 { 0, 512, CKF_SN_VR },
422 PR_FALSE },423 PR_FALSE },
@@ -425,7 +426,7 @@ index 6bd4ac913..8e7be30b1 100644
425 { CKM_HKDF_DERIVE, { 1, 255 * 64, CKF_DERIVE }, PR_TRUE },426 { CKM_HKDF_DERIVE, { 1, 255 * 64, CKF_DERIVE }, PR_TRUE },
426 { CKM_HKDF_DATA, { 1, 255 * 64, CKF_DERIVE }, PR_TRUE },427 { CKM_HKDF_DATA, { 1, 255 * 64, CKF_DERIVE }, PR_TRUE },
427diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c428diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c
428-index 8d7bff804..769bdeff3 100644429+index 7bdb3b4..652ebc5 100644
429--- a/lib/softoken/pkcs11c.c430--- a/lib/softoken/pkcs11c.c
430+++ b/lib/softoken/pkcs11c.c431+++ b/lib/softoken/pkcs11c.c
431@@ -138,6 +138,7 @@ SFTKHashWrap(SHA3_256Context, SHA3_256);432@@ -138,6 +138,7 @@ SFTKHashWrap(SHA3_256Context, SHA3_256);
@@ -436,7 +437,7 @@ index 8d7bff804..769bdeff3 100644
436 437
437 static void438 static void
438 SFTKHash_SHA1_Begin(void *vctx)439 SFTKHash_SHA1_Begin(void *vctx)
439-@@ -2035,6 +2036,8 @@ NSC_DigestInit(CK_SESSION_HANDLE hSession,440+@@ -2114,6 +2115,8 @@ NSC_DigestInit(CK_SESSION_HANDLE hSession,
440 INIT_MECH(SHA3_256)441 INIT_MECH(SHA3_256)
441 INIT_MECH(SHA3_384)442 INIT_MECH(SHA3_384)
442 INIT_MECH(SHA3_512)443 INIT_MECH(SHA3_512)
@@ -446,7 +447,7 @@ index 8d7bff804..769bdeff3 100644
446 default:447 default:
447 crv = CKR_MECHANISM_INVALID;448 crv = CKR_MECHANISM_INVALID;
448diff --git a/lib/util/hasht.h b/lib/util/hasht.h449diff --git a/lib/util/hasht.h b/lib/util/hasht.h
449-index b70b94fbf..26506c331 100644450+index b70b94f..26506c3 100644
450--- a/lib/util/hasht.h451--- a/lib/util/hasht.h
451+++ b/lib/util/hasht.h452+++ b/lib/util/hasht.h
452@@ -28,6 +28,7 @@ typedef enum {453@@ -28,6 +28,7 @@ typedef enum {
@@ -466,10 +467,10 @@ index b70b94fbf..26506c331 100644
466 467
467 /*468 /*
468diff --git a/lib/util/nsshash.c b/lib/util/nsshash.c469diff --git a/lib/util/nsshash.c b/lib/util/nsshash.c
469-index a4271187f..174b8be68 100644470+index a427118..e1020c4 100644
470--- a/lib/util/nsshash.c471--- a/lib/util/nsshash.c
471+++ b/lib/util/nsshash.c472+++ b/lib/util/nsshash.c
472-@@ -45,6 +45,9 @@ HASH_GetHashTypeByOidTag(SECOidTag hashOid)473+@@ -46,6 +46,9 @@ HASH_GetHashTypeByOidTag(SECOidTag hashOid)
473 case SEC_OID_SHA3_512:474 case SEC_OID_SHA3_512:
474 ht = HASH_AlgSHA3_512;475 ht = HASH_AlgSHA3_512;
475 break;476 break;
@@ -480,10 +481,10 @@ index a4271187f..174b8be68 100644
480 PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);481 PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
481 break;482 break;
482diff --git a/lib/util/pkcs11n.h b/lib/util/pkcs11n.h483diff --git a/lib/util/pkcs11n.h b/lib/util/pkcs11n.h
483-index 6dd2eb6ab..ceda492fc 100644484+index fb67e3f..b8d216c 100644
484--- a/lib/util/pkcs11n.h485--- a/lib/util/pkcs11n.h
485+++ b/lib/util/pkcs11n.h486+++ b/lib/util/pkcs11n.h
486-@@ -414,6 +414,9 @@487+@@ -416,6 +416,9 @@
487 #define CKM_NSS_ML_KEM_KEY_PAIR_GEN (CKM_NSS + 48)488 #define CKM_NSS_ML_KEM_KEY_PAIR_GEN (CKM_NSS + 48)
488 #define CKM_NSS_ML_KEM (CKM_NSS + 49)489 #define CKM_NSS_ML_KEM (CKM_NSS + 49)
489 490
@@ -494,10 +495,10 @@ index 6dd2eb6ab..ceda492fc 100644
494 * HISTORICAL:495 * HISTORICAL:
495 * Do not attempt to use these. They are only used by NSS's internal496 * Do not attempt to use these. They are only used by NSS's internal
496diff --git a/lib/util/secoid.c b/lib/util/secoid.c497diff --git a/lib/util/secoid.c b/lib/util/secoid.c
497-index 2c10ff7bf..84c6b7deb 100644498+index f827138..a9e2a69 100644
498--- a/lib/util/secoid.c499--- a/lib/util/secoid.c
499+++ b/lib/util/secoid.c500+++ b/lib/util/secoid.c
500-@@ -628,6 +628,11 @@ CONST_OID evIncorporationCountry[] = { EV_NAME_ATTRIBUTE, 3 };501+@@ -630,6 +630,11 @@ CONST_OID evIncorporationCountry[] = { EV_NAME_ATTRIBUTE, 3 };
501 */502 */
502 CONST_OID curve25519[] = { 0x2B, 0x06, 0x01, 0x04, 0x01, 0xDA, 0x47, 0x0F, 0x01 };503 CONST_OID curve25519[] = { 0x2B, 0x06, 0x01, 0x04, 0x01, 0xDA, 0x47, 0x0F, 0x01 };
503 504
@@ -509,30 +510,28 @@ index 2c10ff7bf..84c6b7deb 100644
509 /*510 /*
510 https://oid-rep.orange-labs.fr/get/1.3.101.112511 https://oid-rep.orange-labs.fr/get/1.3.101.112
511 A.1. ASN.1 Object for Ed25519512 A.1. ASN.1 Object for Ed25519
512-@@ -1917,6 +1922,8 @@ const static SECOidData oids[SEC_OID_TOTAL] = {513+@@ -1933,6 +1938,7 @@ const static SECOidData oids[SEC_OID_TOTAL] = {
513- ODE(SEC_OID_SECP384R1MLKEM1024,514+ OD(cmsAuthEnvelopedData, SEC_OID_CMS_AUTH_ENVELOPED_DATA,
514- "SECP384R1+ML-KEM-1024 Hybrid key exchange", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),515+ "CMS AuthEnvelopedData",
515- 516+ CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
516-+
517+ OD(sm3, SEC_OID_SM3, "SM3", CKM_NSS_SM3, INVALID_CERT_EXTENSION),517+ OD(sm3, SEC_OID_SM3, "SM3", CKM_NSS_SM3, INVALID_CERT_EXTENSION),
518+
518 };519 };
519 520
520- /* PRIVATE EXTENDED SECOID Table
521diff --git a/lib/util/secoidt.h b/lib/util/secoidt.h521diff --git a/lib/util/secoidt.h b/lib/util/secoidt.h
522-index 15499ece8..b38058d76 100644522+index 6b24728..8153070 100644
523--- a/lib/util/secoidt.h523--- a/lib/util/secoidt.h
524+++ b/lib/util/secoidt.h524+++ b/lib/util/secoidt.h
525-@@ -540,6 +539,8 @@ typedef enum {525+@@ -546,6 +546,7 @@ typedef enum {
526- SEC_OID_SECP256R1MLKEM768 = 394,526+ SEC_OID_ML_KEM_1024 = 398,
527- SEC_OID_SECP384R1MLKEM1024 = 395,527+
528+ SEC_OID_CMS_AUTH_ENVELOPED_DATA = 399,
529++ SEC_OID_SM3 = 400,
528 530
529-+ SEC_OID_SM3 = 396,
530-+
531 SEC_OID_TOTAL531 SEC_OID_TOTAL
532 } SECOidTag;532 } SECOidTag;
533-
534diff --git a/lib/util/utilmodt.h b/lib/util/utilmodt.h533diff --git a/lib/util/utilmodt.h b/lib/util/utilmodt.h
535-index 0d1e4419f..115e47b32 100644534+index 0d1e441..115e47b 100644
536--- a/lib/util/utilmodt.h535--- a/lib/util/utilmodt.h
537+++ b/lib/util/utilmodt.h536+++ b/lib/util/utilmodt.h
538@@ -29,6 +29,7 @@537@@ -29,6 +29,7 @@
@@ -544,7 +543,7 @@ index 0d1e4419f..115e47b32 100644
544 #define SECMOD_RESERVED_FLAG 0X08000000L543 #define SECMOD_RESERVED_FLAG 0X08000000L
545 #define SECMOD_FRIENDLY_FLAG 0x10000000L544 #define SECMOD_FRIENDLY_FLAG 0x10000000L
546diff --git a/lib/util/utilpars.c b/lib/util/utilpars.c545diff --git a/lib/util/utilpars.c b/lib/util/utilpars.c
547-index 0461eb9fe..fc6ccdd75 100644546+index 4246832..db19f2e 100644
548--- a/lib/util/utilpars.c547--- a/lib/util/utilpars.c
549+++ b/lib/util/utilpars.c548+++ b/lib/util/utilpars.c
550@@ -607,6 +607,7 @@ static struct nssutilArgSlotFlagTable nssutil_argSlotFlagTable[] = {549@@ -607,6 +607,7 @@ static struct nssutilArgSlotFlagTable nssutil_argSlotFlagTable[] = {
@@ -556,7 +555,7 @@ index 0461eb9fe..fc6ccdd75 100644
556 NSSUTIL_ARG_ENTRY(RANDOM, SECMOD_RANDOM_FLAG),555 NSSUTIL_ARG_ENTRY(RANDOM, SECMOD_RANDOM_FLAG),
557 NSSUTIL_ARG_ENTRY(Disable, SECMOD_DISABLE_FLAG),556 NSSUTIL_ARG_ENTRY(Disable, SECMOD_DISABLE_FLAG),
558diff --git a/lib/util/utilparst.h b/lib/util/utilparst.h557diff --git a/lib/util/utilparst.h b/lib/util/utilparst.h
559-index 5dda09028..7a4c9f73a 100644558+index 5dda090..7a4c9f7 100644
560--- a/lib/util/utilparst.h559--- a/lib/util/utilparst.h
561+++ b/lib/util/utilparst.h560+++ b/lib/util/utilparst.h
562@@ -43,7 +43,7 @@561@@ -43,7 +43,7 @@
@@ -568,6 +567,3 @@ index 5dda09028..7a4c9f73a 100644
568 567
569 #define NSSUTIL_DEFAULT_CIPHER_ORDER 0568 #define NSSUTIL_DEFAULT_CIPHER_ORDER 0
570 #define NSSUTIL_DEFAULT_TRUST_ORDER 50569 #define NSSUTIL_DEFAULT_TRUST_ORDER 50
571---
572-2.47.3
573- 
Dbackport-CVE-2026-16389.patch+0-44
@@ -1,44 +0,0 @@
1-Origin: https://hg-edge.mozilla.org/projects/nss/rev/9e854d9c6234ac0990f9002b364abddb6a6a645d
2-From dcb5f9f3c6ef5e88e6502f985a97d8ce17fba9d9 Mon Sep 17 00:00:00 2001
3-From: John Schanck <jschanck@mozilla.com>
4-Date: Sun, 2 Aug 2026 05:52:19 +0000
5-Subject: [PATCH] Bug 2043887 - guard against integer overflow in CERT_Hexify.
6- r=nss-reviewers,keeler
7- 
8----
9- lib/certhigh/certhtml.c | 8 ++++++++
10- 1 file changed, 8 insertions(+)
11- 
12-diff --git a/lib/certhigh/certhtml.c b/lib/certhigh/certhtml.c
13-index 2d708cc..0226391 100644
14---- a/lib/certhigh/certhtml.c
15-+++ b/lib/certhigh/certhtml.c
16-@@ -6,6 +6,8 @@
17- * certhtml.c --- convert a cert to html
18- */
19-
20-+#include <limits.h>
21-+
22- #include "seccomon.h"
23- #include "secitem.h"
24- #include "sechash.h"
25-@@ -14,6 +16,7 @@
26- #include "secder.h"
27- #include "prprf.h"
28- #include "secport.h"
29-+#include "secerr.h"
30- #include "secasn1.h"
31- #include "pk11func.h"
32-
33-@@ -32,6 +35,11 @@ CERT_Hexify(SECItem *i, int do_colon)
34- return PORT_Strdup("00");
35- }
36-
37-+ if (i->len > UINT_MAX / 3) {
38-+ PORT_SetError(SEC_ERROR_INVALID_ARGS);
39-+ return NULL;
40-+ }
41-+
42- rv = o = (char *)PORT_Alloc(i->len * 3);
43- if (!rv)
44- return rv;
Rnss-3.120.1.tar.gz→nss-3.126.tar.gz+2-2
@@ -1,3 +1,3 @@
1version https://git-lfs.github.com/spec/v11version https://git-lfs.github.com/spec/v1
2-oid sha256:a98f002d20bfe719f50f81824a64c9e6f067f4da3c6a1f0455e97e6d792405122+oid sha256:7aa07c758be1453d82d739240b249ffb7aef0041be488067e1c0f348e1f9e337
3-size 776357923+size 78769092
Mnss.spec+11-10
@@ -1,7 +1,7 @@
1%global nspr_version 4.35.01%global nspr_version 4.35.0
2-%global nss_version 3.120.12+%global nss_version 3.126
3-%global nss_ver 3_120_13+%global nss_ver 3_126
4-%global nss_archive_version 3.120.14+%global nss_archive_version 3.126
5%global unsupported_tools_directory %{_libdir}/nss/unsupported-tools5%global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
6%global allTools "certutil cmsutil crlutil derdump modutil pk12util signtool signver ssltap vfychain vfyserv"6%global allTools "certutil cmsutil crlutil derdump modutil pk12util signtool signver ssltap vfychain vfyserv"
7 7 
@@ -26,7 +26,7 @@
26Summary: Network Security Services26Summary: Network Security Services
27Name: nss27Name: nss
28Version: %{nss_version}28Version: %{nss_version}
29-Release: 429+Release: 1
30License: MPLv2.030License: MPLv2.0
31URL: http://www.mozilla.org/projects/security/pki/nss/31URL: http://www.mozilla.org/projects/security/pki/nss/
32Provides: nss-system-init32Provides: nss-system-init
@@ -52,9 +52,6 @@ Source14: blank-key4.db
52Source15: system-pkcs11.txt52Source15: system-pkcs11.txt
53Source16: setup-nsssysinit.sh53Source16: setup-nsssysinit.sh
54 54 
55-# Backport: CVE fixes
56-Patch6000: backport-CVE-2026-16389.patch
57- 
58# Feature: support sm2 and sm355# Feature: support sm2 and sm3
59Patch9000: Feature-nss-add-implement-of-SM3-digest-algorithm.patch56Patch9000: Feature-nss-add-implement-of-SM3-digest-algorithm.patch
60Patch9001: Feature-port-nss-support-SM3-digest-algorithm-to-NSS_3_117_R.patch57Patch9001: Feature-port-nss-support-SM3-digest-algorithm-to-NSS_3_117_R.patch
@@ -142,7 +139,6 @@ Help document for NSS
142%prep139%prep
143%setup -q -n %{name}-%{nss_archive_version}140%setup -q -n %{name}-%{nss_archive_version}
144pushd nss141pushd nss
145-%patch -P 6000 -p1
146%patch -P 9000 -p1142%patch -P 9000 -p1
147%patch -P 9001 -p1143%patch -P 9001 -p1
148%patch -P 9002 -p1144%patch -P 9002 -p1
@@ -350,7 +346,7 @@ do
350done346done
351 347 
352# Copy the development libraries we want348# Copy the development libraries we want
353-for file in libcrmf.a libnssb.a libnssckfw.a libfreebl.a349+for file in libnssb.a libnssckfw.a libfreebl.a
354do350do
355 install -p -m 644 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir}351 install -p -m 644 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir}
356done352done
@@ -428,7 +424,6 @@ update-crypto-policies &>/dev/null||:
428%{_bindir}/setup-nsssysinit424%{_bindir}/setup-nsssysinit
429 425 
430%files devel426%files devel
431-%{_libdir}/libcrmf.a
432%{_libdir}/pkgconfig/nss.pc427%{_libdir}/pkgconfig/nss.pc
433%{_bindir}/nss-config428%{_bindir}/nss-config
434%{_libdir}/libnssb.a429%{_libdir}/libnssb.a
@@ -575,6 +570,12 @@ update-crypto-policies &>/dev/null||:
575%doc %{_mandir}/man*570%doc %{_mandir}/man*
576 571 
577%changelog572%changelog
573+* Wed Aug 12 2026 Funda Wang <fundawang@yeah.net> - 3.126-1
574+- update to 3.126
575+- adapt SM2/SM3 patches for 3.126 (SEC_OID_SM3=400, SEC_OID_SM2=401, SEC_OID_SM2_WITH_SM3=402)
576+- remove libcrmf as it is being deprecated and we don't use it.
577+- drop backport-CVE-2026-16389.patch (fixed upstream in 3.126)
578+ 
578* Sun Aug 2 2026 Qin Fandong <qinfandong@kylinos.cn> - 3.120.1-4579* Sun Aug 2 2026 Qin Fandong <qinfandong@kylinos.cn> - 3.120.1-4
579- Type:CVE580- Type:CVE
580- ID:CVE-2026-16389581- ID:CVE-2026-16389