177387 - Implement software integrity check of the softoken using DSA

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P1)

Description

[Wan-Teh Chang]

We need to implement a software integrity check of
the softoken using DSA.

Here is my proposal.

1. Write a tool that generates a DSA key pair and
generates a signature.

2. During the build, we invoke the tool on the
softoken after it is built.  Store the public key
and the signature in a file.  Discard the private
key.

3. Distribute the public key/signature file with
the softoken.  The public key/signature file must
be installed in the same directory as the softoken.

4. The software integrity check of the softoken
uses platform-dependent techniques to discover its
installation directory.  It then reads itself (as
a file) and the public key/signature file to verify
the signature.

Comment 1

[Wan-Teh Chang]

Moved to target milestone 3.8 because the original
NSS 3.7 release has been renamed 3.8.

Comment 2

[Wan-Teh Chang]

Attachment: Add freebl_GetLibraryFilePathname to libfreebl.a temporarily

This patch adds freebl_GetLibraryFilePathname to libfreebl.a
temporarily.  The new function is defined in the new file
mozilla/security/nss/lib/freebl/libpath.c and has the same
semantics as the NSPR 4.3 function PR_GetLibraryFilePathname.
This patch should be backed out when NSPR 4.3 is released.

Comment 3

[Wan-Teh Chang]

Attachment: Add freebl_GetLibraryFilePathname to libfreebl.a temporarily, v2

Use __LP64__ instead of __LP64 on HP-UX.

Comment 4

[Wan-Teh Chang]

Attachment: Include the *.chk files in mdbinary.jar

The *.chk files need to be included in our binary distributions.

Comment 5

[Wan-Teh Chang]

I got this error once:

./Linux2.4_x86_glibc_PTH_DBG.OBJ/shlibsign -v -i ../../../../dist/Linux2.4_x86_g
libc_PTH_DBG.OBJ/lib/libsoftokn3.so
Generating DSA Key Pair....Generating PQG Params: An I/O error occurred during s
ecurity authorization.

Comment 6

[Wan-Teh Chang]

Attachment: Include the *.chk files in mdbinary.jar, v2

The previous patch doesn't work if mozilla/dist/$(OBJDIR)/lib/*.chk
are not symbolic links.

The changes to cmd/shlibsign/Makefile are good changes in general
because they put all the configuration/assignments before the
rules, which is the right order.  The change to
cmd/shlibsign/manifest.mn is what causes the *.chk files to be
included in mdbinary.jar.  It requires that CHECKLOC be defined
before coreconf/rules.mk is included in Makefile, which is why
I put the configuration/assignments and rules in the right order.

Comment 7

[Robert Relyea]

Code is checked in and Running