Do not roll back to SSL 3.0 for Google properties.

net/ssl/ssl_config_service_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/ssl_config_service.h"
 
 #include <vector>
 
 #include "base/basictypes.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ skipping 53 matching lines @@
 
   mock_service->RemoveObserver(&observer);
 }
 
 TEST(SSLConfigServiceTest, ConfigUpdatesNotifyObservers) {
   SSLConfig initial_config;
   initial_config.rev_checking_enabled = true;
   initial_config.false_start_enabled = false;
   initial_config.version_min = SSL_PROTOCOL_VERSION_SSL3;
   initial_config.version_max = SSL_PROTOCOL_VERSION_TLS1_1;
+  initial_config.ssl3_fallback_enabled = false;

[wtc, 2013/04/18 18:15:34]

Set this after line 71 (initial_config.false_start_enabled = false).

 
   scoped_refptr<MockSSLConfigService> mock_service(
       new MockSSLConfigService(initial_config));
   MockSSLConfigServiceObserver observer;
   mock_service->AddObserver(&observer);
 
   // Test that the basic boolean preferences trigger updates.
   initial_config.rev_checking_enabled = false;
   EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
   mock_service->SetSSLConfig(initial_config);
 
   initial_config.false_start_enabled = true;
   EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
   mock_service->SetSSLConfig(initial_config);
 
   // Test that changing the SSL version range triggers updates.
   initial_config.version_min = SSL_PROTOCOL_VERSION_TLS1;
   EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
   mock_service->SetSSLConfig(initial_config);
 
   initial_config.version_max = SSL_PROTOCOL_VERSION_SSL3;
   EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
   mock_service->SetSSLConfig(initial_config);
 
+  initial_config.ssl3_fallback_enabled = true;
+  EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
+  mock_service->SetSSLConfig(initial_config);

[wtc, 2013/04/18 18:15:34]

Do this after lines 86-88 (which deals with false_start_enabled).

+
   // Test that disabling certain cipher suites triggers an update.
   std::vector<uint16> disabled_ciphers;
   disabled_ciphers.push_back(0x0004u);
   disabled_ciphers.push_back(0xBEEFu);
   disabled_ciphers.push_back(0xDEADu);
   initial_config.disabled_cipher_suites = disabled_ciphers;
   EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
   mock_service->SetSSLConfig(initial_config);
 
   // Ensure that changing a disabled cipher suite, while still maintaining
   // sorted order, triggers an update.
   disabled_ciphers[1] = 0xCAFEu;
   initial_config.disabled_cipher_suites = disabled_ciphers;
   EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
   mock_service->SetSSLConfig(initial_config);
 
   // Ensure that removing a disabled cipher suite, while still keeping some
   // cipher suites disabled, triggers an update.
   disabled_ciphers.pop_back();
   initial_config.disabled_cipher_suites = disabled_ciphers;
   EXPECT_CALL(observer, OnSSLConfigChanged()).Times(1);
   mock_service->SetSSLConfig(initial_config);
 
   mock_service->RemoveObserver(&observer);
 }
 
 }  // namespace net