Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1010224

Summary: NSS 3.15 breaks SSL in OpenLDAP clients
Product: Red Hat Enterprise Linux 6 Reporter: Alicja Kario <hkario>
Component: nssAssignee: Elio Maldonado Batiz <emaldona>
Status: CLOSED ERRATA QA Contact: Alicja Kario <hkario>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 6.5CC: azelinka, borgan, eparis, kengert, omoris, rrelyea, sforsber, tlavigne
Target Milestone: betaKeywords: Regression
Target Release: 6.5   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: nss-softokn-3.14.3-8.el6 nss-3.15.1-9.el6 Doc Type: Bug Fix
Doc Text:
Cause: The nss-softoken self test did not check whether freebl was properly initialized before running its tests. Consequence: Client code, such as the LPAD client, may have initialized and finalized nss. In such case freebl would have been claned up and unloaded and when loaded again it would try to run its test and such test would fail resulting in client failures such as TLS connection errors. Fix: The nss-softoken self test now reinitailizes appropriate parts of freebl before running the RSA checks. Result: The self tests pass and LDAP queries via TLS succeed.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2013-11-21 06:20:40 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 993793    
Attachments:
Description Flags
Fix the self test to reinitailize appropriate parts of freebl before running the RSA checks. none

Description Alicja Kario 2013-09-20 10:03:56 UTC 
Description of problem:
Using NSS packages from 3.15.1 rebase, OpenLDAP client commands don't work with SSL/TLS connections.

Version-Release number of selected component (if applicable):
nss-3.15.1-5.el6.x86_64
nspr-4.10.0-1.el6.x86_64
nss-util-3.15.1-2.el6.x86_64
nspr-devel-4.10.0-1.el6.x86_64
nss-softokn-devel-3.14.3-6.el6.x86_64
nss-softokn-fips-3.14.3-6.el6.x86_64
nss-sysinit-3.15.1-5.el6.x86_64
nss-tools-3.15.1-5.el6.x86_64
nss-softokn-freebl-3.14.3-6.el6.x86_64
nss-devel-3.15.1-5.el6.x86_64
nss-softokn-3.14.3-6.el6.x86_64
nss-softokn-freebl-fips-3.14.3-6.el6.x86_64
nss-util-devel-3.15.1-2.el6.x86_64
openldap-clients-2.4.23-32.el6_4.1.x86_64

How reproducible:
Always

Steps to Reproduce:
1. mkdir /etc/openldap/cacerts/
2. wget -c -O /etc/openldap/cacerts/redhat.pem http://password.corp.redhat.com/newca.crt --no-check-certificate
3. cacertdir_rehash "/etc/openldap/cacerts"
4. LDAPTLS_CACERTDIR=/etc/openldap/cacerts ldapsearch -ZZ -H ldap://ldap.corp.redhat.com/ -x -b dc=redhat,dc=com cn=hkario

Actual results:
ldap_start_tls: Connect error (-11)
        additional info: Start TLS request accepted.Server willing to negotiate SSL.

Expected results:
# extended LDIF
#
# LDAPv3
# base <dc=redhat,dc=com> with scope subtree
# filter: cn=hkario
# requesting: ALL
#

# hkario, Groups, redhat.com
dn: cn=hkario,ou=Groups,dc=redhat,dc=com
objectClass: top
objectClass: posixGroup
cn: hkario
memberUid: hkario

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Additional info:
The regression was introduced by the 3.15.1 rebase. With 3.14.3 the command works.

nss-softokn-3.14.3-3.el6_4.x86_64
nspr-debuginfo-4.10.0-1.el6.x86_64
nspr-4.9.5-2.el6_4.x86_64
nss-softokn-3.14.3-3.el6_4.i686
nss-softokn-freebl-fips-3.14.3-6.el6.x86_64
nss-util-3.14.3-3.el6_4.x86_64
nss-sysinit-3.14.3-4.el6_4.x86_64
nss-3.14.3-4.el6_4.i686
nss-softokn-freebl-3.14.3-6.el6.x86_64
nspr-4.9.5-2.el6_4.i686
nss-util-3.14.3-3.el6_4.i686
nss-util-debuginfo-3.15.1-2.el6.x86_64
nss-debuginfo-3.15.1-5.el6.x86_64
nss-tools-3.14.3-4.el6_4.x86_64
nss-softokn-debuginfo-3.14.3-6.el6.x86_64
nss-3.14.3-4.el6_4.x86_64
nss-softokn-freebl-3.14.3-6.el6.i686
Comment 1 Eric Paris 2013-09-20 18:23:49 UTC 
were their any AVC messages which went along with this denial?
Comment 2 Bob Relyea 2013-09-20 19:15:55 UTC 
I've just verified this is not the prelink/freebl issue. This may really be a rebase issue.
Comment 3 Kai Engert (:kaie) (inactive account) 2013-09-20 21:40:41 UTC 
Using strace, the very last action executed is an attempt to read
  /usr/lib64/libsoftokn3.chk

Immediately after accessing that file, the ldapsearch utility returns the error.

I downgraded packages one after the other.

With these packages we fail:
  nss-softokn-3.14.3-6.el6.x86_64
  nss-softokn-freebl-3.14.3-6.el6.x86_64

With these packages it works:
  nss-softokn-3.14.3-3.el6.x86_64
  nss-softokn-freebl-3.14.3-3.el6.x86_64
Comment 4 Bob Relyea 2013-09-20 23:52:04 UTC 
OK, I've solved the initial problem, I now get 	additional info: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.

At this point we may be operating where kai has pointed out (that is the trust setup is wrong somewhere).

I'm going to attach a patch to fix the failure to initialize NSS. It would be good to see if Hubert's failure is actually a regression. Certainly /etc/openldap/cacerts is not an NSS database directory, so if LDAPTLS_CACERTDIR is supposed to point to an NSS database directory, the failure I'm getting is expected. (The silent "I can't starttls" isn't.
Comment 5 Bob Relyea 2013-09-20 23:55:07 UTC 
Elio is building a new package the removes the fips-selftest code only only leaves the moving the the .chk files into new packages. We'll roll that out in for betat. That is not the patch I'll attach here. I'm looking beyond beta, so this patch won't actually be in the next compose.
Comment 6 Bob Relyea 2013-09-21 00:04:14 UTC 
Created attachment 800803 [details]
Fix the self test to reinitailize appropriate parts of freebl before running the RSA checks.

The problem is ldap is Initializing NSS then Finalizing it. This is perfectly permissible, but the new 'run tests at load time' in softoken are now failing. What happens is normally freebl gets loaded and it's 'at load time' handler gets called, which initializes everything and runs its selftests. Then softoken gets loaded and runs its selftests. Then at Finalize softoken cleans up the freebl state and then unloads. When it loads again, it tries to run it's selftests, but because it freebl was shutdown, the tests will fail. The patch is to try to initialize freebl before running the tests.
Comment 15 errata-xmlrpc 2013-11-21 06:20:40 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1558.html