Bug 842022

Created attachment 599467 [details]
Tarball with configuration, keys etc.

To reproduce:
Try to rebuild libuser in Koji (tested f17 and f18 branches), e.g. https://koji.fedoraproject.org/koji/taskinfo?taskID=4284035 , https://koji.fedoraproject.org/koji/taskinfo?taskID=4283740 .

LDAP connection using TLS fails.

Note that this seems to happen only in mock, not on an installed F17 with the same version of openldap.


Additional information generated by enabling debugging:

> 5009d4ab daemon: epoll: listen=6 active_threads=0 tvp=NULL
> 5009d4ab send_ldap_extended: err=0 oid= len=0
> 5009d4ab send_ldap_response: msgid=1 tag=120 err=0
> ber_flush2: 14 bytes to sd 15
>   0000:  30 0c 02 01 01 78 07 0a  01 00 04 00 04 00         0....x........    
> ldap_write: want=14, written=14
>   0000:  30 0c 02 01 01 78 07 0a  01 00 04 00 04 00         0....x........    
> 5009d4ab daemon: activity on 1 descriptor
> 5009d4ab daemon: activity on:5009d4ab  15r5009d4ab 
> 5009d4ab daemon: read active on 15
> 5009d4ab daemon: epoll: listen=6 active_threads=0 tvp=NULL
> 5009d4ab connection_get(15)
> 5009d4ab connection_get(15): got connid=1002
> 5009d4ab connection_read(15): checking for input on id=1002
> TLS: certificate [CN=127.0.0.1] is not valid - error -8172:Peer's certificate issuer has been marked as not trusted by the user..
> TLS: error: unable to find and verify server's cert and key for certificate > CN=127.0.0.1
> TLS: error: could not initialize moznss security context - error -8172:Peer's certificate issuer has been marked as not trusted by the user.
> TLS: can't create ssl handle.
> 5009d4ab connection_read(15): TLS accept failure error=-1 id=1002, closing
> 5009d4ab connection_closing: readying conn=1002 sd=15 for close
> 5009d4ab connection_close: conn=1002 sd=15
> 5009d4ab daemon: activity on 1 descriptor

"peer's certificate issuer has been marked as not trusted" makes no sense to me:
1) the peer is a client, who does not supply any certificate
2) the certificate is in PEM format, which unlinke the NSS DB does not have any trust bits.

The second time the message is different, namely 
> TLS: error: could not initialize moznss security context - error -5925:The one-time function was previously called and failed. Its error code is no longer available
> TLS: can't create ssl handle.


More information to hopefully help reproducing this:
The server command is 
> /usr/sbin/slapd -h ldap://127.0.0.1:42883/ -f /builddir/build/BUILD/libuser-0.57.6/test_default_pw/slapd.conf -d 255
The client command is
> HOME=tests ldapsearch -d 255 -Z -h 127.0.0.1 -p 42883 -x -D cn=Manager,dc=libuser -w password -s sub -b 'dc=libuser'

with tests/ldaprc containing:
> HOST 127.0.0.1
> BASE dc=libuser
> # Don't check hostname on certificate
> TLS_REQCERT allow

I'll attach a tarball containing the test_default_pw directory (includes slapd.conf, the key, and the database)