Bug 801975 - Restore the use of NSS_NoDB_Init or alternate call on fipstest.c
Restore the use of NSS_NoDB_Init or alternate call on fipstest.c
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: nss-softokn (Show other bugs)
rawhide
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Elio Maldonado Batiz
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-03-09 20:03 EST by Elio Maldonado Batiz
Modified: 2013-03-11 19:10 EDT (History)
3 users (show)

See Also:
Fixed In Version: nss-softokn-3.13.4-2.fc18
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-03-11 19:10:05 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Call NSS_NoDB_Init (1.20 KB, patch)
2012-04-10 13:54 EDT, Elio Maldonado Batiz
rrelyea: review-
Details | Diff
The patch that was applied as Bob suggested. (473 bytes, patch)
2012-04-10 16:37 EDT, Elio Maldonado Batiz
rrelyea: review+
Details | Diff

  None (edit)
Description Elio Maldonado Batiz 2012-03-09 20:03:53 EST
Description of problem: 
The removal of the NSS_NoDB_Init call breaks fipstest.c. 
It still compiles and links, but doesn't work. The NSS_NoDB_Init call needs to be replaced by individual XXX_Init calls to initialize the subsystems required by fipstest.c, such as the RNG and the SECOID tables.


Version-Release number of selected component (if applicable):

How reproducible: always

Steps to Reproduce:
1. Acquire a set of FIPS 140 .req test file validation suite.
2. Use fipstest with some of them. 
  
Actual results: The test won't succeed because of unseeded RNG.
Expected results: The tests pass,


Additional info: 

This bug was been reported upstream and we should have a temporary fix until is fixed properly upstream and we pick it up in a future update.

The tools code code is include in the nss and here as is of most relevance for softoken. It is not installed as it's not part of the supported or unsupported tools. It's here for the convenience of internal developers for FIPS 140 matters. It will be accessible in code form for by others who may be interested in assisting the team or reporting a bug.
Comment 1 Bob Relyea 2012-03-12 18:19:16 EDT
We should restore the init calls.

Upsream bug nubmers:
https://bugzilla.mozilla.org/show_bug.cgi?id=679814
https://bugzilla.mozilla.org/show_bug.cgi?id=698049

The upstream bug that caused the problem was:
https://bugzilla.mozilla.org/show_bug.cgi?id=681382

Note wtc's comments in the bug.
Comment 2 Bob Relyea 2012-04-10 13:53:46 EDT
new upstream bug which includes restoring the calls in it's patch:

https://bugzilla.mozilla.org/show_bug.cgi?id=475578

bottom of the patch:

https://bugzilla.mozilla.org/attachment.cgi?id=611091&action=diff

bob
Comment 3 Elio Maldonado Batiz 2012-04-10 13:54:33 EDT
Created attachment 576535 [details]
Call NSS_NoDB_Init

The include is <nss.h> as when building as part of nss-softoken we don't have that header in the source build tree. 

I wish I could rely on 'unset USE_STATIC_LIBS' on the spec file and get dynamic linking rather than unconditionally adding 
EXTRA_SHARED_LIBS += -L$(NSSUTIL_LIB_DIR) -lnss3.

What's the reason for having USE_STATIC_LIBS in so many places?
Comment 4 Elio Maldonado Batiz 2012-04-10 14:08:47 EDT
Comment on attachment 576535 [details]
Call NSS_NoDB_Init

Oops, I should have read the previous comment. Let me try then using the bottom of the patch you pointed me to until we get the full upstream patch.
Comment 5 Bob Relyea 2012-04-10 16:28:16 EDT
Comment on attachment 576535 [details]
Call NSS_NoDB_Init

r- please look at my upstream patch. I fixes the problem without needing nss.h.
Comment 6 Elio Maldonado Batiz 2012-04-10 16:37:05 EDT
Created attachment 576594 [details]
The patch that was applied as Bob suggested.
Comment 7 Bob Relyea 2012-04-10 20:02:35 EDT
Comment on attachment 576594 [details]
The patch that was applied as Bob suggested.

That one looks better
Comment 8 Bob Relyea 2012-04-10 20:04:24 EDT
From comment 5: I fixes -> It fixes  (was the intent, though I fixes-> I fixed would also be true:).

Note You need to log in before you can comment on or make changes to this bug.