Do not roll back to SSL 3.0 for Google properties.

net/ssl/ssl_config_service.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SSL_SSL_CONFIG_SERVICE_H_
 #define NET_SSL_SSL_CONFIG_SERVICE_H_
 
 #include <vector>
 
 #include "base/basictypes.h"
@@ skipping 73 matching lines @@
   // big-endian form, they should be declared in host byte order, with the
   // first uint8 occupying the most significant byte.
   // Ex: To disable TLS_RSA_WITH_RC4_128_MD5, specify 0x0004, while to
   // disable TLS_ECDH_ECDSA_WITH_RC4_128_SHA, specify 0xC002.
   std::vector<uint16> disabled_cipher_suites;
 
   bool cached_info_enabled;  // True if TLS cached info extension is enabled.
   bool channel_id_enabled;  // True if TLS channel ID extension is enabled.
   bool false_start_enabled;  // True if we'll use TLS False Start.
 
+  // If |ssl3_fallback_enabled| is false and the request is sent to a site
+  // pinned to the Google pin list (indicating that it is a Google site),
+  // SSL 3.0 fallback will be disabled.
+  // If |ssl3_fallback_enabled| is true, SSL 3.0 fallback will be enabled
+  // for all sites.

[wtc, 2013/04/18 18:15:34]

I suggest describing the "true" case before the "false" case,
and rewording the "false" case slightly to make the two cases
more symmetrical, as follows:

  // If |ssl3_fallback_enabled| is true, SSL 3.0 fallback will be enabled
  // for all sites.
  // If |ssl3_fallback_enabled| is false, SSL 3.0 fallback will be disabled
  // for a site pinned to the Google pin list (indicating that it is a
  // Google site).

+  bool ssl3_fallback_enabled;

[wtc, 2013/04/18 18:15:34]

NOTE: I still think this member name is confusing. I think
something like "permissive_ssl3_fallback_enabled" or
"ssl3_fallback_unrestricted" would be more accurate.

+
   // TODO(wtc): move the following members to a new SSLParams structure.  They
   // are not SSL configuration settings.
 
   struct NET_EXPORT CertAndStatus {
     CertAndStatus();
     ~CertAndStatus();
 
     std::string der_cert;
     CertStatus cert_status;
   };
@@ skipping 101 matching lines @@
   void ProcessConfigUpdate(const SSLConfig& orig_config,
                            const SSLConfig& new_config);
 
  private:
   ObserverList<Observer> observer_list_;
 };
 
 }  // namespace net
 
 #endif  // NET_SSL_SSL_CONFIG_SERVICE_H_