Changeset 59e66ff

Timestamp:

2014-07-24T03:51:07Z (10 years ago)

Author:

dequis <dx@…>

Branches:

master

Children:

632627e

Parents:

269580c

Message:

Fix the NSS init after fork bug, and clean up lies in unix.c

This might look like a simple diff, but those 'lies' made this not very
straightforward.

The NSS bug itself is simple: NSS detects a fork happened after the
initialization, and refuses to work because shared CSPRNG state is bad.
The bug has been around for long time. I've been aware of it for 5
months, which says something about this mess. Trac link:

​http://bugs.bitlbee.org/bitlbee/ticket/785

This wasn't a big deal because the main users of NSS (redhat) already
applied a different patch in their packages that workarounded the issue
somewhat accidentally. And this is the ticket for the 'lies' in unix.c:

​http://bugs.bitlbee.org/bitlbee/ticket/1159

Basically a conflict with libotr that doesn't happen anymore. Read that
ticket for details on why ignoring those comments is acceptable.

Anyway: yay!

Files:

• irc.c (modified) (2 diffs)
• unix.c (modified) (2 diffs)

irc.c

@@ -27 +27 @@
 #include "ipc.h"
 #include "dcc.h"
+#include "lib/ssl_client.h"
 
 GSList *irc_connection_list;
@@ -171 +172 @@
         nogaim_init();
 #endif
+
+        /* SSL library initialization also should be done after the fork, to
+           avoid shared CSPRNG state. This is required by NSS, which refuses to
+           work if a fork is detected */
+        ssl_init();
         
         for( l = irc_plugins; l; l = l->next )

unix.c

@@ -32 +32 @@
 #include "help.h"
 #include "ipc.h"
-#include "lib/ssl_client.h"
 #include "md5.h"
 #include "misc.h"
@@ -82 +81 @@
 #endif
         
-        /* Ugly Note: libotr and gnutls both use libgcrypt. libgcrypt
-           has a process-global config state whose initialization happpens
-           twice if libotr and gnutls are used together. libotr installs custom
-           memory management functions for libgcrypt while our gnutls module
-           uses the defaults. Therefore we initialize OTR after SSL. *sigh* */
-        ssl_init();
 #ifdef OTR_BI
         otr_init();
 #endif
-        /* And in case OTR is loaded as a plugin, it'll also get loaded after
-           this point. */
         
         srand( time( NULL ) ^ getpid() );