Add IsAcceptableCipher, use instead of GetDefaultCipher.

webrtc/base/opensslstreamadapter.cc

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 1129 matching lines @@
 }
 
 bool OpenSSLStreamAdapter::HaveExporter() {
 #ifdef HAVE_DTLS_SRTP
   return true;
 #else
   return false;
 #endif
 }
 
+// TODO(torbjorng): Remove.
 int OpenSSLStreamAdapter::GetDefaultSslCipherForTest(SSLProtocolVersion version,
                                                      KeyType key_type) {
   if (key_type == KT_RSA) {
     switch (version) {
       case SSL_PROTOCOL_TLS_10:
       case SSL_PROTOCOL_TLS_11:
         return kDefaultSslCipher10;
       case SSL_PROTOCOL_TLS_12:
       default:
 #ifdef OPENSSL_IS_BORINGSSL
@@ skipping 22 matching lines @@
 #else  // !OPENSSL_IS_BORINGSSL
         return kDefaultSslEcCipher12;
 #endif
     }
   } else {
     RTC_NOTREACHED();
     return kDefaultSslEcCipher12;
   }
 }
 
+#define CDEF(X) \
+  { static_cast<uint16_t>(TLS1_CK_##X & 0xffff), "TLS_" #X }
+
+struct cipher_list {
+  uint16_t cipher;
+  const char* cipher_str;
+};
+
+// TODO(torbjorng): Add more cipher suites to these lists.
+static const cipher_list OK_RSA_ciphers[] = {
+    CDEF(ECDHE_RSA_WITH_AES_128_CBC_SHA),
+    CDEF(ECDHE_RSA_WITH_AES_256_CBC_SHA),
+    CDEF(ECDHE_RSA_WITH_AES_128_GCM_SHA256),
+#ifdef TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA256
+    CDEF(ECDHE_RSA_WITH_AES_256_GCM_SHA256),
+#endif
+    CDEF(ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256),
+};
+
+static const cipher_list OK_ECDSA_ciphers[] = {
+    CDEF(ECDHE_ECDSA_WITH_AES_128_CBC_SHA),
+    CDEF(ECDHE_ECDSA_WITH_AES_256_CBC_SHA),
+    CDEF(ECDHE_ECDSA_WITH_AES_128_GCM_SHA256),
+#ifdef TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA256
+    CDEF(ECDHE_ECDSA_WITH_AES_256_GCM_SHA256),
+#endif
+    CDEF(ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256),
+};
+
+bool OpenSSLStreamAdapter::IsAcceptableCipher(int cipher,
+                                              SSLProtocolVersion version,
+                                              KeyType key_type) {
+  if (key_type == KT_RSA) {
+    for (const cipher_list &c : OK_RSA_ciphers) {
+      if (cipher == c.cipher)
+        return true;
+    }
+  }
+
+  if (key_type == KT_ECDSA) {
+    for (const cipher_list &c : OK_ECDSA_ciphers) {
+      if (cipher == c.cipher)
+        return true;
+    }
+  }
+
+  // TODO(torbjorng): Remove before landing.
+  LOG(LS_ERROR) << "Attempted use of truly terrible cipher suite: "
+                << OpenSSLStreamAdapter::SslCipherSuiteToName(cipher) << "("
+                << cipher << ")";
+  return false;
+}
+
+bool OpenSSLStreamAdapter::IsAcceptableCipher(std::string cipher,
+                                              SSLProtocolVersion version,
+                                              KeyType key_type) {
+  if (key_type == KT_RSA) {
+    for (const cipher_list &c : OK_RSA_ciphers) {
+      if (cipher == c.cipher_str)
+        return true;
+    }
+  }
+
+  if (key_type == KT_ECDSA) {
+    for (const cipher_list &c : OK_ECDSA_ciphers) {
+      if (cipher == c.cipher_str)
+        return true;
+    }
+  }
+
+  // TODO(torbjorng): Remove before landing.
+  LOG(LS_ERROR) << "Attempted use of truly terrible cipher suite: " << cipher;
+  return false;
+}
+
 }  // namespace rtc
 
 #endif  // HAVE_OPENSSL_SSL_H