Move RC4 behind a fallback.

net/socket/client_socket_pool_manager.cc

Index: net/socket/client_socket_pool_manager.cc
diff --git a/net/socket/client_socket_pool_manager.cc b/net/socket/client_socket_pool_manager.cc
index cd3633661ff92bdcb508f9777bcda43bae08fc71..b5b61fb0c1dab515db0a513e364a4a0f2439d734 100644
--- a/net/socket/client_socket_pool_manager.cc
+++ b/net/socket/client_socket_pool_manager.cc
@@ -149,6 +149,10 @@ int InitSocketPoolHelper(const GURL& request_url,
           break;
       }
     }
+    // Place sockets with and without deprecated ciphers into separate
+    // connection groups.
+    if (ssl_config_for_origin.enable_deprecated_cipher_suites)
+      prefix += "deprecated/";

[davidben, 2015/04/01 22:22:59]

NOTE: This, like with the fallback, means that we'll send RC4-less ClientHellos
to RC4-requiring servers once on every request attempt. Only when that fails
will we try the other group and reuse any existing socket.

The alternative (not including this line) is worse as we'll get very strange
mixing due to late-binding of connection attempts.

[agl, 2015/04/03 21:06:17]

"deprecated" is a rather generic name. I'm not sure that someone looking at the
socket pools would figure it out. "deprecatedciphers/", or "weakciphers/" might
be more descriptive.

[davidben, 2015/04/03 21:10:00]

Done. (Went with deprecatedciphers. weakciphers implies that the ciphers that
don't match the bucket aren't weak, but we aren't deprecating all weak ciphers
in one swoop.)

     connection_group = prefix + connection_group;
   }