[SSSD] [PATCH] p11: check if cert is valid before selecting it
Sumit Bose
sbose at redhat.com
Tue Nov 10 10:23:38 UTC 2015
Hi,
currently the p11_child does not continue to search for more
certificates if the first suitable certificate cannot be verified. With
this patch p11_child will continue until a valid certificate is found
(or all are checked).
As said before I'm working on improving the handling of the certificates
for the unit-test and would prefer to not spend time to add a test for
this case with the old scheme. If you agree I would open a ticket to
remind me to add tests for this case with the new scheme.
bye,
Sumit
-------------- next part --------------
From 26898bf92af4d28ef12cd9ae3a5ffb513d38183b Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 5 Nov 2015 17:43:52 +0100
Subject: [PATCH] p11: check if cert is valid before selecting it
Currently the first certificate was selected and if it was not valid
p11_child just returned an error. With this patch the validity is
checked first and the first valid certificate is selected.
Resolves https://fedorahosted.org/sssd/ticket/2801
---
src/p11_child/p11_child_nss.c | 22 ++++++++++++----------
1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/src/p11_child/p11_child_nss.c b/src/p11_child/p11_child_nss.c
index 8a383a044dd295c911a1b12c6caeeffc57d00be6..22e449d547c64c94a3ee9e29939377c98443b47d 100644
--- a/src/p11_child/p11_child_nss.c
+++ b/src/p11_child/p11_child_nss.c
@@ -272,6 +272,18 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db, const char *slot_name_in,
cert_list_node->cert->nickname,
cert_list_node->cert->subjectName);
+ rv = CERT_VerifyCertificateNow(handle, cert_list_node->cert,
+ PR_TRUE, certificateUsageSSLClient,
+ NULL, NULL);
+ if (rv != SECSuccess) {
+ DEBUG(SSSDBG_OP_FAILURE,
+ "Certificate [%s][%s] not valid [%d], skipping.\n",
+ cert_list_node->cert->nickname,
+ cert_list_node->cert->subjectName, PR_GetError());
+ break;
+ }
+
+
if (found_cert == NULL) {
found_cert = cert_list_node->cert;
} else {
@@ -291,16 +303,6 @@ int do_work(TALLOC_CTX *mem_ctx, const char *nss_db, const char *slot_name_in,
goto done;
}
- rv = CERT_VerifyCertificateNow(handle, found_cert, PR_TRUE,
- certificateUsageSSLClient, NULL, NULL);
- if (rv != SECSuccess) {
- DEBUG(SSSDBG_OP_FAILURE,
- "CERT_VerifyCertificateNow failed [%d].\n",
- PR_GetError());
- ret = EIO;
- goto done;
- }
-
if (mode == OP_AUTH) {
rv = PK11_GenerateRandom(random_value, sizeof(random_value));
if (rv != SECSuccess) {
--
2.1.0
More information about the sssd-devel
mailing list