1263221 - improve how we handle the __CERT_AddTempCertToPerm situation

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

There is a function in NSS called CERT_AddTempCertToPerm that is useful to PSM. It is exported as __CERT_AddTempCertToPerm (I think because it is considered an internal API this "compromise" was settled upon). The relevant header file (certdb.h) only mentions CERT_AddTempCertToPerm, so if PSM code uses the prefixed version, the compiler can't find the declaration. If PSM uses the unprefixed version, the linker can't find the definition (since it's private). The workaround has been to insert a line '#define CERT_AddTempCertToPerm __CERT_AddTempCertToPerm' before including certdb.h (directly or indirectly) in any file using it. This doesn't work well with unified builds. However, it looks like we can leverage the improved build system to put the redefinition in the relevant moz.build files themselves. This bug will explore the feasibility of that option.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: MozReview Request: bug 1263221 - improve how PSM handles the visibility of __CERT_AddTempCertToPerm r?chmanchester,mgoodwin

Review commit: https://reviewboard.mozilla.org/r/45307/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/45307/

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Here's how this came out on try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=07e42dd1d91a
r? to :chmanchester to confirm that this is an ok thing to do in moz.build.

Comment 3

[Mark Goodwin [:mgoodwin]]

Comment on attachment 8739548 [details]
MozReview Request: bug 1263221 - improve how PSM handles the visibility of __CERT_AddTempCertToPerm r?chmanchester,mgoodwin

https://reviewboard.mozilla.org/r/45307/#review41823

I'm fine with the PSM stuff - assuming the build / config stuff looks good to those who know about these things.

Comment 4

[Chris Manchester (limited bugmail, email directly)]

Comment on attachment 8739548 [details]
MozReview Request: bug 1263221 - improve how PSM handles the visibility of __CERT_AddTempCertToPerm r?chmanchester,mgoodwin

https://reviewboard.mozilla.org/r/45307/#review42043

Looks good to me.

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d4f4469ef5ff

Comment 6

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Thanks!

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/d4f4469ef5ff