Windows performs certificate revocation checks (CRL) during signature
verification. When the revocation endpoints listed in a certificate are
unreachable or respond slowly, the revocation checking logic issues
blocking network requests and waits for connection timeouts, which can
introduce multi‑second delays for each certificate in the chain.
Add a configuration option to disable CRL checking. The signature is
still validated against the certificate itself, preserving security
while improving performance in restricted environments.
Change-Id: I83e76556b8bd37d6b0b2fda4bb676ebd10580b38
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/197516
Reviewed-by: Nagy Tibor <tibor.nagy@collabora.com>
Tested-by: Jenkins
Converted plain enums to enum class for better type safety:
- xmlreader: Converted two local Space enums to enum class and removed
redundant SPACE_ prefix from enum values (NONE, SPAN, BREAK, START)
- xmlsecurity: Converted EqualMode enum to enum class
- xmlsecurity: Converted local State enum in CompatDNCryptoAPI to enum class
Updated all usages across 8 files to use scoped enum syntax.
Change-Id: I27fd7280bccad72a43cda3b669b1f0926c34271c
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196207
Tested-by: Jenkins
Reviewed-by: Hossein <hossein@libreoffice.org>
After recent commit 851fb75779
recheck these directories in include/ again
to test drive the new --headersfwd mode of bin/find-unneeded-includes
Change-Id: I0ede437c4f9958cd98210ed1760a5b98ea8bd1ad
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192377
Tested-by: Jenkins
Reviewed-by: Gabor Kelemen <gabor.kelemen@collabora.com>
commit e3b5e3aebc
Date: Wed Apr 23 13:38:50 2025 +0200
libxml2: upgrade to 2.14.3
* In https://gitlab.gnome.org/GNOME/libxml2/-/commit/712a31abe458eed75f0e2a442b35af58cf7091ca
some members used by Libreoffice were marked as deprecated.
Add deprecated.patch.0 to undeprecate them for now.
Meanwhile
https://gitlab.gnome.org/GNOME/libxml2/-/issues/936#note_2461334 has been
opened to discuss it. The necessary code changes
will be addressed in a follow-up commit
[...]
added a patch to ignore deprecated symbols in
the internal libxml2, by undeprecating the symbols for
that version.
Drop that patch again and instead let compilers ignore
the deprecation warnings for now, to also make the --enable-werror
build pass for the (default) system libxml2 used e.g. on
Debian testing (which currently provides 2.14.5+dfsg-0.2).
Build failure seen there otherwise:
/home/michi/development/git/libreoffice/xmlsecurity/source/xmlsec/saxhelper.cxx:162:24: error: 'recovery' is deprecated [-Werror,-Wdeprecated-declarations]
162 | m_pParserCtxt->recovery = 1 ;
| ^
/usr/include/libxml2/libxml/parser.h:377:18: note: 'recovery' has been explicitly marked deprecated here
377 | int recovery XML_DEPRECATED_MEMBER;
| ^
/usr/include/libxml2/libxml/xmlexports.h:74:50: note: expanded from macro 'XML_DEPRECATED_MEMBER'
74 | #define XML_DEPRECATED_MEMBER __attribute__((deprecated))
| ^
/home/michi/development/git/libreoffice/xmlsecurity/source/xmlsec/saxhelper.cxx:209:20: error: 'nodeTab' is deprecated [-Werror,-Wdeprecated-declarations]
209 | m_pParserCtxt->nodeTab[m_pParserCtxt->nodeNr - 1]
| ^
/usr/include/libxml2/libxml/parser.h:284:25: note: 'nodeTab' has been explicitly marked deprecated here
284 | xmlNodePtr *nodeTab XML_DEPRECATED_MEMBER;
| ^
/usr/include/libxml2/libxml/xmlexports.h:74:50: note: expanded from macro 'XML_DEPRECATED_MEMBER'
74 | #define XML_DEPRECATED_MEMBER __attribute__((deprecated))
| ^
/home/michi/development/git/libreoffice/xmlsecurity/source/xmlsec/saxhelper.cxx:209:43: error: 'nodeNr' is deprecated [-Werror,-Wdeprecated-declarations]
209 | m_pParserCtxt->nodeTab[m_pParserCtxt->nodeNr - 1]
| ^
/usr/include/libxml2/libxml/parser.h:280:16: note: 'nodeNr' has been explicitly marked deprecated here
280 | int nodeNr XML_DEPRECATED_MEMBER;
| ^
/usr/include/libxml2/libxml/xmlexports.h:74:50: note: expanded from macro 'XML_DEPRECATED_MEMBER'
74 | #define XML_DEPRECATED_MEMBER __attribute__((deprecated))
| ^
/home/michi/development/git/libreoffice/xmlsecurity/source/xmlsec/saxhelper.cxx:229:62: error: 'inputMax' is deprecated [-Werror,-Wdeprecated-declarations]
229 | if( m_pParserCtxt->inputTab != nullptr && m_pParserCtxt->inputMax != 0 )
| ^
/usr/include/libxml2/libxml/parser.h:271:18: note: 'inputMax' has been explicitly marked deprecated here
271 | int inputMax XML_DEPRECATED_MEMBER;
| ^
/usr/include/libxml2/libxml/xmlexports.h:74:50: note: expanded from macro 'XML_DEPRECATED_MEMBER'
74 | #define XML_DEPRECATED_MEMBER __attribute__((deprecated))
| ^
4 errors generated.
make[1]: *** [/home/michi/development/git/libreoffice/solenv/gbuild/LinkTarget.mk:338: /home/michi/development/git/libreoffice/workdir/CxxObject/xmlsecurity/source/xmlsec/saxhelper.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:301: build] Error 2
Change-Id: I1124859c0ef766b73f506dd997d89543ccf6eb12
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/190668
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
Tested-by: Jenkins
Previously, WindowsErrorString and WindowsErrorStringFromHRESULT were
defined in an anonymous namespace in windowserrorstring.hxx, which:
1. Made them unavailable to other translation units
2. Violate ODR by creating separate copies in each TU
3. Require workarounds to access them
Changes:
- Move functions to proper comphelper namespace
- Keep implementations inline as they're simple utilities
- Preserve all existing functionality
- Update all call sites to use comphelper:: prefix
This change enables proper use of these utilities across LibreOffice
while maintaining current behavior and performance characteristics.
Introduced in this commit:
commit 94cdcaa4d8
Author: Tor Lillqvist <tml@collabora.com>
Date: Thu Aug 13 13:22:28 2015 +0300
Add a globally usable WindowsErrorString function
Change-Id: I34df1c2b1f30c6204f107ca4792131d692203880
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/183332
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
Tested-by: Jenkins
See commit 1817760f56 (tdf#161872
xmlsecurity nss: don't require trusted signing certs, 2025-01-28), this
is the same situation, but this time on Windows.
Change-Id: I945899da47ab5dcc421f35db31ec7af240c59b8c
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/180881
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins
Configure your signing cert in Firefox, (unusually) don't trust the CA
that you would use to issue your signing cert, try to sign a document,
error.
This is reportedly wrong since commit
bfd479abf0 (Update libxmlsec to 1.3.1,
2023-06-09), for some reason our usage of libxmlsec-1.2 didn't trigger
this problem.
Given that we already disable libxmlsec-side cert verify while
verifying a signature (and have our own logic there), it's consistent to
do the same while creating the signature, and that fixes the bug, too.
The Windows / MSCNG backend is not yet changed here.
Change-Id: I8a7adf06b9a26731f1a180a4f6257317084e414a
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/180844
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
we can just take a "const &".
(found by running clang-tidy with the
performance-unnecessary-copy-initialization warning)
Change-Id: I20fd208c65303da78170b1ac06c638fdf3aa094b
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/176267
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
Tested-by: Jenkins
Once the signing key is taken from the matching SfxViewShell (not yet
done), signing with a certificate specified via initializeForRendering()
failed with:
warn:xmlsecurity.xmlsec:13020:13005:xmlsecurity/source/xmlsec/nss/x509certificate_nssimpl.cxx:330: X509Certificate_NssImpl::getPrivateKey() cannot find private key
warn:xmlsecurity.xmlsec:13020:13005:xmlsecurity/source/xmlsec/nss/securityenvironment_nssimpl.cxx:812: Can't get the private key from the certificate.
warn:xmlsecurity.xmlsec:13020:13005:xmlsecurity/source/xmlsec/errorcallback.cxx:53: keys.c:1347: xmlSecKeysMngrGetKey() '' '' 45 'details=NULL'
warn:xmlsecurity.xmlsec:13020:13005:xmlsecurity/source/xmlsec/errorcallback.cxx:53: xmldsig.c:822: xmlSecDSigCtxProcessKeyInfoNode() '' '' 45 'details=NULL'
warn:xmlsecurity.xmlsec:13020:13005:xmlsecurity/source/xmlsec/errorcallback.cxx:53: xmldsig.c:537: xmlSecDSigCtxProcessSignatureNode() '' 'xmlSecDSigCtxProcessKeyInfoNode' 1 ' '
warn:xmlsecurity.xmlsec:13020:13005:xmlsecurity/source/xmlsec/errorcallback.cxx:53: xmldsig.c:301: xmlSecDSigCtxSign() '' 'xmlSecDSigCtxProcessSignatureNode' 1 ' '
The trouble was that we wanted to keep the private key in-memory,
presumably because initially the whole NSS database was in-memory for
the LOK case. This was changed in commit
87eec1b90b (NSS: create a temporary
database instead of in-memory, 2018-12-31), so there is no problem with
a not-in-memory private key anymore.
Note that the problematic codepath was only triggered when first the
certificate chooser was ran and only then we signed. So the testcase
also gets the cert flags before signing, otherwise the test would
succeed even without the fix.
Change-Id: I5086b205c91b630ddd343c0eb91bd9e63b3ea238
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/173892
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins
When selecting a X.509 cert on Unix/Linux/macOS. (ODF+PDF signing)
Helps the user to know which password is requested.
Previously only asked for the "NSS Certificate DB" password.
Change-Id: Ic44d3c4b2f98185c07b11f9880d64016aa0b60ca
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171641
Tested-by: Jenkins
Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
Seeing as since:
commit e9531b792d
Date: Tue Feb 6 14:39:47 2024 +0100
sal: rtlRandomPool: require OS random device, abort if not present
Both rtl_random_createPool() and rtl_random_getBytes() first try to get
random data from the OS, via /dev/urandom or rand_s() (documented to
call RtlGenRandom(), see [1]).
we don't use the initial arg to rtl_random_getBytes anymore, drop the
requirement to have one. Then simplify our usages of that, and
addtionally deprecate rtl_random_createPool and rtl_random_destroyPool.
Change-Id: I13dcc067714a8a741a4e8f2bfcf2006373f832c4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167067
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
what I'm really after is some vexating not-reproducible oss-fuzz msan
warnings when using libxml2 in the fodt2pdf fuzzer. So lets upgrade
libxml2 to the latest, which requires bumping libxslt, and then requires
a newer liblangtag because of no longer implicit includes that it
depended on.
xmlKeepBlanksDefaultValue and xmlSubstituteEntitiesDefault are
deprecated, we should get around to updating those uses
Change-Id: I8fda0dffda0a7ea65407d246a3121875cb8ad4a4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161598
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
With PCH, the earlier workaround with NSS_PKCS11_2_0_COMPAT breaks -
so lets fix this with conditionals, its only two places.
Follow-up commit to 9276d5338e
Change-Id: I7d3292304d83d784ee9dce5cdc62b4a028ff333a
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161204
Tested-by: Jenkins
Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
... and use it in the new experimental ODF encryption mode.
https://www.w3.org/TR/xmlenc-core1/#sec-AES-GCM
Unfortunately it turned out that NSS PK11_CipherOp() does not work with
CKM_AES_GCM because it is initialized with "context->multi = PR_FALSE"
in sftk_CryptInit(), so the one-step functions PK11_Encrypt() and
PK11_Decrypt() have to be used.
NSS 3.52 also changed a parameter struct definition - see
https://fedoraproject.org/wiki/Changes/NssGCMParams - which is not a
problem for RHEL or SUSE system NSS since those are rebased, but it
is likely a problem for less well maintained Ubuntu LTS, so use
the old struct definition which evidently still works with NSS 3.94.
NSS 3.52 also added a new PK11_AEADOp() API but it looks like this
doesn't support incremental encryption either.
Change-Id: Ibd4a672db74b65b1218926ba35ff8d2f70444c7e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/160505
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
Missed a special case in previous commit, in case the input is
completely empty and PK11_DigestFinal() doesn't see a problem with it,
aResult could be empty too.
Change-Id: I8ea900774ae390857307ec5bab38876bead6bc86
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/160441
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
If this function returns null, storing a document will proceed without
reporting an error to the user, and lose all the data.
Change-Id: I0f9fd53702321e7997b28e12eb5bed3349bbcc13
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/160435
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
new plugin to look for class fields that are always cast to some
subtype, which indicates that they should probably just be declared to
be that subtype.
Perform one of the suggested improvements in xmlsecurity/
Change-Id: Ia68df422c37f05cbcf9c02ba5d0853f8eca4f120
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159063
Tested-by: Jenkins
Reviewed-by: Noel Grandin <noel.grandin@collabora.co.uk>
...in include files. This is a mix of automatic rewriting in include files and
manual fixups (mostly addressing loplugin:redundantfcast) in source files that
include those.
Change-Id: I1f3cc1e67b9cabd2e9d61a4d9e9a01e587ea35cc
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158337
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
As a complementer to clang-tidy-12 --checks="-*,misc-unused-using-decls"
Pros:
- simple, fast!
- finds some more unused declarations, somehow
- works on non-linux specific parts of the code
- clang-tidy (for me) trips on files with external headers, this does not
Change-Id: If2db989114ac5c2841ed2e89ff7bd7a9e419f567
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150612
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Andrea Gelmini