Route key_exchange_group over to DevTools.

chrome/browser/ssl/chrome_security_state_model_client.cc

Index: chrome/browser/ssl/chrome_security_state_model_client.cc
diff --git a/chrome/browser/ssl/chrome_security_state_model_client.cc b/chrome/browser/ssl/chrome_security_state_model_client.cc
index 72bf6d6ff15f81942c291172560dd0695b76be45..30b8e4db410fc64a1605fe5217743b9ce6fc0986 100644
--- a/chrome/browser/ssl/chrome_security_state_model_client.cc
+++ b/chrome/browser/ssl/chrome_security_state_model_client.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/ssl/chrome_security_state_model_client.h"
 
+#include <openssl/ssl.h>
+
 #include <vector>
 
 #include "base/command_line.h"
@@ -112,6 +114,19 @@ void AddConnectionExplanation(
                     : l10n_util::GetStringFUTF16(IDS_CIPHER_WITH_MAC,
                                                  base::ASCIIToUTF16(cipher),
                                                  base::ASCIIToUTF16(mac));
+
+  // Include the key exchange group (previously known as curve) if specified.
+  //
+  // TODO(davidben): When TLS 1.3's new negotiation is implemented, omit the
+  // "key exchange" if empty and only display the group, which is the true key
+  // exchange. See https://crbug.com/639495.
+  if (security_info.key_exchange_group != 0) {

[estark, 2016/08/30 23:23:56]

How do you feel about adding a test to exercise this code path? (There's a unit
test file now with the obnoxiously long name
chrome_security_state_model_client_unittest.cc, though code search doesn't seem
to have picked it up yet -- or a browser test would work too.)

I dunno, though; maybe it's silly to test that every string is produced
correctly.

[davidben, 2016/09/02 21:48:05]

Done. lgarron, since Emily's OOO, could you look over the test and tweak to
AddConnectionExplanation (assuming try bots are happy...)?

[lgarron, 2016/09/02 22:45:33]

LGTM.

+    key_exchange_name = l10n_util::GetStringFUTF16(
+        IDS_SSL_KEY_EXCHANGE_WITH_GROUP, key_exchange_name,
+        base::ASCIIToUTF16(
+            SSL_get_curve_name(security_info.key_exchange_group)));
+  }
+
   if (security_info.obsolete_ssl_status == net::OBSOLETE_SSL_NONE) {
     security_style_explanations->secure_explanations.push_back(
         content::SecurityStyleExplanation(
@@ -306,6 +321,7 @@ void ChromeSecurityStateModelClient::GetVisibleSecurityState(
   state->cert_id = ssl.cert_id;
   state->cert_status = ssl.cert_status;
   state->connection_status = ssl.connection_status;
+  state->key_exchange_group = ssl.key_exchange_group;
   state->security_bits = ssl.security_bits;
   state->pkp_bypassed = ssl.pkp_bypassed;
   state->sct_verify_statuses.clear();