IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Free NSS objects in --external-ca scenario

Browse Source 
In external CA installation, ipa-server-install leaked NSS objects
which caused an installation crash later when a subsequent call of
NSSConnection tried to free them.

Properly freeing the NSS objects avoid this crash.

https://fedorahosted.org/freeipa/ticket/3773
This commit is contained in:
Martin Kosek 2013-07-26 10:58:52 +02:00
parent 8a41b64a8c
commit 6a0aabede5
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
freeipa.spec.in
View File

@ -134,7 +134,7 @@ Requires(post): systemd-units
Requires: selinux-policy >= 3.12.1-65 Requires: selinux-policy >= 3.12.1-65
Requires(post): selinux-policy-base Requires(post): selinux-policy-base
Requires: slapi-nis >= 0.44 Requires: slapi-nis >= 0.44
Requires: pki-ca >= 10.0.2 Requires: pki-ca >= 10.0.4
Requires: dogtag-pki-server-theme Requires: dogtag-pki-server-theme
%if 0%{?rhel} %if 0%{?rhel}
Requires: subscription-manager Requires: subscription-manager
@ -829,6 +829,9 @@ fi
%endif # ! %{ONLY_CLIENT} %endif # ! %{ONLY_CLIENT}
%changelog %changelog
* Fri Jul 26 2013 Martin Kosek <mkosek@redhat.com> - 3.2.99-12
- Require pki-ca 10.0.4 which fixes external CA installation (#986901)
* Wed Jul 24 2013 Petr Viktorin <pviktori@redhat.com> - 3.2.99-11 * Wed Jul 24 2013 Petr Viktorin <pviktori@redhat.com> - 3.2.99-11
- Add tar and xz dependencies to freeipa-tests - Add tar and xz dependencies to freeipa-tests

5
install/tools/ipa-server-install
View File

@ -698,18 +698,23 @@ def main():
sys.exit(1) sys.exit(1)
certdict = dict((DN(str(cert.subject)), cert) for cert in extchain) certdict = dict((DN(str(cert.subject)), cert) for cert in extchain)
del extchain
certissuer = DN(str(extcert.issuer)) certissuer = DN(str(extcert.issuer))
if certissuer not in certdict: if certissuer not in certdict:
print "The external certificate is not signed by the external CA (unknown issuer %s)." % certissuer print "The external certificate is not signed by the external CA (unknown issuer %s)." % certissuer
sys.exit(1) sys.exit(1)
cert = extcert cert = extcert
del extcert
while cert.issuer != cert.subject: while cert.issuer != cert.subject:
certissuer = DN(str(cert.issuer)) certissuer = DN(str(cert.issuer))
if certissuer not in certdict: if certissuer not in certdict:
print "The external CA chain is incomplete (%s is missing from the chain)." % certissuer print "The external CA chain is incomplete (%s is missing from the chain)." % certissuer
sys.exit(1) sys.exit(1)
del cert
cert = certdict[certissuer] cert = certdict[certissuer]
del certdict
del cert
# We only set up the CA if the PKCS#12 options are not given. # We only set up the CA if the PKCS#12 options are not given.
if options.dirsrv_pkcs12: if options.dirsrv_pkcs12: