migration from http://raidzilla.sfbay.redhat.com/show_bug.cgi?id=57684




1/ perform enrollment with webstore token with client on rhel4 and the tps
server setup on solaris-9 64 bit.

enrollment completes. but ESC crashes. everytime we plug the token in after that
and when visiting the enrollment page, ESC crashes. 

attached are the ESC stack trace and TPS debug log.


------- Additional Comment #1 From Chandrasekar Kannan 2005-05-25 18:56 [reply]
-------

Created an attachment (id=24554) [edit]
esc stack trace and tps debug log


------- Additional Comment #2 From Chandrasekar Kannan 2005-05-25 18:56 [reply]
-------

I can't visit the format page either on rhel4. esc crashes. so can't format the
token on rhel4. trying windows


------- Additional Comment #3 From Thomas Kwan 2005-05-25 19:51 [reply] -------

I just checked that our CA has put CRLDistribution point extension into the
encryption, which upsets NSS.

Jack provided my the NSS stack trace.

From func PK11_ListCertsInSlot(slot);

Program received signal SIGSEGV, Segmentation fault.
0x00aeac35 in subject_list_sort (v1=0x9a037c0, v2=0x9a02ee8) at tdcache.c:157
157         if (dc1->isNewerThan(dc1, dc2)) {
Current language:  auto; currently c
(gdb) list
152     {
153         NSSCertificate *c1 = (NSSCertificate *)v1;
154         NSSCertificate *c2 = (NSSCertificate *)v2;
155         nssDecodedCert *dc1 = nssCertificate_GetDecoding(c1);
156         nssDecodedCert *dc2 = nssCertificate_GetDecoding(c2);
157         if (dc1->isNewerThan(dc1, dc2)) {
158             return -1;
159         } else {
160             return 1;
161         }
(gdb) print dc1
$1 = (nssDecodedCert *) 0x0
(gdb) pirnt dc2
Undefined command: "pirnt".  Try "help".
(gdb) print dc2
$2 = (nssDecodedCert *) 0x9a01858
(gdb) print dc1
$3 = (nssDecodedCert *) 0x0
(gdb) print v1
$4 = (void *) 0x9a037c0
(gdb) print v2
$5 = (void *) 0x9a02ee8
(gdb) print dc1
$6 = (nssDecodedCert *) 0x0
(gdb) print dc2
$7 = (nssDecodedCert *) 0x9a01858
(gdb) print c1
$8 = (NSSCertificate *) 0x9a037c0
(gdb) print c2
$9 = (NSSCertificate *) 0x9a02ee8
(gdb) print *c1;
Invalid character ';' in expression.
(gdb) print *c1
$10 = {object = {arena = 0x9a036c0, refCount = 1, lock = 0x9a03f90,
   instances = 0x9a037b0, numInstances = 1, trustDomain = 0x98b0050,
   cryptoContext = 0x0, tempName = 0x0}, type = NSSCertificateType_PKIX, id = {
   data = 0x9a03850, size = 1}, encoding = {data = 0x9a03860, size = 664},
 issuer = {data = 0x9a03b00, size = 62}, subject = {data = 0x9a03b58,
   size = 53}, serial = {data = 0x9a03b48, size = 4}, email = 0x0,
 decoding = 0x0}
(gdb) print *c2
$11 = {object = {arena = 0x9a26e80, refCount = 2, lock = 0x9a27010,
   instances = 0x9a02ed8, numInstances = 1, trustDomain = 0x98b0050,
   cryptoContext = 0x0, tempName = 0x0}, type = NSSCertificateType_PKIX, id = {
   data = 0x9a02f78, size = 1}, encoding = {data = 0x9a02f88, size = 596},
 issuer = {data = 0x9a031e8, size = 62}, subject = {data = 0x9a03240,
   size = 53}, serial = {data = 0x9a03230, size = 4}, email = 0x0,
 decoding = 0x9a01858}
(gdb)


When examined with manageobj, the util returns

...
 Compressed Object ID Size: 4
6b 35 00 00                                      k5..
 Object Attributes: 0x000050a2 Class = CKO_PUBLIC_KEY (2) id=2 flags
=TOKEN,ENCRYPT,WRAP,
 Attribute Count: 0
                                                                                
 Compressed Object ID Size: 4
6b 34 00 00                                      k4..
 Object Attributes: 0x0010a1b2 Class = CKO_PRIVATE_KEY (3) id=2 flags
=TOKEN,PRIVATE,DECRYPT,UNWRAP,SENSITIVE,
 Attribute Count: 0
FAILED Reading Object List (Schlumberger e-gate 0) status=AKAPDUFAIL,6,
winerr=SCARD_S_SUCCESS (0x0), appleterr = AKISO_UNAUTHORIZED 0x9c06


------- Additional Comment #4 From Thomas Kwan 2005-05-25 19:52 [reply] -------

Added Bob


------- Additional Comment #5 From Thomas Kwan 2005-05-25 19:54 [reply] -------

Also, Chandra marked the CRL distribution point extension as critical. NSS
should not crash. Wan-Teh suggested that we should try to include the extension,
but mark it as non-critical


------- Additional Comment #6 From Wan-Teh Chang 2005-05-25 22:49 [reply] -------

I found that CRL distribution points is an unsupported extension:
http://lxr.mozilla.org/security/source/security/nss/lib/util/secoid.c#782

This is enough to cause certificate decoding to fail:
http://lxr.mozilla.org/security/source/security/nss/lib/certdb/certdb.c#863
CERT_DecodeDERCertificate fails with SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION because
http://lxr.mozilla.org/security/source/security/nss/lib/certdb/certxutl.c#504
cert_HasUnknownCriticalExten returns PR_TRUE because
http://lxr.mozilla.org/security/source/security/nss/lib/util/secoid.c#1776
SECOID_KnownCertExtenOID on CRL dist points returns PR_FALSE.

We can fix this crash at two levels.  At the higher level, we
can prevent undecodable certs from being passed to this
subject_list_sort function.  At the lower level, we can prevent
the subject_list_sort function from crashing on undecodable certs.

Here is a proposed fix at the lower level.  If we consider an
undecodable cert older than a decodable cert, we can implement the
subject_list_sort function like this:

static PRIntn subject_list_sort(void *v1, void *v2)
{
    NSSCertificate *c1 = (NSSCertificate *)v1;
    NSSCertificate *c2 = (NSSCertificate *)v2;
    nssDecodedCert *dc1 = nssCertificate_GetDecoding(c1);
    nssDecodedCert *dc2 = nssCertificate_GetDecoding(c2);
    if (!dc1) {
        return dc2 ? 1 : 0;
    } else if (!dc2) {
        return -1;
    } else {
        return dc1->isNewerThan(dc1, dc2) ? -1 : 1;
    }
}

I looked at the callers of subject_list_sort and tend to
think that we should fix this in subject_list_sort.


------- Additional Comment #7 From Wan-Teh Chang 2005-05-25 23:19 [reply] -------

I reviewed the other callers of nssCertificate_GetDecoding.

This should be fixed the same way.
http://lxr.mozilla.org/security/source/security/nss/lib/pki/pkistore.c#96

This is dead code.  It probably should be removed.
http://lxr.mozilla.org/security/ident?i=nssBestCertificate_Callback

This does not crash but should be reviewed for correctness.
http://lxr.mozilla.org/security/source/security/nss/lib/pki/certificate.c#443


------- Additional Comment #8 From Wan-Teh Chang 2005-05-25 23:53 [reply] -------

Bob,

I looked at the callers of subject_list_sort more.
This function is used when we add certs to the cache.
So the question is whether we want to add undecodable
certs to the cache.  If so, then my fix for subject_list_sort
is fine.  If not, then we need to fix this crash at a
higher level, probably in nssTrustDomain_AddCertsToCache.
nssTrustDomain_AddCertsToCache returns PRStatus but none
of its callers check the return value.  Also, all callers
of nssTrustDomain_AddCertsToCache call it to add only one
cert even though the function can add an array of certs
to the cache.

Note to self: pk11_fastCert has a memory leak.  It may
store an allocated string in *nickptr but return NULL.


------- Additional Comment #9 From Chandrasekar Kannan 2005-05-26 10:41 [reply]
-------

we plan to release note this for 7.1


------- Additional Comment #10 From John Magne 2005-05-26 10:42 [reply] -------

Sample debug stack trace of crash instance:


#0  0x008c8c35 in subject_list_sort (v1=0x854bb58, v2=0x854b2c0) at
tdcache.c:157
#1  0x008d88fc in nsslist_add_element (list=0x8549a28, data=0x854bb58)
    at list.c:225
#2  0x008d8abc in nssList_AddUnique (list=0x8549a28, data=0x854bb58)
    at list.c:272
#3  0x008c96a6 in add_subject_entry (arena=0x854c3f0, cache=0x840d958,
    cert=0x854bb58, nickname=0x856f370 "encryption key for testuser",
    subjectList=0xbfe4e894) at tdcache.c:578
#4  0x008c9c91 in add_cert_to_cache (td=0x840cf70, cert=0x854bb58)
    at tdcache.c:812
#5  0x008c9e77 in nssTrustDomain_AddCertsToCache (td=0x840cf70,
    certs=0xbfe4e8fc, numCerts=1) at tdcache.c:890
#6  0x008cce2a in cert_createObject (o=0x854bb20) at pkibase.c:1045
#7  0x008cca5a in nssPKIObjectCollection_GetObjects (collection=0x8549208,
    rvObjects=0x856efb8, rvSize=2) at pkibase.c:851
#8  0x008ccf74 in nssPKIObjectCollection_GetCertificates (collection=0x8549208,
    rvOpt=0x856efb8, maximumOpt=0, arenaOpt=0x0) at pkibase.c:1100
#9  0x0087dd21 in PK11_TraverseCertsInSlot (slot=0x8401c58,
    callback=0x87ec2c <listCertsCallback>, arg=0xbfe4e9dc) at pk11cert.c:2966
(More stack frames follow...)
(gdb) where
#0  0x008c8c35 in subject_list_sort (v1=0x854bb58, v2=0x854b2c0) at
tdcache.c:157
#1  0x008d88fc in nsslist_add_element (list=0x8549a28, data=0x854bb58)
    at list.c:225
#2  0x008d8abc in nssList_AddUnique (list=0x8549a28, data=0x854bb58)
    at list.c:272
#3  0x008c96a6 in add_subject_entry (arena=0x854c3f0, cache=0x840d958,
    cert=0x854bb58, nickname=0x856f370 "encryption key for testuser",
    subjectList=0xbfe4e894) at tdcache.c:578
#4  0x008c9c91 in add_cert_to_cache (td=0x840cf70, cert=0x854bb58)
    at tdcache.c:812
#5  0x008c9e77 in nssTrustDomain_AddCertsToCache (td=0x840cf70,
    certs=0xbfe4e8fc, numCerts=1) at tdcache.c:890
#6  0x008cce2a in cert_createObject (o=0x854bb20) at pkibase.c:1045
#7  0x008cca5a in nssPKIObjectCollection_GetObjects (collection=0x8549208,
    rvObjects=0x856efb8, rvSize=2) at pkibase.c:851
#8  0x008ccf74 in nssPKIObjectCollection_GetCertificates (collection=0x8549208,
    rvOpt=0x856efb8, maximumOpt=0, arenaOpt=0x0) at pkibase.c:1100
#9  0x0087dd21 in PK11_TraverseCertsInSlot (slot=0x8401c58,
    callback=0x87ec2c <listCertsCallback>, arg=0xbfe4e9dc) at pk11cert.c:2966
#10 0x0087ed9c in PK11_ListCertsInSlot (slot=0x8401c58) at pk11cert.c:3619
#11 0x00f08c88 in NSSManager::GetKeyPolicy (aKey=0xbfe4ea8c, aBuf=0xbfe4ea9c "",
    aBufLength=1024) at NSSManager.cpp:234
#12 0x00f12bc9 in NetKeyGetPolicy (aKey=0x0, aBuf=0x854d600 "",
    aBufLen=139768512) at netkey.cpp:785
#13 0x04933159 in rhNetKey::GetCOOLKeyPolicy (this=0x83fa960, aKeyType=0,
    aKeyID=0x856b2f0 "40900062ff02000065cb", policy=0x854b2c0)
    at rhNetKey.cpp:971


------- Additional Comment #11 From Thomas Kwan 2005-05-26 10:50 [reply] -------

For CS71 release note, 

ESC 1.1 does not support CRL Distribution Point Extension. Certificate profiles
for the token enrollment in the CA subsystem has CRL Distribution Point 
extension disable by default.


------- Additional Comment #12 From Chandrasekar Kannan 2006-08-18 22:30 [reply]
-------

per bug council on 08/18/2006, downgrade to P1. Jack to check if we can fix this.


------- Additional Comment #13 From Wan-Teh Chang 2006-08-18 23:28 [reply] -------

This is NSS bug
https://bugzilla.mozilla.org/show_bug.cgi?id=295754.
It has been fixed in NSS 3.10.2.  I'm sure ESC is
using NSS 3.11.x now.