67 lines
2.1 KiB
Text
67 lines
2.1 KiB
Text
|
|
PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
|
|
NSSInitContext *const ctx =
|
|
NSS_InitContext("sql:/etc/pki/nssdb", "", "", "", NULL,
|
|
NSS_INIT_READONLY | NSS_INIT_PK11RELOAD);
|
|
if (ctx == NULL) {
|
|
const PRErrorCode err = PR_GetError();
|
|
fprintf(stderr, "error: NSPR error code %d: %s\n",
|
|
err, PR_ErrorToName(err));
|
|
exit(1);
|
|
}
|
|
|
|
// Ciphers to enable.
|
|
static const PRUint16 good_ciphers[] = {
|
|
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
|
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
|
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
|
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
|
TLS_RSA_WITH_AES_128_GCM_SHA256,
|
|
TLS_RSA_WITH_AES_256_GCM_SHA384,
|
|
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
|
|
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
|
|
TLS_RSA_WITH_AES_128_CBC_SHA,
|
|
TLS_RSA_WITH_AES_256_CBC_SHA,
|
|
SSL_RSA_WITH_3DES_EDE_CBC_SHA,
|
|
SSL_NULL_WITH_NULL_NULL // sentinel
|
|
};
|
|
|
|
// Check if the current policy allows any strong ciphers. If it
|
|
// doesn't, set the cipher suite policy. This is not thread-safe
|
|
// and has global impact. Consequently, we only do it if absolutely
|
|
// necessary.
|
|
int found_good_cipher = 0;
|
|
for (const PRUint16 *p = good_ciphers; *p != SSL_NULL_WITH_NULL_NULL;
|
|
++p) {
|
|
PRInt32 policy;
|
|
if (SSL_CipherPolicyGet(*p, &policy) != SECSuccess) {
|
|
const PRErrorCode err = PR_GetError();
|
|
fprintf(stderr, "error: policy for cipher %u: error %d: %s\n",
|
|
(unsigned)*p, err, PR_ErrorToName(err));
|
|
exit(1);
|
|
}
|
|
if (policy == SSL_ALLOWED) {
|
|
fprintf(stderr, "info: found cipher %x\n", (unsigned)*p);
|
|
found_good_cipher = 1;
|
|
break;
|
|
}
|
|
}
|
|
if (!found_good_cipher) {
|
|
if (NSS_SetDomesticPolicy() != SECSuccess) {
|
|
const PRErrorCode err = PR_GetError();
|
|
fprintf(stderr, "error: NSS_SetDomesticPolicy: error %d: %s\n",
|
|
err, PR_ErrorToName(err));
|
|
exit(1);
|
|
}
|
|
}
|
|
|
|
// Initialize the trusted certificate store.
|
|
char module_name[] = "library=libnssckbi.so name=\"Root Certs\"";
|
|
SECMODModule *module = SECMOD_LoadUserModule(module_name, NULL, PR_FALSE);
|
|
if (module == NULL || !module->loaded) {
|
|
const PRErrorCode err = PR_GetError();
|
|
fprintf(stderr, "error: NSPR error code %d: %s\n",
|
|
err, PR_ErrorToName(err));
|
|
exit(1);
|
|
}
|
|
|