net: disable SSLv3 fallback.

net/ssl/ssl_config.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/ssl_config.h"
 
 #if defined(USE_OPENSSL)
 #include <openssl/ssl.h>
 #endif
 
 namespace net {
 
 const uint16 kDefaultSSLVersionMin = SSL_PROTOCOL_VERSION_SSL3;
 
 const uint16 kDefaultSSLVersionMax =
 #if defined(USE_OPENSSL)
 #if defined(SSL_OP_NO_TLSv1_2)
     SSL_PROTOCOL_VERSION_TLS1_2;
 #elif defined(SSL_OP_NO_TLSv1_1)
     SSL_PROTOCOL_VERSION_TLS1_1;
 #else
     SSL_PROTOCOL_VERSION_TLS1;
 #endif
 #else
     SSL_PROTOCOL_VERSION_TLS1_2;
 #endif
 
+const uint16 kDefaultSSLVersionFallbackMin = SSL_PROTOCOL_VERSION_TLS1;
+
 SSLConfig::CertAndStatus::CertAndStatus() : cert_status(0) {}
 
 SSLConfig::CertAndStatus::~CertAndStatus() {}
 
 SSLConfig::SSLConfig()
     : rev_checking_enabled(false),
       rev_checking_required_local_anchors(false),
       version_min(kDefaultSSLVersionMin),
       version_max(kDefaultSSLVersionMax),
+      version_fallback_min(kDefaultSSLVersionFallbackMin),
       channel_id_enabled(true),
       false_start_enabled(true),
       signed_cert_timestamps_enabled(true),
       require_forward_secrecy(false),
       send_client_cert(false),
       verify_ev_cert(false),
       version_fallback(false),
       cert_io_enabled(true) {
 }
 
@@ skipping 13 matching lines @@
     if (der_cert == allowed_bad_certs[i].der_cert) {
       if (cert_status)
         *cert_status = allowed_bad_certs[i].cert_status;
       return true;
     }
   }
   return false;
 }
 
 }  // namespace net