net: disable SSLv3 fallback.

net/ssl/ssl_config.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SSL_SSL_CONFIG_H_
 #define NET_SSL_SSL_CONFIG_H_
 
 #include "base/basictypes.h"
 #include "base/memory/ref_counted.h"
 #include "net/base/net_export.h"
@@ skipping 14 matching lines @@
   SSL_PROTOCOL_VERSION_TLS1_1 = 0x0302,
   SSL_PROTOCOL_VERSION_TLS1_2 = 0x0303,
 };
 
 // Default minimum protocol version.
 NET_EXPORT extern const uint16 kDefaultSSLVersionMin;
 
 // Default maximum protocol version.
 NET_EXPORT extern const uint16 kDefaultSSLVersionMax;
 
+// Default minimum protocol version that it's acceptable to fallback to.
+NET_EXPORT extern const uint16 kDefaultSSLVersionFallbackMin;
+
 // A collection of SSL-related configuration settings.
 struct NET_EXPORT SSLConfig {
   // Default to revocation checking.
   // Default to SSL 3.0 ~ default_version_max() on.
   SSLConfig();
   ~SSLConfig();
 
   // Returns true if |cert| is one of the certs in |allowed_bad_certs|.
   // The expected cert status is written to |cert_status|. |*cert_status| can
   // be NULL if user doesn't care about the cert status.
@@ skipping 21 matching lines @@
   bool rev_checking_required_local_anchors;
 
   // The minimum and maximum protocol versions that are enabled.
   // SSL 3.0 is 0x0300, TLS 1.0 is 0x0301, TLS 1.1 is 0x0302, and so on.
   // (Use the SSL_PROTOCOL_VERSION_xxx enumerators defined above.)
   // SSL 2.0 is not supported. If version_max < version_min, it means no
   // protocol versions are enabled.
   uint16 version_min;
   uint16 version_max;
 
+  // version_fallback_min contains the minimum version that is acceptable to
+  // fallback to. Versions before this may be tried to see whether they would
+  // have succeeded and thus to give a better message to the user, but the
+  // resulting connection won't be used in these cases.
+  uint16 version_fallback_min;
+
   // Presorted list of cipher suites which should be explicitly prevented from
   // being used in addition to those disabled by the net built-in policy.
   //
   // By default, all cipher suites supported by the underlying SSL
   // implementation will be enabled except for:
   // - Null encryption cipher suites.
   // - Weak cipher suites: < 80 bits of security strength.
   // - FORTEZZA cipher suites (obsolete).
   // - IDEA cipher suites (RFC 5469 explains why).
   // - Anonymous cipher suites.
@@ skipping 61 matching lines @@
   // client's protocol sets, then the first protocol in this list will be
   // requested by the client.
   std::vector<std::string> next_protos;
 
   scoped_refptr<X509Certificate> client_cert;
 };
 
 }  // namespace net
 
 #endif  // NET_SSL_SSL_CONFIG_H_