Request 1217 (accepted)

Overview

Request 1217 (accepted)

Check in mod_nss

Created by vanmeeuwen over 8 years ago
In state accepted

Submit mod_nss

Submit package Kolab:14 / mod_nss to package Kolab:16:Enterprise / mod_nss

mod_nss.spec Added

@@ -0,0 +1,428 @@
+%if 0%{?opensuse_bs}
+#!BuildIgnore:  vim-enhanced
+%endif
+
+%{!?_httpd_apxs:       %{expand: %%global _httpd_apxs       %%{_sbindir}/apxs}}
+%{!?_httpd_confdir:    %{expand: %%global _httpd_confdir    %%{_sysconfdir}/httpd/conf.d}}
+# /etc/httpd/conf.d with httpd < 2.4 and defined as /etc/httpd/conf.modules.d with httpd >= 2.4
+%{!?_httpd_modconfdir: %{expand: %%global _httpd_modconfdir %%{_sysconfdir}/httpd/conf.d}}
+%{!?_httpd_mmn: %{expand: %%global _httpd_mmn %%(cat %{_includedir}/httpd/.mmn 2>/dev/null || echo 0-0)}}
+
+Name: mod_nss
+Version: 1.0.11
+Release: 4%{?dist}
+Summary: SSL/TLS module for the Apache HTTP server
+Group: System Environment/Daemons
+License: ASL 2.0
+URL: https://fedorahosted.org/mod_nss/
+Source: http://fedorahosted.org/released/mod_nss/%{name}-%{version}.tar.gz
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+BuildRequires: nspr-devel >= 4.9.2, nss-devel >= 3.14.0.0
+BuildRequires: httpd-devel, apr-devel, apr-util-devel
+BuildRequires: pkgconfig
+BuildRequires: autoconf
+BuildRequires: automake
+BuildRequires: libtool
+# Needed for make check
+BuildRequires: openssl
+BuildRequires: python-nose
+BuildRequires: python-requests
+BuildRequires: gcc-c++
+Requires: httpd-mmn = %{_httpd_mmn}
+Requires(post): httpd, nss-tools
+Requires: nss%{?_isa} >= 3.14.0.0
+# Although the following change reverses the desire of Bugzilla Bug #601939, it
+# was provided to suppress the dangling symlink warning of Bugzilla Bug #906089
+# as exposed via 'rpmlint'.
+Requires: %{_libdir}/libnssckbi.so
+
+# Change configuration to not conflict with mod_ssl
+Patch1: mod_nss-conf.patch
+# Generate a password-less NSS database
+Patch2: mod_nss-gencert.patch
+Patch3: mod_nss-parallel-build.patch
+# One manual change made to upstream patch to replace
+# nss_engine_cipher.c:292 with nss_engine_cipher.c:291
+Patch4: 0001-Fix-logical-AND-support-in-OpenSSL-cipher-compatibil.patch
+Patch5: 0002-Fix-make-check.patch
+
+%description
+The mod_nss module provides strong cryptography for the Apache Web
+server via the Secure Sockets Layer (SSL) and Transport Layer
+Security (TLS) protocols using the Network Security Services (NSS)
+security library.
+
+%prep
+%setup -q
+%patch1 -p1 -b .conf
+%patch2 -p1 -b .gencert
+%patch3 -p1
+%patch4 -p1
+%patch5 -p1
+
+# Touch expression parser sources to prevent regenerating it
+touch nss_expr_*.[chyl]
+
+%build
+
+CFLAGS="$RPM_OPT_FLAGS"
+APXS=%{_httpd_apxs}
+
+export CFLAGS APXS
+
+NSPR_INCLUDE_DIR=`/usr/bin/pkg-config --variable=includedir nspr`
+NSPR_LIB_DIR=`/usr/bin/pkg-config --variable=libdir nspr`
+
+NSS_INCLUDE_DIR=`/usr/bin/pkg-config --variable=includedir nss`
+NSS_LIB_DIR=`/usr/bin/pkg-config --variable=libdir nss`
+
+NSS_BIN=`/usr/bin/pkg-config --variable=exec_prefix nss`
+
+autoreconf -i -f
+%configure \
+    --with-nss-lib=$NSS_LIB_DIR \
+    --with-nss-inc=$NSS_INCLUDE_DIR \
+    --with-nspr-lib=$NSPR_LIB_DIR \
+    --with-nspr-inc=$NSPR_INCLUDE_DIR \
+    --with-apr-config --enable-ecc
+
+make %{?_smp_mflags} all
+
+%install
+# The install target of the Makefile isn't used because that uses apxs
+# which tries to enable the module in the build host httpd instead of in
+# the build root.
+rm -rf $RPM_BUILD_ROOT
+
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf
+mkdir -p $RPM_BUILD_ROOT%{_httpd_confdir}
+mkdir -p $RPM_BUILD_ROOT%{_libdir}/httpd/modules
+mkdir -p $RPM_BUILD_ROOT%{_libexecdir}
+mkdir -p $RPM_BUILD_ROOT%{_sbindir}
+mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/httpd/alias
+mkdir -p $RPM_BUILD_ROOT%{_mandir}/man8
+
+%if "%{_httpd_modconfdir}" != "%{_httpd_confdir}"
+# httpd >= 2.4.x
+mkdir -p $RPM_BUILD_ROOT%{_httpd_modconfdir}
+sed -n /^LoadModule/p nss.conf > 10-nss.conf
+sed -i /^LoadModule/d nss.conf
+install -m 644 10-nss.conf $RPM_BUILD_ROOT%{_httpd_modconfdir}
+%endif
+
+install -m 644 gencert.8 $RPM_BUILD_ROOT%{_mandir}/man8/
+install -m 644 nss_pcache.8 $RPM_BUILD_ROOT%{_mandir}/man8/
+
+install -m 644 nss.conf $RPM_BUILD_ROOT%{_httpd_confdir}
+
+install -m 755 .libs/libmodnss.so $RPM_BUILD_ROOT%{_libdir}/httpd/modules/
+install -m 755 nss_pcache $RPM_BUILD_ROOT%{_libexecdir}/
+# Provide a compatibility link to prevent disruption of customized deployments.
+#
+#     NOTE:  This link may be deprecated in a future release of 'mod_nss'.
+#
+ln -s %{_libexecdir}/nss_pcache $RPM_BUILD_ROOT%{_sbindir}/nss_pcache
+install -m 755 gencert $RPM_BUILD_ROOT%{_sbindir}/
+ln -s ../../../%{_libdir}/libnssckbi.so $RPM_BUILD_ROOT%{_sysconfdir}/httpd/alias/
+touch $RPM_BUILD_ROOT%{_sysconfdir}/httpd/alias/secmod.db
+touch $RPM_BUILD_ROOT%{_sysconfdir}/httpd/alias/cert8.db
+touch $RPM_BUILD_ROOT%{_sysconfdir}/httpd/alias/key3.db
+touch $RPM_BUILD_ROOT%{_sysconfdir}/httpd/alias/install.log
+
+perl -pi -e "s:$NSS_LIB_DIR:$NSS_BIN:" $RPM_BUILD_ROOT%{_sbindir}/gencert
+
+%check
+timeout 300 make check || :
+
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+%post
+umask 077
+
+if [ "$1" -eq 1 ] ; then
+    if [ ! -e %{_sysconfdir}/httpd/alias/key3.db ]; then
+        %{_sbindir}/gencert %{_sysconfdir}/httpd/alias > %{_sysconfdir}/httpd/alias/install.log 2>&1
+        echo ""
+        echo "%{name} certificate database generated."
+        echo ""
+    fi
+
+    # Make sure that the database ownership is setup properly.
+    /bin/find %{_sysconfdir}/httpd/alias -user root -name "*.db" -exec /bin/chgrp apache {} \;
+    /bin/find %{_sysconfdir}/httpd/alias -user root -name "*.db" -exec /bin/chmod g+r {} \;
+fi
+
+%files
+%defattr(-,root,root,-)
+%doc README LICENSE docs/mod_nss.html
+%{_mandir}/man8/*
+%config(noreplace) %{_httpd_confdir}/nss.conf
+%if "%{_httpd_modconfdir}" != "%{_httpd_confdir}"
+%config(noreplace) %{_httpd_modconfdir}/10-nss.conf
+%endif
+%{_libdir}/httpd/modules/libmodnss.so
+%dir %{_sysconfdir}/httpd/alias/
+%ghost %attr(0640,root,apache) %config(noreplace) %{_sysconfdir}/httpd/alias/secmod.db
+%ghost %attr(0640,root,apache) %config(noreplace) %{_sysconfdir}/httpd/alias/cert8.db
+%ghost %attr(0640,root,apache) %config(noreplace) %{_sysconfdir}/httpd/alias/key3.db
+%ghost %config(noreplace) %{_sysconfdir}/httpd/alias/install.log
+%{_sysconfdir}/httpd/alias/libnssckbi.so
+%{_libexecdir}/nss_pcache
+%{_sbindir}/nss_pcache
+%{_sbindir}/gencert
+
+%changelog
+* Mon Aug 17 2015 Rob Crittenden <rcritten@redhat.com> - 1.0.11-4
+- Fix logical AND in cipher string parsing CVE-2015-3277
+  (#1243518)
+- Add missing BuildRequires and some other changes so that
+  make check passes
+
+* Sun Mar  1 2015 Peter Robinson <pbrobinson@fedoraproject.org> 1.0.11-3
+- Enable make check
+
+* Fri Feb 27 2015 Rob Crittenden <rcritten@redhat.com> - 1.0.11-2
+- Fix parallel build issue (#1196222)
+
+* Tue Dec  2 2014 Rob Crittenden <rcritten@redhat.com> - 1.0.11-1
+- Rebase to upstream mod_nss-1.0.11
+
+* Fri Oct 17 2014 Rob Crittenden <rcritten@redhat.com> - 1.0.10-1
+- Rebase to upstream mod_nss-1.0.10
+- Changed the URL and Source directives to point to the fedorahosted
+  site.
+
+* Thu Aug 28 2014 Rob Crittenden <rcritten@redhat.com> - 1.0.9-2
+- Add explicit BuildRequires for autoconf, automake and libtool
+
+* Wed Aug 27 2014 Rob Crittenden <rcritten@redhat.com> - 1.0.9-1
+- Rebase to upstream mod_nss-1.0.9
+
+* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.8-31
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.8-30
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Thu Jan 23 2014 Joe Orton <jorton@redhat.com> - 1.0.8-29
+- fix _httpd_mmn expansion in absence of httpd-devel
+
+* Tue Dec  3 2013 Rob Crittenden <rcritten@redhat.com> - 1.0.8-28
+- Resolves: CVE-2013-4566, bz #1036940
+- [mod_nss-nssverifyclient.patch]
+- Bugzilla Bug #1037722 - CVE-2013-4566 mod_nss: incorrect handling of
+  NSSVerifyClient in directory context [fedora-all] (rcritten)
+- Bugzilla Bug #1037761 - mod_nss does not respect `NSSVerifyClient` in
+  Directory (rcritten)
+- [mod_nss-usecases.patch]
+- Bugzilla Bug #1036940 - [DOC] making mod_nss work in FIPS mode (mharmsen)
+
+* Tue Nov 12 2013 Joe Orton <jorton@redhat.com> - 1.0.8-26
+- [mod_nss-SSLEngine-off.patch]
+- Bugzilla Bug #1029043 - Implicit SSLEngine for 443 port breaks mod_nss
+  configuration (jorton)
+- [mod_nss-unused-filter_ctx.patch]
+- Bugzilla Bug #1023237 - Remove unused variable 'filter_ctx' (mharmsen)
+
+* Tue Nov 12 2013 Tomas Hoger <thoger@redhat.com> - 1.0.8-25
+- [mod_nss-docs-fix.patch]
+- Bugzilla Bug #1025316 - mod_nss: documentation formatting fixes
+
+* Mon Oct 21 2013 Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-24
+- Bugzilla Bug #961471 - Port Downstream Patches Upstream (mharmsen)
+- Add '--enable-ecc' option to %%configure line under %%build section of
+  this spec file (mharmsen)
+- Bumped version build/runtime requirements for NSPR and NSS (mharmsen)
+- [mod_nss-PK11_ListCerts_2.patch]
+- Bugzilla Bug #767802 - PK11_ListCerts called to retrieve all user
+  certificates for every server (rcritten)
+- [mod_nss-array_overrun.patch]
+- Bugzilla Bug #1022717 - overrunning array when executing nss_pcache
+  (rcritten)
+- [mod_nss-clientauth.patch]
+- Bugzilla Bug #1017675 - mod_nss: FakeBasicAuth authentication bypass
+  [fedora-all] (rcritten)
+- [mod_nss-no_shutdown_if_not_init_2.patch]
+- Bugzilla Bug #1022722 - File descriptor leak after "service httpd reload"
+  or httpd doesn't reload (rrelyea)
+- [mod_nss-proxyvariables.patch]
+- Bugzilla Bug #1022726 - mod_nss insists on Required value NSSCipherSuite
+  not set. (mharmsen)
+- [mod_nss-tlsv1_1.patch]
+- Bugzilla Bug #979798 - current nss support TLS 1.1 so mod_nss should pick
+  it up (mharmsen)
+- Bugzilla Bug #979718 - mod_nss documentation should mention TLS 1.1
+  (mharmsen)
+- [mod_nss-sslmultiproxy_2.patch]
+- Fixes Bugzilla Bug #1021469 - [RFE] Support ability to share mod_proxy with
+  other SSL providers (jorton, mharmsen, nkinder, & rcritten)
+
+* Tue Jul 30 2013 Joe Orton <jorton@redhat.com> - 1.0.8-23
+- add dependency on httpd-mmn
+
+* Wed Jul  3 2013 Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-22
+- Moved 'nss_pcache' from %%sbindir to %%libexecdir
+  (provided compatibility link)
+
+* Tue Jul  2 2013 Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-21.1
+- rpmlint mod_nss.spec
+  0 packages and 1 specfiles checked; 0 errors, 0 warnings.
+- rpmlint mod_nss-1.0.8-21.1 (SRPM)
+  W: spelling-error %%description -l en_US nss -> ass, nos, nus
+  1 packages and 0 specfiles checked; 0 errors, 1 warnings.
+- rpmlint mod_nss-1.0.8-21.1 (RPM)
+  W: spelling-error %%description -l en_US nss -> ass, nos, nus
+  E: non-readable /etc/httpd/alias/cert8.db 0640L
+  E: non-readable /etc/httpd/alias/secmod.db 0640L
+  E: non-readable /etc/httpd/alias/key3.db 0640L
+  1 packages and 0 specfiles checked; 3 errors, 1 warnings.
+- rpmlint mod_nss-debuginfo-1.0.8-21.1 (RPM)
+  W: spelling-error Summary(en_US) nss -> ass, nos, nus
+  W: spelling-error %%description -l en_US nss -> ass, nos, nus
+  1 packages and 0 specfiles checked; 0 errors, 2 warnings.
+
+* Tue Jun 25 2013 Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-21
+- Bugzilla Bug #884115 - Package mod_nss-1.0.8-18.1.el7 failed RHEL7 RPMdiff
+  testing
+- Bugzilla Bug #906082 - mod_nss requires manpages for gencert and nss_pcache
+- Bugzilla Bug #906089 - Fix dangling symlinks in mod_nss
+- Bugzilla Bug #906097 - Correct RPM Parse Warning in mod_nss.spec
+- Bugzilla Bug #948601 - Man page scan results for mod_nss
+
+* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.8-20.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Fri Jul 20 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.8-19.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Mon Jun 18 2012 Joe Orton <jorton@redhat.com> - 1.0.8-18.1
+- fix build for RHEL7
+
+* Fri Jun 15 2012 Rob Crittenden <rcritten@redhat.com> - 1.0.8-18
+- Actually apply the patch to use memmove in place of memcpy since the
+  buffers can overlap (#669118)
+
+* Tue Jun 12 2012 Nathan Kinder <nkinder@redhat.com> - 1.0.8-17
+- Port mod_nss to work with httpd 2.4
+
+* Mon Apr 23 2012 Joe Orton <jorton@redhat.com> - 1.0.8-16
+- packaging fixes/updates (#803072)
+
+* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.8-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
+* Mon Mar  7 2011 Rob Crittenden <rcritten@redhat.com> - 1.0.8-14
+- Add Requires(post) for nss-tools, gencert needs it (#652007)
+
+* Wed Mar  2 2011 Rob Crittenden <rcritten@redhat.com> - 1.0.8-13
+- Lock around the pipe to nss_pcache for retrieving the token PIN
+  (#677701)
+
+* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.8-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Wed Jan 12 2011 Rob Crittenden <rcritten@redhat.com> - 1.0.8-11
+- Use memmove in place of memcpy since the buffers can overlap (#669118)
+
+* Wed Sep 29 2010 jkeating - 1.0.8-10
+- Rebuilt for gcc bug 634757
+
+* Thu Sep 23 2010 Rob Crittenden <rcritten@redhat.com> - 1.0.8-9
+- Revert mod_nss-wouldblock patch
+- Reset NSPR error before calling PR_Read(). This should fix looping
+  in #620856
+
+* Fri Sep 17 2010 Rob Crittenden <rcritten@redhat.com> - 1.0.8-8
+- Fix hang when handling large POST under some conditions (#620856)
+
+* Tue Jun 22 2010 Rob Crittenden <rcritten@redhat.com> - 1.0.8-7
+- Remove file Requires on libnssckbi.so (#601939)
+
+* Fri May 14 2010 Rob Crittenden <rcritten@redhat.com> - 1.0.8-6
+- Ignore SIGHUP in nss_pcache (#591889).
+
+* Thu May 13 2010 Rob Crittenden <rcritten@redhat.com> - 1.0.8-5
+- Use remote hostname set by mod_proxy to compare to CN in peer cert (#591224)
+
+* Thu Mar 18 2010 Rob Crittenden <rcritten@redhat.com> - 1.0.8-4
+- Patch to add configuration options for new NSS negotiation API (#574187)
+- Add (pre) for Requires on httpd so we can be sure the user and group are
+  already available
+- Add file Requires on libnssckbi.so so symlink can't fail
+- Use _sysconfdir macro instead of /etc
+- Set minimum level of NSS to 3.12.6
+
+* Mon Jan 25 2010 Rob Crittenden <rcritten@redhat.com> - 1.0.8-3
+- The location of libnssckbi moved from /lib[64] to /usr/lib[64] (556744)
+
+* Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Mon Mar  2 2009 Rob Crittenden <rcritten@redhat.com> - 1.0.8-1
+- Update to 1.0.8
+- Add patch that fixes NSPR layer bug
+
+* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0.7-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Mon Aug 11 2008 Tom "spot" Callaway <tcallawa@redhat.com> - 1.0.7-10
+- fix license tag
+
+* Mon Jul 28 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.7-9
+- rebuild to bump NVR
+
+* Mon Jul 14 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.7-8
+- Don't force module de-init during the configuration stage (453508)
+
+* Thu Jul 10 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.7-7
+- Don't inherit the MP cache in multi-threaded mode (454701)
+- Don't initialize NSS in each child if SSL isn't configured
+
+* Wed Jul  2 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.7-6
+- Update the patch for FIPS to include fixes for nss_pcache, enforce
+  the security policy and properly initialize the FIPS token.
+
+* Mon Jun 30 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.7-5
+- Include patch to fix NSSFIPS (446851)
+
+* Mon Apr 28 2008 Rob Crittenden <rcritten@redhat.com> - 1.0.7-4
+- Apply patch so that mod_nss calls NSS_Init() after Apache forks a child
+  and not before. This is in response to a change in the NSS softtokn code
+  and should have always been done this way. (444348)
+- The location of libnssckbi moved from /usr/lib[64] to /lib[64]
+- The NSS database needs to be readable by apache since we need to use it
+  after the root priviledges are dropped.
+
+* Tue Feb 19 2008 Fedora Release Engineering <rel-eng@fedoraproject.org> - 1.0.7-3
+- Autorebuild for GCC 4.3
+
+* Thu Oct 18 2007 Rob Crittenden <rcritten@redhat.com> 1.0.7-2
+- Register functions needed by mod_proxy if mod_ssl is not loaded.
+
+* Fri Jun  1 2007 Rob Crittenden <rcritten@redhat.com> 1.0.7-1
+- Update to 1.0.7
+- Remove Requires for nss and nspr since those are handled automatically
+  by versioned libraries
+- Updated URL and Source to reference directory.fedoraproject.org
+
+* Mon Apr  9 2007 Rob Crittenden <rcritten@redhat.com> 1.0.6-2
+- Patch to properly detect the Apache model and set up NSS appropriately
+- Patch to punt if a bad password is encountered
+- Patch to fix crash when password.conf is malformatted
+- Don't enable ECC support as NSS doesn't have it enabled (3.11.4-0.7)
+
+* Mon Oct 23 2006 Rob Crittenden <rcritten@redhat.com> 1.0.6-1
+- Update to 1.0.6
+
+* Fri Aug 04 2006 Rob Crittenden <rcritten@redhat.com> 1.0.3-4
+- Include LogLevel warn in nss.conf and use separate log files
+
+* Fri Aug 04 2006 Rob Crittenden <rcritten@redhat.com> 1.0.3-3
+- Need to initialize ECC certificate and key variables
+
+* Fri Aug 04 2006 Jarod Wilson <jwilson@redhat.com> 1.0.3-2
+- Use %%ghost for db files and install.log
+
+* Tue Jun 20 2006 Rob Crittenden <rcritten@redhat.com> 1.0.3-1
+- Initial build

0001-Fix-logical-AND-support-in-OpenSSL-cipher-compatibil.patch Added

@@ -0,0 +1,875 @@
+From 63eb1f4c6ef8c1bb68afbfc5fba8762d50c1a0a8 Mon Sep 17 00:00:00 2001
+From: Rob Crittenden <rcritten@redhat.com>
+Date: Wed, 17 Jun 2015 11:12:40 -0400
+Subject: [PATCH] Fix logical AND support in OpenSSL cipher compatibility
+
+The + operator didn't perform properly at all. It is supposed
+to be used either for logical AND to combine two cipher suites
+or to move ciphers to the end of the list. Given that NSS
+doesn't support cipher ordering + is a no-op in this case.
+
+Also add in a slew of missing aliases: kRSA, aRSA, EDH,
+ECDH, kECDHe, kECDHr, kEECDH, aECDH, aNULL, AESGCM, AES128,
+AES256, CAMELLIA, CAMELLIA128, CAMELLIA256.
+
+Fix the definition of TLSv1.2.
+
+Define some ciphers as unimplemented in NSS.
+
+Renumber the mask/protocol/strength values to ensure uniqueness.
+
+Replace the existing cipher test to one that compares the output
+of the NSS-generated cipher string with the openssl generated
+string.  There are a lot of restrictions on the openssl string
+since so much isn't either implemented or needed for mod_nss.
+
+Add a new openssl-compatible cipher request test to the server
+tests.
+---
+ nss_engine_cipher.c    | 196 +++++++++++++++++++++++++++++++-------
+ nss_engine_cipher.h    |  61 ++++++------
+ test/createinstance.sh |   1 +
+ test/suite1.tmpl       |   6 ++
+ test/test.py           |   6 ++
+ test/test_cipher.py    | 254 ++++++++++++++++++++++++++++++++-----------------
+ test_cipher.c          |  32 +++++--
+ 7 files changed, 401 insertions(+), 155 deletions(-)
+
+diff --git a/nss_engine_cipher.c b/nss_engine_cipher.c
+index 9110d57..37ef338 100644
+--- a/nss_engine_cipher.c
++++ b/nss_engine_cipher.c
+@@ -29,10 +29,11 @@ cipher_properties ciphers_def[ciphernum] =
+     {"rsa_rc4_128_md5", TLS_RSA_WITH_RC4_128_MD5, "RC4-MD5", SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5, SSLV3, SSL_MEDIUM, 128, 128},
+     {"rsa_rc4_128_sha", TLS_RSA_WITH_RC4_128_SHA, "RC4-SHA", SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA1, SSLV3, SSL_MEDIUM, 128, 128},
+     {"rsa_rc2_40_md5", TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5, "EXP-RC2-CBC-MD5", SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5, SSLV3, SSL_EXPORT40, 40, 128},
++    /* TLS_RSA_EXPORT_WITH_DES40_CBC_SHA not implemented 0x0008 */
+     {"rsa_des_sha", TLS_RSA_WITH_DES_CBC_SHA, "DES-CBC-SHA", SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1, SSLV3, SSL_LOW, 56, 56},
+-    {"rsa_3des_sha", TLS_RSA_WITH_3DES_EDE_CBC_SHA, "DES-CBC3-SHA", SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSLV3, SSL_HIGH, 112, 168},
++    {"rsa_3des_sha", TLS_RSA_WITH_3DES_EDE_CBC_SHA, "DES-CBC3-SHA", SSL_kRSA|SSL_aRSA|SSL_3DES|SSL_SHA1, SSLV3, SSL_HIGH, 168, 168},
+     {"rsa_aes_128_sha", TLS_RSA_WITH_AES_128_CBC_SHA, "AES128-SHA", SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA1, TLSV1, SSL_HIGH, 128, 128},
+-    {"rsa_aes_256_sha", TLS_RSA_WITH_AES_256_CBC_SHA, "AES256-SHA256", SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA1, TLSV1, SSL_HIGH, 256, 256},
++    {"rsa_aes_256_sha", TLS_RSA_WITH_AES_256_CBC_SHA, "AES256-SHA", SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA1, TLSV1, SSL_HIGH, 256, 256},
+     {"null_sha_256", TLS_RSA_WITH_NULL_SHA256, "NULL-SHA256", SSL_kRSA|SSL_aRSA|SSL_eNULL|SSL_SHA256, TLSV1_2, SSL_STRONG_NONE, 0, 0},
+     {"aes_128_sha_256", TLS_RSA_WITH_AES_128_CBC_SHA256, "AES128-SHA256", SSL_kRSA|SSL_aRSA|SSL_AES128|SSL_SHA256, TLSV1_2, SSL_HIGH, 128, 128},
+     {"aes_256_sha_256", TLS_RSA_WITH_AES_256_CBC_SHA256, "AES256-SHA256", SSL_kRSA|SSL_aRSA|SSL_AES256|SSL_SHA256, TLSV1_2, SSL_HIGH, 256, 256},
+@@ -73,9 +74,25 @@ cipher_properties ciphers_def[ciphernum] =
+     {"ecdhe_rsa_aes_128_sha_256", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, "ECDHE-RSA-AES128-SHA256", SSL_kEECDH|SSL_aRSA|SSL_AES128|SSL_SHA256, TLSV1_2, SSL_HIGH, 128, 128},
+     {"ecdhe_ecdsa_aes_128_gcm_sha_256", TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, "ECDHE-ECDSA-AES128-GCM-SHA256", SSL_kEECDH|SSL_aECDSA|SSL_AES128GCM|SSL_AEAD, TLSV1_2, SSL_HIGH, 128, 128},
+     {"ecdhe_rsa_aes_128_gcm_sha_256", TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, "ECDHE-RSA-AES128-GCM-SHA256", SSL_kEECDH|SSL_aRSA|SSL_AES128GCM|SSL_AEAD, TLSV1_2, SSL_HIGH, 128, 128},
++    /* TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 is not implemented */
++    /* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 is not implemented */
++    /* TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 is not implemented */
++    /* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 is not implemented */
+ #endif
+ };
+ 
++
++/* Some ciphers are optionally enabled in OpenSSL. For safety sake assume
++ * they are not available.
++ */
++static int skip_ciphers = 4;
++static int ciphers_not_in_openssl[] = {
++    SSL_RSA_FIPS_WITH_DES_CBC_SHA,
++    SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,
++    TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,
++    TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,
++};
++
+ static int parse_nss_ciphers(server_rec *s, char *ciphers, PRBool cipher_list[ciphernum]);
+ static int parse_openssl_ciphers(server_rec *s, char *ciphers, PRBool cipher_list[ciphernum]);
+ 
+@@ -107,19 +124,48 @@ int nss_parse_ciphers(server_rec *s, char *ciphers, PRBool cipher_list[ciphernum
+         rv = parse_nss_ciphers(s, ciphers, cipher_list);
+     } else {
+         rv = parse_openssl_ciphers(s, ciphers, cipher_list);
+-        if (0 == countciphers(cipher_list, SSLV3|TLSV1|TLSV1_2)) {
++        if (rv == 0 && 0 == countciphers(cipher_list, SSLV3|TLSV1|TLSV1_2)) {
+             rv = parse_nss_ciphers(s, ciphers, cipher_list);
+         }
+     }
++    if (0 == countciphers(cipher_list, SSLV3|TLSV1|TLSV1_2)) {
++        ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
++                     "no cipher match");
++    }
+ 
+     return rv;
+ }
+ 
+ 
++/* Given a set of ciphers perform a given action on the indexed value.
++ * 
++ * This is needed because the + action doesn't do anything in the NSS
++ * context. In OpenSSL it will re-order the cipher list.
++ */
++static int set_cipher_value(PRBool cipher_list[ciphernum], int index, int action)
++{
++    int i;
++
++    for (i = 0; i < skip_ciphers; i++) {
++        if (ciphers_def[index].num == ciphers_not_in_openssl[i]) {
++            cipher_list[index] = -1;
++            return;
++        }
++    }
++
++    if (cipher_list[index] == -1) /* cipher is disabled */
++        return;
++    else
++        cipher_list[index] = action;
++}
++
++
+ static int parse_openssl_ciphers(server_rec *s, char *ciphers, PRBool cipher_list[ciphernum])
+ {
+     char * cipher;
+     int i, action;
++    PRBool merge = PR_FALSE;
++    PRBool found = PR_FALSE;
+ 
+     cipher = ciphers;
+     while (ciphers && (strlen(ciphers)))
+@@ -127,12 +173,12 @@ static int parse_openssl_ciphers(server_rec *s, char *ciphers, PRBool cipher_lis
+         while ((*cipher) && (isspace(*cipher)))
+             ++cipher;
+ 
+-        action = 1;
++        action = 1; /* default to enable */
+         switch(*cipher)
+         {
+             case '+': /* Add something */
+-                action = 1;
+-                cipher++;
++                /* Cipher ordering is not supported in NSS */
++                return 0;
+                 break;
+             case '-': /* Subtract something */
+                 action = 0;
+@@ -149,34 +195,58 @@ static int parse_openssl_ciphers(server_rec *s, char *ciphers, PRBool cipher_lis
+ 
+         if ((ciphers = strchr(cipher, ':'))) {
+             *ciphers++ = '\0';
++            merge = PR_FALSE;
++            found = PR_FALSE;
+         }
+ 
+         if (!strcmp(cipher, "ALL")) {
++            found = PR_TRUE;
+             for (i=0; i<ciphernum; i++) {
+                 if (!(ciphers_def[i].attr & SSL_eNULL))
+-                    if (cipher_list[i] != -1)
+-                        cipher_list[i] = action;
++                    set_cipher_value(cipher_list, i, action);
+             }
+         } else if (!strcmp(cipher, "COMPLEMENTOFALL")) {
++            found = PR_TRUE;
+             for (i=0; i<ciphernum; i++) {
+                 if ((ciphers_def[i].attr & SSL_eNULL))
+-                    if (cipher_list[i] != -1)
+-                        cipher_list[i] = action;
++                    set_cipher_value(cipher_list, i, action);
+             }
+         } else if (!strcmp(cipher, "DEFAULT")) {
++            found = PR_TRUE;
+             for (i=0; i < ciphernum; i++) {
+                 if (cipher_list[i] != -1)
+                     SSL_CipherPrefGetDefault(ciphers_def[i].num,
+                                              &cipher_list[i]);
+             }
++        } else if (!strcmp(cipher, "COMPLEMENTOFDEFAULT")) {
++            found = PR_TRUE;
++            /* no-op. In OpenSSL this is the ADH ciphers */
++        } else if (!strcmp(cipher, "@STRENGTH")) {
++            /* No cipher ordering in NSS */
++            ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
++                         "Cipher ordering is not supported in NSS");
++            return -1;
+         } else {
+             int mask = 0;
+             int strength = 0;
+             int protocol = 0;
+             char *c;
++            int i;
++            PRBool candidate_list[ciphernum];
++            PRBool temp_list[ciphernum];
++
++            for (i = 0; i < ciphernum; i++) {
++                candidate_list[i] = 1;
++            }
+ 
+             c = cipher;
+             while (c && (strlen(c))) {
++                mask = 0;
++                strength = 0;
++                protocol = 0;
++                for (i = 0; i < ciphernum; i++) {
++                    temp_list[i] = 0;
++                }
+ 
+                 if ((c = strchr(cipher, '+'))) {
+                     *c++ = '\0';
+@@ -184,12 +254,44 @@ static int parse_openssl_ciphers(server_rec *s, char *ciphers, PRBool cipher_lis
+ 
+                 if (!strcmp(cipher, "RSA")) {
+                     mask |= SSL_RSA;
++                } else if (!strcmp(cipher, "kRSA")) {
++                    mask |= SSL_kRSA;
++                } else if (!strcmp(cipher, "aRSA")) {
++                    mask |= SSL_aRSA;
+                 } else if (!strcmp(cipher, "EDH")) {
+                     mask |= SSL_EDH;
++#if 0
++                } else if (!strcmp(cipher, "ADH")) {
++                    mask |= SSL_ADH;
++#endif
++                } else if (!strcmp(cipher, "ECDH")) {
++                    mask |= SSL_ECDH;
++                } else if (!strcmp(cipher, "kECDHe")) {
++                    mask |= SSL_kECDHe;
++                } else if (!strcmp(cipher, "kECDHr")) {
++                    mask |= SSL_kECDHr;
++                } else if (!strcmp(cipher, "kEECDH")) {
++                    mask |= SSL_kEECDH;
++                } else if (!strcmp(cipher, "aECDH")) {
++                    mask |= SSL_aECDH;
+                 } else if ((!strcmp(cipher, "NULL")) || (!strcmp(cipher, "eNULL"))) {
+                     mask |= SSL_eNULL;
++                } else if (!strcmp(cipher, "aNULL")) {
++                    mask |= SSL_aNULL;
+                 } else if (!strcmp(cipher, "AES")) {
+                     mask |= SSL_AES;
++                } else if (!strcmp(cipher, "AESGCM")) {
++                    mask |= SSL_AES128GCM|SSL_AES256GCM;
++                } else if (!strcmp(cipher, "AES128")) {
++                    mask |= SSL_AES128|SSL_AES128GCM;
++                } else if (!strcmp(cipher, "AES256")) {
++                    mask |= SSL_AES256|SSL_AES256GCM;
++                } else if (!strcmp(cipher, "CAMELLIA")) {
++                    mask |= SSL_CAMELLIA128|SSL_CAMELLIA256;
++                } else if (!strcmp(cipher, "CAMELLIA128")) {
++                    mask |= SSL_CAMELLIA128;
++                } else if (!strcmp(cipher, "CAMELLIA256")) {
++                    mask |= SSL_CAMELLIA256;
+                 } else if (!strcmp(cipher, "3DES")) {
+                     mask |= SSL_3DES;
+                 } else if (!strcmp(cipher, "DES")) {
+@@ -210,7 +312,7 @@ static int parse_openssl_ciphers(server_rec *s, char *ciphers, PRBool cipher_lis
+                     protocol |= SSLV3;
+                 } else if (!strcmp(cipher, "TLSv1")) {
+                     protocol |= TLSV1;
+-                } else if (!strcmp(cipher, "TLSv12")) {
++                } else if (!strcmp(cipher, "TLSv1.2")) {
+                     protocol |= TLSV1_2;
+                 } else if (!strcmp(cipher, "HIGH")) {
+                     strength |= SSL_HIGH;
+@@ -229,32 +331,58 @@ static int parse_openssl_ciphers(server_rec *s, char *ciphers, PRBool cipher_lis
+                 if (c)
+                     cipher = c;
+ 
+-            } /* while */
+-
+-            /* If we have a mask, apply it. If not then perhaps they provided
+-             * a specific cipher to enable.
+-             */
+-            if (mask || strength || protocol)
+-                for (i=0; i<ciphernum; i++) {
+-                    if (((ciphers_def[i].attr & mask) ||
+-                     (ciphers_def[i].strength & strength) ||
+-                     (ciphers_def[i].version & protocol)) &&
+-                     (cipher_list[i] != -1)) {
+-                        /* Enable the NULL ciphers only if explicity
+-                         * requested */
+-                        if (ciphers_def[i].attr & SSL_eNULL) {
+-                            if (mask & SSL_eNULL)
+-                                cipher_list[i] = action;
+-                        } else
+-                            cipher_list[i] = action;
++                /* If we have a mask, apply it. If not then perhaps they
++                 * provided a specific cipher to enable.
++                 */
++                if (mask || strength || protocol) {
++                    merge = PR_TRUE;
++                    found = PR_TRUE;
++                    for (i=0; i<ciphernum; i++) {
++                        if (((ciphers_def[i].attr & mask) ||
++                         (ciphers_def[i].strength & strength) ||
++                         (ciphers_def[i].version & protocol)) &&
++                         (cipher_list[i] != -1)) {
++#if 0
++                            /* Enable the NULL ciphers only if explicity
++                             * requested */
++                            if (ciphers_def[i].attr & SSL_eNULL) {
++                                if (mask & SSL_eNULL)
++                                    temp_list[i] = 1;
++                            } else
++#endif
++                                temp_list[i] = 1;
++                            }
++                    }
++                    /* Merge the temp list into the candidate list */
++                    for (i=0; i<ciphernum; i++) {
++                        if (!(candidate_list[i] & temp_list[i])) {
++                            candidate_list[i] = 0;
++                        }
++                    }
++                } else if (!strcmp(cipher, "FIPS")) {
++                        SSLCipherSuiteInfo suite;
++                    for (i=0; i<ciphernum;i++) {
++                        if (SSL_GetCipherSuiteInfo(ciphers_def[i].num,
++                            &suite, sizeof suite) == SECSuccess) {
++                            if (suite.isFIPS)
++                                set_cipher_value(cipher_list, i, action);
++                        }
++                    }
++                } else {
++                    for (i=0; i<ciphernum; i++) {
++                        if (!strcmp(ciphers_def[i].openssl_name, cipher))
++                            set_cipher_value(cipher_list, i, action);
+                     }
+                 }
+-            else {
++            } /* while */
++            if (PR_TRUE == merge) {
++                /* Merge the candidate list into the cipher list */
+                 for (i=0; i<ciphernum; i++) {
+-                    if (!strcmp(ciphers_def[i].openssl_name, cipher) &&
+-                        cipher_list[i] != -1)
+-                        cipher_list[i] = action;
++                    if (candidate_list[i])
++                        set_cipher_value(cipher_list, i, action);
+                 }
++                merge = PR_FALSE;
++                found = PR_FALSE;
+             }
+         }
+ 
+@@ -262,6 +390,8 @@ static int parse_openssl_ciphers(server_rec *s, char *ciphers, PRBool cipher_lis
+             cipher = ciphers;
+ 
+     }
++    if (found && 0 == countciphers(cipher_list, SSLV3|TLSV1|TLSV1_2))
++        return 1; /* no matching ciphers */
+     return 0;
+ }
+ 
+diff --git a/nss_engine_cipher.h b/nss_engine_cipher.h
+index f0c12f1..2cd103b 100644
+--- a/nss_engine_cipher.h
++++ b/nss_engine_cipher.h
+@@ -29,27 +29,30 @@ typedef struct
+ } cipher_properties;
+ 
+ /* OpenSSL-compatible cipher attributes */
+-#define SSL_kRSA  0x00000001L
+-#define SSL_aRSA  0x00000002L
+-#define SSL_aDSS  0x00000004L
+-#define SSL_DSS   SSL_aDSS
+-#define SSL_eNULL 0x00000008L
+-#define SSL_DES   0x00000010L
+-#define SSL_3DES  0x00000020L
+-#define SSL_RC4   0x00000040L
+-#define SSL_RC2   0x00000080L
+-#define SSL_MD5   0x00000200L
+-#define SSL_SHA1  0x00000400L
+-#define SSL_SHA   SSL_SHA1
+-#define SSL_RSA   (SSL_kRSA|SSL_aRSA)
+-#define SSL_kEDH  0x00000800L
+-#define SSL_EDH   (SSL_kEDH)
+-#define SSL_aNULL 0x00001000L
+-#define SSL_kECDHe 0x00002000L
+-#define SSL_aECDH 0x00004000L
+-#define SSL_aECDSA 0x00008000L
+-#define SSL_kECDHr 0x00010000L
+-#define SSL_kEECDH 0x00020000L
++#define SSL_kRSA	0x00000001L
++#define SSL_aRSA	0x00000002L
++#define SSL_aDSS	0x00000004L
++#define SSL_DSS		SSL_aDSS
++#define SSL_eNULL	0x00000008L
++#define SSL_DES		0x00000010L
++#define SSL_3DES	0x00000020L
++#define SSL_RC4		0x00000040L
++#define SSL_RC2		0x00000080L
++#define SSL_MD5		0x00000200L
++#define SSL_SHA1	0x00000400L
++#define SSL_SHA		SSL_SHA1
++#define SSL_RSA		(SSL_kRSA)
++#define SSL_kEDH	0x00000800L
++#define SSL_EDH		(SSL_kEDH)
++#define SSL_aNULL	0x00001000L
++#define SSL_kECDHe	0x00002000L
++#define SSL_aECDH	0x00004000L
++#define SSL_aECDSA	0x00008000L
++#define SSL_kECDHr	0x00010000L
++#define SSL_kEECDH	0x00020000L
++#define SSL_ECDH	(SSL_kECDHe|SSL_kECDHr|SSL_kEECDH)
++#define SSL_EECDH	(SSL_kEECDH)
++#define SSL_ADH		(SSL_kEDH)
+ 
+ /* cipher strength */
+ #define SSL_STRONG_NONE   0x00000001L
+@@ -60,14 +63,14 @@ typedef struct
+ #define SSL_MEDIUM        0x00000020L
+ #define SSL_HIGH          0x00000040L
+ 
+-#define SSL_AES128        0x00004000L
+-#define SSL_AES256        0x00008000L
+-#define SSL_CAMELLIA128   0x00010000L
+-#define SSL_CAMELLIA256   0x00020000L
+-#define SSL_AES128GCM     0x00040000L
+-#define SSL_AES256GCM     0x00080000L
+-#define SSL_SHA256        0x00100000L
+-#define SSL_AEAD          0x00200000L
++#define SSL_AES128        0x00400000L
++#define SSL_AES256        0x00800000L
++#define SSL_CAMELLIA128   0x01000000L
++#define SSL_CAMELLIA256   0x02000000L
++#define SSL_AES128GCM     0x04000000L
++#define SSL_AES256GCM     0x08000000L
++#define SSL_SHA256        0x10000000L
++#define SSL_AEAD          0x20000000L
+ 
+ #define SSL_AES           (SSL_AES128|SSL_AES256|SSL_AES128GCM|SSL_AES256GCM)
+ #define SSL_CAMELLIA      (SSL_CAMELLIA128|SSL_CAMELLIA256)
+diff --git a/test/createinstance.sh b/test/createinstance.sh
+index c3b7260..9cdba62 100755
+--- a/test/createinstance.sh
++++ b/test/createinstance.sh
+@@ -25,6 +25,7 @@ mkdir lib
+ # Create the content
+ mkdir content/rc4_cipher
+ mkdir content/openssl_rc4_cipher
++mkdir content/openssl_aes_cipher
+ mkdir content/acl
+ mkdir content/protocolssl2
+ mkdir content/protocolssl3
+diff --git a/test/suite1.tmpl b/test/suite1.tmpl
+index eb2a16c..0f739a2 100644
+--- a/test/suite1.tmpl
++++ b/test/suite1.tmpl
+@@ -39,6 +39,12 @@ NSSUserName SSL_CLIENT_S_DN_UID
+     NSSCipherSuite RC4-SHA
+ </Location>
+ 
++<Location "/openssl_aes_cipher">
++    # In openssl equivalent of AES:-ECDH:-ADH:-PSK:-DH
++    # In NSS equivalent of AES:-ECDH
++    NSSCipherSuite AES+RSA
++</Location>
++
+ <Location "/acl/aclS01.html">
+     NSSOptions +StdEnvVars +CompatEnvVars +ExportCertData
+     NSSVerifyClient require
+diff --git a/test/test.py b/test/test.py
+index ee8d95b..23e093c 100644
+--- a/test/test.py
++++ b/test/test.py
+@@ -69,6 +69,12 @@ class test_suite1(Declarative):
+         ),
+ 
+         dict(
++            desc='server-side OpenSSL-style AES cipher check',
++            request=('/openssl_aes_cipher/', {'ciphers': 'AES128-SHA'}),
++            expected=200,
++        ),
++
++        dict(
+             desc='Basic client auth, no certificate',
+             request=('/acl/aclS01.html', {}),
+             expected=requests.exceptions.SSLError(),
+diff --git a/test/test_cipher.py b/test/test_cipher.py
+index 55989bd..a91f411 100644
+--- a/test/test_cipher.py
++++ b/test/test_cipher.py
+@@ -10,9 +10,50 @@ WITH_ECC=47
+ cwd = os.getcwd()
+ srcdir = os.path.dirname(cwd)
+ exe = "%s/test_cipher" % srcdir
++openssl = "/usr/bin/openssl"
+ 
+ ciphernum = 0
+ 
++CIPHERS_NOT_IN_NSS = ['ECDH-RSA-AES128-SHA256',
++                      'ECDH-ECDSA-AES128-GCM-SHA256',
++                      'ECDH-ECDSA-AES128-SHA256',
++                      'ECDH-RSA-AES128-GCM-SHA256',
++                      'EXP-DES-CBC-SHA',
++]
++
++def assert_equal_openssl(nss_ciphers, ossl_ciphers):
++    (nss, err, rc) = run([exe, "--o", nss_ciphers])
++    assert rc == 0
++    (ossl, err, rc) = run([openssl, "ciphers", ossl_ciphers])
++    assert rc == 0
++
++    nss_list = nss.strip().split(':')
++    nss_list.sort()
++
++    ossl_list = ossl.strip().split(':')
++    ossl_list = list(set(ossl_list))
++    ossl_list.sort()
++
++    # NSS doesn't support the SHA-384 ciphers, remove them from the OpenSSL
++    # output.
++    t = list()
++    for o in ossl_list:
++        if 'SHA384' in o:
++            continue
++        if o in CIPHERS_NOT_IN_NSS:
++            continue
++        t.append(o)
++    ossl_list = t
++
++    if len(nss_list) > len(ossl_list):
++        diff = set(nss_list) - set(ossl_list)
++    elif len(ossl_list) > len(nss_list):
++        diff = set(ossl_list) - set(nss_list)
++    else:
++        diff = ''
++
++    assert nss_list == ossl_list, '%r != %r. Difference %r' % (':'.join(nss_list), ':'.join(ossl_list), diff)
++
+ class test_ciphers(object):
+     @classmethod
+     def setUpClass(cls):
+@@ -20,131 +61,172 @@ class test_ciphers(object):
+         assert rc == 0
+         cls.ciphernum = int(out)
+ 
++    def test_RSA(self):
++        assert_equal_openssl("RSA", "RSA:-SSLv2:-SEED:-IDEA")
++
++    def test_kRSA(self):
++        assert_equal_openssl("kRSA", "kRSA:-SSLv2:-SEED:-IDEA")
++
++    def test_aRSA(self):
++        assert_equal_openssl("aRSA", "aRSA:-SSLv2:-SEED:-IDEA:-DH")
++
++    def test_EDH(self):
++        # No DH ciphers supported yet
++        (out, err, rc) = run([exe, "EDH"])
++        assert rc == 1
++
+     def test_RC4(self):
+-        (out, err, rc) = run([exe, "RC4"])
+-        assert rc == 0
+-        if self.ciphernum < WITH_ECC:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc4_56_sha')
+-        else:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc4_56_sha, ecdh_ecdsa_rc4_128_sha, ecdhe_ecdsa_rc4_128_sha, ecdh_rsa_128_sha, ecdhe_rsa_rc4_128_sha, ecdh_anon_rc4_128sha')
++        assert_equal_openssl("RC4", "RC4:-KRB5:-PSK:-ADH")
++
++    def test_RC2(self):
++        assert_equal_openssl("RC2", "RC2:-SSLv2:-KRB5")
+ 
+     def test_AES(self):
+-        (out, err, rc) = run([exe, "AES"])
+-        assert rc == 0
+-        if self.ciphernum < WITH_ECC:
+-            assert_equal(out, 'rsa_aes_128_sha, rsa_aes_256_sha, aes_128_sha_256, aes_256_sha_256, rsa_aes_128_gcm_sha_256')
+-        else:
+-            assert_equal(out, 'rsa_aes_128_sha, rsa_aes_256_sha, aes_128_sha_256, aes_256_sha_256, rsa_aes_128_gcm_sha_256, ecdh_ecdsa_rc4_128_sha, ecdh_ecdsa_3des_sha, ecdh_ecdsa_aes_128_sha, ecdh_ecdsa_aes_256_sha, ecdhe_ecdsa_rc4_128_sha, ecdhe_ecdsa_3des_sha, ecdhe_ecdsa_aes_128_sha, ecdhe_ecdsa_aes_256_sha, ecdh_rsa_128_sha, ecdh_rsa_3des_sha, ecdh_rsa_aes_128_sha, ecdh_rsa_aes_256_sha, ecdhe_rsa_aes_128_sha, ecdhe_rsa_aes_256_sha, ecdh_anon_aes_128_sha, ecdh_anon_aes_256_sha, ecdhe_ecdsa_aes_128_sha_256, ecdhe_rsa_aes_128_sha_256, ecdhe_ecdsa_aes_128_gcm_sha_256, ecdhe_rsa_aes_128_gcm_sha_256')
++        assert_equal_openssl("AES", "AES:-PSK:-ADH:-DSS:-DH")
+ 
++    def test_AESGCM(self):
++        assert_equal_openssl("AESGCM", "AESGCM:-PSK:-ADH:-DSS:-DH")
++
++    def test_AES128(self):
++        assert_equal_openssl("AES128", "AES128:-PSK:-ADH:-DSS:-DH")
++
++    def test_AES256(self):
++        assert_equal_openssl("AES256", "AES256:-PSK:-ADH:-DSS:-DH")
++
++    def test_CAMELLIA(self):
++        assert_equal_openssl("CAMELLIA", "CAMELLIA:-DH")
++
++    def test_CAMELLIA128(self):
++        assert_equal_openssl("CAMELLIA128", "CAMELLIA128:-DH")
++
++    def test_CAMELLIA256(self):
++        assert_equal_openssl("CAMELLIA256", "CAMELLIA256:-DH")
++
++    def test_3DES(self):
++        assert_equal_openssl("3DES", "3DES:-SSLv2:-PSK:-KRB5:-DH")
++
++    def test_DES(self):
++        assert_equal_openssl("DES", "DES:-SSLv2:-KRB5:-DH")
+ 
+     def test_ALL(self):
+-        (out, err, rc) = run([exe, "ALL"])
+-        assert rc == 0
+-        if self.ciphernum < WITH_ECC:
+-            'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc2_40_md5, rsa_des_sha, rsa_3des_sha, rsa_aes_128_sha, rsa_aes_256_sha, aes_128_sha_256, aes_256_sha_256, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, rsa_aes_128_gcm_sha_256'
+-        else:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc2_40_md5, rsa_des_sha, rsa_3des_sha, rsa_aes_128_sha, rsa_aes_256_sha, aes_128_sha_256, aes_256_sha_256, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, rsa_aes_128_gcm_sha_256, fips_3des_sha, fips_des_sha, ecdh_ecdsa_rc4_128_sha, ecdh_ecdsa_3des_sha, ecdh_ecdsa_aes_128_sha, ecdh_ecdsa_aes_256_sha, ecdhe_ecdsa_rc4_128_sha, ecdhe_ecdsa_3des_sha, ecdhe_ecdsa_aes_128_sha, ecdhe_ecdsa_aes_256_sha, ecdh_rsa_128_sha, ecdh_rsa_3des_sha, ecdh_rsa_aes_128_sha, ecdh_rsa_aes_256_sha, ecdhe_rsa_rc4_128_sha, ecdhe_rsa_3des_sha, ecdhe_rsa_aes_128_sha, ecdhe_rsa_aes_256_sha, ecdh_anon_rc4_128sha, ecdh_anon_3des_sha, ecdh_anon_aes_128_sha, ecdh_anon_aes_256_sha, ecdhe_ecdsa_aes_128_sha_256, ecdhe_rsa_aes_128_sha_256, ecdhe_ecdsa_aes_128_gcm_sha_256, ecdhe_rsa_aes_128_gcm_sha_256')
++        assert_equal_openssl("ALL", "ALL:-SSLv2:-KRB5:-ADH:-DH:-DSS:-PSK:-SEED:-IDEA")
+ 
+     def test_ALL_no_AES(self):
+-        (out, err, rc) = run([exe, "ALL:-AES"])
+-        assert rc == 0
+-        if self.ciphernum < WITH_ECC:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc2_40_md5, rsa_des_sha, rsa_3des_sha, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, fips_3des_sha, fips_des_sha')
+-        else:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc2_40_md5, rsa_des_sha, rsa_3des_sha, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, fips_3des_sha, fips_des_sha, ecdhe_rsa_rc4_128_sha, ecdhe_rsa_3des_sha, ecdh_anon_rc4_128sha, ecdh_anon_3des_sha')
++        assert_equal_openssl("ALL:-AES", "ALL:-AES:-SSLv2:-KRB5:-ADH:-DH:-DSS:-PSK:-SEED:-IDEA")
++
++    def test_COMPLEMENTOFALL(self):
++        assert_equal_openssl("COMPLEMENTOFALL", "COMPLEMENTOFALL")
++
++    # skipping DEFAULT as we use the NSS defaults
++    # skipping COMPLEMENTOFDEFAULT as these are all ADH ciphers
+ 
+     def test_SSLv3(self):
+-        (out, err, rc) = run([exe, "SSLv3"])
+-        assert rc == 0
+-        if self.ciphernum < WITH_ECC:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc2_40_md5, rsa_des_sha, rsa_3des_sha, rsa_aes_128_sha, rsa_aes_256_sha, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, fips_3des_sha, fips_des_sha')
+-        else:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc2_40_md5, rsa_des_sha, rsa_3des_sha, rsa_aes_128_sha, rsa_aes_256_sha, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, fips_3des_sha, fips_des_sha, ecdh_ecdsa_rc4_128_sha, ecdh_ecdsa_3des_sha, ecdh_ecdsa_aes_128_sha, ecdh_ecdsa_aes_256_sha, ecdhe_ecdsa_rc4_128_sha, ecdhe_ecdsa_3des_sha, ecdhe_ecdsa_aes_128_sha, ecdhe_ecdsa_aes_256_sha, ecdh_rsa_128_sha, ecdh_rsa_3des_sha, ecdh_rsa_aes_128_sha, ecdh_rsa_aes_256_sha, ecdhe_rsa_rc4_128_sha, ecdhe_rsa_3des_sha, ecdhe_rsa_aes_128_sha, ecdhe_rsa_aes_256_sha, ecdh_anon_rc4_128sha, ecdh_anon_3des_sha, ecdh_anon_aes_128_sha, ecdh_anon_aes_256_sha')
++        assert_equal_openssl("SSLv3", "SSLv3:-KRB5:-PSK:-ADH:-EDH:-SEED:-IDEA")
+ 
+     def test_SSLv3_equals_TLSv1(self):
+-        (out, err, rc) = run([exe, "SSLv3"])
+-        (out2, err2, rc2) = run([exe, "TLSv1"])
++        (nss, err, rc) = run([exe, "--o", "SSLv3"])
++        (nss2, err, rc2) = run([exe, "--o", "TLSv1"])
+         assert rc == 0
+         assert rc2 == 0
+-        assert_equal(out, out2)
++        assert_equal(nss, nss2)
+ 
+     def test_TLSv12(self):
+-        if self.ciphernum < WITH_ECC:
+-            raise nose.SkipTest('ECC disabled')
+-        (out, err, rc) = run([exe, "TLSv12"])
+-        assert rc == 0
+-        assert_equal(out, 'aes_128_sha_256, aes_256_sha_256, rsa_aes_128_gcm_sha_256, ecdhe_ecdsa_aes_128_sha_256, ecdhe_rsa_aes_128_sha_256, ecdhe_ecdsa_aes_128_gcm_sha_256, ecdhe_rsa_aes_128_gcm_sha_256')
++        assert_equal_openssl("TLSv1.2", "TLSv1.2:TLSv1.2:-ADH:-DH:-DSS")
+ 
+     def test_NULL(self):
+-        (out, err, rc) = run([exe, "NULL"])
+-        assert rc == 0
+-        if self.ciphernum < WITH_ECC:
+-            assert_equal(out, 'rsa_null_md5, rsa_null_sha, null_sha_256')
+-        else:
+-            assert_equal(out, 'rsa_null_md5, rsa_null_sha, null_sha_256, ecdh_ecdsa_null_sha, ecdhe_ecdsa_null_sha, ecdh_rsa_null_sha, ecdhe_rsa_null, ecdh_anon_null_sha')
++        assert_equal_openssl("NULL", "NULL")
+ 
+     def test_nss_rsa_rc4_128(self):
++        # Test NSS cipher parsing
+         (out, err, rc) = run([exe, "+rsa_rc4_128_md5,+rsa_rc4_128_sha"])
+         assert rc == 0
+         assert_equal(out, 'rsa_rc4_128_md5, rsa_rc4_128_sha')
+ 
+-    def test_openssl_cipher(self):
+-        (out, err, rc) = run([exe, "DES-CBC3-SHA"])
+-        assert rc == 0
+-        assert_equal(out, 'rsa_3des_sha')
++    def test_EXP(self):
++        assert_equal_openssl("EXP", "EXP:-SSLv2:-DH:-KRB5")
+ 
+-    def test_openssl_cipherlist(self):
+-        (out, err, rc) = run([exe, "DES-CBC3-SHA:RC4-SHA"])
+-        assert rc == 0
+-        assert_equal(out, 'rsa_rc4_128_sha, rsa_3des_sha')
++    def test_EXPORT(self):
++        assert_equal_openssl("EXPORT", "EXPORT:-SSLv2:-DH:-KRB5")
+ 
+-    def test_EXP(self):
+-        (out, err, rc) = run([exe, "EXP"])
+-        assert rc == 0
+-        assert_equal(out, 'rsa_rc4_40_md5, rsa_rc2_40_md5, rsa_des_56_sha, rsa_rc4_56_sha')
++    def test_EXPORT40(self):
++        assert_equal_openssl("EXPORT40", "EXPORT40:-SSLv2:-ADH:-DH:-KRB5")
+ 
+     def test_MD5(self):
+-        (out, err, rc) = run([exe, "MD5"])
+-        assert rc == 0
+-        assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc2_40_md5')
++        assert_equal_openssl("MD5", "MD5:-SSLv2:-DH:-KRB5")
+ 
+     def test_SHA(self):
+-        (out, err, rc) = run([exe, "SHA"])
+-        assert rc == 0
+-        if self.ciphernum < WITH_ECC:
+-            assert_equal(out, 'rsa_rc4_128_sha, rsa_des_sha, rsa_3des_sha, rsa_aes_128_sha, rsa_aes_256_sha, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, fips_3des_sha, fips_des_sha')
+-        else:
+-            assert_equal(out, 'rsa_rc4_128_sha, rsa_des_sha, rsa_3des_sha, rsa_aes_128_sha, rsa_aes_256_sha, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, fips_3des_sha, fips_des_sha, ecdh_ecdsa_rc4_128_sha, ecdh_ecdsa_3des_sha, ecdh_ecdsa_aes_128_sha, ecdh_ecdsa_aes_256_sha, ecdhe_ecdsa_rc4_128_sha, ecdhe_ecdsa_3des_sha, ecdhe_ecdsa_aes_128_sha, ecdhe_ecdsa_aes_256_sha, ecdh_rsa_128_sha, ecdh_rsa_3des_sha, ecdh_rsa_aes_128_sha, ecdh_rsa_aes_256_sha, ecdhe_rsa_rc4_128_sha, ecdhe_rsa_3des_sha, ecdhe_rsa_aes_128_sha, ecdhe_rsa_aes_256_sha, ecdh_anon_rc4_128sha, ecdh_anon_3des_sha, ecdh_anon_aes_128_sha, ecdh_anon_aes_256_sha')
++        assert_equal_openssl("SHA", "SHA:-SSLv2:-DH:-KRB5:-PSK:-IDEA:-SEED")
++
++    def test_HIGH(self):
++        assert_equal_openssl("HIGH", "HIGH:-SSLv2:-DH:-ADH:-KRB5:-PSK")
++
++    def test_MEDIUM(self):
++        assert_equal_openssl("MEDIUM", "MEDIUM:-SSLv2:-ADH:-KRB5:-PSK:-SEED:-IDEA")
++
++    def test_LOW(self):
++        assert_equal_openssl("LOW", "LOW:-SSLv2:-DH:-ADH:-KRB5")
+ 
+     def test_SHA256(self):
+-        (out, err, rc) = run([exe, "SHA256"])
+-        assert rc == 0
+-        if self.ciphernum < WITH_ECC:
+-            assert_equal(out, 'aes_128_sha_256, aes_256_sha_256')
+-        else:
+-            assert_equal(out, 'aes_128_sha_256, aes_256_sha_256, ecdhe_ecdsa_aes_128_sha_256, ecdhe_rsa_aes_128_sha_256')
++        assert_equal_openssl("SHA256", "SHA256:-ADH:-DSS:-DH")
+ 
+     def test_SHA_MD5_minus_AES(self):
+-        (out, err, rc) = run([exe, "SHA:MD5:-AES"])
+-        assert rc == 0
+-        if self.ciphernum < WITH_ECC:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc2_40_md5, rsa_des_sha, rsa_3des_sha, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, fips_3des_sha, fips_des_sha')
+-        else:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc2_40_md5, rsa_des_sha, rsa_3des_sha, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, fips_3des_sha, fips_des_sha, ecdhe_rsa_rc4_128_sha, ecdhe_rsa_3des_sha, ecdh_anon_rc4_128sha, ecdh_anon_3des_sha')
++        assert_equal_openssl("SHA:MD5:-AES", "SHA:MD5:-AES:-SSLv2:-DH:-DSS:-KRB5:-SEED:-PSK:-IDEA")
+ 
+-    def test_SHA_MD5_not_AES_HIGH(self):
+-        (out, err, rc) = run([exe, "!AES:SHA:MD5"])
+-        assert rc == 0
+-        if self.ciphernum < WITH_ECC:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc2_40_md5, rsa_des_sha, rsa_3des_sha, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, fips_3des_sha, fips_des_sha')
+-        else:
+-            assert_equal(out, 'rsa_rc4_40_md5, rsa_rc4_128_md5, rsa_rc4_128_sha, rsa_rc2_40_md5, rsa_des_sha, rsa_3des_sha, camelia_128_sha, rsa_des_56_sha, rsa_rc4_56_sha, camelia_256_sha, fips_3des_sha, fips_des_sha, ecdhe_rsa_rc4_128_sha, ecdhe_rsa_3des_sha, ecdh_anon_rc4_128sha, ecdh_anon_3des_sha')
++    def test_SHA_MD5_not_AES(self):
++        assert_equal_openssl("!AES:SHA:MD5", "!AES:SHA:MD5:-SSLv2:-DH:-KRB5:-DSS:-SEED:-PSK:-IDEA")
++
++    def test_aECDH(self):
++        assert_equal_openssl("aECDH", "aECDH")
++
++    def test_kECDHe(self):
++        assert_equal_openssl("kECDHe", "kECDHe")
++
++    def test_kECDHr(self):
++        assert_equal_openssl("kECDHr", "kECDHr")
++
++    def test_kEECDH(self):
++        assert_equal_openssl("kEECDH", "kEECDH")
++
++    def test_ECDH(self):
++        assert_equal_openssl("ECDH", "ECDH")
++
++    def test_AES_no_ECDH(self):
++        assert_equal_openssl("AES:-ECDH", "AES:-ECDH:-ADH:-PSK:-DH")
++        assert_equal_openssl("AES+RSA", "AES+RSA")
++
++    def test_logical_and_3DES_RSA(self):
++        assert_equal_openssl("3DES+RSA", "3DES+RSA:-SSLv2")
++
++    def test_logical_and_RSA_RC4(self):
++        assert_equal_openssl("RSA+RC4", "RSA+RC4:-SSLv2")
++
++    def test_logical_and_ECDH_SHA(self):
++        assert_equal_openssl("ECDH+SHA", "ECDH+SHA")
++
++    def test_logical_and_RSA_RC4_no_SHA(self):
++        assert_equal_openssl("RSA+RC4:!SHA", "RSA+RC4:-SSLv2:!SHA")
++
++    def test_additive_RSA_RC4(self):
++        assert_equal_openssl("RSA:+RC4", "RSA:+RC4:-SSLv2:-SEED:-IDEA")
++
++    def test_negative_plus_RSA_MD5(self):
++        assert_equal_openssl("-RC2:RSA+MD5", "-RC2:RSA+MD5:-SSLv2")
+ 
+     def test_nss_subtraction(self):
+         (out, err, rc) = run([exe, "+rsa_rc4_128_md5,+rsa_rc4_128_sha,-rsa_rc4_128_md5"])
+         assert rc == 0
+         assert_equal(out, 'rsa_rc4_128_sha')
+ 
++    def test_openssl_cipher(self):
++        (out, err, rc) = run([exe, "DES-CBC3-SHA"])
++        assert rc == 0
++        assert_equal(out, 'rsa_3des_sha')
++
++    def test_openssl_cipherlist(self):
++        (out, err, rc) = run([exe, "DES-CBC3-SHA:RC4-SHA"])
++        assert rc == 0
++        assert_equal(out, 'rsa_rc4_128_sha, rsa_3des_sha')
++
+     # As long as at least one is valid, things are ok
+     def test_nss_unknown(self):
+         (out, err, rc) = run([exe, "+rsa_rc4_128_md5,+unknown"])
+@@ -156,7 +238,9 @@ class test_ciphers(object):
+         assert rc == 0
+         assert_equal(out, 'aes_128_sha_256')
+ 
++    def test_openssl_single_cipher(self):
++        assert_equal_openssl("RC4-SHA", "RC4-SHA")
++
+     def test_invalid_format(self):
+         (out, err, rc) = run([exe, "none"])
+         assert rc == 1
+-        assert_equal(err, 'nss_engine_cipher.c:292, invalid cipher string none. Format is +cipher1,-cipher2...Unable to parse cipher list')
+diff --git a/test_cipher.c b/test_cipher.c
+index 91d112b..86a88d6 100644
+--- a/test_cipher.c
++++ b/test_cipher.c
+@@ -40,7 +40,7 @@ int ap_log_error_(const char *fn, int line, int module_index,
+ 
+     va_start(args, fmt);
+     vsprintf(out, fmt, args);
+-    fprintf(stderr,"%s:%d, %s", fn, line, out);
++    fprintf(stderr,"%s:%d, %s\n", fn, line, out);
+     va_end(args);
+ 
+     return 0;
+@@ -53,10 +53,11 @@ int main(int argc, char ** argv)
+     int rv=0;
+     int i;
+     char *ciphers;
++    PRBool openssl_output = PR_FALSE;
+     PRBool ciphers_list[ciphernum];
+ 
+-    if (argc != 2) {
+-        fprintf(stderr, "Usage: test_cipher [--count] <cipher_list>\n");
++    if (argc != 2 && argc != 3) {
++        fprintf(stderr, "Usage: test_cipher [--count] [--o] <cipher_list>\n");
+         exit(1);
+     }
+ 
+@@ -70,9 +71,14 @@ int main(int argc, char ** argv)
+         ciphers_list[i] = PR_FALSE;
+     }
+ 
+-    ciphers = strdup(argv[1]);
++    i = 1; /* index of ciphers */
++    if (!strcmp(argv[1], "--o")) {
++        openssl_output = PR_TRUE;
++        i = 2;
++    }
++
++    ciphers = strdup(argv[i]);
+     if (nss_parse_ciphers(NULL, ciphers, ciphers_list) < 0) {
+-        fprintf(stderr, "Unable to parse cipher list\n");
+         rv = 1;
+     }
+     free(ciphers);
+@@ -85,12 +91,22 @@ int main(int argc, char ** argv)
+         for (i = 0; i < ciphernum; i++)
+         {
+             if (ciphers_list[i] == 1) {
+-                strncat(output,  ciphers_def[i].name, sizeof(output));
+-                strncat(output,  ", ", sizeof(output));
++                if (openssl_output) {
++                    strncat(output,  ciphers_def[i].openssl_name, sizeof(output));
++                    strncat(output,  ":", sizeof(output));
++                } else {
++                    strncat(output,  ciphers_def[i].name, sizeof(output));
++                    strncat(output,  ", ", sizeof(output));
++                }
+             }
+         }
+-        output[strlen(output) - 2] = '\0';
++        if (openssl_output)
++            output[strlen(output) - 1] = '\0';
++        else
++            output[strlen(output) - 2] = '\0';
+         fprintf(stdout, "%s\n", output);
++    } else {
++        fprintf(stdout, "Unable to parse cipher list\n");
+     }
+ 
+     return rv;
+-- 
+1.9.3
+

0002-Fix-make-check.patch Added

@@ -0,0 +1,36 @@
+diff -up --recursive mod_nss-1.0.11/test/test_cipher.py mod_nss-1.0.11.fixed/test/test_cipher.py
+--- mod_nss-1.0.11/test/test_cipher.py	2015-08-17 19:35:48.362013632 +0000
++++ mod_nss-1.0.11.fixed/test/test_cipher.py	2015-08-17 19:33:25.818806486 +0000
+@@ -121,7 +121,7 @@ class test_ciphers(object):
+     # skipping COMPLEMENTOFDEFAULT as these are all ADH ciphers
+ 
+     def test_SSLv3(self):
+-        assert_equal_openssl("SSLv3", "SSLv3:-KRB5:-PSK:-ADH:-EDH:-SEED:-IDEA")
++        assert_equal_openssl("SSLv3", "SSLv3:-KRB5:-PSK:-ADH:-EDH:-DH:-SEED:-IDEA")
+ 
+     def test_SSLv3_equals_TLSv1(self):
+         (nss, err, rc) = run([exe, "--o", "SSLv3"])
+diff -up --recursive mod_nss-1.0.11/test/test_request.py mod_nss-1.0.11.fixed/test/test_request.py
+--- mod_nss-1.0.11/test/test_request.py	2014-12-02 18:59:03.000000000 +0000
++++ mod_nss-1.0.11.fixed/test/test_request.py	2015-08-17 19:32:53.831536743 +0000
+@@ -4,8 +4,8 @@
+ import socket
+ import requests
+ import urlparse
+-from urllib3.util import get_host
+-from urllib3.connectionpool import HTTPConnectionPool, HTTPSConnectionPool
++from requests.packages.urllib3.util import get_host
++from requests.packages.urllib3.connectionpool import HTTPConnectionPool, HTTPSConnectionPool
+ import logging
+ 
+ # Don't bend over backwards for ssl support, assume it is there.
+@@ -107,6 +107,9 @@ class MyVerifiedHTTPSConnection(HTTPSCon
+     ca_certs = None
+     client_cipher = None
+ 
++    # A gross oversimplification but we aren't testing this
++    is_verified = True
++
+     def set_cert(self, key_file=None, cert_file=None,
+                  cert_reqs='CERT_NONE', ca_certs=None):
+         ssl_req_scheme = {

mod_nss-conf.patch Added

@@ -0,0 +1,75 @@
+From bc24e3c0a438a2b6f177227b3340b516c15292a8 Mon Sep 17 00:00:00 2001
+From: Rob Crittenden <rcritten@redhat.com>
+Date: Thu, 20 Feb 2014 17:21:41 -0500
+Subject: [PATCH] Configure nss.conf.in to match Fedora filesystem layout
+
+---
+ nss.conf.in | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/nss.conf.in b/nss.conf.in
+index c941ecf..349a810 100644
+--- a/nss.conf.in
++++ b/nss.conf.in
+@@ -8,14 +8,16 @@
+ # consult the online docs. You have been warned.  
+ #
+ 
++LoadModule nss_module modules/libmodnss.so
++
+ #
+ # When we also provide SSL we have to listen to the 
+ # standard HTTP port (see above) and to the HTTPS port
+ #
+ # Note: Configurations that use IPv6 but not IPv4-mapped addresses need two
+-#       Listen directives: "Listen [::]:443" and "Listen 0.0.0.0:443"
++#       Listen directives: "Listen [::]:8443" and "Listen 0.0.0.0:443"
+ #
+-Listen 443
++Listen 8443
+ 
+ ##
+ ##  SSL Global Context
+@@ -79,17 +81,17 @@ NSSRequireSafeNegotiation off
+ ## SSL Virtual Host Context
+ ##
+ 
+-<VirtualHost _default_:443>
++<VirtualHost _default_:8443>
+ 
+ #   General setup for the virtual host
+ #DocumentRoot "@apache_prefix@/htdocs"
+-#ServerName www.example.com:443
++#ServerName www.example.com:8443
+ #ServerAdmin you@example.com
+ 
+ # mod_nss can log to separate log files, you can choose to do that if you'd like
+ # LogLevel is not inherited from httpd.conf.
+-#ErrorLog @apache_prefix@/logs/error_log
+-#TransferLog @apache_prefix@/logs/access_log
++ErrorLog @apache_prefix@/logs/error_log
++TransferLog @apache_prefix@/logs/access_log
+ LogLevel warn
+ 
+ #   SSL Engine Switch:
+@@ -133,7 +135,7 @@ NSSNickname Server-Cert
+ #   The NSS security database directory that holds the certificates and
+ #   keys. The database consists of 3 files: cert8.db, key3.db and secmod.db.
+ #   Provide the directory that these files exist.
+-NSSCertificateDatabase @apache_conf@
++NSSCertificateDatabase /etc/httpd/alias
+ 
+ #   Database Prefix:
+ #   In order to be able to store multiple NSS databases in one directory
+@@ -209,7 +211,7 @@ NSSCertificateDatabase @apache_conf@
+ <Files ~ "\.(cgi|shtml|phtml|php3?)$">
+     NSSOptions +StdEnvVars
+ </Files>
+-<Directory "@apache_prefix@/cgi-bin">
++<Directory "/var/www/cgi-bin">
+     NSSOptions +StdEnvVars
+ </Directory>
+ 
+-- 
+1.7.11.7
+

mod_nss-gencert.patch Added

@@ -0,0 +1,40 @@
+From 2d99bb694029f06d3bb7810922e755c57229b951 Mon Sep 17 00:00:00 2001
+From: Rob Crittenden <rcritten@redhat.com>
+Date: Tue, 2 Dec 2014 11:34:23 -0500
+Subject: [PATCH] Modify gencert to create a password-less database
+
+---
+ gencert.in | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/gencert.in b/gencert.in
+index ffccaab..1808f42 100755
+--- a/gencert.in
++++ b/gencert.in
+@@ -85,12 +85,11 @@ fi
+ 
+ DBDIR=$1
+ 
+-echo "httptest" > $DEST/pw.txt
++echo -e "\n" > $DEST/pw.txt
+ 
+ echo ""
+ echo "#####################################################################"
+-echo "Generating new server certificate and key database. The password"
+-echo "is httptest"
++echo "Generating new server certificate and key database."
+ echo "#####################################################################"
+ $CERTUTIL -N -d $DBDIR -f $DEST/pw.txt
+ 
+@@ -207,8 +206,4 @@ echo "#####################################################################"
+ rm $DEST/pw.txt
+ rm $DEST/noise
+ 
+-echo ""
+-echo "The database password is httptest"
+-echo ""
+-
+ exit 0
+-- 
+1.9.3
+

mod_nss-parallel-build.patch Added

debian.changelog Added

@@ -0,0 +1,31 @@
+libapache2-mod-nss (1.0.8-4.1) unstable; urgency=low
+
+  * Rebuild with correct requirements and build requirements
+  
+ -- Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com>  Thu,  3 Sep 2015 14:14:14 +0200
+
+libapache2-mod-nss (1.0.8-1) unstable; urgency=low
+
+  * New upstream
+  * Patch for softokn3 is not needed anymore
+  * Add doc/mod_nss.html
+  * Enable Elliptic Curve Cryptography
+  * Fix build
+  * Add ${misc:Depends}
+  * Spelling fixes
+  * Bumped policy to 3.8.3
+  * Switch to dpkg-source 3.0 (quilt) format
+  * Bumped policy to 3.8.4
+  * Removed README.source
+  * Added pkg-config, libtool & automake to B-D
+  * Changed my email address
+  * Fix compilation issues (QUILT_STAMPFN)
+
+ -- Michele Baldessari <michele@acksyn.org>  Sun, 17 Oct 2010 14:12:42 +0200
+
+libapache2-mod-nss (1.0.7-1) unstable; urgency=low
+
+  * Initial release (Closes: #XXXXX)
+  * Added patch from RH 444348
+
+ -- Michele Baldessari <michele@pupazzo.org>  Mon, 12 May 2008 22:05:09 +0200

debian.control Added

debian.rules Added

@@ -0,0 +1,90 @@
+#!/usr/bin/make -f
+
+include /usr/share/quilt/quilt.make  
+
+# These are used for cross-compiling and for saving the configure script
+# from having to guess our platform (since we know it already)
+DEB_HOST_GNU_TYPE   ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+DEB_BUILD_GNU_TYPE  ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
+DEB_BUILD_ARCH  ?= $(shell dpkg-architecture -qDEB_BUILD_ARCH)
+
+UPSTREAM_VERSION := $(shell dpkg-parsechangelog | sed -n 's/^Version: *$.*$-.*$$/\1/ p' | sed -e 's/~.*//')
+MOD_MAJOR_VERSION := $(word 1, $(subst ., ,$(UPSTREAM_VERSION)))
+MOD_MINOR_VERSION := $(word 2, $(subst ., ,$(UPSTREAM_VERSION)))
+MOD_PATCH_VERSION := $(word 3, $(subst ., ,$(UPSTREAM_VERSION)))
+
+CFLAGS := -Wall -pipe
+
+ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
+	CFLAGS += -O0
+else
+	CFLAGS += -O2 -fno-strict-aliasing
+endif
+
+CFLAGS += -g
+CONFIGURE_SWITCHES := --prefix=/usr \
+			--exec-prefix=/usr \
+			--sysconfdir=/usr \
+			--mandir=/usr/share/man \
+			--with-apxs=/usr/bin/apxs2 \
+			--enable-ecc
+
+
+configure: configure-stamp
+configure-stamp: $(QUILT_STAMPFN)
+ifneq "$(wildcard /usr/share/misc/config.sub)" "" 
+	cp -f /usr/share/misc/config.sub config.sub 
+endif 
+ifneq "$(wildcard /usr/share/misc/config.guess)" "" 
+	cp -f /usr/share/misc/config.guess config.guess 
+endif 
+
+	autoreconf -i -f
+	dh_testdir
+	./configure $(CONFIGURE_SWITCHES)
+	touch $@
+
+build: build-stamp
+build-stamp: configure-stamp
+	dh_testdir
+	$(MAKE)
+	touch $@
+
+clean: clean-patched unpatch
+clean-patched:
+	dh_testdir
+	dh_testroot
+	[ ! -f Makefile ] || $(MAKE) distclean
+	rm -f build-stamp configure-stamp install-stamp config.log
+	dh_clean
+
+install: build install-stamp
+install-stamp:
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+	dh_installdirs
+	# FIXME: brrrr
+	mv $(CURDIR)/.libs/libmodnss.so $(CURDIR)/.libs/mod_nss.so
+	touch install-stamp
+
+binary-indep: build install 
+binary-arch: build install
+	dh_testdir
+	dh_testroot
+	dh_installchangelogs -a
+	dh_installdocs -a
+	dh_install
+	dh_link -a
+	dh_strip
+	dh_compress -a
+	dh_fixperms -a
+	dh_installdeb -a
+	dh_shlibdeps -a -L libapache2-mod-nss -l debian/libapache2-mod-nss/usr/lib/apache2/modules
+	dh_gencontrol -a
+	dh_md5sums -a
+	dh_builddeb -a
+
+binary: binary-arch
+
+.PHONY: clean install build binary-indep binary-arch binary

debian.series Added

debian.tar.gz Added

mod_nss-1.0.11.tar.gz Added

mod_nss.dsc Added

Build Results
RPM Lint

Refresh

Comments for request 1217 0

Request History

vanmeeuwen created request over 8 years ago

Check in mod_nss

vanmeeuwen accepted request over 8 years ago