326963 - Interoperability test with apache/mod_ssl: tstclnt produces: assertion failure: secmod_PrivateModuleCount == 0

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Alexei Volkov]

Getting the assertion when configure server to request client auth for a directory access. Server global zone is configured to request client cert.

See attached files for details.

It looks like one reference is left to sid->localCert after     SSL_ClearSessionCache() function call.

Comment 1

[Alexei Volkov]

Attachment: output of tstclnt with SSLTRACE

Comment 2

[Alexei Volkov]

Attachment: ssltap output

Comment 3

[Alexei Volkov]

Attachment: mod_ssl log

Comment 4

[Alexei Volkov]

Attachment: bug fix

leaking cert and priv key in case when server sends request for renegotiation regardless the fact that it already has client cert. If such thing happen, ssl library on the client side should dispose not only cert chain but the user cert of the session and its private key that been left from previous session.

Comment 5

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 211808 [details] [diff] [review]
bug fix

r=nelson.  Good Job.  I'm impressed with how quickly you found that leak.  
I'm asking Julien for SR so that this patch can go into 3.11.1

Comment 6

[Nelson Bolyard (seldom reads bugmail)]

Nominating for NSS 3.11.1

Comment 7

[Alexei Volkov]

Checking in ssl3con.c: 1.77 -> 1.78
Checking in ssl3con.c NSS_3_11_BRANCH: 1.76.2.1 -> 1.76.2.2