Expose OpenSSL's key_exchange_info in the content API

net/ssl/ssl_cipher_suite_names.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/ssl_cipher_suite_names.h"
 
+#if defined(USE_OPENSSL)
+#include <openssl/ssl.h>
+#endif
 #include <stdlib.h>
 
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 
 // Rather than storing the names of all the ciphersuites we eliminate the
 // redundancy and break each cipher suite into a key exchange method, cipher
 // and mac. For all the ciphersuites in the IANA registry, we extract each of
@@ skipping 395 matching lines @@
       return false;
   }
 
   // Only AEADs allowed.
   if (mac != kAEADMACValue)
     return false;
 
   return true;
 }
 
+const char* ECCurveName(uint16 cipher_suite, int key_exchange_info) {
+  int key_exchange, cipher, mac;
+  if (!GetCipherProperties(cipher_suite, &key_exchange, &cipher, &mac))

[Ryan Sleevi, 2015/09/02 01:37:07]

Why do this lookup for non-OpenSSL cases?

[sigbjorn, 2015/09/02 13:42:14]

Done.

+    return NULL;

[Ryan Sleevi, 2015/09/02 01:37:07]

nullptr throughout.

[sigbjorn, 2015/09/02 13:42:14]

Done.

+  switch (key_exchange) {
+    case 14:  // ECDHE_ECDSA
+    case 16:  // ECDHE_RSA

[Ryan Sleevi, 2015/09/02 01:37:07]

This seems very brittle; I guess it's contingent upon whether or not the two
methods above are auto-generated.

[sigbjorn, 2015/09/02 13:42:14]

I don't know if the methods above are generated, the mentioned .go file isn't in
my checkout, and old versions did not generate any c++ code.

To avoid the code duplication I can create an anonymous helper function
IsECDHE(), and use that throughout. That would only mess things up if the code
is autogenerated though.

A solution which is brittle in other places instead, is to skip this check
entirely, and always pass |key_exchange_info| to SSL_get_curve_name(). As
|key_exchange_info| either contains an enum, or a bit strength (which' value is
>> enum values), a nullptr will in practice be returned for non-EC key exchanges
anyhow.

Up to you.

+      break;
+    default:
+      return NULL;
+  }
+#if defined(USE_OPENSSL)

[Ryan Sleevi, 2015/09/02 01:37:07]

newline between 435/436 for legibility.

[sigbjorn, 2015/09/02 13:42:14]

Code changed.

+  return SSL_get_curve_name(key_exchange_info);
+#endif
+  return NULL;
+}
+
 }  // namespace net