From 28f421f1fe326846b43fb2950c2d4ab868f06b76 Mon Sep 17 00:00:00 2001

From: Noriko Hosoi <nhosoi@redhat.com>

Date: Wed, 7 Jan 2015 12:58:32 -0800

Subject: [PATCH 295/305] Ticket #47880 - provide enabled ciphers as search

 result

Description: Implemented getEnabledCiphers, with which

  ldapsearch -b "cn=encryption,cn=config" nsSSLEnabledCiphers

returns enabled cipher list.  Example of returned enabled cipher

  dn: cn=encryption,cn=config

  nsSSLEnabledCiphers: TLS_RSA_WITH_RC4_128_MD5::RC4::MD5::128

  nsSSLEnabledCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5::3DES::MD5::192

Back-ported commit c675243e018a89291760161998944c04ea04b12f

https://fedorahosted.org/389/ticket/47880

(cherry picked from commit 8550aaf90870e75b78bb6f393f9fd4aedb68d612)

---

 ldap/servers/slapd/fedse.c | 14 +++++++++++++-

 ldap/servers/slapd/ssl.c   | 42 +++++++++++++++++++++++++++++++++++++++++-

 2 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/ldap/servers/slapd/fedse.c b/ldap/servers/slapd/fedse.c

index f8c95ce..6a8b6e6 100644

--- a/ldap/servers/slapd/fedse.c

+++ b/ldap/servers/slapd/fedse.c

@@ -75,6 +75,7 @@

 #endif  /* _WIN32 */

 extern char ** getSupportedCiphers();

+extern char ** getEnabledCiphers();

 /* Note: These DNs are no need to be normalized */

 static const char *internal_entries[] =

@@ -1693,11 +1694,12 @@ search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter

     struct berval           *vals[2];

     struct berval           val;

     char ** cipherList = getSupportedCiphers(); /*Get the string array of supported ciphers here */

+    char ** enabledCipherList = getEnabledCiphers(); /*Get the string array of enabled ciphers here */

     vals[0] = &val;

     vals[1] = NULL;

     attrlist_delete ( &entry->e_attrs, "nsSSLSupportedCiphers");

-    while (*cipherList) /* iterarate thru each of them and add to the attr value */

+    while (cipherList && *cipherList) /* iterarate thru each of them and add to the attr value */

     {

         char *cipher = *cipherList;

         val.bv_val = (char* ) cipher;

@@ -1706,6 +1708,16 @@ search_encryption( Slapi_PBlock *pb, Slapi_Entry *entry, Slapi_Entry *entryAfter

         cipherList++;

     }

+    attrlist_delete ( &entry->e_attrs, "nsSSLEnabledCiphers");

+	while (enabledCipherList && *enabledCipherList) /* iterarate thru each of them and add to the attr value */

+	{

+	    char *cipher = *enabledCipherList;

+	    val.bv_val = (char* ) cipher;

+	    val.bv_len = strlen ( val.bv_val );

+	    attrlist_merge ( &entry->e_attrs, "nsSSLEnabledCiphers", vals);

+	    enabledCipherList++;

+	}

+

     return SLAPI_DSE_CALLBACK_OK;

 }

diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c

index 23fa620..c30ebd6 100644

--- a/ldap/servers/slapd/ssl.c

+++ b/ldap/servers/slapd/ssl.c

@@ -128,6 +128,7 @@ static char * configDN = "cn=encryption,cn=config";

 static char **cipher_names = NULL;

+static char **enabled_cipher_names = NULL;

 typedef struct {

 	char *version;

     char *name;

@@ -220,7 +221,8 @@ slapd_SSL_warn(char *fmt, ...)

     va_end(args);

 }

-char ** getSupportedCiphers()

+char **

+getSupportedCiphers()

 {

 	SSLCipherSuiteInfo info;

 	char *sep = "::";

@@ -242,6 +244,44 @@ char ** getSupportedCiphers()

 	return cipher_names;

 }

+char **

+getEnabledCiphers()

+{

+    SSLCipherSuiteInfo info;

+    char *sep = "::";

+    int number_of_ciphers = 0;

+    int x;

+    int idx = 0;

+    PRBool enabled;

+

+    /* We have to wait until the SSL initialization is done. */

+    if (!slapd_ssl_listener_is_initialized()) {

+        return NULL;

+    }

+    if ((enabled_cipher_names == NULL)) {

+        for (x = 0; _conf_ciphers[x].name; x++) {

+            SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);

+            if (enabled) {

+                number_of_ciphers++;

+            }

+        }

+        enabled_cipher_names = (char **)slapi_ch_calloc((number_of_ciphers + 1), sizeof(char *));

+        for (x = 0; _conf_ciphers[x].name; x++) {

+            SSL_CipherPrefGetDefault(_conf_ciphers[x].num, &enabled);

+            if (enabled) {

+                SSL_GetCipherSuiteInfo((PRUint16)_conf_ciphers[x].num,&info,sizeof(info));

+                enabled_cipher_names[idx++] = PR_smprintf("%s%s%s%s%s%s%d",

+                        _conf_ciphers[x].name,sep,

+                        info.symCipherName,sep,

+                        info.macAlgorithmName,sep,

+                        info.symKeyBits);

+            }

+        }

+    }

+

+    return enabled_cipher_names;

+}

+

 static PRBool

 cipher_check_fips(int idx, char ***suplist, char ***unsuplist)

 {

-- 

1.9.3