net: disable ChaCha20 based cipher suites.

net/socket/nss_ssl_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/nss_ssl_util.h"
 
 #include <nss.h>
 #include <secerr.h>
 #include <ssl.h>
 #include <sslerr.h>
@@ skipping 52 matching lines @@
         if (info.symCipher == ssl_calg_camellia ||
             info.symCipher == ssl_calg_seed ||
             (info.symCipher == ssl_calg_3des && info.keaType != ssl_kea_rsa) ||
             info.authAlgorithm == ssl_auth_dsa ||
             info.macAlgorithm == ssl_hmac_sha256 ||
             info.nonStandard ||
             strcmp(info.keaTypeName, "ECDH") == 0) {
           enabled = false;
         }
 
+        // We also disable ChaCha20 based cipher suites for now because we
+        // aren't quite ready to use them in M32.
+        if (ssl_ciphers[i] == 0xcc13 || ssl_ciphers[i] == 0xcc14)

[agl, 2013/11/05 23:18:01]

We may be compiling on systems where the headers don't have calg_chacha20 so I
used the raw cipher suite numbers.

[wtc, 2013/11/05 23:38:37]

I think we use our own SSL headers in net/third_party/nss/ssl, unless we run
into include directory search order problem.

Also, it would be nice to disable the third ChaCha20 cipher suite as well. (It's
probably not yet implemented.)

[agl, 2013/11/06 19:11:23]

On 2013/11/05 23:38:37, wtc wrote:> I think we use our own SSL headers in
net/third_party/nss/ssl, unless we run
Ah, great. Have switched to match symCipher against ssl_calg_chacha20 then.

+          enabled = false;
+
         if (ssl_ciphers[i] == TLS_DHE_DSS_WITH_AES_128_CBC_SHA) {
           // Enabled to allow servers with only a DSA certificate to function.
           enabled = true;
         }
         SSL_CipherPrefSetDefault(ssl_ciphers[i], enabled);
       }
     }
 
     // Enable SSL.
     SSL_OptionSetDefault(SSL_SECURITY, PR_TRUE);
@@ skipping 188 matching lines @@
                           const char* param) {
   DCHECK(function);
   DCHECK(param);
   net_log.AddEvent(
       NetLog::TYPE_SSL_NSS_ERROR,
       base::Bind(&NetLogSSLFailedNSSFunctionCallback,
                  function, param, PR_GetError()));
 }
 
 }  // namespace net