rpms/nss
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Disable export suites and SSL2 support at build time

Browse Source 
- Fix syntax errors in various shell scripts
- Resolves: Bug 1189952 - Disable SSL2 and the export cipher suites
This commit is contained in:
Elio Maldonado 2015-03-03 14:35:20 -08:00
parent fa80ce0efb
commit 9b7199b3db
4 changed files with 71 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

71
disableSSL2libssl.patch
View File

@ -10,8 +10,8 @@ diff --git a/lib/ssl/config.mk b/lib/ssl/config.mk
DEFINES += -DNISCC_TEST
endif
+ifdef NSS_NO_SSL2
+DEFINES += -DNSS_NO_SSL2
+ifdef NSS_NO_SSL2_NO_EXPORT
+DEFINES += -DNSS_NO_SSL2_NO_EXPORT
+endif
+
# Allow build-time configuration of TLS 1.3 (Experimental)
@ -34,7 +34,7 @@ diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
break;
case SSL_ENABLE_SSL2:
+#ifdef NSS_NO_SSL2
+#ifdef NSS_NO_SSL2_NO_EXPORT
+ if (on) {
+ PORT_SetError(SSL_ERROR_SSL2_DISABLED);
+ rv = SECFailure; /* not allowed */
@ -48,7 +48,7 @@ diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
break;
}
ss->opt.enableSSL2 = on;
@@ -667,42 +673,50 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
@@ -667,52 +673,67 @@ SSL_OptionSet(PRFileDesc *fd, PRInt32 wh
ss->opt.v2CompatibleHello = on;
}
ss->preferredCipher = NULL;
@ -57,7 +57,7 @@ diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
ss->cipherSpecs = NULL;
ss->sizeCipherSpecs = 0;
}
+#endif /* NSS_NO_SSL2 */
+#endif /* NSS_NO_SSL2_NO_EXPORT */
break;
case SSL_NO_CACHE:
@ -73,7 +73,7 @@ diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
break;
case SSL_V2_COMPATIBLE_HELLO:
+#ifdef NSS_NO_SSL2
+#ifdef NSS_NO_SSL2_NO_EXPORT
+ if (on) {
+ PORT_SetError(SSL_ERROR_SSL2_DISABLED);
+ rv = SECFailure; /* not allowed */
@ -90,7 +90,7 @@ diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
if (!on) {
ss->opt.enableSSL2 = on;
}
+#endif /* NSS_NO_SSL2 */
+#endif /* NSS_NO_SSL2_NO_EXPORT */
break;
case SSL_ROLLBACK_DETECTION:
@ -98,26 +98,45 @@ diff --git a/lib/ssl/sslsock.c b/lib/ssl/sslsock.c
break;
case SSL_NO_STEP_DOWN:
ss->opt.noStepDown = on;
@@ -1168,17 +1182,21 @@ SSL_CipherPolicySet(PRInt32 which, PRInt
if (rv != SECSuccess) {
return rv;
}
if (ssl_IsRemovedCipherSuite(which)) {
rv = SECSuccess;
} else if (SSL_IS_SSL2_CIPHER(which)) {
+#ifdef NSS_NO_SSL2
+ rv = SSL_ERROR_SSL2_DISABLED;
+#ifdef NSS_NO_SSL2_NO_EXPORT
+ if (!on) {
+ PORT_SetError(SSL_ERROR_SSL2_DISABLED);
+ rv = SECFailure; /* not allowed */
+ }
+#else
rv = ssl2_SetPolicy(which, policy);
+#endif /* NSS_NO_SSL2 */
} else {
rv = ssl3_SetPolicy((ssl3CipherSuite)which, policy);
ss->opt.noStepDown = on;
if (on)
SSL_DisableExportCipherSuites(fd);
+#endif /* NSS_NO_SSL2_NO_EXPORT */
break;
case SSL_BYPASS_PKCS11:
if (ss->handshakeBegun) {
PORT_SetError(PR_INVALID_STATE_ERROR);
rv = SECFailure;
} else {
if (PR_FALSE != on) {
@@ -1127,16 +1148,23 @@ SSL_OptionSetDefault(PRInt32 which, PRBo
}
return rv;
return SECSuccess;
}
SECStatus
SSL_CipherPolicyGet(PRInt32 which, PRInt32 *oPolicy)
/* function tells us if the cipher suite is one that we no longer support. */
static PRBool
ssl_IsRemovedCipherSuite(PRInt32 suite)
{
+#ifdef NSS_NO_SSL2_NO_EXPORT
+ /* both ssl2 and export cipher suites disabled */
+ if (SSL_IS_SSL2_CIPHER(suite))
+ return PR_TRUE;
+ if (SSL_IsExportCipherSuite(suite))
+ return PR_TRUE;
+#endif /* NSS_NO_SSL2_NO_EXPORT */
switch (suite) {
case SSL_FORTEZZA_DMS_WITH_NULL_SHA:
case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA:
case SSL_FORTEZZA_DMS_WITH_RC4_128_SHA:
return PR_TRUE;
default:
return PR_FALSE;
}

32
disableSSL2tests.patch
View File

@ -1,7 +1,7 @@
diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
--- a/tests/ssl/ssl.sh
+++ b/tests/ssl/ssl.sh
@@ -57,18 +57,23 @@ ssl_init()
@@ -57,19 +57,23 @@ ssl_init()
fi
PORT=${PORT-8443}
@ -11,14 +11,15 @@ diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
# Test case files
- SSLCOV=${QADIR}/ssl/sslcov.txt
+ SSLCOV=[ "${NSS_NO_SSL2}" = "1" ] \
+ && ${QADIR}/ssl/sslcov.noSSL2orExport.txt \
+ || ${QADIR}/ssl/sslcov.txt
SSLAUTH=${QADIR}/ssl/sslauth.txt
+ SSLSTRESS=[ "${NSS_NO_SSL2}" = "1" ] \
+ && ${QADIR}/ssl/sslstress.noSSL2orExport.txt \
+ || ${QADIR}/ssl/sslstress.txt
SSLSTRESS=${QADIR}/ssl/sslstress.txt
- SSLAUTH=${QADIR}/ssl/sslauth.txt
- SSLSTRESS=${QADIR}/ssl/sslstress.txt
+ if [ "${NSS_NO_SSL2_NO_EXPORT}" = "1" ]; then
+ SSLCOV=${QADIR}/ssl/sslcov.noSSL2orExport.txt
+ SSLSTRESS=${QADIR}/ssl/sslstress.noSSL2orExport.txt
+ else
+ SSLCOV=${QADIR}/ssl/sslcov.txt
+ SSLSTRESS=${QADIR}/ssl/sslstress.txt
+ fi
REQUEST_FILE=${QADIR}/ssl/sslreq.dat
#temparary files
@ -26,7 +27,8 @@ diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
SERVERPID=${TMP}/tests_pid.$$
R_SERVERPID=../tests_pid.$$
@@ -115,17 +120,21 @@ is_selfserv_alive()
@@ -115,17 +119,21 @@ is_selfserv_alive()
if [ "${OS_ARCH}" = "WINNT" ] && \
[ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then
PID=${SHELL_SERVERPID}
@ -35,7 +37,7 @@ diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
fi
echo "kill -0 ${PID} >/dev/null 2>/dev/null"
+ if [[ "${NSS_NO_SSL2}" = "1" ] && [ -n ${EXP} -o -n ${SSL2} ]]; then
+ if [[ "${NSS_NO_SSL2_NO_EXPORT}" = "1" ] && [ -n ${EXP} -o -n ${SSL2} ]]; then
+ echo "No server to kill"
+ else
kill -0 ${PID} >/dev/null 2>/dev/null || Exit 10 "Fatal - selfserv process not detectable"
@ -48,7 +50,7 @@ diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
# local shell function to wait until selfserver is running and initialized
########################################################################
wait_for_selfserv()
@@ -138,17 +147,21 @@ wait_for_selfserv()
@@ -138,17 +146,21 @@ wait_for_selfserv()
if [ $? -ne 0 ]; then
sleep 5
echo "retrying to connect to selfserv at `date`"
@ -57,7 +59,7 @@ diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} ${CLIENT_OPTIONS} -q \
-d ${P_R_CLIENTDIR} -v < ${REQUEST_FILE}
if [ $? -ne 0 ]; then
+ if [ "${NSS_NO_SSL2}" = "1" ] && [ -n ${EXP} -o -n ${SSL2} ]; then
+ if [ "${NSS_NO_SSL2_NO_EXPORT}" = "1" ] && [ -n ${EXP} -o -n ${SSL2} ]; then
+ html_passed "Server never started"
+ else
html_failed "Waiting for Server"
@ -70,7 +72,7 @@ diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
########################### kill_selfserv ##############################
# local shell function to kill the selfserver after the tests are done
########################################################################
@@ -273,16 +286,19 @@ ssl_cov()
@@ -273,16 +285,19 @@ ssl_cov()
exec < ${SSLCOV}
while read ectype testmax param testname
do
@ -80,7 +82,7 @@ diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
SSL2=$?
+ # skip export and ssl2 tests when build has disabled SSL2
+ [ "${NSS_NO_SSL2}" = "1" ] && [ -n ${EXP} -o -n ${SSL2} ] && continue
+ [ "${NSS_NO_SSL2_NO_EXPORT}" = "1" ] && [ -n ${EXP} -o -n ${SSL2} ] && continue
+
if [ "${SSL2}" -eq 0 ] ; then
# We cannot use asynchronous cert verification with SSL2

14
nss.spec
View File

@ -19,7 +19,7 @@
Summary: Network Security Services
Name: nss
Version: 3.17.4
Release: 4%{?dist}
Release: 5%{?dist}
License: MPLv2.0
URL: http://www.mozilla.org/projects/security/pki/nss/
Group: System Environment/Libraries
@ -92,7 +92,6 @@ Patch49: nss-skip-bltest-and-fipstest.patch
Patch50: iquote.patch
# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1083900
Patch51: tls12.patch
# SSL2 support has been disabled downstream in RHEL since RHEL-7.0
Patch52: disableSSL2libssl.patch
Patch53: disableSSL2tests.patch
# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1128367
@ -219,8 +218,7 @@ done
%build
# uncomment this line when the work is ready
#export NSS_NO_SSL2=1
export NSS_NO_SSL2_NO_EXPORT=1
NSS_NO_PKCS11_BYPASS=1
export NSS_NO_PKCS11_BYPASS
@ -371,8 +369,7 @@ fi
# Begin -- copied from the build section
# inform the ssl test scripts that SSL2 is disabled
# uncomment this line when the work is ready
#export NSS_NO_SSL2=1
export NSS_NO_SSL2_NO_EXPORT=1
FREEBL_NO_DEPEND=1
export FREEBL_NO_DEPEND
@ -797,6 +794,11 @@ fi
%changelog
* Tue Mar 03 2015 Elio Maldonado <emaldona@redhat.com> - 3.17.4-5
- Disable export suites and SSL2 support at build time
- Fix syntax errors in various shell scripts
- Resolves: Bug 1189952 - Disable SSL2 and the export cipher suites
* Sat Feb 21 2015 Till Maas <opensource@till.name> - 3.17.4-4
- Rebuilt for Fedora 23 Change
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code

2
scripts-syntax-errors.patch
View File

@ -11,7 +11,7 @@ diff --git a/tests/all.sh b/tests/all.sh
# Exception: when building softoken only, shlibsign is the
# last file created.
-if [ ${NSS_BUILD_SOFTOKEN_ONLY} -eq "1" ]; then
+if [ ${NSS_BUILD_SOFTOKEN_ONLY} = "1" ]; then
+if [ "${NSS_BUILD_SOFTOKEN_ONLY}" = "1" ]; then
LAST_FILE_BUILT=shlibsign
else
LAST_FILE_BUILT=modutil