Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
I have a Subversion server which requires client certificates, and a DoD CAC. Under RHEL6, when I try to use the CAC to authenticate to the server using svn, svn says: svn: Invalid config: unable to load PKCS#11 provider 'coolkey'. It works properly under RHEL5. Also Firefox seems to work properly with the CAC under RHEL6 using CoolKey.
Version-Release number of selected component (if applicable):
subversion-1.6.11-2.el6.x86_64
neon-0.29.3-1.2.el6.x86_64
pakchois-0.4-3.2.el6.x86_64
coolkey-1.1.0-16.el6.x86_64
Steps to Reproduce:
1. Configure an Apache Web server with mod_ssl and mod_dav_svn.
2. Cause it to require client certificates (SSLVerifyClient require).
3. Go to an RHEL6 workstation and log in.
4. Put the following in $HOME/.subversion/servers:
[global]
ssl-pkcs11-provider = coolkey
3. On the RHEL6 workstation, type svn ls https://my-server/svn/repository
4. The error results: svn: Invalid config: unable to load PKCS#11 provider 'coolkey'.
Actual results:
unable to load CoolKey
Expected results:
successful load of CoolKey, PIN prompt, Subversion transaction successfully completes
Additional info:
This works properly under RHEL5, with
subversion-1.6.11-7.el5
neon-0.25.5-10.el5_4.1
package pakchois is not installed
coolkey-1.1.0-15.el5
I tried setting COOL_KEY_LOG_FILE on RHEL6 but got no log file.
I straced svn and it opens libcoolkeypk11.so and libckyapplet.so.1, but immediately quits.
I installed all the debuginfo packages and ran svn under gdb. Here's what I found:
pakchois is calling coolkey's C_Initialize with the CKF_OS_LOCKING_OK flag (pakchois.c:213-216), and CoolKey is throwing a PKCS11Exception(CKR_CANT_LOCK) (coolkey.cpp:215-226). From there the error propagates up from CoolKey through this call stack:
#0 load_provider (module=0x7fffffffdab8, name=<value optimized out>, reserved=0x0) at pakchois.c:214
#1 load_module (module=0x7fffffffdab8, name=<value optimized out>, reserved=0x0) at pakchois.c:253
#2 0x00007ffff48d782b in ne_ssl_pkcs11_provider_init (provider=0x7fffffffdba8, name=<value optimized out>)
at ne_pkcs11.c:542
#3 0x00007ffff62425f1 in svn_ra_neon__open (session=0x7ffff8228bd0, repos_URL=<value optimized out>, callbacks=
0x7ffff8228b08, callback_baton=<value optimized out>, config=0x7ffff8228d10, pool=<value optimized out>)
at subversion/libsvn_ra_neon/session.c:990
#4 0x00007ffff77246b0 in svn_ra_open3 (session_p=0x7fffffffde68, repos_URL=
0x7ffff8225e18 "https://afseo.eglin.af.mil/svn/cat", uuid=0x0, callbacks=0x7ffff8228b08, callback_baton=
0x7ffff8228b58, config=0x7ffff8214d30, pool=0x7ffff8228a88) at subversion/libsvn_ra/ra_loader.c:480
#5 0x00007ffff7ba81b4 in svn_client__open_ra_session_internal (ra_session=0x7fffffffde68, base_url=
0x7ffff8225e18 "https://afseo.eglin.af.mil/svn/cat", base_dir=0x0, base_access=0x0, commit_items=0x0,
use_admin=0, read_only_wc=0, ctx=0x7ffff8214c90, pool=0x7ffff8228a88) at subversion/libsvn_client/ra.c:295
#6 0x00007ffff7ba89d1 in svn_client__ra_session_from_path (ra_session_p=0x7fffffffdf40, rev_p=0x7fffffffdf38,
url_p=0x7fffffffdf28, path_or_url=0x7ffff8225e18 "https://afseo.eglin.af.mil/svn/cat", base_access=0x0,
peg_revision_p=<value optimized out>, revision=0x7fffffffe168, ctx=0x7ffff8214c90, pool=0x7ffff8228a88)
at subversion/libsvn_client/ra.c:445
#7 0x00007ffff7b94238 in svn_client_list2 (path_or_url=<value optimized out>, peg_revision=0x7fffffffdff0,
revision=<value optimized out>, depth=svn_depth_immediates, dirent_fields=1, fetch_locks=0, list_func=
0x7ffff7fe4f40 <print_dirent>, baton=0x7fffffffe000, ctx=0x7ffff8214c90, pool=0x7ffff8228a88)
at subversion/libsvn_client/list.c:134
#8 0x00007ffff7fe4cbf in svn_cl__list (os=<value optimized out>, baton=<value optimized out>, pool=
0x7ffff8214298) at subversion/svn/list-cmd.c:277
#9 0x00007ffff7fe8448 in main (argc=<value optimized out>, argv=<value optimized out>)
at subversion/svn/main.c:2119
The fix discussed in the thread above, which worked for me under RHEL5, works for me now under RHEL6 - that being to patch pakchois to pass NULL to C_Initialize instead of the args structure.
Wan-Teh Chang suggested in that thread that CoolKey needed some sort of change regarding thread safety. I suppose that would be a more correct fix than to merely stop requesting locking, but as before I will leave it to people who have either more time or more expertise or both.
Hmm, I though I had fixed the coolkey locking issue. I know coolkey has locking functions, I don't know why it's throwing the CKR_CANT_LOCK.
Passing NULL should be fine, as long as pkchois can handle it's own locking. NSS tries to initiallize modules with locking, and if that fails, NSS marks the module as not-thread-safe and does it's own locking.
Comment 5RHEL Program Management
2011-04-04 02:08:34 UTC
Since RHEL 6.1 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.
Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.
The patch which fixes this for RHEL 6 is the same patch already included in RHEL 5.
bob
Comment 9Chandrasekar Kannan
2011-11-10 13:48:32 UTC
Here's how I verified..
1. Configure an Apache Web server with mod_nss
2. Cause it to require client certificates
<Location /repos>
DAV svn
SVNPath /svn/myrepo
NSSRequireSSL
NSSVerifyClient optional
NSSOptions +OptRenegotiate
NSSRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
3. Go to an RHEL6 workstation and log in.
4. Put the following in $HOME/.subversion/servers:
[global]
ssl-pkcs11-provider = coolkey
3. On the RHEL6 workstation, type..
[root@dhcp231-57 conf.d]# svn ls https://dhcp231-57.rdu.redhat.com/repos/trunk
Passphrase for 'PIN for token "TestUserKDC" in slot "SCM SCR 331 (21120612212405) 00 00"':
dir1/
dir2/
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
http://rhn.redhat.com/errata/RHEA-2011-1738.html
Description of problem: I have a Subversion server which requires client certificates, and a DoD CAC. Under RHEL6, when I try to use the CAC to authenticate to the server using svn, svn says: svn: Invalid config: unable to load PKCS#11 provider 'coolkey'. It works properly under RHEL5. Also Firefox seems to work properly with the CAC under RHEL6 using CoolKey. Version-Release number of selected component (if applicable): subversion-1.6.11-2.el6.x86_64 neon-0.29.3-1.2.el6.x86_64 pakchois-0.4-3.2.el6.x86_64 coolkey-1.1.0-16.el6.x86_64 Steps to Reproduce: 1. Configure an Apache Web server with mod_ssl and mod_dav_svn. 2. Cause it to require client certificates (SSLVerifyClient require). 3. Go to an RHEL6 workstation and log in. 4. Put the following in $HOME/.subversion/servers: [global] ssl-pkcs11-provider = coolkey 3. On the RHEL6 workstation, type svn ls https://my-server/svn/repository 4. The error results: svn: Invalid config: unable to load PKCS#11 provider 'coolkey'. Actual results: unable to load CoolKey Expected results: successful load of CoolKey, PIN prompt, Subversion transaction successfully completes Additional info: This works properly under RHEL5, with subversion-1.6.11-7.el5 neon-0.25.5-10.el5_4.1 package pakchois is not installed coolkey-1.1.0-15.el5 I tried setting COOL_KEY_LOG_FILE on RHEL6 but got no log file. I straced svn and it opens libcoolkeypk11.so and libckyapplet.so.1, but immediately quits. I installed all the debuginfo packages and ran svn under gdb. Here's what I found: pakchois is calling coolkey's C_Initialize with the CKF_OS_LOCKING_OK flag (pakchois.c:213-216), and CoolKey is throwing a PKCS11Exception(CKR_CANT_LOCK) (coolkey.cpp:215-226). From there the error propagates up from CoolKey through this call stack: #0 load_provider (module=0x7fffffffdab8, name=<value optimized out>, reserved=0x0) at pakchois.c:214 #1 load_module (module=0x7fffffffdab8, name=<value optimized out>, reserved=0x0) at pakchois.c:253 #2 0x00007ffff48d782b in ne_ssl_pkcs11_provider_init (provider=0x7fffffffdba8, name=<value optimized out>) at ne_pkcs11.c:542 #3 0x00007ffff62425f1 in svn_ra_neon__open (session=0x7ffff8228bd0, repos_URL=<value optimized out>, callbacks= 0x7ffff8228b08, callback_baton=<value optimized out>, config=0x7ffff8228d10, pool=<value optimized out>) at subversion/libsvn_ra_neon/session.c:990 #4 0x00007ffff77246b0 in svn_ra_open3 (session_p=0x7fffffffde68, repos_URL= 0x7ffff8225e18 "https://afseo.eglin.af.mil/svn/cat", uuid=0x0, callbacks=0x7ffff8228b08, callback_baton= 0x7ffff8228b58, config=0x7ffff8214d30, pool=0x7ffff8228a88) at subversion/libsvn_ra/ra_loader.c:480 #5 0x00007ffff7ba81b4 in svn_client__open_ra_session_internal (ra_session=0x7fffffffde68, base_url= 0x7ffff8225e18 "https://afseo.eglin.af.mil/svn/cat", base_dir=0x0, base_access=0x0, commit_items=0x0, use_admin=0, read_only_wc=0, ctx=0x7ffff8214c90, pool=0x7ffff8228a88) at subversion/libsvn_client/ra.c:295 #6 0x00007ffff7ba89d1 in svn_client__ra_session_from_path (ra_session_p=0x7fffffffdf40, rev_p=0x7fffffffdf38, url_p=0x7fffffffdf28, path_or_url=0x7ffff8225e18 "https://afseo.eglin.af.mil/svn/cat", base_access=0x0, peg_revision_p=<value optimized out>, revision=0x7fffffffe168, ctx=0x7ffff8214c90, pool=0x7ffff8228a88) at subversion/libsvn_client/ra.c:445 #7 0x00007ffff7b94238 in svn_client_list2 (path_or_url=<value optimized out>, peg_revision=0x7fffffffdff0, revision=<value optimized out>, depth=svn_depth_immediates, dirent_fields=1, fetch_locks=0, list_func= 0x7ffff7fe4f40 <print_dirent>, baton=0x7fffffffe000, ctx=0x7ffff8214c90, pool=0x7ffff8228a88) at subversion/libsvn_client/list.c:134 #8 0x00007ffff7fe4cbf in svn_cl__list (os=<value optimized out>, baton=<value optimized out>, pool= 0x7ffff8214298) at subversion/svn/list-cmd.c:277 #9 0x00007ffff7fe8448 in main (argc=<value optimized out>, argv=<value optimized out>) at subversion/svn/main.c:2119