Do not roll back to SSL 3.0 for Google properties.

net/http/transport_security_state.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 #define NET_HTTP_TRANSPORT_SECURITY_STATE_H_
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/gtest_prod_util.h"
 #include "base/threading/non_thread_safe.h"
 #include "base/time.h"
 #include "net/base/net_export.h"
 #include "net/cert/x509_cert_types.h"
 #include "net/cert/x509_certificate.h"
+#include "net/ssl/ssl_connection_status_flags.h"
 
 namespace net {
 
 class SSLInfo;
 
 // Tracks which hosts have enabled strict transport security and/or public
 // key pins.
 //
 // This object manages the in-memory store. Register a Delegate with
 // |SetDelegate| to persist the state to disk.
@@ skipping 98 matching lines @@
     HashValueVector dynamic_spki_hashes;
 
     // The absolute time (UTC) when the |dynamic_spki_hashes| expire.
     base::Time dynamic_spki_hashes_expiry;
 
     // Optional; hashes of static known-bad SubjectPublicKeyInfos which
     // MUST NOT intersect with the set of SPKIs in the TLS server's
     // certificate chain.
     HashValueVector bad_static_spki_hashes;
 
+    // The minimum SSL version that servers serving this domain expect. This
+    // version can be specified as part of HSTS preloading, or it will be
+    // extracted from succesfull handshakes. The default value is SSLv3.
+    // Chrome must not roll back to an older version, even if the connection
+    // handhsake failed. That is, if the server indicates support of TLS 1.1,
+    // but the connection fails, then we do not attempt to connect to the
+    // server using TLS 1.0, but allow the connection to fail.
+
+    // The default value is SSL_CONNECTION_VERSION_3.
+    // TODO(thaidn): define a HSTS extension for this.
+    SSL_CONNECTION_VERSION ssl_version_min;
+
     // The following members are not valid when stored in |enabled_hosts_|:
 
     // The domain which matched during a search for this DomainState entry.
     // Updated by |GetDomainState| and |GetStaticDomainState|.
     std::string domain;
   };
 
   class NET_EXPORT Iterator {
    public:
     explicit Iterator(const TransportSecurityState& state);
@@ skipping 116 matching lines @@
   // to the caller with |GetStaticDomainState|.
   static void ReportUMAOnPinFailure(const std::string& host);
 
   // IsBuildTimely returns true if the current build is new enough ensure that
   // built in security information (i.e. HSTS preloading and pinning
   // information) is timely.
   static bool IsBuildTimely();
 
  private:
   friend class TransportSecurityStateTest;
+  friend class SSLClientSocketNSS;

[thaidn_google, 2013/04/11 01:31:52]

This is ugly. Should I make |EnableHost| public?

 
   typedef std::map<std::string, DomainState> DomainStateMap;
 
   // If a Delegate is present, notify it that the internal state has
   // changed.
   void DirtyNotify();
 
   // Enable TransportSecurity for |host|. |state| supercedes any previous
   // state for the |host|, including static entries.
   //
@@ skipping 32 matching lines @@
   DomainStateMap forced_hosts_;
 
   Delegate* delegate_;
 
   DISALLOW_COPY_AND_ASSIGN(TransportSecurityState);
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_TRANSPORT_SECURITY_STATE_H_