net: disable SSLv3 fallback.

net/base/net_error_list.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file intentionally does not have header guards, it's included
 // inside a macro to generate enum values.
 
 // This file contains the list of network errors.
 
 //
@@ skipping 318 matching lines @@
 NET_ERROR(SOCKET_RECEIVE_BUFFER_SIZE_UNCHANGEABLE, -162)
 
 // Failed to set the socket's send buffer size as requested, despite success
 // return code from setsockopt.
 NET_ERROR(SOCKET_SEND_BUFFER_SIZE_UNCHANGEABLE, -163)
 
 // Failed to import a client certificate from the platform store into the SSL
 // library.
 NET_ERROR(SSL_CLIENT_AUTH_CERT_BAD_FORMAT, -164)
 
+// The SSL connection needed a fallback version less than the configured
+// minimum fallback version.

[Ryan Sleevi, 2014/09/30 19:34:19]

This reads a little weird. Perhaps something like

// The SSL server requires falling back to a version weaker than the configured
minimum fallback version, and thus fallback failed.

(s/weaker/older/ or /less than/ for taste)

[agl, 2014/10/01 21:10:53]

Done.

+NET_ERROR(SSL_NEEDS_MORE_FALLBACK, -165)

[Ryan Sleevi, 2014/09/30 19:34:19]

NEEDS_MORE_FALLBACK is... a little less descriptive than I'd hope.

SSL_CANT_FALLBACK_BEYOND_MINIMUM_VERSION ?

That is, I'd hope that the error code tries to describe what's going on without
the error message.

I'm pretty flexible on this if you have alternatives, the concrete concern I
have with "needs more fallback" is that it feels like it combines two
comparators (more = greater than, fallback = less than). That is, you need more
of less security. Which is weird.

Something that can avoid words like "more" is ideal.

[agl, 2014/10/01 21:10:53]

Went with SSL_FALLBACK_BEYOND_MINIMUM_VERSION.

+
 // Certificate error codes
 //
 // The values of certificate error codes must be consecutive.
 
 // The server responded with a certificate whose common name did not match
 // the host name.  This could mean:
 //
 // 1. An attacker has redirected our traffic to his server and is
 //    presenting a certificate for which he knows the private key.
 //
@@ skipping 416 matching lines @@
 NET_ERROR(DNS_TIMED_OUT, -803)
 
 // The entry was not found in cache, for cache-only lookups.
 NET_ERROR(DNS_CACHE_MISS, -804)
 
 // Suffix search list rules prevent resolution of the given host name.
 NET_ERROR(DNS_SEARCH_EMPTY, -805)
 
 // Failed to sort addresses according to RFC3484.
 NET_ERROR(DNS_SORT_ERROR, -806)