Do not roll back to SSL 3.0 for Google properties.

net/ssl/ssl_config_service.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/ssl_config_service.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/ref_counted.h"
 #include "base/synchronization/lock.h"
 #include "net/cert/crl_set.h"
@@ skipping 22 matching lines @@
 
 SSLConfig::CertAndStatus::~CertAndStatus() {}
 
 SSLConfig::SSLConfig()
     : rev_checking_enabled(false),
       version_min(g_default_version_min),
       version_max(g_default_version_max),
       cached_info_enabled(false),
       channel_id_enabled(true),
       false_start_enabled(true),
+      ssl_version_min_preloaded_disabled(false),
       send_client_cert(false),
       verify_ev_cert(false),
       version_fallback(false),
       cert_io_enabled(true) {
 }
 
 SSLConfig::~SSLConfig() {
 }
 
 bool SSLConfig::IsAllowedBadCert(X509Certificate* cert,
                                  CertStatus* cert_status) const {
   std::string der_cert;
   if (!X509Certificate::GetDEREncoded(cert->os_cert_handle(), &der_cert))
     return false;
   return IsAllowedBadCert(der_cert, cert_status);
 }
 
 bool SSLConfig::IsAllowedBadCert(const base::StringPiece& der_cert,
                                  CertStatus* cert_status) const {
   for (size_t i = 0; i < allowed_bad_certs.size(); ++i) {
     if (der_cert == allowed_bad_certs[i].der_cert) {
       if (cert_status)
         *cert_status = allowed_bad_certs[i].cert_status;
       return true;
     }
   }
   return false;
 }
 
+// static
+std::string SSLConfig::SSLProtocolVersionToString(uint16 version) {
+  switch (version) {
+    case net::SSL_PROTOCOL_VERSION_SSL3:
+      return "ssl3";
+    case net::SSL_PROTOCOL_VERSION_TLS1:
+      return "tls1";
+    case net::SSL_PROTOCOL_VERSION_TLS1_1:
+      return "tls1.1";
+    case net::SSL_PROTOCOL_VERSION_TLS1_2:
+      return "tls1.2";
+    default:
+      NOTREACHED();
+      return std::string();
+  }
+}
+
+// static
+uint16 SSLConfig::SSLProtocolVersionFromString(const std::string& version_str) {
+  uint16 version = 0;  // Invalid.
+  if (version_str == "ssl3") {
+    version = net::SSL_PROTOCOL_VERSION_SSL3;
+  } else if (version_str == "tls1") {
+    version = net::SSL_PROTOCOL_VERSION_TLS1;
+  } else if (version_str == "tls1.1") {
+    version = net::SSL_PROTOCOL_VERSION_TLS1_1;
+  } else if (version_str == "tls1.2") {
+    version = net::SSL_PROTOCOL_VERSION_TLS1_2;
+  }
+  return version;
+}
+
 SSLConfigService::SSLConfigService()
     : observer_list_(ObserverList<Observer>::NOTIFY_EXISTING_ONLY) {
 }
 
 static bool g_cached_info_enabled = false;
 
 // GlobalCRLSet holds a reference to the global CRLSet. It simply wraps a lock
 // around a scoped_refptr so that getting a reference doesn't race with
 // updating the CRLSet.
 class GlobalCRLSet {
@@ skipping 65 matching lines @@
   ssl_config->cached_info_enabled = g_cached_info_enabled;
 }
 
 void SSLConfigService::ProcessConfigUpdate(const SSLConfig& orig_config,
                                            const SSLConfig& new_config) {
   bool config_changed =
       (orig_config.rev_checking_enabled != new_config.rev_checking_enabled) ||
       (orig_config.version_min != new_config.version_min) ||
       (orig_config.version_max != new_config.version_max) ||
       (orig_config.disabled_cipher_suites !=
-       new_config.disabled_cipher_suites) ||
+        new_config.disabled_cipher_suites) ||

[agl, 2013/04/15 15:23:51]

This looks like a stray space.

[thaidn_google, 2013/04/16 00:38:16]

Done.

       (orig_config.channel_id_enabled != new_config.channel_id_enabled) ||
+      (orig_config.ssl_version_min_preloaded_disabled !=
+          new_config.ssl_version_min_preloaded_disabled) ||
       (orig_config.false_start_enabled != new_config.false_start_enabled);
 
   if (config_changed)
     NotifySSLConfigChange();
 }
 
 // static
 bool SSLConfigService::IsSNIAvailable(SSLConfigService* service) {
   if (!service)
     return false;
 
   SSLConfig ssl_config;
   service->GetSSLConfig(&ssl_config);
   return ssl_config.version_max >= SSL_PROTOCOL_VERSION_TLS1;
 }
 
 }  // namespace net