A follow-up of r64178....

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 348 matching lines @@
 }
 
 #endif
 
 // PeerCertificateChain is a helper object which extracts the certificate
 // chain, as given by the server, from an NSS socket and performs the needed
 // resource management. The first element of the chain is the leaf certificate
 // and the other elements are in the order given by the server.
 class PeerCertificateChain {
  public:
-  PeerCertificateChain(PRFileDesc* nss_fd)
+  explicit PeerCertificateChain(PRFileDesc* nss_fd)
       : num_certs_(0),
         certs_(NULL) {
     SECStatus rv = SSL_PeerCertificateChain(nss_fd, NULL, &num_certs_);
     DCHECK_EQ(rv, SECSuccess);
 
     certs_ = new CERTCertificate*[num_certs_];
     const unsigned expected_num_certs = num_certs_;
     rv = SSL_PeerCertificateChain(nss_fd, certs_, &num_certs_);
     DCHECK_EQ(rv, SECSuccess);
     DCHECK_EQ(num_certs_, expected_num_certs);
@@ skipping 718 matching lines @@
     ssl_connection_status_ |=
         (static_cast<int>(channel_info.cipherSuite) &
          SSL_CONNECTION_CIPHERSUITE_MASK) <<
         SSL_CONNECTION_CIPHERSUITE_SHIFT;
 
     ssl_connection_status_ |=
         (static_cast<int>(channel_info.compressionMethod) &
          SSL_CONNECTION_COMPRESSION_MASK) <<
         SSL_CONNECTION_COMPRESSION_SHIFT;
 
+    // NSS 3.12.x doesn't have version macros for TLS 1.1 and 1.2 (because NSS
+    // doesn't support them yet), so we use 0x0302 and 0x0303 directly.
     int version = SSL_CONNECTION_VERSION_UNKNOWN;
     if (channel_info.protocolVersion < SSL_LIBRARY_VERSION_3_0) {
       // All versions less than SSL_LIBRARY_VERSION_3_0 are treated as SSL
       // version 2.
       version = SSL_CONNECTION_VERSION_SSL2;
     } else if (channel_info.protocolVersion == SSL_LIBRARY_VERSION_3_0) {
       version = SSL_CONNECTION_VERSION_SSL3;
     } else if (channel_info.protocolVersion == SSL_LIBRARY_VERSION_3_1_TLS) {
       version = SSL_CONNECTION_VERSION_TLS1;
+    } else if (channel_info.protocolVersion == 0x0302) {
+      version = SSL_CONNECTION_VERSION_TLS1_1;
+    } else if (channel_info.protocolVersion == 0x0303) {
+      version = SSL_CONNECTION_VERSION_TLS1_2;
     }
     ssl_connection_status_ |=
         (version & SSL_CONNECTION_VERSION_MASK) <<
         SSL_CONNECTION_VERSION_SHIFT;
   }
 
   // SSL_HandshakeNegotiatedExtension was added in NSS 3.12.6.
   // Since SSL_MAX_EXTENSIONS was added at the same time, we can test
   // SSL_MAX_EXTENSIONS for the presence of SSL_HandshakeNegotiatedExtension.
 #if defined(SSL_MAX_EXTENSIONS)
@@ skipping 517 matching lines @@
 
 // static
 // NSS calls this if a client certificate is needed.
 // Based on Mozilla's NSS_GetClientAuthData.
 SECStatus SSLClientSocketNSS::ClientAuthHandler(
     void* arg,
     PRFileDesc* socket,
     CERTDistNames* ca_names,
     CERTCertificate** result_certificate,
     SECKEYPrivateKey** result_private_key) {
+  // NSS passes a null ca_names if SSL 2.0 is used.  Just fail rather than
+  // trying to make this work, as we plan to remove SSL 2.0 support soon.
+  if (!ca_names)
+    return SECFailure;
+
   SSLClientSocketNSS* that = reinterpret_cast<SSLClientSocketNSS*>(arg);
 
   that->client_auth_cert_needed_ = !that->ssl_config_.send_client_cert;
 
 #if defined(OS_WIN)
   if (that->ssl_config_.send_client_cert) {
     // TODO(wtc): SSLClientSocketNSS can't do SSL client authentication using
     // CryptoAPI yet (http://crbug.com/37560), so client_cert must be NULL.
     DCHECK(!that->ssl_config_.client_cert);
     // Send no client certificate.
@@ skipping 695 matching lines @@
     case SSL_CONNECTION_VERSION_TLS1_1:
       UpdateConnectionTypeHistograms(CONNECTION_SSL_TLS1_1);
       break;
     case SSL_CONNECTION_VERSION_TLS1_2:
       UpdateConnectionTypeHistograms(CONNECTION_SSL_TLS1_2);
       break;
   };
 }
 
 }  // namespace net