507482 - NSS 3.12.3 (and later) doesn't build on AIX 5.1

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Nelson Bolyard (seldom reads bugmail)]

Awwwwww FIPS!

We need to build 3.12.3 and/or 3.12.4 on AIX, but in softoknt.h

90 NSS_AUDIT_UNWRAP_KEY,
91 NSS_AUDIT_WRAP_KEY,
                     ^ AIX won't allow this
92 } NSSAuditType;

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Likewise, 
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/certdb/certi.h&rev=1.30&mark=371#368

368 typedef enum { 369 certRevocationStatusRevoked = 0, 370 certRevocationStatusValid = 1,
371 certRevocationStatusUnknown = 2,
                                   ^ AIX says no
372 } CERTRevocationStatus;

Comment 2

[Christophe Ravel]

Attachment: fix for softoknt.h (checked in)

Comment 3

[Christophe Ravel]

Attachment: fix for certi.h (checked in)

Not sure if this patch is within the FIPS boundaries. Asking for superreview from Glen anyway.

Comment 4

[Christophe Ravel]

"../../../../../../dist/private/nss/pkixt.h", line 503.30: 1506-275 (S) Unexpected text ',' encountered.
"../../../../../../dist/private/nss/pkixt.h", line 510.27: 1506-275 (S) Unexpected text ',' encountered.

Comment 5

[Christophe Ravel]

Attachment: fix for pkixt.h (checked in)

Comment 6

[Christophe Ravel]

"/h/guybrush.red.iplanet.com/export/mccrel3/security/securitytip/builds/20090730.1/wozzeck_Solaris8/mozilla/security/nss/cmd/lib/pk11table.h", line 77.19: 1506-275 (S) Unexpected text ',' encountered.
"/h/guybrush.red.iplanet.com/export/mccrel3/security/securitytip/builds/20090730.1/wozzeck_Solaris8/mozilla/security/nss/cmd/lib/pk11table.h", line 106.21: 1506-275 (S) Unexpected text ',' encountered.

Comment 7

[Christophe Ravel]

Attachment: fix for pk11table.h (checked in)

Comment 8

[Christophe Ravel]

That seems to be all we need to build on AIX 5.1. I applied these 4 changes to my build workspace and the build is complete.

Comment 9

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 391895 [details] [diff] [review]
fix for softoknt.h (checked in)

I'm giving this patch r+ because it is correct.  But this code is clearly inside the FIPS boundary, so we need to decide if it can be committed now, or not.  
Glen?  Bob?

Comment 10

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 391896 [details] [diff] [review]
fix for certi.h (checked in)

This patch can go in immediately.  It is NOT inside the FIPS boundary.

Comment 11

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 391898 [details] [diff] [review]
fix for pkixt.h (checked in)

This patch can go in immediately since it is outside the FIPS boundary.

Comment 12

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 391900 [details] [diff] [review]
fix for pk11table.h (checked in)

I believe this fix can go in immediately, as it only affects a test program and not the libraries being FIPS validated.

Comment 13

[Christophe Ravel]

Checking in lib/certdb/certi.h;
/cvsroot/mozilla/security/nss/lib/certdb/certi.h,v  <--  certi.h
new revision: 1.31; previous revision: 1.30
done
Checking in lib/libpkix/include/pkixt.h;
/cvsroot/mozilla/security/nss/lib/libpkix/include/pkixt.h,v  <--  pkixt.h
new revision: 1.19; previous revision: 1.18
done
Checking in cmd/lib/pk11table.h;
/cvsroot/mozilla/security/nss/cmd/lib/pk11table.h,v  <--  pk11table.h
new revision: 1.8; previous revision: 1.7
done

Comment 14

[Christophe Ravel]

Checking in softoknt.h;
/cvsroot/mozilla/security/nss/lib/softoken/softoknt.h,v  <--  softoknt.h
new revision: 1.6; previous revision: 1.5
done

Comment 15

[Christophe Ravel]

Comment on attachment 391895 [details] [diff] [review]
fix for softoknt.h (checked in)

Change approved for FIPS by the lab.