net: disable SSLv3 fallback.

net/socket/ssl_client_socket_openssl.cc

Index: net/socket/ssl_client_socket_openssl.cc
diff --git a/net/socket/ssl_client_socket_openssl.cc b/net/socket/ssl_client_socket_openssl.cc
index f341a9fc3775a60266d77f36e40babff29ea1ee9..7860a1cb0a5200c227f369cbe1ef60d2211e516a 100644
--- a/net/socket/ssl_client_socket_openssl.cc
+++ b/net/socket/ssl_client_socket_openssl.cc
@@ -907,6 +907,11 @@ int SSLClientSocketOpenSSL::DoHandshake() {
                << " is: " << (SSL_session_reused(ssl_) ? "Success" : "Fail");
     }
 
+    if (ssl_config_.version_fallback &&
+        ssl_config_.version_max < ssl_config_.version_fallback_min) {
+      return ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION;

[davidben, 2014/10/07 22:06:30]

Ditto for the NSS comment. We should avoid resuming the session. Especially if
this needs to get merged before M39 because that too will clamp the session.

I believe we're fine because MarkSSLSessionAsGood isn't called yet, but wanted
to point this out.

+    }
+
     // SSL handshake is completed. If NPN wasn't negotiated, see if ALPN was.
     if (npn_status_ == kNextProtoUnsupported) {
       const uint8_t* alpn_proto = NULL;