Bug 728562 - download fails if /etc/pki/nssdb is an empty directory (CURLOPT_SSL_VERIFYPEER set to 0)
Summary: download fails if /etc/pki/nssdb is an empty directory (CURLOPT_SSL_VERIFYPEE...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: curl
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kamil Dudka
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 772642
TreeView+ depends on / blocked
 
Reported: 2011-08-05 15:31 UTC by Ales Kozumplik
Modified: 2014-09-30 23:40 UTC (History)
3 users (show)

Fixed In Version: curl-7.21.3-11.fc15
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 772642 (view as bug list)
Environment:
Last Closed: 2011-09-07 03:38:06 UTC


Attachments (Terms of Use)
sample program demonstrating error (581 bytes, text/plain)
2011-08-05 15:31 UTC, Ales Kozumplik
no flags Details

Description Ales Kozumplik 2011-08-05 15:31:00 UTC
Created attachment 516913 [details]
sample program demonstrating error

Description of problem:

See the attached program to a file on an https server with a self-signed certificate. Build and run the program.

It will pass if either there is no /etc/pki/nssdb or if there are the expected files.

It will fail whenever /etc/pki/nssdb is an empty directory, with:
Problem with the SSL CA cert (path? access rights?)


Expected results:
as long as CURLOPT_SSL_VERIFYPEER is zero, contents of /etc/pki/nssdb should make no difference.

Related: Anaconda bug 696696.

Comment 1 Kamil Dudka 2011-08-05 15:53:39 UTC
Please try to set $SSL_DIR to a non-directory.  Does it solve the problem for Anaconda?

Comment 2 Ales Kozumplik 2011-08-05 16:05:54 UTC
(In reply to comment #1)
> Please try to set $SSL_DIR to a non-directory.  Does it solve the problem for
> Anaconda?

I can reproduce this in F15 on a running system, this is not isolated to Anaconda (though it's a lot more plausible to have empty nssdb there).

Answer is no:
[akozumpl@aklab ~/projects/curltest]$ export SSL_DIR='/etc/vimrc'
[akozumpl@aklab ~/projects/curltest]$ ./a.out 
Problem with the SSL CA cert (path? access rights?)

Comment 3 Kamil Dudka 2011-08-05 19:31:03 UTC
Any idea why I get a different result with your sample program?

$ SSL_DIR=/etc/vimrc ./a.out
$ SSL_DIR=/etc ./a.out
Problem with the SSL CA cert (path? access rights?)

My plan was to improve the certdir check to look for certain files as the check for the directory itself did not seem to be sufficient.  Now it looks like there are some other problems involved?

Comment 4 Ales Kozumplik 2011-08-08 06:19:14 UTC
(In reply to comment #3)
> Any idea why I get a different result with your sample program?
> 
> $ SSL_DIR=/etc/vimrc ./a.out
> $ SSL_DIR=/etc ./a.out
> Problem with the SSL CA cert (path? access rights?)
> 
> My plan was to improve the certdir check to look for certain files as the check
> for the directory itself did not seem to be sufficient.  Now it looks like
> there are some other problems involved?

No clue, this is the output on my machine:

[akozumpl@aklab ~/projects/curltest]$ SSL_DIR=/etc/vimrc ./a.out 
Problem with the SSL CA cert (path? access rights?)

The versions are:

curl-7.21.3-8.fc15.x86_64
libcurl-7.21.3-8.fc15.x86_64
libcurl-devel-7.21.3-8.fc15.x86_64

You probably are working closer to rawhide so it could make sense to do your fix there and let me retest in F16 Anaconda once the package reaches the repos?

Comment 5 Kamil Dudka 2011-08-15 12:29:09 UTC
Ales, you are right, the current handling of $SSL_DIR is stupid.  If the given path is not a directory, it falls back to the built-in path (/etc/pki/nssdb) ... and if the built-in path is a directory with no valid NSS database, it breaks.  As a workaround, you can set $SSL_DIR to a valid NSS database, which does not need to be the system one.

I have proposed a patch upstream to initialize NSS with no database in case the selected database is broken:

http://thread.gmane.org/gmane.comp.web.curl.library/32627

Comment 6 Kamil Dudka 2011-08-15 21:14:37 UTC
fixed in curl-7.21.7-3.fc17

Comment 7 Fedora Update System 2011-08-16 07:12:54 UTC
curl-7.21.3-10.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/curl-7.21.3-10.fc15

Comment 8 Fedora Update System 2011-08-16 07:13:12 UTC
curl-7.21.7-3.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/curl-7.21.7-3.fc16

Comment 9 Fedora Update System 2011-08-16 20:07:35 UTC
Package curl-7.21.7-3.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing curl-7.21.7-3.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/curl-7.21.7-3.fc16
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2011-09-07 03:37:51 UTC
curl-7.21.7-4.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2011-09-08 07:10:45 UTC
curl-7.21.3-11.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.