Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(359)

Side by Side Diff: net/ssl/ssl_cipher_suite_names.cc

Issue 291093002: Fail the SPDY transaction if it does not meet TLS base requirements. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Address forgotten comment. Created 6 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « net/ssl/ssl_cipher_suite_names.h ('k') | net/ssl/ssl_cipher_suite_names_unittest.cc » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "net/ssl/ssl_cipher_suite_names.h" 5 #include "net/ssl/ssl_cipher_suite_names.h"
6 6
7 #include <stdlib.h> 7 #include <stdlib.h>
8 8
9 #include "base/logging.h" 9 #include "base/logging.h"
10 #include "base/strings/string_number_conversions.h" 10 #include "base/strings/string_number_conversions.h"
(...skipping 327 matching lines...) Expand 10 before | Expand all | Expand 10 after
338 int value = 0; 338 int value = 0;
339 if (cipher_string.size() == 6 && 339 if (cipher_string.size() == 6 &&
340 StartsWithASCII(cipher_string, "0x", false /* case insensitive */) && 340 StartsWithASCII(cipher_string, "0x", false /* case insensitive */) &&
341 base::HexStringToInt(cipher_string, &value)) { 341 base::HexStringToInt(cipher_string, &value)) {
342 *cipher_suite = static_cast<uint16>(value); 342 *cipher_suite = static_cast<uint16>(value);
343 return true; 343 return true;
344 } 344 }
345 return false; 345 return false;
346 } 346 }
347 347
348 bool IsSecureTLSCipherSuite(uint16 cipher_suite) {
349 CipherSuite desired = {0};
350 desired.cipher_suite = cipher_suite;
351
352 void* r = bsearch(&desired,
353 kCipherSuites,
354 arraysize(kCipherSuites),
355 sizeof(kCipherSuites[0]),
356 CipherSuiteCmp);
357
358 if (!r)
359 return false;
360
361 const CipherSuite* cs = static_cast<const CipherSuite*>(r);
362
363 const int key_exchange = cs->encoded >> 8;
364 const int cipher = (cs->encoded >> 3) & 0x1f;
365 const int mac = cs->encoded & 0x7;
366
367 // Only allow forward secure key exchanges.
368 switch (key_exchange) {
369 case 10: // DHE_RSA
370 case 14: // ECDHE_ECDSA
371 case 16: // ECDHE_RSA
372 break;
373 default:
374 return false;
375 }
376
377 switch (cipher) {
378 case 13: // AES_128_GCM
379 case 14: // AES_256_GCM
380 case 17: // CHACHA20_POLY1305
381 break;
382 default:
383 return false;
384 }
385
386 // Only AEADs allowed.
387 if (mac != kAEADMACValue)
388 return false;
389
390 return true;
391 }
392
348 } // namespace net 393 } // namespace net
OLDNEW
« no previous file with comments | « net/ssl/ssl_cipher_suite_names.h ('k') | net/ssl/ssl_cipher_suite_names_unittest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698