Bug 1010224

Summary:

NSS 3.15 breaks SSL in OpenLDAP clients

Product:

Red Hat Enterprise Linux 6

Reporter:

Alicja Kario <hkario>

Component:

nss

Assignee:

Elio Maldonado Batiz <emaldona>

Status:

CLOSED ERRATA

QA Contact:

Alicja Kario <hkario>

Severity:

urgent

Docs Contact:

Priority:

urgent

Version:

6.5

CC:

azelinka, borgan, eparis, kengert, omoris, rrelyea, sforsber, tlavigne

Target Milestone:

beta

Keywords:

Regression

Target Release:

6.5

Hardware:

All

OS:

Linux

Whiteboard:

Fixed In Version:

nss-softokn-3.14.3-8.el6 nss-3.15.1-9.el6

Doc Type:

Bug Fix

Doc Text:

Cause: The nss-softoken self test did not check whether freebl was properly initialized before running its tests. Consequence: Client code, such as the LPAD client, may have initialized and finalized nss. In such case freebl would have been claned up and unloaded and when loaded again it would try to run its test and such test would fail resulting in client failures such as TLS connection errors. Fix: The nss-softoken self test now reinitailizes appropriate parts of freebl before running the RSA checks. Result: The self tests pass and LDAP queries via TLS succeed.

Story Points:

---

Clone Of:

Environment:

Last Closed:

2013-11-21 06:20:40 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Bug Depends On:

Bug Blocks:

993793

Attachments:

Description	Flags
Fix the self test to reinitailize appropriate parts of freebl before running the RSA checks.	none

Description Alicja Kario 2013-09-20 10:03:56 UTC

Description of problem:
Using NSS packages from 3.15.1 rebase, OpenLDAP client commands don't work with SSL/TLS connections.

Version-Release number of selected component (if applicable):
nss-3.15.1-5.el6.x86_64
nspr-4.10.0-1.el6.x86_64
nss-util-3.15.1-2.el6.x86_64
nspr-devel-4.10.0-1.el6.x86_64
nss-softokn-devel-3.14.3-6.el6.x86_64
nss-softokn-fips-3.14.3-6.el6.x86_64
nss-sysinit-3.15.1-5.el6.x86_64
nss-tools-3.15.1-5.el6.x86_64
nss-softokn-freebl-3.14.3-6.el6.x86_64
nss-devel-3.15.1-5.el6.x86_64
nss-softokn-3.14.3-6.el6.x86_64
nss-softokn-freebl-fips-3.14.3-6.el6.x86_64
nss-util-devel-3.15.1-2.el6.x86_64
openldap-clients-2.4.23-32.el6_4.1.x86_64

How reproducible:
Always

Steps to Reproduce:
1. mkdir /etc/openldap/cacerts/
2. wget -c -O /etc/openldap/cacerts/redhat.pem http://password.corp.redhat.com/newca.crt --no-check-certificate
3. cacertdir_rehash "/etc/openldap/cacerts"
4. LDAPTLS_CACERTDIR=/etc/openldap/cacerts ldapsearch -ZZ -H ldap://ldap.corp.redhat.com/ -x -b dc=redhat,dc=com cn=hkario

Actual results:
ldap_start_tls: Connect error (-11)
        additional info: Start TLS request accepted.Server willing to negotiate SSL.

Expected results:
# extended LDIF
#
# LDAPv3
# base <dc=redhat,dc=com> with scope subtree
# filter: cn=hkario
# requesting: ALL
#

# hkario, Groups, redhat.com
dn: cn=hkario,ou=Groups,dc=redhat,dc=com
objectClass: top
objectClass: posixGroup
cn: hkario
memberUid: hkario

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Additional info:
The regression was introduced by the 3.15.1 rebase. With 3.14.3 the command works.

nss-softokn-3.14.3-3.el6_4.x86_64
nspr-debuginfo-4.10.0-1.el6.x86_64
nspr-4.9.5-2.el6_4.x86_64
nss-softokn-3.14.3-3.el6_4.i686
nss-softokn-freebl-fips-3.14.3-6.el6.x86_64
nss-util-3.14.3-3.el6_4.x86_64
nss-sysinit-3.14.3-4.el6_4.x86_64
nss-3.14.3-4.el6_4.i686
nss-softokn-freebl-3.14.3-6.el6.x86_64
nspr-4.9.5-2.el6_4.i686
nss-util-3.14.3-3.el6_4.i686
nss-util-debuginfo-3.15.1-2.el6.x86_64
nss-debuginfo-3.15.1-5.el6.x86_64
nss-tools-3.14.3-4.el6_4.x86_64
nss-softokn-debuginfo-3.14.3-6.el6.x86_64
nss-3.14.3-4.el6_4.x86_64
nss-softokn-freebl-3.14.3-6.el6.i686

Comment 1 Eric Paris 2013-09-20 18:23:49 UTC

were their any AVC messages which went along with this denial?

Comment 2 Bob Relyea 2013-09-20 19:15:55 UTC

I've just verified this is not the prelink/freebl issue. This may really be a rebase issue.

Comment 3 Kai Engert (:kaie) (inactive account) 2013-09-20 21:40:41 UTC

Using strace, the very last action executed is an attempt to read
  /usr/lib64/libsoftokn3.chk

Immediately after accessing that file, the ldapsearch utility returns the error.

I downgraded packages one after the other.

With these packages we fail:
  nss-softokn-3.14.3-6.el6.x86_64
  nss-softokn-freebl-3.14.3-6.el6.x86_64

With these packages it works:
  nss-softokn-3.14.3-3.el6.x86_64
  nss-softokn-freebl-3.14.3-3.el6.x86_64

Comment 4 Bob Relyea 2013-09-20 23:52:04 UTC

OK, I've solved the initial problem, I now get 	additional info: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.

At this point we may be operating where kai has pointed out (that is the trust setup is wrong somewhere).

I'm going to attach a patch to fix the failure to initialize NSS. It would be good to see if Hubert's failure is actually a regression. Certainly /etc/openldap/cacerts is not an NSS database directory, so if LDAPTLS_CACERTDIR is supposed to point to an NSS database directory, the failure I'm getting is expected. (The silent "I can't starttls" isn't.

Comment 5 Bob Relyea 2013-09-20 23:55:07 UTC

Elio is building a new package the removes the fips-selftest code only only leaves the moving the the .chk files into new packages. We'll roll that out in for betat. That is not the patch I'll attach here. I'm looking beyond beta, so this patch won't actually be in the next compose.

Comment 6 Bob Relyea 2013-09-21 00:04:14 UTC

Created attachment 800803 [details]
Fix the self test to reinitailize appropriate parts of freebl before running the RSA checks.

The problem is ldap is Initializing NSS then Finalizing it. This is perfectly permissible, but the new 'run tests at load time' in softoken are now failing. What happens is normally freebl gets loaded and it's 'at load time' handler gets called, which initializes everything and runs its selftests. Then softoken gets loaded and runs its selftests. Then at Finalize softoken cleans up the freebl state and then unloads. When it loads again, it tries to run it's selftests, but because it freebl was shutdown, the tests will fail. The patch is to try to initialize freebl before running the tests.

Comment 15 errata-xmlrpc 2013-11-21 06:20:40 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1558.html