Disable DSS ciphers in the NSS port.

net/socket/nss_ssl_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/nss_ssl_util.h"
 
 #include <nss.h>
 #include <secerr.h>
 #include <ssl.h>
 #include <sslerr.h>
@@ skipping 90 matching lines @@
 
     // Disable ECDSA cipher suites on platforms that do not support ECDSA
     // signed certificates, as servers may use the presence of such
     // ciphersuites as a hint to send an ECDSA certificate.
     bool disableECDSA = false;
 #if defined(OS_WIN)
     if (base::win::GetVersion() < base::win::VERSION_VISTA)
       disableECDSA = true;
 #endif
 
-    // Explicitly enable exactly those ciphers with keys of at least 80 bits
+    // Explicitly enable exactly those ciphers with keys of at least 80 bits.
     for (int i = 0; i < num_ciphers; i++) {
       SSLCipherSuiteInfo info;
       if (SSL_GetCipherSuiteInfo(ssl_ciphers[i], &info,
                                  sizeof(info)) == SECSuccess) {
         bool enabled = info.effectiveKeyBits >= 80;
         if (info.authAlgorithm == ssl_auth_ecdsa && disableECDSA)
           enabled = false;
 
         // Trim the list of cipher suites in order to keep the size of the
         // ClientHello down. DSS, ECDH, CAMELLIA, SEED, ECC+3DES, and
         // HMAC-SHA256 cipher suites are disabled.
         if (info.symCipher == ssl_calg_camellia ||
             info.symCipher == ssl_calg_seed ||
             (info.symCipher == ssl_calg_3des && info.keaType != ssl_kea_rsa) ||
             info.authAlgorithm == ssl_auth_dsa ||
             info.macAlgorithm == ssl_hmac_sha256 ||
             info.nonStandard ||
             strcmp(info.keaTypeName, "ECDH") == 0) {
           enabled = false;
         }
 
-        if (ssl_ciphers[i] == TLS_DHE_DSS_WITH_AES_128_CBC_SHA) {
-          // Enabled to allow servers with only a DSA certificate to function.
-          enabled = true;
-        }
         SSL_CipherPrefSetDefault(ssl_ciphers[i], enabled);
       }
     }
 
     // Enable SSL.
     SSL_OptionSetDefault(SSL_SECURITY, PR_TRUE);
 
     // Calculate the order of ciphers that we'll use for NSS sockets. (Note
     // that, even if a cipher is specified in the ordering, it must still be
     // enabled in order to be included in a ClientHello.)
@@ skipping 261 matching lines @@
       base::Bind(&NetLogSSLFailedNSSFunctionCallback,
                  function, param, PR_GetError()));
 }
 
 NetLog::ParametersCallback CreateNetLogSSLErrorCallback(int net_error,
                                                         int ssl_lib_error) {
   return base::Bind(&NetLogSSLErrorCallback, net_error, ssl_lib_error);
 }
 
 }  // namespace net