Re: Problem on building NSS with Windows
In addition, I have checked my installed MozillaBuild. It doesn't include file quickder.c. Is there any wrong on MoziilaBuild? Or some issue in my environment? 2016-08-19 15:24 GMT+08:00 John Jiang <john.sha.ji...@gmail.com>: > Hi, > I tried to build NSS on Windows 7 x86_64 machine, and followed the > instructions at: > https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Building > > VS 2015 community and Latest MozillaBuild have been installed, and USE_64 > was set to 1. > When "make nss_build_all" finished, I got the below errors: > c1: fatal error C1083: Cannot open source file: > 'C:/mozilla-build/msys/quickder.c': > No such file or directory > make[2]: *** [WIN954.0_x86_64_64_DBG.OBJ/quickder.obj] Error 2 > make[2]: Leaving directory `/d/security/nss/nss-latest/nss/lib/util' > make[1]: *** [libs] Error 2 > make[1]: Leaving directory `/d/security/nss/nss-latest/nss/lib' > make: *** [libs] Error 2 > > How to resolve this problem? > Thanks! > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Problem on building NSS with Windows
Hi, I tried to build NSS on Windows 7 x86_64 machine, and followed the instructions at: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Building VS 2015 community and Latest MozillaBuild have been installed, and USE_64 was set to 1. When "make nss_build_all" finished, I got the below errors: c1: fatal error C1083: Cannot open source file: 'C:/mozilla-build/msys/quickder.c': No such file or directory make[2]: *** [WIN954.0_x86_64_64_DBG.OBJ/quickder.obj] Error 2 make[2]: Leaving directory `/d/security/nss/nss-latest/nss/lib/util' make[1]: *** [libs] Error 2 make[1]: Leaving directory `/d/security/nss/nss-latest/nss/lib' make: *** [libs] Error 2 How to resolve this problem? Thanks! -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Problem on building NSS with Windows
Hi, Thanks for your reply. My steps are the follwings: 1. Double-click start-shell-msvc2015-x64.bat in C:\mozilla-build. And it displayed some information, like the below: MozillaBuild Install Directory: C:\mozilla-build\ Visual C++ 2015 Directory: C:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\ Windows SDK Directory: C:\Program Files (x86)\Windows Kits\8.1\ Using the MSVC 2015 64-bit toolchain. 2. cd /d/security/nss/nss-latest/nss/ The source directories of nss and nspr are under a same parent directory nss-latest. 3. export USE_64=1 4. make nss_build_all 2016-08-19 16:21 GMT+08:00 Franziskus Kiefer <fkie...@mozilla.com>: > This sounds like there's something wrong with the setup. quickder.c is a > file in NSS [1] (lib/util as your output shows as well). > > 'C:/mozilla-build/msys/quickder.c': No such file or directory > > So this line is a bit confusing. Why is your build searching in the > mozilla-build directory for NSS files? What's your folder structure and > where do you execute the make command? Describing the exact steps of what > you're doing might help to figure this out. > > Cheers > > [1] > http://searchfox.org/nss/rev/462a77115abebd0f3cd9cb56dbc350 > a25b9be706/lib/util/quickder.c > > On Fri, Aug 19, 2016 at 9:30 AM, John Jiang <john.sha.ji...@gmail.com> > wrote: > > > In addition, I have checked my installed MozillaBuild. It doesn't include > > file quickder.c. > > Is there any wrong on MoziilaBuild? Or some issue in my environment? > > > > 2016-08-19 15:24 GMT+08:00 John Jiang <john.sha.ji...@gmail.com>: > > > > > Hi, > > > I tried to build NSS on Windows 7 x86_64 machine, and followed the > > > instructions at: > > > https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Building > > > > > > VS 2015 community and Latest MozillaBuild have been installed, and > USE_64 > > > was set to 1. > > > When "make nss_build_all" finished, I got the below errors: > > > c1: fatal error C1083: Cannot open source file: 'C:/mozilla-build/msys/ > > quickder.c': > > > No such file or directory > > > make[2]: *** [WIN954.0_x86_64_64_DBG.OBJ/quickder.obj] Error 2 > > > make[2]: Leaving directory `/d/security/nss/nss-latest/nss/lib/util' > > > make[1]: *** [libs] Error 2 > > > make[1]: Leaving directory `/d/security/nss/nss-latest/nss/lib' > > > make: *** [libs] Error 2 > > > > > > How to resolve this problem? > > > Thanks! > > > > > -- > > dev-tech-crypto mailing list > > dev-tech-crypto@lists.mozilla.org > > https://lists.mozilla.org/listinfo/dev-tech-crypto > > > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Problem on building NSS with Windows
Hi, Thanks for your reply. I don't get any useful info from env output, like the below $ env | grep msys OSTYPE=msys MACHTYPE=i686-pc-msys 2016-08-20 0:31 GMT+08:00 Wan-Teh Chang <w...@google.com>: > On Fri, Aug 19, 2016 at 1:49 AM, John Jiang <john.sha.ji...@gmail.com> > wrote: > > Hi, > > Thanks for your reply. > > > > My steps are the follwings: > > 1. Double-click start-shell-msvc2015-x64.bat in C:\mozilla-build. And it > > displayed some information, like the below: > > MozillaBuild Install Directory: C:\mozilla-build\ > > Visual C++ 2015 Directory: C:\Program Files (x86)\Microsoft Visual Studio > > 14.0\VC\ > > Windows SDK Directory: C:\Program Files (x86)\Windows Kits\8.1\ > > Using the MSVC 2015 64-bit toolchain. > > 2. cd /d/security/nss/nss-latest/nss/ > > The source directories of nss and nspr are under a same parent directory > > nss-latest. > > 3. export USE_64=1 > > 4. make nss_build_all > > Hi John, > > Your steps look correct to me. There must be something wrong in your > environment variables. > > Our clue is the pathname 'C:/mozilla-build/msys/quickder.c'. The > 'C:/mozilla-build/msys' part is the problem. Can you run the command > 'env' to print your environment variables, and see which one contains > 'C:/mozilla-build/msys'? > > Wan-Teh Chang > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Problem on building NSS with Windows
I checked the full logs. Many "execvp: pwd: Permission denied" in the logs, like the below, ... make[1]: Leaving directory `/d/security/nss/nss-latest/nspr/WIN954.0_x86_64_64_DBG.OBJ' cd coreconf; make export make[1]: execvp: pwd: Permission denied make[1]: Entering directory `/d/security/nss/nss-latest/nss/coreconf' cd nsinstall; make export make[2]: execvp: pwd: Permission denied make[2]: Entering directory `/d/security/nss/nss-latest/nss/coreconf/nsinstall' make[2]: Nothing to be done for `export'. make[2]: Leaving directory `/d/security/nss/nss-latest/nss/coreconf/nsinstall' cd nsinstall; make libs ... Does it impact the building? Thanks! 2016-08-20 9:48 GMT+08:00 Julien Pierre <julien.pie...@oracle.com>: > That looks correct; must be a different issue then. > > Julien > > > > On 8/19/2016 18:44, John Jiang wrote: > >> Run "make -version" in the MSYS/BASH command prompt, which is launched by >> MozillaBuild, and got the following info, >> GNU Make 3.81.90 >> Copyright (C) 2006 Free Software Foundation, Inc. >> This is free software; see the source for copying conditions. >> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A >> PARTICULAR PURPOSE. >> >> This program built for i686-pc-msys32 >> >> 2016-08-20 9:24 GMT+08:00 Julien Pierre <julien.pie...@oracle.com>: >> >> Which version of GNU make do you have in your PATH ? >>> >>> The NSS build system tries to get the absolute location of all source >>> files. It does so to facilitate debugging, so that debug binaries can >>> automatically locate the files in a debugger. It uses gmake >>> macros/function >>> that don't work in very old gmake. This is a change I made 10+ years ago. >>> >>> If you have gmake < 3.81, I think that path computation will fail. Just >>> check which gmake or make you have with gmake.exe -v . >>> >>> You might also have the Microsoft make.exe / nmake.exe in your path . >>> >>> Make sure the version of make in your path is GNU make and not another >>> make. >>> >>> Julien >>> >>> >>> >>> On 8/19/2016 00:24, John Jiang wrote: >>> >>> Hi, >>>> I tried to build NSS on Windows 7 x86_64 machine, and followed the >>>> instructions at: >>>> https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Building >>>> >>>> VS 2015 community and Latest MozillaBuild have been installed, and >>>> USE_64 >>>> was set to 1. >>>> When "make nss_build_all" finished, I got the below errors: >>>> c1: fatal error C1083: Cannot open source file: >>>> 'C:/mozilla-build/msys/quickder.c': No such file or directory >>>> make[2]: *** [WIN954.0_x86_64_64_DBG.OBJ/quickder.obj] Error 2 >>>> make[2]: Leaving directory `/d/security/nss/nss-latest/nss/lib/util' >>>> make[1]: *** [libs] Error 2 >>>> make[1]: Leaving directory `/d/security/nss/nss-latest/nss/lib' >>>> make: *** [libs] Error 2 >>>> >>>> How to resolve this problem? >>>> Thanks! >>>> >>>> -- >>> dev-tech-crypto mailing list >>> dev-tech-crypto@lists.mozilla.org >>> https://lists.mozilla.org/listinfo/dev-tech-crypto >>> >>> > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Problem on building NSS with Windows
2016-08-20 20:25 GMT+08:00 Manuel Dejonghe <man...@dejonghe.de>: > On Sat, Aug 20, 2016 at 4:00 AM, John Jiang <john.sha.ji...@gmail.com> > wrote: > > I checked the full logs. Many "execvp: pwd: Permission denied" in the > logs, > > like the below, > > ... > > make[1]: Leaving directory > > `/d/security/nss/nss-latest/nspr/WIN954.0_x86_64_64_DBG.OBJ' > > cd coreconf; make export > > make[1]: execvp: pwd: Permission denied > > make[1]: Entering directory `/d/security/nss/nss-latest/nss/coreconf' > > cd nsinstall; make export > > make[2]: execvp: pwd: Permission denied > > make[2]: Entering directory > > `/d/security/nss/nss-latest/nss/coreconf/nsinstall' > > make[2]: Nothing to be done for `export'. > > make[2]: Leaving directory > > `/d/security/nss/nss-latest/nss/coreconf/nsinstall' > > cd nsinstall; make libs > > ... > > > > Does it impact the building? > > Most certainly it does. > "pwd" is a command with which the build system could find out where > (in which directory) it is sitting. As long as that fails, I would not > be amazed that files are being searched/built in the wrong directory. > I'm really confused by this issue. If run "pwd" by manual in that command prompt, I didn't get any error or warning. It did work well. > ~manuel > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Problem on building NSS with Windows
Hi Julien, Thanks for your info! 2016-08-21 6:49 GMT+08:00 Julien Pierre <julien.pie...@oracle.com>: > This is an issue with the shell's inability to run "pwd.exe". > It may be either a built-in shell, or a separately configured shell. > What is the value of the SHELL environment variable, if any ? > $ echo $SHELL /bin/sh > > See > https://www.gnu.org/software/make/manual/make.html#Choosing-the-Shell > for more details. > > "shell pwd" is what's used in the NSS build within coreconf to find the > absolute path for source files - ie. this is the change that was made 10 > years ago. > > quickder.c is the first source file to be compiled in NSS, which I > originally authored. > > Julien > > - Original Message - > From: john.sha.ji...@gmail.com > To: dev-tech-crypto@lists.mozilla.org > Sent: Saturday, August 20, 2016 6:58:02 AM GMT -08:00 US/Canada Pacific > Subject: Re: Problem on building NSS with Windows > > 2016-08-20 20:25 GMT+08:00 Manuel Dejonghe <man...@dejonghe.de>: > > > On Sat, Aug 20, 2016 at 4:00 AM, John Jiang <john.sha.ji...@gmail.com> > > wrote: > > > I checked the full logs. Many "execvp: pwd: Permission denied" in the > > logs, > > > like the below, > > > ... > > > make[1]: Leaving directory > > > `/d/security/nss/nss-latest/nspr/WIN954.0_x86_64_64_DBG.OBJ' > > > cd coreconf; make export > > > make[1]: execvp: pwd: Permission denied > > > make[1]: Entering directory `/d/security/nss/nss-latest/nss/coreconf' > > > cd nsinstall; make export > > > make[2]: execvp: pwd: Permission denied > > > make[2]: Entering directory > > > `/d/security/nss/nss-latest/nss/coreconf/nsinstall' > > > make[2]: Nothing to be done for `export'. > > > make[2]: Leaving directory > > > `/d/security/nss/nss-latest/nss/coreconf/nsinstall' > > > cd nsinstall; make libs > > > ... > > > > > > Does it impact the building? > > > > Most certainly it does. > > "pwd" is a command with which the build system could find out where > > (in which directory) it is sitting. As long as that fails, I would not > > be amazed that files are being searched/built in the wrong directory. > > > I'm really confused by this issue. > If run "pwd" by manual in that command prompt, I didn't get any error or > warning. > It did work well. > > > > ~manuel > > -- > > dev-tech-crypto mailing list > > dev-tech-crypto@lists.mozilla.org > > https://lists.mozilla.org/listinfo/dev-tech-crypto > > > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Problems on building NSS with VS2013
Hi, I tried to build NSS 3.16 + NSPR 4.10.4 with VS2013 (Community) on Windows 8 x64. But finally the following errors were raised: WIN954.0_64_DBG.OBJ\addbuiltin.obj addbuiltin.obj : error LNK2019: unresolved external symbol __imp___acrt_iob_func referenced in function print_crl_info sectool.lib(basicutil.obj) : error LNK2001: unresolved external symbol __imp___acrt_iob_func sectool.lib(secutil.obj) : error LNK2001: unresolved external symbol __imp___acrt_iob_func sectool.lib(secpwd.obj) : error LNK2001: unresolved external symbol __imp___acrt_iob_func sectool.lib(pppolicy.obj) : error LNK2001: unresolved external symbol __imp___stdio_common_vfprintf addbuiltin.obj : error LNK2001: unresolved external symbol __imp___stdio_common_vfprintf sectool.lib(basicutil.obj) : error LNK2001: unresolved external symbol __imp___stdio_common_vfprintf sectool.lib(secutil.obj) : error LNK2001: unresolved external symbol __imp___stdio_common_vfprintf sectool.lib(secpwd.obj) : error LNK2001: unresolved external symbol __imp___stdio_common_vfprintf sectool.lib(basicutil.obj) : error LNK2019: unresolved external symbol __imp___stdio_common_vsprintf referenced in function _vsnprintf_l sectool.lib(secutil.obj) : error LNK2001: unresolved external symbol __imp___stdio_common_vsprintf WIN954.0_64_DBG.OBJ/addbuiltin.exe : fatal error LNK1120: 3 unresolved externals make[2]: *** [WIN954.0_64_DBG.OBJ/addbuiltin.exe] Error 2 make[2]: Leaving directory `/c/nss/nss-3.16/nss/cmd/addbuiltin' make[1]: *** [libs] Error 2 make[1]: Leaving directory `/c/nss/nss-3.16/nss/cmd' make: *** [libs] Error 2 I just exported USE_64=1, and then run "make nss_build_all". Is there any wrong on my environment? Thanks! -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Building NSS failed on Mac OS X 10.10 with "unknown warning group '-Wvarargs'"
Hi, I tried to build NSS 3.27.1 [1] on Mac OS X 10.10, but the building ended with the following message: ocsp.c:2200:32: error: unknown warning group '-Wvarargs', ignored [-Werror,-Wunknown-pragmas] #pragma GCC diagnostic ignored "-Wvarargs" ^ 1 error generated. make[2]: *** [Darwin14.1.0_64_OPT.OBJ/ocsp.o] Error 1 make[1]: *** [libs] Error 2 make: *** [libs] Error 2 How to resolve this issue? Thanks! [1] https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_27_1_RTM/src/nss-3.27.1-with-nspr-4.13.tar.gz -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Building NSS failed on Mac OS X 10.10 with "unknown warning group '-Wvarargs'"
Just filed a bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1326368 Additionally, I commented the below line for nss/lib/certhigh/ocsp.c, #pragma GCC diagnostic ignored "-Wvarargs" and tried to build again. The new building finished. Thanks! 2016-12-30 10:43 GMT+08:00 Martin Thomson <m...@mozilla.com>: > Hi John, > > Could you open a bug? > https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS=Libraries > > On Thu, Dec 29, 2016 at 5:19 PM, John Jiang <john.sha.ji...@gmail.com> > wrote: > > Hi, > > I tried to build NSS 3.27.1 [1] on Mac OS X 10.10, but the building ended > > with the following message: > > ocsp.c:2200:32: error: unknown warning group '-Wvarargs', ignored > > [-Werror,-Wunknown-pragmas] > > #pragma GCC diagnostic ignored "-Wvarargs" > >^ > > 1 error generated. > > make[2]: *** [Darwin14.1.0_64_OPT.OBJ/ocsp.o] Error 1 > > make[1]: *** [libs] Error 2 > > make: *** [libs] Error 2 > > > > How to resolve this issue? > > Thanks! > > > > [1] > > https://ftp.mozilla.org/pub/security/nss/releases/NSS_3_ > 27_1_RTM/src/nss-3.27.1-with-nspr-4.13.tar.gz > > -- > > dev-tech-crypto mailing list > > dev-tech-crypto@lists.mozilla.org > > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
How do selfserv and tstclnt specify RSASSA-PSS certificate?
Hi, I'm using NSS 3.37. Tried to specify a RSASSA-PSS certificate for selfserv and tstclnt, but looks no option supports this certificate type: "Must specify at least one certificate nickname using '-n' (RSA), '-S' (DSA), or 'e' (EC)." But it looks the current NSS supports RSASSA-PSS. -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: How do selfserv and tstclnt specify RSASSA-PSS certificate?
Hi Martin, Thanks for your clarification! 2018-05-31 9:52 GMT+08:00 Martin Thomson : > This was a feature we supported, but we have an open item to restore > full PSS support for TLS after some changes in TLS 1.3 reassigned the > meaning of the codepoints. (It's been a few months, and a low > priority item, but it is still on my todo list). Getting selfserv and > tstclnt to use those keys requires the stack to support them fully, > which - right now - it doesn't. > On Thu, May 31, 2018 at 2:31 AM John Jiang > wrote: > > > > Hi, > > I'm using NSS 3.37. > > > > Tried to specify a RSASSA-PSS certificate for selfserv and tstclnt, but > > looks no option supports this certificate type: "Must specify at least > one > > certificate nickname using '-n' (RSA), '-S' (DSA), or 'e' (EC)." > > But it looks the current NSS supports RSASSA-PSS. > > -- > > dev-tech-crypto mailing list > > dev-tech-crypto@lists.mozilla.org > > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
tstclnt request and selfserv response
Hi, Using NSS 3.37 How to take selfserv to send response when it is connected by a client? Can I implement the below case in shell? 1. tstclnt sends specific request to selfserv; 2. and then the selfserv sends specific response to the tstclnt; 3. (Optional) the tstclnt quits automatically after it receives the response. Thanks! -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Building the latest NSS with VS 2013
Hi, I need to build NSS with VS 2013 and MozillaBuild 2.2.0. Just found the building failed on NSS 3.33 and 3.34.1, exactly many libs, like nss3, ssl3, were missing. But the building looked fine on NSS 3.32.1. Does that mean the NSS versions later than 3.32.1 cannot be built with VS2013? Best regards, John Jiang -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Can import multiple certificates with same subject?
Hi, I'm using NSS 3.35. With my testing, it is not allowed to import multiple certificates with same subject and different nicknames to a certificate database via pk12util. I just want to confirm this point. Best regards, John Jiang -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Can import multiple certificates with same subject?
In order to describing my point clearly, please consider the below simple example. 1. Two certificates with same subject (CN=www.example.com) and different nicknames (respectively, example1 and example2). Both of them are in PKCS12 format. 2. Import the certificates to an existing database $ pk12util -i example1.p12 -d sql:exampledb -W 'example1pass' pk12util: PKCS12 IMPORT SUCCESSFU $ pk12util -i example2.p12 -d sql:exampledb -W 'example2pass' pk12util: PKCS12 IMPORT SUCCESSFU 3. List the certificates $ certutil -d sql:exampledb -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI example1 u,u,u example1 u,u,u Only nickname "example1" is listed. 4. Display certificate example1 $ certutil -d sql:exampledb -L -n example1 Here, in deed, certificate example2 is displayed. It looks a bug. Best regards, John Jiang 2018-01-31 13:07 GMT+08:00 John Jiang <john.sha.ji...@gmail.com>: > Hi, > I'm using NSS 3.35. > > With my testing, it is not allowed to import multiple certificates with > same subject and different nicknames to a certificate database via pk12util. > I just want to confirm this point. > > Best regards, > John Jiang > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: How do selfserv and tstclnt support ALPN?
Thanks for the clarification! 2018-02-07 22:43 GMT+08:00 Franziskus Kiefer <fkie...@mozilla.com>: > Hi, > > -Q was added in NSS 3.26 and adds, as described, "ALPN for HTTP/1.1 > [RFC7301]". > There's currently non way to set a custom ALPN. > > Cheers > > On Wed, Feb 7, 2018 at 12:03 PM, John Jiang <john.sha.ji...@gmail.com> > wrote: > > > Hi, > > I'm playing selfserv and tstclnt from a NSS 3.35 build. > > Although selfserv introduces option "-Q" for enabling ALPN, I don't find > > any option to allow selfserv and tstclnt to specify their application > > protocols respectively. > > How to make selfserv and tstclnt to negotiate application protocol? > > Thanks! > > -- > > dev-tech-crypto mailing list > > dev-tech-crypto@lists.mozilla.org > > https://lists.mozilla.org/listinfo/dev-tech-crypto > > > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
selfserv and tstclnt on SNI
Hi, Using NSS 3.35. It looks tstclnt always send SNI extension, even though no option "-a". As for selfserv, I suppose it should have an option for configuring multiple certificates (nicknames) for server side. But I don't find it. In addition, option "-n" means rsa_nickname, but with my testing, it also works with the nicknames for DSA and ECDSA certificates, though such nicknames should use options -S and -e respectively. -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
How do selfserv and tstclnt support ALPN?
Hi, I'm playing selfserv and tstclnt from a NSS 3.35 build. Although selfserv introduces option "-Q" for enabling ALPN, I don't find any option to allow selfserv and tstclnt to specify their application protocols respectively. How to make selfserv and tstclnt to negotiate application protocol? Thanks! -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Building the latest NSS with VS 2013
Any new update on this point? Can I build NSS with VS2017 now? Best regards, John Jiang 2018-01-19 15:41 GMT+08:00 Franziskus Kiefer : > Hi John, > > using MozillaBuild 2.x with VS 2015 should work fine. That's the only > configuration at the moment that works for building NSS unfortunately. > We're working on new build instructions for Windows. But newer MozillaBuild > won't work and older VS version don't work either. > > Cheers, > Franziskus > > On Fri, Jan 19, 2018 at 6:47 AM, John Jiang > wrote: > > > Using VS 2015 and MozillaBuild 2.2.0, the building finished successfully. > > > > In addition, I don't get proper reference for building NSS with VS 2017 > and > > the latest MozillaBuild (3.3.1). > > By default, the last MozillaBuild cannot find VC++ and Windows Kits. It > may > > have to setup some environment variables. > > > > Best regards, > > John Jiang > > > > 2018-01-12 14:21 GMT+08:00 John Jiang : > > > > > Hi, > > > I need to build NSS with VS 2013 and MozillaBuild 2.2.0. > > > > > > Just found the building failed on NSS 3.33 and 3.34.1, exactly many > libs, > > > like nss3, ssl3, were missing. > > > But the building looked fine on NSS 3.32.1. > > > Does that mean the NSS versions later than 3.32.1 cannot be built with > > > VS2013? > > > > > > Best regards, > > > John Jiang > > > > > -- > > dev-tech-crypto mailing list > > dev-tech-crypto@lists.mozilla.org > > https://lists.mozilla.org/listinfo/dev-tech-crypto > > > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Building the latest NSS with VS 2013
Using VS 2015 and MozillaBuild 2.2.0, the building finished successfully. In addition, I don't get proper reference for building NSS with VS 2017 and the latest MozillaBuild (3.3.1). By default, the last MozillaBuild cannot find VC++ and Windows Kits. It may have to setup some environment variables. Best regards, John Jiang 2018-01-12 14:21 GMT+08:00 John Jiang <john.sha.ji...@gmail.com>: > Hi, > I need to build NSS with VS 2013 and MozillaBuild 2.2.0. > > Just found the building failed on NSS 3.33 and 3.34.1, exactly many libs, > like nss3, ssl3, were missing. > But the building looked fine on NSS 3.32.1. > Does that mean the NSS versions later than 3.32.1 cannot be built with > VS2013? > > Best regards, > John Jiang > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
tstclnt on session resumption
Using NSS 3.35 Can tstclnt be used to check session resumption (via session id)? With the tool's usage help, options "-r" and "-u" are related to session resumption. Option "-u" is related to session ticket, howerver I focus on session id, so just option "-r 2" was used in my command. But it looked no session was reused. The output contains the followings, ... 0 cache hits; 1 cache misses, 0 cache not reusable 0 stateless resumes ... I even debugged the traffic via WireShark, but found only one handshake. Did I miss something? Thanks! -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
selfserv on session resumption
Using NSS 3.35 on MacOSX to test session resumption (via session id). If a client connect to a selfserv server with same options many times, the server may not reuse the session. I used a JSSE client to connect the selfserv server twice. In the second connection, the client used the same SSL context that used in the first connection, that means the client reused the session. I repeated the above operation in a loop, and sometimes the session was not reused in a single operation. In single operation, the server side output likes the below: selfserv: SSL version 3.3 using 256-bit AES with 160-bit SHA1 MAC selfserv: Server Auth: 256-bit ECDSA, Key Exchange: 256-bit ECDHE Compression: NULL, Extended Master Secret: No selfserv: subject DN: CN=server selfserv: issuer DN: CN=root selfserv: 0 cache hits; 2 cache misses, 0 cache not reusable 0 stateless resumes, 0 ticket parse failures selfserv: HDX PR_Read hit EOF returned error 0: Undefined error: 0 selfserv: SSL version 3.3 using 256-bit AES with 160-bit SHA1 MAC selfserv: Server Auth: 256-bit ECDSA, Key Exchange: 256-bit ECDHE Compression: NULL, Extended Master Secret: No selfserv: subject DN: CN=server selfserv: issuer DN: CN=root selfserv: 0 cache hits; 2 cache misses, 0 cache not reusable 0 stateless resumes, 0 ticket parse failures selfserv: HDX PR_Read hit EOF returned error 0: Undefined error: 0 In the second connection, no cache was hit. In addition, I also used the same client to connect OpenSSL s_server, but didn't meet this problem. Thanks! -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: selfserv and tstclnt on SNI
Just filed issues: https://bugzilla.mozilla.org/show_bug.cgi?id=1441764 https://bugzilla.mozilla.org/show_bug.cgi?id=1441767 2018-02-13 1:57 GMT+08:00 Franziskus Kiefer <fkie...@mozilla.com>: > Can you file bugs for the issues you found? > > On Fri, Feb 9, 2018 at 1:50 AM, Martin Thomson <m...@mozilla.com> wrote: > > > These sound like simple bugs. Most are probably good first bugs for > > someone looking to contribute. > > > > On Thu, Feb 8, 2018 at 6:13 PM, John Jiang <john.sha.ji...@gmail.com> > > wrote: > > > Hi, > > > Using NSS 3.35. > > > > > > It looks tstclnt always send SNI extension, even though no option "-a". > > > As for selfserv, I suppose it should have an option for configuring > > > multiple certificates (nicknames) for server side. But I don't find it. > > > > > > In addition, option "-n" means rsa_nickname, but with my testing, it > also > > > works with the nicknames for DSA and ECDSA certificates, though such > > > nicknames should use options -S and -e respectively. > > > -- > > > dev-tech-crypto mailing list > > > dev-tech-crypto@lists.mozilla.org > > > https://lists.mozilla.org/listinfo/dev-tech-crypto > > -- > > dev-tech-crypto mailing list > > dev-tech-crypto@lists.mozilla.org > > https://lists.mozilla.org/listinfo/dev-tech-crypto > > > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Debug info on NSS tools
I had read that page. In fact, SSLDEBUG and SSLTRACE were used in my last try. My NSS was built with "BUILD_OPT=0", so I supposed it is a debug build. How can I double-check this point? Thanks! On Sat, Jan 5, 2019 at 12:34 AM Kai Engert wrote: > Does this page help? > You might need a debug build (i.e. build yourself with debugging enabled). > > https://wiki.mozilla.org/NSS:Tracing > > Kai > > On 03.01.19 13:51, John Jiang wrote: > > Just tried it, but looked not work. > > > > $ export SSLDEBUG=1 > > $ export SSLTRACE=127 > > $ tstclnt -v ... > > I didn't get more logs. > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Debug info on NSS tools
Can NSS tools, like selfserv and tstclnt, output debug info? My NSS binary is built with debug mode. I try to enable the debug logs for selfserv and tstclnt, but don't get any useful option. Option -v just outputs a bit more logs. That's not enough for me. I wish the tools can output more details on TLS handshaking. -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Debug info on NSS tools
On Sun, Jan 6, 2019 at 8:56 PM Martin Thomson wrote: > You need to build a debug build with -DDEBUG. Disabling optimization is a > different thing. > What command need option -DDEBUG? > > The default build with build.sh or make nss_build_all should be fine. > I always use `make nss_build_all` to build NSS. Does that mean my build should already be a debug build? Thanks! > > On Sat, 5 Jan. 2019, 11:40 John Jiang > > I had read that page. In fact, SSLDEBUG and SSLTRACE were used in my last > > try. > > My NSS was built with "BUILD_OPT=0", so I supposed it is a debug build. > > How can I double-check this point? > > > > Thanks! > > > > On Sat, Jan 5, 2019 at 12:34 AM Kai Engert wrote: > > > > > Does this page help? > > > You might need a debug build (i.e. build yourself with debugging > > enabled). > > > > > > https://wiki.mozilla.org/NSS:Tracing > > > > > > Kai > > > > > > On 03.01.19 13:51, John Jiang wrote: > > > > Just tried it, but looked not work. > > > > > > > > $ export SSLDEBUG=1 > > > > $ export SSLTRACE=127 > > > > $ tstclnt -v ... > > > > I didn't get more logs. > > > > > -- > > dev-tech-crypto mailing list > > dev-tech-crypto@lists.mozilla.org > > https://lists.mozilla.org/listinfo/dev-tech-crypto > > > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Building NSS 3.40 with VS 2017
NSS 3.40 release note contains "It is easier to build NSS on Windows in mozilla-build environments". Does it mean that I can build NSS with VS 2017 now? I'm following the guide in https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Building, and using MozillaBuild 3.2. But after start MozillaBuild, it looks my installed VS 2017 cannot be identified. Do I still miss something? Thanks! -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Debug info on NSS tools
Just tried it, but looked not work. $ export SSLDEBUG=1 $ export SSLTRACE=127 $ tstclnt -v ... I didn't get more logs. On Thu, Jan 3, 2019 at 3:46 PM Martin Thomson wrote: > Try exporting SSLTRACE=100. > > That might be too much detail, but lower numbers are still useful. I find > that 20-ish gets some fairly useful logging. > > On Thu, Jan 3, 2019 at 6:12 PM John Jiang > wrote: > > > Can NSS tools, like selfserv and tstclnt, output debug info? > > My NSS binary is built with debug mode. > > > > I try to enable the debug logs for selfserv and tstclnt, but don't get > any > > useful option. > > Option -v just outputs a bit more logs. That's not enough for me. > > I wish the tools can output more details on TLS handshaking. > > -- > > dev-tech-crypto mailing list > > dev-tech-crypto@lists.mozilla.org > > https://lists.mozilla.org/listinfo/dev-tech-crypto > > > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Failed building NSS 3.44 on MacOSX
Hi, I tried to build NSS 3.44 on MacOSX 10.13.6 (Darwin Kernel Version 17.7.0). Just run "make nss_build_all" in directory nss-3.44/nss, and got the below errors, mkdir -p ./../nspr/Darwin17.7.0_cc_64_OPT.OBJ cd ./../nspr/Darwin17.7.0_cc_64_OPT.OBJ ; \ CC="cc x86_64" CXX="g++ x86_64" sh ../configure \ --disable-debug --enable-optimize --enable-64bit \ --with-dist-prefix='path/to/nss-3.44/nss/../dist/Darwin17.7.0_cc_64_OPT.OBJ' \ --with-dist-includedir='path/to/nss-3.44/nss/../dist/Darwin17.7.0_cc_64_OPT.OBJ/include' checking build system type... x86_64-apple-darwin17.7.0 checking host system type... x86_64-apple-darwin17.7.0 checking target system type... x86_64-apple-darwin17.7.0 checking for whoami... /usr/bin/whoami checking for gcc... cc x86_64 checking whether the C compiler works... no configure: error: in `path/to/nss-3.44/nspr/Darwin17.7.0_cc_64_OPT.OBJ': configure: error: C compiler cannot create executables See `config.log' for more details make: *** [../nspr/Darwin17.7.0_cc_64_OPT.OBJ/config.status] Error 77 but on the same machine, I didn't get any trouble when building NSS 3.43. -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: Failed building NSS 3.44 on MacOSX
Hi Martin,
Thanks for your reply!
On Wed, Jun 26, 2019 at 8:58 AM Martin Thomson wrote:
> I had trouble myself, but it turns out that even if you are all up to date,
> XCode isn't upgraded. The error I get is the result of XCode being out of
> date.
>
> Confirm by looking for a config.log in the NSPR directory. If it contains
> a message like the one below, the outdated XCode is the problem.
>
> configure:: gccconftest.c >&5
> ld: malformed
> file/Library/Developer/CommandLineTools/SDKs/MacOSX10.14.sdk/usr/lib/libSystem.tbd:4:18:
> error: unknown enumerated scalar
> platform:zippered
> ^~~~
> file
> '/Library/Developer/CommandLineTools/SDKs/MacOSX10.14.sdk/usr/lib/libSystem.tbd'
> clang: error: linker command failed with exit code 1 (use -v to see
> invocation)
>
I don't find such stuff in my config.log.
My config.log contains the following lines,
==
configure:3466: checking for C compiler version
configure:3475: cc x86_64 --version >&5
Apple LLVM version 10.0.0 (clang-1000.10.44.4)
Target: x86_64-apple-darwin17.7.0
Thread model: posix
InstalledDir: /Library/Developer/CommandLineTools/usr/bin
configure:3486: $? = 0
configure:3475: cc x86_64 -v >&5
Apple LLVM version 10.0.0 (clang-1000.10.44.4)
Target: x86_64-apple-darwin17.7.0
Thread model: posix
InstalledDir: /Library/Developer/CommandLineTools/usr/bin
clang: error: no such file or directory: 'x86_64'
configure:3486: $? = 1
configure:3475: cc x86_64 -V >&5
clang: error: argument to '-V' is missing (expected 1 value)
clang: error: no such file or directory: 'x86_64'
clang: error: no input files
configure:3486: $? = 1
configure:3475: cc x86_64 -qversion >&5
clang: error: unknown argument: '-qversion'
clang: error: no such file or directory: 'x86_64'
clang: error: no input files
configure:3486: $? = 1
configure:3506: checking whether the C compiler works
configure:3528: cc x86_64conftest.c >&5
clang: error: no such file or directory: 'x86_64'
configure:3532: $? = 1
configure:3570: result: no
configure: failed program was:
| /* confdefs.h */
| #define PACKAGE_NAME ""
| #define PACKAGE_TARNAME ""
| #define PACKAGE_VERSION ""
| #define PACKAGE_STRING ""
| #define PACKAGE_BUGREPORT ""
| #define PACKAGE_URL ""
| #define DEBUG 1
| /* end confdefs.h. */
|
| int
| main ()
| {
|
| ;
| return 0;
| }
configure:3575: error: in
`/Users/sha.jiang/work/software/nss/nss-3.44/nspr/Darwin17.7.0_cc_64_DBG.OBJ':
configure:3577: error: C compiler cannot create executables
See `config.log' for more details
==
I also checked the config.log for NSS 3.43, it looks cc doesn't use option
"x86_64".
Thanks!
>
> On Sun, Jun 23, 2019 at 6:27 PM John Jiang
> wrote:
>
> > Hi,
> > I tried to build NSS 3.44 on MacOSX 10.13.6 (Darwin Kernel Version
> 17.7.0).
> > Just run "make nss_build_all" in directory nss-3.44/nss, and got the
> below
> > errors,
> > mkdir -p ./../nspr/Darwin17.7.0_cc_64_OPT.OBJ
> > cd ./../nspr/Darwin17.7.0_cc_64_OPT.OBJ ; \
> > CC="cc x86_64" CXX="g++ x86_64" sh ../configure \
> > --disable-debug --enable-optimize --enable-64bit \
> >
> >
> --with-dist-prefix='path/to/nss-3.44/nss/../dist/Darwin17.7.0_cc_64_OPT.OBJ'
> > \
> >
> >
> --with-dist-includedir='path/to/nss-3.44/nss/../dist/Darwin17.7.0_cc_64_OPT.OBJ/include'
> > checking build system type... x86_64-apple-darwin17.7.0
> > checking host system type... x86_64-apple-darwin17.7.0
> > checking target system type... x86_64-apple-darwin17.7.0
> > checking for whoami... /usr/bin/whoami
> > checking for gcc... cc x86_64
> > checking whether the C compiler works... no
> > configure: error: in `path/to/nss-3.44/nspr/Darwin17.7.0_cc_64_OPT.OBJ':
> > configure: error: C compiler cannot create executables
> > See `config.log' for more details
> > make: *** [../nspr/Darwin17.7.0_cc_64_OPT.OBJ/config.status] Error 77
> >
> > but on the same machine, I didn't get any trouble when building NSS 3.43.
> > --
> > dev-tech-crypto mailing list
> > dev-tech-crypto@lists.mozilla.org
> > https://lists.mozilla.org/listinfo/dev-tech-crypto
> >
> --
> dev-tech-crypto mailing list
> dev-tech-crypto@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-tech-crypto
>
--
dev-tech-crypto mailing list
dev-tech-crypto@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-tech-crypto
Re: NSS 3.45 building hang on windows
On Sat, Aug 31, 2019 at 12:40 AM JC Jones wrote: > On Thursday, August 29, 2019 at 7:31:46 PM UTC-7, John Jiang wrote: > > Hi, > > When I build NSS 3.45 on windows 2016 with VS2017, it hung at "cd freebl; > > make export". > > > > The followings are the last outputs in the console, > > ... ... > > make[1]: Entering directory `/path/to/nss-3.45/nss/lib' > > cd util; make export > > make[2]: Entering directory `/path/to/nss-3.45/nss/lib/util' > > Creating ../../../dist/public/nss > > nsinstall -m 444 base64.h ciferfam.h eccutil.h hasht.h nssb64.h nssb64t.h > > nsslocks.h nssilock.h nssilckt.h nssrwlk.h nssrwlkt.h nssutil.h pkcs11.h > > pkcs11f.h pkcs11p.h pkcs11t.h pkcs11n.h pkcs11u.h pkcs1sig.h portreg.h > > secasn1.h secasn1t.h seccomon.h secder.h secdert.h secdig.h secdigt.h > > secitem.h secoid.h secoidt.h secport.h secerr.h utilmodt.h utilrename.h > > utilpars.h utilparst.h pkcs11uri.h ../../../dist/public/nss > > Creating ../../../dist/private/nss > > nsinstall -m 444 verref.h templates.c ../../../dist/private/nss > > make[2]: Leaving directory `/path/to/nss-3.45/nss/lib/util' > > cd freebl; make export > > > > Is it a known issue? Or should I do something? > > > > I didn't meet any problem when building NSS 3.44 on the same environment. > > > > Thanks! > > I believe this is the same as bug 1565577, which is fixed in NSS 3.46, > being released later today. (stay tuned) > Version 3.46 works for me. Thanks! > -- > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto > -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
NSS 3.45 building hang on windows
Hi, When I build NSS 3.45 on windows 2016 with VS2017, it hung at "cd freebl; make export". The followings are the last outputs in the console, ... ... make[1]: Entering directory `/path/to/nss-3.45/nss/lib' cd util; make export make[2]: Entering directory `/path/to/nss-3.45/nss/lib/util' Creating ../../../dist/public/nss nsinstall -m 444 base64.h ciferfam.h eccutil.h hasht.h nssb64.h nssb64t.h nsslocks.h nssilock.h nssilckt.h nssrwlk.h nssrwlkt.h nssutil.h pkcs11.h pkcs11f.h pkcs11p.h pkcs11t.h pkcs11n.h pkcs11u.h pkcs1sig.h portreg.h secasn1.h secasn1t.h seccomon.h secder.h secdert.h secdig.h secdigt.h secitem.h secoid.h secoidt.h secport.h secerr.h utilmodt.h utilrename.h utilpars.h utilparst.h pkcs11uri.h ../../../dist/public/nss Creating ../../../dist/private/nss nsinstall -m 444 verref.h templates.c ../../../dist/private/nss make[2]: Leaving directory `/path/to/nss-3.45/nss/lib/util' cd freebl; make export Is it a known issue? Or should I do something? I didn't meet any problem when building NSS 3.44 on the same environment. Thanks! -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
