Uprev NSS to 3.23 on iOS

net/socket/nss_ssl_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/nss_ssl_util.h"
 
 #include <nss.h>
 #include <secerr.h>
 #include <ssl.h>
 #include <sslerr.h>
@@ skipping 130 matching lines @@
 
     // Calculate the order of ciphers that we'll use for NSS sockets. (Note
     // that, even if a cipher is specified in the ordering, it must still be
     // enabled in order to be included in a ClientHello.)
     //
     // Our top preference cipher suites are either forward-secret AES-GCM or
     // forward-secret ChaCha20-Poly1305. If the local machine has AES-NI then
     // we prefer AES-GCM, otherwise ChaCha20. The remainder of the cipher suite
     // preference is inheriented from NSS. */
     static const uint16_t chacha_ciphers[] = {
-        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
-        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, 0,
+        TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+        TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+        TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, 0,
     };
     static const uint16_t aes_gcm_ciphers[] = {
         TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
         TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
         TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, 0,
     };
     scoped_ptr<uint16_t[]> ciphers(new uint16_t[num_ciphers]);
     memcpy(ciphers.get(), ssl_ciphers, sizeof(uint16_t) * num_ciphers);
 
     if (CiphersRemove(chacha_ciphers, ciphers.get(), num_ciphers) &&
@@ skipping 239 matching lines @@
       base::Bind(&NetLogSSLFailedNSSFunctionCallback,
                  function, param, PR_GetError()));
 }
 
 NetLog::ParametersCallback CreateNetLogSSLErrorCallback(int net_error,
                                                         int ssl_lib_error) {
   return base::Bind(&NetLogSSLErrorCallback, net_error, ssl_lib_error);
 }
 
 }  // namespace net