net: disable ECDSA ciphersuites on platforms where we can't support it.

net/socket/nss_ssl_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/nss_ssl_util.h"
 
 #include <nss.h>
 #include <secerr.h>
 #include <ssl.h>
 #include <sslerr.h>
 
 #include <string>
 
 #include "base/bind.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/memory/singleton.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/values.h"
+#include "build/build_config.h"
 #include "crypto/nss_util.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_log.h"
 
+#if defined(OS_WIN)
+#include "base/win/windows_version.h"
+#elif defined(OS_MACOSX)
+#include "base/mac/mac_util.h"
+#endif
+
 namespace net {
 
 class NSSSSLInitSingleton {
  public:
   NSSSSLInitSingleton() {
     crypto::EnsureNSSInit();
 
     NSS_SetDomesticPolicy();
 
 #if defined(USE_SYSTEM_SSL)
@@ skipping 19 matching lines @@
       if (SSL_GetCipherSuiteInfo(pSSL_ImplementedCiphers[i], &info,
                                  sizeof(info)) == SECSuccess) {
         SSL_CipherPrefSetDefault(pSSL_ImplementedCiphers[i],
                                  (info.effectiveKeyBits >= 80));
       }
     }
 
     // Enable SSL.
     SSL_OptionSetDefault(SSL_SECURITY, PR_TRUE);
 
+    // On some platforms we cannot verify ECDSA certificates.

[Ryan Sleevi, 2012/08/15 01:12:07]

nit: Suggested re-word to drop the "we" (a pet nit of Mark's that I've
inherited), but also provide context why this is, since normally the two
statements would be unrelated.

// On platforms that do not support ECDSA signed certificates,
// disable ECDSA cipher suites, as servers may use the presence
// of such ciphersuites as a hint to send an ECDSA certificate.

[agl, 2012/08/15 01:36:29]

Done. (And have reworked the ssl_config_service.h comment similarly.)

+#if defined(OS_WIN)
+    if (base::win::GetVersion() < base::win::VERSION_VISTA) {
+      DisableECDSA();
+    }
+#elif defined(OS_MACOSX)
+    if (!base::mac::IsOSSnowLeopardOrLater()) {
+      DisableECDSA();
+    }
+#endif
+
     // All other SSL options are set per-session by SSLClientSocket and
     // SSLServerSocket.
   }
 
   ~NSSSSLInitSingleton() {
     // Have to clear the cache, or NSS_Shutdown fails with SEC_ERROR_BUSY.
     SSL_ClearSessionCache();
   }
+
+  void DisableECDSA() {
+    const PRUint16* ciphersuites = SSL_GetImplementedCiphers();
+    const unsigned num_ciphersuites = SSL_GetNumImplementedCiphers();
+    SECStatus rv;
+    SSLCipherSuiteInfo info;
+
+    for (unsigned i = 0; i < num_ciphersuites; i++) {
+      rv = SSL_GetCipherSuiteInfo(ciphersuites[i], &info, sizeof(info));
+      if (rv != SECSuccess) {
+        LOG(ERROR) << "SSL_GetCipherSuiteInfo failed";
+        break;

[Ryan Sleevi, 2012/08/15 01:12:07]

break or continue?

If continue, you can probably just rewrite
if (rv == SECSuccess && info.authAlgorithm == ...)
  SSL_CipherPrefSetDefault(..., PR_FALSE);

[agl, 2012/08/15 01:36:29]

I did mean break, but less code is better.

+      }
+      if (info.authAlgorithm == ssl_auth_ecdsa) {
+        SSL_CipherPrefSetDefault(ciphersuites[i], PR_FALSE);
+      }

[Ryan Sleevi, 2012/08/15 01:12:07]

nit: lose the braces for the one-line if here

[agl, 2012/08/15 01:36:29]

So many different micro-styles... :)

+    }
+  }
 };
 
 static base::LazyInstance<NSSSSLInitSingleton> g_nss_ssl_init_singleton =
     LAZY_INSTANCE_INITIALIZER;
 
 // Initialize the NSS SSL library if it isn't already initialized.  This must
 // be called before any other NSS SSL functions.  This function is
 // thread-safe, and the NSS SSL library will only ever be initialized once.
 // The NSS SSL library will be properly shut down on program exit.
 void EnsureNSSSSLInit() {
@@ skipping 161 matching lines @@
                           const char* param) {
   DCHECK(function);
   DCHECK(param);
   net_log.AddEvent(
       NetLog::TYPE_SSL_NSS_ERROR,
       base::Bind(&NetLogSSLFailedNSSFunctionCallback,
                  function, param, PR_GetError()));
 }
 
 }  // namespace net