|
 |
96373c |
From b1dfe53aaf7cb0260286423b9abf7d71f8edd421 Mon Sep 17 00:00:00 2001
|
|
|
96373c |
From: Mark Reynolds <mreynolds@redhat.com>
|
|
|
96373c |
Date: Wed, 15 Nov 2017 13:27:58 -0500
|
|
|
96373c |
Subject: [PATCH] Ticket 49454 - SSL Client Authentication breaks in FIPS mode
|
|
|
96373c |
|
|
|
96373c |
Bug Description: Replication using SSL Client Auth breaks when FIPS
|
|
|
96373c |
is enabled. This is because FIPS mode changes the
|
|
|
96373c |
internal certificate token name.
|
|
|
96373c |
|
|
|
96373c |
Fix Description: If FIPS is enabled grab the token name from the internal
|
|
|
96373c |
slot instead of using the default hardcoded internal
|
|
|
96373c |
token name.
|
|
|
96373c |
|
|
|
96373c |
https://pagure.io/389-ds-base/issue/49454
|
|
|
96373c |
|
|
|
96373c |
Reviewed by: firstyear(Thanks!)
|
|
|
96373c |
|
|
|
96373c |
(cherry picked from commit 6e794a8eff213d49c933f781006e234984160db2)
|
|
|
96373c |
---
|
|
|
96373c |
ldap/servers/slapd/proto-slap.h | 1 +
|
|
|
96373c |
ldap/servers/slapd/security_wrappers.c | 6 ++++++
|
|
|
96373c |
ldap/servers/slapd/ssl.c | 24 +++++++++++++++++-------
|
|
|
96373c |
3 files changed, 24 insertions(+), 7 deletions(-)
|
|
|
96373c |
|
|
|
96373c |
diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
|
|
|
96373c |
index 4a30def8b..3b7ab53b2 100644
|
|
|
96373c |
--- a/ldap/servers/slapd/proto-slap.h
|
|
|
96373c |
+++ b/ldap/servers/slapd/proto-slap.h
|
|
|
96373c |
@@ -1130,6 +1130,7 @@ PRBool slapd_pk11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type);
|
|
|
96373c |
PK11SymKey *slapd_pk11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey, SECItem *wrappedKey, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS flags, PRBool isPerm);
|
|
|
96373c |
PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *param, int keySize, SECItem *keyid, CK_FLAGS opFlags, PK11AttrFlags attrFlags, void *wincx);
|
|
|
96373c |
CK_MECHANISM_TYPE slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem);
|
|
|
96373c |
+char *slapd_PK11_GetTokenName(PK11SlotInfo *slot);
|
|
|
96373c |
|
|
|
96373c |
/*
|
|
|
96373c |
* start_tls_extop.c
|
|
|
96373c |
diff --git a/ldap/servers/slapd/security_wrappers.c b/ldap/servers/slapd/security_wrappers.c
|
|
|
96373c |
index bec28d2f3..41fe03608 100644
|
|
|
96373c |
--- a/ldap/servers/slapd/security_wrappers.c
|
|
|
96373c |
+++ b/ldap/servers/slapd/security_wrappers.c
|
|
|
96373c |
@@ -401,3 +401,9 @@ slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECIte
|
|
|
96373c |
{
|
|
|
96373c |
return PK11_GetPBECryptoMechanism(algid, params, pwitem);
|
|
|
96373c |
}
|
|
|
96373c |
+
|
|
|
96373c |
+char *
|
|
|
96373c |
+slapd_PK11_GetTokenName(PK11SlotInfo *slot)
|
|
|
96373c |
+{
|
|
|
96373c |
+ return PK11_GetTokenName(slot);
|
|
|
96373c |
+}
|
|
|
96373c |
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
|
|
|
96373c |
index efe32d5d0..52ac7ea9f 100644
|
|
|
96373c |
--- a/ldap/servers/slapd/ssl.c
|
|
|
96373c |
+++ b/ldap/servers/slapd/ssl.c
|
|
|
96373c |
@@ -2365,13 +2365,23 @@ slapd_SSL_client_auth(LDAP *ld)
|
|
|
96373c |
ssltoken = slapi_entry_attr_get_charptr(entry, "nsssltoken");
|
|
|
96373c |
if (ssltoken && personality) {
|
|
|
96373c |
if (!PL_strcasecmp(ssltoken, "internal") ||
|
|
|
96373c |
- !PL_strcasecmp(ssltoken, "internal (software)")) {
|
|
|
96373c |
-
|
|
|
96373c |
- /* Translate config internal name to more
|
|
|
96373c |
- * readable form. Certificate name is just
|
|
|
96373c |
- * the personality for internal tokens.
|
|
|
96373c |
- */
|
|
|
96373c |
- token = slapi_ch_strdup(internalTokenName);
|
|
|
96373c |
+ !PL_strcasecmp(ssltoken, "internal (software)"))
|
|
|
96373c |
+ {
|
|
|
96373c |
+ if ( slapd_pk11_isFIPS() ) {
|
|
|
96373c |
+ /*
|
|
|
96373c |
+ * FIPS mode changes the internal token name, so we need to
|
|
|
96373c |
+ * grab the new token name from the internal slot.
|
|
|
96373c |
+ */
|
|
|
96373c |
+ PK11SlotInfo *slot = slapd_pk11_getInternalSlot();
|
|
|
96373c |
+ token = slapi_ch_strdup(slapd_PK11_GetTokenName(slot));
|
|
|
96373c |
+ PK11_FreeSlot(slot);
|
|
|
96373c |
+ } else {
|
|
|
96373c |
+ /*
|
|
|
96373c |
+ * Translate config internal name to more readable form.
|
|
|
96373c |
+ * Certificate name is just the personality for internal tokens.
|
|
|
96373c |
+ */
|
|
|
96373c |
+ token = slapi_ch_strdup(internalTokenName);
|
|
|
96373c |
+ }
|
|
|
96373c |
#if defined(USE_OPENLDAP)
|
|
|
96373c |
/* openldap needs tokenname:certnick */
|
|
|
96373c |
PR_snprintf(cert_name, sizeof(cert_name), "%s:%s", token, personality);
|
|
|
96373c |
--
|
|
|
96373c |
2.13.6
|
|
|
96373c |
|