From 94959de39ec080e3d0c70d7cf4f99b37aa5a2a57 Mon Sep 17 00:00:00 2001
From: Dan Horak <dan@danny.cz>
Date: Thu, 15 May 2008 12:03:49 +0200
Subject: [PATCH] add NSS initialization, conditionalize the ssl dir


diff --git a/ssl/Makefile.am b/ssl/Makefile.am
index f8fcca7..81306b0 100644
--- a/ssl/Makefile.am
+++ b/ssl/Makefile.am
@@ -11,11 +11,19 @@
 MAINTAINERCLEANFILES 	= Makefile.in
 
 INCLUDES		= @OPENHPI_INCLUDES@
+if HAVE_NSS
+INCLUDES		+= @NSS_INCLUDES@
+endif
 
 lib_LTLIBRARIES		= libopenhpi_ssl.la
 
 EXTRA_DIST = oh_ssl.h
 
+if HAVE_OPENSSL
 libopenhpi_ssl_la_SOURCES = oh_ssl.c
+endif
+if HAVE_NSS
+libopenhpi_ssl_la_SOURCES = oh_nss.c
+endif
 
 libopenhpi_ssl_la_LDFLAGS = -version-info @HPI_LIB_VERSION@
diff --git a/ssl/oh_nss.c b/ssl/oh_nss.c
new file mode 100644
index 0000000..1d9209a
--- /dev/null
+++ b/ssl/oh_nss.c
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2008, Red Hat Inc.
+ *		       All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or
+ * without modification, are permitted provided that the following
+ * conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the distribution.
+ *
+ * Neither the name of the Red Hat Inc., nor the names
+ * of its contributors may be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
+ * OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * Author(s)
+ *     Dan Horak <dhorak@redhat.com>
+ *
+ *
+ * This file implements NSS initialization and SSL connection management
+ * functionality such as open, close, send, and receive.
+ *
+ * The initialization is done here and called by the OpenHPI infrastructure,
+ * so that individual modules and plugins don't have to worry about any
+ * global NSS initialization.  Some of this initialization can only be
+ * done once, so this is the best place for it.
+ *
+ * NSS is a complex library, and the code to reliably communicate over
+ * an SSL channel includes a number of subtle factors.  Rather than having
+ * each plug-in duplicate the effort to get this right, it's easier to
+ * centralize SSL communication support in this library.
+ *
+ * The following functions are provided:
+ *
+ * oh_ssl_init()		- Intializes the NSS library (called by the
+ * 				  OpenHPI infrastructure only)
+ * oh_ssl_ctx_init()            - Creates a new SSL_CTX object
+ * oh_ssl_ctx_free()            - Free an SSL_CTX object
+ * oh_ssl_connect()             - Create and open a new ssl conection
+ * oh_ssl_disconnect()          - Close and free an SSL connection
+ * oh_ssl_read()                - Read from an SSL connection
+ * oh_ssl_write()               - Write to an SSL connection
+ */
+
+
+/* NSS and other header files */
+#include <unistd.h>
+#include <string.h>
+#include <sys/select.h>
+#include <oh_ssl.h>
+#include <oh_error.h>
+
+
+/* Global (static) data for this module */
+static int      oh_ssl_init_done = 0;   /* Will be set true when done */
+
+/**
+ * oh_ssl_init
+ *
+ * Intialize the NSS library.  Note that the calls used in this routine
+ * set up global data and are only to be called once for an SSL-based program.
+ * To enforce this while allowing multiple callers (plugins) to initialize
+ * the library, we use a static global variable to mark when we've done the
+ * initialization.
+ *
+ * Note that the thread-safe initialization portion requires that
+ * g_thread_init() has already been called, so don't call this routine
+ * before then.
+ *
+ * Return value: 0 for success, -1 for failure
+ **/
+int		oh_ssl_init(void)
+{
+	if (! oh_ssl_init_done) {	/* Do this only once */
+		oh_ssl_init_done = 1;
+
+		/* Initialize the NSS library */
+		if (NSS_NoDB_Init(".") != SECSuccess) {
+			err("NSS_NoDB_Init() failed");
+			return(-1);
+		}
+	}
+
+	return(0);			/* Successful return */
+}
diff --git a/ssl/oh_ssl.h b/ssl/oh_ssl.h
index 5ae01ac..ebffb90 100644
--- a/ssl/oh_ssl.h
+++ b/ssl/oh_ssl.h
@@ -48,12 +48,14 @@
 
 /* Include files */
 #include <config.h>
-#ifdef HAVE_OPENSSL
+#if defined(HAVE_OPENSSL)
 #include <openssl/bio.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 #include <openssl/rand.h>
 #include <openssl/x509v3.h>
+#elif defined(HAVE_NSS)
+#include <nss.h>
 #endif
 
 
-- 
1.5.4.1

