nss-3.52

[Bruce Dubbs]

New minor version.

[Douglas R. Reno]

Notable Changes in NSS 3.52

    Bug 1603628 - Update NSS to support PKCS #11 v3.0.
    Bug 1623374 - Support new PKCS #11 v3.0 Message Interface for AES-GCM and ChaChaPoly.
    Bug 1612493 - Integrate AVX2 ChaCha20, Poly1305, and ChaCha20Poly1305 from HACL*.

Bugs fixed in NSS 3.52

    Bug 1633498 - Fix unused variable 'getauxval' error on iOS compilation.
    Bug 1630721 - Add Softoken functions for FIPS.
    Bug 1630458 - Fix problem of GYP MSVC builds not producing debug symbol files.
    Bug 1629663 - Add IKEv1 Quick Mode KDF.
    Bug 1629661 - MPConfig calls in SSL initiailizes policy before NSS is initialized.
    Bug 1629655 - Support temporary session objects in ckfw.
    Bug 1629105 - Add PKCS11 v3.0 functions to module debug logger.
    Bug 1626751 - Fix error in generation of fuzz32 docker image after updates.
    Bug 1625133 - Fix implicit declaration of function 'getopt' error.
    Bug 1624864 - Allow building of gcm-arm32-neon on non-armv7 architectures.
    Bug 1624402 - Fix compilation error in Firefox Android.
    Bug 1624130 - Require CK_FUNCTION_LIST structs to be packed.
    Bug 1624377 - Fix clang warning for unknown argument '-msse4'.
    Bug 1623374 - Support new PKCS #11 v3.0 Message Interface for AES-GCM and ChaChaPoly.
    Bug 1623184 - Fix freebl_cpuid for querying Extended Features.
    Bug 1622555 - Fix argument parsing in lowhashtest.
    Bug 1620799 - Introduce NSS_DISABLE_GCM_ARM32_NEON to build on arm32 without NEON support.
    Bug 1619102 - Add workaround option to include both DTLS and TLS versions in DTLS supported_versions.
    Bug 1619056 - Update README: TLS 1.3 is not experimental anymore.
    Bug 1618915 - Fix UBSAN issue in ssl_ParseSessionTicket.
    Bug 1618739 - Don't assert fuzzer behavior in SSL_ParseSessionTicket.
    Bug 1617968 - Update Delegated Credentials implementation to draft-07.
    Bug 1617533 - Update HACL* dependencies for libintvector.h
    Bug 1613238 - Add vector accelerated SHA2 for POWER 8+.
    Bug 1612493 - Integrate AVX2 ChaCha20, Poly1305, and ChaCha20Poly1305 from HACL*.
    Bug 1612281 - Maintain PKCS11 C_GetAttributeValue semantics on attributes that lack NSS database columns.
    Bug 1612260 - Add Wycheproof RSA test vectors.
    Bug 1608250 - broken fipstest handling of KI_len.
    Bug 1608245 - Consistently handle NULL slot/session.
    Bug 1603801 - Avoid dcache pollution from sdb_measureAccess().
    Bug 1603628 - Update NSS to support PKCS #11 v3.0.
    Bug 1561637 - TLS 1.3 does not work in FIPS mode.
    Bug 1531906 - Fix overzalous assertion when evicting a cached sessionID or using external cache.
    Bug 1465613 - Fix issue where testlib makefile build produced extraneous object files.
    Bug 1619959 - Properly handle multi-block SEED ECB inputs.
    Bug 1630925 - Guard all instances of NSSCMSSignedData.signerInfo to avoid a CMS crash
    Bug 1571677 - Name Constraints validation: CN treated as DNS name even when syntactically invalid as DNS name

[Douglas R. Reno]

I noticed something interesting while reviewing my build log:

coreconf/arch.mk:150: CPU_ARCH is not x86_64, disabling -mavx2

I am in fact on an x86_64 CPU:

renodr [ /sources ]$ uname -m
x86_64

And I do have AVX2 support

Flags:                           fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single pti tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp

It's just an oddity though, the build works fine and NSS seems to work as normal.

[Douglas R. Reno]

Fixed at r4102

[Bruce Dubbs]

Milestone renamed

[Bruce Dubbs]

Milestone renamed