net: disable SSLv3 fallback.

net/socket/ssl_client_socket_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // OpenSSL binding for SSLClientSocket. The class layout and general principle
 // of operation is derived from SSLClientSocketNSS.
 
 #include "net/socket/ssl_client_socket_openssl.h"
 
 #include <errno.h>
@@ skipping 889 matching lines @@
         int rv = SSL_CTX_remove_session(SSL_get_SSL_CTX(ssl_), session);
         LOG_IF(WARNING, !rv) << "Couldn't invalidate SSL session: " << session;
       }
     }
   } else if (rv == 1) {
     if (trying_cached_session_ && logging::DEBUG_MODE) {
       DVLOG(2) << "Result of session reuse for " << host_and_port_.ToString()
                << " is: " << (SSL_session_reused(ssl_) ? "Success" : "Fail");
     }
 
+    if (ssl_config_.version_fallback &&
+        ssl_config_.version_max < ssl_config_.version_fallback_min) {
+      return ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION;

[davidben, 2014/10/07 22:06:30]

Ditto for the NSS comment. We should avoid resuming the session. Especially if
this needs to get merged before M39 because that too will clamp the session.

I believe we're fine because MarkSSLSessionAsGood isn't called yet, but wanted
to point this out.

+    }
+
     // SSL handshake is completed. If NPN wasn't negotiated, see if ALPN was.
     if (npn_status_ == kNextProtoUnsupported) {
       const uint8_t* alpn_proto = NULL;
       unsigned alpn_len = 0;
       SSL_get0_alpn_selected(ssl_, &alpn_proto, &alpn_len);
       if (alpn_len > 0) {
         npn_proto_.assign(reinterpret_cast<const char*>(alpn_proto), alpn_len);
         npn_status_ = kNextProtoNegotiated;
       }
     }
@@ skipping 844 matching lines @@
                                             ct::SCT_STATUS_LOG_UNKNOWN));
   }
 }
 
 scoped_refptr<X509Certificate>
 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const {
   return server_cert_;
 }
 
 }  // namespace net