Red Hat Bugzilla – Bug 1010224
NSS 3.15 breaks SSL in OpenLDAP clients
Last modified: 2013-11-21 01:20:40 EST
Description of problem: Using NSS packages from 3.15.1 rebase, OpenLDAP client commands don't work with SSL/TLS connections. Version-Release number of selected component (if applicable): nss-3.15.1-5.el6.x86_64 nspr-4.10.0-1.el6.x86_64 nss-util-3.15.1-2.el6.x86_64 nspr-devel-4.10.0-1.el6.x86_64 nss-softokn-devel-3.14.3-6.el6.x86_64 nss-softokn-fips-3.14.3-6.el6.x86_64 nss-sysinit-3.15.1-5.el6.x86_64 nss-tools-3.15.1-5.el6.x86_64 nss-softokn-freebl-3.14.3-6.el6.x86_64 nss-devel-3.15.1-5.el6.x86_64 nss-softokn-3.14.3-6.el6.x86_64 nss-softokn-freebl-fips-3.14.3-6.el6.x86_64 nss-util-devel-3.15.1-2.el6.x86_64 openldap-clients-2.4.23-32.el6_4.1.x86_64 How reproducible: Always Steps to Reproduce: 1. mkdir /etc/openldap/cacerts/ 2. wget -c -O /etc/openldap/cacerts/redhat.pem http://password.corp.redhat.com/newca.crt --no-check-certificate 3. cacertdir_rehash "/etc/openldap/cacerts" 4. LDAPTLS_CACERTDIR=/etc/openldap/cacerts ldapsearch -ZZ -H ldap://ldap.corp.redhat.com/ -x -b dc=redhat,dc=com cn=hkario Actual results: ldap_start_tls: Connect error (-11) additional info: Start TLS request accepted.Server willing to negotiate SSL. Expected results: # extended LDIF # # LDAPv3 # base <dc=redhat,dc=com> with scope subtree # filter: cn=hkario # requesting: ALL # # hkario, Groups, redhat.com dn: cn=hkario,ou=Groups,dc=redhat,dc=com objectClass: top objectClass: posixGroup cn: hkario memberUid: hkario # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Additional info: The regression was introduced by the 3.15.1 rebase. With 3.14.3 the command works. nss-softokn-3.14.3-3.el6_4.x86_64 nspr-debuginfo-4.10.0-1.el6.x86_64 nspr-4.9.5-2.el6_4.x86_64 nss-softokn-3.14.3-3.el6_4.i686 nss-softokn-freebl-fips-3.14.3-6.el6.x86_64 nss-util-3.14.3-3.el6_4.x86_64 nss-sysinit-3.14.3-4.el6_4.x86_64 nss-3.14.3-4.el6_4.i686 nss-softokn-freebl-3.14.3-6.el6.x86_64 nspr-4.9.5-2.el6_4.i686 nss-util-3.14.3-3.el6_4.i686 nss-util-debuginfo-3.15.1-2.el6.x86_64 nss-debuginfo-3.15.1-5.el6.x86_64 nss-tools-3.14.3-4.el6_4.x86_64 nss-softokn-debuginfo-3.14.3-6.el6.x86_64 nss-3.14.3-4.el6_4.x86_64 nss-softokn-freebl-3.14.3-6.el6.i686
were their any AVC messages which went along with this denial?
I've just verified this is not the prelink/freebl issue. This may really be a rebase issue.
Using strace, the very last action executed is an attempt to read /usr/lib64/libsoftokn3.chk Immediately after accessing that file, the ldapsearch utility returns the error. I downgraded packages one after the other. With these packages we fail: nss-softokn-3.14.3-6.el6.x86_64 nss-softokn-freebl-3.14.3-6.el6.x86_64 With these packages it works: nss-softokn-3.14.3-3.el6.x86_64 nss-softokn-freebl-3.14.3-3.el6.x86_64
OK, I've solved the initial problem, I now get additional info: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user. At this point we may be operating where kai has pointed out (that is the trust setup is wrong somewhere). I'm going to attach a patch to fix the failure to initialize NSS. It would be good to see if Hubert's failure is actually a regression. Certainly /etc/openldap/cacerts is not an NSS database directory, so if LDAPTLS_CACERTDIR is supposed to point to an NSS database directory, the failure I'm getting is expected. (The silent "I can't starttls" isn't.
Elio is building a new package the removes the fips-selftest code only only leaves the moving the the .chk files into new packages. We'll roll that out in for betat. That is not the patch I'll attach here. I'm looking beyond beta, so this patch won't actually be in the next compose.
Created attachment 800803 [details] Fix the self test to reinitailize appropriate parts of freebl before running the RSA checks. The problem is ldap is Initializing NSS then Finalizing it. This is perfectly permissible, but the new 'run tests at load time' in softoken are now failing. What happens is normally freebl gets loaded and it's 'at load time' handler gets called, which initializes everything and runs its selftests. Then softoken gets loaded and runs its selftests. Then at Finalize softoken cleans up the freebl state and then unloads. When it loads again, it tries to run it's selftests, but because it freebl was shutdown, the tests will fail. The patch is to try to initialize freebl before running the tests.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-1558.html