admserv/cgi-src40/security.c | 76 ++++++++++++++++++++++++++++++++++---------
1 file changed, 61 insertions(+), 15 deletions(-)
New commits:
commit 814b7ecc9e245171a9abfcc17be8b9aa1f3fd047
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Tue Jun 28 17:34:45 2011 -0600
Bug 710372 - Not able to open the Manage Certificate from DS-console
https://bugzilla.redhat.com/show_bug.cgi?id=710372
Resolves: bug 710372
Bug Description: Not able to open the Manage Certificate from DS-console
Reviewed by: nkinder (Thanks!)
Branch: master
Fix Description: NSS_Initialize fails to open the cert db for the specified
directory server because NSS_Shutdown failed. That failed because of a
memory leak in openldap using moznss:
http://www.openldap.org/its/index.cgi?findid=6980
and
https://bugzilla.redhat.com/show_bug.cgi?id=717730
The workaround is to use a new NSS InitContext to open the key/cert db.
Platforms tested: RHEL6 x86_64
Flag Day: no
Doc impact: no
diff --git a/admserv/cgi-src40/security.c b/admserv/cgi-src40/security.c
index ce84a81..093655c 100644
--- a/admserv/cgi-src40/security.c
+++ b/admserv/cgi-src40/security.c
@@ -115,6 +115,7 @@ extern "C" {
int expired = 0;
CERTCertDBHandle *certdb = NULL;
char line[BIG_LINE];
+static NSSInitContext *secctx = NULL;
static char *securitydir; /* based on the sie - security dir for ds or as */
@@ -233,10 +234,18 @@ static char * getParameter(char *key, char *keyName) {
return get_cgi_var(key, getResourceString(DBT_PARAMETERMISSING), line);
}
-static void closeAllSecurityDB() {
+static void closeAllSecurityDB(int global) {
/* close all db */
- SSL_ClearSessionCache();
- NSS_Shutdown();
+ if (NSS_IsInitialized()) {
+ SSL_ClearSessionCache();
+ }
+ if (secctx) {
+ NSS_ShutdownContext(secctx);
+ secctx = NULL;
+ }
+ if (global) {
+ NSS_Shutdown();
+ }
}
static void errorAllocateMem() {
@@ -247,7 +256,7 @@ static void errorAllocateMem() {
}
static void errorRpt(int type, char* detailInfo) {
- closeAllSecurityDB();
+ closeAllSecurityDB(1);
rpt_err(type,
getResourceString(DBT_ERROR_OCCURED),
detailInfo,
@@ -255,7 +264,7 @@ static void errorRpt(int type, char* detailInfo) {
}
static void errorRptExtended(int type, char* detail, char* extra) {
- closeAllSecurityDB();
+ closeAllSecurityDB(1);
rpt_err(type,
getResourceString(DBT_ERROR_OCCURED),
detail,
@@ -455,8 +464,20 @@ getSecurityDir(AdmldapInfo info, const char *sie)
return PL_strdup(util_get_security_dir()); /* same as admin server security dir */
}
+#ifdef DUMP_CACHE_INFO
+ if (NSS_IsInitialized()) {
+ printf("nss_DumpCertificateCacheInfo 6\n");
+ nss_DumpCertificateCacheInfo();
+ }
+#endif
/* create pset with this dn */
pset = psetCreateSSL((char *)sie, configdir, NULL, NULL, &rval);
+#ifdef DUMP_CACHE_INFO
+ if (NSS_IsInitialized()) {
+ printf("nss_DumpCertificateCacheInfo 7\n");
+ nss_DumpCertificateCacheInfo();
+ }
+#endif
if (pset && ((rval == PSET_OP_OK) || (rval == PSET_LOCAL_OPEN_FAIL))) { /* only
admin-serv uses local file */
securitydir = psetGetAttrSingleValue(pset,
"configuration.encryption.certdir", &rval);
if (!securitydir && util_psetHasObjectClass(pset, DSOBJECTCLASS)) {
@@ -496,8 +517,20 @@ getSecurityDir(AdmldapInfo info, const char *sie)
}
psetDelete(pset);
+#ifdef DUMP_CACHE_INFO
+ if (NSS_IsInitialized()) {
+ printf("nss_DumpCertificateCacheInfo 8\n");
+ nss_DumpCertificateCacheInfo();
+ }
+#endif
pset = psetRealCreateSSL(info, host, port, security, DSCONFIGENTRY,
binddn, bindpw, NULL, &rval);
+#ifdef DUMP_CACHE_INFO
+ if (NSS_IsInitialized()) {
+ printf("nss_DumpCertificateCacheInfo 9\n");
+ nss_DumpCertificateCacheInfo();
+ }
+#endif
securitydir = psetGetAttrSingleValue(pset, DSSECURITYDIR, &rval);
PL_strfree(host);
PL_strfree(sport);
@@ -511,7 +544,12 @@ getSecurityDir(AdmldapInfo info, const char *sie)
}
}
psetDelete(pset);
-
+#ifdef DUMP_CACHE_INFO
+ if (NSS_IsInitialized()) {
+ printf("nss_DumpCertificateCacheInfo 10\n");
+ nss_DumpCertificateCacheInfo();
+ }
+#endif
return securitydir;
}
@@ -980,17 +1018,18 @@ static void setTrust(char *certFingerprint, int trust) {
static void securityInitialization(char* securitydir) {
PRUint32 flags = 0;
- char *db_name;
int const minPwdLen = 8;
int const pwdRequired = 1;
+ NSSInitParameters initParams;
- /* PKSC11 module must be configured before NSS is initialized */
- db_name = strdup("internal (software) ");
- PK11_ConfigurePKCS11(NULL,NULL,NULL,db_name,NULL,NULL,NULL,NULL,
- minPwdLen, pwdRequired);
+ memset(&initParams, 0, sizeof(initParams));
+ initParams.length = sizeof(initParams);
+ initParams.dbTokenDescription = strdup("internal (software) ");
+ initParams.minPWLen = minPwdLen;
+ initParams.passwordRequired = pwdRequired;
/* init NSS */
- if (NSS_Initialize(securitydir, NULL, NULL, SECMOD_DB, flags)) {
+ if (!(secctx = NSS_InitContext(securitydir, NULL, NULL, SECMOD_DB, &initParams,
flags))) {
rpt_err(GENERAL_FAILURE,
getResourceString(DBT_INTERNAL_ERROR),
getResourceString(DBT_OPEN_CERTDB_FAIL),
@@ -1454,7 +1493,7 @@ installCACert(char *tokenName, char *certname)
getResourceString(DBT_INSTALL_FAIL), line);
}
- if(NULL == PK11_FindCertInSlot(slot, cert, NULL)) {
+ if(CK_INVALID_HANDLE == PK11_FindCertInSlot(slot, cert, NULL)) {
errorRpt(GENERAL_FAILURE, getResourceString(DBT_INSTALL_FAIL));
}
@@ -2042,6 +2081,13 @@ int main(int argc, char *argv[])
errorRpt(FILE_ERROR, line);
}
+#ifdef DUMP_CACHE_INFO
+ if (NSS_IsInitialized()) {
+ printf("nss_DumpCertificateCacheInfo 1\n");
+ nss_DumpCertificateCacheInfo();
+ }
+#endif
+
if(ADMSSL_InitSimple((char *)configdir, (char *)secdir, 1)) {
errorRpt(SYSTEM_ERROR, getResourceString(CMN_SSL_INIT_ERROR));
}
@@ -2070,7 +2116,7 @@ int main(int argc, char *argv[])
/* we got here, we think sie is a valid prefix */
/* close all db - we may have had to open the admin server key/cert db
in order to use LDAPS before - now have to shut down NSS and reinit */
- closeAllSecurityDB();
+ closeAllSecurityDB(0);
securityInitialization(securitydir);
if (!PORT_Strcmp(operation, "LIST_CERTIFICATE")) {
@@ -2192,7 +2238,7 @@ int main(int argc, char *argv[])
errorRpt(INCORRECT_USAGE, line);
}
/* close all db */
- closeAllSecurityDB();
+ closeAllSecurityDB(1);
}
}