From f7f28dcc95ca9e842c456614d569380aa82a8191 Mon Sep 17 00:00:00 2001 From: Noriko Hosoi Date: Thu, 10 Mar 2016 17:05:54 -0800 Subject: [PATCH 1/2] Ticket #48760 - NSS -- switching to the sql db Description: 389-ds-base and 389-admin are using the old format of key/cert db. NSS recommends to switch to the sql format having the shared DB feature. The current version of NSS (3.22.0 and older) takes ordinary paths to access the cert db, while it requires the prefix "sql:" for the sql db. By setting the environment variable 'NSS_DEFAULT_DB_TYPE="sql"', the default path setting is supposed to be swtiched. This patch tries these 2 cases. 1) #define ENABLE_SQL_PREFIX 1 This enables generating "sql:/path/to/certdir". 2) /* #define ENABLE_SQL_PREFIX 1 */ This depends upon the NSS_DEFAULT_DB_TYPE="sql" and use the ordinary path to access the cert db. Both works fine with the test script. The case (1) generates just the new key/cert db's. $ ls slapd-master_1/*.db slapd-master_1/cert9.db slapd-master_1/key4.db But in the case (2), the server creates 2 sets of key/cert db's: $ ls slapd-master_1/*.db slapd-master_1/key3.db slapd-master_1/cert8.db slapd-master_1/secmod.db slapd-master_1/key4.db slapd-master_1/cert9.db $ cerrtutil -L -d sql:slapd-master_1 Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI CAcertificate CTu,u,u Server-Cert1 u,u,u Server-Cert2 u,u,u $ cerrtutil -L -d slapd-master_1 returns nothing. To reduce the confusion, we should choose the case (1). --- ldap/admin/src/base-initconfig.in | 2 ++ ldap/servers/slapd/ssl.c | 32 ++++++++++++++++++++++++-------- 2 files changed, 26 insertions(+), 8 deletions(-) diff --git a/ldap/admin/src/base-initconfig.in b/ldap/admin/src/base-initconfig.in index e803a36..a352cbf 100644 --- a/ldap/admin/src/base-initconfig.in +++ b/ldap/admin/src/base-initconfig.in @@ -48,3 +48,5 @@ # has been shown to have a significant positive impact on the Directory # Server's process size/growth. #LD_PRELOAD=@libdir@/@package_name@/libjemalloc.so.1 ; export LD_PRELOAD + +export NSS_DEFAULT_DB_TYPE="sql" diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c index 1a551da..3556b4a 100644 --- a/ldap/servers/slapd/ssl.c +++ b/ldap/servers/slapd/ssl.c @@ -71,7 +71,7 @@ static SSLVersionRange slapdNSSVersions; #endif /* dongle_file_name is set in slapd_nss_init when we set the path for the - key, cert, and secmod files - the dongle file must be in the same directory + key, cert, and secmod(deprecated) files - the dongle file must be in the same directory and use the same naming scheme */ static char* dongle_file_name = NULL; @@ -792,17 +792,17 @@ static int warn_if_no_cert_file(const char *dir, int no_log) { int ret = 0; - char *filename = slapi_ch_smprintf("%s/cert8.db", dir); + char *filename = slapi_ch_smprintf("%s/cert9.db", dir); PRStatus status = PR_Access(filename, PR_ACCESS_READ_OK); if (PR_SUCCESS != status) { slapi_ch_free_string(&filename); - filename = slapi_ch_smprintf("%s/cert7.db", dir); + filename = slapi_ch_smprintf("%s/cert8.db", dir); status = PR_Access(filename, PR_ACCESS_READ_OK); if (PR_SUCCESS != status) { ret = 1; if (!no_log) { slapi_log_error(SLAPI_LOG_FATAL, "SSL Initialization", - "Warning: certificate DB file cert8.db nor cert7.db exists in [%s] - " + "Warning: certificate DB file cert9.db nor cert8.db exists in [%s] - " "SSL initialization will likely fail\n", dir); } } @@ -818,7 +818,7 @@ static int warn_if_no_key_file(const char *dir, int no_log) { int ret = 0; - char *filename = slapi_ch_smprintf("%s/key3.db", dir); + char *filename = slapi_ch_smprintf("%s/key4.db", dir); PRStatus status = PR_Access(filename, PR_ACCESS_READ_OK); if (PR_SUCCESS != status) { ret = 1; @@ -999,6 +999,8 @@ restrict_SSLVersionRange(void) } #endif +#define ENABLE_SQL_PREFIX 1 + /* * slapd_nss_init() is always called from main(), even if we do not * plan to listen on a secure port. If config_available is 0, the @@ -1020,9 +1022,14 @@ slapd_nss_init(int init_ssl, int config_available) int create_certdb = 0; PRUint32 nssFlags = 0; char *certdir; +#if defined(ENABLE_SQL_PREFIX) + char *sqlcertdir; +#endif char *certdb_file_name = NULL; char *keydb_file_name = NULL; +#if !defined(ENABLE_SQL_PREFIX) char *secmoddb_file_name = NULL; +#endif #if !defined(NSS_TLS10) /* NSS_TLS11 or newer */ char emin[VERSION_STR_LENGTH], emax[VERSION_STR_LENGTH]; /* Get the range of the supported SSL version */ @@ -1074,7 +1081,12 @@ slapd_nss_init(int init_ssl, int config_available) nssFlags &= (~NSS_INIT_READONLY); slapd_pk11_configurePKCS11(NULL, NULL, tokPBE, ptokPBE, NULL, NULL, NULL, NULL, 0, 0 ); +#if defined(ENABLE_SQL_PREFIX) + sqlcertdir = slapi_ch_smprintf("sql:%s", certdir); + secStatus = NSS_Initialize(sqlcertdir, NULL, NULL, /*"secmod.db"*/NULL, nssFlags); +#else secStatus = NSS_Initialize(certdir, NULL, NULL, "secmod.db", nssFlags); +#endif dongle_file_name = PR_smprintf("%s/pin.txt", certdir); @@ -1101,9 +1113,8 @@ slapd_nss_init(int init_ssl, int config_available) * write permission to the group so the certs can be managed via * the console/adminserver. */ if (create_certdb) { - certdb_file_name = slapi_ch_smprintf("%s/cert8.db", certdir); - keydb_file_name = slapi_ch_smprintf("%s/key3.db", certdir); - secmoddb_file_name = slapi_ch_smprintf("%s/secmod.db", certdir); + certdb_file_name = slapi_ch_smprintf("%s/cert9.db", certdir); + keydb_file_name = slapi_ch_smprintf("%s/key4.db", certdir); if(chmod(certdb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP )){ LDAPDebug(LDAP_DEBUG_ANY, "slapd_nss_init: chmod failed for file %s error (%d) %s.\n", certdb_file_name, errno, slapd_system_strerror(errno)); @@ -1112,17 +1123,22 @@ slapd_nss_init(int init_ssl, int config_available) LDAPDebug(LDAP_DEBUG_ANY, "slapd_nss_init: chmod failed for file %s error (%d) %s.\n", keydb_file_name, errno, slapd_system_strerror(errno)); } +#if !defined(ENABLE_SQL_PREFIX) + secmoddb_file_name = slapi_ch_smprintf("%s/secmod.db", certdir); if(chmod(secmoddb_file_name, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP )){ LDAPDebug(LDAP_DEBUG_ANY, "slapd_nss_init: chmod failed for file %s error (%d) %s.\n", secmoddb_file_name, errno, slapd_system_strerror(errno)); } +#endif } /****** end of NSS Initialization ******/ _nss_initialized = 1; slapi_ch_free_string(&certdb_file_name); slapi_ch_free_string(&keydb_file_name); +#if !defined(ENABLE_SQL_PREFIX) slapi_ch_free_string(&secmoddb_file_name); +#endif slapi_ch_free_string(&certdir); return rv; } -- 2.4.3