Bug 988083

Summary: [nss-util] Pick up various upstream GCM code fixes applied since nss-3.14.3 was released
Product: Red Hat Enterprise Linux 6 Reporter: Elio Maldonado Batiz <emaldona>
Component: nss-utilAssignee: Elio Maldonado Batiz <emaldona>
Status: CLOSED ERRATA QA Contact: Alicja Kario <hkario>
Severity: high Docs Contact:
Priority: high    
Version: 6.5CC: emaldona, eparis, hkario, rrelyea
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: nss-util-3.14.3-4.el6 Doc Type: Bug Fix
Doc Text:
Cause: The pkcs11n.h header did not have the needed constants enumerating the mechanisms needed to support TLS 1.2. Consequence: Without these constants defined NSS would not be able to support TLS 1.2. Fix: Added the needed constants to the header. Result: NSS will now be able to support TLS 1.2.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2013-11-21 06:16:17 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 968473, 976572, 983766, 987131    
Attachments:
Description Flags
add the CKM_ #defines required for softoken to build rrelyea: review+

Description Elio Maldonado Batiz 2013-07-24 17:13:14 UTC 
Description of problem: Need to update the pkcs11n.h internal header on nss-util with some new #denies for some mechanisms needed by nss-softoken code.


Version-Release number of selected component (if applicable): rhel-6.5


How reproducible: Always


Steps to Reproduce:
1. Try to compile nss-sftoken with needed GCM fixes

Actual results: Compile fails because the symbols it needed aren't defined.

Expected results: nss-softoken compiles.


Additional info:
Comment 1 Elio Maldonado Batiz 2013-07-24 17:16:44 UTC 
*** Bug 988072 has been marked as a duplicate of this bug. ***
Comment 2 Elio Maldonado Batiz 2013-07-24 17:21:46 UTC 
Created attachment 777872 [details]
add the CKM_ #defines required for softoken to build
Comment 3 Bob Relyea 2013-07-27 00:26:03 UTC 
Comment on attachment 777872 [details]
add the CKM_ #defines required for softoken to build

r+ rrelyea
Comment 4 Bob Relyea 2013-07-27 00:28:55 UTC 
Note to QA: This bug can be verified by inspection.
Note to PM: This bug is needed to fix bug 976572, which is needed by FIPS and already approved. The patch only adds 4 #defines to a header file, so there is very little risk of this patch breaking anything.
Comment 6 Alicja Kario 2013-08-28 15:17:23 UTC 
I don't see any obvious way to test it (except trying to use the code and see if it works/doesn't crash, which we already do as part of openswan Suite B test case) so I'm proposing qa_test_coverage-

Of course, I'll do code inspection in this release and check if the patches are present in the package. Elio, Is that OK for you?
Comment 7 Elio Maldonado Batiz 2013-08-28 17:19:09 UTC 
It's the usage of TLS 1.2 mechanisms by higher layers of nss that will allow you to test this change. Bob made sure I included this patch in order to have the crypto module ready to support TLS 1.2 when we updates to nss-3.15.1 with TLS 1.2 support.  Because of the FIPS-140 revalidation we have to keep nss-softokn at 3.14.3 (+selected backports) but the rest NSS will update to nss-3.15.1 and the TLS 1.2 code will use these constants. This change will be tested by the TLS tests.
Comment 8 Alicja Kario 2013-08-29 09:41:17 UTC 
OK, marking as qa_test_coverage-, feature will be tested once we support TLS1.2 specific cipher suites in CLI utilities.
Comment 11 errata-xmlrpc 2013-11-21 06:16:17 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1558.html