Add Enterprise policy option to control minimum SSL fallback level.

Add Enterprise policy option to control minimum SSL fallback level.

r299567 disabled SSLv3 fallback. This change adds an enterprise policy option
to control this value so that enterprises can reenable the fallback if they
need it.

This option is in contrast to the one added in r299755. That one allows
enterprises to be more aggressive in disabling SSLv3, while this one is
intended for those who need to more slower that Chrome's default.

BUG=418848, 419870
Committed: https://crrev.com/33369a4034528613b79464015cf8a000e3f27abb
Cr-Commit-Position: refs/heads/master@{#300178}

[agl, 2014-10-17 19:08:30]

agl@chromium.org changed reviewers:
+ asvitkine@chromium.org, atwilson@chromium.org, joaodasilva@chromium.org

[Alexei Svitkine (slow), 2014-10-17 19:08:59]

histograms lgtm

[Joao da Silva, 2014-10-17 19:19:13]

code lgtm

However I don't quite understand how these 2 policies will interact. I thought
setting SSLVersionMin to "ssl3" would always enable the fallback to ssl3, even
post M40?

[agl, 2014-10-17 20:12:05]

On 2014/10/17 19:19:13, Joao da Silva wrote:
> code lgtm
> 
> However I don't quite understand how these 2 policies will interact. I thought
> setting SSLVersionMin to "ssl3" would always enable the fallback to ssl3, even
> post M40?

No, SSLVersionMin is for places that want to disable SSLv3 ASAP.

SSLVersionFallbackMin is for places that have buggy servers and need to keep
them working temporarily.

In short, if you're worried about attacks -> set SSLVersionMin=tls1. If you've
got a server that broke with Chrome 39 -> set SSLVersionFallbackMin=ssl3.

[agl, 2014-10-17 22:08:49]

The CQ bit was checked by agl@chromium.org

[commit-bot: I haz the power, 2014-10-17 22:09:52]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/644913008/1

[commit-bot: I haz the power, 2014-10-17 22:28:23]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2014-10-17 22:29:33]

Patchset 1 (id:??) landed as
https://crrev.com/33369a4034528613b79464015cf8a000e3f27abb
Cr-Commit-Position: refs/heads/master@{#300178}