144487 - Enabling/Disabling FIPS - login resets master password

Status: VERIFIED FIXED

(NSS :: Libraries, defect, P1)

Description

[Charles Rosendahl]

To reproduce:

Start up the client.
Preferences->Privacy & Security->Manage Certificates
Import a cert or two for test purposes.  (You should be prompted to set the
master passowrd if this is a profile that has never touched the key db)
Preferences->Privacy & Security->Device Manager
Enable FIPS.  Login to the FIPS module.  At this point you might be prompted
again to set the master password.

If not, exit the browser and restart with the same profile (the new workaround
to enable/disable FIPS requires a restart?)
Preferences->Privacy & Security->Device Manager
Disable FIPS.  Login to the Software security device.  At this point you should
be prompted to set the master password.

Expected Result:  
Since the master password is already set during the import of the certificates,
logging in after switching modules should prompt for the existing password.

Actual Result:
Logging in after swapping the FIPS module (enable/disable) is prompting the user
to create a new master password which is blanking out the key/cert dbs.

Comment 1

[Wan-Teh Chang]

Javi, could you confirm this bug on your Mac?

Charles, could you try a standard Mozilla trunk build to see
if it has the same problem?

Thanks.

Comment 2

[John Unruh]

Confirming on the [NSS_TIP_20020510] build on Mac OSX. This is not happening 
with the 5/14 Mozilla build.

Comment 3

[Javier Delgadillo]

I see this too.  I'm currently debugging this to see what's going on..

Comment 4

[Javier Delgadillo]

I wasn't able to set breakpoints using Mac OS X, so I've gone back to debugging
on Mac OS 9.

What I'm seeing on Mac OS 9 is that whenever I press the "Enable FIPS" button,
the application hangs and I have to force quit.

Does QA see the same thing on Mac OS 9?

Comment 5

[Javier Delgadillo]

I'm not sure why yet, but the app intermittently hangs on the following line:
http://lxr.mozilla.org/security/source/security/nss/lib/pk11wrap/pk11util.c#363

Of course everytime I step into the function to see what's going on, it actually
works just fine.

Comment 6

[John Unruh]

I'm not seeing a lock up on OS9 when enabling FIPS, but I am seeing the same 
behavior as in the original bug description.

Comment 7

[Wan-Teh Chang]

Assigned the bug to Bob.  This bug may be related to his fix
for bug 142659.

Comment 8

[Robert Relyea]

Attachment: Shutdown old cert & key DB before we open the new one.

Javi, could you try this patch out on the Mac. It's against the 3.5 branch
(mozilla/security/lib/softoken/pkcs11.c). Thanks.

Comment 9

[Javier Delgadillo]

Applying this patch fixes the problem for me. 

I'll post another build for QA to test with shortly.

Comment 10

[Wan-Teh Chang]

Attachment: Shutdown old cert & key DB before we open the new one.

This is the patch that Bob checked in.	The only differences
from the previous patch are minor changes to the comments.

Comment 11

[Wan-Teh Chang]

The patch has been checked into the tip of NSS,
NSS_3_5_BRANCH, and NSS_CLIENT_TAG (used by the
Mozilla trunk build).

John, could you verify the fix with either Javi's
test build or today's Mozilla trunk build?  Thanks.

Comment 12

[John Unruh]

Verified with the 5/28 Mozilla trunk build.