Do not roll back to SSL 3.0 for Google properties.

net/http/http_network_transaction.cc

Index: net/http/http_network_transaction.cc
diff --git a/net/http/http_network_transaction.cc b/net/http/http_network_transaction.cc
index 467eb940a65d7a6687b7085b3e9257f615036ab5..5a3b833267c546d23caef36f0b6413563fb5ecab 100644
--- a/net/http/http_network_transaction.cc
+++ b/net/http/http_network_transaction.cc
@@ -47,6 +47,7 @@
 #include "net/http/http_stream_base.h"
 #include "net/http/http_stream_factory.h"
 #include "net/http/http_util.h"
+#include "net/http/transport_security_state.h"
 #include "net/http/url_security_manager.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/socket/socks_client_socket_pool.h"
@@ -1216,11 +1217,14 @@ int HttpNetworkTransaction::HandleSSLHandshakeError(int error) {
         GetHostAndPort(request_->url));
   }
 
+  uint16 version_before = server_ssl_config_.version_max;

[Ryan Sleevi, 2013/04/17 01:16:36]

So after reading the code (which, yes, I realize I pseudo-coded), I realized you
don't need version_before.

If you swap lines 1259/1260 (so that assignment comes after the logging), you
can get away with just tracking version_max (the new max) and
server_ssl_config_.version_max (aka version_before)

[thaidn_google, 2013/04/17 04:34:47]

Nice catch :-).

On 2013/04/17 01:16:36, Ryan Sleevi wrote:

+  uint16 version_max = version_before;
+
   switch (error) {
     case ERR_SSL_PROTOCOL_ERROR:
     case ERR_SSL_VERSION_OR_CIPHER_MISMATCH:
-      if (server_ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1 &&
-          server_ssl_config_.version_max > server_ssl_config_.version_min) {
+      if (version_max >= SSL_PROTOCOL_VERSION_TLS1 &&
+          version_max > server_ssl_config_.version_min) {
         // This could be a TLS-intolerant server or a server that chose a
         // cipher suite defined only for higher protocol versions (such as
         // an SSL 3.0 server that chose a TLS-only cipher suite).  Fall
@@ -1231,38 +1235,38 @@ int HttpNetworkTransaction::HandleSSLHandshakeError(int error) {
         // repeat the TLS 1.0 handshake. To avoid this problem, the default
         // version_max should match the maximum protocol version supported
         // by the SSLClientSocket class.
-        uint16 version_before = server_ssl_config_.version_max;
-        server_ssl_config_.version_max--;
-        net_log_.AddEvent(
-            NetLog::TYPE_SSL_VERSION_FALLBACK,
-            base::Bind(&NetLogSSLVersionFallbackCallback,
-                       &request_->url, error, version_before,
-                       server_ssl_config_.version_max));
-        server_ssl_config_.version_fallback = true;
-        ResetConnectionAndRequestForResend();
-        error = OK;
+        version_max--;
       }
       break;
     case ERR_SSL_DECOMPRESSION_FAILURE_ALERT:
     case ERR_SSL_BAD_RECORD_MAC_ALERT:
-      if (server_ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1 &&
-          server_ssl_config_.version_min == SSL_PROTOCOL_VERSION_SSL3) {
+      if (version_max >= SSL_PROTOCOL_VERSION_TLS1 &&
+          version_max == SSL_PROTOCOL_VERSION_SSL3) {
         // This could be a server with buggy DEFLATE support. Turn off TLS,
         // DEFLATE support and retry.
         // TODO(wtc): turn off DEFLATE support only. Do not tie it to TLS.
-        uint16 version_before = server_ssl_config_.version_max;
-        server_ssl_config_.version_max = SSL_PROTOCOL_VERSION_SSL3;
-        net_log_.AddEvent(
-            NetLog::TYPE_SSL_VERSION_FALLBACK,
-            base::Bind(&NetLogSSLVersionFallbackCallback,
-                       &request_->url, error, version_before,
-                       server_ssl_config_.version_max));
-        server_ssl_config_.version_fallback = true;
-        ResetConnectionAndRequestForResend();
-        error = OK;
+        version_max = SSL_PROTOCOL_VERSION_SSL3;
       }
       break;
   }
+
+  if (version_max != version_before &&
+      // Do not fallback to SSL 3.0 on Google properties.
+      !(version_max <= SSL_PROTOCOL_VERSION_SSL3 &&
+        !server_ssl_config_.ssl_version_min_preloaded_disabled &&
+        TransportSecurityState::IsGooglePinnedProperty(
+            request_->url.host(), true /* include SNI */))) {
+    server_ssl_config_.version_max = version_max;
+    net_log_.AddEvent(
+        NetLog::TYPE_SSL_VERSION_FALLBACK,
+        base::Bind(&NetLogSSLVersionFallbackCallback,
+                   &request_->url, error, version_before,
+                   server_ssl_config_.version_max));
+    server_ssl_config_.version_fallback = true;
+    ResetConnectionAndRequestForResend();
+    error = OK;
+  }
+
   return error;
 }