Initialize cipher list when re-negotiating handshake.

If an NSSCipherSuite is defined in a location or directory then
we re-do the SSL handshake. The cipher list wasn't being initialized
to PR_FALSE so changes are good that all ciphers would be enabled,
not just the ones in the local NSSCipherSuite setting.

Resolves BZ 1165408

2 files changed, 27 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index d2413ff..e5ca948 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2014-11-12  Rob Crittenden <rcritten@redhat.com>
+    * Initialize ciphers to all disabled before renegotiation
+      (#1165408)
+
 2014-11-06  Rob Crittenden <rcritten@redhat.com>
     * Completely remove support for SSLv2
 
diff --git a/nss_engine_kernel.c b/nss_engine_kernel.c
index deb91a0..4addb39 100644
--- a/nss_engine_kernel.c
+++ b/nss_engine_kernel.c
@@ -198,6 +198,10 @@ int nss_hook_Access(request_rec *r)
 
         /* configure new state */
 
+        for (i=0; i<ciphernum; i++)
+        {
+            ciphers_new[i] = PR_FALSE;
+        }
         ciphers = strdup(dc->szCipherSuite);
         if (nss_parse_ciphers(r->server, ciphers, ciphers_new) < 0) {
             ap_log_error(APLOG_MARK, APLOG_WARNING, 0,
@@ -211,6 +215,13 @@ int nss_hook_Access(request_rec *r)
         }
         free(ciphers);
 
+        /* Disable all ciphers so only the ones we want will be available */
+
+        for (i = 0; i < SSL_NumImplementedCiphers; i++)
+        {
+            SSL_CipherPrefSet(ssl, SSL_ImplementedCiphers[i], SSL_NOT_ALLOWED);
+        }
+
         /* Actually enable the selected ciphers. Also check to
            see if the existing cipher is in the new list for
            a possible optimization later. */
@@ -474,6 +485,18 @@ int nss_hook_Access(request_rec *r)
             }
         }
 
+        if (cipher || !cipher_in_list) {
+            int on, keySize, secretKeySize;
+            char *issuer, *subject;
+
+            SSL_SecurityStatus(ssl, &on, &cipher,
+                               &keySize, &secretKeySize, &issuer,
+                               &subject);
+
+            ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server,
+                "Re-negotiated cipher %s", cipher);
+        }
+
         /*
          * Remember the peer certificate's DN
          */