Completely remove SSLv3 support.

net/ssl/ssl_config.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SSL_SSL_CONFIG_H_
 #define NET_SSL_SSL_CONFIG_H_
 
 #include "base/basictypes.h"
 #include "base/memory/ref_counted.h"
 #include "net/base/net_export.h"
 #include "net/cert/x509_certificate.h"
 #include "net/socket/next_proto.h"
 
 namespace net {
 
 // Various TLS/SSL ProtocolVersion values encoded as uint16
 //      struct {
 //          uint8 major;
 //          uint8 minor;
 //      } ProtocolVersion;
 // The most significant byte is |major|, and the least significant byte
 // is |minor|.
 enum {
-  SSL_PROTOCOL_VERSION_SSL3 = 0x0300,
   SSL_PROTOCOL_VERSION_TLS1 = 0x0301,
   SSL_PROTOCOL_VERSION_TLS1_1 = 0x0302,
   SSL_PROTOCOL_VERSION_TLS1_2 = 0x0303,
 };
 
 // Default minimum protocol version.
 NET_EXPORT extern const uint16 kDefaultSSLVersionMin;
 
 // For maximum supported protocol version, use
 // SSLClientSocket::GetMaxSupportedSSLVersion().
 
 // Default minimum protocol version that it's acceptable to fallback to.
 NET_EXPORT extern const uint16 kDefaultSSLVersionFallbackMin;
 
 // A collection of SSL-related configuration settings.
 struct NET_EXPORT SSLConfig {
   // Default to revocation checking.
-  // Default to SSL 3.0 ~ default_version_max() on.
   SSLConfig();
   ~SSLConfig();
 
   // Returns true if |cert| is one of the certs in |allowed_bad_certs|.
   // The expected cert status is written to |cert_status|. |*cert_status| can
   // be NULL if user doesn't care about the cert status.
   bool IsAllowedBadCert(X509Certificate* cert, CertStatus* cert_status) const;
 
   // Same as above except works with DER encoded certificates instead
   // of X509Certificate.
@@ skipping 10 matching lines @@
   // rev_checking_required_local_anchors is true if revocation checking is
   // required to succeed when certificates chain to local trust anchors (that
   // is, non-public CAs). If revocation information cannot be obtained, such
   // certificates will be treated as revoked ("hard-fail").
   // Note: This is distinct from rev_checking_enabled. If true, it is
   // equivalent to also setting rev_checking_enabled, but only when the
   // certificate chain chains to a local (non-public) trust anchor.
   bool rev_checking_required_local_anchors;
 
   // The minimum and maximum protocol versions that are enabled.
-  // SSL 3.0 is 0x0300, TLS 1.0 is 0x0301, TLS 1.1 is 0x0302, and so on.
   // (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined above.)
-  // SSL 2.0 is not supported. If version_max < version_min, it means no
-  // protocol versions are enabled.
+  // SSL 2.0 and SSL 3.0 are not supported. If version_max < version_min, it
+  // means no protocol versions are enabled.
   uint16 version_min;
   uint16 version_max;
 
   // version_fallback_min contains the minimum version that is acceptable to
   // fallback to. Versions before this may be tried to see whether they would
   // have succeeded and thus to give a better message to the user, but the
   // resulting connection won't be used in these cases.
   uint16 version_fallback_min;
 
   // Presorted list of cipher suites which should be explicitly prevented from
@@ skipping 90 matching lines @@
   // |fastradio_padding_eligible| can be true when |fastradio_padding_enabled|
   // is false: in this case, fastradio padding would not be enabled, but
   // metrics can be collected for experiments.
   bool fastradio_padding_enabled;
   bool fastradio_padding_eligible;
 };
 
 }  // namespace net
 
 #endif  // NET_SSL_SSL_CONFIG_H_