Red Hat Bugzilla – Bug 347691
Port neon to use NSS library for cryptography
Last modified: 2014-09-23 16:03:19 EDT
neon should be ported to use NSS library for cryptography.
See the tracking bug for details and links on how it could be done.
neon has an library-agnostic SSL interface which is currently implemented for
both OpenSSL and GnuTLS. To be able to port neon to NSS, NSS needs to be able
to work in a mode where a central certificate database is not required. I
couldn't work out how to do this with the current API.
NSS can be initialized to work without a centralized database. The open ssl
compatibility libraries currently uses this method.
That being said, doing so can leave the application deficient compared to other
applications. Certainly for the first step, that's probably sufficient. As we
enable the shared database code, applications that don't play in that shared
database will be viewed as deficient or lacking.
Can you explain how?
I think I was supposed to call NSS_NoDB_Init() to initialize, right? I couldn't
see any way to get a CERTCertDBHandle * pointer other than calling the
CERT_GetDefaultCertDB() function, so virtually all the state neon needs to
manipulate is process-global (e.g. the cert verification callback) - which is
not possible for a library interface.
The other thing I stumbled on when looking at this was that the export policy
would have to be set (again as process-global state) at startup somehow. How
would an application (or worse, a library) be expected to decide what export
policy to use? Is this supposed to be user-configurable?
*** Bug 346661 has been marked as a duplicate of this bug. ***