138626 - Deleted certs delivered by PK11_ListCerts

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Kai Engert (:KaiE:)]

Delete a user cert using PK11_DeleteTokenCertAndKey.
Use PK11_ListCerts(PK11CertListUser) to obtain a list of all user certs.
Actual behaviour: The result list contains the deleted cert.

Comment 1

[Stephane Saux]

adding adt and nsbeta1 so that it makes it into rtm.

Comment 2

[Ian McGreer]

I've seen this behavior, and it is always for the same reason -- the cert has
been leaked.  PSM has code that delays the actual deletion of the cert until the
last reference goes away.  Additionally, if there are references to the cert, it
will show up in NSS's cache.

What you should look at is the refCount of the cert, and try to find the leak.

Actually, I just looked at the nsNSSCertificate destructor.  It does not call
CERT_DestroyCertificate after calling PK11_DeleteTokenCertAndKey when
mPermDelete is true.

Comment 3

[Robert Relyea]

So there is 2 issues here:
1) the cert is leaked.
2) delete should remove the cert from the cache, even if it is leaked.

bob

Comment 4

[Charles Rosendahl]

Is this fixed - Bug 129067 has been fixed and verified.

Comment 5

[Kai Engert (:KaiE:)]

> Is this fixed - Bug 129067 has been fixed and verified.

Charles, no. This is a tracking bug for the NSS component.

Bug 129067 uses a workaround for this bug, but this bug has not yet been fixed.

Comment 6

[Wan-Teh Chang]

Assigned the bug to Bob.

Comment 7

[Ian McGreer]

Attachment: remove deleted certs from cache

patch checked in

Comment 8

[Kai Engert (:KaiE:)]

Thanks for the patch.
I was curious to see whether this patch alone is sufficient to fix bug 129067,
but it is not. But I believe you expected that, because you believe we have
leaks in PSM.

Ian, how can I look at the refCount of a CERT_Certificate from the code? My
impression is that the direct refcount member is not the real refcount.

Comment 9

[Wan-Teh Chang]

Assigned the bug to Ian.

Comment 10

[Ian McGreer]

Ah, blimey.  I forgot PK11_DeleteTokenCertAndKey is a different code path than
SEC_DeletePermCertificate (sigh).

You can find the actual refCount in cert->nssCertificate->object.refCount.

Comment 11

[Ian McGreer]

I must correct myself.  PK11_DeleteTokenCertAndKey *does* call
SEC_DeletePermCertificate, so my patch should get the cert out of the cache.

Comment 12

[Wan-Teh Chang]

Changed the QA contact to Bishakha.

Comment 13

[Kai Engert (:KaiE:)]

I'm marking this fixed, because Wan-Teh today landed this patch together with
other changes on the NSS_CLIENT_TAG.

Comment 14

[Wan-Teh Chang]

Set target milestone to NSS 3.5.

Comment 15

[Jaime Rodriguez, Jr.]

Does this need to be checked into the 1.0 branch? If yes, please nominate for
checkin with adt1.0.1 and Mozilla1.0.1 keywords.

Comment 16

[Wan-Teh Chang]

Yes, this needs to be checked into the 1.0 branch.

Added the adt1.0.1 and mozilla1.0.1 keywords.