f5a8d01d38
The problem in the new code was that previously xmlSecNssInit() didn't require an already initialized NSS, but 1.3.3 did. Backport upstream fix that restores the old behavior that NSS init is not needed, which allows no longer reverting the xmlSecNssUpdateAvailableCryptoTransforms() call that upstream added recently. Change-Id: Ie33ccbff0149e3c406d5574e889d90da4fdbbfb5 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162292 Reviewed-by: Miklos Vajna <vmiklos@collabora.com> Tested-by: Jenkins
67 lines
2.5 KiB
Groff
67 lines
2.5 KiB
Groff
diff --git a/include/xmlsec/nss/crypto.h b/include/xmlsec/nss/crypto.h
|
|
index bb64c5f2..fe9904be 100644
|
|
--- a/include/xmlsec/nss/crypto.h
|
|
+++ b/include/xmlsec/nss/crypto.h
|
|
@@ -105,6 +105,7 @@ XMLSEC_CRYPTO_EXPORT xmlSecTransformId xmlSecNssTransformAes192CbcGetKlass(void
|
|
XMLSEC_CRYPTO_EXPORT xmlSecTransformId xmlSecNssTransformAes256CbcGetKlass(void);
|
|
|
|
|
|
+#if 0
|
|
/**
|
|
* xmlSecNssTransformAes128GcmId:
|
|
*
|
|
@@ -131,6 +132,7 @@ XMLSEC_CRYPTO_EXPORT xmlSecTransformId xmlSecNssTransformAes192GcmGetKlass(void
|
|
#define xmlSecNssTransformAes256GcmId \
|
|
xmlSecNssTransformAes256GcmGetKlass()
|
|
XMLSEC_CRYPTO_EXPORT xmlSecTransformId xmlSecNssTransformAes256GcmGetKlass(void);
|
|
+#endif
|
|
|
|
|
|
/**
|
|
diff --git a/src/nss/ciphers_gcm.c b/src/nss/ciphers_gcm.c
|
|
index 5763a756..7b50e5fd 100644
|
|
--- a/src/nss/ciphers_gcm.c
|
|
+++ b/src/nss/ciphers_gcm.c
|
|
@@ -31,6 +31,7 @@
|
|
#include "../cast_helpers.h"
|
|
#include "../kw_aes_des.h"
|
|
|
|
+#if 0
|
|
/* https://www.w3.org/TR/xmlenc-core1/#sec-AES-GCM
|
|
*
|
|
* For the purposes of this specification, AES-GCM shall be used with
|
|
@@ -591,3 +592,4 @@ xmlSecNssTransformAes256GcmGetKlass(void) {
|
|
}
|
|
|
|
#endif /* XMLSEC_NO_AES */
|
|
+#endif
|
|
diff --git a/src/nss/crypto.c b/src/nss/crypto.c
|
|
index 429d209f..e0296bda 100644
|
|
--- a/src/nss/crypto.c
|
|
+++ b/src/nss/crypto.c
|
|
@@ -162,10 +162,12 @@ xmlSecCryptoGetFunctions_nss(void) {
|
|
gXmlSecNssFunctions->transformAes192CbcGetKlass = xmlSecNssTransformAes192CbcGetKlass;
|
|
gXmlSecNssFunctions->transformAes256CbcGetKlass = xmlSecNssTransformAes256CbcGetKlass;
|
|
|
|
+#if 0
|
|
/* gcm */
|
|
gXmlSecNssFunctions->transformAes128GcmGetKlass = xmlSecNssTransformAes128GcmGetKlass;
|
|
gXmlSecNssFunctions->transformAes192GcmGetKlass = xmlSecNssTransformAes192GcmGetKlass;
|
|
gXmlSecNssFunctions->transformAes256GcmGetKlass = xmlSecNssTransformAes256GcmGetKlass;
|
|
+#endif
|
|
|
|
/* kw: uses AES ECB */
|
|
gXmlSecNssFunctions->transformKWAes128GetKlass = xmlSecNssTransformKWAes128GetKlass;
|
|
diff --git a/include/xmlsec/nss/crypto.h b/include/xmlsec/nss/crypto.h
|
|
index bb64c5f2..4c3dc4d3 100644
|
|
--- a/include/xmlsec/nss/crypto.h
|
|
+++ b/include/xmlsec/nss/crypto.h
|
|
@@ -26,7 +26,7 @@
|
|
* RSA OAEP requires https://bugzilla.mozilla.org/show_bug.cgi?id=1666891
|
|
* which was fixed in NSS 3.59 (https://firefox-source-docs.mozilla.org/security/nss/legacy/nss_releases/nss_3.59_release_notes/index.html)
|
|
*/
|
|
-#if (NSS_VMAJOR < 3) || ((NSS_VMAJOR == 3) && (NSS_VMINOR < 59))
|
|
+#if 1
|
|
#define XMLSEC_NO_RSA_OAEP 1
|
|
#else /* (NSS_VMAJOR < 3) || ((NSS_VMAJOR == 3) && (NSS_VMINOR < 59)) */
|
|
#define XMLSEC_NO_MD5 1
|