|
 |
dc8c34 |
From 32e9133c933830ff0ae89401365e1e912c771ecb Mon Sep 17 00:00:00 2001
|
|
|
dc8c34 |
From: Mark Reynolds <mreynolds@redhat.com>
|
|
|
dc8c34 |
Date: Fri, 14 Oct 2016 16:17:46 -0400
|
|
|
dc8c34 |
Subject: [PATCH 409/410] Ticket 48909 - Replication stops working in FIPS mode
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Bug Description: When FIPS mode is enabled on the security database, the
|
|
|
dc8c34 |
token name is changed. This prevents the server from
|
|
|
dc8c34 |
reverse decoding the replication manager's password. Which
|
|
|
dc8c34 |
prevents replication sessions from getting established.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Fix Description: Instead of getting the key slot from the harded coded token
|
|
|
dc8c34 |
name, call slapd_pk11_getInternalKeySlot() which gets the
|
|
|
dc8c34 |
current slot.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
https://fedorahosted.org/389/ticket/48909
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Reviewed by: nhosoi(Thanks!)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
(cherry picked from commit 61c72f966bda17993f483e8f79d97dff20b7cc93)
|
|
|
dc8c34 |
(cherry picked from commit c55e70835b4896ca178f6db2e9efe3545617357e)
|
|
|
dc8c34 |
---
|
|
|
dc8c34 |
ldap/servers/plugins/rever/pbe.c | 11 +++++------
|
|
|
dc8c34 |
1 file changed, 5 insertions(+), 6 deletions(-)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
diff --git a/ldap/servers/plugins/rever/pbe.c b/ldap/servers/plugins/rever/pbe.c
|
|
|
dc8c34 |
index abb8d1b..7206bb9 100644
|
|
|
dc8c34 |
--- a/ldap/servers/plugins/rever/pbe.c
|
|
|
dc8c34 |
+++ b/ldap/servers/plugins/rever/pbe.c
|
|
|
dc8c34 |
@@ -98,7 +98,7 @@ struct pk11ContextStore
|
|
|
dc8c34 |
|
|
|
dc8c34 |
static int encode_path(char *inPlain, char **outCipher, char *path, int mech);
|
|
|
dc8c34 |
static int decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid);
|
|
|
dc8c34 |
-static SVRCOREError genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *algid);
|
|
|
dc8c34 |
+static SVRCOREError genKey(struct pk11ContextStore **out, char *path, int mech, PRArenaPool *arena, char *algid);
|
|
|
dc8c34 |
static SVRCOREError cryptPassword(struct pk11ContextStore *store, char * clear, unsigned char **out);
|
|
|
dc8c34 |
static SVRCOREError decryptPassword(struct pk11ContextStore *store, unsigned char *cipher, char **out, int len);
|
|
|
dc8c34 |
static void freePBE(struct pk11ContextStore *store);
|
|
|
dc8c34 |
@@ -131,7 +131,7 @@ encode_path(char *inPlain, char **outCipher, char *path, int mech)
|
|
|
dc8c34 |
*outCipher = NULL;
|
|
|
dc8c34 |
err = 1;
|
|
|
dc8c34 |
|
|
|
dc8c34 |
- if ( genKey(&context, tokPBE, path, mech, arena, NULL) == SVRCORE_Success ){
|
|
|
dc8c34 |
+ if ( genKey(&context, path, mech, arena, NULL) == SVRCORE_Success ){
|
|
|
dc8c34 |
/* Try an encryption */
|
|
|
dc8c34 |
if ( cryptPassword(context, inPlain, &cipher) == SVRCORE_Success ){
|
|
|
dc8c34 |
base = BTOA_DataToAscii(cipher, context->length);
|
|
|
dc8c34 |
@@ -189,7 +189,7 @@ decode_path(char *inCipher, char **outPlain, char *path, int mech, char *algid)
|
|
|
dc8c34 |
*outPlain = NULL;
|
|
|
dc8c34 |
err = 1;
|
|
|
dc8c34 |
|
|
|
dc8c34 |
- if ( genKey(&context, tokPBE, path, mech, arena, algid) == SVRCORE_Success ){
|
|
|
dc8c34 |
+ if ( genKey(&context, path, mech, arena, algid) == SVRCORE_Success ){
|
|
|
dc8c34 |
/* it seems that there is memory leak in that function: bug 400170 */
|
|
|
dc8c34 |
base = ATOB_AsciiToData(inCipher, (unsigned int*)&len;;
|
|
|
dc8c34 |
if ( base != NULL ){
|
|
|
dc8c34 |
@@ -225,7 +225,7 @@ freePBE(struct pk11ContextStore *store)
|
|
|
dc8c34 |
}
|
|
|
dc8c34 |
|
|
|
dc8c34 |
static SVRCOREError
|
|
|
dc8c34 |
-genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, PRArenaPool *arena, char *alg)
|
|
|
dc8c34 |
+genKey(struct pk11ContextStore **out, char *path, int mech, PRArenaPool *arena, char *alg)
|
|
|
dc8c34 |
{
|
|
|
dc8c34 |
SVRCOREError err = SVRCORE_Success;
|
|
|
dc8c34 |
struct pk11ContextStore *store = NULL;
|
|
|
dc8c34 |
@@ -252,8 +252,7 @@ genKey(struct pk11ContextStore **out, const char *token, char *path, int mech, P
|
|
|
dc8c34 |
}
|
|
|
dc8c34 |
*out = store;
|
|
|
dc8c34 |
|
|
|
dc8c34 |
- /* Use the tokenName to find a PKCS11 slot */
|
|
|
dc8c34 |
- store->slot = slapd_pk11_findSlotByName((char *)token);
|
|
|
dc8c34 |
+ store->slot = slapd_pk11_getInternalKeySlot();
|
|
|
dc8c34 |
if (store->slot == NULL){
|
|
|
dc8c34 |
err = SVRCORE_NoSuchToken_Error;
|
|
|
dc8c34 |
goto done;
|
|
|
dc8c34 |
--
|
|
|
dc8c34 |
2.4.11
|
|
|
dc8c34 |
|