Attachment 310750 Details for Bug 450349 – Fix NSSFips mode

[patch] Fix NSSFips mode

mod_nss-fips.patch (text/plain), 2.22 KB, created by Rob Crittenden on 2008-07-02 02:40:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Crittenden

Created: 2008-07-02 02:40:44 UTC

Size: 2.22 KB

patch

obsolete

>--- mod_nss-1.0-orig/nss_engine_pphrase.c        22 Feb 2007 16:50:14 -0000      1.10
>+++ mod_nss-1.0/nss_engine_pphrase.c        16 May 2008 15:16:02 -0000      1.11
>@@ -62,6 +62,13 @@
>     {
>         PK11SlotInfo *slot = listEntry->slot;
> 
>+        /* This is needed to work around a bug in NSS while in FIPS mode.
>+         * The first login will succeed but NSS_Shutdown() isn't cleaning
>+         * something up causing subsequent logins to be skipped making
>+         * keys and certs unavailable.
>+         */
>+        PK11_Logout(slot);
>+
>         if (PK11_NeedLogin(slot) && PK11_NeedUserInit(slot)) {
>             if (slot == PK11_GetInternalKeySlot()) {
>                 ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
>@@ -298,7 +300,13 @@
>             fprintf(output, "non-alphabetic characters\n");
>             continue; 
>         }
>-        return (char*) PORT_Strdup((char*)phrase);
>+
>+        if (PK11_IsFIPS() && strlen(phrase) == 0) {
>+            ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
>+                "The FIPS security policy requires that a password be set.");
>+            nss_die();
>+        } else
>+            return (char*) PORT_Strdup((char*)phrase);
>     }
> }
>
>--- mod_nss-1.0-orig/nss_pcache.c        18 Nov 2005 16:10:23 -0000      1.8
>+++ mod_nss-1.0/nss_pcache.c        2 Jul 2008 02:08:23 -0000
>@@ -410,7 +409,10 @@
>                 for (node = pinList; node != NULL; node = node->next) {
>                     if (!strcmp(node->tokenName, tokenName)) {
>                         if (Pk11StoreGetPin(&pin, node->store) == SECSuccess) {
>-                            PR_Write(out, pin, strlen(pin));
>+                            if (strlen(pin) == 0)
>+                                PR_Write(out, "", 1);
>+                            else
>+                                PR_Write(out, pin, strlen(pin));
>                             memset(pin, 0, strlen(pin));
>                             free(pin);
>                             found = PR_TRUE;
>@@ -452,7 +454,7 @@
>     while (*s) {
>         if (*s == '\t' || *peek == '\0') {
>             if (i == el) {
>-                if (*peek != '\0')
>+                if (*peek != '\0' || *s == '\t')
>                     *s = '\0';
>                 r = strdup(t);
>                 free(work);
>

Actions: View | Diff

Attachments on bug 450349: 310750