381718 - Bug in PK11_ListPrivKeysInSlot

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Tom Mraz]

There is a mistake in PK11_ListPrivKeysInSlot making it not to find private keys by nickname:

2074     if (nickname) {
2075         len = PORT_Strlen(nickname)-1;
2076         PK11_SETATTRS(attrs, CKA_LABEL, nickname, len); attrs++;
2077     }

In the code above the -1 should be removed.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

The -1 is a bug, (and I think there be another bug about that already),
but private key objects typically don't have useful CKA_LABELs.
This is because keys are generated well before the certs are available
and the nicknames are generally derived from the cert contents.
So, by the time the cert arrives, the priv key is already created without
a useful nickname.

If you look at how other NSS programs fine private keys from nicknames,
you'll notice that they find a cert object with the nickname, and then find 
the private key object whose CKA_ID matches the CKA_ID of the cert. 

Comment 2

[Tom Mraz]

I'm using NSS for ssh keys and certs are meaningless there but I know about the problem you wrote and I'll workaround it some way or another.

Comment 3

[Kai Engert (:KaiE:)]

Nelson, should we go ahead and fix the bug?

Do you want me to attach a patch?

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

This bug is a duplicate of Bug 353714, which notes that there are other
problems with that function than merely this one off-by-one issue.  

Kai and Tom, feel free to attach a patch (or patches) to Bug 353714 
that address the issues reported there.

Comment 5

[Tom Mraz]

I'd rather leave this bug for the off by one issue as the other bug mentions another issues which I don't know about.

Comment 6

[Tom Mraz]

Attachment: Patch for the off-by-one for ListPubKeys and ListPrivKeys functions

Comment 7

[Wan-Teh Chang]

Comment on attachment 265930 [details] [diff] [review]
Patch for the off-by-one for ListPubKeys and ListPrivKeys functions

r=wtc.

Comment 8

[Robert Relyea]

Comment on attachment 265930 [details] [diff] [review]
Patch for the off-by-one for ListPubKeys and ListPrivKeys functions

r+ for the 3.11 branch once it opens again.

Comment 9

[Julien Pierre]

Fixed on the trunk :

Checking in pk11akey.c;
/cvsroot/mozilla/security/nss/lib/pk11wrap/pk11akey.c,v  <--  pk11akey.c
new revision: 1.18; previous revision: 1.17
done

And on the NSS_3_11_BRANCH :

Checking in pk11akey.c;
/cvsroot/mozilla/security/nss/lib/pk11wrap/pk11akey.c,v  <--  pk11akey.c
new revision: 1.9.2.7; previous revision: 1.9.2.6
done