Bug 1347735 – libreswan needs to check additional CRLs after LDAP CRL distributionpoint fails

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1347735 - libreswan needs to check additional CRLs after LDAP CRL distributionpoint fails

Summary:	libreswan needs to check additional CRLs after LDAP CRL distributionpoint fails

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	libreswan (Show other bugs)
Sub Component:
Version:	7.4
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Paul Wouters
QA Contact:	Jaroslav Aster
Docs Contact:	Mirek Jahoda

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2016-06-17 09:47 EDT by Paul Wouters
Modified:	2016-11-03 17:23 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	Cause: Only the first CRLdistributionpoint was checked Consequence: If there are more than one CRLdistributionpoints listed in the certificate, and the first CRLdistributionpoint was down, the second CRLdistributionpoint was never checked Fix: process all CRLdistributionpoints Result: if only one of a set of CRLdistributionpoints is down, libreswan can now properly still fetch the CRL.
Story Points:	---
Clone Of:
Clones:	1360134 (view as bug list)
Environment:
Last Closed:	2016-11-03 17:23:07 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
multi crldistribution fetch (2.04 KB, patch) 2016-06-22 08:25 EDT, Paul Wouters	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2016:2603	normal	SHIPPED_LIVE	Moderate: libreswan security and bug fix update	2016-11-03 08:13:02 EDT

Groups: None (edit)

Description Paul Wouters 2016-06-17 09:47:08 EDT

Description of problem:

When multiple CRL distributionpoints are present in a certificate, and the ldap URI fails, libreswan does not attempt another URI like http.

I believe LDAP is always attempted first?

This is related to a missing feature in NSS:

https://bugzilla.mozilla.org/show_bug.cgi?id=1280276

Comment 2 Kai Engert (:kaie) (inactive account) 2016-06-22 06:48:08 EDT

(In reply to Paul Wouters from comment #0)

> This is related to a missing feature in NSS:
> https://bugzilla.mozilla.org/show_bug.cgi?id=1280276

I have triaged and commented in the upstream bug.

NSS seems to already provide everything you need, see the explanations I wrote there.

Comment 4 Paul Wouters 2016-06-22 08:25 EDT

Created attachment 1170715 [details]
multi crldistribution fetch

patch ot fetch from multiple CRL points

Comment 8 errata-xmlrpc 2016-11-03 17:23:07 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2603.html

Note You need to log in before you can comment on or make changes to this bug.