Index: webrtc/base/opensslstreamadapter.cc |
diff --git a/webrtc/base/opensslstreamadapter.cc b/webrtc/base/opensslstreamadapter.cc |
index 7563f17c56809c5c006c6d461575976d42fbc985..4a1dc8082138a3a44d235f71d04544b8411cf9b2 100644 |
--- a/webrtc/base/opensslstreamadapter.cc |
+++ b/webrtc/base/opensslstreamadapter.cc |
@@ -160,12 +160,29 @@ static int kDefaultSslCipher12 = |
static int kDefaultSslEcCipher12 = |
static_cast<uint16_t>(TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256); |
// Fallback cipher for DTLS 1.2 if hardware-accelerated AES-GCM is unavailable. |
-// TODO(davidben): Switch to the standardized CHACHA20_POLY1305 variant when |
-// available. |
+ |
+#ifdef TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 |
+// This ciphersuite was added in boringssl 13414b3a..., changing the fallback |
+// ciphersuite. For compatibility during a transitional period, support old |
+// boringssl versions. TODO(torbjorng): Remove this. |
tommi
2016/01/15 14:39:19
nit: Move the todo to a separate line. (same below
|
+static int kDefaultSslCipher12NoAesGcm = |
+ static_cast<uint16_t>(TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256); |
+#else |
static int kDefaultSslCipher12NoAesGcm = |
static_cast<uint16_t>(TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305_OLD); |
+#endif |
+ |
+#ifdef TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 |
+// This ciphersuite was added in boringssl 13414b3a..., changing the fallback |
+// ciphersuite. For compatibility during a transitional period, support old |
+// boringssl versions. TODO(torbjorng): Remove this. |
+static int kDefaultSslEcCipher12NoAesGcm = |
+ static_cast<uint16_t>(TLS1_CK_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256); |
+#else |
static int kDefaultSslEcCipher12NoAesGcm = |
static_cast<uint16_t>(TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305_OLD); |
+#endif |
+ |
#else // !OPENSSL_IS_BORINGSSL |
// OpenSSL sorts differently than BoringSSL, so the default cipher doesn't |
// change between TLS 1.0 and TLS 1.2 with the current setup. |
@@ -173,7 +190,7 @@ static int kDefaultSslCipher12 = |
static_cast<uint16_t>(TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA); |
static int kDefaultSslEcCipher12 = |
static_cast<uint16_t>(TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA); |
-#endif |
+#endif // OPENSSL_IS_BORINGSSL |
#if defined(_MSC_VER) |
#pragma warning(pop) |