net: disable ChaCha20 based cipher suites.

net/socket/nss_ssl_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/nss_ssl_util.h"
 
 #include <nss.h>
 #include <secerr.h>
 #include <ssl.h>
 #include <sslerr.h>
@@ skipping 43 matching lines @@
       if (SSL_GetCipherSuiteInfo(ssl_ciphers[i], &info,
                                  sizeof(info)) == SECSuccess) {
         bool enabled = info.effectiveKeyBits >= 80;
         if (info.authAlgorithm == ssl_auth_ecdsa && disableECDSA)
           enabled = false;
 
         // Trim the list of cipher suites in order to keep the size of the
         // ClientHello down. DSS, ECDH, CAMELLIA, SEED, ECC+3DES, and
         // HMAC-SHA256 cipher suites are disabled.
         if (info.symCipher == ssl_calg_camellia ||
             info.symCipher == ssl_calg_seed ||

[wtc, 2013/11/06 19:18:40]

We can also move the info.symCipher == ssl_calg_chacha20 check here, unless you
want to make it easier to revert this change.

             (info.symCipher == ssl_calg_3des && info.keaType != ssl_kea_rsa) ||
             info.authAlgorithm == ssl_auth_dsa ||
             info.macAlgorithm == ssl_hmac_sha256 ||
             info.nonStandard ||
             strcmp(info.keaTypeName, "ECDH") == 0) {
           enabled = false;
         }
 
+        // We also disable ChaCha20 based cipher suites for now because we
+        // aren't quite ready to use them in M32.
+        if (info.symCipher == ssl_calg_chacha20)
+          enabled = false;
+
         if (ssl_ciphers[i] == TLS_DHE_DSS_WITH_AES_128_CBC_SHA) {
           // Enabled to allow servers with only a DSA certificate to function.
           enabled = true;
         }
         SSL_CipherPrefSetDefault(ssl_ciphers[i], enabled);
       }
     }
 
     // Enable SSL.
     SSL_OptionSetDefault(SSL_SECURITY, PR_TRUE);
@@ skipping 188 matching lines @@
                           const char* param) {
   DCHECK(function);
   DCHECK(param);
   net_log.AddEvent(
       NetLog::TYPE_SSL_NSS_ERROR,
       base::Bind(&NetLogSSLFailedNSSFunctionCallback,
                  function, param, PR_GetError()));
 }
 
 }  // namespace net