File 0001-Change-the-default-certificate-database-fo... of Package apache2-mod_nss

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-Change-the-default-certificate-database-format-to-SQ.patch of Package apache2-mod_nss (Revision d85031844df379c90df3235e6b3ccc12)

Currently displaying revision d85031844df379c90df3235e6b3ccc12 , Show latest

From 36530cee371164702dc213bf571f49dfaaf5332e Mon Sep 17 00:00:00 2001
From: Vitezslav Cizek <vcizek@suse.com>
Date: Mon, 5 Mar 2018 17:45:07 +0100
Subject: [PATCH] Change the default certificate database format to SQLite.

Since version 3.35, NSS uses by default the SQLite format for certificate
database. Adjust the documentation accordingly.
---
 Makefile.am       |  4 ++--
 docs/mod_nss.html | 46 ++++++++++++++++++++++++----------------------
 nss.conf.in       |  4 ++--
 nss_engine_init.c |  4 ++--
 4 files changed, 30 insertions(+), 28 deletions(-)

Index: mod_nss-1.0.14/Makefile.am
===================================================================
--- mod_nss-1.0.14.orig/Makefile.am	2018-09-18 14:43:11.354192158 +0200
+++ mod_nss-1.0.14/Makefile.am	2018-09-18 14:43:27.890287919 +0200
@@ -102,8 +102,8 @@ check:
 	rm -rf work;	\
 	nosetests -v test_cipher.py;	\
 	if [ `id -u` != 0 ]; then	\
-	./setup.sh -s 1;	\
-	nosetests -v test.py;	\
+	./setup.sh -s 1 dbm:;	\
+	DBPREFIX=dbm: nosetests -v test.py;	\
 	sleep 5;	\
 	rm -rf work;	\
 	./setup.sh -s 1 sql:;	\
Index: mod_nss-1.0.14/docs/mod_nss.html
===================================================================
--- mod_nss-1.0.14.orig/docs/mod_nss.html	2018-09-18 14:43:11.354192158 +0200
+++ mod_nss-1.0.14/docs/mod_nss.html	2018-09-18 14:43:27.890287919 +0200
@@ -221,17 +221,17 @@ Generating key. This may take a few mom
 [ Lots of output removed ]
 </pre>
 You should now have the following files: 
-<pre>/etc/httpd/nss/cert8.db
-/etc/httpd/nss/key3.db
-/etc/httpd/nss/secmod.db
+<pre>/etc/httpd/nss/cert9.db
+/etc/httpd/nss/key4.db
+/etc/httpd/nss/pkcs11.txt
 </pre>
 These 3 files make up an NSS certificate database. 
 
-If you have a sql: prefix on the path, like sql:/etc/httpd/nss, then it
-will generate an SQLite NSS database consisting of the following files: 
-<pre>/etc/httpd/nss/cert9.db
-/etc/httpd/nss/key4.db
-/etc/httpd/nss/pkcs11.txt</pre>
+If you have a dbm: prefix on the path, like dbm:/etc/httpd/nss, then it
+will generate an Berkeley DB NSS database consisting of the following files: 
+<pre>/etc/httpd/nss/cert8.db
+/etc/httpd/nss/key3.db
+/etc/httpd/nss/secmod.db</pre>
 
 
 <h1><a name="Startup"></a>Server Startup</h1>
@@ -383,10 +383,12 @@ password. 
 NSSCertificateDatabase 
 
 Specifies the location of the NSS certificate database to be used. An
-NSS certificate database consists of 3 files: cert8.db, key3.db and
-secmod.db. cert8.db stores certificates and Certificate Revocation
-Lists (CRLs), key3.db stores keys and secmod.db stores information
+NSS certificate database consists of 3 files: cert9.db, key4.db and
+pkcs11.txt. cert9.db stores certificates and Certificate Revocation
+Lists (CRLs), key4.db stores keys and pkcs11.txt stores information
 about available PKCS#11 modules. 
+Before version 3.35, NSS used a Berkeley DB format by default.
+It consisted of files cert8.db, key3.db and secmod.db. 
 
 This directive specifies a path, not a filename. To use a sqlite
 NSS database include the prefix sql: in the path. 
@@ -398,16 +400,16 @@ NSS database include the prefix sql: in
 
 <big><big>NSSDBPrefix</big></big> 
 
-Normally a certificate database consists of 3 files: cert8.db, key3.db
-and secmod.db. This directive allows you to add a named prefix to the
-filenames of cert8.db and key3.db so you can store multiple databases
+Normally a certificate database consists of 3 files: cert9.db, key4.db
+and pkcs11.txt. This directive allows you to add a named prefix to the
+filenames of cert9.db and key4.db so you can store multiple databases
 in one directory. 
 
 Example 
 
 <code>NSSDBPrefix my-prefix-</code> 
 
-You would then need: my-prefix-cert8.db, my-prefix-key3.db and secmod.db 
+You would then need: my-prefix-cert9.db, my-prefix-key4.db and secmod.db 
 
 In order to work with files with a prefix using the NSS command-line
 tools use the -P flag. 
@@ -1483,14 +1485,14 @@ itself). 
 
 
 <h1><a name="Database_Management"></a>Database Management</h1>
-NSS stores it's certificates and keys in a set of files referred to as
-the "certificate database." The files by default (with NSS 3.x) are
-named cert8.db, key3.db and secmod.db. See the NSS documentation at <a href="http://www.mozilla.org/projects/security/pki/nss/">http://www.mozilla.org/projects/security/pki/nss/</a>
+NSS stores its certificates and keys in a set of files referred to as
+the "certificate database." The files by default (with NSS >= 3.35) are
+named cert9.db, key4.db and pkcs11.txt. See the NSS documentation at <a href="http://www.mozilla.org/projects/security/pki/nss/">http://www.mozilla.org/projects/security/pki/nss/</a>
 for more information on these specific files.
-By default the NSS databases use the Berkeley Database format (cert8 and
-key3). To use the sqlite format (cert9 and key4) either include sql: in
-all references to the database (-d sql:/path/to/database) or
-<code>export NSS_DEFAULT_DB_TYPE="sql"</code>.
+Before version 3.35 the NSS databases used the Berkeley Database format by default
+(cert8 and key3). To use the old format either include dbm: in
+all references to the database (-d dbm:/path/to/database) or
+<code>export NSS_DEFAULT_DB_TYPE="dbm"</code>.
 
 For more details see
 <a href="https://wiki.mozilla.org/NSS_Shared_DB">https://wiki.mozilla.org/NSS_Shared_DB</a> 
Index: mod_nss-1.0.14/nss.conf.in
===================================================================
--- mod_nss-1.0.14.orig/nss.conf.in	2018-09-18 14:43:11.354192158 +0200
+++ mod_nss-1.0.14/nss.conf.in	2018-09-18 14:43:27.890287919 +0200
@@ -124,14 +124,14 @@ NSSNickname Server-Cert
 
 # Server Certificate Database:
 # The NSS security database directory that holds the certificates and
-# keys. The database consists of 3 files: cert8.db, key3.db and secmod.db.
+# keys. The database consists of 3 files: cert9.db, key4.db and pkcs11.txt
 # Provide the directory that these files exist.
 NSSCertificateDatabase @apache_conf@
 
 # Database Prefix:
 # In order to be able to store multiple NSS databases in one directory
 # they need unique names. This option sets the database prefix used for
-# cert8.db and key3.db.
+# cert9.db and key4.db.
 #NSSDBPrefix my-prefix-
 
 # Client Authentication (Type):
Index: mod_nss-1.0.14/nss_engine_init.c
===================================================================
--- mod_nss-1.0.14.orig/nss_engine_init.c	2018-09-18 14:43:25.846276083 +0200
+++ mod_nss-1.0.14/nss_engine_init.c	2018-09-18 14:43:27.890287919 +0200
@@ -179,9 +179,9 @@ static void nss_init_SSLLibrary(server_r
 }
 
 /* Strip the known prefixes */
- if (strncasecmp(mc->pCertificateDatabase, "sql:", 4) == 0)
+ if (strncasecmp(mc->pCertificateDatabase, SQLDB, 4) == 0)
 dbdir = (char *)mc->pCertificateDatabase + 4;
- else if (strncasecmp(mc->pCertificateDatabase, "dbm:", 4) == 0)
+ else if (strncasecmp(mc->pCertificateDatabase, LEGACY, 4) == 0)
 dbdir = (char *)mc->pCertificateDatabase + 4;
 else
 dbdir = (char *)mc->pCertificateDatabase;

Places

File 0001-Change-the-default-certificate-database-format-to-SQ.patch of Package apache2-mod_nss (Revision d85031844df379c90df3235e6b3ccc12)

Places