Ticket #47838 - harden the list of ciphers available by default

Description:
Directory Server used to maintain the supported cipher suite list.
This patch abandons the table and retrieve the list dynamically
from NSS using its API SSL_GetImplementedCiphers.

We still keeps a lookup table _lookup_cipher to find out a name
defined in NSS from the old cipher name for the backward compatibility.
E.g. "rc4" --> "SSL_CK_RC4_128_WITH_MD5".

Changes on the value of nsSSL3Ciphers:
. If "+all" is included in the value of nsSSL3Ciphers, enable all
ciphers first, then disable specified ciphers starting with "-".
Otherwise (without "+all"), disable all the ciphers first, then
enable specified ciphers starting with "+".
. Introduced a keyword "default" for nsSSL3Ciphers.  If the config
attribute nsSSL3Ciphers does not exist, the value is empty or the
value is "default", the default cipher set is enabled.

The enabled ciphers are logged in the error log as follows:
 [..] - SSL alert: Configured NSS Ciphers
 [..] - SSL alert:   TLS_RSA_WITH_AES_128_GCM_SHA256: enabled
 [..] - SSL alert:   TLS_RSA_WITH_AES_128_CBC_SHA: enabled

If specified ciphers are weak or very weak, the cipher is logged
with (WEAK CIPHER) or (MUST BE DISABLED) as follows:
 [..] - SSL alert: Configured NSS Ciphers
 [..] - SSL alert:   TLS_DHE_DSS_WITH_DES_CBC_SHA: disabled, (WEAK CIPHER)
 [..] - SSL alert:   TLS_RSA_WITH_NULL_SHA: disabled, (MUST BE DISABLED)

To log all the available ciphers, set log level to CONFIG
(SLAPI_LOG_CONFIG).  Then, all the ciphers are logged.

See also http://directory.fedoraproject.org/wiki/NSS_Ciphers

https://fedorahosted.org/389/ticket/47838

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)
Ticket 47838 - CI test: add test case for ticket 47838

Description: harden the list of ciphers available by default
Test Case 1 - Check the ciphers availability for "+all"
Test Case 2 - Check the ciphers availability for "+rsa_aes_128_sha,+rsa_aes_256_sha"
Test Case 3 - Check the ciphers availability for "-all"
Test Case 4 - Check no nssSSL3Chiphers (default setting)
Test Case 5 - Check default nssSSL3Chiphers (default setting)
Test Case 6 - Check nssSSL3Chiphers: +all,-rsa_rc4_128_md5
Test Case 7 - Check nssSSL3Chiphers: -all,+rsa_rc4_128_md5
Test Case 8 - Check no nssSSL3Chiphers (default setting) with no errorlog-level
Test Case 9 - Check nssSSL3Chiphers: long list using the NSS Cipher Suite name
Ticket #47838 - harden the list of ciphers available by default

Description: Fixed a compiler warning introduced by
commit 13c0d2f7b7850676042fe05c917a7d498135324f
Ticket 47869 - CI test: add test case for ticket 47869

Description:
On Master 1 and 2:
  Bind as Directory Manager.
  Search all specifying nscpEntryWsi in the attribute list.
  Check nscpEntryWsi is returned.
On Master 1 and 2:
  Bind as Bind Entry.
  Search all specifying nscpEntryWsi in the attribute list.
  Check nscpEntryWsi is not returned.
On Master 1 and 2:
  Bind as anonymous.
  Search all specifying nscpEntryWsi in the attribute list.
  Check nscpEntryWsi is not returned.
Ticket #47838 - harden the list of ciphers available by default

Description: Fixed a coverity issue introduced by
commit 13c0d2f7b7850676042fe05c917a7d498135324f

Coverity 12734 - Uninitialized scalar variable
Ticket #47574 - start dirsrv after ntpd

Description:
1) Adding a dependency on ntpd.service to systemd (systemd.group.in).
2) Set "# chkconfig: - 59 73" to initcript.  Start priority 59 is one
   greater than ntpd's; stop priofity 73 is one less than ntpd's.

https://fedorahosted.org/389/ticket/47574

Reviewed and commented by rmeggins@redhat.com (Thank you, Rich!!)
Ticket 47872 - Filter AND with only one clause should be optimized

Bug Description:  If the filter id of the form "(&(attr=value))" it is not detected
			that the filtertest can by bypassed like in "(attr=value)"

Fix Description:   Check if an AND filter has only one component and this component is not
			another complex filter. To make this work, the check if the filter
			attribute is a subtyp also had to be applied earlier

https://fedorahosted.org/389/ticket/47872

Reviewed by: RichM, thanks
Ticket #47874 - Performance degradation with scope ONE after some load

Bug Description: Backend has a bit to indicate "should not bypass
the filter test".  It's set if one of the search results is ALLID
in idl_intersection.  Once the flag is set, it's never been unset.
It makes the following one level searches slow down.

Fix Description: Introduced slapi_be_unset_flag and unset the bit
at the end of every search.

https://fedorahosted.org/389/ticket/47874

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)
Ticket 47446 - logconv.pl memory continually grows

Bug Description:  Running logconv.pl without any special options
                  continually consumes more memory.

Fix Description:  The last fix introduced the use of regex matches which
                  caused the value of $1 to become undefined.  When using
                  all of the logconv cmd line switches, many undefined
                  variable warnings were printed.  This fix saves the value
                  of $1 in a local variable so that it it not undefined by
                  the use of subsequent regex matches.

https://fedorahosted.org/389/ticket/47446

Reviewed by: mreynolds (Thanks!)
Ticket #47875 - dirsrv not running with old openldap

Description: AC_SUBST(ldap_lib_ldif) was missing from configure.ac
for @ldap_lib_dir@.

https://fedorahosted.org/389/ticket/47875

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)
Ticket #47875 - dirsrv not running with old openldap

Automatically generated files:
  aclocal.m4, config.guess, config.sub, configure

https://fedorahosted.org/389/ticket/47875
Ticket #47875 - dirsrv not running with old openldap

Description: Changing the function of AC_CHECK_LIB from ldif_open
to _init so that regardless of the contents of the library, it's
linked to the server if it exists.

https://fedorahosted.org/389/ticket/47875

Reviewed by rmeggins@redhat.com (Thank you, Rich!!)
Ticket #47875 - dirsrv not running with old openldap

Description: Automatically generated files by autogen.sh.
Revert "Ticket #47875 - dirsrv not running with old openldap"

This reverts commit 0ae55bcd61497c2fa7aaade40fe4ff6c91216325.