rpms
/
nss
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Incorporate some upstream review suggestions

This commit is contained in:
Elio Maldonado 2016-07-12 14:54:51 -07:00
parent 91a8b7f9ac
commit da7272436c
2 changed files with 66 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
nss-check-policy-file.patch
View File

@ -1,7 +1,6 @@
diff --git a/lib/nss/config.mk b/lib/nss/config.mk
--- a/lib/nss/config.mk
+++ b/lib/nss/config.mk
@@ -95,8 +95,12 @@ SHARED_LIBRARY_DIRS = \
--- ./lib/nss/config.mk.check_policy_file 2016-07-12 09:11:01.198867052 -0700
+++ ./lib/nss/config.mk 2016-07-12 09:15:58.739946540 -0700
@@ -99,8 +99,15 @@
ifeq (,$(filter-out WINNT WIN95,$(OS_TARGET)))
ifndef NS_USE_GCC
# Export 'mktemp' to be backward compatible with NSS 3.2.x and 3.3.x
@ -12,12 +11,14 @@ diff --git a/lib/nss/config.mk b/lib/nss/config.mk
endif
+
+ifdef POLICY_FILE
+ifndef POLICY_PATH
+$(error You must define POLICY_PATH if you set POLICY_FILE)
+endif
+DEFINES += -DPOLICY_FILE=\"$(POLICY_FILE)\" -DPOLICY_PATH=\"$(POLICY_PATH)\"
+endif
diff --git a/lib/nss/nssinit.c b/lib/nss/nssinit.c
--- a/lib/nss/nssinit.c
+++ b/lib/nss/nssinit.c
@@ -330,47 +330,47 @@ nss_FindExternalRoot(const char *dbpath,
--- ./lib/nss/nssinit.c.check_policy_file 2016-06-20 10:11:28.000000000 -0700
+++ ./lib/nss/nssinit.c 2016-07-12 09:18:14.821671331 -0700
@@ -330,47 +330,47 @@
/*
* see nss_Init for definitions of the various options.
@ -69,7 +70,7 @@ diff --git a/lib/nss/nssinit.c b/lib/nss/nssinit.c
lconfigdir = NSSUTIL_DoubleEscape(configdir, '\'', '\"');
if (lconfigdir == NULL) {
goto loser;
@@ -427,24 +427,26 @@ loser:
@@ -427,24 +427,24 @@
if (lsecmodName) PORT_Free(lsecmodName);
if (lupdateDir) PORT_Free(lupdateDir);
if (lupdCertPrefix) PORT_Free(lupdCertPrefix);
@ -79,15 +80,13 @@ diff --git a/lib/nss/nssinit.c b/lib/nss/nssinit.c
if (moduleSpec) {
- SECMODModule *module = SECMOD_LoadModule(moduleSpec,NULL,PR_TRUE);
+ module = SECMOD_LoadModule(moduleSpec,NULL,PR_TRUE);
+ module = SECMOD_LoadModule(moduleSpec, NULL, PR_TRUE);
PR_smprintf_free(moduleSpec);
if (module) {
- if (module) {
- if (module->loaded) rv=SECSuccess;
- SECMOD_DestroyModule(module);
+ if (!module->loaded) {
+ SECMOD_DestroyModule(module);
+ module = NULL;
+ }
+ if (module && !module->loaded) {
SECMOD_DestroyModule(module);
+ return NULL;
}
}
- return rv;
@ -100,10 +99,23 @@ diff --git a/lib/nss/nssinit.c b/lib/nss/nssinit.c
* configdir - base directory where all the cert, key, and module datbases live.
* certPrefix - prefix added to the beginning of the cert database example: "
* "https-server1-"
@@ -520,17 +522,17 @@ nss_Init(const char *configdir, const ch
@@ -509,41 +509,44 @@
return PR_FAILURE;
}
return PR_SUCCESS;
}
static SECStatus
nss_Init(const char *configdir, const char *certPrefix, const char *keyPrefix,
- const char *secmodName, const char *updateDir,
+ const char *secmodName, const char *updateDir,
const char *updCertPrefix, const char *updKeyPrefix,
const char *updateID, const char *updateName,
NSSInitContext ** initContextPtr,
NSSInitParameters *initParams,
PRBool readOnly, PRBool noCertDB,
- PRBool readOnly, PRBool noCertDB,
+ PRBool readOnly, PRBool noCertDB,
PRBool noModDB, PRBool forceOpen, PRBool noRootInit,
PRBool optimizeSpace, PRBool noSingleThreadedModules,
PRBool allowAlreadyInitializedModules,
@ -117,9 +129,26 @@ diff --git a/lib/nss/nssinit.c b/lib/nss/nssinit.c
char *configStrings = NULL;
char *configName = NULL;
PRBool passwordRequired = PR_FALSE;
+#ifdef POLICY_FILE
+ char *ignoreVar;
+#endif
/* if we are trying to init with a traditional NSS_Init call, maintain
@@ -630,23 +632,23 @@ nss_Init(const char *configdir, const ch
* the traditional idempotent behavior. */
if (!initContextPtr && nssIsInitted) {
return SECSuccess;
}
-
+
/* make sure our lock and condition variable are initialized one and only
* one time */
if (PR_CallOnce(&nssInitOnce, nss_doLockInit) != PR_SUCCESS) {
return SECFailure;
}
/*
* if we haven't done basic initialization, single thread the
@@ -630,23 +633,23 @@
configStrings = pk11_config_strings;
configName = pk11_config_name;
passwordRequired = pk11_password_required;
@ -129,10 +158,12 @@ diff --git a/lib/nss/nssinit.c b/lib/nss/nssinit.c
* to init with noCertDB and noModDB */
if (!(isReallyInitted && noCertDB && noModDB)) {
- rv = nss_InitModules(configdir, certPrefix, keyPrefix, secmodName,
- updateDir, updCertPrefix, updKeyPrefix, updateID,
+ parent = nss_InitModules(configdir, certPrefix, keyPrefix, secmodName,
updateDir, updCertPrefix, updKeyPrefix, updateID,
+ updateDir, updCertPrefix, updKeyPrefix, updateID,
updateName, configName, configStrings, passwordRequired,
readOnly, noCertDB, noModDB, forceOpen, optimizeSpace,
- readOnly, noCertDB, noModDB, forceOpen, optimizeSpace,
+ readOnly, noCertDB, noModDB, forceOpen, optimizeSpace,
(initContextPtr != NULL));
- if (rv != SECSuccess) {
@ -145,7 +176,7 @@ diff --git a/lib/nss/nssinit.c b/lib/nss/nssinit.c
/* finish up initialization */
if (!isReallyInitted) {
if (SECOID_Init() != SECSuccess) {
@@ -675,17 +677,34 @@ nss_Init(const char *configdir, const ch
@@ -675,17 +678,40 @@
* path. Skip it */
dbpath = NULL;
}
@ -156,14 +187,19 @@ diff --git a/lib/nss/nssinit.c b/lib/nss/nssinit.c
}
-
+#ifdef POLICY_FILE
+ if (PR_Access(POLICY_PATH "/" POLICY_FILE, PR_ACCESS_READ_OK) == PR_SUCCESS ) {
+ /* Load the system crypto policy file if it exists,
+ * unless the NSS_IGNORE_SYSTEM_POLICY environment
+ * variable has been set to 1. */
+ ignoreVar = PR_GetEnvSecure("NSS_IGNORE_SYSTEM_POLICY");
+ if (ignoreVar == NULL || strncmp(ignoreVar, "1", sizeof("1")) != 0) {
+ if (PR_Access(POLICY_PATH "/" POLICY_FILE, PR_ACCESS_READ_OK) == PR_SUCCESS) {
+ SECMODModule *module = SECMOD_LoadModule(
+ "name=\"Policy File\" "
+ "parameters=\"configdir='sql:" POLICY_PATH "' "
+ "secmod='" POLICY_FILE "' "
+ "flags=readOnly,noCertDB,forceSecmodChoice,forceOpen\" "
+ "NSS=\"flags=internal,moduleDB,skipFirst,moduleDBOnly,critical\"",
+ parent, PR_TRUE);
+ parent, PR_TRUE);
+ if (module) {
+ PRBool isLoaded = module->loaded;
+ SECMOD_DestroyModule(module);
@ -172,6 +208,7 @@ diff --git a/lib/nss/nssinit.c b/lib/nss/nssinit.c
+ }
+ }
+ }
+ }
+#endif
pk11sdr_Init();
cert_CreateSubjectKeyIDHashTable();
@ -181,7 +218,7 @@ diff --git a/lib/nss/nssinit.c b/lib/nss/nssinit.c
PKIX_MINOR_VERSION, &actualMinorVersion, &plContext);
if (pkixError != NULL) {
@@ -716,32 +735,38 @@ nss_Init(const char *configdir, const ch
@@ -716,32 +742,38 @@
nssIsInInit--;
/* now that we are inited, all waiters can move forward */
PZ_NotifyAllCondVar(nssInitCondition);

8
nss.spec
View File

@ -183,7 +183,6 @@ low level services.
%patch58 -p0 -b .1185708_3des
pushd nss
%patch59 -p1 -b .check_policy_file
%patch60 -p1 -b .cond_ignore
%patch62 -p0 -b .skip_util_gtest
%patch70 -p1 -b .skip_ecperf
%patch71 -p1 -b .do_queries
@ -233,7 +232,7 @@ FREEBL_NO_DEPEND=1
export FREEBL_NO_DEPEND
# Enable compiler optimizations and disable debugging code
export BUILD_OPT=1
#export BUILD_OPT=1
# Uncomment to disable optimizations
#RPM_OPT_FLAGS=`echo $RPM_OPT_FLAGS | sed -e 's/-O2/-O0/g'`
@ -390,7 +389,7 @@ fi
FREEBL_NO_DEPEND=1
export FREEBL_NO_DEPEND
export BUILD_OPT=1
#export BUILD_OPT=1
%ifnarch noarch
%if 0%{__isa_bits} == 64
@ -796,13 +795,14 @@ fi
%changelog
* Fri Jul 08 2016 Elio Maldonado <emaldona@redhat.com> - 3.25.0-6
* Tue Jul 12 2016 Elio Maldonado <emaldona@redhat.com> - 3.25.0-6
- Cherry-pick merge from master branch
- Add support for conditionally ignoring the system policy (#1157720)
- Remove unneeded test scripts patches in order to run more tests
- Remove unneeded test data modifications from the spec file
- Remove obsolete patch and spurious lines from the spec file (#1347336)
- Add support to listsuites to list ciphers allowed by policy
- Incorporate some upstream review suggestions
* Sun Jun 26 2016 Elio Maldonado <emaldona@redhat.com> - 3.25.0-3
- Cleanup spec file and patches and add references to bugs filed upstream