ssl_cipher_suite_names.cc 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/ssl/ssl_cipher_suite_names.h"
  5. #include <ostream>
  6. #include "base/notreached.h"
  7. #include "base/strings/string_number_conversions.h"
  8. #include "base/strings/string_util.h"
  9. #include "net/ssl/ssl_connection_status_flags.h"
  10. #include "third_party/boringssl/src/include/openssl/ssl.h"
  11. namespace net {
  12. namespace {
  13. int ObsoleteSSLStatusForProtocol(int ssl_version) {
  14. int obsolete_ssl = OBSOLETE_SSL_NONE;
  15. if (ssl_version < SSL_CONNECTION_VERSION_TLS1_2)
  16. obsolete_ssl |= OBSOLETE_SSL_MASK_PROTOCOL;
  17. return obsolete_ssl;
  18. }
  19. int ObsoleteSSLStatusForCipherSuite(uint16_t cipher_suite) {
  20. int obsolete_ssl = OBSOLETE_SSL_NONE;
  21. const SSL_CIPHER* cipher = SSL_get_cipher_by_value(cipher_suite);
  22. if (!cipher) {
  23. // Cannot determine/unknown cipher suite. Err on the side of caution.
  24. obsolete_ssl |= OBSOLETE_SSL_MASK_KEY_EXCHANGE;
  25. obsolete_ssl |= OBSOLETE_SSL_MASK_CIPHER;
  26. return obsolete_ssl;
  27. }
  28. if (SSL_CIPHER_get_kx_nid(cipher) == NID_kx_rsa) {
  29. obsolete_ssl |= OBSOLETE_SSL_MASK_KEY_EXCHANGE;
  30. }
  31. if (!SSL_CIPHER_is_aead(cipher)) {
  32. obsolete_ssl |= OBSOLETE_SSL_MASK_CIPHER;
  33. }
  34. return obsolete_ssl;
  35. }
  36. int ObsoleteSSLStatusForSignature(uint16_t signature_algorithm) {
  37. switch (signature_algorithm) {
  38. case SSL_SIGN_ECDSA_SHA1:
  39. case SSL_SIGN_RSA_PKCS1_MD5_SHA1:
  40. case SSL_SIGN_RSA_PKCS1_SHA1:
  41. return OBSOLETE_SSL_MASK_SIGNATURE;
  42. default:
  43. return OBSOLETE_SSL_NONE;
  44. }
  45. }
  46. } // namespace
  47. void SSLCipherSuiteToStrings(const char** key_exchange_str,
  48. const char** cipher_str,
  49. const char** mac_str,
  50. bool* is_aead,
  51. bool* is_tls13,
  52. uint16_t cipher_suite) {
  53. *key_exchange_str = *cipher_str = *mac_str = "???";
  54. *is_aead = false;
  55. *is_tls13 = false;
  56. const SSL_CIPHER* cipher = SSL_get_cipher_by_value(cipher_suite);
  57. if (!cipher)
  58. return;
  59. switch (SSL_CIPHER_get_kx_nid(cipher)) {
  60. case NID_kx_any:
  61. *key_exchange_str = nullptr;
  62. *is_tls13 = true;
  63. break;
  64. case NID_kx_rsa:
  65. *key_exchange_str = "RSA";
  66. break;
  67. case NID_kx_ecdhe:
  68. switch (SSL_CIPHER_get_auth_nid(cipher)) {
  69. case NID_auth_rsa:
  70. *key_exchange_str = "ECDHE_RSA";
  71. break;
  72. case NID_auth_ecdsa:
  73. *key_exchange_str = "ECDHE_ECDSA";
  74. break;
  75. }
  76. break;
  77. }
  78. switch (SSL_CIPHER_get_cipher_nid(cipher)) {
  79. case NID_aes_128_gcm:
  80. *cipher_str = "AES_128_GCM";
  81. break;
  82. case NID_aes_256_gcm:
  83. *cipher_str = "AES_256_GCM";
  84. break;
  85. case NID_chacha20_poly1305:
  86. *cipher_str = "CHACHA20_POLY1305";
  87. break;
  88. case NID_aes_128_cbc:
  89. *cipher_str = "AES_128_CBC";
  90. break;
  91. case NID_aes_256_cbc:
  92. *cipher_str = "AES_256_CBC";
  93. break;
  94. case NID_des_ede3_cbc:
  95. *cipher_str = "3DES_EDE_CBC";
  96. break;
  97. }
  98. if (SSL_CIPHER_is_aead(cipher)) {
  99. *is_aead = true;
  100. *mac_str = nullptr;
  101. } else {
  102. switch (SSL_CIPHER_get_digest_nid(cipher)) {
  103. case NID_sha1:
  104. *mac_str = "HMAC-SHA1";
  105. break;
  106. case NID_sha256:
  107. *mac_str = "HMAC-SHA256";
  108. break;
  109. case NID_sha384:
  110. *mac_str = "HMAC-SHA384";
  111. break;
  112. }
  113. }
  114. }
  115. void SSLVersionToString(const char** name, int ssl_version) {
  116. switch (ssl_version) {
  117. case SSL_CONNECTION_VERSION_SSL2:
  118. *name = "SSL 2.0";
  119. break;
  120. case SSL_CONNECTION_VERSION_SSL3:
  121. *name = "SSL 3.0";
  122. break;
  123. case SSL_CONNECTION_VERSION_TLS1:
  124. *name = "TLS 1.0";
  125. break;
  126. case SSL_CONNECTION_VERSION_TLS1_1:
  127. *name = "TLS 1.1";
  128. break;
  129. case SSL_CONNECTION_VERSION_TLS1_2:
  130. *name = "TLS 1.2";
  131. break;
  132. case SSL_CONNECTION_VERSION_TLS1_3:
  133. *name = "TLS 1.3";
  134. break;
  135. case SSL_CONNECTION_VERSION_QUIC:
  136. *name = "QUIC";
  137. break;
  138. default:
  139. NOTREACHED() << ssl_version;
  140. *name = "???";
  141. break;
  142. }
  143. }
  144. bool ParseSSLCipherString(const std::string& cipher_string,
  145. uint16_t* cipher_suite) {
  146. int value = 0;
  147. if (cipher_string.size() == 6 &&
  148. base::StartsWith(cipher_string, "0x",
  149. base::CompareCase::INSENSITIVE_ASCII) &&
  150. base::HexStringToInt(cipher_string, &value)) {
  151. *cipher_suite = static_cast<uint16_t>(value);
  152. return true;
  153. }
  154. return false;
  155. }
  156. int ObsoleteSSLStatus(int connection_status, uint16_t signature_algorithm) {
  157. int obsolete_ssl = OBSOLETE_SSL_NONE;
  158. int ssl_version = SSLConnectionStatusToVersion(connection_status);
  159. obsolete_ssl |= ObsoleteSSLStatusForProtocol(ssl_version);
  160. uint16_t cipher_suite = SSLConnectionStatusToCipherSuite(connection_status);
  161. obsolete_ssl |= ObsoleteSSLStatusForCipherSuite(cipher_suite);
  162. obsolete_ssl |= ObsoleteSSLStatusForSignature(signature_algorithm);
  163. return obsolete_ssl;
  164. }
  165. bool IsTLSCipherSuiteAllowedByHTTP2(uint16_t cipher_suite) {
  166. return ObsoleteSSLStatusForCipherSuite(cipher_suite) == OBSOLETE_SSL_NONE;
  167. }
  168. } // namespace net