Ticket #47838 - harden the list of ciphers available by default

Description:
1. Introducing a new attribute allowWeakCipher in "cn=encryption,cn=config".
   allowWeakCipher: [on | off]
                     on  -- allows weak ciphers.
                            Default setting for user specified ciphers.
                     off -- rejects weak ciphers.
                            Default setting for +all and default.

2. allowWeakCipher is applied only to the user specified cipher suites
   such as "nsSSL3Ciphers: +rsa_rc4_128_md5".
   If allowWeakCipher is enabled and the user specified cipher is weak,
      SSL alert is logged in the error log:
       SSL alert: Cipher rsa_rc4_128_md5 is weak. It is enabled since
       allowWeakCipher is "on" (default setting for the backward compatibility).
       We strongly recommend to set it to "off".  Please replace the value of
       allowWeakCipher with "off" in the encryption config entry cn=encryption,
       cn=config and restart the server.

3. If specified cipher suite is not supported, ignore the cipher suite
   and continue setting ciphers.

https://fedorahosted.org/389/ticket/47838

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)
Ticket 47838,47895 - CI test: add test cases for ticket 47838 and 47895

Description:
Ticket #47838: harden the list of ciphers available by default
Adding test cases for default behaviour change of allowWeakCipher.

Ticket #47895 - If no effective ciphers are available, disable security setting.
Test case for "Even if no cipher is available, the server starts
without SSL" is added.

https://fedorahosted.org/389/ticket/47838
Ticket #47895 - If no effective ciphers are available, disable security setting.

Description: If nsslapd-security is "on" and nsSSL3Ciphers is given
AND none of the ciphers are available or some syntax error is detected,
the server sets nsslapd-security "off" and starts up.

https://fedorahosted.org/389/ticket/47895

Reviewed by nkinder@redhat.com (Thank you, Nathan!!)
Ticket 47889 - DS crashed during ipa-server-install on test_ava_filter

Bug Description:
	During a MOD the target entry is duplicated and mods are applied
	on the duplicated entry that is set in the pblock (SLAPI_MODIFY_EXISTING_ENTRY).
	In case of transient DB error, ldbm_back_modify retries.
	But when retrying the duplicated entry will be freed and needs to be duplicated again.
	The new duplicated entry needs to be set in the pblock.
	https://fedorahosted.org/389/ticket/47834 erronously skip the setting of SLAPI_MODIFY_EXISTING_ENTRY

Fix Description:
	Set SLAPI_MODIFY_EXISTING_ENTRY during mod/retry

https://fedorahosted.org/389/ticket/47889

Reviewed by: ?

Platforms tested: F20

Flag Day: no

Doc impact: no
Ticket 47787: Make the test case more robust

Description
	Sometime the MOD (description) M2->M1 takes some time and we need to be sure it is
	replicated before checking that the target entry is identical M1 vs. M2
https://fedorahosted.org/389/ticket/47787

reviewed by: Mark Reynolds (Thanks Mark !)

Platforms tested: F20

Flag Day: no

Doc impact: no
Ticket #47892 coverity defects found in 1.3.3.1

https://fedorahosted.org/389/ticket/47892
Reviewed by: mreynolds, nkinder (Thanks!)
Branch: master
Fix Description:
9. 389-ds-base-1.3.3.1/ldap/servers/plugins/memberof/memberof.c:2079:var_compare_op – Comparing "group_norm_vals" to null implies that "group_norm_vals" might be null.
11. 389-ds-base-1.3.3.1/ldap/servers/plugins/memberof/memberof.c:2099:var_deref_model – Passing null pointer "group_norm_vals" to function "slapi_valueset_add_value_ext(Slapi_ValueSet *, Slapi_Value const *, unsigned long)", which dereferences it.
12. 389-ds-base-1.3.3.1/ldap/servers/slapd/valueset.c:896:2:deref_parm_in_call – Function "slapi_valueset_add_attr_valuearray_ext(Slapi_Attr const *, Slapi_ValueSet *, Slapi_Value **, int, unsigned long, int *)" dereferences "vs".
15. 389-ds-base-1.3.3.1/ldap/servers/slapd/valueset.c:1075:2:deref_parm – Directly dereferencing parameter "vs".

Added a check for group_norm_vals == NULL at beginning of function.  I think this had a chain effect causing 11, 12, and 15 as well.

various - deprecated conversion from string constant - added const_cast<char *> as recommended by C++ guides.

2. 389-ds-base-1.3.3.1/ldap/servers/slapd/back-ldbm/ldif2ldbm.c:2198:78:warning – 'j' may be used uninitialized in this function [-Wmaybe-uninitialized]

Should have been using SLAPI_ATTR_TOMBSTONE_CSN

2. 389-ds-base-1.3.3.1/ldap/servers/plugins/acl/aclparse.c:538:28:warning – 'is_target_to' may be used uninitialized in this function [-Wmaybe-uninitialized]

2. 389-ds-base-1.3.3.1/ldap/servers/plugins/acl/acl.c:2493:26:warning – 'attrFilterArray' may be used uninitialized in this function [-Wmaybe-uninitialized]

These are false positives.

The minor memleaks were also fixed.

Platforms tested: Fedora 20
Flag Day: no
Doc impact: no
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing

Description: Poring changes made to 1.2.11 branch to newer versions.
1) Enabiling cache lock in cache_is_in_cache and cache_has_otherref.
2) Removing unused field new_entry_in_cache from "struct _modify_context".
Ticket #47907 - ldclt: assertion failure with -e "add,counteach" -e "object=<ldif file>,rdn=uid:test[A=INCRNNOLOOP(0;24

Bug Description: In case createMissingNodes is called from doAddEntry,
LDAP handle is unbound which makes the following operation such as
ldap_add fail since the handle is already released.

Fix Description: Rempoving ldap_unbind_ext from createMissingNodes.

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)

https://fedorahosted.org/389/ticket/47907
Ticket #47908 - 389-ds 1.3.3.0 does not adjust cipher suite configuration on upgrade, breaks itself and pki-server

Description:
In the given cipher list:
  nsSSL3Ciphers: +rsa_fips_3des_sha,+rsa_fips_des_sha,+rsa_3des_sha,
   +rsa_rc4_128_md5,+rsa_des_sha,+rsa_rc2_40_md5,+rsa_rc4_40_md5,
   +fortezza
there were 2 issues.
1) An old cipher suite name rsa_des_sha was not correctly mapped
   to the name supported by NSS (TLS_RSA_WITH_DES_CBC_SHA) in the
   mapping table. And the unsupported cipher name was not gracefully
   skipped but returned an error.  This patch fixes the mapped name
   and the behaviour so that it skips the unknown/unsupported cipher.
2) A cipher "fortezza" is deprecated.  It's now skipped with the
   proper warning message.

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)

https://fedorahosted.org/389/ticket/47908
Ticket 47900 - Adding an entry with an invalid password as rootDN is incorrectly rejected

Bug Description:  Root DN and password administrators should bypass all password
                  restrictions and syntax checks, but on ADD operations the password
                  checks were still be applied to root/password admins.

Fix Description:  Do not check the password syntax if the bind DN is a rootDN/password admin.

https://fedorahosted.org/389/ticket/47900

Reviewed by: nhosoi(Thanks!)
Ticket #47838 - harden the list of ciphers available by default (phase 2)

Description:
1) By default (i.e., no explicit allowWeakCipher set in cn=encryption,cn=config),
   allowWeakCipher is on for user specified cipher list
   allowWeakCipher is off for "+all" and "default"
2) Fixed enabled allowWeakCipher (explicitly set "on" to it) is
   applied to "+all" and "default".
3) If an invalid value is set to allowWeakCipher, this message is
   logged in the error log and set it to the default value.
     SSL alert: The value of allowWeakCipher "poor" in cn=encryption,
     cn=config is invalid. Ignoring it and set it to default.

https://fedorahosted.org/389/ticket/47838

Reviewed by tbordaz@redhat.com (Thank you, Thierry!)
Ticket 47838 - CI test: adjusted test cases based on the phase 2 fixes for ticket 47838

https://fedorahosted.org/389/ticket/47838
Ticket #47880 - provide enabled ciphers as search result

Description: Implemented getEnabledCiphers, with which
  ldapsearch -b "cn=encryption,cn=config" nsSSLEnabledCiphers
returns enabled cipher list.  Example of returned enabled cipher
  dn: cn=encryption,cn=config
  nsSSLEnabledCiphers: TLS_RSA_WITH_RC4_128_MD5::RC4::MD5::128
  nsSSLEnabledCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5::3DES::MD5::192

https://fedorahosted.org/389/ticket/47880

Reviewed by mreynolds@redhat.com (Thank you, Mark!)
Ticket 47880 - CI test: added test cases for ticket 47880

Description: Ticket #47880 - provide enabled ciphers as search result

https://fedorahosted.org/389/ticket/47880
Ticket #47892 - coverity defects found in 1.3.3.x

Description: fixing compiler warnings reported by covscan on 1.3.3.4.
https://fedorahosted.org/389/ticket/47892#comment:8

Reviewed by mreynolds@redhat.com (Thank you, Mark!!)
Ticket 47900 - Server fails to start if password admin is set

Bug Description:  The server will crash at startup if the password admin is set.

Fix Description:  When creating a password policy for the pblock, which we do
                  for add and modifiy operations, make sure the server is fully
                  up and running before searching backends for password admins.

                  Also, allow passwordAdminDN to be deleted from the cn=config.

https://fedorahosted.org/389/ticket/47900

Reviewed by: nhosoi(Thanks!)
Ticket 47918 - result of dna_dn_is_shared_config is incorrectly used

Bug Description:  dna_load_shared_servers() is called for all entries,
                  except the config entries

Fix Description:   revert the logic of the result of dna_dn_is_shared_config()

https://fedorahosted.org/389/ticket/47918

Reviewed by: Mark, Thanks
ticket 47916 plugin logging parameter only triggers result logging

Fix: evaluate global plugin logging param, when setting logging flag for plugins

Reviewed by: Noriko, Thanks
https://fedorahosted.org/389/ticket/47916