Make sure that pkinit_octetstring_hkdf() inits NSS

Create an NSS context for use when performing KDF, so that the tests,
which call into the function directly, will work.

diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
index 9a36df5c2895e4e7711dd73433530187681327b6..c1e654ad910a18fa5a84fb764cf268bfdac76e77 100644 (file)
--- a/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_nss.c
@@ -3702,6 +3702,7 @@ pkinit_octetstring_hkdf(krb5_context context,
     size_t kbyte, klength;
     krb5_data rnd_data;
     krb5_error_code result;
+    NSSInitContext *ncontext;
 
     if (counter_length > sizeof(counter))
         return EINVAL;
@@ -3717,6 +3718,17 @@ pkinit_octetstring_hkdf(krb5_context context,
         counter[i] = (counter_start >> (8 * (counter_length - 1 - i))) & 0xff;
     rnd_len = kbyte;
     left = rnd_len;
+    ncontext = NSS_InitContext(DEFAULT_CONFIGDIR,
+                               NULL,
+                               NULL,
+                               NULL,
+                               NULL,
+                               NSS_INIT_READONLY |
+                               NSS_INIT_NOCERTDB |
+                               NSS_INIT_NOMODDB |
+                               NSS_INIT_FORCEOPEN |
+                               NSS_INIT_NOROOTINIT |
+                               NSS_INIT_PK11RELOAD);
     while (left > 0) {
         ctx = PK11_CreateDigestContext(hash_alg);
         if (ctx == NULL) {
@@ -3775,6 +3787,9 @@ pkinit_octetstring_hkdf(krb5_context context,
         }
     }
 
+    if (NSS_ShutdownContext(ncontext) != SECSuccess)
+        pkiDebug("%s: error shutting down context\n", __FUNCTION__);
+
     krb5key->contents = malloc(klength);
     if (krb5key->contents == NULL) {
         krb5key->length = 0;