Add support for restricting the cipher suites that SSLClientSocket(Mac,NSS) use

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 76 matching lines @@
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/base/net_log.h"
 #include "net/base/ssl_cert_request_info.h"
 #include "net/base/ssl_connection_status_flags.h"
 #include "net/base/ssl_info.h"
 #include "net/base/sys_addrinfo.h"
 #include "net/ocsp/nss_ocsp.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/dns_cert_provenance_check.h"
+#include "net/socket/ssl_error_params.h"
 #include "net/socket/ssl_host_info.h"
 
 static const int kRecvBufferSize = 4096;
 
 // kCorkTimeoutMs is the number of milliseconds for which we'll wait for a
 // Write to an SSL socket which we're False Starting. Since corking stops the
 // Finished message from being sent, the server sees an incomplete handshake
 // and some will time out such sockets quite aggressively.
 static const int kCorkTimeoutMs = 200;
 
@@ skipping 158 matching lines @@
     // The handshake may fail because some signature (for example, the
     // signature in the ServerKeyExchange message for an ephemeral
     // Diffie-Hellman cipher suite) is invalid.
     case SEC_ERROR_BAD_SIGNATURE:
       return ERR_SSL_PROTOCOL_ERROR;
     default:
       return MapNSPRError(err);
   }
 }
 
-// Extra parameters to attach to the NetLog when we receive an SSL error.
-class SSLErrorParams : public NetLog::EventParameters {
- public:
-  // If |ssl_lib_error| is 0, it will be ignored.
-  SSLErrorParams(int net_error, PRErrorCode ssl_lib_error)
-      : net_error_(net_error),
-        ssl_lib_error_(ssl_lib_error) {
-  }
-
-  virtual Value* ToValue() const {
-    DictionaryValue* dict = new DictionaryValue();
-    dict->SetInteger("net_error", net_error_);
-    if (ssl_lib_error_)
-      dict->SetInteger("ssl_lib_error", ssl_lib_error_);
-    return dict;
-  }
-
- private:
-  const int net_error_;
-  const PRErrorCode ssl_lib_error_;
-};
-
 // Extra parameters to attach to the NetLog when we receive an error in response
 // to a call to an NSS function.  Used instead of SSLErrorParams with
 // events of type TYPE_SSL_NSS_ERROR.  Automatically looks up last PR error.
 class SSLFailedNSSFunctionParams : public NetLog::EventParameters {
  public:
   // |param| is ignored if it has a length of 0.
   SSLFailedNSSFunctionParams(const std::string& function,
                              const std::string& param)
       : function_(function), param_(param), ssl_lib_error_(PR_GetError()) {
   }
@@ skipping 415 matching lines @@
     LogFailedNSSFunction(net_log_, "SSL_OptionSet", "SSL_ENABLE_SSL3");
     return ERR_UNEXPECTED;
   }
 
   rv = SSL_OptionSet(nss_fd_, SSL_ENABLE_TLS, ssl_config_.tls1_enabled);
   if (rv != SECSuccess) {
     LogFailedNSSFunction(net_log_, "SSL_OptionSet", "SSL_ENABLE_TLS");
     return ERR_UNEXPECTED;
   }
 
+  for (std::vector<uint16>::const_iterator it =
+           ssl_config_.disabled_cipher_suites.begin();
+       it != ssl_config_.disabled_cipher_suites.end(); ++it) {
+    // This will fail if the specified cipher is not implemented by NSS, but
+    // the failure is harmless.
+    SSL_CipherPrefSet(nss_fd_, *it, PR_FALSE);
+  }
+
 #ifdef SSL_ENABLE_SESSION_TICKETS
   // Support RFC 5077
   rv = SSL_OptionSet(nss_fd_, SSL_ENABLE_SESSION_TICKETS, PR_TRUE);
   if (rv != SECSuccess) {
     LogFailedNSSFunction(
         net_log_, "SSL_OptionSet", "SSL_ENABLE_SESSION_TICKETS");
   }
 #else
   #error "You need to install NSS-3.12 or later to build chromium"
 #endif
@@ skipping 1834 matching lines @@
     case SSL_CONNECTION_VERSION_TLS1_1:
       UpdateConnectionTypeHistograms(CONNECTION_SSL_TLS1_1);
       break;
     case SSL_CONNECTION_VERSION_TLS1_2:
       UpdateConnectionTypeHistograms(CONNECTION_SSL_TLS1_2);
       break;
   };
 }
 
 }  // namespace net