CP-311259: Use Tls_policy to configure cipher suites

Signed-off-by: Lin Liu <lin.liu01@citrix.com>

Author: Lin Liu

ocaml/libs/stunnel/stunnel.ml

@@ -222,9 +222,9 @@ let config_file ?(accept = None) config host port =
          )
        ; [Printf.sprintf "connect=%s:%d" host port]
        ; [
-           "sslVersion = TLSv1.2"
-         ; "ciphers = " ^ Constants.good_ciphersuites
-         ; "curve = secp384r1"
+           "sslVersion = " ^ Tls_policy.Openssl.default_version
+         ; "ciphers = " ^ Tls_policy.Openssl.default_ciphers
+         ; "curve = " ^ Tls_policy.Openssl.default_curve
          ]
        ; ( match config with
          | None ->

ocaml/nbd/src/main.ml

@@ -92,8 +92,8 @@ let init_tls_get_server_ctx ~certfile =
   let certfile = require_str "certfile" certfile in
   Some
     (Nbd_unix.TlsServer
-       (Nbd_unix.init_tls_get_ctx ~curve:"secp384r1" ~certfile
-          ~ciphersuites:Constants.good_ciphersuites ()
+       (Nbd_unix.init_tls_get_ctx ~curve:Tls_policy.Openssl.default_curve
+          ~certfile ~ciphersuites:Tls_policy.Openssl.default_ciphers ()
        )
     )
 

ocaml/xapi-consts/constants.ml

@@ -429,10 +429,6 @@ let gencert = ref "/opt/xensource/libexec/gencert"
 
 let openssl_path = ref "/usr/bin/openssl"
 
-let good_ciphersuites =
-  String.concat ":"
-    ["ECDHE-RSA-AES256-GCM-SHA384"; "ECDHE-RSA-AES128-GCM-SHA256"]
-
 let verify_certificates_path = "/var/xapi/verify-certificates"
 
 let python3_path = "/usr/bin/python3"

ocaml/xapi/extauth_plugin_ADwinbind.ml

@@ -952,6 +952,9 @@ let config_winbind_daemon domain_info =
         ; "tls trust system cas = yes"
         ; "tls verify peer = ca_and_name_if_available"
         ; tls_ca
+        ; Printf.sprintf "tls ca directories = %s" certs_dir
+        ; Printf.sprintf "tls priority = %s"
+            (Tls_policy.Gnutls.default_policy ())
         ; Printf.sprintf "winbind scan trusted domains = %s"
             scan_trusted_domains
         ; "winbind use krb5 enterprise principals = yes"

ocaml/xapi/sparse_dd_wrapper.ml

@@ -122,7 +122,7 @@ let dd_internal progress_cb base prezeroed verify_cert ?(proto = None) infile
                     ; "-size"
                     ; Int64.to_string size
                     ; "-good-ciphersuites"
-                    ; Constants.good_ciphersuites
+                    ; Tls_policy.Openssl.default_ciphers
                     ]
                   ; ( if prezeroed then
                         ["-prezeroed"]

ocaml/xapi/xapi_stunnel_server.ml

@@ -52,10 +52,10 @@ end = struct
       let open Printf in
       let cipher_options =
         [
-          sprintf "ciphers = %s" Constants.good_ciphersuites
-        ; "curve = secp384r1"
-        ; "options = CIPHER_SERVER_PREFERENCE"
-        ; "sslVersion = TLSv1.2"
+          sprintf "ciphers = %s" Tls_policy.Openssl.default_ciphers
+        ; "curve = " ^ Tls_policy.Openssl.default_curve
+        ; "options = " ^ Tls_policy.Openssl.default_server_preference
+        ; "sslVersion = " ^ Tls_policy.Openssl.default_version
         ]
       in
       [