Better libk5crypto NSS fork safety

Use SECMOD_RestartModules() from the forthcoming NSS 3.12.9 release to
make the libk5crypto back end work after a fork.  Add a test program
to exercise fork detection in the NSS back end.  Add a configure-time
version check to ensure that we're using NSS 3.12.9 or later.

ticket: 6810
target_version:	1.9
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24470 dc483132-0cff-0310-8789-dd5450dbe970

1 files changed, 6 insertions, 4 deletions

diff --git a/src/lib/crypto/nss/enc_provider/enc_gen.c b/src/lib/crypto/nss/enc_provider/enc_gen.c
index 3edf3fc72..6bdf1d0f9 100644
--- a/src/lib/crypto/nss/enc_provider/enc_gen.c
+++ b/src/lib/crypto/nss/enc_provider/enc_gen.c
@@ -39,6 +39,7 @@
 #include "rand2key.h"
 #include "aead.h"
 #include "seccomon.h"
+#include "secmod.h"
 #include "pk11pub.h"
 #include "nss.h"
 
@@ -111,14 +112,15 @@ k5_nss_init(void)
         /* Do nothing if the existing context is still good. */
         if (k5_nss_pid == pid)
             goto cleanup;
-
-        /* We've forked since the last init, and need to reinitialize. */
-        rv = NSS_ShutdownContext(k5_nss_ctx);
-        k5_nss_ctx = NULL;
+        /* The caller has forked.  Restart the NSS modules.  This will
+         * invalidate all of our PKCS11 handles, which we're prepared for. */
+        rv = SECMOD_RestartModules(TRUE);
         if (rv != SECSuccess) {
             ret = k5_nss_map_last_error();
             goto cleanup;
         }
+        k5_nss_pid = pid;
+        goto cleanup;
     }
     k5_nss_ctx = NSS_InitContext(NSS_KRB5_CONFIGDIR, "", "", "", NULL, flags);
     if (k5_nss_ctx == NULL) {