Disable the TLS version fallback.

components/ssl_config/ssl_config_service_manager_pref.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "components/ssl_config/ssl_config_service_manager.h"
 
 #include <stdint.h>
 
 #include <algorithm>
 #include <string>
 #include <vector>
@@ skipping 179 matching lines @@
     PrefService* local_state,
     const scoped_refptr<base::SingleThreadTaskRunner>& io_task_runner)
     : ssl_config_service_(new SSLConfigServicePref(io_task_runner)),
       io_task_runner_(io_task_runner) {
   DCHECK(local_state);
 
   local_state->SetDefaultPrefValue(
       ssl_config::prefs::kRC4Enabled,
       new base::FundamentalValue(IsRC4EnabledByDefault()));
 
+  // TODO(davidben): Remove this when the fallback removal has succeeded.
+  local_state->SetDefaultPrefValue(
+      ssl_config::prefs::kSSLVersionFallbackMin,
+      new base::StringValue(
+          base::FieldTrialList::FindFullName("SSLVersionFallbackMin")));

[Ryan Sleevi, 2016/02/09 02:16:12]

I think you want to indirect this through a function; AIUI, on the first call
(e.g. before Finch seeds are fetched), this simply returns "Default" - is that
what you expect?

[davidben, 2016/02/09 02:58:36]

I believe these get called at a point where fetch state is seeded. (Otherwise
the RC4 one wouldn't work.) I don't know if it's possible to tell the pref
system to indirect through a function since it needs to know when the value
changed. Other code does something similar:

https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/io_...

[davidben, 2016/02/09 02:59:08]

(I believe it's the empty string, not "Default".)

[Ryan Sleevi, 2016/02/09 03:28:43]

I don't believe the RC4 one would necessarily work correctly. That was certainly
my (negative) experience with handling things like certificate expiration
policies or EV whitelists. I'm not terribly keen to couple with the Finch state.

Just looking through code search, this seems *wrong* to me. Perhaps check with
one of the metrics/prefs owners?

[davidben, 2016/02/09 05:11:56]

It works. It's pretty easy to test this with --force-fieldtrials. I tested the
various cases extensively before uploading, just as with RC4. That was why I did
RC4 this way rather than in RegisterPrefs which would be more natural. Doing it
in RegisterPrefs is the one that doesn't work.

This code runs in CreateDefaultManager which is called right next to all the
QUIC field trial bits in the link earlier.
Yup. They reviewed the RC4 code and I'll add them to this CL as well when
getting the rest of the OWNERS in.

+
   PrefChangeRegistrar::NamedChangeCallback local_state_callback =
       base::Bind(&SSLConfigServiceManagerPref::OnPreferenceChanged,
                  base::Unretained(this), local_state);
 
   rev_checking_enabled_.Init(ssl_config::prefs::kCertRevocationCheckingEnabled,
                              local_state, local_state_callback);
   rev_checking_required_local_anchors_.Init(
       ssl_config::prefs::kCertRevocationCheckingRequiredLocalAnchors,
       local_state, local_state_callback);
   ssl_version_min_.Init(ssl_config::prefs::kSSLVersionMin, local_state,
@@ skipping 77 matching lines @@
   uint16_t version_max = SSLProtocolVersionFromString(version_max_str);
   uint16_t version_fallback_min =
       SSLProtocolVersionFromString(version_fallback_min_str);
   if (version_min) {
     config->version_min = version_min;
   }
   if (version_max) {
     uint16_t supported_version_max = config->version_max;
     config->version_max = std::min(supported_version_max, version_max);
   }
-  if (version_fallback_min) {
+  // Values below TLS 1.1 are invalid.
+  if (version_fallback_min &&
+      version_fallback_min >= net::SSL_PROTOCOL_VERSION_TLS1_1) {
     config->version_fallback_min = version_fallback_min;
   }
   config->disabled_cipher_suites = disabled_cipher_suites_;
   config->rc4_enabled = rc4_enabled_.GetValue();
 }
 
 void SSLConfigServiceManagerPref::OnDisabledCipherSuitesChange(
     PrefService* local_state) {
   const base::ListValue* value =
       local_state->GetList(ssl_config::prefs::kCipherSuiteBlacklist);
   disabled_cipher_suites_ = ParseCipherSuites(ListValueToStringVector(value));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 //  SSLConfigServiceManager
 
 namespace ssl_config {
 // static
 SSLConfigServiceManager* SSLConfigServiceManager::CreateDefaultManager(
     PrefService* local_state,
     const scoped_refptr<base::SingleThreadTaskRunner>& io_task_runner) {
   return new SSLConfigServiceManagerPref(local_state, io_task_runner);
 }
 
 // static
 void SSLConfigServiceManager::RegisterPrefs(PrefRegistrySimple* registry) {
   SSLConfigServiceManagerPref::RegisterPrefs(registry);
 }
 }  // namespace ssl_config