Bug 651977 - turn off ssl2 for java servers (server.xml) - patch 2

git-svn-id: svn+ssh://svn.fedorahosted.org/svn/pki/trunk@1583 c9f7a03b-bd48-0410-a16d-cbbf54688b0b

5 files changed, 30 insertions, 7 deletions

diff --git a/pki/base/common/src/com/netscape/cmscore/ldapconn/LdapJssSSLSocketFactory.java b/pki/base/common/src/com/netscape/cmscore/ldapconn/LdapJssSSLSocketFactory.java
index a662b84cd..b9f7d78eb 100644
--- a/pki/base/common/src/com/netscape/cmscore/ldapconn/LdapJssSSLSocketFactory.java
+++ b/pki/base/common/src/com/netscape/cmscore/ldapconn/LdapJssSSLSocketFactory.java
@@ -46,8 +46,12 @@ public class LdapJssSSLSocketFactory implements LDAPSSLSocketFactoryExt {
         SSLSocket s = null;
 
         try {
+            SSLSocket.enableSSL2Default(false);
             s = new SSLSocket(host, port);
             s.setUseClientMode(true);
+            s.enableSSL2(false);
+            s.enableSSL2Default(false);
+            s.enableV2CompatibleHello(false);
 
             SSLHandshakeCompletedListener listener = null;
 
diff --git a/pki/base/common/src/com/netscape/cmscore/security/JssSubsystem.java b/pki/base/common/src/com/netscape/cmscore/security/JssSubsystem.java
index 08615264e..cf63a770b 100644
--- a/pki/base/common/src/com/netscape/cmscore/security/JssSubsystem.java
+++ b/pki/base/common/src/com/netscape/cmscore/security/JssSubsystem.java
@@ -131,6 +131,7 @@ public final class JssSubsystem implements ICryptoSubsystem {
     static {
 
         /* set ssl cipher string names. */
+        /* disallowing SSL2 ciphers to be turned on
         mCipherNames.put(Constants.PR_SSL2_RC4_128_WITH_MD5,
             Integer.valueOf(SSLSocket.SSL2_RC4_128_WITH_MD5));
         mCipherNames.put(Constants.PR_SSL2_RC4_128_EXPORT40_WITH_MD5,
@@ -143,6 +144,7 @@ public final class JssSubsystem implements ICryptoSubsystem {
             Integer.valueOf(SSLSocket.SSL2_DES_64_CBC_WITH_MD5));
         mCipherNames.put(Constants.PR_SSL2_DES_192_EDE3_CBC_WITH_MD5,
             Integer.valueOf(SSLSocket.SSL2_DES_192_EDE3_CBC_WITH_MD5));
+        */
         mCipherNames.put(Constants.PR_SSL3_RSA_WITH_NULL_MD5,
             Integer.valueOf(SSLSocket.SSL3_RSA_WITH_NULL_MD5));
         mCipherNames.put(Constants.PR_SSL3_RSA_EXPORT_WITH_RC4_40_MD5,
@@ -389,6 +391,7 @@ public final class JssSubsystem implements ICryptoSubsystem {
                 if (sslcipher != null) {
                     String msg = "setting ssl cipher " + cipher;
 
+                    CMS.debug("JSSSubsystem: initSSL(): "+msg);
                     log(ILogger.LL_INFO, msg);
                     if (Debug.ON)
                         Debug.trace(msg);
diff --git a/pki/base/console/src/com/netscape/admin/certsrv/connection/JSSConnection.java b/pki/base/console/src/com/netscape/admin/certsrv/connection/JSSConnection.java
index bc9b8dd94..27292b3d9 100644
--- a/pki/base/console/src/com/netscape/admin/certsrv/connection/JSSConnection.java
+++ b/pki/base/console/src/com/netscape/admin/certsrv/connection/JSSConnection.java
@@ -98,15 +98,23 @@ public class JSSConnection implements IConnection, SSLCertificateApprovalCallbac
 
         // SSLSocket needs to be set before getting an instance
         // to get the ciphers
+        SSLSocket.enableSSL2Default(false);
         SSLSocket.enableSSL3Default(true);
         int TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA = 0xC005; 
         int TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA = 0xC00A; 
 
         int ciphers[] = SSLSocket.getImplementedCipherSuites();
         for (int i = 0; ciphers != null && i < ciphers.length; i++) {
-           Debug.println("JSSConnection Debug: NSS Cipher Supported '0x" + 
-              Integer.toHexString(ciphers[i]) + "'"); 
-           SSLSocket.setCipherPreferenceDefault(ciphers[i], true);
+            // make sure SSLv2 ciphers are not enabled
+            if ((ciphers[i] & 0xfff0) !=0xff00) {
+                Debug.println("JSSConnection Debug: non-SSL2 NSS Cipher Supported '0x" + 
+                Integer.toHexString(ciphers[i]) + "'"); 
+                SSLSocket.setCipherPreferenceDefault(ciphers[i], true);
+            } else {
+                Debug.println("JSSConnection Debug: SSL2 (turned off) NSS Cipher Supported '0x" + 
+                Integer.toHexString(ciphers[i]) + "'"); 
+                SSLSocket.setCipherPreferenceDefault(ciphers[i], false);
+            }
 
            /* Enable ECC Cipher */
 
@@ -120,8 +128,11 @@ public class JSSConnection implements IConnection, SSLCertificateApprovalCallbac
            }
         }
 		s = new SSLSocket(host, port, null, 0, this, this);
-//        s.enableSSL3(true);
-//        s.enableSSL3Default(true);
+        s.enableSSL2(false);
+        s.enableSSL2Default(false);
+        s.enableV2CompatibleHello(false);
+        s.enableSSL3(true);
+        s.enableSSL3Default(true);
 
 		// Initialze Http Input and Output Streams
 		httpIn = s.getInputStream();
diff --git a/pki/base/silent/src/http/HTTPClient.java b/pki/base/silent/src/http/HTTPClient.java
index 4db3f4d18..049b1440a 100644
--- a/pki/base/silent/src/http/HTTPClient.java
+++ b/pki/base/silent/src/http/HTTPClient.java
@@ -120,6 +120,7 @@ public class HTTPClient implements SSLCertificateApprovalCallback
 			socket.enableSSL3(true);
 			socket.enableSSL2(false);
 			socket.enableSSL2Default(false);
+            socket.enableV2CompatibleHello(false);
 		}
 		catch(Exception e)
 		{
diff --git a/pki/base/util/src/com/netscape/cmsutil/http/JssSSLSocketFactory.java b/pki/base/util/src/com/netscape/cmsutil/http/JssSSLSocketFactory.java
index 91cf9ca43..e24fbb0aa 100644
--- a/pki/base/util/src/com/netscape/cmsutil/http/JssSSLSocketFactory.java
+++ b/pki/base/util/src/com/netscape/cmsutil/http/JssSSLSocketFactory.java
@@ -60,15 +60,16 @@ public class JssSSLSocketFactory implements ISocketFactory {
         for (i = SSLSocket.SSL2_RC4_128_WITH_MD5;
             i <= SSLSocket.SSL2_RC2_128_CBC_EXPORT40_WITH_MD5; ++i) {
             try {
-                SSLSocket.setCipherPreferenceDefault(i, true);
+                SSLSocket.setCipherPreferenceDefault(i, false);
             } catch( SocketException e) {
             }
         }
+
         //skip SSL_EN_IDEA_128_EDE3_CBC_WITH_MD5
         for (i = SSLSocket.SSL2_DES_64_CBC_WITH_MD5;
             i <= SSLSocket.SSL2_DES_192_EDE3_CBC_WITH_MD5; ++i) {
             try {
-                SSLSocket.setCipherPreferenceDefault(i, true);
+                SSLSocket.setCipherPreferenceDefault(i, false);
             } catch( SocketException e) {
             }
         }
@@ -94,6 +95,9 @@ public class JssSSLSocketFactory implements ISocketFactory {
             s = new SSLSocket(host, port, null, 0, certApprovalCallback,
               clientCertCallback);
             s.setUseClientMode(true);
+            s.enableSSL2(false);
+            s.enableSSL2Default(false);
+            s.enableV2CompatibleHello(false);
 
             SSLHandshakeCompletedListener listener = null;