net: disable ECDSA ciphersuites on platforms where we can't support it.

net/socket/ssl_client_socket_nss.cc

Index: net/socket/ssl_client_socket_nss.cc
diff --git a/net/socket/ssl_client_socket_nss.cc b/net/socket/ssl_client_socket_nss.cc
index 21089d521b3b5d59c87261688933dfa0778fe34b..f6ffc0a17d125dabb50f5b42e98762de1ddba453 100644
--- a/net/socket/ssl_client_socket_nss.cc
+++ b/net/socket/ssl_client_socket_nss.cc
@@ -108,11 +108,13 @@
 #if defined(OS_WIN)
 #include <windows.h>
 #include <wincrypt.h>
+#include "base/win/windows_version.h"
 #elif defined(OS_MACOSX)
 #include <Security/SecBase.h>
 #include <Security/SecCertificate.h>
 #include <Security/SecIdentity.h>
 #include "base/mac/mac_logging.h"
+#include "base/mac/mac_util.h"
 #elif defined(USE_NSS)
 #include <dlfcn.h>
 #endif
@@ -3114,6 +3116,17 @@ int SSLClientSocketNSS::InitializeSSLOptions() {
     SSL_CipherPrefSet(nss_fd_, *it, PR_FALSE);
   }
 
+  // On some platforms we cannot verify ECDSA certificates.
+#if defined(OS_WIN)
+  if (base::win::GetVersion() < base::win::VISTA) {
+    DisableECDSA();
+  }
+#elif defined(OS_MACOSX)
+  if (!base::mac::IsOSSnowLeopardOrLater()) {
+    DisableECDSA();
+  }
+#endif

[Ryan Sleevi, 2012/08/15 00:40:27]

Seems like you can move this into NSSSSLInitSingleton (nss_ssl_util.cc), and
only have to set it once per-process rather than once-per-socket, and then
update the comment in net/base/ssl_config_service.h

[agl, 2012/08/15 01:06:20]

Good point, there's a SetDefault function too. Done.

+
 #ifdef SSL_ENABLE_SESSION_TICKETS
   // Support RFC 5077
   rv = SSL_OptionSet(nss_fd_, SSL_ENABLE_SESSION_TICKETS, PR_TRUE);
@@ -3510,6 +3523,25 @@ bool SSLClientSocketNSS::CalledOnValidThread() const {
   return valid_thread_id_ == base::PlatformThread::CurrentId();
 }
 
+void SSLClientSocketNSS::DisableECDSA() {
+  const PRUint16* ciphersuites = SSL_GetImplementedCiphers();
+  const unsigned num_ciphersuites = SSL_GetNumImplementedCiphers();
+  SECStatus rv;
+  SSLCipherSuiteInfo info;
+
+  for (unsigned i = 0; i < num_ciphersuites; i++) {
+    rv = SSL_GetCipherSuiteInfo(ciphersuites[i], &info, sizeof(info));
+    if (rv != SECSuccess) {
+      LogFailedNSSFunction(net_log_, "SSL_GetCipherSuiteInfo", "");
+      LOG(ERROR) << "SSL_GetCipherSuiteInfo failed";
+      break;
+    }
+    if (info.authAlgorithm == ssl_auth_ecdsa) {
+      SSL_CipherPrefSet(nss_fd_, ciphersuites[i], PR_FALSE);
+    }
+  }
+}
+
 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const {
   return server_bound_cert_service_;
 }