From e10d253e44e4541a0030b041bdc430f416defcb3 Mon Sep 17 00:00:00 2001
From: Mike Perry <mikeperry-git@torproject.org>
Date: Tue, 4 Dec 2012 15:51:07 -0800
Subject: [PATCH 03/41] Make Intermediate Cert Store memory-only.

This patch makes the intermediate SSL cert store exist in memory only.

The pref must be set before startup in prefs.js.
https://trac.torproject.org/projects/tor/ticket/2949
---
 security/manager/ssl/src/nsNSSComponent.cpp | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/security/manager/ssl/src/nsNSSComponent.cpp b/security/manager/ssl/src/nsNSSComponent.cpp
index c9205bc..159985c 100644
--- a/security/manager/ssl/src/nsNSSComponent.cpp
+++ b/security/manager/ssl/src/nsNSSComponent.cpp
@@ -1736,8 +1736,21 @@ nsNSSComponent::InitializeNSS(bool showWarningBox)
     // Ubuntu 8.04, which loads any nonexistent "<configdir>/libnssckbi.so" as
     // "/usr/lib/nss/libnssckbi.so".
     uint32_t init_flags = NSS_INIT_NOROOTINIT | NSS_INIT_OPTIMIZESPACE;
-    SECStatus init_rv = ::NSS_Initialize(profileStr.get(), "", "",
-                                         SECMOD_DB, init_flags);
+    bool nocertdb = false;
+    mPrefBranch->GetBoolPref("security.nocertdb", &nocertdb);
+
+    // XXX: We can also do the the following to only disable the certdb.
+    // Leaving this codepath in as a fallback in case InitNODB fails
+    if (nocertdb)
+      init_flags |= NSS_INIT_NOCERTDB;
+
+    SECStatus init_rv;
+    if (nocertdb) {
+        init_rv = ::NSS_NoDB_Init(NULL);
+    } else {
+        init_rv = ::NSS_Initialize(profileStr.get(), "", "",
+                                          SECMOD_DB, init_flags);
+    }
 
     if (init_rv != SECSuccess) {
       PR_LOG(gPIPNSSLog, PR_LOG_DEBUG, ("can not init NSS r/w in %s\n", profileStr.get()));
-- 
1.8.1.2

