andykimpe / rpms / 389-ds-base

Forked from rpms/389-ds-base 5 months ago
Clone

Blame SOURCES/0086-Ticket-49726-DS-only-accepts-RSA-and-Fortezza-cipher.patch

3b7e51
From b6894f921a0635dba97a0745ce75917284e5e5ff Mon Sep 17 00:00:00 2001
3b7e51
From: Mark Reynolds <mreynolds@redhat.com>
3b7e51
Date: Sun, 27 May 2018 10:48:55 -0400
3b7e51
Subject: [PATCH] Ticket 49726 - DS only accepts RSA and Fortezza cipher
3b7e51
 families
3b7e51
3b7e51
Bug Description:  Currently DS only accepts fortezza and RSA cipher families.
3b7e51
                  This prevents things like ECC certificates from being used.
3b7e51
3b7e51
Fix Description:  Instead of hardcoding the cipher families, just grab the
3b7e51
                  current type and use it.
3b7e51
3b7e51
                  Also cleaned up code: removed unncessary "ifdefs", and switched
3b7e51
                  for loops to use size_t.
3b7e51
3b7e51
https://pagure.io/389-ds-base/issue/49726
3b7e51
3b7e51
Reviewed by: ?
3b7e51
3b7e51
(cherry picked from commit 27a16a068887e5b9fcab3b4507d58a18e6f1d1ec)
3b7e51
---
3b7e51
 ldap/servers/slapd/ssl.c | 136 ++++++---------------------------------
3b7e51
 1 file changed, 20 insertions(+), 116 deletions(-)
3b7e51
3b7e51
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
3b7e51
index 36b09fd16..b8eba2da4 100644
3b7e51
--- a/ldap/servers/slapd/ssl.c
3b7e51
+++ b/ldap/servers/slapd/ssl.c
3b7e51
@@ -31,28 +31,11 @@
3b7e51
 #include "fe.h"
3b7e51
 #include "certdb.h"
3b7e51
 
3b7e51
-#if !defined(USE_OPENLDAP)
3b7e51
-#include "ldap_ssl.h"
3b7e51
-#endif
3b7e51
-
3b7e51
 /* For IRIX... */
3b7e51
 #ifndef MAXPATHLEN
3b7e51
 #define MAXPATHLEN 1024
3b7e51
 #endif
3b7e51
 
3b7e51
-#if NSS_VMAJOR * 100 + NSS_VMINOR >= 315
3b7e51
-/* TLS1.2 is defined in RFC5246. */
3b7e51
-#define NSS_TLS12 1
3b7e51
-#elif NSS_VMAJOR * 100 + NSS_VMINOR >= 314
3b7e51
-/* TLS1.1 is defined in RFC4346. */
3b7e51
-#define NSS_TLS11 1
3b7e51
-#else
3b7e51
-#define NSS_TLS10 1
3b7e51
-#endif
3b7e51
-
3b7e51
-#if NSS_VMAJOR * 100 + NSS_VMINOR >= 320
3b7e51
-#define HAVE_NSS_DHE 1
3b7e51
-#endif
3b7e51
 
3b7e51
 /******************************************************************************
3b7e51
  * Default SSL Version Rule
3b7e51
@@ -70,10 +53,9 @@
3b7e51
 
3b7e51
 extern char *slapd_SSL3ciphers;
3b7e51
 extern symbol_t supported_ciphers[];
3b7e51
-#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
3b7e51
 static SSLVersionRange enabledNSSVersions;
3b7e51
 static SSLVersionRange slapdNSSVersions;
3b7e51
-#endif
3b7e51
+
3b7e51
 
3b7e51
 /* dongle_file_name is set in slapd_nss_init when we set the path for the
3b7e51
    key, cert, and secmod files - the dongle file must be in the same directory
3b7e51
@@ -109,12 +91,10 @@ static char *configDN = "cn=encryption,cn=config";
3b7e51
 #define CIPHER_SET_DEFAULTWEAKCIPHER 0x10  /* allowWeakCipher is not set in cn=encryption */
3b7e51
 #define CIPHER_SET_ALLOWWEAKCIPHER 0x20    /* allowWeakCipher is on */
3b7e51
 #define CIPHER_SET_DISALLOWWEAKCIPHER 0x40 /* allowWeakCipher is off */
3b7e51
-
3b7e51
-#ifdef HAVE_NSS_DHE
3b7e51
 #define CIPHER_SET_DEFAULTWEAKDHPARAM 0x100  /* allowWeakDhParam is not set in cn=encryption */
3b7e51
 #define CIPHER_SET_ALLOWWEAKDHPARAM 0x200    /* allowWeakDhParam is on */
3b7e51
 #define CIPHER_SET_DISALLOWWEAKDHPARAM 0x400 /* allowWeakDhParam is off */
3b7e51
-#endif
3b7e51
+
3b7e51
 
3b7e51
 #define CIPHER_SET_ISDEFAULT(flag) \
3b7e51
     (((flag)&CIPHER_SET_DEFAULT) ? PR_TRUE : PR_FALSE)
3b7e51
@@ -145,10 +125,7 @@ static char *configDN = "cn=encryption,cn=config";
3b7e51
 #define CIPHER_IS_WEAK 0x4
3b7e51
 #define CIPHER_IS_DEPRECATED 0x8
3b7e51
 
3b7e51
-#ifdef HAVE_NSS_DHE
3b7e51
 static int allowweakdhparam = CIPHER_SET_DEFAULTWEAKDHPARAM;
3b7e51
-#endif
3b7e51
-
3b7e51
 
3b7e51
 static char **cipher_names = NULL;
3b7e51
 static char **enabled_cipher_names = NULL;
3b7e51
@@ -225,12 +202,10 @@ static lookup_cipher _lookup_cipher[] = {
3b7e51
     /*{"tls_dhe_dss_1024_des_sha",          ""}, */
3b7e51
     {"tls_dhe_dss_1024_rc4_sha", "TLS_RSA_EXPORT1024_WITH_RC4_56_SHA"},
3b7e51
     {"tls_dhe_dss_rc4_128_sha", "TLS_DHE_DSS_WITH_RC4_128_SHA"},
3b7e51
-#if defined(NSS_TLS12)
3b7e51
     /* New in NSS 3.15 */
3b7e51
     {"tls_rsa_aes_128_gcm_sha", "TLS_RSA_WITH_AES_128_GCM_SHA256"},
3b7e51
     {"tls_dhe_rsa_aes_128_gcm_sha", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"},
3b7e51
     {"tls_dhe_dss_aes_128_gcm_sha", NULL}, /* not available */
3b7e51
-#endif
3b7e51
     {NULL, NULL}};
3b7e51
 
3b7e51
 /* E.g., "SSL3", "TLS1.2", "Unknown SSL version: 0x0" */
3b7e51
@@ -317,7 +292,6 @@ getSupportedCiphers(void)
3b7e51
     SSLCipherSuiteInfo info;
3b7e51
     char *sep = "::";
3b7e51
     int number_of_ciphers = SSL_NumImplementedCiphers;
3b7e51
-    int i;
3b7e51
     int idx = 0;
3b7e51
     PRBool isFIPS = slapd_pk11_isFIPS();
3b7e51
 
3b7e51
@@ -325,7 +299,7 @@ getSupportedCiphers(void)
3b7e51
 
3b7e51
     if ((cipher_names == NULL) && (_conf_ciphers)) {
3b7e51
         cipher_names = (char **)slapi_ch_calloc((number_of_ciphers + 1), sizeof(char *));
3b7e51
-        for (i = 0; _conf_ciphers[i].name != NULL; i++) {
3b7e51
+        for (size_t i = 0; _conf_ciphers[i].name != NULL; i++) {
3b7e51
             SSL_GetCipherSuiteInfo((PRUint16)_conf_ciphers[i].num, &info, sizeof(info));
3b7e51
             /* only support FIPS approved ciphers in FIPS mode */
3b7e51
             if (!isFIPS || info.isFIPS) {
3b7e51
@@ -341,7 +315,6 @@ getSupportedCiphers(void)
3b7e51
     return cipher_names;
3b7e51
 }
3b7e51
 
3b7e51
-#ifdef HAVE_NSS_DHE
3b7e51
 int
3b7e51
 get_allow_weak_dh_param(Slapi_Entry *e)
3b7e51
 {
3b7e51
@@ -365,7 +338,6 @@ get_allow_weak_dh_param(Slapi_Entry *e)
3b7e51
     slapi_ch_free((void **)&val;;
3b7e51
     return allow;
3b7e51
 }
3b7e51
-#endif
3b7e51
 
3b7e51
 
3b7e51
 char **
3b7e51
@@ -374,7 +346,6 @@ getEnabledCiphers(void)
3b7e51
     SSLCipherSuiteInfo info;
3b7e51
     char *sep = "::";
3b7e51
     int number_of_ciphers = 0;
3b7e51
-    int x;
3b7e51
     int idx = 0;
3b7e51
     PRBool enabled;
3b7e51
 
3b7e51
@@ -383,14 +354,14 @@ getEnabledCiphers(void)
3b7e51
         return NULL;
3b7e51
     }
3b7e51
     if ((enabled_cipher_names == NULL) && _conf_ciphers) {
3b7e51
-        for (x = 0; _conf_ciphers[x].name; x++) {
3b7e51
+        for (size_t x = 0; _conf_ciphers[x].name; x++) {
3b7e51
             SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);
3b7e51
             if (enabled) {
3b7e51
                 number_of_ciphers++;
3b7e51
             }
3b7e51
         }
3b7e51
         enabled_cipher_names = (char **)slapi_ch_calloc((number_of_ciphers + 1), sizeof(char *));
3b7e51
-        for (x = 0; _conf_ciphers[x].name; x++) {
3b7e51
+        for (size_t x = 0; _conf_ciphers[x].name; x++) {
3b7e51
             SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);
3b7e51
             if (enabled) {
3b7e51
                 SSL_GetCipherSuiteInfo((PRUint16)_conf_ciphers[x].num, &info, sizeof(info));
3b7e51
@@ -472,9 +443,6 @@ getSSLVersionRange(char **min, char **max)
3b7e51
         }
3b7e51
         return -1;
3b7e51
     }
3b7e51
-#if defined(NSS_TLS10)
3b7e51
-    return -1; /* not supported */
3b7e51
-#else          /* NSS_TLS11 or newer */
3b7e51
     if (min) {
3b7e51
         *min = slapi_getSSLVersion_str(slapdNSSVersions.min, NULL, 0);
3b7e51
     }
3b7e51
@@ -482,10 +450,8 @@ getSSLVersionRange(char **min, char **max)
3b7e51
         *max = slapi_getSSLVersion_str(slapdNSSVersions.max, NULL, 0);
3b7e51
     }
3b7e51
     return 0;
3b7e51
-#endif
3b7e51
 }
3b7e51
 
3b7e51
-#if defined(USE_OPENLDAP)
3b7e51
 void
3b7e51
 getSSLVersionRangeOL(int *min, int *max)
3b7e51
 {
3b7e51
@@ -499,10 +465,7 @@ getSSLVersionRangeOL(int *min, int *max)
3b7e51
     if (!slapd_ssl_listener_is_initialized()) {
3b7e51
         return;
3b7e51
     }
3b7e51
-#if defined(NSS_TLS10)
3b7e51
-    *max = LDAP_OPT_X_TLS_PROTOCOL_TLS1_0;
3b7e51
-    return;
3b7e51
-#else /* NSS_TLS11 or newer */
3b7e51
+
3b7e51
     if (min) {
3b7e51
         switch (slapdNSSVersions.min) {
3b7e51
         case SSL_LIBRARY_VERSION_3_0:
3b7e51
@@ -550,14 +513,11 @@ getSSLVersionRangeOL(int *min, int *max)
3b7e51
         }
3b7e51
     }
3b7e51
     return;
3b7e51
-#endif
3b7e51
 }
3b7e51
-#endif /* USE_OPENLDAP */
3b7e51
 
3b7e51
 static void
3b7e51
 _conf_init_ciphers(void)
3b7e51
 {
3b7e51
-    int x;
3b7e51
     SECStatus rc;
3b7e51
     SSLCipherSuiteInfo info;
3b7e51
     const PRUint16 *implementedCiphers = SSL_GetImplementedCiphers();
3b7e51
@@ -568,7 +528,7 @@ _conf_init_ciphers(void)
3b7e51
     }
3b7e51
     _conf_ciphers = (cipherstruct *)slapi_ch_calloc(SSL_NumImplementedCiphers + 1, sizeof(cipherstruct));
3b7e51
 
3b7e51
-    for (x = 0; implementedCiphers && (x < SSL_NumImplementedCiphers); x++) {
3b7e51
+    for (size_t x = 0; implementedCiphers && (x < SSL_NumImplementedCiphers); x++) {
3b7e51
         rc = SSL_GetCipherSuiteInfo(implementedCiphers[x], &info, sizeof info);
3b7e51
         if (SECFailure == rc) {
3b7e51
             slapi_log_err(SLAPI_LOG_ERR, "Security Initialization",
3b7e51
@@ -598,7 +558,6 @@ _conf_init_ciphers(void)
3b7e51
 static void
3b7e51
 _conf_setallciphers(int flag, char ***suplist, char ***unsuplist)
3b7e51
 {
3b7e51
-    int x;
3b7e51
     SECStatus rc;
3b7e51
     PRBool setdefault = CIPHER_SET_ISDEFAULT(flag);
3b7e51
     PRBool enabled = CIPHER_SET_ISALL(flag);
3b7e51
@@ -608,7 +567,7 @@ _conf_setallciphers(int flag, char ***suplist, char ***unsuplist)
3b7e51
 
3b7e51
     _conf_init_ciphers();
3b7e51
 
3b7e51
-    for (x = 0; implementedCiphers && (x < SSL_NumImplementedCiphers); x++) {
3b7e51
+    for (size_t x = 0; implementedCiphers && (x < SSL_NumImplementedCiphers); x++) {
3b7e51
         if (_conf_ciphers[x].flags & CIPHER_IS_DEFAULT) {
3b7e51
             /* certainly, not the first time. */
3b7e51
             setme = PR_TRUE;
3b7e51
@@ -663,11 +622,10 @@ charray2str(char **ary, const char *delim)
3b7e51
 void
3b7e51
 _conf_dumpciphers(void)
3b7e51
 {
3b7e51
-    int x;
3b7e51
     PRBool enabled;
3b7e51
     /* {"SSL3","rc4", SSL_EN_RC4_128_WITH_MD5}, */
3b7e51
     slapd_SSL_info("Configured NSS Ciphers");
3b7e51
-    for (x = 0; _conf_ciphers[x].name; x++) {
3b7e51
+    for (size_t x = 0; _conf_ciphers[x].name; x++) {
3b7e51
         SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);
3b7e51
         if (enabled) {
3b7e51
             slapd_SSL_info("\t%s: enabled%s%s%s", _conf_ciphers[x].name,
3b7e51
@@ -687,7 +645,8 @@ char *
3b7e51
 _conf_setciphers(char *setciphers, int flags)
3b7e51
 {
3b7e51
     char *t, err[MAGNUS_ERROR_LEN];
3b7e51
-    int x, i, active;
3b7e51
+    int active;
3b7e51
+    size_t x = 0;
3b7e51
     char *raw = setciphers;
3b7e51
     char **suplist = NULL;
3b7e51
     char **unsuplist = NULL;
3b7e51
@@ -772,7 +731,7 @@ _conf_setciphers(char *setciphers, int flags)
3b7e51
                 }
3b7e51
             }
3b7e51
             if (lookup) { /* lookup with old cipher name and get NSS cipherSuiteName */
3b7e51
-                for (i = 0; _lookup_cipher[i].alias; i++) {
3b7e51
+                for (size_t i = 0; _lookup_cipher[i].alias; i++) {
3b7e51
                     if (!PL_strcasecmp(setciphers, _lookup_cipher[i].alias)) {
3b7e51
                         if (enabled && !_lookup_cipher[i].name[0]) {
3b7e51
                             slapd_SSL_warn("Cipher suite %s is not available in NSS %d.%d.  Ignoring %s",
3b7e51
@@ -915,9 +874,8 @@ getChildren(char *dn)
3b7e51
         slapi_pblock_get(new_pb, SLAPI_PLUGIN_INTOP_RESULT, &search_result);
3b7e51
         slapi_pblock_get(new_pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, &e);
3b7e51
         if (e != NULL) {
3b7e51
-            int i;
3b7e51
             list = (char **)slapi_ch_malloc(sizeof(*list) * (nEntries + 1));
3b7e51
-            for (i = 0; e[i] != NULL; i++) {
3b7e51
+            for (size_t i = 0; e[i] != NULL; i++) {
3b7e51
                 list[i] = slapi_ch_strdup(slapi_entry_get_dn(e[i]));
3b7e51
             }
3b7e51
             list[nEntries] = NULL;
3b7e51
@@ -935,8 +893,7 @@ static void
3b7e51
 freeChildren(char **list)
3b7e51
 {
3b7e51
     if (list != NULL) {
3b7e51
-        int i;
3b7e51
-        for (i = 0; list[i] != NULL; i++) {
3b7e51
+        for (size_t i = 0; list[i] != NULL; i++) {
3b7e51
             slapi_ch_free((void **)(&list[i]));
3b7e51
         }
3b7e51
         slapi_ch_free((void **)(&list));
3b7e51
@@ -1017,7 +974,6 @@ warn_if_no_key_file(const char *dir, int no_log)
3b7e51
     return ret;
3b7e51
 }
3b7e51
 
3b7e51
-#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
3b7e51
 /*
3b7e51
  * If non NULL buf and positive bufsize is given,
3b7e51
  * the memory is used to store the version string.
3b7e51
@@ -1183,7 +1139,6 @@ restrict_SSLVersionRange(void)
3b7e51
         }
3b7e51
     }
3b7e51
 }
3b7e51
-#endif
3b7e51
 
3b7e51
 /*
3b7e51
  * slapd_nss_init() is always called from main(), even if we do not
3b7e51
@@ -1206,7 +1161,6 @@ slapd_nss_init(int init_ssl __attribute__((unused)), int config_available __attr
3b7e51
     int create_certdb = 0;
3b7e51
     PRUint32 nssFlags = 0;
3b7e51
     char *certdir;
3b7e51
-#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
3b7e51
     char emin[VERSION_STR_LENGTH], emax[VERSION_STR_LENGTH];
3b7e51
     /* Get the range of the supported SSL version */
3b7e51
     SSL_VersionRangeGetSupported(ssl_variant_stream, &enabledNSSVersions);
3b7e51
@@ -1216,7 +1170,6 @@ slapd_nss_init(int init_ssl __attribute__((unused)), int config_available __attr
3b7e51
     slapi_log_err(SLAPI_LOG_CONFIG, "Security Initialization",
3b7e51
                   "slapd_nss_init - Supported range by NSS: min: %s, max: %s\n",
3b7e51
                   emin, emax);
3b7e51
-#endif
3b7e51
 
3b7e51
     /* set in slapd_bootstrap_config,
3b7e51
        thus certdir is available even if config_available is false */
3b7e51
@@ -1385,9 +1338,7 @@ slapd_ssl_init()
3b7e51
     char *val = NULL;
3b7e51
     PK11SlotInfo *slot;
3b7e51
     Slapi_Entry *entry = NULL;
3b7e51
-#ifdef HAVE_NSS_DHE
3b7e51
     SECStatus rv = SECFailure;
3b7e51
-#endif
3b7e51
 
3b7e51
     /* Get general information */
3b7e51
 
3b7e51
@@ -1396,7 +1347,6 @@ slapd_ssl_init()
3b7e51
     val = slapi_entry_attr_get_charptr(entry, "nssslSessionTimeout");
3b7e51
     ciphers = slapi_entry_attr_get_charptr(entry, "nsssl3ciphers");
3b7e51
 
3b7e51
-#ifdef HAVE_NSS_DHE
3b7e51
     allowweakdhparam = get_allow_weak_dh_param(entry);
3b7e51
     if (allowweakdhparam & CIPHER_SET_ALLOWWEAKDHPARAM) {
3b7e51
         slapd_SSL_warn("notice, generating new WEAK DH param");
3b7e51
@@ -1405,7 +1355,6 @@ slapd_ssl_init()
3b7e51
             slapd_SSL_error("Warning, unable to generate weak dh parameters");
3b7e51
         }
3b7e51
     }
3b7e51
-#endif
3b7e51
 
3b7e51
     /* We are currently using the value of sslSessionTimeout
3b7e51
        for ssl3SessionTimeout, see SSL_ConfigServerSessionIDCache() */
3b7e51
@@ -1527,7 +1476,6 @@ slapd_ssl_init()
3b7e51
     return 0;
3b7e51
 }
3b7e51
 
3b7e51
-#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
3b7e51
 /*
3b7e51
  * val:   sslVersionMin/Max value set in cn=encription,cn=config (INPUT)
3b7e51
  * rval:  Corresponding value to set SSLVersionRange (OUTPUT)
3b7e51
@@ -1541,7 +1489,7 @@ static int
3b7e51
 set_NSS_version(char *val, PRUint16 *rval, int ismin)
3b7e51
 {
3b7e51
     char *vp, *endp;
3b7e51
-    int vnum;
3b7e51
+    int64_t vnum;
3b7e51
     char emin[VERSION_STR_LENGTH], emax[VERSION_STR_LENGTH];
3b7e51
 
3b7e51
     if (NULL == rval) {
3b7e51
@@ -1662,7 +1610,6 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
3b7e51
                 }
3b7e51
             }
3b7e51
         } else if (tlsv < 1.3) { /* TLS1.2 */
3b7e51
-#if defined(NSS_TLS12)
3b7e51
             if (ismin) {
3b7e51
                 if (enabledNSSVersions.min > SSL_LIBRARY_VERSION_TLS_1_2) {
3b7e51
                     slapd_SSL_warn("The value of sslVersionMin "
3b7e51
@@ -1685,7 +1632,6 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
3b7e51
                     (*rval) = SSL_LIBRARY_VERSION_TLS_1_2;
3b7e51
                 }
3b7e51
             }
3b7e51
-#endif
3b7e51
         } else { /* Specified TLS is newer than supported */
3b7e51
             if (ismin) {
3b7e51
                 slapd_SSL_warn("The value of sslVersionMin "
3b7e51
@@ -1720,7 +1666,6 @@ set_NSS_version(char *val, PRUint16 *rval, int ismin)
3b7e51
 #undef SSLLEN
3b7e51
 #undef TLSSTR
3b7e51
 #undef TLSLEN
3b7e51
-#endif
3b7e51
 
3b7e51
 int
3b7e51
 slapd_ssl_init2(PRFileDesc **fd, int startTLS)
3b7e51
@@ -1740,12 +1685,10 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
3b7e51
     char *tmpDir;
3b7e51
     Slapi_Entry *e = NULL;
3b7e51
     PRBool fipsMode = PR_FALSE;
3b7e51
-#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
3b7e51
     PRUint16 NSSVersionMin = enabledNSSVersions.min;
3b7e51
     PRUint16 NSSVersionMax = enabledNSSVersions.max;
3b7e51
     char mymin[VERSION_STR_LENGTH], mymax[VERSION_STR_LENGTH];
3b7e51
     char newmax[VERSION_STR_LENGTH];
3b7e51
-#endif
3b7e51
     char cipher_string[1024];
3b7e51
     int allowweakcipher = CIPHER_SET_DEFAULTWEAKCIPHER;
3b7e51
     int_fast16_t renegotiation = (int_fast16_t)SSL_RENEGOTIATE_REQUIRES_XTN;
3b7e51
@@ -1964,15 +1907,13 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
3b7e51
                 }
3b7e51
 
3b7e51
                 if (SECSuccess == rv) {
3b7e51
+                    SSLKEAType certKEA;
3b7e51
 
3b7e51
-#ifdef HAVE_NSS_DHE
3b7e51
-                    /* Step If we want weak dh params, flag it on the socket now! */
3b7e51
-
3b7e51
+                    /* If we want weak dh params, flag it on the socket now! */
3b7e51
                     rv = SSL_OptionSet(*fd, SSL_ENABLE_SERVER_DHE, PR_TRUE);
3b7e51
                     if (rv != SECSuccess) {
3b7e51
                         slapd_SSL_warn("Warning, unable to start DHE");
3b7e51
                     }
3b7e51
-
3b7e51
                     if (allowweakdhparam & CIPHER_SET_ALLOWWEAKDHPARAM) {
3b7e51
                         slapd_SSL_warn("notice, allowing weak parameters on socket.");
3b7e51
                         rv = SSL_EnableWeakDHEPrimeGroup(*fd, PR_TRUE);
3b7e51
@@ -1980,13 +1921,9 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
3b7e51
                             slapd_SSL_warn("Warning, unable to allow weak DH params on socket.");
3b7e51
                         }
3b7e51
                     }
3b7e51
-#endif
3b7e51
 
3b7e51
-                    if (slapd_pk11_fortezzaHasKEA(cert) == PR_TRUE) {
3b7e51
-                        rv = SSL_ConfigSecureServer(*fd, cert, key, kt_fortezza);
3b7e51
-                    } else {
3b7e51
-                        rv = SSL_ConfigSecureServer(*fd, cert, key, kt_rsa);
3b7e51
-                    }
3b7e51
+                    certKEA = NSS_FindCertKEAType(cert);
3b7e51
+                    rv = SSL_ConfigSecureServer(*fd, cert, key, certKEA);
3b7e51
                     if (SECSuccess != rv) {
3b7e51
                         errorCode = PR_GetError();
3b7e51
                         slapd_SSL_warn("ConfigSecureServer: "
3b7e51
@@ -2140,7 +2077,6 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
3b7e51
             enableTLS1 = PR_TRUE; /* If available, enable TLS1 */
3b7e51
         }
3b7e51
         slapi_ch_free_string(&val;;
3b7e51
-#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
3b7e51
         val = slapi_entry_attr_get_charptr(e, "sslVersionMin");
3b7e51
         if (val) {
3b7e51
             (void)set_NSS_version(val, &NSSVersionMin, 1);
3b7e51
@@ -2161,9 +2097,8 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
3b7e51
                            mymax, newmax);
3b7e51
             NSSVersionMax = enabledNSSVersions.max;
3b7e51
         }
3b7e51
-#endif
3b7e51
     }
3b7e51
-#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
3b7e51
+
3b7e51
     if (NSSVersionMin > 0) {
3b7e51
         /* Use new NSS API SSL_VersionRangeSet (NSS3.14 or newer) */
3b7e51
         slapdNSSVersions.min = NSSVersionMin;
3b7e51
@@ -2183,7 +2118,6 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
3b7e51
                             mymin, mymax);
3b7e51
         }
3b7e51
     } else {
3b7e51
-#endif
3b7e51
         /* deprecated code */
3b7e51
         sslStatus = SSL_OptionSet(pr_sock, SSL_ENABLE_SSL3, enableSSL3);
3b7e51
         if (sslStatus != SECSuccess) {
3b7e51
@@ -2202,9 +2136,7 @@ slapd_ssl_init2(PRFileDesc **fd, int startTLS)
3b7e51
                            enableTLS1 ? "enable" : "disable",
3b7e51
                            errorCode, slapd_pr_strerror(errorCode));
3b7e51
         }
3b7e51
-#if !defined(NSS_TLS10) /* NSS_TLS11 or newer */
3b7e51
     }
3b7e51
-#endif
3b7e51
 
3b7e51
     val = NULL;
3b7e51
     if (e != NULL) {
3b7e51
@@ -2382,12 +2314,8 @@ slapd_SSL_client_auth(LDAP *ld)
3b7e51
                              */
3b7e51
                             token = slapi_ch_strdup(internalTokenName);
3b7e51
                         }
3b7e51
-#if defined(USE_OPENLDAP)
3b7e51
                         /* openldap needs tokenname:certnick */
3b7e51
                         PR_snprintf(cert_name, sizeof(cert_name), "%s:%s", token, personality);
3b7e51
-#else
3b7e51
-                        PL_strncpyz(cert_name, personality, sizeof(cert_name));
3b7e51
-#endif
3b7e51
                         slapi_ch_free_string(&ssltoken);
3b7e51
                     } else {
3b7e51
                         /* external PKCS #11 token - attach token name */
3b7e51
@@ -2461,7 +2389,6 @@ slapd_SSL_client_auth(LDAP *ld)
3b7e51
                            "(no password). (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
3b7e51
                            errorCode, slapd_pr_strerror(errorCode));
3b7e51
         } else {
3b7e51
-#if defined(USE_OPENLDAP)
3b7e51
             if (slapi_client_uses_non_nss(ld)  && config_get_extract_pem()) {
3b7e51
                 char *certdir = config_get_certdir();
3b7e51
                 char *keyfile = NULL;
3b7e51
@@ -2532,29 +2459,6 @@ slapd_SSL_client_auth(LDAP *ld)
3b7e51
                                    cert_name);
3b7e51
                 }
3b7e51
             }
3b7e51
-/*
3b7e51
-             * not sure what else needs to be done for client auth - don't
3b7e51
-             * currently have a way to pass in the password to use to unlock
3b7e51
-             * the keydb - nor a way to disable caching
3b7e51
-             */
3b7e51
-#else /* !USE_OPENLDAP */
3b7e51
-            rc = ldapssl_enable_clientauth(ld, SERVER_KEY_NAME, pw, cert_name);
3b7e51
-            if (rc != 0) {
3b7e51
-                errorCode = PR_GetError();
3b7e51
-                slapd_SSL_error("ldapssl_enable_clientauth(%s, %s) %i (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
3b7e51
-                                SERVER_KEY_NAME, cert_name, rc,
3b7e51
-                                errorCode, slapd_pr_strerror(errorCode));
3b7e51
-            } else {
3b7e51
-                /*
3b7e51
-                 * We cannot allow NSS to cache outgoing client auth connections -
3b7e51
-                 * each client auth connection must have it's own non-shared SSL
3b7e51
-                 * connection to the peer so that it will go through the
3b7e51
-                 * entire handshake protocol every time including the use of its
3b7e51
-                 * own unique client cert - see bug 605457
3b7e51
-                 */
3b7e51
-                ldapssl_set_option(ld, SSL_NO_CACHE, PR_TRUE);
3b7e51
-            }
3b7e51
-#endif
3b7e51
         }
3b7e51
     }
3b7e51
 
3b7e51
-- 
3b7e51
2.17.0
3b7e51