[nss-softokn/f16] - Fix failure to switch nss-softokn to FIPS mode (#745571)
Elio Maldonado
emaldonado at fedoraproject.org
Thu Oct 13 03:59:50 UTC 2011
commit d6cabcc864b6e642280bc65e74350bfc6a97393a
Author: Elio Maldonado <emaldona at dhcp-225.sjc.redhat.com>
Date: Wed Oct 12 20:57:12 2011 -0700
- Fix failure to switch nss-softokn to FIPS mode (#745571)
- Updated the nss-softokn prelink patch to be complete
Conflicts:
nss-softokn.spec
nss-softokn-3.12.4-prelink.patch | 235 ++++++++++++++++++++++++++++++++++++-
nss-softokn.spec | 7 +-
2 files changed, 234 insertions(+), 8 deletions(-)
---
diff --git a/nss-softokn-3.12.4-prelink.patch b/nss-softokn-3.12.4-prelink.patch
index 6480a28..ed187e8 100644
--- a/nss-softokn-3.12.4-prelink.patch
+++ b/nss-softokn-3.12.4-prelink.patch
@@ -1,6 +1,228 @@
-diff -up mozilla/security/nss/lib/freebl/stubs.c.prelink mozilla/security/nss/lib/freebl/stubs.c
---- mozilla/security/nss/lib/freebl/stubs.c.prelink 2011-03-30 11:39:44.000000000 -0700
-+++ mozilla/security/nss/lib/freebl/stubs.c 2011-04-25 18:20:24.013948568 -0700
+diff -up ./mozilla/security/nss/lib/freebl/Makefile.prelink ./mozilla/security/nss/lib/freebl/Makefile
+--- ./mozilla/security/nss/lib/freebl/Makefile.prelink 2011-10-12 09:47:04.956000000 -0700
++++ ./mozilla/security/nss/lib/freebl/Makefile 2011-10-12 09:47:55.040002000 -0700
+@@ -82,6 +82,12 @@ ifeq ($(FREEBL_NO_DEPEND),1)
+ else
+ MAPFILE_SOURCE = freebl.def
+ endif
++ifdef FREEBL_USE_PRELINK
++ DEFINES += -DFREEBL_USE_PRELINK
++endif
++ifdef FREEBL_PRELINK_COMMAND
++ DEFINES +=-DFREEBL_PRELINK_COMMAND=\"$(FREEBL_PRELINK_COMMAND)\"
++endif
+ # NSS_X86 means the target is a 32-bits x86 CPU architecture
+ # NSS_X64 means the target is a 64-bits x64 CPU architecture
+ # NSS_X86_OR_X64 means the target is either x86 or x64
+diff -up ./mozilla/security/nss/lib/freebl/shvfy.c.prelink ./mozilla/security/nss/lib/freebl/shvfy.c
+--- ./mozilla/security/nss/lib/freebl/shvfy.c.prelink 2011-10-12 09:48:46.966000000 -0700
++++ ./mozilla/security/nss/lib/freebl/shvfy.c 2011-10-12 09:50:16.017002000 -0700
+@@ -48,6 +48,168 @@
+ #include "stdio.h"
+ #include "prmem.h"
+
++#ifdef FREEBL_USE_PRELINK
++#ifndef FREELB_PRELINK_COMMAND
++#define FREEBL_PRELINK_COMMAND "/usr/sbin/prelink -u -o -"
++#endif
++#include "private/pprio.h"
++
++#include <stdlib.h>
++#include <unistd.h>
++#include <fcntl.h>
++#include <sys/wait.h>
++#include <sys/stat.h>
++
++PRFileDesc *
++bl_OpenUnPrelink(const char *shName, int *pid)
++{
++ char *command= strdup(FREEBL_PRELINK_COMMAND);
++ char *argString = NULL;
++ char **argv = NULL;
++ char *shNameArg = NULL;
++ char *cp;
++ pid_t child;
++ int argc = 0, argNext = 0;
++ struct stat statBuf;
++ int pipefd[2] = {-1,-1};
++ int ret;
++
++ *pid = 0;
++
++ /* make sure the prelink command exists first. If not, fall back to
++ * just reading the file */
++ for (cp = command; *cp ; cp++) {
++ if (*cp == ' ') {
++ *cp++ = 0;
++ argString = cp;
++ break;
++ }
++ }
++ memset (&statBuf, 0, sizeof(statBuf));
++ /* stat the file, follow the link */
++ ret = stat(command, &statBuf);
++ if (ret < 0) {
++ free(command);
++ return PR_Open(shName, PR_RDONLY, 0);
++ }
++ /* file exits, make sure it's an executable */
++ if (!S_ISREG(statBuf.st_mode) ||
++ ((statBuf.st_mode & (S_IXUSR|S_IXGRP|S_IXOTH)) == 0)) {
++ free(command);
++ return PR_Open(shName, PR_RDONLY, 0);
++ }
++
++ /* OK, the prelink command exists and looks correct, use it */
++ /* build the arglist while we can still malloc */
++ /* count the args if any */
++ if (argString && *argString) {
++ /* argString may have leading spaces, strip them off*/
++ for (cp = argString; *cp && *cp == ' '; cp++);
++ argString = cp;
++ if (*cp) {
++ /* there is at least one arg.. */
++ argc = 1;
++ }
++
++ /* count the rest: Note there is no provision for escaped
++ * spaces here */
++ for (cp = argString; *cp ; cp++) {
++ if (*cp == ' ') {
++ while (*cp && *cp == ' ') cp++;
++ if (*cp) argc++;
++ }
++ }
++ }
++
++ /* add the additional args: argv[0] (command), shName, NULL*/
++ argc += 3;
++ argv = PORT_NewArray(char *, argc);
++ if (argv == NULL) {
++ goto loser;
++ }
++
++ /* fill in the arglist */
++ argv[argNext++] = command;
++ if (argString && *argString) {
++ argv[argNext++] = argString;
++ for (cp = argString; *cp; cp++) {
++ if (*cp == ' ') {
++ *cp++ = 0;
++ while (*cp && *cp == ' ') cp++;
++ if (*cp) argv[argNext++] = cp;
++ }
++ }
++ }
++ /* exec doesn't advertise taking const char **argv, do the paranoid
++ * copy */
++ shNameArg = strdup(shName);
++ if (shNameArg == NULL) {
++ goto loser;
++ }
++ argv[argNext++] = shNameArg;
++ argv[argNext++] = 0;
++
++ ret = pipe(pipefd);
++ if (ret < 0) {
++ goto loser;
++ }
++
++ /* use vfork() so we don't trigger the pthread_at_fork() handlers */
++ child = vfork();
++ if (child < 0) goto loser;
++ if (child == 0) {
++ /* set up the file descriptors */
++ close(0);
++ /* associate pipefd[1] with stdout */
++ if (pipefd[1] != 1) dup2(pipefd[1], 1);
++ close(2);
++ close(pipefd[0]);
++ /* should probably close the other file descriptors? */
++
++
++ execv(command, argv);
++ /* avoid at_exit() handlers */
++ _exit(1); /* shouldn't reach here except on an error */
++ }
++ close(pipefd[1]);
++ pipefd[1] = -1;
++
++ /* this is safe because either vfork() as full fork() semantics, and thus
++ * already has it's own address space, or because vfork() has paused
++ * the parent util the exec or exit */
++ free(command);
++ free(shNameArg);
++ PORT_Free(argv);
++
++ *pid = child;
++
++ return PR_ImportPipe(pipefd[0]);
++
++loser:
++ if (pipefd[0] != -1) {
++ close(pipefd[0]);
++ }
++ if (pipefd[1] != -1) {
++ close(pipefd[1]);
++ }
++ free(command);
++ free(shNameArg);
++ PORT_Free(argv);
++
++ return NULL;
++}
++
++void
++bl_CloseUnPrelink( PRFileDesc *file, int pid)
++{
++ /* close the file descriptor */
++ PR_Close(file);
++ /* reap the child */
++ if (pid) {
++ waitpid(pid, NULL, 0);
++ }
++}
++#endif
+
+ /* #define DEBUG_SHVERIFY 1 */
+
+@@ -117,6 +279,9 @@ BLAPI_SHVerify(const char *name, PRFuncP
+ SECStatus rv;
+ DSAPublicKey key;
+ int count;
++#ifdef FREEBL_USE_PRELINK
++ int pid = 0;
++#endif
+
+ PRBool result = PR_FALSE; /* if anything goes wrong,
+ * the signature does not verify */
+@@ -197,7 +362,11 @@ BLAPI_SHVerify(const char *name, PRFuncP
+ checkFD = NULL;
+
+ /* open our library file */
++#ifdef FREEBL_USE_PRELINK
++ shFD = bl_OpenUnPrelink(shName,&pid);
++#else
+ shFD = PR_Open(shName, PR_RDONLY, 0);
++#endif
+ if (shFD == NULL) {
+ #ifdef DEBUG_SHVERIFY
+ fprintf(stderr, "Failed to open the library file %s: (%d, %d)\n",
+@@ -218,7 +387,11 @@ BLAPI_SHVerify(const char *name, PRFuncP
+ SHA1_Update(hashcx, buf, bytesRead);
+ count += bytesRead;
+ }
++#ifdef FREEBL_USE_PRELINK
++ bl_CloseUnPrelink(shFD, pid);
++#else
+ PR_Close(shFD);
++#endif
+ shFD = NULL;
+
+ SHA1_End(hashcx, hash.data, &hash.len, hash.len);
+diff -up ./mozilla/security/nss/lib/freebl/stubs.c.prelink ./mozilla/security/nss/lib/freebl/stubs.c
+--- ./mozilla/security/nss/lib/freebl/stubs.c.prelink 2011-03-30 11:39:44.000000000 -0700
++++ ./mozilla/security/nss/lib/freebl/stubs.c 2011-10-12 09:46:24.737000000 -0700
@@ -70,6 +70,7 @@
#include <secport.h>
#include <secitem.h>
@@ -62,9 +284,9 @@ diff -up mozilla/security/nss/lib/freebl/stubs.c.prelink mozilla/security/nss/li
STUB_FETCH_FUNCTION(PR_Close);
STUB_FETCH_FUNCTION(PR_Read);
STUB_FETCH_FUNCTION(PR_Seek);
-diff -up mozilla/security/nss/lib/freebl/stubs.h.prelink mozilla/security/nss/lib/freebl/stubs.h
---- mozilla/security/nss/lib/freebl/stubs.h.prelink 2011-04-25 18:16:32.075083232 -0700
-+++ mozilla/security/nss/lib/freebl/stubs.h 2011-04-25 18:19:48.109634458 -0700
+diff -up ./mozilla/security/nss/lib/freebl/stubs.h.prelink ./mozilla/security/nss/lib/freebl/stubs.h
+--- ./mozilla/security/nss/lib/freebl/stubs.h.prelink 2011-03-30 11:39:44.000000000 -0700
++++ ./mozilla/security/nss/lib/freebl/stubs.h 2011-10-12 09:46:24.740001000 -0700
@@ -84,6 +84,8 @@
#define PR_NotifyCondVar PR_NotifyCondVar_stub
#define PR_NotifyAllCondVar PR_NotifyAllCondVar_stub
@@ -74,4 +296,3 @@ diff -up mozilla/security/nss/lib/freebl/stubs.h.prelink mozilla/security/nss/li
#define PR_Read PR_Read_stub
#define PR_Seek PR_Seek_stub
#define PR_Sleep PR_Sleep_stub
-diff -up mozilla/security/nss/lib/freebl/stubs.prelink mozilla/security/nss/lib/freebl/stubs
diff --git a/nss-softokn.spec b/nss-softokn.spec
index 0a54cf4..e920500 100644
--- a/nss-softokn.spec
+++ b/nss-softokn.spec
@@ -17,7 +17,7 @@
Summary: Network Security Services Softoken Module
Name: nss-softokn
Version: 3.12.10
-Release: 5%{?dist}
+Release: 6%{?dist}
License: MPLv1.1 or GPLv2+ or LGPLv2+
URL: http://www.mozilla.org/projects/security/pki/nss/
Group: System Environment/Libraries
@@ -49,6 +49,8 @@ Source1: nss-split-softokn.sh
Source2: nss-softokn.pc.in
Source3: nss-softokn-config.in
+# FIPS 140 -- update this patch as we rebase nss
+# and remov it once it has been included upstream
Patch2: nss-softokn-3.12.4-prelink.patch
Patch3: bz709517.patch
Patch4: softoken-minimal-test-dependencies.patch
@@ -375,6 +377,9 @@ done
%{_includedir}/nss3/shsign.h
%changelog
+* Wed Oct 12 2011 Elio Maldonado <emaldona at redhat.com> - 3.12.10-6
+- Fix failure to switch nss-softokn to FIPS mode (#745571)
+
* Wed Aug 17 2011 Elio Maldonado <emaldona at redhat.com> - 3.12.10-5
- rebuilt as recommended to deal with an rpm 4.9.1 issue
More information about the scm-commits
mailing list