PR#171: Fix NSS shutdown issues when obtaining the internal token name - certmonger

certmonger

#171 Fix NSS shutdown issues when obtaining the internal token name

Merged 3 years ago by rcritten. Opened 3 years ago by rcritten.

rcritten/certmonger issue_8533 into master

Fix NSS shutdown issues when obtaining the internal token name

Rob Crittenden • 3 years ago

f167cff

src/certread-n.c

file modified

+1 -1

		`@@ -193,7 +193,7 @@`
		`_exit(CM_SUB_STATUS_ERROR_AUTH);`
		`}`
		`if (entry->cm_cert_token == NULL) {`
		`- entry->cm_cert_token = talloc_strdup(entry, util_internal_token_name());`
		`+ entry->cm_cert_token = util_internal_token_name(entry);`
		`}`
		`PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);`
		`for (sle = slotlist->head;`

src/certsave-n.c

file modified

+1 -1

		`@@ -228,7 +228,7 @@`
		`}`
		`PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);`
		`if (entry->cm_cert_token == NULL) {`
		`- entry->cm_cert_token = talloc_strdup(entry, util_internal_token_name());`
		`+ entry->cm_cert_token = util_internal_token_name(entry);`
		`}`
		`for (sle = slotlist->head;`
		`((sle != NULL) && (sle->slot != NULL));`

src/keygen-n.c

file modified

+1 -1

		`@@ -285,7 +285,7 @@`
		`_exit(CM_SUB_STATUS_ERROR_NO_TOKEN);`
		`}`
		`if (entry->cm_cert_token == NULL) {`
		`- entry->cm_cert_token = talloc_strdup(entry, util_internal_token_name());`
		`+ entry->cm_cert_token = util_internal_token_name(entry);`
		`}`
		`/* Walk the list looking for the requested slot, or the first one if`
		`* none was requested. */`

src/keyiread-n.c

file modified

+1 -1

		`@@ -165,7 +165,7 @@`
		`}`
		`PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);`
		`if (entry->cm_key_token == NULL) {`
		`- entry->cm_key_token = talloc_strdup(entry, util_internal_token_name());`
		`+ entry->cm_key_token = util_internal_token_name(entry);`
		`}`
		`n_tokens = 0;`
		`pubkey = NULL;`

src/submit-n.c

file modified

+1 -1

		`@@ -359,7 +359,7 @@`
		`goto done;`
		`}`
		`if (args->entry->cm_key_token == NULL) {`
		`- args->entry->cm_key_token = talloc_strdup(args->entry, util_internal_token_name());`
		`+ args->entry->cm_key_token = util_internal_token_name(args->entry);`
		`}`
		`PK11_SetPasswordFunc(&cm_pin_read_for_cert_nss_cb);`
		`n_tokens = 0;`

src/util-n.c

file modified

+10 -2

		`@@ -34,6 +34,8 @@`
		`#include "store-int.h"`
		`#include "util-n.h"`

		`+ #include <talloc.h>`
		`+`
		`#define NODE "/proc/sys/crypto/fips_enabled"`

		`static PRBool force_fips = PR_FALSE;`
		`@@ -289,7 +291,13 @@`
		`}`

		`char *`
		`- util_internal_token_name()`
		`+ util_internal_token_name(void *ctx)`
		`{`
		`- return PK11_GetTokenName(PK11_GetInternalKeySlot());`
		`+ PK11SlotInfo *slot = NULL;`
		`+ char *name = NULL;`
		`+`
		`+ slot = PK11_GetInternalKeySlot();`
		`+ name = talloc_strdup(ctx, PK11_GetTokenName(slot));`
		`+ PK11_FreeSlot(slot);`
		`+ return name;`
		`}`

src/util-n.h

file modified

+1 -1

		`@@ -29,6 +29,6 @@`
		`struct cm_store_entry *entry);`
		`void util_set_db_entry_cert_owner(const char *dbdir,`
		`struct cm_store_entry *entry);`
		`- char * util_internal_token_name();`
		`+ char * util_internal_token_name(void *ctx);`

		`#endif`

rcritten commented 3 years ago

The slot wasn't being freed every time util_internal_token_name()
was called which caused NSS_Shutdown() and NSS_ShutdownContext()
to return SEC_ERROR_BUSY.

Discovered in IPA issue https://pagure.io/freeipa/issue/8533