Roll src/third_party/boringssl/src 0d81373f9..1991af690

chrome/browser/ssl/chrome_security_state_model_client.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ssl/chrome_security_state_model_client.h"
 
 #include <openssl/ssl.h>
 
 #include <vector>
 
@@ skipping 89 matching lines @@
   }
 
   int ssl_version =
       net::SSLConnectionStatusToVersion(security_info.connection_status);
   const char* protocol;
   net::SSLVersionToString(&protocol, ssl_version);
   const char* key_exchange;
   const char* cipher;
   const char* mac;
   bool is_aead;
+  bool is_tls13;
   uint16_t cipher_suite =
       net::SSLConnectionStatusToCipherSuite(security_info.connection_status);
   net::SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead,
-                               cipher_suite);
+                               &is_tls13, cipher_suite);
   base::string16 protocol_name = base::ASCIIToUTF16(protocol);
-  base::string16 key_exchange_name = base::ASCIIToUTF16(key_exchange);
   const base::string16 cipher_name =
       (mac == NULL) ? base::ASCIIToUTF16(cipher)
                     : l10n_util::GetStringFUTF16(IDS_CIPHER_WITH_MAC,
                                                  base::ASCIIToUTF16(cipher),
                                                  base::ASCIIToUTF16(mac));
 
   // Include the key exchange group (previously known as curve) if specified.
-  //
-  // TODO(davidben): When TLS 1.3's new negotiation is implemented, omit the
-  // "key exchange" if empty and only display the group, which is the true key
-  // exchange. See https://crbug.com/639495.
-  if (security_info.key_exchange_group != 0) {
+  base::string16 key_exchange_name;
+  if (is_tls13) {
+    key_exchange_name = base::ASCIIToUTF16(
+        SSL_get_curve_name(security_info.key_exchange_group));
+  } else if (security_info.key_exchange_group != 0) {
     key_exchange_name = l10n_util::GetStringFUTF16(
-        IDS_SSL_KEY_EXCHANGE_WITH_GROUP, key_exchange_name,
+        IDS_SSL_KEY_EXCHANGE_WITH_GROUP, base::ASCIIToUTF16(key_exchange),
         base::ASCIIToUTF16(
             SSL_get_curve_name(security_info.key_exchange_group)));
+  } else {

[felt, 2016/10/10 21:31:28]

Why do we need this else catch-all now?

[davidben, 2016/10/10 21:38:19]

It's because line 115 (on LHS) is gone. base::ASCIIToUTF16 seems to be fine with
NULLs (treats as empty string), but it seemed poor to pass it in nonetheless.

[felt, 2016/10/10 22:04:07]

Oh, right.

+    key_exchange_name = base::ASCIIToUTF16(key_exchange);
   }
 
   if (security_info.obsolete_ssl_status == net::OBSOLETE_SSL_NONE) {
     security_style_explanations->secure_explanations.push_back(
         content::SecurityStyleExplanation(
             l10n_util::GetStringUTF8(IDS_STRONG_SSL_SUMMARY),
             l10n_util::GetStringFUTF8(IDS_STRONG_SSL_DESCRIPTION, protocol_name,
                                       key_exchange_name, cipher_name)));
     return;
   }
@@ skipping 251 matching lines @@
       !!(ssl.content_status & content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS);
   state->displayed_password_field_on_http =
       !!(ssl.content_status &
          content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP);
   state->displayed_credit_card_field_on_http =
       !!(ssl.content_status &
          content::SSLStatus::DISPLAYED_CREDIT_CARD_FIELD_ON_HTTP);
 
   CheckSafeBrowsingStatus(entry, web_contents_, state);
 }