Ticket #47838 - harden the list of ciphers available by default

Description:
1. Introducing a new attribute allowWeakCipher in "cn=encryption,cn=config".
   allowWeakCipher: [on | off]
                     on  -- allows weak ciphers.
                            Default setting for user specified ciphers.
                     off -- rejects weak ciphers.
                            Default setting for +all and default.

2. allowWeakCipher is applied only to the user specified cipher suites
   such as "nsSSL3Ciphers: +rsa_rc4_128_md5".
   If allowWeakCipher is enabled and the user specified cipher is weak,
      SSL alert is logged in the error log:
       SSL alert: Cipher rsa_rc4_128_md5 is weak. It is enabled since
       allowWeakCipher is "on" (default setting for the backward compatibility).
       We strongly recommend to set it to "off".  Please replace the value of
       allowWeakCipher with "off" in the encryption config entry cn=encryption,
       cn=config and restart the server.

3. If specified cipher suite is not supported, ignore the cipher suite
   and continue setting ciphers.

https://fedorahosted.org/389/ticket/47838

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)

(cherry picked from commit 5f3c87e1380e56d76d4a4bef3af07633a8589891)
Ticket 47838,47895 - CI test: add test cases for ticket 47838 and 47895

Description:
Ticket #47838: harden the list of ciphers available by default
Adding test cases for default behaviour change of allowWeakCipher.

Ticket #47895 - If no effective ciphers are available, disable security setting.
Test case for "Even if no cipher is available, the server starts
without SSL" is added.

https://fedorahosted.org/389/ticket/47838
(cherry picked from commit 4fb1a04ceb9631680a9bcff844250afb4b6e5b7d)
Ticket #47895 - If no effective ciphers are available, disable security setting.

Description: If nsslapd-security is "on" and nsSSL3Ciphers is given
AND none of the ciphers are available or some syntax error is detected,
the server sets nsslapd-security "off" and starts up.

https://fedorahosted.org/389/ticket/47895

Reviewed by nkinder@redhat.com (Thank you, Nathan!!)

(cherry picked from commit 0f1a203a0fe85f3cf0440006685f63409502f093)
Ticket 47889 - DS crashed during ipa-server-install on test_ava_filter

Bug Description:
	During a MOD the target entry is duplicated and mods are applied
	on the duplicated entry that is set in the pblock (SLAPI_MODIFY_EXISTING_ENTRY).
	In case of transient DB error, ldbm_back_modify retries.
	But when retrying the duplicated entry will be freed and needs to be duplicated again.
	The new duplicated entry needs to be set in the pblock.
	https://fedorahosted.org/389/ticket/47834 erronously skip the setting of SLAPI_MODIFY_EXISTING_ENTRY

Fix Description:
	Set SLAPI_MODIFY_EXISTING_ENTRY during mod/retry

https://fedorahosted.org/389/ticket/47889

Reviewed by: ?

Platforms tested: F20

Flag Day: no

Doc impact: no

(cherry picked from commit 3b5f3fa1b82cde2bda1104cf758acb64f6484009)
bump version to 1.3.3.2
Ticket #47892 coverity defects found in 1.3.3.1

https://fedorahosted.org/389/ticket/47892
Reviewed by: mreynolds, nkinder (Thanks!)
Branch: 389-ds-base-1.3.3
Fix Description:
9. 389-ds-base-1.3.3.1/ldap/servers/plugins/memberof/memberof.c:2079:var_compare_op – Comparing "group_norm_vals" to null implies that "group_norm_vals" might be null.
11. 389-ds-base-1.3.3.1/ldap/servers/plugins/memberof/memberof.c:2099:var_deref_model – Passing null pointer "group_norm_vals" to function "slapi_valueset_add_value_ext(Slapi_ValueSet *, Slapi_Value const *, unsigned long)", which dereferences it.
12. 389-ds-base-1.3.3.1/ldap/servers/slapd/valueset.c:896:2:deref_parm_in_call – Function "slapi_valueset_add_attr_valuearray_ext(Slapi_Attr const *, Slapi_ValueSet *, Slapi_Value **, int, unsigned long, int *)" dereferences "vs".
15. 389-ds-base-1.3.3.1/ldap/servers/slapd/valueset.c:1075:2:deref_parm – Directly dereferencing parameter "vs".

Added a check for group_norm_vals == NULL at beginning of function.  I think this had a chain effect causing 11, 12, and 15 as well.

various - deprecated conversion from string constant - added const_cast<char *> as recommended by C++ guides.

2. 389-ds-base-1.3.3.1/ldap/servers/slapd/back-ldbm/ldif2ldbm.c:2198:78:warning – 'j' may be used uninitialized in this function [-Wmaybe-uninitialized]

Should have been using SLAPI_ATTR_TOMBSTONE_CSN

2. 389-ds-base-1.3.3.1/ldap/servers/plugins/acl/aclparse.c:538:28:warning – 'is_target_to' may be used uninitialized in this function [-Wmaybe-uninitialized]

2. 389-ds-base-1.3.3.1/ldap/servers/plugins/acl/acl.c:2493:26:warning – 'attrFilterArray' may be used uninitialized in this function [-Wmaybe-uninitialized]

These are false positives.

The minor memleaks were also fixed.

Platforms tested: Fedora 20
Flag Day: no
Doc impact: no

(cherry picked from commit 66e43aee7151acf6939b1a646eb869c7ccf0f7a4)
bump version to 1.3.3.3
Ticket #47750 - Creating a glue fails if one above level is a conflict or missing

Description: Poring changes made to 1.2.11 branch to newer versions.
1) Enabiling cache lock in cache_is_in_cache and cache_has_otherref.
2) Removing unused field new_entry_in_cache from "struct _modify_context".

(cherry picked from commit 5ae13072330e9a769a5949b2e8a91085b38ac4e1)
Ticket #47907 - ldclt: assertion failure with -e "add,counteach" -e "object=<ldif file>,rdn=uid:test[A=INCRNNOLOOP(0;24

Bug Description: In case createMissingNodes is called from doAddEntry,
LDAP handle is unbound which makes the following operation such as
ldap_add fail since the handle is already released.

Fix Description: Rempoving ldap_unbind_ext from createMissingNodes.

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)

https://fedorahosted.org/389/ticket/47907
(cherry picked from commit 685607f63d52d54e8bd094bb0694986484a91e34)
Ticket #47908 - 389-ds 1.3.3.0 does not adjust cipher suite configuration on upgrade, breaks itself and pki-server

Description:
In the given cipher list:
  nsSSL3Ciphers: +rsa_fips_3des_sha,+rsa_fips_des_sha,+rsa_3des_sha,
   +rsa_rc4_128_md5,+rsa_des_sha,+rsa_rc2_40_md5,+rsa_rc4_40_md5,
   +fortezza
there were 2 issues.
1) An old cipher suite name rsa_des_sha was not correctly mapped
   to the name supported by NSS (TLS_RSA_WITH_DES_CBC_SHA) in the
   mapping table. And the unsupported cipher name was not gracefully
   skipped but returned an error.  This patch fixes the mapped name
   and the behaviour so that it skips the unknown/unsupported cipher.
2) A cipher "fortezza" is deprecated.  It's now skipped with the
   proper warning message.

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)

https://fedorahosted.org/389/ticket/47908
(cherry picked from commit 83a6ceb556e769f0d0a201f4a3d783ae3915c6bc)
Ticket 47900 - Adding an entry with an invalid password as rootDN is incorrectly rejected

Bug Description:  Root DN and password administrators should bypass all password
                  restrictions and syntax checks, but on ADD operations the password
                  checks were still be applied to root/password admins.

Fix Description:  Do not check the password syntax if the bind DN is a rootDN/password admin.

https://fedorahosted.org/389/ticket/47900

Reviewed by: nhosoi(Thanks!)

(cherry picked from commit 50820f80c2da853c29962485b5e9806e68d5aece)
Ticket #47838 - harden the list of ciphers available by default (phase 2)

Description:
1) By default (i.e., no explicit allowWeakCipher set in cn=encryption,cn=config),
   allowWeakCipher is on for user specified cipher list
   allowWeakCipher is off for "+all" and "default"
2) Fixed enabled allowWeakCipher (explicitly set "on" to it) is
   applied to "+all" and "default".
3) If an invalid value is set to allowWeakCipher, this message is
   logged in the error log and set it to the default value.
     SSL alert: The value of allowWeakCipher "poor" in cn=encryption,
     cn=config is invalid. Ignoring it and set it to default.

https://fedorahosted.org/389/ticket/47838

Reviewed by tbordaz@redhat.com (Thank you, Thierry!)

(cherry picked from commit c6febe325a1b5a0e4f7e7e59bcc076c9e4a3b825)
Ticket 47838 - CI test: adjusted test cases based on the phase 2 fixes for ticket 47838

https://fedorahosted.org/389/ticket/47838
(cherry picked from commit c6c73e674ecf79fc7404758f90f4837f04bdbed0)
Ticket #47880 - provide enabled ciphers as search result

Description: Implemented getEnabledCiphers, with which
  ldapsearch -b "cn=encryption,cn=config" nsSSLEnabledCiphers
returns enabled cipher list.  Example of returned enabled cipher
  dn: cn=encryption,cn=config
  nsSSLEnabledCiphers: TLS_RSA_WITH_RC4_128_MD5::RC4::MD5::128
  nsSSLEnabledCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5::3DES::MD5::192

https://fedorahosted.org/389/ticket/47880

Reviewed by mreynolds@redhat.com (Thank you, Mark!)

(cherry picked from commit c675243e018a89291760161998944c04ea04b12f)
Ticket 47880 - CI test: added test cases for ticket 47880

Description: Ticket #47880 - provide enabled ciphers as search result

https://fedorahosted.org/389/ticket/47880
(cherry picked from commit ce7378990855abe1a5b52cd4fbe78ffc33365dcb)
bump version to 1.3.3.4
Ticket #47892 - coverity defects found in 1.3.3.x

Description: fixing compiler warnings reported by covscan on 1.3.3.4.
https://fedorahosted.org/389/ticket/47892#comment:8

Reviewed by mreynolds@redhat.com (Thank you, Mark!!)

(cherry picked from commit afc8b06f9e9cc045906d6d6fb64fe5d5f9d7c3d5)
Ticket 47900 - Server fails to start if password admin is set

Bug Description:  The server will crash at startup if the password admin is set.

Fix Description:  When creating a password policy for the pblock, which we do
                  for add and modifiy operations, make sure the server is fully
                  up and running before searching backends for password admins.

                  Also, allow passwordAdminDN to be deleted from the cn=config.

https://fedorahosted.org/389/ticket/47900

Reviewed by: nhosoi(Thanks!)

(cherry picked from commit 4711de687174d6e5dd7b2c04782b62dc1cb90a6e)
Ticket 47918 - result of dna_dn_is_shared_config is incorrectly used

Bug Description:  dna_load_shared_servers() is called for all entries,
                  except the config entries

Fix Description:   revert the logic of the result of dna_dn_is_shared_config()

https://fedorahosted.org/389/ticket/47918

Reviewed by: Mark, Thanks
ticket 47916 plugin logging parameter only triggers result logging

Fix: evaluate global plugin logging param, when setting logging flag for plugins

Reviewed by: Noriko, Thanks
https://fedorahosted.org/389/ticket/47916