Fedora DS 1.3.7.8-1 is built using NSS 3.34. on nss-3.34 http://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.34_release_notes two new fields were added at the end of SSLChannelInfo ( originalKeaGroup , resumed )
So when DS 1.3.7.8-1 calls SSL_GetChannelInfo (during handcheck handle_handshake_done), it provides a data structure lenght that is larger than the data structure (SSLChannelInfo) in 3.33 and before.
The problem is that GetChannelInfo, checks that the caller do not expect more data than it supports (i.e. provided length > supported length).
In this situation, SSL handcheck fails logging:
[13/Dec/2017:15:40:31.145169387 +0000] conn=13 SSL failed to obtain channel info; Netscape Portable Runtime error -8187 (security library: invalid arguments.)
Any version built with NSS 3.34
SSL connection fails
SSL connection should succeeds
Metadata Update from @mreynolds: - Issue assigned to mreynolds
Metadata Update from @mreynolds: - Custom field component adjusted to None - Custom field origin adjusted to None - Custom field reviewstatus adjusted to None - Custom field type adjusted to None - Custom field version adjusted to None - Issue set to the milestone: 1.3.7.0
Metadata Update from @mreynolds: - Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1538740
Issue linked to Bugzilla: Bug 1538740
This bug was originally seen on Fedora 27. I only see a RHEL BZ but this could have been fixed ages ago in Fedora. When do you expect to fix it there?
This change is going into the next Fedora (27 and 28) builds. I do not have an ETA yet, but it will be within the next few weeks.
Fixed in 1.3.7.9 (f27) and rawhide
Metadata Update from @mreynolds: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)
389-ds-base is moving from Pagure to Github. This means that new issues and pull requests will be accepted only in 389-ds-base's github repository.
This issue has been cloned to Github and is available here: - https://github.com/389ds/389-ds-base/issues/2557
If you want to receive further updates on the issue, please navigate to the github issue and click on subscribe button.
subscribe
Thank you for understanding. We apologize for all inconvenience.
Metadata Update from @spichugi: - Issue close_status updated to: wontfix (was: fixed)
Login to comment on this ticket.