Commit 6a22f595 authored by Kathleen Brade's avatar Kathleen Brade Committed by Mike Perry
Browse files

Bug 13379: Sign our MAR files. 

Configure with --enable-signmar (build the signmar tool).
Configure with --enable-verify-mar (when updating, require a valid signature
  on the MAR file before it is applied).
Use the Tor Browser version instead of the Firefox version inside the
  MAR file info block (necessary to prevent downgrade attacks).
Use NSS on all platforms for checking MAR signatures (Mozilla plans to use
  OS-native APIs on Mac OS and they already do so on Windows).  So that the
  NSS and NSPR libraries the updater depends on can be found at runtime, we
  add the firefox directory to the shared library search path on all platforms.
Use SHA512-based MAR signatures instead of the SHA1-based ones that Mozilla
  uses.  This is implemented inside MAR_USE_SHA512_RSA_SIG #ifdef's and with
  a signature algorithm ID of 512 to help avoid collisions with future work
  Mozilla might do in this area.
  See: https://bugzilla.mozilla.org/show_bug.cgi?id=1105689
parent 368924d1

.mozconfig

+2 −2
Original line number Diff line number Diff line
@@ -11,8 +11,8 @@ ac_add_options --enable-optimize 
ac_add_options --enable-official-branding

ac_add_options --enable-tor-browser-update

ac_add_options --enable-update-packaging

# We do not use signed MAR files yet (Mozilla uses them on Windows only).

ac_add_options --disable-verify-mar

ac_add_options --enable-signmar

ac_add_options --enable-verify-mar

ac_add_options --disable-strip

ac_add_options --disable-install-strip

ac_add_options --disable-tests

.mozconfig-mac

+2 −2
Original line number Diff line number Diff line
@@ -38,8 +38,8 @@ ac_add_options --disable-debug 


ac_add_options --enable-tor-browser-update

ac_add_options --enable-update-packaging

# We do not use signed MAR files yet (Mozilla uses them on Windows only).

ac_add_options --disable-verify-mar

ac_add_options --enable-signmar

ac_add_options --enable-verify-mar



# ICU seems still to have cross-compiling issues:

ac_add_options --without-intl-api

.mozconfig-mingw

+2 −2
Original line number Diff line number Diff line
@@ -16,8 +16,8 @@ ac_add_options --enable-strip 
ac_add_options --enable-official-branding

ac_add_options --enable-tor-browser-update

ac_add_options --enable-update-packaging

# We do not use signed MAR files yet (Mozilla uses them on Windows only).

ac_add_options --disable-verify-mar

ac_add_options --enable-signmar

ac_add_options --enable-verify-mar



# ICU seems still to have cross-compiling issues:

# https://bugzilla.mozilla.org/show_bug.cgi?id=1019744#c19

modules/libmar/sign/mar_sign.c

+12 −3
Original line number Diff line number Diff line
@@ -95,7 +95,12 @@ NSSSignBegin(const char *certName, 
    return -1;

  }



  *ctx = SGN_NewContext (SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE, *privKey);

#ifdef MAR_USE_SHA512_RSA_SIG

  SECOidTag sigAlg = SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION;

#else

  SECOidTag sigAlg = SEC_OID_ISO_SHA1_WITH_RSA_SIGNATURE;

#endif

  *ctx = SGN_NewContext (sigAlg, *privKey);

  if (!*ctx) {

    fprintf(stderr, "ERROR: Could not create signature context\n");

    return -1;
@@ -991,8 +996,12 @@ mar_repackage_and_sign(const char *NSSConfigDir, 
  signaturePlaceholderOffset = ftello(fpDest);



  for (k = 0; k < certCount; k++) {

    /* Write out the signature algorithm ID, Only an ID of 1 is supported */

    signatureAlgorithmID = htonl(1);

    /* Write out the signature algorithm ID. */

#ifdef MAR_USE_SHA512_RSA_SIG

    signatureAlgorithmID = htonl(SIGNATURE_ALGORITHM_ID_SHA512_RSA);

#else

    signatureAlgorithmID = htonl(SIGNATURE_ALGORITHM_ID_SHA1_RSA);

#endif

    if (WriteAndUpdateSignatures(fpDest, &signatureAlgorithmID,

                                 sizeof(signatureAlgorithmID),

                                 ctxs, certCount, "num signatures")) {

modules/libmar/sign/moz.build

+1 −0
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ LOCAL_INCLUDES += [ 
]



DEFINES['MAR_NSS'] = True

DEFINES['MAR_USE_SHA512_RSA_SIG'] = True



if CONFIG['OS_ARCH'] == 'WINNT':

    USE_STATIC_LIBS = True