net: disable ChaCha20 based cipher suites.

net/socket/nss_ssl_util.cc

Index: net/socket/nss_ssl_util.cc
diff --git a/net/socket/nss_ssl_util.cc b/net/socket/nss_ssl_util.cc
index 7e3aee430c4417353bca38270ea2f4564e90a0e0..40921078b0feec1e1290e1e887598ddcb5fdf99e 100644
--- a/net/socket/nss_ssl_util.cc
+++ b/net/socket/nss_ssl_util.cc
@@ -70,6 +70,11 @@ class NSSSSLInitSingleton {
           enabled = false;
         }
 
+        // We also disable ChaCha20 based cipher suites for now because we
+        // aren't quite ready to use them in M32.
+        if (ssl_ciphers[i] == 0xcc13 || ssl_ciphers[i] == 0xcc14)

[agl, 2013/11/05 23:18:01]

We may be compiling on systems where the headers don't have calg_chacha20 so I
used the raw cipher suite numbers.

[wtc, 2013/11/05 23:38:37]

I think we use our own SSL headers in net/third_party/nss/ssl, unless we run
into include directory search order problem.

Also, it would be nice to disable the third ChaCha20 cipher suite as well. (It's
probably not yet implemented.)

[agl, 2013/11/06 19:11:23]

On 2013/11/05 23:38:37, wtc wrote:> I think we use our own SSL headers in
net/third_party/nss/ssl, unless we run
Ah, great. Have switched to match symCipher against ssl_calg_chacha20 then.

+          enabled = false;
+
         if (ssl_ciphers[i] == TLS_DHE_DSS_WITH_AES_128_CBC_SHA) {
           // Enabled to allow servers with only a DSA certificate to function.
           enabled = true;