1806010 - FIPS-104-3 requires we restart post programmatically

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement)

Description

[Robert Relyea]

FIPS -140-3 requires that we give applications a way to restart the Power On Self-Tests programmatically. Unloading the shared library is insufficient. Shutting down softoken and restarting it with a special flag is.

Comment 1

[Robert Relyea]

Attachment: WIP: Bug 1806010 FIPS-104-3 requires we restart post programmatically

FIPS -140-3 requires that we give applications a way to restart the Power On Self-Tests programmatically. Unloading the shared library is insufficient. Shutting down softoken and restarting it with a special flag is.

This path accomplishes this task by:

1. adding a new startup flag init argument flag called forcePost which is
   parsed at FC_Initialize time.
2. Code which checks if the post ran properly takes a new Bool which tells the function whether or not to rerun the post operations. If post operations are to be rerun, all test flags are set to unknown or fail and the tests are rerun. The results are returned.
3. Public facing functions to verify integrity looks for a special non-valid character flag as the first character of the filename and uses that to decide if we should rerun post or not. Callers add the flag if post should be rerun.
4. pk11mode, the general FIPS test program makes sure we can turn on the forcePost flag.

Comment 2

[John Schanck [:jschanck]]

https://hg.mozilla.org/projects/nss/rev/9cfcdb7034e33256d8c28d640584489ae68c2da2