Negotiate the same SRTP crypto suites for every DTLS association formed.

webrtc/base/sslstreamadapter.cc

 /*
  *  Copyright 2004 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 77 matching lines @@
           crypto_suite == CS_AEAD_AES_128_GCM);
 }
 
 // static
 CryptoOptions CryptoOptions::NoGcm() {
   CryptoOptions options;
   options.enable_gcm_crypto_suites = false;
   return options;
 }
 
+std::vector<int> GetSupportedDtlsSrtpCryptoSuites(
+    const rtc::CryptoOptions& crypto_options) {
+  std::vector<int> crypto_suites;
+  if (crypto_options.enable_gcm_crypto_suites) {
+    crypto_suites.push_back(rtc::SRTP_AEAD_AES_256_GCM);
+    crypto_suites.push_back(rtc::SRTP_AEAD_AES_128_GCM);
+  }
+  // Note: SRTP_AES128_CM_SHA1_80 is what is required to be supported (by
+  // draft-ietf-rtcweb-security-arch), but SRTP_AES128_CM_SHA1_32 is allowed as
+  // well, and saves a few bytes per packet if it ends up selected.
+  crypto_suites.push_back(rtc::SRTP_AES128_CM_SHA1_32);
+  crypto_suites.push_back(rtc::SRTP_AES128_CM_SHA1_80);

[pthatcher1, 2017/04/17 22:12:41]

I'm not so sure about this being the default.  I'd feel more comfortable if this
were another crypto_options, such as
crypto_options.enable_sha1_32bit_crypto_suites, or something like that.  

But I don't see a way web apps could get to this.  Maybe it will become a
mobile-app-only thing and web apps always get 80bit?  

[Taylor Brandstetter, 2017/04/20 07:20:40]

It's already the default though. If we want to change the default to 80, let's
do that in a separate CL, since that's a bigger change. The main point of this
CL is to fix the "data-only to audio upgrade" regression.

+  return crypto_suites;
+}
+
 SSLStreamAdapter* SSLStreamAdapter::Create(StreamInterface* stream) {
   return new OpenSSLStreamAdapter(stream);
 }
 
 SSLStreamAdapter::SSLStreamAdapter(StreamInterface* stream)
     : StreamAdapterInterface(stream),
       ignore_bad_cert_(false),
       client_auth_enabled_(true) {}
 
 SSLStreamAdapter::~SSLStreamAdapter() {}
@@ skipping 33 matching lines @@
 std::string SSLStreamAdapter::SslCipherSuiteToName(int cipher_suite) {
   return OpenSSLStreamAdapter::SslCipherSuiteToName(cipher_suite);
 }
 void SSLStreamAdapter::enable_time_callback_for_testing() {
   OpenSSLStreamAdapter::enable_time_callback_for_testing();
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
 }  // namespace rtc