Unwind ECDSA CBC escape hatch.

net/socket/ssl_client_socket_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_impl.h"
 
 #include <errno.h>
 #include <string.h>
 
 #include <algorithm>
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
-#include "base/feature_list.h"
 #include "base/lazy_instance.h"
 #include "base/macros.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/stringprintf.h"
@@ skipping 186 matching lines @@
   if (base::StringToInt(base::FieldTrialList::FindFullName(field_trial),
                         &override_buffer_size)) {
     buffer_size = override_buffer_size;
     buffer_size = std::max(buffer_size, 1000);
     buffer_size = std::min(buffer_size, 2 * kDefaultOpenSSLBufferSize);
   }
 #endif  // !defined(OS_NACL)
   return buffer_size;
 }
 
-#if defined(OS_NACL)
-bool AreLegacyECDSACiphersEnabled() {
-  return false;
-}
-#else
-// TODO(davidben): Remove this after the ECDSA CBC removal sticks.
-// https:/crbug.com/666191.
-const base::Feature kLegacyECDSACiphersFeature{
-    "SSLLegacyECDSACiphers", base::FEATURE_DISABLED_BY_DEFAULT};
-
-bool AreLegacyECDSACiphersEnabled() {
-  return base::FeatureList::IsEnabled(kLegacyECDSACiphersFeature);
-}
-#endif
-
 scoped_refptr<X509Certificate> OSChainFromBuffers(STACK_OF(CRYPTO_BUFFER) *
                                                   openssl_chain) {
   if (sk_CRYPTO_BUFFER_num(openssl_chain) == 0) {
     NOTREACHED();
     return nullptr;
   }
 
   // Convert the certificate chains to a platform certificate handle.
   std::vector<base::StringPiece> der_chain;
   der_chain.reserve(sk_CRYPTO_BUFFER_num(openssl_chain));
@@ skipping 675 matching lines @@
   mode.ConfigureFlag(SSL_MODE_CBC_RECORD_SPLITTING, true);
 
   mode.ConfigureFlag(SSL_MODE_ENABLE_FALSE_START,
                      ssl_config_.false_start_enabled);
 
   SSL_set_mode(ssl_.get(), mode.set_mask);
   SSL_clear_mode(ssl_.get(), mode.clear_mask);
 
   // Use BoringSSL defaults, but disable HMAC-SHA256 and HMAC-SHA384 ciphers
   // (note that SHA256 and SHA384 only select legacy CBC ciphers).
-  std::string command("ALL:!SHA256:!SHA384:!kDHE:!aPSK:!RC4");
+  // Additionally disable HMAC-SHA1 ciphers in ECDSA. These are the remaining
+  // CBC-mode ECDSA ciphers.
+  std::string command("ALL:!SHA256:!SHA384:!kDHE:!aPSK:!RC4:!ECDSA+SHA1");
 
   if (ssl_config_.require_ecdhe)
     command.append(":!kRSA:!kDHE");
 
-  // Additionally disable HMAC-SHA1 ciphers in ECDSA. These are the remaining
-  // CBC-mode ECDSA ciphers.
-  if (!AreLegacyECDSACiphersEnabled())
-    command.append("!ECDSA+SHA1");
-
   // Remove any disabled ciphers.
   for (uint16_t id : ssl_config_.disabled_cipher_suites) {
     const SSL_CIPHER* cipher = SSL_get_cipher_by_value(id);
     if (cipher) {
       command.append(":!");
       command.append(SSL_CIPHER_get_name(cipher));
     }
   }
 
   int rv = SSL_set_cipher_list(ssl_.get(), command.c_str());
@@ skipping 1010 matching lines @@
     if (ERR_GET_REASON(info->error_code) == SSL_R_TLSV1_ALERT_ACCESS_DENIED &&
         !certificate_requested_) {
       net_error = ERR_SSL_PROTOCOL_ERROR;
     }
   }
 
   return net_error;
 }
 
 }  // namespace net