Add histogram for key exchange strength

net/socket/ssl_client_socket_pool.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_pool.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/values.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_proxy_client_socket.h"
 #include "net/http/http_proxy_client_socket_pool.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/socks_client_socket_pool.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/socket/transport_client_socket_pool.h"
 #include "net/ssl/ssl_cert_request_info.h"
+#include "net/ssl/ssl_cipher_suite_names.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "net/ssl/ssl_info.h"
 
 namespace net {
 
 SSLSocketParams::SSLSocketParams(
     const scoped_refptr<TransportSocketParams>& direct_params,
     const scoped_refptr<SOCKSSocketParams>& socks_proxy_params,
     const scoped_refptr<HttpProxySocketParams>& http_proxy_params,
     const HostPortPair& host_and_port,
@@ skipping 330 matching lines @@
                                100);
 
     SSLInfo ssl_info;
     bool has_ssl_info = ssl_socket_->GetSSLInfo(&ssl_info);
     DCHECK(has_ssl_info);
 
     UMA_HISTOGRAM_ENUMERATION("Net.SSLVersion", SSLConnectionStatusToVersion(
                                                     ssl_info.connection_status),
                               SSL_CONNECTION_VERSION_MAX);
 
-    UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_CipherSuite",
-                                SSLConnectionStatusToCipherSuite(
-                                    ssl_info.connection_status));
+    uint16 cipher_suite =
+        SSLConnectionStatusToCipherSuite(ssl_info.connection_status);
+    UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_CipherSuite", cipher_suite);
+
+    const char *str, *cipher_str, *mac_str;
+    bool is_aead;
+    SSLCipherSuiteToStrings(&str, &cipher_str, &mac_str, &is_aead,
+                            cipher_suite);
+    // UMA_HISTOGRAM_... macros cache the Histogram instance and thus only work

[agl, 2015/08/26 17:28:02]

What decision are we going to make with this data?

Also, we don't support DH or ECDH cipher suites.

[sigbjorn, 2015/08/27 14:51:38]

For now, as long as DH is still supported (for however long that may be), it
will help make decisions about how to treat DH, in particular DH 1024. It will
also give data points which may be used in determining when and how to deprecate
DH.
For RSA, the information is available elsewhere, and already histogrammed. I
don't know what RSA information is used for, but presumably there is a need for
it.
This information is currently not available elsewhere for ECDH. The distribution
of curves is not equal, knowing which are used is interesting information, even
if no actions are yet planned based on the knowledge.

In general, this is raw data, available for use in whichever way is fit.
Removed

+    // if the histogram name is constant, so don't generate it dynamically.
+    if (strncmp(str, "RSA", 3) == 0) {
+      UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_KeyExchange.RSA",
+                                  ssl_info.key_exchange_info);
+    } else if (strncmp(str, "DHE", 3) == 0) {
+      UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_KeyExchange.DHE",
+                                  ssl_info.key_exchange_info);
+    } else if (strncmp(str, "DH", 2) == 0) {
+      UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_KeyExchange.DH",
+                                  ssl_info.key_exchange_info);
+    } else if (strncmp(str, "ECDHE", 5) == 0) {
+      UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_KeyExchange.ECDHE",
+                                  ssl_info.key_exchange_info);
+    } else if (strncmp(str, "ECDH", 4) == 0) {
+      UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_KeyExchange.ECDH",
+                                  ssl_info.key_exchange_info);
+    } else {
+      UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSL_KeyExchange.Unknown",
+                                  ssl_info.key_exchange_info);
+    }
 
     if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_RESUME) {
       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Resume_Handshake",
                                  connect_duration,
                                  base::TimeDelta::FromMilliseconds(1),
                                  base::TimeDelta::FromMinutes(1),
                                  100);
     } else if (ssl_info.handshake_type == SSLInfo::HANDSHAKE_FULL) {
       UMA_HISTOGRAM_CUSTOM_TIMES("Net.SSL_Connection_Latency_Full_Handshake",
                                  connect_duration,
@@ skipping 274 matching lines @@
   if (base_.CloseOneIdleSocket())
     return true;
   return base_.CloseOneIdleConnectionInHigherLayeredPool();
 }
 
 void SSLClientSocketPool::OnSSLConfigChanged() {
   FlushWithError(ERR_NETWORK_CHANGED);
 }
 
 }  // namespace net