OpenSSL: Disable ECDSA cipher suites on Windows XP.

OpenSSL: Disable ECDSA cipher suites on Windows XP.

This matches the logic in nss_ssl_util.cc.

Note: this CL has a test which only affects Windows XP. We
have no try coverage on XP, so if the XP bots break, please
revert.

BUG=405630
Committed: https://crrev.com/8ecc3071e84838f8a20a76a7caf9ae51380896ad
Cr-Commit-Position: refs/heads/master@{#293214}

[Ryan Sleevi, 2014-08-20 19:52:42]

LGTM.

Can... we add a test?

Maybe just have testserver.py dump the ClientHello and make sure it doesn't
appear?

[davidben, 2014-08-21 21:37:15]

Added a test. I'm running the try bots, but that's of limited use since we lack
XP try bots. I did test the tests manually on Linux with OpenSSL and NSS by
commenting the logic which gates everything on Windows.

[Ryan Sleevi, 2014-09-02 23:45:02]

Not LGTM.

Rather than parsing the client hello, just have the testserver.py emit the
ciphersuites in a defined format, the same way we do for the session caching
tests.

Then just parse the output.

https://codereview.chromium.org/495663002/diff/20001/net/socket/ssl_client_so...
File net/socket/ssl_client_socket_unittest.cc (right):

https://codereview.chromium.org/495663002/diff/20001/net/socket/ssl_client_so...
net/socket/ssl_client_socket_unittest.cc:2786: return false;
SSLCipherSuiteToStrings(&key_exchange, ..., cipher_suite);
return std::string(key_exchange).find("ECDSA") != std::string::npos;

[davidben, 2014-09-03 17:10:41]

Rewrote test to bounce through testserver.py

https://codereview.chromium.org/495663002/diff/20001/net/socket/ssl_client_so...
File net/socket/ssl_client_socket_unittest.cc (right):

https://codereview.chromium.org/495663002/diff/20001/net/socket/ssl_client_so...
net/socket/ssl_client_socket_unittest.cc:2786: return false;
On 2014/09/02 23:45:01, Ryan Sleevi wrote:
> SSLCipherSuiteToStrings(&key_exchange, ..., cipher_suite);
> return std::string(key_exchange).find("ECDSA") != std::string::npos;

Done.

[Ryan Sleevi, 2014-09-03 19:08:58]

LGTM % nit

https://codereview.chromium.org/495663002/diff/40001/net/url_request/url_requ...
File net/url_request/url_request_unittest.cc (right):

https://codereview.chromium.org/495663002/diff/40001/net/url_request/url_requ...
net/url_request/url_request_unittest.cc:6980: << "ClientHello advertised " <<
std::hex << cipher_suite;
Don't modify the stream like this if you don't reset it.

Reasons why iostreams are awful :)

[davidben, 2014-09-03 19:15:32]

https://codereview.chromium.org/495663002/diff/40001/net/url_request/url_requ...
File net/url_request/url_request_unittest.cc (right):

https://codereview.chromium.org/495663002/diff/40001/net/url_request/url_requ...
net/url_request/url_request_unittest.cc:6980: << "ClientHello advertised " <<
std::hex << cipher_suite;
On 2014/09/03 19:08:58, Ryan Sleevi wrote:
> Don't modify the stream like this if you don't reset it.
> 
> Reasons why iostreams are awful :)

Done.

[davidben, 2014-09-03 19:15:58]

The CQ bit was checked by davidben@chromium.org

[commit-bot: I haz the power, 2014-09-03 19:17:37]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/davidben@chromium.org/495663002/60001

[commit-bot: I haz the power, 2014-09-03 20:12:56]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  mac_gpu_retina_triggered_tests on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/mac_gpu_retina_tr...)

[commit-bot: I haz the power, 2014-09-03 23:22:43]

Committed patchset #4 (id:60001) as 7abb775e4237bc46035aaa3cf618c0221742fed9

[commit-bot: I haz the power, 2014-09-10 03:28:19]

Patchset 4 (id:??) landed as
https://crrev.com/8ecc3071e84838f8a20a76a7caf9ae51380896ad
Cr-Commit-Position: refs/heads/master@{#293214}