Hacking NSS: Difference between revisions

From Libreswan
Jump to navigation Jump to search
(simplify building NSS fromscratch)
(RPM tweaks)
Line 11: Line 11:
Here, we use the <tt>build</tt> machine (it has lots of memory and network access) and the 9p mounted directory <tt>/pool</tt> (aka <tt>$(KVM_POOLDIR)</tt>, but /testing and /root should also work).  Just remember that any changes to build aren't permanent, we'll get to that later.
Here, we use the <tt>build</tt> machine (it has lots of memory and network access) and the 9p mounted directory <tt>/pool</tt> (aka <tt>$(KVM_POOLDIR)</tt>, but /testing and /root should also work).  Just remember that any changes to build aren't permanent, we'll get to that later.


First lets set things up:
Prepare the machine (<tt>xmlto</tt> is hacked so that it doesn't try to preserve permissions when copying files within the 9p file system):
  $ ./kvm sh build
  $ ./kvm sh build
build# dnf install -y fedpkg
build# dnf builddep nss
build# sed -i -e 's/ -p / /' \
    /usr/share/xmlto/format/docbook/man \
    /usr/share/xmlto/format/docbook/html
Get the sources (drop <tt>--branch f32</tt> if trying to build rawhide):
  build# cd /pool
  build# cd /pool
build# dnf install -y fedpkg
  build# cat /etc/fedora-release
  build# cat /etc/fedora-release
  Fedora release 32 (Thirty Two)
  Fedora release 32 (Thirty Two)
  build# fedpkg clone --branch f32 --anonymous nss
  build# fedpkg clone --branch f32 --anonymous nss
  build# cd nss
  build# cd nss
build# dnf builddep nss


Hack <tt>xmlto</tt> so that it doesn't try to preserve permissions when copying files within the 9p file system (remember, <tt>./kvm uninstall install</tt> will wipe this):
hack <tt>nss.spec</tt>so that it has a unique suffix, and check result:
build# sed -i -e 's/ -p / /' \
  build# sed -i -e '/Release:/ s/\([0-9]*\)%/\1lsw%/' nss.spec
    /usr/share/xmlto/format/docbook/man \
    /usr/share/xmlto/format/docbook/html
 
hack <tt>nss.spec</tt>so that it has a unique suffix:
  build# sed -i -e '/Release:/ s/\([0-9]*\)%/\1_lsw%/' nss.spec
  build# fedpkg verrel
  build# fedpkg verrel
  nss-3.63.0-1_lsw.fc32
  nss-3.63.0-1lsw.fc32
if <tt>fedpkg verrel</tt> fails more hacks may be required.


hobble running tests during the build (optional):
hobble running tests during the build (optional):
Line 85: Line 86:


Prepare the machine (<tt>xmlto</tt> is hacked so that it doesn't try to preserve permissions when copying files within the 9p file system):
Prepare the machine (<tt>xmlto</tt> is hacked so that it doesn't try to preserve permissions when copying files within the 9p file system):
$ ./kvm sh build
  build# dnf builddep -y nss
  build# dnf builddep -y nss
  build# dnf install -y hg python gyp ninja-build
  build# dnf install -y hg python gyp ninja-build

Revision as of 21:30, 29 October 2021

Using NSS from Pluto

use lsw_nss_error*() to report errors

It includes both the error symbol name and the error message (the former is really useful when reading the code^D^D^D^D documentation when tracking down why the error was returned).

Building Libreswan using custom NSS RPMs

Building NSS RPMs on the guest

Here, we use the build machine (it has lots of memory and network access) and the 9p mounted directory /pool (aka $(KVM_POOLDIR), but /testing and /root should also work). Just remember that any changes to build aren't permanent, we'll get to that later.

Prepare the machine (xmlto is hacked so that it doesn't try to preserve permissions when copying files within the 9p file system):

$ ./kvm sh build
build# dnf install -y fedpkg
build# dnf builddep nss
build# sed -i -e 's/ -p / /' \
   /usr/share/xmlto/format/docbook/man \
   /usr/share/xmlto/format/docbook/html

Get the sources (drop --branch f32 if trying to build rawhide):

build# cd /pool
build# cat /etc/fedora-release
Fedora release 32 (Thirty Two)
build# fedpkg clone --branch f32 --anonymous nss
build# cd nss

hack nss.specso that it has a unique suffix, and check result:

build# sed -i -e '/Release:/ s/\([0-9]*\)%/\1lsw%/' nss.spec
build# fedpkg verrel
nss-3.63.0-1lsw.fc32

if fedpkg verrel fails more hacks may be required.

hobble running tests during the build (optional):

build# sed -i -e 's/bcond_without tests/bcond_with tests/' nss.spec

finally build:

build# fedpkg local --without tests:

or:

build# fedpkg prep --without tests
build# fedpkg compile --short-circuit --without tests

the RPMs are under x86_64.

Building NSS RPMs on the host

Hmm, something goes here!

fedpkg mock-config
fedpkg mockbuild

Installing the NSS RPMs (and making them stick)

The NSS RPMs can either be installed manually on build (which means they only stick around until ./kvm uninstall), or they can be made more permenant by installing them into the base domain.

To install the RPMs on the base domain, add the following lines to Makefile.inc.local:

# Prepend the directory containing the RPMs, include /
KVM_NSS_RPMDIR = /pool/nss/x86_64/
# Append the actual RPM version
KVM_NSS_VERSION = -3.63.0-1_lsw.fc32.x86_64.rpm

and then upgrade the base domain:

$ ./kvm upgrade
...
 Upgrading        : nss-util-3.63.0-1_lsw.fc32.x86_64                     1/20 
...

finally, confirm:

$ ./kvm install
$ ./kvm sh east
east# rpm -q nss
nss-3.63.0-1_lsw.fc32.x86_64

If needed, the the customized domains can be reverted. In Makefile.inc.local, comment out the lines added above, and then run:

$ ./kvm downgrade
$ ./kvm upgrade
...
 Installing       : nss-util-3.63.0-1.fc32.x86_64                       13/330 

Distributing Custom NSS RPMs

Tar up both the .rpm and .srpm files into a single archive and make that available. That way, who ever downloads the archive always gets the source code.

Building Libreswan using a scratch NSS+NSPR build

Scratch building NSS+NSPR

Prepare the machine (xmlto is hacked so that it doesn't try to preserve permissions when copying files within the 9p file system):

$ ./kvm sh build
build# dnf builddep -y nss
build# dnf install -y hg python gyp ninja-build
build# sed -i -e 's/ -p / /' \
   /usr/share/xmlto/format/docbook/man \
   /usr/share/xmlto/format/docbook/html

Download and build using Building NSS as a guide:

build# cd /source
build# hg clone https://hg.mozilla.org/projects/nspr
build# hg clone https://hg.mozilla.org/projects/nss
build# ./nss/build.sh --enable-libpkix

testing (for comparison, NSS build farm):

build# HOST=localhost DOMSUF=localdomain USE_64=1 nss/tests/all.sh

however, of most interest is PKIX:

( cd nss/tests/cert/ ; USE_64=1 NSS_ENABLE_PKIX_VERIFY=1 DOMSUF=localdomain ./cert.sh )

Linking with libreswan

finally, to link nss against the build, add the following to Makefile.inc.local (how correct is this?):

KVM_NSS_CFLAGS = -I/source/nspr/Debug/dist/include/nspr -I/source/dist/public/nss
KVM_NSS_LDFLAGS = -L/source/dist/Debug/lib/ -Wl,-rpath,/source/dist/Debug/lib/ -lnss3

and then build as per normal:

$ ./kvm install check

and confirm it worked:

$ ./kvm sh east
cat /proc/$(pgrep pluto)/maps | grep nss

Debugging NSS

NSS_ENABLE_PKIX_VERIFY=1 LD_LIBRARY_PATH=$(cd ../dist/Debug/lib && pwd) gdb --args $(cd ../dist/Debug/bin && pwd)/certutil -V -n PasswordCert -u S -d ../tests_results/security/build.1/dbpass
(gdb) break PKIX_Shutdown
(gdb) break cert_VerifyCertChainPkix