Completely remove SSLv3 support.

Completely remove SSLv3 support.

It's been off by default since Chrome 40 with a policy opt-in. The policy was
documented to stop working after Chrome 43, so remove all logic for SSL 3.0.
Chrome will no longer honor a --ssl-version-min=ssl3 flag and the option is
removed from about:flags.

This CL also removes the SSL 3.0 support from the extensions' TLS socket API.

BUG=487730
Committed: https://crrev.com/b937d6c4aaf04dcdd6823dd5092a3716cf3e9d5e
Cr-Commit-Position: refs/heads/master@{#329805}

[davidben, 2015-05-13 20:46:18]

davidben@chromium.org changed reviewers:
+ rsleevi@chromium.org, scheib@chromium.org

[davidben, 2015-05-13 20:46:19]

https://codereview.chromium.org/1139013002/diff/20001/extensions/browser/api/...
File extensions/browser/api/socket/tls_socket.cc (right):

https://codereview.chromium.org/1139013002/diff/20001/extensions/browser/api/...
extensions/browser/api/socket/tls_socket.cc:26: if (version_str == "tls1") {
NOTE: Unlike the rest of this CL, this part is not a no-op. But it's something
we probably should have done earlier.

https://codereview.chromium.org/1139013002/diff/20001/net/socket/ssl_client_s...
File net/socket/ssl_client_socket_openssl.cc (right):

https://codereview.chromium.org/1139013002/diff/20001/net/socket/ssl_client_s...
net/socket/ssl_client_socket_openssl.cc:716: SSL_set_max_version(ssl_,
ssl_config_.version_max);
This is a newer API we added but I apparently never got around to switching it.

(The SSL_OP_NO_SSLv3 flags are weird. For instance, what does this do?

  options.ConfigureFlag(SSL_OP_NO_SSLv2, false);
  options.ConfigureFlag(SSL_OP_NO_SSLv3, false);
  options.ConfigureFlag(SSL_OP_NO_TLSv1, false);
  options.ConfigureFlag(SSL_OP_NO_TLSv1_1, true);
  options.ConfigureFlag(SSL_OP_NO_TLSv1_2, false);

Answer: advertise a maximum version of TLS 1.0, but if the server responds with
TLS 1.2, that's OK.)

[davidben, 2015-05-13 20:46:52]

(Oh, scheib for extensions and rsleevi for general review)

[Ryan Sleevi, 2015-05-13 22:10:22]

lgtm

[scheib, 2015-05-13 22:23:54]

extensions/* LGTM

[davidben, 2015-05-14 04:49:16]

The CQ bit was checked by davidben@chromium.org

[commit-bot: I haz the power, 2015-05-14 04:49:53]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1139013002/20001

[commit-bot: I haz the power, 2015-05-14 04:53:50]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-05-14 04:54:42]

Patchset 2 (id:??) landed as
https://crrev.com/b937d6c4aaf04dcdd6823dd5092a3716cf3e9d5e
Cr-Commit-Position: refs/heads/master@{#329805}