Move RC4 behind a fallback.

net/socket/client_socket_pool_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/client_socket_pool_manager.h"
 
 #include <string>
 
 #include "base/basictypes.h"
 #include "base/logging.h"
@@ skipping 131 matching lines @@
           prefix = "ssl(max:3.1)/";
           break;
         case SSL_PROTOCOL_VERSION_SSL3:
           prefix = "sslv3/";
           break;
         default:
           CHECK(false);
           break;
       }
     }
+    // Place sockets with and without deprecated ciphers into separate
+    // connection groups.
+    if (ssl_config_for_origin.enable_deprecated_cipher_suites)
+      prefix += "deprecated/";

[davidben, 2015/04/01 22:22:59]

NOTE: This, like with the fallback, means that we'll send RC4-less ClientHellos
to RC4-requiring servers once on every request attempt. Only when that fails
will we try the other group and reuse any existing socket.

The alternative (not including this line) is worse as we'll get very strange
mixing due to late-binding of connection attempts.

[agl, 2015/04/03 21:06:17]

"deprecated" is a rather generic name. I'm not sure that someone looking at the
socket pools would figure it out. "deprecatedciphers/", or "weakciphers/" might
be more descriptive.

[davidben, 2015/04/03 21:10:00]

Done. (Went with deprecatedciphers. weakciphers implies that the ciphers that
don't match the bucket aren't weak, but we aren't deprecating all weak ciphers
in one swoop.)

     connection_group = prefix + connection_group;
   }
 
   bool ignore_limits = (request_load_flags & LOAD_IGNORE_LIMITS) != 0;
   if (!proxy_info.is_direct()) {
     ProxyServer proxy_server = proxy_info.proxy_server();
     proxy_host_port.reset(new HostPortPair(proxy_server.host_port_pair()));
     scoped_refptr<TransportSocketParams> proxy_tcp_params(
         new TransportSocketParams(
             *proxy_host_port,
@@ skipping 344 matching lines @@
     int num_preconnect_streams) {
   return InitSocketPoolHelper(
       request_url, request_extra_headers, request_load_flags, request_priority,
       session, proxy_info, force_spdy_over_ssl, want_spdy_over_npn,
       ssl_config_for_origin, ssl_config_for_proxy, false, privacy_mode, net_log,
       num_preconnect_streams, NULL, HttpNetworkSession::NORMAL_SOCKET_POOL,
       OnHostResolutionCallback(), CompletionCallback());
 }
 
 }  // namespace net