From 60f66dfaa0f652f0f9702b1496c742901e05111c Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Nov 16 2017 18:29:28 +0000
Subject: Ticket 49454 - SSL Client Authentication breaks in FIPS mode


Bug Description:  Replication using SSL Client Auth breaks when FIPS
                  is enabled.  This is because FIPS mode changes the
                  internal certificate token name.

Fix Description:  If FIPS is enabled grab the token name from the internal
                  slot instead of using the default hardcoded internal
                  token name.

https://pagure.io/389-ds-base/issue/49454

Reviewed by: firstyear(Thanks!)

(cherry picked from commit 6e794a8eff213d49c933f781006e234984160db2)

---

diff --git a/ldap/servers/slapd/proto-slap.h b/ldap/servers/slapd/proto-slap.h
index 4a30def..3b7ab53 100644
--- a/ldap/servers/slapd/proto-slap.h
+++ b/ldap/servers/slapd/proto-slap.h
@@ -1130,6 +1130,7 @@ PRBool slapd_pk11_DoesMechanism(PK11SlotInfo *slot, CK_MECHANISM_TYPE type);
 PK11SymKey *slapd_pk11_PubUnwrapSymKeyWithFlagsPerm(SECKEYPrivateKey *wrappingKey, SECItem *wrappedKey, CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS flags, PRBool isPerm);
 PK11SymKey *slapd_pk11_TokenKeyGenWithFlags(PK11SlotInfo *slot, CK_MECHANISM_TYPE type, SECItem *param, int keySize, SECItem *keyid, CK_FLAGS opFlags, PK11AttrFlags attrFlags, void *wincx);
 CK_MECHANISM_TYPE slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECItem *pwitem);
+char *slapd_PK11_GetTokenName(PK11SlotInfo *slot);
 
 /*
  * start_tls_extop.c
diff --git a/ldap/servers/slapd/security_wrappers.c b/ldap/servers/slapd/security_wrappers.c
index bec28d2..41fe036 100644
--- a/ldap/servers/slapd/security_wrappers.c
+++ b/ldap/servers/slapd/security_wrappers.c
@@ -401,3 +401,9 @@ slapd_PK11_GetPBECryptoMechanism(SECAlgorithmID *algid, SECItem **params, SECIte
 {
     return PK11_GetPBECryptoMechanism(algid, params, pwitem);
 }
+
+char *
+slapd_PK11_GetTokenName(PK11SlotInfo *slot)
+{
+    return PK11_GetTokenName(slot);
+}
diff --git a/ldap/servers/slapd/ssl.c b/ldap/servers/slapd/ssl.c
index efe32d5..52ac7ea 100644
--- a/ldap/servers/slapd/ssl.c
+++ b/ldap/servers/slapd/ssl.c
@@ -2365,13 +2365,23 @@ slapd_SSL_client_auth(LDAP *ld)
                 ssltoken = slapi_entry_attr_get_charptr(entry, "nsssltoken");
                 if (ssltoken && personality) {
                     if (!PL_strcasecmp(ssltoken, "internal") ||
-                        !PL_strcasecmp(ssltoken, "internal (software)")) {
-
-                        /* Translate config internal name to more
-                          * readable form.  Certificate name is just
-                          * the personality for internal tokens.
-                          */
-                        token = slapi_ch_strdup(internalTokenName);
+                        !PL_strcasecmp(ssltoken, "internal (software)"))
+                    {
+                        if ( slapd_pk11_isFIPS() ) {
+                            /*
+                             * FIPS mode changes the internal token name, so we need to
+                             * grab the new token name from the internal slot.
+                             */
+                            PK11SlotInfo *slot = slapd_pk11_getInternalSlot();
+                            token = slapi_ch_strdup(slapd_PK11_GetTokenName(slot));
+                            PK11_FreeSlot(slot);
+                        } else {
+                            /*
+                             * Translate config internal name to more readable form.
+                             * Certificate name is just the personality for internal tokens.
+                             */
+                            token = slapi_ch_strdup(internalTokenName);
+                        }
 #if defined(USE_OPENLDAP)
                         /* openldap needs tokenname:certnick */
                         PR_snprintf(cert_name, sizeof(cert_name), "%s:%s", token, personality);