rpms/openldap
6
0
Fork 0
Code Issues Pull Requests Releases Activity

MozNSS Compat. Layer: fix incorrect parsing of CACertDir

Browse Source 
NSS DB type prefix was not taken into account at all. Due to this the
path might not have been stat-ed. Thus, last part of the path would
have been considered an NSS DB name prefix which would be incorrect.

(cherry picked from commit 7f41b4a1ffe61c03d65896d82fc6b72a2710c492)
(originally #1533955)

Related: #1400570
This commit is contained in:
Matúš Honěk 2018-01-31 22:11:45 +01:00
parent 8c29eeec6a
commit 7264811847
2 changed files with 46 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
openldap-tlsmc.patch
View File

@ -1,7 +1,7 @@
MozNSS Interception Code MozNSS Interception Code
Author: Matus Honek <mhonek@redhat.com> Author: Matus Honek <mhonek@redhat.com>
Date: Wed Jan 31 21:44:47 CET 2018 Date: Wed Jan 31 22:08:28 CET 2018
diff --git a/configure.in b/configure.in diff --git a/configure.in b/configure.in
--- a/configure.in --- a/configure.in
+++ b/configure.in +++ b/configure.in
@ -283,7 +283,7 @@ diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/libraries/libldap/tls_mc.c +++ b/libraries/libldap/tls_mc.c
@@ -0,0 +1,1316 @@ @@ -0,0 +1,1345 @@
+#include "portable.h" +#include "portable.h"
+ +
+#ifdef HAVE_MOZNSS_COMPATIBILITY +#ifdef HAVE_MOZNSS_COMPATIBILITY
@ -484,33 +484,61 @@ new file mode 100644
+ +
+/* BORROWED FROM tls_m.c */ +/* BORROWED FROM tls_m.c */
+static void +static void
+tlsmc_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix ) +tlsmc_get_certdb_prefix( const char *certdir, char **nsscertdir, char **realcertdir, char **prefix )
+{ +{
+ char sep = PR_GetDirectorySeparator(); + char sep = PR_GetDirectorySeparator();
+ char *ptr = NULL; + char *ptr = NULL;
+ char *chkpath = NULL;
+ struct PRFileInfo prfi; + struct PRFileInfo prfi;
+ PRStatus prc; + PRStatus prc;
+ +
+ *realcertdir = (char *)certdir; /* default is the one passed in */ + *realcertdir = (char *)certdir; /* default is the one passed in */
+
+ /* if certdir is not given, just return */
+ if ( !certdir ) return; + if ( !certdir ) return;
+ +
+ prc = PR_GetFileInfo( certdir, &prfi ); + *nsscertdir = certdir;
+ /* if certdir exists (file or directory) then it cannot specify a prefix */ +
+ if ( prc == PR_SUCCESS ) { + /* ignore database type prefix (e.g. sql:, dbm:) if provided */
+ /* and drop potential last '/' */ + if ( NULL != ( chkpath = strchr( certdir, ':' ) ) ) {
+ ptr = strrchr( *realcertdir, sep ); + *realcertdir = chkpath + 1;
+ if ( ptr && (! *(ptr+1) ) ) {
+ *ptr = '\0';
+ } + }
+ return; +
+ /* if certdir exists (file or directory) then it cannot specify a prefix */
+ prc = PR_GetFileInfo( *realcertdir, &prfi );
+ if ( prc == PR_SUCCESS ) {
+ goto finish;
+ } + }
+ +
+ /* if certdir was given, and there is a '/' in certdir, see if there + /* if certdir was given, and there is a '/' in certdir, see if there
+ is anything after the last '/' - if so, assume it is the prefix */ + is anything after the last '/' - if so, assume it is the prefix */
+ if ( ( ( ptr = strrchr( certdir, sep ) ) ) && *(ptr+1) ) { + /* if ( ( ( ptr = strrchr( *realcertdir, sep ) ) ) && *(ptr + 1) ) { */
+ *realcertdir = PL_strndup( certdir, ptr-certdir ); + /* *realcertdir = PL_strndup( *realcertdir, ptr - (*realcertdir) ); */
+ *prefix = PL_strdup( ptr+1 ); + /* *prefix = PL_strdup( ptr + 1 ); */
+ /* } */
+
+
+ if ( ptr = strrchr( *realcertdir, sep ) ) {
+ if ( *(ptr + 1) ) {
+ *ptr = '\0';
+ *prefix = ptr + 1;
+ } else {
+ *prefix = *realcertdir + strlen( *realcertdir ); // empty string
+ } + }
+ } else {
+ *prefix = *realcertdir;
+ *realcertdir = *prefix + strlen( *prefix ); // empty string
+ }
+finish:
+ /* drop potential last '/' from realcertdir */
+ do {
+ ptr = strrchr( *realcertdir, sep );
+ if ( ptr && (! *(ptr+1) ) ) {
+ *ptr = '\0';
+ } else {
+ break;
+ }
+ } while (1);
+ +
+ return; + return;
+} +}
@ -748,17 +776,18 @@ new file mode 100644
+ for ( ii = 0; !done && ( ii < SECURITYDIRS_COUNT ); ++ii ) { + for ( ii = 0; !done && ( ii < SECURITYDIRS_COUNT ); ++ii ) {
+ // get certdb prefix + // get certdb prefix
+ const char *securitydir = securitydirs[ii]; + const char *securitydir = securitydirs[ii];
+ char *nsscertdir = NULL;
+ char *realcertdir = NULL; + char *realcertdir = NULL;
+ const char *defprefix = ""; + const char *defprefix = "";
+ char *prefix = (char *)defprefix; + char *prefix = (char *)defprefix;
+ if ( securitydir == NULL ) continue; + if ( securitydir == NULL ) continue;
+ tlsmc_get_certdb_prefix( securitydir, &realcertdir, &prefix ); //FIXME + tlsmc_get_certdb_prefix( securitydir, &nsscertdir, &realcertdir, &prefix );
+ *out_nssdb_dir = strdup( realcertdir ); + *out_nssdb_dir = strdup( realcertdir );
+ *out_nssdb_prefix = strdup( prefix ); + *out_nssdb_prefix = strdup( prefix );
+ +
+ Debug( LDAP_DEBUG_TRACE, + Debug( LDAP_DEBUG_TRACE,
+ "tlsmc_open_nssdb: INFO: trying to initialize moznss using security dir `%s` prefix `%s`.\n", + "tlsmc_open_nssdb: INFO: trying to initialize moznss using security dir `%s` prefix `%s`.\n",
+ realcertdir, prefix, NULL); + nsscertdir, prefix, NULL);
+ +
+ // init context + // init context
+ NSSInitContext *initctx = NULL; + NSSInitContext *initctx = NULL;
@ -766,7 +795,7 @@ new file mode 100644
+ memset( &initparams, 0, sizeof( initparams ) ); + memset( &initparams, 0, sizeof( initparams ) );
+ initparams.length = sizeof( initparams ); + initparams.length = sizeof( initparams );
+ +
+ initctx = NSS_InitContext( realcertdir, + initctx = NSS_InitContext( nsscertdir,
+ prefix, + prefix,
+ prefix, + prefix,
+ SECMOD_DB, + SECMOD_DB,

1
openldap.spec
View File

@ -518,6 +518,7 @@ exit 0
%changelog %changelog
* Wed Feb 7 2018 Matus Honek <mhonek@redhat.com> - 2.4.45-7 * Wed Feb 7 2018 Matus Honek <mhonek@redhat.com> - 2.4.45-7
- MozNSS Compat. Layer fixes (#1400570) - MozNSS Compat. Layer fixes (#1400570)
- fix incorrect parsing of CACertDir (orig. #1533955)
- fix PIN disclaimer not always shown (orig. #1516409) - fix PIN disclaimer not always shown (orig. #1516409)
- fix recursive directory deletion (orig. #1516409) - fix recursive directory deletion (orig. #1516409)
- Ensure consistency of a PEM dir before usage (orig. #1516409) - Ensure consistency of a PEM dir before usage (orig. #1516409)