Do not roll back to SSL 3.0 for Google properties.

net/http/transport_security_state_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/transport_security_state.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 46 matching lines @@
     return state->GetStaticDomainState(host, sni_enabled, result);
   }
 
   void EnableHost(TransportSecurityState* state,
                   const std::string& host,
                   const TransportSecurityState::DomainState& domain_state) {
     return state->EnableHost(host, domain_state);
   }
 };
 
+TEST_F(TransportSecurityStateTest, SSLVersionMinPreloaded) {
+  TransportSecurityState state;
+  TransportSecurityState::DomainState domain_state;
+  EXPECT_EQ(domain_state.ssl_version_min, net::SSL_CONNECTION_VERSION_SSL3);
+
+  // google.com is a preloaded entry.
+  EXPECT_TRUE(state.GetDomainState("google.com", true, &domain_state));
+  // The minimum SSL version that Google accepts is tlsv1.0.
+  EXPECT_EQ(domain_state.ssl_version_min, net::SSL_CONNECTION_VERSION_TLS1);
+
+  domain_state.ssl_version_min = net::SSL_CONNECTION_VERSION_SSL3;
+  EnableHost(&state, "google.com", domain_state);
+  EXPECT_TRUE(state.GetDomainState("google.com", true, &domain_state));
+  // Can't change |ssl_version_min| of preloaded entries.
+  EXPECT_EQ(domain_state.ssl_version_min, net::SSL_CONNECTION_VERSION_TLS1);
+}
+
+TEST_F(TransportSecurityStateTest, SSLVersionMinDynamic) {
+  TransportSecurityState state;
+  TransportSecurityState::DomainState domain_state;
+  // yahoo.com is not a preloaded entry.
+  EXPECT_FALSE(state.GetDomainState("yahoo.com", true, &domain_state));
+
+  const base::Time current_time(base::Time::Now());
+  const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
+  bool include_subdomains = false;
+  state.AddHSTS("yahoo.com", expiry, include_subdomains);
+  EXPECT_TRUE(state.GetDomainState("yahoo.com", true, &domain_state));
+
+  domain_state.ssl_version_min = net::SSL_CONNECTION_VERSION_TLS1;
+  EnableHost(&state, "yahoo.com", domain_state);
+  EXPECT_TRUE(state.GetDomainState("yahoo.com", true, &domain_state));
+  EXPECT_EQ(domain_state.ssl_version_min, net::SSL_CONNECTION_VERSION_TLS1);
+}
+
+
 TEST_F(TransportSecurityStateTest, SimpleMatches) {
   TransportSecurityState state;
   TransportSecurityState::DomainState domain_state;
   const base::Time current_time(base::Time::Now());
   const base::Time expiry = current_time + base::TimeDelta::FromSeconds(1000);
 
   EXPECT_FALSE(state.GetDomainState("yahoo.com", true, &domain_state));
   bool include_subdomains = false;
   state.AddHSTS("yahoo.com", expiry, include_subdomains);
   EXPECT_TRUE(state.GetDomainState("yahoo.com", true, &domain_state));
@@ skipping 759 matching lines @@
   // Expect to fail for SNI hosts when not searching the SNI list:
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "gmail.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "googlegroups.com", false));
   EXPECT_FALSE(TransportSecurityState::IsGooglePinnedProperty(
       "www.googlegroups.com", false));
 }
 
 }  // namespace net