Add an escape hatch for the ECDSA CBC cipher removal.

net/socket/ssl_client_socket_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_impl.h"
 
 #include <errno.h>
 #include <string.h>
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
+#include "base/feature_list.h"
 #include "base/lazy_instance.h"
 #include "base/macros.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/synchronization/lock.h"
@@ skipping 185 matching lines @@
   if (base::StringToInt(base::FieldTrialList::FindFullName(field_trial),
                         &override_buffer_size)) {
     buffer_size = override_buffer_size;
     buffer_size = std::max(buffer_size, 1000);
     buffer_size = std::min(buffer_size, 2 * kDefaultOpenSSLBufferSize);
   }
 #endif  // !defined(OS_NACL)
   return buffer_size;
 }
 
+#if defined(OS_NACL)
+bool AreLegacyECDSACiphersEnabled() {
+  return false;
+}
+#else
+// TODO(davidben): Remove this after the ECDSA CBC removal sticks.

[Ryan Sleevi, 2016/11/17 04:06:28]

File a crbug? :)

Also: In addition to not working on nacl, this won't work for Chromium. Is that
a concern? Or not?

[davidben, 2016/11/17 05:15:58]

Done.
I think that's fine. This is the sort of thing where recovering from the problem
on the server (deploy AEAD ciphers) is pretty straightforward and desirable
anyway. This is just in case the volume is higher than expected and we need to
roll back. Otherwise we'll end up with these kinds of removals not affecting
Chromium.

+const base::Feature kLegacyECDSACiphersFeature{
+    "SSLLegacyECDSACiphers", base::FEATURE_DISABLED_BY_DEFAULT};
+
+bool AreLegacyECDSACiphersEnabled() {
+  return base::FeatureList::IsEnabled(kLegacyECDSACiphersFeature);
+}
+#endif
+
 }  // namespace
 
 class SSLClientSocketImpl::SSLContext {
  public:
   static SSLContext* GetInstance() {
     return base::Singleton<SSLContext>::get();
   }
   SSL_CTX* ssl_ctx() { return ssl_ctx_.get(); }
   SSLClientSessionCache* session_cache() { return &session_cache_; }
 
@@ skipping 707 matching lines @@
         "CECPQ1-RSA-CHACHA20-POLY1305-SHA256:"
         "CECPQ1-ECDSA-CHACHA20-POLY1305-SHA256:");
     if (!EVP_has_aes_hardware()) {
       command.append(
           "CECPQ1-RSA-AES256-GCM-SHA384:"
           "CECPQ1-ECDSA-AES256-GCM-SHA384:");
     }
   }
 
   // Use BoringSSL defaults, but disable HMAC-SHA256 and HMAC-SHA384 ciphers
-  // (note that SHA256 and SHA384 only select legacy CBC ciphers). Additionally
-  // disable HMAC-SHA1 ciphers in ECDSA. Also disable
+  // (note that SHA256 and SHA384 only select legacy CBC ciphers). Also disable
   // DHE_RSA_WITH_AES_256_GCM_SHA384. Historically, AES_256_GCM was not
-  // supported. As DHE is being deprecated, don't add a cipher only to remove it
-  // immediately.
+  // supported. As DHE is being deprecated, don't add a cipher only to remove
+  // it immediately.
   //
   // TODO(davidben): Remove the DHE_RSA_WITH_AES_256_GCM_SHA384 exclusion when
   // the DHEEnabled administrative policy expires.
-  command.append(
-      "ALL:!SHA256:!SHA384:!ECDSA+SHA1:!DHE-RSA-AES256-GCM-SHA384:!aPSK:!RC4");
+  command.append("ALL:!SHA256:!SHA384:!DHE-RSA-AES256-GCM-SHA384:!aPSK:!RC4");
 
   if (ssl_config_.require_ecdhe)
     command.append(":!kRSA:!kDHE");
 
   if (!ssl_config_.deprecated_cipher_suites_enabled) {
     // Only offer DHE on the second handshake. https://crbug.com/538690
     command.append(":!kDHE");
   }
 
+  // Additionally disable HMAC-SHA1 ciphers in ECDSA. These are the remaining
+  // CBC-mode ECDSA ciphers.
+  if (!AreLegacyECDSACiphersEnabled())
+    command.append("!ECDSA+SHA1");
+
   // Remove any disabled ciphers.
   for (uint16_t id : ssl_config_.disabled_cipher_suites) {
     const SSL_CIPHER* cipher = SSL_get_cipher_by_value(id);
     if (cipher) {
       command.append(":!");
       command.append(SSL_CIPHER_get_name(cipher));
     }
   }
 
   int rv = SSL_set_cipher_list(ssl_.get(), command.c_str());
@@ skipping 1025 matching lines @@
     if (ERR_GET_REASON(info->error_code) == SSL_R_TLSV1_ALERT_ACCESS_DENIED &&
         !certificate_requested_) {
       net_error = ERR_SSL_PROTOCOL_ERROR;
     }
   }
 
   return net_error;
 }
 
 }  // namespace net