On Fri, Nov 20, 2015 at 01:23:41PM +0100, Jakub Hrozek wrote:
> On Tue, Nov 10, 2015 at 11:23:38AM +0100, Sumit Bose wrote:
> > Hi,
> >
> > currently the p11_child does not continue to search for more
> > certificates if the first suitable certificate cannot be verified. With
> > this patch p11_child will continue until a valid certificate is found
> > (or all are checked).
> >
> > As said before I'm working on improving the handling of the certificates
> > for the unit-test and would prefer to not spend time to add a test for
> > this case with the old scheme. If you agree I would open a ticket to
> > remind me to add tests for this case with the new scheme.
> >
> > bye,
> > Sumit
>
> > From 26898bf92af4d28ef12cd9ae3a5ffb513d38183b Mon Sep 17 00:00:00 2001
> > From: Sumit Bose <sbose(a)redhat.com>
> > Date: Thu, 5 Nov 2015 17:43:52 +0100
> > Subject: [PATCH] p11: check if cert is valid before selecting it
> >
> > Currently the first certificate was selected and if it was not valid
> > p11_child just returned an error. With this patch the validity is
> > checked first and the first valid certificate is selected.
> >
> > Resolves
https://fedorahosted.org/sssd/ticket/2801
> > ---
> > src/p11_child/p11_child_nss.c | 22 ++++++++++++----------
> > 1 file changed, 12 insertions(+), 10 deletions(-)
> >
> > diff --git a/src/p11_child/p11_child_nss.c b/src/p11_child/p11_child_nss.c
> > index
8a383a044dd295c911a1b12c6caeeffc57d00be6..22e449d547c64c94a3ee9e29939377c98443b47d 100644
> > --- a/src/p11_child/p11_child_nss.c
> > +++ b/src/p11_child/p11_child_nss.c
> > @@ -272,6 +272,18 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db, const
char *slot_name_in,
> > cert_list_node->cert->nickname,
> > cert_list_node->cert->subjectName);
> >
> > + rv = CERT_VerifyCertificateNow(handle, cert_list_node->cert,
> > + PR_TRUE,
certificateUsageSSLClient,
> > + NULL, NULL);
> > + if (rv != SECSuccess) {
> > + DEBUG(SSSDBG_OP_FAILURE,
> > + "Certificate [%s][%s] not valid [%d],
skipping.\n",
> > + cert_list_node->cert->nickname,
> > + cert_list_node->cert->subjectName,
PR_GetError());
> > + break;
>
> Did you mean to say continue instead of break here?
You are of course right. I just needed some time to figure out why my
original test failed which wasn't easy because the environment already
changed a lot. But I found a typo in my bash history which caused the
one of the CA certificates I used for the test certificates was not
removed from the NSS DB. As a result all certificates on the Smartcard
were still valid and I didn't check carefully if really the expected
certificate was returned.
New version attached.
bye,
Sumit
>
> > + }
> > +
> > +
> > if (found_cert == NULL) {
> > found_cert = cert_list_node->cert;
> > } else {
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org
From 42999facd5d3eb718c061778b25e0fb1d6cb9e82 Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Thu, 5 Nov 2015 17:43:52 +0100
Subject: [PATCH] p11: check if cert is valid before selecting it
Currently the first certificate was selected and if it was not valid
p11_child just returned an error. With this patch the validity is
checked first and the first valid certificate is selected.
Resolves
https://fedorahosted.org/sssd/ticket/2801