[openldap] fix: less influence between individual TLS contexts
jvcelak
jvcelak at fedoraproject.org
Wed Jun 27 12:41:34 UTC 2012
commit 50ed49760bf0d78f8d2ccdc54c69ddeef1c1c1d0
Author: Jan Vcelak <jvcelak at redhat.com>
Date: Wed Jun 27 14:39:32 2012 +0200
fix: less influence between individual TLS contexts
Resolves: #795763 (and possibly others)
openldap-nss-multiple-tls-contexts.patch | 1029 ++++++++++++++++++++++++++++++
openldap.spec | 5 +
2 files changed, 1034 insertions(+), 0 deletions(-)
---
diff --git a/openldap-nss-multiple-tls-contexts.patch b/openldap-nss-multiple-tls-contexts.patch
new file mode 100644
index 0000000..bf008f4
--- /dev/null
+++ b/openldap-nss-multiple-tls-contexts.patch
@@ -0,0 +1,1029 @@
+MozNSS: TLS fixes which should resolve problems with applications using multiple TLS contexts
+
+ - context specific token description for certdb
+ - store certificate object instead of nickname in in ctx
+ - lock whole init and clenaup process
+ - do not authenticate to a slot manually
+ - do not retry when reading the pin from file
+
+Author: Jan Vcelak <jvcelak at redhat.com>
+Upstream ITS: #7312 #7313 #7314 #7315 #7316
+Upstream commit: 87132b8 d07779e 3531c34 a171237 2db5195
+Resolves: #795763 (and possibly other)
+
+diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
+index 2e755eb..4b5727b 100644
+--- a/libraries/libldap/tls_m.c
++++ b/libraries/libldap/tls_m.c
+@@ -81,16 +81,18 @@
+ typedef struct tlsm_ctx {
+ PRFileDesc *tc_model;
+ int tc_refcnt;
++ int tc_unique; /* unique number associated with this ctx */
+ PRBool tc_verify_cert;
+ CERTCertDBHandle *tc_certdb;
+- char *tc_certname;
++ PK11SlotInfo *tc_certdb_slot;
++ CERTCertificate *tc_certificate;
++ SECKEYPrivateKey *tc_private_key;
+ char *tc_pin_file;
+ struct ldaptls *tc_config;
+ int tc_is_server;
+ int tc_require_cert;
+ PRCallOnceType tc_callonce;
+ PRBool tc_using_pem;
+- char *tc_slotname; /* if using pem */
+ #ifdef HAVE_NSS_INITCONTEXT
+ NSSInitContext *tc_initctx; /* the NSS context */
+ #endif
+@@ -104,10 +106,16 @@ typedef struct tlsm_ctx {
+
+ typedef PRFileDesc tlsm_session;
+
++static int tlsm_ctx_count;
++#define TLSM_CERTDB_DESC_FMT "ldap(%d)"
++
+ static PRDescIdentity tlsm_layer_id;
+
+ static const PRIOMethods tlsm_PR_methods;
+
++#define CERTDB_NONE NULL
++#define PREFIX_NONE NULL
++
+ #define PEM_LIBRARY "nsspem"
+ #define PEM_MODULE "PEM"
+ /* hash files for use with cacertdir have this file name suffix */
+@@ -117,13 +125,11 @@ static const PRIOMethods tlsm_PR_methods;
+ static SECMODModule *pem_module;
+
+ #define DEFAULT_TOKEN_NAME "default"
+-/* sprintf format used to create token name */
+-#define TLSM_PEM_TOKEN_FMT "PEM Token #%ld"
++#define TLSM_PEM_SLOT_CACERTS "PEM Token #0"
++#define TLSM_PEM_SLOT_CERTS "PEM Token #1"
+
+-static int tlsm_slot_count;
+-
+-#define PK11_SETATTRS(x,id,v,l) (x)->type = (id); \
+- (x)->pValue=(v); (x)->ulValueLen = (l);
++#define PK11_SETATTRS(x,id,v,l) (x).type = (id); \
++ (x).pValue=(v); (x).ulValueLen = (l);
+
+ /* forward declaration */
+ static int tlsm_init( void );
+@@ -134,6 +140,7 @@ static int tlsm_init( void );
+ tlsm_thr_init in a non-threaded context - so we have
+ to wrap the mutex creation in a prcallonce
+ */
++static ldap_pvt_thread_mutex_t tlsm_ctx_count_mutex;
+ static ldap_pvt_thread_mutex_t tlsm_init_mutex;
+ static ldap_pvt_thread_mutex_t tlsm_pem_mutex;
+ static PRCallOnceType tlsm_init_mutex_callonce = {0,0};
+@@ -141,6 +148,12 @@ static PRCallOnceType tlsm_init_mutex_callonce = {0,0};
+ static PRStatus PR_CALLBACK
+ tlsm_thr_init_callonce( void )
+ {
++ if ( ldap_pvt_thread_mutex_init( &tlsm_ctx_count_mutex ) ) {
++ Debug( LDAP_DEBUG_ANY,
++ "TLS: could not create mutex for context counter: %d\n", errno, 0, 0 );
++ return PR_FAILURE;
++ }
++
+ if ( ldap_pvt_thread_mutex_init( &tlsm_init_mutex ) ) {
+ Debug( LDAP_DEBUG_ANY,
+ "TLS: could not create mutex for moznss initialization: %d\n", errno, 0, 0 );
+@@ -890,6 +903,8 @@ tlsm_get_pin(PK11SlotInfo *slot, PRBool retry, tlsm_ctx *ctx)
+ */
+ if ( ctx->tc_pin_file ) {
+ pwdstr = tlsm_get_pin_from_file( token_name, ctx );
++ if (retry && pwdstr != NULL)
++ return NULL;
+ }
+ #endif /* RETRIEVE_PASSWORD_FROM_FILE */
+ #ifdef READ_PASSWORD_FROM_STDIN
+@@ -932,6 +947,15 @@ tlsm_pin_prompt(PK11SlotInfo *slot, PRBool retry, void *arg)
+ return tlsm_get_pin( slot, retry, ctx );
+ }
+
++static char *
++tlsm_ctx_subject_name(tlsm_ctx *ctx)
++{
++ if (!ctx || !ctx->tc_certificate)
++ return "(unknown)";
++
++ return ctx->tc_certificate->subjectName;
++}
++
+ static SECStatus
+ tlsm_get_basic_constraint_extension( CERTCertificate *cert,
+ CERTBasicConstraints *cbcval )
+@@ -1088,25 +1112,6 @@ tlsm_auth_cert_handler(void *arg, PRFileDesc *fd,
+ return ret;
+ }
+
+-static int
+-tlsm_authenticate_to_slot( tlsm_ctx *ctx, PK11SlotInfo *slot )
+-{
+- int rc = -1;
+-
+- if ( SECSuccess != PK11_Authenticate( slot, PR_FALSE, ctx ) ) {
+- char *token_name = PK11_GetTokenName( slot );
+- PRErrorCode errcode = PR_GetError();
+- Debug( LDAP_DEBUG_ANY,
+- "TLS: could not authenticate to the security token %s - error %d:%s.\n",
+- token_name ? token_name : DEFAULT_TOKEN_NAME, errcode,
+- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
+- } else {
+- rc = 0; /* success */
+- }
+-
+- return rc;
+-}
+-
+ static SECStatus
+ tlsm_nss_shutdown_cb( void *appData, void *nssData )
+ {
+@@ -1196,22 +1201,18 @@ tlsm_free_pem_objs( tlsm_ctx *ctx )
+ }
+
+ static int
+-tlsm_add_cert_from_file( tlsm_ctx *ctx, const char *filename, PRBool isca, PRBool istrusted )
++tlsm_add_cert_from_file( tlsm_ctx *ctx, const char *filename, PRBool isca )
+ {
+- CK_SLOT_ID slotID;
+- PK11SlotInfo *slot = NULL;
+- PK11GenericObject *rv;
+- CK_ATTRIBUTE *attrs;
+- CK_ATTRIBUTE theTemplate[20];
++ PK11SlotInfo *slot;
++ PK11GenericObject *cert;
++ CK_ATTRIBUTE attrs[4];
+ CK_BBOOL cktrue = CK_TRUE;
+ CK_BBOOL ckfalse = CK_FALSE;
+ CK_OBJECT_CLASS objClass = CKO_CERTIFICATE;
+- char tmpslotname[64];
+- char *slotname = NULL;
+- const char *ptr = NULL;
+- char sep = PR_GetDirectorySeparator();
++ char *slotname;
+ PRFileInfo fi;
+ PRStatus status;
++ SECItem certDER = { 0, NULL, 0 };
+
+ memset( &fi, 0, sizeof(fi) );
+ status = PR_GetFileInfo( filename, &fi );
+@@ -1232,87 +1233,96 @@ tlsm_add_cert_from_file( tlsm_ctx *ctx, const char *filename, PRBool isca, PRBoo
+ return -1;
+ }
+
+- attrs = theTemplate;
++ slotname = isca ? TLSM_PEM_SLOT_CACERTS : TLSM_PEM_SLOT_CERTS;
++ slot = PK11_FindSlotByName( slotname );
+
+- if ( isca ) {
+- slotID = 0; /* CA and trust objects use slot 0 */
+- PR_snprintf( tmpslotname, sizeof(tmpslotname), TLSM_PEM_TOKEN_FMT, slotID );
+- slotname = tmpslotname;
+- istrusted = PR_TRUE;
+- } else {
+- if ( ctx->tc_slotname == NULL ) { /* need new slot */
+- if ( istrusted ) {
+- slotID = 0;
+- } else {
+- slotID = ++tlsm_slot_count;
+- }
+- ctx->tc_slotname = PR_smprintf( TLSM_PEM_TOKEN_FMT, slotID );
+- }
+- slotname = ctx->tc_slotname;
+-
+- if ( ( ptr = PL_strrchr( filename, sep ) ) ) {
+- PL_strfree( ctx->tc_certname );
+- ++ptr;
+- if ( istrusted ) {
+- /* pemnss conflates trusted certs with CA certs - since there can
+- be more than one CA cert in a file (e.g. ca-bundle.crt) pemnss
+- numbers each trusted cert - in the case of a server cert, there will be
+- only one, so it will be number 0 */
+- ctx->tc_certname = PR_smprintf( "%s:%s - 0", slotname, ptr );
+- } else {
+- ctx->tc_certname = PR_smprintf( "%s:%s", slotname, ptr );
+- }
+- }
++ if ( !slot ) {
++ PRErrorCode errcode = PR_GetError();
++ Debug( LDAP_DEBUG_ANY,
++ "TLS: could not find the slot for the certificate '%s' - error %d:%s.\n",
++ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
++ return -1;
+ }
+
+- slot = PK11_FindSlotByName( slotname );
++ PK11_SETATTRS( attrs[0], CKA_CLASS, &objClass, sizeof(objClass) );
++ PK11_SETATTRS( attrs[1], CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) );
++ PK11_SETATTRS( attrs[2], CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 );
++ PK11_SETATTRS( attrs[3], CKA_TRUST, isca ? &cktrue : &ckfalse, sizeof(CK_BBOOL) );
+
+- if ( !slot ) {
++ cert = PK11_CreateGenericObject( slot, attrs, 4, PR_FALSE /* isPerm */ );
++
++ if ( !cert ) {
+ PRErrorCode errcode = PR_GetError();
+ Debug( LDAP_DEBUG_ANY,
+- "TLS: could not find the slot for certificate %s - error %d:%s.\n",
+- ctx->tc_certname, errcode,
+- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
++ "TLS: could not add the certificate '%s' - error %d:%s.\n",
++ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
++ PK11_FreeSlot( slot );
+ return -1;
+ }
+
+- PK11_SETATTRS( attrs, CKA_CLASS, &objClass, sizeof(objClass) ); attrs++;
+- PK11_SETATTRS( attrs, CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); attrs++;
+- PK11_SETATTRS( attrs, CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 ); attrs++;
+- if ( istrusted ) {
+- PK11_SETATTRS( attrs, CKA_TRUST, &cktrue, sizeof(CK_BBOOL) ); attrs++;
+- } else {
+- PK11_SETATTRS( attrs, CKA_TRUST, &ckfalse, sizeof(CK_BBOOL) ); attrs++;
++ /* if not CA, we store the certificate in ctx->tc_certificate */
++ if ( !isca ) {
++ if ( PK11_ReadRawAttribute( PK11_TypeGeneric, cert, CKA_VALUE, &certDER ) != SECSuccess ) {
++ PRErrorCode errcode = PR_GetError();
++ Debug( LDAP_DEBUG_ANY,
++ "TLS: could not get DER of the '%s' certificate - error %d:%s.\n",
++ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
++ PK11_DestroyGenericObject( cert );
++ PK11_FreeSlot( slot );
++ return -1;
++ }
++
++ ctx->tc_certificate = PK11_FindCertFromDERCertItem( slot, &certDER, NULL );
++ SECITEM_FreeItem( &certDER, PR_FALSE );
++
++ if ( !ctx->tc_certificate ) {
++ PRErrorCode errcode = PR_GetError();
++ Debug( LDAP_DEBUG_ANY,
++ "TLS: could not get certificate '%s' using DER - error %d:%s.\n",
++ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
++ PK11_DestroyGenericObject( cert );
++ PK11_FreeSlot( slot );
++ return -1;
++ }
+ }
+- /* This loads the certificate in our PEM module into the appropriate
+- * slot.
+- */
+- rv = PK11_CreateGenericObject( slot, theTemplate, 4, PR_FALSE /* isPerm */ );
++
++ tlsm_add_pem_obj( ctx, cert );
+
+ PK11_FreeSlot( slot );
+
+- if ( !rv ) {
++ return 0;
++}
++
++static int
++tlsm_ctx_load_private_key(tlsm_ctx *ctx)
++{
++ if (!ctx->tc_certificate)
++ return -1;
++
++ if (ctx->tc_private_key)
++ return 0;
++
++ void *pin_arg = SSL_RevealPinArg(ctx->tc_model);
++
++ ctx->tc_private_key = PK11_FindKeyByAnyCert(ctx->tc_certificate, pin_arg);
++ if (!ctx->tc_private_key) {
+ PRErrorCode errcode = PR_GetError();
+- Debug( LDAP_DEBUG_ANY,
+- "TLS: could not add the certificate %s - error %d:%s.\n",
+- ctx->tc_certname, errcode,
+- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
++ Debug(LDAP_DEBUG_ANY,
++ "TLS: cannot find private key for certificate '%s' (error %d: %s)",
++ tlsm_ctx_subject_name(ctx), errcode,
++ PR_ErrorToString(errcode, PR_LANGUAGE_I_DEFAULT));
+ return -1;
+ }
+
+- tlsm_add_pem_obj( ctx, rv );
+-
+ return 0;
+ }
+
+ static int
+ tlsm_add_key_from_file( tlsm_ctx *ctx, const char *filename )
+ {
+- CK_SLOT_ID slotID;
+ PK11SlotInfo * slot = NULL;
+- PK11GenericObject *rv;
+- CK_ATTRIBUTE *attrs;
+- CK_ATTRIBUTE theTemplate[20];
++ PK11GenericObject *key;
++ CK_ATTRIBUTE attrs[3];
+ CK_BBOOL cktrue = CK_TRUE;
+ CK_OBJECT_CLASS objClass = CKO_PRIVATE_KEY;
+ int retcode = 0;
+@@ -1338,48 +1348,40 @@ tlsm_add_key_from_file( tlsm_ctx *ctx, const char *filename )
+ return -1;
+ }
+
+- attrs = theTemplate;
+-
+- if ( ctx->tc_slotname == NULL ) { /* need new slot */
+- slotID = ++tlsm_slot_count;
+- ctx->tc_slotname = PR_smprintf( TLSM_PEM_TOKEN_FMT, slotID );
+- }
+- slot = PK11_FindSlotByName( ctx->tc_slotname );
++ slot = PK11_FindSlotByName( TLSM_PEM_SLOT_CERTS );
+
+ if ( !slot ) {
+ PRErrorCode errcode = PR_GetError();
+ Debug( LDAP_DEBUG_ANY,
+- "TLS: could not find the slot %s for the private key - error %d:%s.\n",
+- ctx->tc_slotname, errcode,
+- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
++ "TLS: could not find the slot for the private key '%s' - error %d:%s.\n",
++ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
+ return -1;
+ }
+
+- PK11_SETATTRS( attrs, CKA_CLASS, &objClass, sizeof(objClass) ); attrs++;
+- PK11_SETATTRS( attrs, CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); attrs++;
+- PK11_SETATTRS( attrs, CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 ); attrs++;
+- rv = PK11_CreateGenericObject( slot, theTemplate, 3, PR_FALSE /* isPerm */ );
++ PK11_SETATTRS( attrs[0], CKA_CLASS, &objClass, sizeof(objClass) );
++ PK11_SETATTRS( attrs[1], CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) );
++ PK11_SETATTRS( attrs[2], CKA_LABEL, (unsigned char *)filename, strlen(filename)+1 );
++
++ key = PK11_CreateGenericObject( slot, attrs, 3, PR_FALSE /* isPerm */ );
+
+- if ( !rv ) {
++ if ( !key ) {
+ PRErrorCode errcode = PR_GetError();
+ Debug( LDAP_DEBUG_ANY,
+- "TLS: could not add the certificate %s - error %d:%s.\n",
+- ctx->tc_certname, errcode,
+- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
++ "TLS: could not add the private key '%s' - error %d:%s.\n",
++ filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
+ retcode = -1;
+ } else {
++ tlsm_add_pem_obj( ctx, key );
++ retcode = 0;
++
+ /* When adding an encrypted key the PKCS#11 will be set as removed */
+ /* This will force the token to be seen as re-inserted */
+ SECMOD_WaitForAnyTokenEvent( pem_module, 0, 0 );
+ PK11_IsPresent( slot );
+- retcode = 0;
+ }
+
+ PK11_FreeSlot( slot );
+
+- if ( !retcode ) {
+- tlsm_add_pem_obj( ctx, rv );
+- }
+ return retcode;
+ }
+
+@@ -1396,7 +1398,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
+ }
+
+ if ( cacertfile ) {
+- int rc = tlsm_add_cert_from_file( ctx, cacertfile, isca, PR_TRUE );
++ int rc = tlsm_add_cert_from_file( ctx, cacertfile, isca );
+ if ( rc ) {
+ errcode = PR_GetError();
+ Debug( LDAP_DEBUG_ANY,
+@@ -1470,7 +1472,7 @@ tlsm_init_ca_certs( tlsm_ctx *ctx, const char *cacertfile, const char *cacertdir
+ continue;
+ }
+ fullpath = PR_smprintf( "%s/%s", cacertdir, entry->name );
+- if ( !tlsm_add_cert_from_file( ctx, fullpath, isca, PR_TRUE ) ) {
++ if ( !tlsm_add_cert_from_file( ctx, fullpath, isca ) ) {
+ Debug( LDAP_DEBUG_TRACE,
+ "TLS: loaded CA certificate file %s from CA certificate directory %s.\n",
+ fullpath, cacertdir, 0 );
+@@ -1534,6 +1536,45 @@ tlsm_get_certdb_prefix( const char *certdir, char **realcertdir, char **prefix )
+ }
+
+ /*
++ * Currently mutiple MozNSS contexts share one certificate storage. When the
++ * certdb is being opened, only new certificates are added to the storage.
++ * When different databases are used, conflicting nicknames make the
++ * certificate lookup by the nickname impossible. In addition a token
++ * description might be prepended in certain conditions.
++ *
++ * In order to make the certificate lookup by nickname possible, we explicitly
++ * open each database using SECMOD_OpenUserDB and assign it the token
++ * description. The token description is generated using ctx->tc_unique value,
++ * which is unique for each context.
++ */
++static PK11SlotInfo *
++tlsm_init_open_certdb(tlsm_ctx *ctx, const char *dbdir, const char *prefix)
++{
++ PK11SlotInfo *slot = NULL;
++ char *token_desc = NULL;
++ char *config = NULL;
++
++ token_desc = PR_smprintf(TLSM_CERTDB_DESC_FMT, ctx->tc_unique);
++ config = PR_smprintf("configDir='%s' tokenDescription='%s' certPrefix='%s' keyPrefix='%s' flags=readOnly",
++ dbdir, token_desc, prefix, prefix);
++ Debug(LDAP_DEBUG_TRACE, "TLS: certdb config: %s\n", config, 0, 0);
++
++ slot = SECMOD_OpenUserDB(config);
++ if (!slot) {
++ PRErrorCode errcode = PR_GetError();
++ Debug(LDAP_DEBUG_TRACE, "TLS: cannot open certdb '%s', error %d:%s\n", dbdir, errcode,
++ PR_ErrorToString(errcode, PR_LANGUAGE_I_DEFAULT));
++ }
++
++ if (token_desc)
++ PR_smprintf_free(token_desc);
++ if (config)
++ PR_smprintf_free(config);
++
++ return slot;
++}
++
++/*
+ * This is the part of the init we defer until we get the
+ * actual security configuration information. This is
+ * only called once, protected by a PRCallOnce
+@@ -1553,6 +1594,7 @@ tlsm_deferred_init( void *arg )
+ #ifdef HAVE_NSS_INITCONTEXT
+ NSSInitParameters initParams;
+ NSSInitContext *initctx = NULL;
++ PK11SlotInfo *certdb_slot = NULL;
+ #endif
+ SECStatus rc;
+ int done = 0;
+@@ -1613,28 +1655,37 @@ tlsm_deferred_init( void *arg )
+ }
+
+ tlsm_get_certdb_prefix( securitydir, &realcertdir, &prefix );
+- LDAP_MUTEX_LOCK( &tlsm_init_mutex );
+
++ /* initialize only moddb; certdb will be initialized explicitly */
+ #ifdef HAVE_NSS_INITCONTEXT
+ #ifdef INITCONTEXT_HACK
+ if ( !NSS_IsInitialized() && ctx->tc_is_server ) {
+ rc = NSS_Initialize( realcertdir, prefix, prefix, SECMOD_DB, NSS_INIT_READONLY );
+ } else {
+ initctx = NSS_InitContext( realcertdir, prefix, prefix, SECMOD_DB,
+- &initParams, NSS_INIT_READONLY );
+- rc = (initctx == NULL) ? SECFailure : SECSuccess;
++ &initParams, NSS_INIT_READONLY|NSS_INIT_NOCERTDB );
+ }
+ #else
+ initctx = NSS_InitContext( realcertdir, prefix, prefix, SECMOD_DB,
+- &initParams, NSS_INIT_READONLY );
+- rc = (initctx == NULL) ? SECFailure : SECSuccess;
++ &initParams, NSS_INIT_READONLY|NSS_INIT_NOCERTDB );
+ #endif
++ rc = SECFailure;
++
++ if (initctx != NULL) {
++ certdb_slot = tlsm_init_open_certdb(ctx, realcertdir, prefix);
++ if (certdb_slot) {
++ rc = SECSuccess;
++ ctx->tc_initctx = initctx;
++ ctx->tc_certdb_slot = certdb_slot;
++ } else {
++ NSS_ShutdownContext(initctx);
++ initctx = NULL;
++ }
++ }
+ #else
+ rc = NSS_Initialize( realcertdir, prefix, prefix, SECMOD_DB, NSS_INIT_READONLY );
+ #endif
+
+- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex );
+-
+ if ( rc != SECSuccess ) {
+ errcode = PORT_GetError();
+ if ( securitydirs[ii] != lt->lt_cacertdir) {
+@@ -1658,26 +1709,29 @@ tlsm_deferred_init( void *arg )
+ }
+
+ if ( errcode ) { /* no moznss db found, or not using moznss db */
+- LDAP_MUTEX_LOCK( &tlsm_init_mutex );
+ #ifdef HAVE_NSS_INITCONTEXT
+ int flags = NSS_INIT_READONLY|NSS_INIT_NOCERTDB|NSS_INIT_NOMODDB;
+ #ifdef INITCONTEXT_HACK
+ if ( !NSS_IsInitialized() && ctx->tc_is_server ) {
+ rc = NSS_NoDB_Init( NULL );
+ } else {
+- initctx = NSS_InitContext( "", "", "", SECMOD_DB,
++ initctx = NSS_InitContext( CERTDB_NONE, PREFIX_NONE, PREFIX_NONE, SECMOD_DB,
+ &initParams, flags );
+ rc = (initctx == NULL) ? SECFailure : SECSuccess;
+ }
+ #else
+- initctx = NSS_InitContext( "", "", "", SECMOD_DB,
++ initctx = NSS_InitContext( CERTDB_NONE, PREFIX_NONE, PREFIX_NONE, SECMOD_DB,
+ &initParams, flags );
+- rc = (initctx == NULL) ? SECFailure : SECSuccess;
++ if (initctx) {
++ ctx->tc_initctx = initctx;
++ rc = SECSuccess;
++ } else {
++ rc = SECFailure;
++ }
+ #endif
+ #else
+ rc = NSS_NoDB_Init( NULL );
+ #endif
+- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex );
+ if ( rc != SECSuccess ) {
+ errcode = PORT_GetError();
+ Debug( LDAP_DEBUG_ANY,
+@@ -1685,18 +1739,11 @@ tlsm_deferred_init( void *arg )
+ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
+ return -1;
+ }
+-
+-#ifdef HAVE_NSS_INITCONTEXT
+- ctx->tc_initctx = initctx;
+-#endif
+-
+ }
+
+ if ( errcode || lt->lt_cacertfile ) {
+ /* initialize the PEM module */
+- LDAP_MUTEX_LOCK( &tlsm_init_mutex );
+ if ( tlsm_init_pem_module() ) {
+- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex );
+ int pem_errcode = PORT_GetError();
+ Debug( LDAP_DEBUG_ANY,
+ "TLS: could not initialize moznss PEM module - error %d:%s.\n",
+@@ -1708,7 +1755,6 @@ tlsm_deferred_init( void *arg )
+ } else if ( !errcode ) {
+ tlsm_init_ca_certs( ctx, lt->lt_cacertfile, NULL );
+ }
+- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex );
+ }
+
+ if ( errcode ) {
+@@ -1734,12 +1780,6 @@ tlsm_deferred_init( void *arg )
+ ctx->tc_using_pem = PR_TRUE;
+ }
+
+-#ifdef HAVE_NSS_INITCONTEXT
+- if ( !ctx->tc_initctx ) {
+- ctx->tc_initctx = initctx;
+- }
+-#endif
+-
+ NSS_SetDomesticPolicy();
+
+ PK11_SetPasswordFunc( tlsm_pin_prompt );
+@@ -1754,10 +1794,8 @@ tlsm_deferred_init( void *arg )
+ }
+
+ if ( ctx->tc_is_server ) {
+- LDAP_MUTEX_LOCK( &tlsm_init_mutex );
+ /* 0 means use the defaults here */
+ SSL_ConfigServerSessionIDCache( 0, 0, 0, NULL );
+- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex );
+ }
+
+ #ifndef HAVE_NSS_INITCONTEXT
+@@ -1767,137 +1805,34 @@ tlsm_deferred_init( void *arg )
+ return 0;
+ }
+
+-static int
+-tlsm_authenticate( tlsm_ctx *ctx, const char *certname, const char *pininfo )
+-{
+- const char *colon = NULL;
+- char *token_name = NULL;
+- PK11SlotInfo *slot = NULL;
+- int rc = -1;
+-
+- if ( !certname || !*certname ) {
+- return 0;
+- }
+-
+- if ( ( colon = PL_strchr( certname, ':' ) ) ) {
+- token_name = PL_strndup( certname, colon-certname );
+- }
+-
+- if ( token_name ) {
+- slot = PK11_FindSlotByName( token_name );
+- } else {
+- slot = PK11_GetInternalKeySlot();
+- }
+-
+- if ( !slot ) {
+- PRErrorCode errcode = PR_GetError();
+- Debug( LDAP_DEBUG_ANY,
+- "TLS: could not find the slot for security token %s - error %d:%s.\n",
+- token_name ? token_name : DEFAULT_TOKEN_NAME, errcode,
+- PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
+- goto done;
+- }
+-
+- rc = tlsm_authenticate_to_slot( ctx, slot );
+-
+-done:
+- PL_strfree( token_name );
+- if ( slot ) {
+- PK11_FreeSlot( slot );
+- }
+-
+- return rc;
+-}
+-
+ /*
+ * Find and verify the certificate.
+- * Either fd is given, in which case the cert will be taken from it via SSL_PeerCertificate
+- * or certname is given, and it will be searched for by name
++ * The key is loaded and stored in ctx->tc_private_key
+ */
+ static int
+-tlsm_find_and_verify_cert_key(tlsm_ctx *ctx, PRFileDesc *fd, const char *certname, int isServer, CERTCertificate **pRetCert, SECKEYPrivateKey **pRetKey)
++tlsm_find_and_verify_cert_key(tlsm_ctx *ctx)
+ {
+- CERTCertificate *cert = NULL;
+- int rc = -1;
+- void *pin_arg = NULL;
+- SECKEYPrivateKey *key = NULL;
++ SECCertificateUsage certUsage;
++ PRBool checkSig;
++ SECStatus status;
++ int errorToIgnore;
++ void *pin_arg;
+
+- pin_arg = SSL_RevealPinArg( fd );
+- if ( certname ) {
+- cert = PK11_FindCertFromNickname( certname, pin_arg );
+- if ( !cert ) {
+- PRErrorCode errcode = PR_GetError();
+- Debug( LDAP_DEBUG_ANY,
+- "TLS: error: the certificate %s could not be found in the database - error %d:%s\n",
+- certname, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
+- return -1;
+- }
+- } else {
+- /* we are verifying the peer cert
+- we also need to swap the isServer meaning */
+- cert = SSL_PeerCertificate( fd );
+- if ( !cert ) {
+- PRErrorCode errcode = PR_GetError();
+- Debug( LDAP_DEBUG_ANY,
+- "TLS: error: could not get the certificate from the peer connection - error %d:%s\n",
+- errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), NULL );
+- return -1;
+- }
+- isServer = !isServer; /* verify the peer's cert instead */
+- }
+-
+- if ( ctx->tc_slotname ) {
+- PK11SlotInfo *slot = PK11_FindSlotByName( ctx->tc_slotname );
+- key = PK11_FindPrivateKeyFromCert( slot, cert, NULL );
+- PK11_FreeSlot( slot );
+- } else {
+- key = PK11_FindKeyByAnyCert( cert, pin_arg );
+- }
+-
+- if (key) {
+- SECCertificateUsage certUsage;
+- PRBool checkSig = PR_TRUE;
+- SECStatus status;
+- /* may not have a CA cert - ok - ignore SEC_ERROR_UNKNOWN_ISSUER */
+- int errorToIgnore = SEC_ERROR_UNKNOWN_ISSUER;
++ if (tlsm_ctx_load_private_key(ctx))
++ return -1;
+
+- if ( pRetKey ) {
+- *pRetKey = key; /* caller will deal with this */
+- } else {
+- SECKEY_DestroyPrivateKey( key );
+- }
+- if ( isServer ) {
+- certUsage = certificateUsageSSLServer;
+- } else {
+- certUsage = certificateUsageSSLClient;
+- }
+- if ( ctx->tc_verify_cert ) {
+- checkSig = PR_TRUE;
+- } else {
+- checkSig = PR_FALSE;
+- }
+- if ( ctx->tc_warn_only ) {
+- errorToIgnore = -1;
+- }
+- status = tlsm_verify_cert( ctx->tc_certdb, cert, pin_arg,
+- checkSig, certUsage, errorToIgnore );
+- if ( status == SECSuccess ) {
+- rc = 0;
+- }
+- } else {
+- PRErrorCode errcode = PR_GetError();
+- Debug( LDAP_DEBUG_ANY,
+- "TLS: error: could not find the private key for certificate %s - error %d:%s\n",
+- certname, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
+- }
++ pin_arg = SSL_RevealPinArg(ctx->tc_model);
++ certUsage = ctx->tc_is_server ? certificateUsageSSLServer : certificateUsageSSLClient;
++ checkSig = ctx->tc_verify_cert ? PR_TRUE : PR_FALSE;
++ if ( ctx->tc_warn_only )
++ errorToIgnore = -1;
++ else
++ errorToIgnore = SEC_ERROR_UNKNOWN_ISSUER; /* may not have a CA cert */
+
+- if ( pRetCert ) {
+- *pRetCert = cert; /* caller will deal with this */
+- } else {
+- CERT_DestroyCertificate( cert );
+- }
++ status = tlsm_verify_cert( ctx->tc_certdb, ctx->tc_certificate, pin_arg,
++ checkSig, certUsage, errorToIgnore );
+
+- return rc;
++ return status == SECSuccess ? 0 : -1;
+ }
+
+ static int
+@@ -1906,39 +1841,18 @@ tlsm_get_client_auth_data( void *arg, PRFileDesc *fd,
+ SECKEYPrivateKey **pRetKey )
+ {
+ tlsm_ctx *ctx = (tlsm_ctx *)arg;
+- int rc;
+- PRBool saveval;
+
+- /* don't need caNames - this function will call CERT_VerifyCertificateNow
+- which will verify the cert against the known CAs */
+- saveval = ctx->tc_warn_only;
+- ctx->tc_warn_only = PR_TRUE;
+- rc = tlsm_find_and_verify_cert_key( ctx, fd, ctx->tc_certname, 0, pRetCert, pRetKey );
+- ctx->tc_warn_only = saveval;
+- if ( rc ) {
+- Debug( LDAP_DEBUG_ANY,
+- "TLS: error: unable to perform client certificate authentication for "
+- "certificate named %s\n", ctx->tc_certname, 0, 0 );
+- if ( pRetKey && *pRetKey ) {
+- SECKEY_DestroyPrivateKey( *pRetKey );
+- *pRetKey = NULL;
+- }
+- if ( pRetCert && *pRetCert ) {
+- CERT_DestroyCertificate( *pRetCert );
+- *pRetCert = NULL;
+- }
+- return SECFailure;
+- }
++ if (pRetCert)
++ *pRetCert = CERT_DupCertificate(ctx->tc_certificate);
++
++ if (pRetKey)
++ *pRetKey = SECKEY_CopyPrivateKey(ctx->tc_private_key);
+
+ return SECSuccess;
+ }
+
+ /*
+ * ctx must have a tc_model that is valid
+- * certname is in the form [<tokenname>:]<certnickname>
+- * where <tokenname> is the name of the PKCS11 token
+- * and <certnickname> is the nickname of the cert/key in
+- * the database
+ */
+ static int
+ tlsm_clientauth_init( tlsm_ctx *ctx )
+@@ -1949,12 +1863,12 @@ tlsm_clientauth_init( tlsm_ctx *ctx )
+
+ saveval = ctx->tc_warn_only;
+ ctx->tc_warn_only = PR_TRUE;
+- rc = tlsm_find_and_verify_cert_key( ctx, ctx->tc_model, ctx->tc_certname, 0, NULL, NULL );
++ rc = tlsm_find_and_verify_cert_key(ctx);
+ ctx->tc_warn_only = saveval;
+ if ( rc ) {
+ Debug( LDAP_DEBUG_ANY,
+ "TLS: error: unable to set up client certificate authentication for "
+- "certificate named %s\n", ctx->tc_certname, 0, 0 );
++ "certificate named %s\n", tlsm_ctx_subject_name(ctx), 0, 0 );
+ return -1;
+ }
+
+@@ -1972,6 +1886,7 @@ static void
+ tlsm_destroy( void )
+ {
+ #ifdef LDAP_R_COMPILE
++ ldap_pvt_thread_mutex_destroy( &tlsm_ctx_count_mutex );
+ ldap_pvt_thread_mutex_destroy( &tlsm_init_mutex );
+ ldap_pvt_thread_mutex_destroy( &tlsm_pem_mutex );
+ #endif
+@@ -2048,16 +1963,20 @@ tlsm_ctx_new ( struct ldapoptions *lo )
+ #ifdef LDAP_R_COMPILE
+ ldap_pvt_thread_mutex_init( &ctx->tc_refmutex );
+ #endif
++ LDAP_MUTEX_LOCK( &tlsm_ctx_count_mutex );
++ ctx->tc_unique = tlsm_ctx_count++;
++ LDAP_MUTEX_UNLOCK( &tlsm_ctx_count_mutex );
+ ctx->tc_config = NULL; /* populated later by tlsm_ctx_init */
+ ctx->tc_certdb = NULL;
+- ctx->tc_certname = NULL;
++ ctx->tc_certdb_slot = NULL;
++ ctx->tc_certificate = NULL;
++ ctx->tc_private_key = NULL;
+ ctx->tc_pin_file = NULL;
+ ctx->tc_model = NULL;
+ memset(&ctx->tc_callonce, 0, sizeof(ctx->tc_callonce));
+ ctx->tc_require_cert = lo->ldo_tls_require_cert;
+ ctx->tc_verify_cert = PR_FALSE;
+ ctx->tc_using_pem = PR_FALSE;
+- ctx->tc_slotname = NULL;
+ #ifdef HAVE_NSS_INITCONTEXT
+ ctx->tc_initctx = NULL;
+ #endif /* HAVE_NSS_INITCONTEXT */
+@@ -2090,28 +2009,38 @@ tlsm_ctx_free ( tls_ctx *ctx )
+ LDAP_MUTEX_UNLOCK( &c->tc_refmutex );
+ if ( refcount )
+ return;
++
++ LDAP_MUTEX_LOCK( &tlsm_init_mutex );
+ if ( c->tc_model )
+ PR_Close( c->tc_model );
++ if (c->tc_certificate)
++ CERT_DestroyCertificate(c->tc_certificate);
++ if (c->tc_private_key)
++ SECKEY_DestroyPrivateKey(c->tc_private_key);
+ c->tc_certdb = NULL; /* if not the default, may have to clean up */
+- PL_strfree( c->tc_certname );
+- c->tc_certname = NULL;
++ if ( c->tc_certdb_slot ) {
++ if ( SECMOD_CloseUserDB( c->tc_certdb_slot ) ) {
++ PRErrorCode errcode = PR_GetError();
++ Debug( LDAP_DEBUG_ANY,
++ "TLS: could not close certdb slot - error %d:%s.\n",
++ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
++ }
++ }
+ PL_strfree( c->tc_pin_file );
+ c->tc_pin_file = NULL;
+- PL_strfree( c->tc_slotname );
+ tlsm_free_pem_objs( c );
+ #ifdef HAVE_NSS_INITCONTEXT
+ if ( c->tc_initctx ) {
+- LDAP_MUTEX_LOCK( &tlsm_init_mutex );
+ if ( NSS_ShutdownContext( c->tc_initctx ) ) {
+ PRErrorCode errcode = PR_GetError();
+ Debug( LDAP_DEBUG_ANY,
+ "TLS: could not shutdown NSS - error %d:%s.\n",
+ errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ), 0 );
+ }
+- LDAP_MUTEX_UNLOCK( &tlsm_init_mutex );
+ }
+ c->tc_initctx = NULL;
+ #endif /* HAVE_NSS_INITCONTEXT */
++ LDAP_MUTEX_UNLOCK( &tlsm_init_mutex );
+ #ifdef LDAP_R_COMPILE
+ ldap_pvt_thread_mutex_destroy( &c->tc_refmutex );
+ #endif
+@@ -2173,6 +2102,12 @@ tlsm_deferred_ctx_init( void *arg )
+ return -1;
+ }
+
++ if ( SSL_SetPKCS11PinArg(ctx->tc_model, ctx) ) {
++ Debug( LDAP_DEBUG_ANY,
++ "TLS: could not set pin prompt argument\n", 0, 0, 0);
++ return -1;
++ }
++
+ if ( SECSuccess != SSL_OptionSet( ctx->tc_model, SSL_SECURITY, PR_TRUE ) ) {
+ Debug( LDAP_DEBUG_ANY,
+ "TLS: could not set secure mode on.\n",
+@@ -2287,14 +2222,30 @@ tlsm_deferred_ctx_init( void *arg )
+ /* if using the PEM module, load the PEM file specified by lt_certfile */
+ /* otherwise, assume this is the name of a cert already in the db */
+ if ( ctx->tc_using_pem ) {
+- /* this sets ctx->tc_certname to the correct value */
+- int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE, PR_TRUE );
++ /* this sets ctx->tc_certificate to the correct value */
++ int rc = tlsm_add_cert_from_file( ctx, lt->lt_certfile, PR_FALSE );
+ if ( rc ) {
+ return rc;
+ }
+ } else {
+- PL_strfree( ctx->tc_certname );
+- ctx->tc_certname = PL_strdup( lt->lt_certfile );
++ char *tmp_certname;
++
++ if (ctx->tc_certdb_slot) {
++ tmp_certname = PR_smprintf(TLSM_CERTDB_DESC_FMT ":%s", ctx->tc_unique, lt->lt_certfile);
++ } else {
++ tmp_certname = PR_smprintf("%s", lt->lt_certfile);
++ }
++
++ ctx->tc_certificate = PK11_FindCertFromNickname(tmp_certname, SSL_RevealPinArg(ctx->tc_model));
++ PR_smprintf_free(tmp_certname);
++
++ if (!ctx->tc_certificate) {
++ PRErrorCode errcode = PR_GetError();
++ Debug( LDAP_DEBUG_ANY,
++ "TLS: error: the certificate '%s' could not be found in the database - error %d:%s.\n",
++ lt->lt_certfile, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );
++ return -1;
++ }
+ }
+ }
+
+@@ -2302,7 +2253,6 @@ tlsm_deferred_ctx_init( void *arg )
+ /* if using the PEM module, load the PEM file specified by lt_keyfile */
+ /* otherwise, assume this is the pininfo for the key */
+ if ( ctx->tc_using_pem ) {
+- /* this sets ctx->tc_certname to the correct value */
+ int rc = tlsm_add_key_from_file( ctx, lt->lt_keyfile );
+ if ( rc ) {
+ return rc;
+@@ -2334,66 +2284,42 @@ tlsm_deferred_ctx_init( void *arg )
+ /*
+ since a cert has been specified, assume the client wants to do cert auth
+ */
+- if ( ctx->tc_certname ) {
+- if ( tlsm_authenticate( ctx, ctx->tc_certname, ctx->tc_pin_file ) ) {
+- Debug( LDAP_DEBUG_ANY,
+- "TLS: error: unable to authenticate to the security device for certificate %s\n",
+- ctx->tc_certname, 0, 0 );
+- return -1;
+- }
++ if ( ctx->tc_certificate ) {
+ if ( tlsm_clientauth_init( ctx ) ) {
+ Debug( LDAP_DEBUG_ANY,
+- "TLS: error: unable to set up client certificate authentication using %s\n",
+- ctx->tc_certname, 0, 0 );
++ "TLS: error: unable to set up client certificate authentication using '%s'\n",
++ tlsm_ctx_subject_name(ctx), 0, 0 );
+ return -1;
+ }
+ }
+ } else { /* set up secure server */
+ SSLKEAType certKEA;
+- CERTCertificate *serverCert = NULL;
+- SECKEYPrivateKey *serverKey = NULL;
+ SECStatus status;
+
+ /* must have a certificate for the server to use */
+- if ( !ctx->tc_certname ) {
++ if ( !ctx->tc_certificate ) {
+ Debug( LDAP_DEBUG_ANY,
+ "TLS: error: no server certificate: must specify a certificate for the server to use\n",
+ 0, 0, 0 );
+ return -1;
+ }
+
+- /* authenticate to the server's token - this will do nothing
+- if the key/cert db is not password protected */
+- if ( tlsm_authenticate( ctx, ctx->tc_certname, ctx->tc_pin_file ) ) {
+- Debug( LDAP_DEBUG_ANY,
+- "TLS: error: unable to authenticate to the security device for certificate %s\n",
+- ctx->tc_certname, 0, 0 );
+- return -1;
+- }
+-
+- /* get the server's key and cert */
+- if ( tlsm_find_and_verify_cert_key( ctx, ctx->tc_model, ctx->tc_certname, ctx->tc_is_server,
+- &serverCert, &serverKey ) ) {
++ if (tlsm_find_and_verify_cert_key(ctx)) {
+ Debug( LDAP_DEBUG_ANY,
+ "TLS: error: unable to find and verify server's cert and key for certificate %s\n",
+- ctx->tc_certname, 0, 0 );
+- CERT_DestroyCertificate( serverCert );
+- SECKEY_DestroyPrivateKey( serverKey );
++ tlsm_ctx_subject_name(ctx), 0, 0 );
+ return -1;
+ }
+
+- certKEA = NSS_FindCertKEAType( serverCert );
+ /* configure the socket to be a secure server socket */
+- status = SSL_ConfigSecureServer( ctx->tc_model, serverCert, serverKey, certKEA );
+- /* SSL_ConfigSecureServer copies these */
+- CERT_DestroyCertificate( serverCert );
+- SECKEY_DestroyPrivateKey( serverKey );
++ certKEA = NSS_FindCertKEAType( ctx->tc_certificate );
++ status = SSL_ConfigSecureServer( ctx->tc_model, ctx->tc_certificate, ctx->tc_private_key, certKEA );
+
+ if ( SECSuccess != status ) {
+ PRErrorCode err = PR_GetError();
+ Debug( LDAP_DEBUG_ANY,
+- "TLS: error: unable to configure secure server using certificate %s - error %d:%s\n",
+- ctx->tc_certname, err, PR_ErrorToString( err, PR_LANGUAGE_I_DEFAULT ) );
++ "TLS: error: unable to configure secure server using certificate '%s' - error %d:%s\n",
++ tlsm_ctx_subject_name(ctx), err, PR_ErrorToString( err, PR_LANGUAGE_I_DEFAULT ) );
+ return -1;
+ }
+ }
+@@ -2515,7 +2441,9 @@ tlsm_session_new ( tls_ctx * ctx, int is_server )
+ int rc;
+
+ c->tc_is_server = is_server;
++ LDAP_MUTEX_LOCK( &tlsm_init_mutex );
+ status = PR_CallOnceWithArg( &c->tc_callonce, tlsm_deferred_ctx_init, c );
++ LDAP_MUTEX_UNLOCK( &tlsm_init_mutex );
+ if ( PR_SUCCESS != status ) {
+ PRErrorCode err = PR_GetError();
+ Debug( LDAP_DEBUG_ANY,
diff --git a/openldap.spec b/openldap.spec
index e7fff04..1958f37 100644
--- a/openldap.spec
+++ b/openldap.spec
@@ -45,6 +45,7 @@ Patch13: openldap-nss-dont-overwrite-verify-cert-error.patch
Patch14: openldap-nss-clean-memory-for-token-pin.patch
Patch15: openldap-cve-nss-cipher-suite-ignored.patch
Patch16: openldap-nss-default-cipher-suite-always-selected.patch
+Patch17: openldap-nss-multiple-tls-contexts.patch
# Fedora specific patches
Patch100: openldap-fedora-systemd.patch
@@ -157,6 +158,7 @@ pushd openldap-%{version}
%patch14 -p1
%patch15 -p1
%patch16 -p1
+%patch17 -p1
%patch100 -p1
@@ -676,6 +678,9 @@ exit 0
- CVE-2012-2668: cipher suite selection by name can be ignored (#825875)
- fix: slapd fails to start on reboot (#829272)
- fix: default cipher suite is always selected (#828790)
+- fix: less influence between individual TLS contexts:
+ - replication with TLS does not work (#795763)
+ - possibly others
* Fri May 18 2012 Jan Vcelak <jvcelak at redhat.com> 2.4.31-2
- fix: nss-tools package is required by the base package, not the server subpackage
More information about the scm-commits
mailing list