Do not roll back to SSL 3.0 for Google properties.

net/http/transport_security_state.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #if defined(USE_OPENSSL)
 #include <openssl/ecdsa.h>
 #include <openssl/ssl.h>
 #else  // !defined(USE_OPENSSL)
@@ skipping 527 matching lines @@
   const char* const* excluded_hashes;
 };
 
 struct HSTSPreload {
   uint8 length;
   bool include_subdomains;
   char dns_name[38];
   bool https_required;
   PublicKeyPins pins;
   SecondLevelDomainName second_level_domain_name;
+  SSL_CONNECTION_VERSION ssl_version_min;
 };
 
 static bool HasPreload(const struct HSTSPreload* entries, size_t num_entries,
                        const std::string& canonicalized_host, size_t i,
                        TransportSecurityState::DomainState* out, bool* ret) {
   for (size_t j = 0; j < num_entries; j++) {
     if (entries[j].length == canonicalized_host.size() - i &&
         memcmp(entries[j].dns_name, &canonicalized_host[i],
                entries[j].length) == 0) {
       if (!entries[j].include_subdomains && i != 0) {
         *ret = false;
       } else {
         out->include_subdomains = entries[j].include_subdomains;
+        out->ssl_version_min = entries[j].ssl_version_min;
         *ret = true;
         if (!entries[j].https_required)
           out->upgrade_mode = TransportSecurityState::DomainState::MODE_DEFAULT;
         if (entries[j].pins.required_hashes) {
           const char* const* sha1_hash = entries[j].pins.required_hashes;
           while (*sha1_hash) {
             AddHash(*sha1_hash, &out->static_spki_hashes);
             sha1_hash++;
           }
         }
@@ skipping 211 matching lines @@
 }
 
 void TransportSecurityState::AddOrUpdateForcedHosts(
     const std::string& hashed_host, const DomainState& state) {
   forced_hosts_[hashed_host] = state;
 }
 
 TransportSecurityState::DomainState::DomainState()
     : upgrade_mode(MODE_FORCE_HTTPS),
       created(base::Time::Now()),
-      include_subdomains(false) {
+      include_subdomains(false),
+      ssl_version_min(SSL_CONNECTION_VERSION_SSL3) {
 }
 
 TransportSecurityState::DomainState::~DomainState() {
 }
 
 bool TransportSecurityState::DomainState::CheckPublicKeyPins(
     const HashValueVector& hashes) const {
   // Validate that hashes is not empty. By the time this code is called (in
   // production), that should never happen, but it's good to be defensive.
   // And, hashes *can* be empty in some test scenarios.
@@ skipping 42 matching lines @@
   return true;
 }
 
 bool TransportSecurityState::DomainState::HasPublicKeyPins() const {
   return static_spki_hashes.size() > 0 ||
          bad_static_spki_hashes.size() > 0 ||
          dynamic_spki_hashes.size() > 0;
 }
 
 }  // namespace