Remove SSL 2.0 support.

net/socket/ssl_client_socket_openssl.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // OpenSSL binding for SSLClientSocket. The class layout and general principle
 // of operation is derived from SSLClientSocketNSS.
 
 #include "net/socket/ssl_client_socket_openssl.h"
 
 #include <openssl/ssl.h>
@@ skipping 148 matching lines @@
     return SSL_set_ex_data(ssl, ssl_socket_data_index_, socket) != 0;
   }
 
  private:
   friend struct DefaultSingletonTraits<SSLContext>;
 
   SSLContext() {
     base::EnsureOpenSSLInit();
     ssl_socket_data_index_ = SSL_get_ex_new_index(0, 0, 0, 0, 0);
     DCHECK_NE(ssl_socket_data_index_, -1);
     ssl_ctx_.reset(SSL_CTX_new(SSLv23_client_method()));

[agl, 2010/11/30 01:07:27]

I think that we should add a TODO here as we might want to switch to
SSLv3_client_method.

[wtc, 2010/11/30 02:14:30]

Thanks for the suggestion.

I looked into this.  According to the man page at
http://www.openssl.org/docs/ssl/SSL_CTX_new.html,
SSLv3_client_method supports SSLv3 only, and
SSLv23_client_method is the only client method that
supports SSLv3 and TLS1.

     SSL_CTX_set_cert_verify_callback(ssl_ctx_.get(), NoOpVerifyCallback, NULL);
     SSL_CTX_set_session_cache_mode(ssl_ctx_.get(), SSL_SESS_CACHE_CLIENT);
     SSL_CTX_sess_set_new_cb(ssl_ctx_.get(), NewSessionCallbackStatic);
     SSL_CTX_sess_set_remove_cb(ssl_ctx_.get(), RemoveSessionCallbackStatic);
     SSL_CTX_set_timeout(ssl_ctx_.get(), kSessionCacheTimeoutSeconds);
     SSL_CTX_sess_set_cache_size(ssl_ctx_.get(), kSessionCacheMaxEntires);
   }
 
   static int NewSessionCallbackStatic(SSL* ssl, SSL_SESSION* session) {
     return Get()->NewSessionCallback(ssl, session);
@@ skipping 80 matching lines @@
 
   SSL_set_bio(ssl_, ssl_bio, ssl_bio);
 
 #define SET_SSL_CONFIG_OPTION(option, value)   \
       (((value) ? set_mask : clear_mask) |= (option))
 
   // OpenSSL defaults some options to on, others to off. To avoid ambiguity,
   // set everything we care about to an absolute value.
   long set_mask = 0;
   long clear_mask = 0;
-  SET_SSL_CONFIG_OPTION(SSL_OP_NO_SSLv2, !ssl_config_.ssl2_enabled);
+  SET_SSL_CONFIG_OPTION(SSL_OP_NO_SSLv2, true);
   SET_SSL_CONFIG_OPTION(SSL_OP_NO_SSLv3, !ssl_config_.ssl3_enabled);
   SET_SSL_CONFIG_OPTION(SSL_OP_NO_TLSv1, !ssl_config_.tls1_enabled);
 
   // TODO(joth): Set this conditionally, see http://crbug.com/55410
   SET_SSL_CONFIG_OPTION(SSL_OP_LEGACY_SERVER_CONNECT, true);
 
   // Make sure we haven't got any intersection in the set & clear options.
   DCHECK_EQ(0, set_mask & clear_mask);
 
   SSL_set_options(ssl_, set_mask);
@@ skipping 584 matching lines @@
   int rv = SSL_write(ssl_, user_write_buf_->data(), user_write_buf_len_);
 
   if (rv >= 0)
     return rv;
 
   int err = SSL_get_error(ssl_, rv);
   return MapOpenSSLError(err);
 }
 
 } // namespace net