Bug 988083 - [nss-util] Pick up various upstream GCM code fixes applied since nss-3.14.3 was released
[nss-util] Pick up various upstream GCM code fixes applied since nss-3.14.3 w...
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: nss-util (Show other bugs)
Unspecified Unspecified
high Severity high
: rc
: ---
Assigned To: Elio Maldonado Batiz
Hubert Kario
: 988072 (view as bug list)
Depends On:
Blocks: RHEL65FIPS140 976572 983766 987131
  Show dependency treegraph
Reported: 2013-07-24 13:13 EDT by Elio Maldonado Batiz
Modified: 2013-11-21 01:16 EST (History)
4 users (show)

See Also:
Fixed In Version: nss-util-3.14.3-4.el6
Doc Type: Bug Fix
Doc Text:
Cause: The pkcs11n.h header did not have the needed constants enumerating the mechanisms needed to support TLS 1.2. Consequence: Without these constants defined NSS would not be able to support TLS 1.2. Fix: Added the needed constants to the header. Result: NSS will now be able to support TLS 1.2.
Story Points: ---
Clone Of:
Last Closed: 2013-11-21 01:16:17 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
add the CKM_ #defines required for softoken to build (818 bytes, patch)
2013-07-24 13:21 EDT, Elio Maldonado Batiz
rrelyea: review+
Details | Diff

  None (edit)
Description Elio Maldonado Batiz 2013-07-24 13:13:14 EDT
Description of problem: Need to update the pkcs11n.h internal header on nss-util with some new #denies for some mechanisms needed by nss-softoken code.

Version-Release number of selected component (if applicable): rhel-6.5

How reproducible: Always

Steps to Reproduce:
1. Try to compile nss-sftoken with needed GCM fixes

Actual results: Compile fails because the symbols it needed aren't defined.

Expected results: nss-softoken compiles.

Additional info:
Comment 1 Elio Maldonado Batiz 2013-07-24 13:16:44 EDT
*** Bug 988072 has been marked as a duplicate of this bug. ***
Comment 2 Elio Maldonado Batiz 2013-07-24 13:21:46 EDT
Created attachment 777872 [details]
add the CKM_ #defines required for softoken to build
Comment 3 Bob Relyea 2013-07-26 20:26:03 EDT
Comment on attachment 777872 [details]
add the CKM_ #defines required for softoken to build

r+ rrelyea
Comment 4 Bob Relyea 2013-07-26 20:28:55 EDT
Note to QA: This bug can be verified by inspection.
Note to PM: This bug is needed to fix bug 976572, which is needed by FIPS and already approved. The patch only adds 4 #defines to a header file, so there is very little risk of this patch breaking anything.
Comment 6 Hubert Kario 2013-08-28 11:17:23 EDT
I don't see any obvious way to test it (except trying to use the code and see if it works/doesn't crash, which we already do as part of openswan Suite B test case) so I'm proposing qa_test_coverage-

Of course, I'll do code inspection in this release and check if the patches are present in the package. Elio, Is that OK for you?
Comment 7 Elio Maldonado Batiz 2013-08-28 13:19:09 EDT
It's the usage of TLS 1.2 mechanisms by higher layers of nss that will allow you to test this change. Bob made sure I included this patch in order to have the crypto module ready to support TLS 1.2 when we updates to nss-3.15.1 with TLS 1.2 support.  Because of the FIPS-140 revalidation we have to keep nss-softokn at 3.14.3 (+selected backports) but the rest NSS will update to nss-3.15.1 and the TLS 1.2 code will use these constants. This change will be tested by the TLS tests.
Comment 8 Hubert Kario 2013-08-29 05:41:17 EDT
OK, marking as qa_test_coverage-, feature will be tested once we support TLS1.2 specific cipher suites in CLI utilities.
Comment 11 errata-xmlrpc 2013-11-21 01:16:17 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.