73708 - Leak of certs in the temp cert DB

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

Sonja ran a test using selfserv configured to request client 
authentication and hundreds of strsclnts, each with a different
ssl client certificate.  Each client did a few connections,
normally using SSL restart for all but the first.

When the test was over, all the client certs and ~38 root CA 
certs were left in the temp cert DB.

I don't know if the root CA certs being there is by design 
or in error.

The SSL client certs being there constitutes a leak, and must 
be fixed ASAP.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

I'd like to get the fix into NSS 3.2.1 but I don't know if I can 
find the leak that quickly.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

The major leak turned out to be in the cert authentication callback
function that is part of the test programs, not part of the NSS
libraries.  The fixes to the callback functions in those test programs
have been checked in on the trunk and will be part of NSS 3.3.  

There may also be a separate leak of root CA certs, but there is a 
small finite number of such certs, so a leak there will not lead
to unbounded memory growth.  

So, I am reducing the priority of this bug from P1 to P2.

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Marking fixed because of the change to selfserv described above that 
was checked in back in April.