rpms/nss
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Allow application requests to disable SSL v2 to succeed

Browse Source 
- Resolves: Bug 1342158 - nss-3.24 does no longer support ssl V2, installation of IPA fails because nss init fails
This commit is contained in:
Elio Maldonado 2016-06-02 13:47:29 -07:00
parent c460de4d23
commit 85c6e70f3c
2 changed files with 109 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

102
mozbz1277569backport.patch Normal file
View File

@ -0,0 +1,102 @@
--- ./lib/ssl/sslsock.c.compatibility 2016-06-02 10:59:07.188831825 -0700
+++ ./lib/ssl/sslsock.c 2016-06-02 10:59:07.205831404 -0700
@@ -675,16 +675,28 @@
PORT_SetError(SEC_ERROR_INVALID_ARGS);
rv = SECFailure; /* not allowed */
}
break;
}
ssl_EnableSSL3(&ss->vrange, on);
break;
+ case SSL_ENABLE_SSL2:
+ case SSL_V2_COMPATIBLE_HELLO:
+ /* We no longer support SSL v2.
+ * However, if an old application requests to disable SSL v2,
+ * we shouldn't fail.
+ */
+ if (on) {
+ PORT_SetError(SEC_ERROR_INVALID_ARGS);
+ rv = SECFailure;
+ }
+ break;
+
case SSL_NO_CACHE:
ss->opt.noCache = on;
break;
case SSL_ENABLE_FDX:
if (on && ss->opt.noLocks) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
rv = SECFailure;
@@ -856,16 +868,20 @@
on = ss->opt.handshakeAsServer;
break;
case SSL_ENABLE_TLS:
on = ss->vrange.max >= SSL_LIBRARY_VERSION_TLS_1_0;
break;
case SSL_ENABLE_SSL3:
on = ss->vrange.min == SSL_LIBRARY_VERSION_3_0;
break;
+ case SSL_ENABLE_SSL2:
+ case SSL_V2_COMPATIBLE_HELLO:
+ on = PR_FALSE;
+ break;
case SSL_NO_CACHE:
on = ss->opt.noCache;
break;
case SSL_ENABLE_FDX:
on = ss->opt.fdx;
break;
case SSL_ROLLBACK_DETECTION:
on = ss->opt.detectRollBack;
@@ -967,16 +983,20 @@
on = ssl_defaults.handshakeAsServer;
break;
case SSL_ENABLE_TLS:
on = versions_defaults_stream.max >= SSL_LIBRARY_VERSION_TLS_1_0;
break;
case SSL_ENABLE_SSL3:
on = versions_defaults_stream.min == SSL_LIBRARY_VERSION_3_0;
break;
+ case SSL_ENABLE_SSL2:
+ case SSL_V2_COMPATIBLE_HELLO:
+ on = PR_FALSE;
+ break;
case SSL_NO_CACHE:
on = ssl_defaults.noCache;
break;
case SSL_ENABLE_FDX:
on = ssl_defaults.fdx;
break;
case SSL_ROLLBACK_DETECTION:
on = ssl_defaults.detectRollBack;
@@ -1100,16 +1120,28 @@
case SSL_ENABLE_TLS:
ssl_EnableTLS(&versions_defaults_stream, on);
break;
case SSL_ENABLE_SSL3:
ssl_EnableSSL3(&versions_defaults_stream, on);
break;
+ case SSL_ENABLE_SSL2:
+ case SSL_V2_COMPATIBLE_HELLO:
+ /* We no longer support SSL v2.
+ * However, if an old application requests to disable SSL v2,
+ * we shouldn't fail.
+ */
+ if (on) {
+ PORT_SetError(SEC_ERROR_INVALID_ARGS);
+ return SECFailure;
+ }
+ break;
+
case SSL_NO_CACHE:
ssl_defaults.noCache = on;
break;
case SSL_ENABLE_FDX:
if (on && ssl_defaults.noLocks) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;

8
nss.spec
View File

@ -21,7 +21,7 @@ Name: nss
Version: 3.24.0
# for Rawhide, please always use release >= 2
# for Fedora release branches, please use release < 2 (1.0, 1.1, ...)
Release: 2.1%{?dist}
Release: 2.2%{?dist}
License: MPLv2.0
URL: http://www.mozilla.org/projects/security/pki/nss/
Group: System Environment/Libraries
@ -96,6 +96,8 @@ Patch58: rhbz1185708-enable-ecc-3des-ciphers-by-default.patch
# TODO: file a bug usptream
Patch59: nss-check-policy-file.patch
Patch60: nss-pem-unitialized-vars.path
# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1277569
Patch64: mozbz1277569backport.patch
# Upstream: https://git.fedorahosted.org/cgit/nss-pem.git/commit/
# TODO: file a bug usptream
Patch61: nss-skip-util-gtest.patch
@ -812,6 +814,10 @@ fi
%changelog
* Thu Jun 02 2016 Elio Maldonado <emaldona@redhat.com> - 3.24.0-2.2
- Allow application requests to disable SSL v2 to succeed
- Resolves: Bug 1342158 - nss-3.24 does no longer support ssl V2, installation of IPA fails because nss init fails
* Sun May 29 2016 Elio Maldonado <emaldona@redhat.com> - 3.24.0-2.1
- Rebase to NSS 3.24.0
- Restore setting the policy file location