Bug 988083 - [nss-util] Pick up various upstream GCM code fixes applied since nss-3.14.3 was released
Summary: [nss-util] Pick up various upstream GCM code fixes applied since nss-3.14.3 w...
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: nss-util
Version: 6.5
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Elio Maldonado Batiz
QA Contact: Hubert Kario
: 988072 (view as bug list)
Depends On:
Blocks: RHEL65FIPS140 976572 983766 987131
TreeView+ depends on / blocked
Reported: 2013-07-24 17:13 UTC by Elio Maldonado Batiz
Modified: 2013-11-21 06:16 UTC (History)
4 users (show)

Fixed In Version: nss-util-3.14.3-4.el6
Doc Type: Bug Fix
Doc Text:
Cause: The pkcs11n.h header did not have the needed constants enumerating the mechanisms needed to support TLS 1.2. Consequence: Without these constants defined NSS would not be able to support TLS 1.2. Fix: Added the needed constants to the header. Result: NSS will now be able to support TLS 1.2.
Clone Of:
Last Closed: 2013-11-21 06:16:17 UTC
Target Upstream Version:

Attachments (Terms of Use)
add the CKM_ #defines required for softoken to build (818 bytes, patch)
2013-07-24 17:21 UTC, Elio Maldonado Batiz
rrelyea: review+
Details | Diff

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2013:1558 normal SHIPPED_LIVE nss and nspr bug fix and enhancement update 2013-11-21 00:40:48 UTC

Description Elio Maldonado Batiz 2013-07-24 17:13:14 UTC
Description of problem: Need to update the pkcs11n.h internal header on nss-util with some new #denies for some mechanisms needed by nss-softoken code.

Version-Release number of selected component (if applicable): rhel-6.5

How reproducible: Always

Steps to Reproduce:
1. Try to compile nss-sftoken with needed GCM fixes

Actual results: Compile fails because the symbols it needed aren't defined.

Expected results: nss-softoken compiles.

Additional info:

Comment 1 Elio Maldonado Batiz 2013-07-24 17:16:44 UTC
*** Bug 988072 has been marked as a duplicate of this bug. ***

Comment 2 Elio Maldonado Batiz 2013-07-24 17:21:46 UTC
Created attachment 777872 [details]
add the CKM_ #defines required for softoken to build

Comment 3 Bob Relyea 2013-07-27 00:26:03 UTC
Comment on attachment 777872 [details]
add the CKM_ #defines required for softoken to build

r+ rrelyea

Comment 4 Bob Relyea 2013-07-27 00:28:55 UTC
Note to QA: This bug can be verified by inspection.
Note to PM: This bug is needed to fix bug 976572, which is needed by FIPS and already approved. The patch only adds 4 #defines to a header file, so there is very little risk of this patch breaking anything.

Comment 6 Hubert Kario 2013-08-28 15:17:23 UTC
I don't see any obvious way to test it (except trying to use the code and see if it works/doesn't crash, which we already do as part of openswan Suite B test case) so I'm proposing qa_test_coverage-

Of course, I'll do code inspection in this release and check if the patches are present in the package. Elio, Is that OK for you?

Comment 7 Elio Maldonado Batiz 2013-08-28 17:19:09 UTC
It's the usage of TLS 1.2 mechanisms by higher layers of nss that will allow you to test this change. Bob made sure I included this patch in order to have the crypto module ready to support TLS 1.2 when we updates to nss-3.15.1 with TLS 1.2 support.  Because of the FIPS-140 revalidation we have to keep nss-softokn at 3.14.3 (+selected backports) but the rest NSS will update to nss-3.15.1 and the TLS 1.2 code will use these constants. This change will be tested by the TLS tests.

Comment 8 Hubert Kario 2013-08-29 09:41:17 UTC
OK, marking as qa_test_coverage-, feature will be tested once we support TLS1.2 specific cipher suites in CLI utilities.

Comment 11 errata-xmlrpc 2013-11-21 06:16:17 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.