Attachment 318105 Details for Bug 463437 – updated patch to catch an NSS init failure

[patch] updated patch to catch an NSS init failure

nss_compat.diff (text/plain), 2.81 KB, created by Rob Crittenden on 2008-09-30 18:38:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Crittenden

Created: 2008-09-30 18:38:34 UTC

Size: 2.81 KB

patch

obsolete

>Index: ssl.c
>===================================================================
>--- ssl.c	(revision 63)
>+++ ssl.c	(working copy)
>@@ -19,7 +19,7 @@
> #include <unistd.h>
> #include <stdio.h>
> #include "nss_compat_ossl.h"
>-#include <nss3/secder.h>
>+#include <secder.h>
> #include <secmod.h>
> #include <termios.h> /* for echo on/off */
> #include <sys/stat.h>
>@@ -1203,6 +1203,11 @@
> /*
>  * Is it better do to the NSS_Init() here or let the user pass in the
>  * database location via the command-line?
>+ *
>+ * The SSL_library_init() man page actually advocates ignoring the return
>+ * value. There isn't much we can do about this if the NSS_Init() fails.
>+ * 
>+ * The error will appear elsewhere.
>  */
> int SSL_library_init(void)
> {
>@@ -1224,19 +1229,18 @@
>         certDir = "/etc/pki/nssdb";
>     }
> 
>-    /* FIXME: should we really exit or just let things continue? */
>     if (certDir) {
>         if (NSS_Init(certDir) != SECSuccess) {
>-            exit(1);
>+            return 1;
>         }
>     } else {
>         if (NSS_NoDB_Init(NULL) != SECSuccess) {
>-            exit(1);
>+            return 1;
>         }
>     }
>  
>     if (nss_Init_Tokens() != SECSuccess) {
>-        exit(1);
>+        return 1;
>     }
> 
>     status = NSS_SetDomesticPolicy();
>@@ -1686,11 +1690,16 @@
> SSL_METHOD *create_context(PRBool ssl2, PRBool ssl3, PRBool tlsv1, 
>                            PRBool server)
> {
>-    PRFileDesc *s;
>+    PRFileDesc *s = NULL;
>     PRFileDesc *layer;
>     ossl_ctx_t *ossl;
>     int i;
> 
>+    if (PR_TRUE != NSS_IsInitialized()) {
>+        PR_SetError(SEC_ERROR_NOT_INITIALIZED, 0);
>+        goto error;
>+    }
>+
>     /* Create socket -- used as template */
>     s = PR_NewTCPSocket();
> 
>Index: rand.c
>===================================================================
>--- rand.c	(revision 63)
>+++ rand.c	(working copy)
>@@ -64,6 +64,8 @@
>             else
>                 toread = 1024;
>             numread = fread(buf, 1, toread, fp);
>+            if (numread <= 0)
>+                break;
>             PK11_RandomUpdate(buf, numread);
>             totalread += numread;
>         }
>@@ -84,9 +86,12 @@
>     FILE *fp;
> 
>     if ((fp = fopen(file, "wb")) != NULL) {
>+        chmod(file, 0600);
> 	if (PK11_GenerateRandom(buf, sizeof (buf)) == SECSuccess) {
> 	    total = sizeof (buf);
>             numwrite = fwrite(buf, 1, total, fp);
>+            if (numwrite <= 0)
>+                total = 0;
> 	}
> 	fclose(fp);
>     }
>Index: nss_compat_ossl.h
>===================================================================
>--- nss_compat_ossl.h	(revision 63)
>+++ nss_compat_ossl.h	(working copy)
>@@ -22,11 +22,11 @@
> #undef HAVE_OPENSSL
> #undef HAVE_OSSL_ENGINE_H
> 
>-#include <nspr4/nspr.h>
>+#include <nspr.h>
> #include <nss.h>
> #include <pk11pub.h>
> #include <sechash.h>
>-#include <nss3/ssl.h>
>+#include <ssl.h>
> #include <base64.h>
> #include <keyhi.h>
> #include <sslproto.h>

Actions: View | Diff

Attachments on bug 463437: 317481 | 318105