* Check for Apache user owner/group read permissions of NSS database
* Update default ciphers to something more modern and secure
* Fix test for DH cipher directive
* Check for test and netstat before trying to use them
* Don't ignore NSSProtocol when NSSFIPS is enabled
  Based on patch by Matthew Harmsen <mharmsen@redhat.com>
* Use proper shell syntax to avoid creating /0
* tests: Centralize the openssl ciphers flags when comparing
* Basic test case for DHE cipher negotiation
* Remove -DH from test strings, duplicate test, fix test
* Add server support for DHE ciphers.

Insecure or less secure algorithms such as RC4, DES and 3DES are
removed. Perfect forward secrecy suites with ephemeral ECDH key
exchange have been added. IE 8 on Windows XP is no longer
supported.

https://fedorahosted.org/mod_nss/ticket/5

See if the configured user has read access to the NSS database
during initialization so the server can gracefully shutdown
rather than ending up in a forking loop because the database is
owned by root and is therefore unreadable once Apache starts
forking.

Adds a new configuration option, NSSSkipPermissionCheck <on/off>,
to skip this check in case something goes wrong.

https://fedorahosted.org/mod_nss/ticket/3

Change 184804c82daf7fe04dfb0b0ecdc3e06be0c103c1 modified the
way arguments are handled in test/setup.sh such that sql: was
being dropped so tests were not being executed against sqlite
databases.

These may not be available on all systems. Work around it best
we can. In the case of netstat this can be replaced by using
/dev/urandom or /dev/random instead and piping it through tr
to produce only ASCII strings.

The value was always being set to TLS 1.0, 1.1 and 1.2, ignoring
the configuration value.

I suspect this is because this code dated to when only SSL2, 3 and
TLS 1.0 were supported so it only enabled TLS v1.0. When 1.1 and
1.2 were added it seemed natural to automatically enable those
as well. Natural but incorrect.

Based on patch by Matthew Harmsen <mharmsen@redhat.com>

RHBZ #1312052

I used if [ $x > 0 ]; ... which is obviously wrong :-(

https://bugzilla.redhat.com/show_bug.cgi?id=1311392

Since we don't support ADH ciphers can just ignore DH-*

Note that OpenSSL defines the DH- ciphers but does not implement
them so the DH string support is there only for compatibility.

I used to have a separate set of options when comparing the
NSS and OpenSSL ciphers. These differed between tests, sometimes
being just a difference in order. This just made the tests
hard to understand.