Move RC4 behind a fallback.

net/socket/ssl_client_socket_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // OpenSSL binding for SSLClientSocket. The class layout and general principle
 // of operation is derived from SSLClientSocketNSS.
 
 #include "net/socket/ssl_client_socket_openssl.h"
 
 #include <errno.h>
@@ skipping 782 matching lines @@
     }
     if (disable) {
        const char* name = SSL_CIPHER_get_name(cipher);
        DVLOG(3) << "Found cipher to remove: '" << name << "', ID: " << id
                 << " strength: " << SSL_CIPHER_get_bits(cipher, NULL);
        command.append(":!");
        command.append(name);
      }
   }
 
+  if (!ssl_config_.enable_deprecated_cipher_suites)
+    command.append(":!RC4");
+
   // Disable ECDSA cipher suites on platforms that do not support ECDSA
   // signed certificates, as servers may use the presence of such
   // ciphersuites as a hint to send an ECDSA certificate.
 #if defined(OS_WIN)
   if (base::win::GetVersion() < base::win::VERSION_VISTA)
     command.append(":!ECDSA");
 #endif
 
   int rv = SSL_set_cipher_list(ssl_, command.c_str());
   // If this fails (rv = 0) it means there are no ciphers enabled on this SSL.
@@ skipping 1125 matching lines @@
     case SSL_PROTOCOL_VERSION_TLS1_1:
       result.append("tls1.1");
       break;
     case SSL_PROTOCOL_VERSION_TLS1_2:
       result.append("tls1.2");
       break;
     default:
       NOTREACHED();
   }
 
+  result.append("/");
+  if (ssl_config_.enable_deprecated_cipher_suites)
+    result.append("deprecated");
+
   return result;
 }
 
 scoped_refptr<X509Certificate>
 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const {
   return server_cert_;
 }
 
 }  // namespace net