Expose TLS settings in the Security panel overview, and call out individual obsolete settings.

net/ssl/ssl_cipher_suite_names.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/ssl_cipher_suite_names.h"
 
 #if defined(USE_OPENSSL)
 #include <openssl/ssl.h>
 #endif
 #include <stdlib.h>
@@ skipping 278 matching lines @@
   if (!r)
     return false;
 
   const CipherSuite* cs = static_cast<const CipherSuite*>(r);
   *out_key_exchange = cs->encoded >> 8;
   *out_cipher = (cs->encoded >> 3) & 0x1f;
   *out_mac = cs->encoded & 0x7;
   return true;
 }
 
+int ObsoleteSSLStatusForProtocol(int ssl_version) {
+  int obsolete_ssl = net::OBSOLETE_SSL_NONE;
+  if (ssl_version < net::SSL_CONNECTION_VERSION_TLS1_2) {

[estark, 2016/04/18 11:46:44]

nit: no curly braces

[lgarron, 2016/04/25 23:56:54]

Done.

+    obsolete_ssl |= net::OBSOLETE_SSL_MASK_PROTOCOL;
+  }
+  return obsolete_ssl;
+}
+
+int ObsoleteSSLStatusForCipherSuite(uint16_t cipher_suite) {
+  int obsolete_ssl = net::OBSOLETE_SSL_NONE;
+
+  int key_exchange, cipher, mac;
+  if (!GetCipherProperties(cipher_suite, &key_exchange, &cipher, &mac)) {
+    // Cannot determine/unknown cipher suite. Err on the side of caution.
+    obsolete_ssl |= net::OBSOLETE_SSL_MASK_KEY_EXCHANGE;
+    obsolete_ssl |= net::OBSOLETE_SSL_MASK_CIPHER;
+    return obsolete_ssl;
+  }
+
+  // Only allow ECDHE key exchanges.
+  switch (key_exchange) {
+    case 14:  // ECDHE_ECDSA
+    case 16:  // ECDHE_RSA
+      break;
+    default:
+      obsolete_ssl |= net::OBSOLETE_SSL_MASK_KEY_EXCHANGE;
+  }
+
+  switch (cipher) {
+    case 13:  // AES_128_GCM
+    case 14:  // AES_256_GCM
+    case 17:  // CHACHA20_POLY1305
+      break;
+    default:
+      obsolete_ssl |= net::OBSOLETE_SSL_MASK_CIPHER;
+  }
+
+  // Only AEADs allowed.
+  if (mac != kAEADMACValue)
+    obsolete_ssl |= net::OBSOLETE_SSL_MASK_CIPHER;
+
+  return obsolete_ssl;
+}
+
 }  // namespace
 
 namespace net {
 
 void SSLCipherSuiteToStrings(const char** key_exchange_str,
                              const char** cipher_str,
                              const char** mac_str,
                              bool* is_aead,
                              uint16_t cipher_suite) {
   *key_exchange_str = *cipher_str = *mac_str = "???";
@@ skipping 46 matching lines @@
   if (cipher_string.size() == 6 &&
       base::StartsWith(cipher_string, "0x",
                        base::CompareCase::INSENSITIVE_ASCII) &&
       base::HexStringToInt(cipher_string, &value)) {
     *cipher_suite = static_cast<uint16_t>(value);
     return true;
   }
   return false;
 }
 
-bool IsSecureTLSCipherSuite(uint16_t cipher_suite) {
-  int key_exchange, cipher, mac;
-  if (!GetCipherProperties(cipher_suite, &key_exchange, &cipher, &mac))
-    return false;
+int ObsoleteSSLStatus(int connection_status) {
+  int obsolete_ssl = OBSOLETE_SSL_NONE;
 
-  // Only allow ECDHE key exchanges.
-  switch (key_exchange) {
-    case 14:  // ECDHE_ECDSA
-    case 16:  // ECDHE_RSA
-      break;
-    default:
-      return false;
-  }
+  int ssl_version = SSLConnectionStatusToVersion(connection_status);
+  obsolete_ssl |= ObsoleteSSLStatusForProtocol(ssl_version);
 
-  switch (cipher) {
-    case 13:  // AES_128_GCM
-    case 14:  // AES_256_GCM
-    case 17:  // CHACHA20_POLY1305
-      break;
-    default:
-      return false;
-  }
+  uint16_t cipher_suite = SSLConnectionStatusToCipherSuite(connection_status);
+  obsolete_ssl |= ObsoleteSSLStatusForCipherSuite(cipher_suite);
 
-  // Only AEADs allowed.
-  if (mac != kAEADMACValue)
-    return false;
+  return obsolete_ssl;
+}
 
-  return true;
+bool IsObsoleteTLSCipherSuite(int cipher_suite) {
+  return ObsoleteSSLStatusForCipherSuite(cipher_suite) != OBSOLETE_SSL_NONE;
 }
 
 bool IsTLSCipherSuiteAllowedByHTTP2(uint16_t cipher_suite) {
   int key_exchange, cipher, mac;
   if (!GetCipherProperties(cipher_suite, &key_exchange, &cipher, &mac))
     return false;
 
   // Only allow forward secure key exchanges.
   switch (key_exchange) {
     case 10:  // DHE_RSA
@@ skipping 32 matching lines @@
     default:
       return nullptr;
   }
   return SSL_get_curve_name(key_exchange_info);
 #else
   return nullptr;
 #endif
 }
 
 }  // namespace net