From 964d13237029e0568f56342917ae386746c0b281 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Fri, 1 Feb 2019 10:30:40 -0500
Subject: [PATCH] Update mod_nss cipher list so there is overlap with a 4.x
 master

dogtag updated its cipher list, disabling a lot of ciphers, which
causes an overlap problem with a RHEL 6.x IPA master.

This update script adds the two available ciphers to the nss.conf
so that creating a CA replica is possible.

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
---
 contrib/copy-schema-to-ca-RHEL6.py | 79 ++++++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)

diff --git a/contrib/copy-schema-to-ca-RHEL6.py b/contrib/copy-schema-to-ca-RHEL6.py
index 3ed16555e9a63867162b58fe99531db46e867a8b..2b866a52ba99f59db913a127f271c6da63a65b95 100755
--- a/contrib/copy-schema-to-ca-RHEL6.py
+++ b/contrib/copy-schema-to-ca-RHEL6.py
@@ -31,6 +31,12 @@ from ipaserver.install.dsinstance import DS_USER
 from ipaserver.install.cainstance import PKI_USER
 from ipapython import services
 
+# for mod_nss
+from ipaserver.install.httpinstance import NSS_CONF
+from ipaserver.install.httpinstance import HTTPInstance
+from ipaserver.install import installutils
+from ipapython import sysrestore
+
 SERVERID = "PKI-IPA"
 SCHEMA_FILENAMES = (
     "60kerberos.ldif",
@@ -100,6 +106,77 @@ def restart_pki_ds():
     services.service('dirsrv').restart(SERVERID)
 
 
+# The ipa-3-0 set_directive() has very loose comparision of directive
+# which would cause multiple NSSCipherSuite to be added so provide
+# a custom function for it.
+def set_directive(filename, directive, value, quotes=True, separator=' '):
+    """Set a name/value pair directive in a configuration file.
+
+       A value of None means to drop the directive.
+
+       This has only been tested with nss.conf
+    """
+    valueset = False
+    st = os.stat(filename)
+    fd = open(filename)
+    newfile = []
+    for line in fd:
+        if line.lstrip().startswith(directive):
+            valueset = True
+            if value is not None:
+                if quotes:
+                    newfile.append('%s%s"%s"\n' %
+                                   (directive, separator, value))
+                else:
+                    newfile.append('%s%s%s\n' % (directive, separator, value))
+        else:
+            newfile.append(line)
+    fd.close()
+    if not valueset:
+        if value is not None:
+            if quotes:
+                newfile.append('%s%s"%s"\n' % (directive, separator, value))
+            else:
+                newfile.append('%s%s%s\n' % (directive, separator, value))
+
+    fd = open(filename, "w")
+    fd.write("".join(newfile))
+    fd.close()
+    os.chown(filename, st.st_uid, st.st_gid)  # reset perms
+
+
+def update_mod_nss_cipher_suite():
+    add_ciphers = ['ecdhe_rsa_aes_128_sha', 'ecdhe_rsa_aes_256_sha']
+    ciphers = installutils.get_directive(NSS_CONF, 'NSSCipherSuite')
+
+    # Run through once to see if any of the new ciphers are there but
+    # disabled. If they are then enable them.
+    lciphers = ciphers.split(',')
+    new_ciphers = []
+    for cipher in lciphers:
+        for add in add_ciphers:
+            if cipher.endswith(add):
+                if cipher.startswith('-'):
+                    cipher = '+%s' % add
+        new_ciphers.append(cipher)
+
+    # Run through again and add remaining ciphers as enabled.
+    for add in add_ciphers:
+        if add not in ciphers:
+            new_ciphers.append('+%s' % add)
+
+    ciphers = ','.join(new_ciphers)
+    set_directive(NSS_CONF, 'NSSCipherSuite', ciphers, False)
+    root_logger.info('Updated Apache cipher list')
+
+
+def restart_http():
+    root_logger.info('Restarting HTTP')
+    fstore = sysrestore.FileStore('/var/lib/ipa/sysrestore')
+    http = HTTPInstance(fstore)
+    http.restart()
+
+
 def main():
     if os.getegid() != 0:
         sys.exit("Must be root to run this script")
@@ -110,6 +187,8 @@ def main():
 
     add_ca_schema()
     restart_pki_ds()
+    update_mod_nss_cipher_suite()
+    restart_http()
 
     root_logger.info('Schema updated successfully')
 
-- 
2.20.1