Support generation of EC keys using P256 curve and support ECDSA certs.

webrtc/base/nssstreamadapter.cc

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 52 matching lines @@
   {"AES_CM_128_HMAC_SHA1_80", SRTP_AES128_CM_HMAC_SHA1_80 },
   {"AES_CM_128_HMAC_SHA1_32", SRTP_AES128_CM_HMAC_SHA1_32 },
   {NULL, 0}
 };
 #endif
 
 // Ciphers to enable to get ECDHE encryption with endpoints that support it.
 static const uint32_t kEnabledCiphers[] = {
   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
   TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+  TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,

[juberti1, 2015/06/26 19:16:01]

this should be ECDHE

[torbjorng (webrtc), 2015/07/02 12:35:07]

Done.

+  TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA

[juberti1, 2015/06/26 19:16:01]

we don't want the AES-256 variant. this should be
 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

[torbjorng (webrtc), 2015/07/02 12:35:07]

Done.

 };
 
 // Default cipher used between NSS stream adapters.
 // This needs to be updated when the default of the SSL library changes.
 static const char kDefaultSslCipher10[] =
     "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA";
 static const char kDefaultSslCipher12[] =
     "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256";
 
 
@@ skipping 405 matching lines @@
 
     if (identity_.get()) {
       identity = static_cast<NSSIdentity *>(identity_.get());
     } else {
       LOG(LS_ERROR) << "Can't be an SSL server without an identity";
       Error("BeginSSL", -1, false);
       return -1;
     }
     rv = SSL_ConfigSecureServer(ssl_fd_, identity->certificate().certificate(),
                                 identity->keypair()->privkey(),
-                                kt_rsa);
+                                identity->keypair()->ssl_kea_type());
     if (rv != SECSuccess) {
       Error("BeginSSL", -1, false);
       return -1;
     }
 
     // Insist on a certificate from the client
     rv = SSL_OptionSet(ssl_fd_, SSL_REQUEST_CERTIFICATE, PR_TRUE);
     if (rv != SECSuccess) {
       Error("BeginSSL", -1, false);
       return -1;
@@ skipping 591 matching lines @@
       return kDefaultSslCipher10;
     case SSL_PROTOCOL_TLS_12:
     default:
       return kDefaultSslCipher12;
   }
 }
 
 }  // namespace rtc
 
 #endif  // HAVE_NSS_SSL_H