Do not roll back to SSL 3.0 for Google properties.

net/http/http_network_transaction.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include <set>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 29 matching lines @@
 #include "net/http/http_proxy_client_socket_pool.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_request_info.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_response_info.h"
 #include "net/http/http_server_properties.h"
 #include "net/http/http_status_code.h"
 #include "net/http/http_stream_base.h"
 #include "net/http/http_stream_factory.h"
 #include "net/http/http_util.h"
+#include "net/http/transport_security_state.h"
 #include "net/http/url_security_manager.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/socket/socks_client_socket_pool.h"
 #include "net/socket/ssl_client_socket.h"
 #include "net/socket/ssl_client_socket_pool.h"
 #include "net/socket/transport_client_socket_pool.h"
 #include "net/spdy/spdy_http_stream.h"
 #include "net/spdy/spdy_session.h"
 #include "net/spdy/spdy_session_pool.h"
 #include "net/ssl/ssl_cert_request_info.h"
@@ skipping 110 matching lines @@
 
   net_log_ = net_log;
   request_ = request_info;
   start_time_ = base::Time::Now();
 
   if (request_->load_flags & LOAD_DISABLE_CERT_REVOCATION_CHECKING) {
     server_ssl_config_.rev_checking_enabled = false;
     proxy_ssl_config_.rev_checking_enabled = false;
   }
 
+  // Adjust the minimum version of SSL that Chrome should use.
+  bool sni_available =
+      server_ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1 ||
+      server_ssl_config_.version_fallback;
+  const std::string& host = request_->url.host();
+  TransportSecurityState::DomainState domain_state;
+  if (session_->params().transport_security_state->GetDomainState(
+      host, sni_available, &domain_state)) {
+    switch (domain_state.ssl_version_min) {
+      case SSL_CONNECTION_VERSION_SSL3:
+        server_ssl_config_.version_min = SSL_PROTOCOL_VERSION_SSL3;
+        break;
+      case SSL_CONNECTION_VERSION_TLS1:
+        server_ssl_config_.version_min = SSL_PROTOCOL_VERSION_TLS1;
+        break;
+      case SSL_CONNECTION_VERSION_TLS1_1:
+        server_ssl_config_.version_min = SSL_PROTOCOL_VERSION_TLS1_1;
+        break;
+      case SSL_CONNECTION_VERSION_TLS1_2:
+        server_ssl_config_.version_min = SSL_PROTOCOL_VERSION_TLS1_2;
+        break;
+      default:
+        break;
+    }
+  }
+
   next_state_ = STATE_CREATE_STREAM;
   int rv = DoLoop(OK);
   if (rv == ERR_IO_PENDING)
     callback_ = callback;
   return rv;
 }
 
 int HttpNetworkTransaction::RestartIgnoringLastError(
     const CompletionCallback& callback) {
   DCHECK(!stream_.get());
@@ skipping 1271 matching lines @@
       description = base::StringPrintf("Unknown state 0x%08X (%u)", state,
                                        state);
       break;
   }
   return description;
 }
 
 #undef STATE_CASE
 
 }  // namespace net