Attachment 921077 Details for Bug 1123435 – All changes needed to fix the flaws

[patch] All changes needed to fix the flaws

allchanges.patch (text/plain), 11.08 KB, created by Elio Maldonado Batiz on 2014-07-25 23:14:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Elio Maldonado Batiz

Created: 2014-07-25 23:14:38 UTC

Size: 11.08 KB

patch

obsolete

>diff --git a/Bug-1001841-disable-sslv2-libssl.patch b/Bug-1001841-disable-sslv2-libssl.patch
>index dda9046..efbbfe8 100644
>--- a/Bug-1001841-disable-sslv2-libssl.patch
>+++ b/Bug-1001841-disable-sslv2-libssl.patch
>@@ -1,7 +1,12 @@
>-diff -up ./nss/lib/ssl/config.mk.disableSSL2 ./nss/lib/ssl/config.mk
>---- ./nss/lib/ssl/config.mk.disableSSL2	2014-06-24 13:45:27.000000000 -0700
>-+++ ./nss/lib/ssl/config.mk	2014-07-05 08:40:49.244849858 -0700
>-@@ -7,6 +7,10 @@ ifdef NISCC_TEST
>+diff --git a/lib/ssl/config.mk b/lib/ssl/config.mk
>+--- a/lib/ssl/config.mk
>++++ b/lib/ssl/config.mk
>+@@ -2,16 +2,20 @@
>+ # This Source Code Form is subject to the terms of the Mozilla Public
>+ # License, v. 2.0. If a copy of the MPL was not distributed with this
>+ # file, You can obtain one at http://mozilla.org/MPL/2.0/.
>+ 
>+ ifdef NISCC_TEST
>  DEFINES += -DNISCC_TEST
>  endif
>  
>@@ -12,15 +17,25 @@ diff -up ./nss/lib/ssl/config.mk.disableSSL2 ./nss/lib/ssl/config.mk
>  ifdef NSS_NO_PKCS11_BYPASS
>  DEFINES += -DNO_PKCS11_BYPASS
>  else
>-diff -up ./nss/lib/ssl/sslsock.c.disableSSL2 ./nss/lib/ssl/sslsock.c
>---- ./nss/lib/ssl/sslsock.c.disableSSL2	2014-07-05 08:40:49.251849765 -0700
>-+++ ./nss/lib/ssl/sslsock.c	2014-07-05 08:52:05.597869116 -0700
>-@@ -653,6 +653,14 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
>+ CRYPTOLIB=$(SOFTOKEN_LIB_DIR)/$(LIB_PREFIX)freebl.$(LIB_SUFFIX)
>+ 
>+ EXTRA_LIBS += \
>+ 	$(CRYPTOLIB) \
>+ 	$(NULL)
>+diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
>+--- a/lib/ssl/sslsock.c
>++++ b/lib/ssl/sslsock.c
>+@@ -649,16 +649,24 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
>+         if (ss->cipherSpecs) {
>+             PORT_Free(ss->cipherSpecs);
>+             ss->cipherSpecs     = NULL;
>+             ss->sizeCipherSpecs = 0;
>+         }
>          break;
>  
>        case SSL_ENABLE_SSL2:
> +#ifdef NSS_NO_SSL2
>-+if (on) {
>++        if (on) {
> +            PORT_SetError(SSL_ERROR_SSL2_DISABLED);
> +            rv = SECFailure; /* not allowed */
> +        }
>@@ -30,15 +45,33 @@ diff -up ./nss/lib/ssl/sslsock.c.disableSSL2 ./nss/lib/ssl/sslsock.c
>          if (IS_DTLS(ss)) {
>              if (on) {
>                  PORT_SetError(SEC_ERROR_INVALID_ARGS);
>-@@ -664,6 +672,7 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
>-         if (on) {
>+                 rv = SECFailure; /* not allowed */
>+             }
>+             break;
>+         }
>+         ss->opt.enableSSL2       = on;
>+@@ -666,42 +674,51 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
>              ss->opt.v2CompatibleHello = on;
>          }
>-+#endif
>          ss->preferredCipher     = NULL;
>          if (ss->cipherSpecs) {
>              PORT_Free(ss->cipherSpecs);
>-@@ -685,6 +694,13 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
>+             ss->cipherSpecs     = NULL;
>+             ss->sizeCipherSpecs = 0;
>+         }
>++#endif /* NSS_NO_SSL2 */
>+         break;
>+ 
>+       case SSL_NO_CACHE:
>+         ss->opt.noCache = on;
>+         break;
>+ 
>+       case SSL_ENABLE_FDX:
>+         if (on && ss->opt.noLocks) {
>+             PORT_SetError(SEC_ERROR_INVALID_ARGS);
>+             rv = SECFailure;
>+         }
>+         ss->opt.fdx = on;
>          break;
>  
>        case SSL_V2_COMPATIBLE_HELLO:
>@@ -52,24 +85,43 @@ diff -up ./nss/lib/ssl/sslsock.c.disableSSL2 ./nss/lib/ssl/sslsock.c
>          if (IS_DTLS(ss)) {
>              if (on) {
>                  PORT_SetError(SEC_ERROR_INVALID_ARGS);
>-@@ -692,6 +708,7 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
>+                 rv = SECFailure; /* not allowed */
>              }
>              break;
>          }
>-+#endif
>          ss->opt.v2CompatibleHello = on;
>          if (!on) {
>              ss->opt.enableSSL2    = on;
>-@@ -1146,7 +1163,12 @@ SSL_CipherPolicySet(PRInt32 which, PRInt
>+         }
>++#endif /* NSS_NO_SSL2 */
>+         break;
>+ 
>+       case SSL_ROLLBACK_DETECTION:
>+         ss->opt.detectRollBack = on;
>+         break;
>+ 
>+       case SSL_NO_STEP_DOWN:
>+         ss->opt.noStepDown     = on;
>+@@ -1155,17 +1172,21 @@ SSL_CipherPolicySet(PRInt32 which, PRInt
>+ 
>+     if (rv != SECSuccess) {
>+         return rv;
>+     }
>+ 
>      if (ssl_IsRemovedCipherSuite(which)) {
>          rv = SECSuccess;
>      } else if (SSL_IS_SSL2_CIPHER(which)) {
> +#ifdef NSS_NO_SSL2
>-+        PORT_SetError(SSL_ERROR_SSL2_DISABLED);
>-+        rv = SECFailure; /* not allowed */
>++        rv = SSL_ERROR_SSL2_DISABLED;
> +#else
>          rv = ssl2_SetPolicy(which, policy);
>-+#endif
>++#endif /* NSS_NO_SSL2 */
>      } else {
>          rv = ssl3_SetPolicy((ssl3CipherSuite)which, policy);
>      }
>+     return rv;
>+ }
>+ 
>+ SECStatus
>+ SSL_CipherPolicyGet(PRInt32 which, PRInt32 *oPolicy)
>+
>diff --git a/Bug-1001841-disable-sslv2-tests.patch b/Bug-1001841-disable-sslv2-tests.patch
>index bf0adcb..454088b 100644
>--- a/Bug-1001841-disable-sslv2-tests.patch
>+++ b/Bug-1001841-disable-sslv2-tests.patch
>@@ -1,13 +1,137 @@
>-diff -up ./nss/tests/ssl/ssl.sh.disableSSL2 ./nss/tests/ssl/ssl.sh
>---- ./nss/tests/ssl/ssl.sh.disableSSL2	2013-09-25 06:57:55.000000000 -0700
>-+++ ./nss/tests/ssl/ssl.sh	2013-11-03 16:43:48.905914207 -0800
>-@@ -278,6 +278,9 @@ ssl_cov()
>+diff --git a/tests/chains/chains.sh b/tests/chains/chains.sh
>+--- a/tests/chains/chains.sh
>++++ b/tests/chains/chains.sh
>+@@ -35,17 +35,21 @@ is_httpserv_alive()
>+   if [ "${OS_ARCH}" = "WINNT" ] && \
>+      [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then
>+       PID=${SHELL_HTTPPID}
>+   else
>+       PID=`cat ${HTTPPID}`
>+   fi
>+ 
>+   echo "kill -0 ${PID} >/dev/null 2>/dev/null" 
>++  if [ "${NSS_NO_SSL2}" = "1" ]; then
>++  echo "skipping kill because NSS_NO_SSL=${NSS_NO_SSL2}"
>++  else
>+   kill -0 ${PID} >/dev/null 2>/dev/null || Exit 10 "Fatal - httpserv process not detectable"
>++  fi
>+ 
>+   echo "httpserv with PID ${PID} found at `date`"
>+ }
>+ 
>+ ########################### wait_for_httpserv ##########################
>+ # local shell function to wait until httpserver is running and initialized
>+ ########################################################################
>+ wait_for_httpserv()
>+@@ -54,17 +58,21 @@ wait_for_httpserv()
>+   echo "tstclnt -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v"
>+   ${BINDIR}/tstclnt -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v
>+   if [ $? -ne 0 ]; then
>+       sleep 5
>+       echo "retrying to connect to httpserv at `date`"
>+       echo "tstclnt -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v"
>+       ${BINDIR}/tstclnt -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v
>+       if [ $? -ne 0 ]; then
>+-          html_failed "Waiting for Server"
>++          if [ "${NSS_NO_SSL2}" = "1" ]; then
>++              html_passed "Waiting for Server is supposed to fail"
>++          else
>++              html_failed "Waiting for Server"
>++          fi
>+       fi
>+   fi
>+   is_httpserv_alive
>+ }
>+ 
>+ ########################### kill_httpserv ##############################
>+ # local shell function to kill the httpserver after the tests are done
>+ ########################################################################
>+@@ -1174,17 +1182,21 @@ parse_config()
>+             ;;
>+         "break")
>+             break
>+             ;;
>+         "check_ocsp")
>+             TESTNAME="Test that OCSP server is reachable"
>+             check_ocsp ${VALUE}
>+             if [ $? -ne 0 ]; then
>++                if [ "${NSS_NO_SSL2}" = "1" ]; then
>++                html_passed "$TESTNAME"
>++                else
>+                 html_failed "$TESTNAME"
>++                fi
>+                 break;
>+             else
>+                 html_passed "$TESTNAME"
>+             fi
>+             ;;
>+         "ku")
>+             EXT_KU="${VALUE}"
>+             ;;
>+diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
>+--- a/tests/ssl/ssl.sh
>++++ b/tests/ssl/ssl.sh
>+@@ -115,17 +115,21 @@ is_selfserv_alive()
>+   if [ "${OS_ARCH}" = "WINNT" ] && \
>+      [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then
>+       PID=${SHELL_SERVERPID}
>+   else
>+       PID=`cat ${SERVERPID}`
>+   fi
>+ 
>+   echo "kill -0 ${PID} >/dev/null 2>/dev/null" 
>++  if [ "${NSS_NO_SSL2}" = "1" ]; then
>++  ;
>++  else
>+   kill -0 ${PID} >/dev/null 2>/dev/null || Exit 10 "Fatal - selfserv process not detectable"
>++  fi
>+ 
>+   echo "selfserv with PID ${PID} found at `date`"
>+ }
>+ 
>+ ########################### wait_for_selfserv ##########################
>+ # local shell function to wait until selfserver is running and initialized
>+ ########################################################################
>+ wait_for_selfserv()
>+@@ -138,17 +142,21 @@ wait_for_selfserv()
>+   if [ $? -ne 0 ]; then
>+       sleep 5
>+       echo "retrying to connect to selfserv at `date`"
>+       echo "tstclnt -p ${PORT} -h ${HOSTADDR} ${CLIENT_OPTIONS} -q \\"
>+       echo "        -d ${P_R_CLIENTDIR} -v < ${REQUEST_FILE}"
>+       ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} ${CLIENT_OPTIONS} -q \
>+               -d ${P_R_CLIENTDIR} -v < ${REQUEST_FILE}
>+       if [ $? -ne 0 ]; then
>++          if [ "${NSS_NO_SSL2}" = "1" ]; then
>++              html_passed "Server never started"
>++          else
>+           html_failed "Waiting for Server"
>++          fi
>+       fi
>+   fi
>+   is_selfserv_alive
>+ }
>+ 
>+ ########################### kill_selfserv ##############################
>+ # local shell function to kill the selfserver after the tests are done
>+ ########################################################################
>+@@ -273,16 +281,19 @@ ssl_cov()
>+   exec < ${SSLCOV}
>+   while read ectype testmax param testname
>+   do
>+       echo "${testname}" | grep "EXPORT" > /dev/null 
>+       EXP=$?
>        echo "${testname}" | grep "SSL2" > /dev/null
>        SSL2=$?
>  
> +      #  skip export and ssl2 tests when build has disabled SSL2
>-+      if [ "${NSS_NO_SSL2}" = 1 ] && [ -n ${EXP} -o -n ${SSL2} ] && continue
>++      [ "${NSS_NO_SSL2}" = "1" ] && [ -n ${EXP} -o -n ${SSL2} ] && continue
> +
>        if [ "${SSL2}" -eq 0 ] ; then
>            # We cannot use asynchronous cert verification with SSL2
>            SSL2_FLAGS=-O
>+           VMIN="ssl2"
>+       else
>+           # Do not enable SSL2 for non-SSL2-specific tests. SSL2 is disabled by
>+           # default in libssl but it is enabled by default in tstclnt; we want
>+           # to test the libssl default whenever possible.
>diff --git a/nss.spec b/nss.spec
>index 417ab82..d75722b 100644
>--- a/nss.spec
>+++ b/nss.spec
>@@ -21,7 +21,7 @@
> Summary:          Network Security Services
> Name:             nss
> Version:          3.16.2
>-Release:          1%{?dist}
>+Release:          2%{?dist}
> License:          MPLv2.0
> URL:              http://www.mozilla.org/projects/security/pki/nss/
> Group:            System Environment/Libraries
>@@ -187,8 +187,10 @@ low level services.
> %patch47 -p0 -b .templates
> %patch49 -p0 -b .skipthem
> %patch50 -p0 -b .iquote
>-%patch52 -p0 -b .disableSSL2
>-%patch53 -p0 -b .disableSSL2
>+pushd nss
>+%patch52 -p1 -b .disableSSL2
>+%patch53 -p1 -b .disableSSL2
>+popd
> %patch55 -p0 -b .852023
> %patch56 -p0 -b .1026677
> %patch62 -p0 -b .1034409
>@@ -772,6 +774,10 @@ fi
> 
> 
> %changelog
>+* Fri Jul 25 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-2
>+- Fix libssl and test patches that disable ssl2 support
>+- Resolves: Bug 1123435 - Flaws in tests and conditional compile for disabling SSL2 and export suites
>+
> * Tue Jul 08 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-1
> - Rebase to nss-3.16.2
> - Resolves: Bug 1103252 - Rebase RHEL 7.1 to at least NSS 3.16.1 (FF 31)

Flags:

rrelyea: review+

Actions: View | Diff

Attachments on bug 1123435: 921077 | 921080 | 921082 | 922338 | 922339 | 922341 | 922344 | 922640 | 922673 | 922728 | 922970 | 986851 | 988982 | 989305 | 1058571 | 1059558 | 1061267 | 1061281