rpm/apache2-mod_nss
SHA256
1
0
Fork 0
forked from pool/apache2-mod_nss
Code Pull Requests Activity
d9ebd1c855
apache2-mod_nss/apache2-mod_nss.spec

182 lines
6.9 KiB
RPMSpec
Raw Normal View History

osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
#
# spec file for package apache2-mod_nss
#
checkin OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=61
2024-06-20 11:26:23 +02:00
# Copyright (c) 2024 SUSE LLC
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
Accepting request 655304 from home:vitezslav_cizek:branches:Apache:Modules - Update to 1.0.18 * Initial support for new mod_proxy function ssl_engine_set * Fix some warnings from clang OBS-URL: https://build.opensuse.org/request/show/655304 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=47
2018-12-05 17:08:49 +01:00
# Please submit bugfixes or comments via https://bugs.opensuse.org/
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
#
Accepting request 851083 from home:pgajdos - use apache rpm macros OBS-URL: https://build.opensuse.org/request/show/851083 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=59
2020-11-26 14:44:48 +01:00
%if ! %{defined apache_apxs}
%define apache_apxs %{_sbindir}/apxs
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
%define apache apache2
%define apache_libexecdir %(%{apxs} -q LIBEXECDIR)
%define apache_sysconfdir %(%{apxs} -q SYSCONFDIR)
%define apache_includedir %(%{apxs} -q INCLUDEDIR)
%define apache_serverroot %(%{apxs} -q PREFIX)
%define apache_mmn %(MMN=$(%{apxs} -q LIBEXECDIR)_MMN; test -x $MMN && $MMN)
Accepting request 851083 from home:pgajdos - use apache rpm macros OBS-URL: https://build.opensuse.org/request/show/851083 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=59
2020-11-26 14:44:48 +01:00
%endif
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
%define apache_sysconf_nssdir %{apache_sysconfdir}/mod_nss.d
Accepting request 185495 from home:msmeissn:branches:mozilla:Factory - Add support for TLS v1.1 and TLS v1.2 (TLS v1.2 requires mozilla nss 3.15.1 or newer.) - merged in mod_nss-proxyvariables.patch and mod_nss-tlsv1_1.patch from redhat to allow tls v1.1 too. - ported the tls v1.1 patch to be tls v1.2 aware - added mod_nss-proxyvariables.patch (from RHEL6 package) - added mod_nss-tlsv1_1.patch (from RHEL6 package, enhanced with TLS 1.2) - mod_nss-array_overrun.patch: from RHEL6 package, fixed a array index overrun OBS-URL: https://build.opensuse.org/request/show/185495 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=4
2013-08-01 19:01:22 +02:00
Name: apache2-mod_nss
Accepting request 655304 from home:vitezslav_cizek:branches:Apache:Modules - Update to 1.0.18 * Initial support for new mod_proxy function ssl_engine_set * Fix some warnings from clang OBS-URL: https://build.opensuse.org/request/show/655304 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=47
2018-12-05 17:08:49 +01:00
Version: 1.0.18
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
Release: 0
Accepting request 185495 from home:msmeissn:branches:mozilla:Factory - Add support for TLS v1.1 and TLS v1.2 (TLS v1.2 requires mozilla nss 3.15.1 or newer.) - merged in mod_nss-proxyvariables.patch and mod_nss-tlsv1_1.patch from redhat to allow tls v1.1 too. - ported the tls v1.1 patch to be tls v1.2 aware - added mod_nss-proxyvariables.patch (from RHEL6 package) - added mod_nss-tlsv1_1.patch (from RHEL6 package, enhanced with TLS 1.2) - mod_nss-array_overrun.patch: from RHEL6 package, fixed a array index overrun OBS-URL: https://build.opensuse.org/request/show/185495 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=4
2013-08-01 19:01:22 +02:00
Summary: SSL/TLS module for the Apache HTTP server
License: Apache-2.0
Accepting request 741020 from openSUSE:Factory revert OBS-URL: https://build.opensuse.org/request/show/741020 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=54
2019-10-18 11:16:36 +02:00
Group: Productivity/Networking/Web/Servers
Accepting request 802933 from home:vitezslav_cizek:branches:Apache:Modules - Set the minimal apache version to 2.4.18 which is required since 1.0.18 (mod_nss needs conn_rec->master field) OBS-URL: https://build.opensuse.org/request/show/802933 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=55
2020-05-13 12:55:47 +02:00
URL: https://pagure.io/mod_nss
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
Source: https://releases.pagure.org/mod_nss/mod_nss-%{version}.tar.gz
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
Source1: mod_nss.conf.in
Source2: listen_nss.conf
Source4: README-SUSE.txt
Accepting request 242385 from home:draht:branches:mozilla:Factory - mod_nss-bnc863518-reopen_dev_tty.diff: close(0) and open("/dev/tty", ...) to make sure that stdin can be read from. startproc may inherit wrongly opened file descriptors to httpd. (Note: An analogous fix exists in startproc(8), too.) [bnc#863518] - VirtualHost part in /etc/apache2/conf.d/mod_nss.conf is now externalized to /etc/apache2/conf.d/vhost-nss.template and not activated/read by default. [bnc#878681] - NSSCipherSuite update following additional ciphers of Feb 18 change. [bnc#878681] - mod_nss-SNI-callback.patch, mod_nss-SNI-checks.patch: server side SNI was not implemented when mod_nss was made; patches implement SNI with checks if SNI provided hostname equals Host: field in http request header. OBS-URL: https://build.opensuse.org/request/show/242385 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=10
2014-07-25 16:00:54 +02:00
Source5: vhost-nss.template
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
Patch1: mod_nss-migrate.patch
Patch2: mod_nss-gencert-correct-ownership.patch
Patch4: mod_nss-gencert_use_ss_instead_of_netstat.patch
Accepting request 729843 from home:vitezslav_cizek:branches:Apache:Modules - Use a stronger password in gencert to pass the stricter tests in FIPS mode (bsc#1150133) * https://pagure.io/mod_nss/pull-request/48 * add mod_nss-gencert_stronger_password.patch OBS-URL: https://build.opensuse.org/request/show/729843 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=51
2019-09-11 09:39:21 +02:00
Patch5: mod_nss-gencert_stronger_password.patch
Accepting request 317129 from home:pgajdos:apache2 require %{apache_suse_maintenance_mmn} OBS-URL: https://build.opensuse.org/request/show/317129 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=12
2015-07-16 19:01:59 +02:00
BuildRequires: apache-rpm-macros
Accepting request 802933 from home:vitezslav_cizek:branches:Apache:Modules - Set the minimal apache version to 2.4.18 which is required since 1.0.18 (mod_nss needs conn_rec->master field) OBS-URL: https://build.opensuse.org/request/show/802933 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=55
2020-05-13 12:55:47 +02:00
BuildRequires: apache2-devel >= 2.4.18
- buildrequire apr-devel instead of libapr1-devel - buildrequire apr-util-devel instead of libapr-util1-devel OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=38
2017-12-19 14:14:07 +01:00
BuildRequires: apr-devel
BuildRequires: apr-util-devel
Accepting request 375069 from home:vitezslav_cizek:branches:Apache:Modules - use a whitelist approach for keeping directives in the migration script (bsc#961907) * modify mod_nss_migrate.pl - fix test: add NSSPassPhraseDialog, point it to plain file - update to 1.0.13 Update default ciphers to something more modern and secure Check for host and netstat commands in gencert before trying to use them Add server support for DHE ciphers Extract SAN from server/client certificates into env Fix memory leaks and other coding issues caught by clang analyzer Add support for Server Name Indication (SNI) (#1010751) Add support for SNI for reverse proxy connections Add RenegBufferSize? option Add support for TLS Session Tickets (RFC 5077) Fix logical AND support in OpenSSL cipher compatibility Correctly handle disabled ciphers (CVE-2015-5244) Implement a slew more OpenSSL cipher macros Fix a number of illegal memory accesses and memory leaks Support for SHA384 ciphers if they are available in NSS Add compatibility for mod_ssl-style cipher definitions (#862938) Add TLSv1.2-specific ciphers Completely remove support for SSLv2 Add support for sqlite NSS databases (#1057650) Compare subject CN and VS hostname during server start up Add support for enabling TLS v1.2 Don't enable SSL 3 by default (CVE-2014-3566) Fix CVE-2013-4566 Move nss_pcache to /usr/libexec OBS-URL: https://build.opensuse.org/request/show/375069 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=22
2016-03-30 16:57:58 +02:00
BuildRequires: automake
Accepting request 185495 from home:msmeissn:branches:mozilla:Factory - Add support for TLS v1.1 and TLS v1.2 (TLS v1.2 requires mozilla nss 3.15.1 or newer.) - merged in mod_nss-proxyvariables.patch and mod_nss-tlsv1_1.patch from redhat to allow tls v1.1 too. - ported the tls v1.1 patch to be tls v1.2 aware - added mod_nss-proxyvariables.patch (from RHEL6 package) - added mod_nss-tlsv1_1.patch (from RHEL6 package, enhanced with TLS 1.2) - mod_nss-array_overrun.patch: from RHEL6 package, fixed a array index overrun OBS-URL: https://build.opensuse.org/request/show/185495 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=4
2013-08-01 19:01:22 +02:00
BuildRequires: bison
Accepting request 335936 from home:pgajdos:apache2 - test module with %apache_test_module_curl OBS-URL: https://build.opensuse.org/request/show/335936 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=15
2015-10-05 12:47:37 +02:00
BuildRequires: curl
Accepting request 185495 from home:msmeissn:branches:mozilla:Factory - Add support for TLS v1.1 and TLS v1.2 (TLS v1.2 requires mozilla nss 3.15.1 or newer.) - merged in mod_nss-proxyvariables.patch and mod_nss-tlsv1_1.patch from redhat to allow tls v1.1 too. - ported the tls v1.1 patch to be tls v1.2 aware - added mod_nss-proxyvariables.patch (from RHEL6 package) - added mod_nss-tlsv1_1.patch (from RHEL6 package, enhanced with TLS 1.2) - mod_nss-array_overrun.patch: from RHEL6 package, fixed a array index overrun OBS-URL: https://build.opensuse.org/request/show/185495 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=4
2013-08-01 19:01:22 +02:00
BuildRequires: findutils
BuildRequires: flex
BuildRequires: gcc-c++
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
BuildRequires: iproute2
Accepting request 375069 from home:vitezslav_cizek:branches:Apache:Modules - use a whitelist approach for keeping directives in the migration script (bsc#961907) * modify mod_nss_migrate.pl - fix test: add NSSPassPhraseDialog, point it to plain file - update to 1.0.13 Update default ciphers to something more modern and secure Check for host and netstat commands in gencert before trying to use them Add server support for DHE ciphers Extract SAN from server/client certificates into env Fix memory leaks and other coding issues caught by clang analyzer Add support for Server Name Indication (SNI) (#1010751) Add support for SNI for reverse proxy connections Add RenegBufferSize? option Add support for TLS Session Tickets (RFC 5077) Fix logical AND support in OpenSSL cipher compatibility Correctly handle disabled ciphers (CVE-2015-5244) Implement a slew more OpenSSL cipher macros Fix a number of illegal memory accesses and memory leaks Support for SHA384 ciphers if they are available in NSS Add compatibility for mod_ssl-style cipher definitions (#862938) Add TLSv1.2-specific ciphers Completely remove support for SSLv2 Add support for sqlite NSS databases (#1057650) Compare subject CN and VS hostname during server start up Add support for enabling TLS v1.2 Don't enable SSL 3 by default (CVE-2014-3566) Fix CVE-2013-4566 Move nss_pcache to /usr/libexec OBS-URL: https://build.opensuse.org/request/show/375069 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=22
2016-03-30 16:57:58 +02:00
BuildRequires: libtool
Accepting request 185495 from home:msmeissn:branches:mozilla:Factory - Add support for TLS v1.1 and TLS v1.2 (TLS v1.2 requires mozilla nss 3.15.1 or newer.) - merged in mod_nss-proxyvariables.patch and mod_nss-tlsv1_1.patch from redhat to allow tls v1.1 too. - ported the tls v1.1 patch to be tls v1.2 aware - added mod_nss-proxyvariables.patch (from RHEL6 package) - added mod_nss-tlsv1_1.patch (from RHEL6 package, enhanced with TLS 1.2) - mod_nss-array_overrun.patch: from RHEL6 package, fixed a array index overrun OBS-URL: https://build.opensuse.org/request/show/185495 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=4
2013-08-01 19:01:22 +02:00
BuildRequires: mozilla-nspr-devel >= 4.6.3
Accepting request 555075 from home:vitezslav_cizek:branches:Apache:Modules - drop obsolete mod_nss-dont_disable_SSLV2.patch * bump up minimal NSS version to 3.25, which we now have everywhere - Require iproute2 for ss, which is used by gencert to gather noise (bsc#998183) OBS-URL: https://build.opensuse.org/request/show/555075 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=34
2017-12-11 09:57:38 +01:00
BuildRequires: mozilla-nss-devel >= 3.25
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
BuildRequires: mozilla-nss-tools
Accepting request 185495 from home:msmeissn:branches:mozilla:Factory - Add support for TLS v1.1 and TLS v1.2 (TLS v1.2 requires mozilla nss 3.15.1 or newer.) - merged in mod_nss-proxyvariables.patch and mod_nss-tlsv1_1.patch from redhat to allow tls v1.1 too. - ported the tls v1.1 patch to be tls v1.2 aware - added mod_nss-proxyvariables.patch (from RHEL6 package) - added mod_nss-tlsv1_1.patch (from RHEL6 package, enhanced with TLS 1.2) - mod_nss-array_overrun.patch: from RHEL6 package, fixed a array index overrun OBS-URL: https://build.opensuse.org/request/show/185495 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=4
2013-08-01 19:01:22 +02:00
BuildRequires: pkgconfig
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
Requires: %{apache_mmn}
Requires: %{apache_suse_maintenance_mmn}
Accepting request 802933 from home:vitezslav_cizek:branches:Apache:Modules - Set the minimal apache version to 2.4.18 which is required since 1.0.18 (mod_nss needs conn_rec->master field) OBS-URL: https://build.opensuse.org/request/show/802933 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=55
2020-05-13 12:55:47 +02:00
Requires: apache2 >= 2.4.18
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
Requires: findutils
Requires: iproute2
Accepting request 555075 from home:vitezslav_cizek:branches:Apache:Modules - drop obsolete mod_nss-dont_disable_SSLV2.patch * bump up minimal NSS version to 3.25, which we now have everywhere - Require iproute2 for ss, which is used by gencert to gather noise (bsc#998183) OBS-URL: https://build.opensuse.org/request/show/555075 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=34
2017-12-11 09:57:38 +01:00
Requires: mozilla-nss >= 3.25
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
Requires(post): mozilla-nss-tools
Provides: mod_nss
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
%description
The mod_nss module provides strong cryptography for the Apache Web
server via the Secure Sockets Layer (SSL) and Transport Layer
Security (TLS) protocols using the Network Security Services (NSS)
security library.
%prep
Accepting request 588674 from home:vitezslav_cizek:branches:Apache:Modules - Use fixed upstream 1.0.16 tarball * https://pagure.io/mod_nss/issue/44 OBS-URL: https://build.opensuse.org/request/show/588674 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=43
2018-03-19 16:29:20 +01:00
%setup -q -n mod_nss-%{version}
Accepting request 729843 from home:vitezslav_cizek:branches:Apache:Modules - Use a stronger password in gencert to pass the stricter tests in FIPS mode (bsc#1150133) * https://pagure.io/mod_nss/pull-request/48 * add mod_nss-gencert_stronger_password.patch OBS-URL: https://build.opensuse.org/request/show/729843 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=51
2019-09-11 09:39:21 +02:00
%autopatch -p1
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
# Touch expression parser sources to prevent regenerating it
touch nss_expr_*.[chyl]
%build
Accepting request 813442 from home:polslinux:branches:Apache:Modules - Add -fcommon in order to fix building with GCC10 OBS-URL: https://build.opensuse.org/request/show/813442 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=57
2020-06-15 08:22:59 +02:00
CFLAGS="%{optflags} -fcommon"
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
export CFLAGS
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
NSPR_INCLUDE_DIR=`%{_bindir}/pkg-config --variable=includedir nspr`
NSPR_LIB_DIR=`%{_bindir}/pkg-config --variable=libdir nspr`
NSS_INCLUDE_DIR=`%{_bindir}/pkg-config --variable=includedir nss`
NSS_LIB_DIR=`%{_bindir}/pkg-config --variable=libdir nss`
NSS_BIN=`%{_bindir}/pkg-config --variable=exec_prefix nss`
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
# For some reason mod_nss can't find nss on SUSE unless we do the following
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
C_INCLUDE_PATH="%{_includedir}/nss3:%{_includedir}/nspr4:%{_includedir}/apache2-prefork/"
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
export C_INCLUDE_PATH
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
# no more patching a config file...
cp -a %{SOURCE1} ./nss.conf.in
cp -a %{SOURCE4} .
chmod 644 ./nss.conf.in
Accepting request 375069 from home:vitezslav_cizek:branches:Apache:Modules - use a whitelist approach for keeping directives in the migration script (bsc#961907) * modify mod_nss_migrate.pl - fix test: add NSSPassPhraseDialog, point it to plain file - update to 1.0.13 Update default ciphers to something more modern and secure Check for host and netstat commands in gencert before trying to use them Add server support for DHE ciphers Extract SAN from server/client certificates into env Fix memory leaks and other coding issues caught by clang analyzer Add support for Server Name Indication (SNI) (#1010751) Add support for SNI for reverse proxy connections Add RenegBufferSize? option Add support for TLS Session Tickets (RFC 5077) Fix logical AND support in OpenSSL cipher compatibility Correctly handle disabled ciphers (CVE-2015-5244) Implement a slew more OpenSSL cipher macros Fix a number of illegal memory accesses and memory leaks Support for SHA384 ciphers if they are available in NSS Add compatibility for mod_ssl-style cipher definitions (#862938) Add TLSv1.2-specific ciphers Completely remove support for SSLv2 Add support for sqlite NSS databases (#1057650) Compare subject CN and VS hostname during server start up Add support for enabling TLS v1.2 Don't enable SSL 3 by default (CVE-2014-3566) Fix CVE-2013-4566 Move nss_pcache to /usr/libexec OBS-URL: https://build.opensuse.org/request/show/375069 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=22
2016-03-30 16:57:58 +02:00
autoreconf -fvi
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
%configure \
--with-nss-lib=$NSS_LIB_DIR \
--with-nss-inc=$NSS_INCLUDE_DIR \
--with-nspr-lib=$NSPR_LIB_DIR \
--with-nspr-inc=$NSPR_INCLUDE_DIR \
Accepting request 851083 from home:pgajdos - use apache rpm macros OBS-URL: https://build.opensuse.org/request/show/851083 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=59
2020-11-26 14:44:48 +01:00
--with-apxs=%{apache_apxs} \
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
--enable-ecc \
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
--with-apr-config
make %{?_smp_mflags} all
%install
# The install target of the Makefile isn't used because that uses apxs
# which tries to enable the module in the build host httpd instead of in
# the build root.
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
mkdir -p %{buildroot}/%{apache_libexecdir}
mkdir -p %{buildroot}%{apache_sysconfdir}/conf.d
mkdir -p %{buildroot}%{apache_sysconfdir}/vhosts.d
mkdir -p %{buildroot}%{_sbindir}
mkdir -p %{buildroot}%{apache_sysconf_nssdir}
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
%if 0%{?suse_version}
perl -pi -e "s|\@apache_lib\@|%{_libdir}\/apache2|g" nss.conf
%endif
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
install -m 644 nss.conf %{buildroot}%{apache_sysconfdir}/conf.d/mod_nss.conf
install -m 644 %{SOURCE5} %{buildroot}%{apache_sysconfdir}/vhosts.d/vhost-nss.template
install -m 644 %{SOURCE2} %{buildroot}%{apache_sysconfdir}/listen_nss.conf
install -m 755 .libs/libmodnss.so %{buildroot}%{apache_libexecdir}/mod_nss.so
install -m 755 nss_pcache %{buildroot}%{_sbindir}/
install -m 755 gencert %{buildroot}%{_sbindir}/
install -m 755 migrate.pl %{buildroot}%{_sbindir}/mod_nss_migrate.pl
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
#ln -s $RPM_BUILD_ROOT/%%{apache_libexecdir}/libnssckbi.so $RPM_BUILD_ROOT%%{apache_sysconf_nssdir}/
Accepting request 588609 from home:vitezslav_cizek:branches:Apache:Modules - Update to 1.0.16 * Fix up some broken cipher strings from a bad merge - adjust distro detection, Tumbleweed has NSS 3.35, Leap 15 has 3.34 - drop 0001-Fix-up-some-broken-cipher-strings-from-a-bad-merge.patch (upstream) OBS-URL: https://build.opensuse.org/request/show/588609 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=42
2018-03-19 14:59:29 +01:00
%if 0%{?suse_version} <= 1500
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
touch %{buildroot}%{apache_sysconf_nssdir}/secmod.db
touch %{buildroot}%{apache_sysconf_nssdir}/cert8.db
touch %{buildroot}%{apache_sysconf_nssdir}/key3.db
Accepting request 584463 from home:vitezslav_cizek:branches:Apache:Modules - Since the update to NSS 3.35, the default NSS certificate database format changed from Berkley DB to SQLite - use %license tag - Update to 1.0.15 * Try to auto-detect the NSS database format if not specified * Update nss_pcache.8 man page to drop directory and prefix * When a token is configured in password file only authenticate once * Return an error when NSSPassPhraseDialog is invalid * Move 3DES ciphers down from HIGH to MEDIUM to match OpenSSL 1.0.2k+ * Add -Werror=implicit-function-declaration to CFLAGS * Handle group membership when testing for file permissions * NSS system-wide policy now disables SSLv3, don't use it in tests * Add missing error messages for libssl errors * Fix doc typo in SSL_[SERVER|CLIENT]_SAN_IPaddr env variable name * When including additional test config use specific extension * Fix the TLS Session ID cache * Make an invalid protocol setting fatal * Don't use same NSS db in nss_pcache as mod_nss, use NSS_NoDB_Init() * Add info log message when FIPS is enabled * Add AES-256 and drop DES, CAST128, SKIPJACK as wrapping key types * Fix removal of CR from PEM certificates * Add OCSP caching and timeout tuning knobs * Check the NSS database directory permissions as well as the files inside it for read access on startup. * Add in simple aliases for ciphers to fix those that don't follow the pattern (dhe_rsa_aes_128_sha256, dhe_rsa_aes_256_sha256) and those with typos (camelia_128_sha, camelia_256_sha) * Fix semaphore leak OBS-URL: https://build.opensuse.org/request/show/584463 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=40
2018-03-09 17:02:16 +01:00
%else
touch %{buildroot}%{apache_sysconf_nssdir}/pkcs11.txt
touch %{buildroot}%{apache_sysconf_nssdir}/cert9.db
touch %{buildroot}%{apache_sysconf_nssdir}/key4.db
%endif
Accepting request 536007 from home:vitezslav_cizek:branches:Apache:Modules - Use ss instead of the deprecated netstat in gencert (bsc#1064415) * add mod_nss-gencert_use_ss_instead_of_netstat.patch - spec: cleanup and fix URLs OBS-URL: https://build.opensuse.org/request/show/536007 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=32
2017-10-24 14:16:04 +02:00
touch %{buildroot}%{apache_sysconf_nssdir}/install.log
perl -pi -e "s:$NSS_LIB_DIR:$NSS_BIN:" %{buildroot}%{_sbindir}/gencert
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
%post
umask 077
Accepting request 584463 from home:vitezslav_cizek:branches:Apache:Modules - Since the update to NSS 3.35, the default NSS certificate database format changed from Berkley DB to SQLite - use %license tag - Update to 1.0.15 * Try to auto-detect the NSS database format if not specified * Update nss_pcache.8 man page to drop directory and prefix * When a token is configured in password file only authenticate once * Return an error when NSSPassPhraseDialog is invalid * Move 3DES ciphers down from HIGH to MEDIUM to match OpenSSL 1.0.2k+ * Add -Werror=implicit-function-declaration to CFLAGS * Handle group membership when testing for file permissions * NSS system-wide policy now disables SSLv3, don't use it in tests * Add missing error messages for libssl errors * Fix doc typo in SSL_[SERVER|CLIENT]_SAN_IPaddr env variable name * When including additional test config use specific extension * Fix the TLS Session ID cache * Make an invalid protocol setting fatal * Don't use same NSS db in nss_pcache as mod_nss, use NSS_NoDB_Init() * Add info log message when FIPS is enabled * Add AES-256 and drop DES, CAST128, SKIPJACK as wrapping key types * Fix removal of CR from PEM certificates * Add OCSP caching and timeout tuning knobs * Check the NSS database directory permissions as well as the files inside it for read access on startup. * Add in simple aliases for ciphers to fix those that don't follow the pattern (dhe_rsa_aes_128_sha256, dhe_rsa_aes_256_sha256) and those with typos (camelia_128_sha, camelia_256_sha) * Fix semaphore leak OBS-URL: https://build.opensuse.org/request/show/584463 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=40
2018-03-09 17:02:16 +01:00
# generate a self-signed certificate if there isn't either
# key3.db (old DBM format) or key4.db (new SQLite format)
if [ ! -e %{apache_sysconf_nssdir}/key3.db -a ! -e %{apache_sysconf_nssdir}/key4.db ]; then
Accepting request 427944 from home:vitezslav_cizek:branches:Apache:Modules - don't disable SSLV2, because it doesn't work with NSS 3.24 (boo#993642) * add mod_nss-dont_disable_SSLV2.patch - remove deprecated NSSSessionCacheTimeout option from mod_nss.conf.in (bsc#998176) - change ownership of the gencert generated NSS database so apache can read it (bsc#998180) * add mod_nss-gencert-correct-ownership.patch - use correct configuration path in mod_nss.conf.in (bsc#996282) - remove %post migration code from the old alias directory - generate dummy certificates if there aren't any in mod_nss.d OBS-URL: https://build.opensuse.org/request/show/427944 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=28
2016-09-16 09:23:46 +02:00
%{_sbindir}/gencert %{apache_sysconf_nssdir} > %{apache_sysconf_nssdir}/install.log 2>&1
echo ""
echo "%{name} certificate database generated."
echo ""
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
fi
Accepting request 427944 from home:vitezslav_cizek:branches:Apache:Modules - don't disable SSLV2, because it doesn't work with NSS 3.24 (boo#993642) * add mod_nss-dont_disable_SSLV2.patch - remove deprecated NSSSessionCacheTimeout option from mod_nss.conf.in (bsc#998176) - change ownership of the gencert generated NSS database so apache can read it (bsc#998180) * add mod_nss-gencert-correct-ownership.patch - use correct configuration path in mod_nss.conf.in (bsc#996282) - remove %post migration code from the old alias directory - generate dummy certificates if there aren't any in mod_nss.d OBS-URL: https://build.opensuse.org/request/show/427944 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=28
2016-09-16 09:23:46 +02:00
# Make sure that the database ownership is setup properly.
Accepting request 431310 from home:jengelh:branches:Apache:Modules - Avoid changing permissions through symlinks OBS-URL: https://build.opensuse.org/request/show/431310 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=30
2016-10-06 10:55:55 +02:00
find %{apache_sysconf_nssdir} -user root -name "*.db" -exec /bin/chgrp -h www {} +
find %{apache_sysconf_nssdir} -user root -name "*.db" ! -type l -exec /bin/chmod 640 {} +
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
%files
Accepting request 584463 from home:vitezslav_cizek:branches:Apache:Modules - Since the update to NSS 3.35, the default NSS certificate database format changed from Berkley DB to SQLite - use %license tag - Update to 1.0.15 * Try to auto-detect the NSS database format if not specified * Update nss_pcache.8 man page to drop directory and prefix * When a token is configured in password file only authenticate once * Return an error when NSSPassPhraseDialog is invalid * Move 3DES ciphers down from HIGH to MEDIUM to match OpenSSL 1.0.2k+ * Add -Werror=implicit-function-declaration to CFLAGS * Handle group membership when testing for file permissions * NSS system-wide policy now disables SSLv3, don't use it in tests * Add missing error messages for libssl errors * Fix doc typo in SSL_[SERVER|CLIENT]_SAN_IPaddr env variable name * When including additional test config use specific extension * Fix the TLS Session ID cache * Make an invalid protocol setting fatal * Don't use same NSS db in nss_pcache as mod_nss, use NSS_NoDB_Init() * Add info log message when FIPS is enabled * Add AES-256 and drop DES, CAST128, SKIPJACK as wrapping key types * Fix removal of CR from PEM certificates * Add OCSP caching and timeout tuning knobs * Check the NSS database directory permissions as well as the files inside it for read access on startup. * Add in simple aliases for ciphers to fix those that don't follow the pattern (dhe_rsa_aes_128_sha256, dhe_rsa_aes_256_sha256) and those with typos (camelia_128_sha, camelia_256_sha) * Fix semaphore leak OBS-URL: https://build.opensuse.org/request/show/584463 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=40
2018-03-09 17:02:16 +01:00
%license LICENSE
%doc README docs/mod_nss.html README-SUSE.txt
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
%config(noreplace) %{apache_sysconfdir}/conf.d/mod_nss.conf
Accepting request 242385 from home:draht:branches:mozilla:Factory - mod_nss-bnc863518-reopen_dev_tty.diff: close(0) and open("/dev/tty", ...) to make sure that stdin can be read from. startproc may inherit wrongly opened file descriptors to httpd. (Note: An analogous fix exists in startproc(8), too.) [bnc#863518] - VirtualHost part in /etc/apache2/conf.d/mod_nss.conf is now externalized to /etc/apache2/conf.d/vhost-nss.template and not activated/read by default. [bnc#878681] - NSSCipherSuite update following additional ciphers of Feb 18 change. [bnc#878681] - mod_nss-SNI-callback.patch, mod_nss-SNI-checks.patch: server side SNI was not implemented when mod_nss was made; patches implement SNI with checks if SNI provided hostname equals Host: field in http request header. OBS-URL: https://build.opensuse.org/request/show/242385 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=10
2014-07-25 16:00:54 +02:00
%config(noreplace) %{apache_sysconfdir}/vhosts.d/vhost-nss.template
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
%config(noreplace) %{apache_sysconfdir}/listen_nss.conf
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
%dir %{apache_libexecdir}
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
%{apache_libexecdir}/mod_nss.so
%dir %{apache_sysconf_nssdir}/
Accepting request 588609 from home:vitezslav_cizek:branches:Apache:Modules - Update to 1.0.16 * Fix up some broken cipher strings from a bad merge - adjust distro detection, Tumbleweed has NSS 3.35, Leap 15 has 3.34 - drop 0001-Fix-up-some-broken-cipher-strings-from-a-bad-merge.patch (upstream) OBS-URL: https://build.opensuse.org/request/show/588609 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=42
2018-03-19 14:59:29 +01:00
%if 0%{?suse_version} <= 1500
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
%ghost %attr(0640,root,www) %config(noreplace) %{apache_sysconf_nssdir}/secmod.db
%ghost %attr(0640,root,www) %config(noreplace) %{apache_sysconf_nssdir}/cert8.db
%ghost %attr(0640,root,www) %config(noreplace) %{apache_sysconf_nssdir}/key3.db
Accepting request 584463 from home:vitezslav_cizek:branches:Apache:Modules - Since the update to NSS 3.35, the default NSS certificate database format changed from Berkley DB to SQLite - use %license tag - Update to 1.0.15 * Try to auto-detect the NSS database format if not specified * Update nss_pcache.8 man page to drop directory and prefix * When a token is configured in password file only authenticate once * Return an error when NSSPassPhraseDialog is invalid * Move 3DES ciphers down from HIGH to MEDIUM to match OpenSSL 1.0.2k+ * Add -Werror=implicit-function-declaration to CFLAGS * Handle group membership when testing for file permissions * NSS system-wide policy now disables SSLv3, don't use it in tests * Add missing error messages for libssl errors * Fix doc typo in SSL_[SERVER|CLIENT]_SAN_IPaddr env variable name * When including additional test config use specific extension * Fix the TLS Session ID cache * Make an invalid protocol setting fatal * Don't use same NSS db in nss_pcache as mod_nss, use NSS_NoDB_Init() * Add info log message when FIPS is enabled * Add AES-256 and drop DES, CAST128, SKIPJACK as wrapping key types * Fix removal of CR from PEM certificates * Add OCSP caching and timeout tuning knobs * Check the NSS database directory permissions as well as the files inside it for read access on startup. * Add in simple aliases for ciphers to fix those that don't follow the pattern (dhe_rsa_aes_128_sha256, dhe_rsa_aes_256_sha256) and those with typos (camelia_128_sha, camelia_256_sha) * Fix semaphore leak OBS-URL: https://build.opensuse.org/request/show/584463 OBS-URL: https://build.opensuse.org/package/show/Apache:Modules/apache2-mod_nss?expand=0&rev=40
2018-03-09 17:02:16 +01:00
%else
%ghost %attr(0640,root,www) %config(noreplace) %{apache_sysconf_nssdir}/pkcs11.txt
%ghost %attr(0640,root,www) %config(noreplace) %{apache_sysconf_nssdir}/cert9.db
%ghost %attr(0640,root,www) %config(noreplace) %{apache_sysconf_nssdir}/key4.db
%endif
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
%ghost %config(noreplace) %{apache_sysconf_nssdir}/install.log
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
%{_sbindir}/nss_pcache
%{_sbindir}/gencert
Accepting request 222758 from home:draht:branches:mozilla:Factory - mod_nss-cipherlist_update_for_tls12-doc.diff mod_nss-cipherlist_update_for_tls12.diff GCM mode and Camellia ciphers added to the supported ciphers list. The additional ciphers are: rsa_aes_128_gcm_sha == TLS_RSA_WITH_AES_128_GCM_SHA256 rsa_camellia_128_sha == TLS_RSA_WITH_CAMELLIA_128_CBC_SHA rsa_camellia_256_sha == TLS_RSA_WITH_CAMELLIA_256_CBC_SHA ecdh_ecdsa_aes_128_gcm_sha == TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 ecdhe_ecdsa_aes_128_gcm_sha == TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ecdh_rsa_aes_128_gcm_sha == TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 ecdhe_rsa_aes_128_gcm_sha == TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [bnc#863035] - mod_nss-CVE-2013-4566-NSSVerifyClient.diff fixes CVE-2013-4566: If 'NSSVerifyClient none' is set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication is expected to be required for a specific directory via 'NSSVerifyClient require' setting, mod_nss fails to properly require certificate authentication. Remote attacker can use this to access content of the restricted directories. [bnc#853039] - glue documentation added to /etc/apache2/conf.d/mod_nss.conf: * simultaneaous usage of mod_ssl and mod_nss * SNI concurrency * SUSE framework for apache configuration, Listen directive * module initialization - mod_nss-conf.patch obsoleted by scratch-version of nss.conf.in or mod_nss.conf, respectively. This also leads to the removal of OBS-URL: https://build.opensuse.org/request/show/222758 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=8
2014-02-20 22:12:44 +01:00
%{_sbindir}/mod_nss_migrate.pl
osc copypac from project:mozilla package:apache2-mod_nss revision:4 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/apache2-mod_nss?expand=0&rev=1
2013-07-11 18:44:28 +02:00
%changelog
Copy Permalink