Gather metrics classifying the cause of the TLS fallback.

net/ssl/ssl_failure_state.h

Index: net/ssl/ssl_failure_state.h
diff --git a/net/ssl/ssl_failure_state.h b/net/ssl/ssl_failure_state.h
new file mode 100644
index 0000000000000000000000000000000000000000..0ea3aceb55e1e1dfffcf12e078d0b63532ec081d
--- /dev/null
+++ b/net/ssl/ssl_failure_state.h
@@ -0,0 +1,49 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_SSL_SSL_FAILURE_STATE_H_
+#define NET_SSL_SSL_FAILURE_STATE_H_
+
+namespace net {
+
+// Describes the most likely cause for the TLS handshake failure. This is an
+// approximation used to classify the causes of TLS version fallback. These
+// values are used in histograms, so new values must be appended.
+enum SSLFailureState {
+  // The connection was successful.
+  kSSLFailureNone = 0,

[Alexei Svitkine (slow), 2015/05/15 14:39:36]

Nit: Chromium code prefers SSL_FAILURE_NONE style enum naming convention.

[davidben, 2015/05/15 18:00:24]

Done. (I'd wondered what was up with the mix of styles...)

+
+  // The connection failed for unknown reasons.
+  kSSLFailureUnknown = 1,
+
+  // The connection failed after sending ClientHello and before receiving
+  // ServerHello.
+  kSSLFailureClientHello = 2,
+
+  // The connection failed after negotiating TLS_RSA_WITH_AES_128_GCM_SHA256 or
+  // TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 and completing the client's second
+  // leg. Some Microsoft IIS servers fail at this point. See
+  // https://crbug.com/433406.
+  kSSLFailureBuggyGCM = 3,
+
+  // The connection failed after CertificateVerify was sent. Some servers are
+  // known to incorrectly implement TLS 1.2 client auth.
+  kSSLFailureClientAuth = 4,
+
+  // The connection failed because the server attempted to resume a session at
+  // the wrong version. Some versions of OpenSSL may do this in rare
+  // circumstances. See https://crbug.com/441456
+  kSSLFailureSessionMismatch = 5,
+
+  // The connection failed after sending the NextProto message. Some F5 servers
+  // fail to parse such messages in TLS 1.1 and TLS 1.2, but not 1.0. See
+  // https://crbug.com/466977.
+  kSSLFailureNextProto = 6,
+
+  kSSLFailureMax,
+};
+
+}  // namespace net
+
+#endif  // NET_SSL_SSL_FAILURE_STATE_H_