1405522 - sqldb will drop imported certificate trust settings if a non-empty password is changed

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

STR:

certutil -N -d sql:.
certutil -S -d sql:. -n "ca" -x -t "CT,," -s "CN=ca"

(this just makes a sql db with a certificate in it trusted for webauth)

Then, (in a c file or something):

int
main(int argc, char* argv[])
{
  if (NSS_Initialize("sql:.", "", "", SECMOD_DB, NSS_INIT_NOROOTINIT) != SECSuccess) {
    return 1;
  }
  PK11SlotInfo* slot = PK11_GetInternalKeySlot();
  if (PK11_ChangePW(slot, "", "password") != SECSuccess) {
    return 1;
  }
  if (PK11_ChangePW(slot, "password", "") != SECSuccess) {
    return 1;
  }
  PK11_FreeSlot(slot);
  if (NSS_Shutdown() != SECSuccess) {
    return 1;
  }
  return 0;
}

This changes the empty password to "password" and back to an empty password.

`certutil -d sql:. -L` should result in:

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

ca                                                           CTu,u,u


but the last line is instead:

ca                                                           u,u,u

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Interestingly, if the password is changed to a different non-empty password, the trust settings will be unavailable for the duration of that run of NSS, but certutil will print out the correct trust if run after the fact.

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Tim, any chance you could pick up this review while Franziskus is on vacation?

Comment 3

[Phabricator Automation]

Comment on attachment 8915384 [details]
bug 1405522 - fix authenticated attribute migration under password changes in the sql DBs r?franziskus

Tim Taubert [:ttaubert] has approved the revision.

https://phabricator.services.mozilla.com/D100#2339

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler]]

https://treeherder.mozilla.org/#/jobs?repo=nss-try&revision=3ce397fc83977401cb701c9fa9ad1b575c787369

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Try looks good - the gtest failure looks like an intermittent, and the mac builds are failing for every push, so ¯\_(ツ)_/¯
Tim - would you mind checking this in? Thanks!

Comment 6

[Tim Taubert [:ttaubert] (inactive)]

(In reply to David Keeler [:keeler] (use needinfo?) from comment #5)
> Try looks good - the gtest failure looks like an intermittent, and the mac
> builds are failing for every push, so ¯\_(ツ)_/¯

Yeah, it's a known issue. We're looking into it :)

> Tim - would you mind checking this in? Thanks!

Wanted to do that yesterday already, sorry!

https://hg.mozilla.org/projects/nss/rev/f3766809817b

Comment 7

[Tim Taubert [:ttaubert] (inactive)]

(To make up for the delay I just pushed the latest NSS revision to inbound.)

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Thanks!