diff --git a/apache2-mod_nss.changes b/apache2-mod_nss.changes index bfc4afb..5aa64ec 100644 --- a/apache2-mod_nss.changes +++ b/apache2-mod_nss.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Fri Jul 29 18:04:55 UTC 2016 - vcizek@suse.com + +- use systemd-ask-password to prompt for a certificate passphrase + (bsc#972968) + * drop obsolete mod_nss-bnc863518-reopen_dev_tty.diff + ------------------------------------------------------------------- Sat Apr 16 09:12:29 UTC 2016 - vcizek@suse.com diff --git a/apache2-mod_nss.spec b/apache2-mod_nss.spec index 752943b..18070a9 100644 --- a/apache2-mod_nss.spec +++ b/apache2-mod_nss.spec @@ -51,7 +51,6 @@ BuildRequires: mozilla-nss-devel >= 3.15.1 BuildRequires: mozilla-nss-tools BuildRequires: pkgconfig -Patch0: mod_nss-bnc863518-reopen_dev_tty.diff Patch1: mod_nss-migrate.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build @@ -72,7 +71,6 @@ security library. %prep %setup -q -n mod_nss-%{version} -%patch0 -p0 -b .mod_nss-bnc863518-reopen_dev_tty.rpmpatch %patch1 -p1 # Touch expression parser sources to prevent regenerating it @@ -136,9 +134,7 @@ perl -pi -e "s:$NSS_LIB_DIR:$NSS_BIN:" $RPM_BUILD_ROOT%{_sbindir}/gencert %check set +x mkdir -p %{apache_test_module_dir} -# create password file including internal token to suppress -# apache 'builtin dialog', see NSSPassPhraseDialog below -# (http://mcs.une.edu.au/doc/mod_nss/mod_nss.html) +# create password file including internal token to suppress apache 'builtin dialog' cat << EOF > %{apache_test_module_dir}/password.conf internal:httptest EOF diff --git a/mod_nss-bnc863518-reopen_dev_tty.diff b/mod_nss-bnc863518-reopen_dev_tty.diff deleted file mode 100644 index c75add2..0000000 --- a/mod_nss-bnc863518-reopen_dev_tty.diff +++ /dev/null @@ -1,37 +0,0 @@ -Index: nss_engine_pphrase.c -=================================================================== ---- nss_engine_pphrase.c.orig 2016-04-15 20:27:59.000000000 +0200 -+++ nss_engine_pphrase.c 2016-04-16 11:11:49.472862662 +0200 -@@ -230,6 +230,7 @@ static char *nss_get_password(FILE *inpu - char line[1024]; - unsigned char phrase[200]; - int infd = fileno(input); -+ int tmpfd; - int isTTY = isatty(infd); - - token_name = PK11_GetTokenName(slot); -@@ -351,6 +352,24 @@ static char *nss_get_password(FILE *inpu - if (pwdstr) - return pwdstr; - -+ /* It happens that stdin is not opened with O_RDONLY. Better make sure -+ * it is and re-open /dev/tty. -+ */ -+ close(infd); /* is 0 normally. open(2) will return first available. */ -+ tmpfd = open("/dev/tty", O_RDONLY); -+ if( tmpfd == -1) { -+ fprintf(output, "Cannot open /dev/tty for reading the passphrase.\n"); -+ nss_die(); -+ } -+ if(tmpfd != infd) { -+ if( dup2(tmpfd, infd) != infd) { -+ fprintf(output, "Problem duplicating /dev/tty file descriptor.\n"); -+ close(tmpfd); -+ nss_die(); -+ } -+ close(tmpfd); -+ } -+ - for (;;) { - /* Prompt for password */ - if (isTTY) { diff --git a/mod_nss.conf.in b/mod_nss.conf.in index b6ec400..16cac69 100644 --- a/mod_nss.conf.in +++ b/mod_nss.conf.in @@ -26,7 +26,7 @@ # VirtualHosts on the same IP Address and port is not possible. # # Reason: -# The brwoser/client connects to the web server's port 443 and initializes +# The browser/client connects to the web server's port 443 and initializes # an SSL/TLS handshake. If SSLv3 protocol is used, there is no way for the # client to specify the host that it wants to connect to, unless the crypto # has been fully initialized already. Similarly, the server cannot present @@ -132,8 +132,7 @@ AddType application/x-pkcs7-crl .crl # Configure the pass phrase gathering process. # The filtering dialog program (`builtin' is a internal # terminal dialog) has to provide the pass phrase on stdout. -NSSPassPhraseDialog builtin - +NSSPassPhraseDialog exec:/usr/sbin/apache2-systemd-ask-pass # Pass Phrase Helper: # This helper program stores the token password pins between @@ -188,35 +187,9 @@ NSSRequireSafeNegotiation off # List the ciphers that the client is permitted to negotiate. # See the mod_nss documentation for a complete list. -# SSL 3 ciphers. SSL 2 is disabled -#NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha - -# The following ciphers are available in SUSE's package after June 2014; -# The GCM mode aes ciphers are of particular interest. -# You may want to add them if so desired: -# -# rsa_aes_128_gcm_sha -# ecdh_ecdsa_aes_128_gcm_sha -# ecdhe_ecdsa_aes_128_gcm_sha -# ecdh_rsa_aes_128_gcm_sha -# ecdhe_rsa_aes_128_gcm_sha - -# SSL 3 ciphers + ECC ciphers. SSL 2 is disabled by default. -# -# Comment out the NSSCipherSuite line above and use the one below if you have -# ECC enabled NSS and mod_nss and want to use Elliptical Curve Cryptography -#NSSCipherSuite +rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha,-ecdh_ecdsa_null_sha,+ecdh_ecdsa_rc4_128_sha,+ecdh_ecdsa_3des_sha,+ecdh_ecdsa_aes_128_sha,+ecdh_ecdsa_aes_256_sha,-ecdhe_ecdsa_null_sha,+ecdhe_ecdsa_rc4_128_sha,+ecdhe_ecdsa_3des_sha,+ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,-ecdh_rsa_null_sha,+ecdh_rsa_128_sha,+ecdh_rsa_3des_sha,+ecdh_rsa_aes_128_sha,+ecdh_rsa_aes_256_sha,-echde_rsa_null,+ecdhe_rsa_rc4_128_sha,+ecdhe_rsa_3des_sha,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha - -# The following is taken as default with the apache2-mod_nss package, as -# provided with the August 2014 update (which features the GCM mode ciphers -# along with server side SNI support). -# Ideas: -# * cipher mode may be more important than key length -# (AES-GCM is 128 bit, vs AES256 on a different mode) -# * no rc4, no 3des, no des -# * ephemeral is what you want (PFS). -# * EC has precedence over RSA -NSSCipherSuite +ecdhe_ecdsa_aes_128_gcm_sha,+ecdh_ecdsa_aes_128_gcm_sha,+ecdhe_rsa_aes_256_sha,+ecdh_rsa_aes_256_sha,+ecdhe_rsa_aes_128_gcm_sha,+ecdh_rsa_aes_128_gcm_sha,+ecdhe_rsa_aes_128_sha,+ecdh_rsa_aes_128_sha,+rsa_aes_128_gcm_sha,+rsa_aes_256_sha,+rsa_aes_128_sha +# The following cipher suite is the default that comes with mod_nss 1.0.14, +# plus some additional ciphers +NSSCipherSuite +aes_128_sha_256,+aes_256_sha_256,+ecdhe_ecdsa_aes_128_gcm_sha_256,+ecdhe_ecdsa_aes_128_sha,+ecdhe_ecdsa_aes_256_sha,+ecdhe_rsa_aes_128_gcm_sha_256,+ecdhe_rsa_aes_128_sha,+ecdhe_rsa_aes_256_sha,+rsa_aes_128_gcm_sha_256,+rsa_aes_128_sha,+rsa_aes_256_sha,+ecdh_rsa_aes_256_sha,+ecdh_rsa_aes_128_sha # SSL Protocol: # Cryptographic protocols that provide communication security.