Provide enterprise policy option to set the minimum SSL version.

components/policy/resources/policy_templates.json

 {
 # policy_templates.json - Metafile for policy templates
 #
 # The content of this file is evaluated as a Python expression.
 #
 # This file is used as input to generate the following policy templates:
 # ADM, ADMX+ADML, MCX/plist and html documentation.
 #
 # Policy templates are user interface definitions or documents about the
 # policies that can be used to configure Chrome. Each policy is a name-value
@@ skipping 105 matching lines @@
 #   templates and documentation. The policy definition list that Chrome sees
 #   will include policies marked with 'future'. If a WIP policy isn't meant to
 #   be seen by the policy providers either, the 'supported_on' key should be set
 #   to an empty list.
 #
 # IDs:
 #   Since a Protocol Buffer definition is generated from this file, unique and
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 278
+#   For your editing convenience: highest ID currently used: 279
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
 #     $1 -> Google Chrome / Chromium
 #     $2 -> Google Chrome OS / Chromium OS
 #     $3 -> Google Chrome Frame / Chromium Frame
 #     $6 is reserved for doc_writer
 #
 # Device Policy:
 #   An additional flag device_only (optional, defaults to False) indicates
@@ skipping 6647 matching lines @@
         'dynamic_refresh': True,
         'per_profile': False,
       },
       'example_value': True,
       'id': 276,
       'caption': '''Enable add person in profile manager''',
       'desc': '''If this policy is set to true or not configured, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will allow Add Person from the user manager.
 
       If this policy is set to false, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will not allow creation of new profiles from the profile manager.''',
     },
+    {
+      'name': 'SSLVersionMin',

[Andrew T Wilson (Slow), 2014/10/14 08:32:53]

I wonder if instead of a blanket policy, if instead admins should be allowed to
provide a trusted whitelist of sites that are allowed to use sslv3?

[agl, 2014/10/14 17:39:51]

The message is very much that we're moving on from SSLv3. Adding infrastructure
to support of a set of hostnames would make the patch more difficult and
dangerous to merge. Users who are using this to reenable SSLv3 /should/ feel
that it's a questionable choice!

(Also, some might want to use it to *disable* SSLv3 before we do by default. I
rather hope that's the more common usage.)

+      'type': 'string-enum',
+      'schema': {
+        'type': 'string',
+        'enum': [
+          'ssl3',
+          'tls1',
+          'tls1.1',
+          'tls1.2',
+        ],
+      },
+      'items': [
+        {
+          'name': 'SSLv3',
+          'value': 'ssl3',
+          'caption': 'SSL 3.0',
+        },
+        {
+          'name': 'TLSv1',
+          'value': 'tls1',
+          'caption': 'TLS 1.0',
+        },
+        {
+          'name': 'TLSv1.1',
+          'value': 'tls1.1',
+          'caption': 'TLS 1.1',
+        },
+        {
+          'name': 'TLSv1.2',
+          'value': 'tls1.2',
+          'caption': 'TLS 1.2',
+        },
+      ],
+      'supported_on': ['chrome.*:39-', 'chrome_os:39-', 'android:39-'],

[Andrew T Wilson (Slow), 2014/10/14 08:32:53]

We use our own net stack on ios - is this policy supported on that platform?

[Joao da Silva, 2014/10/14 08:40:10]

Is this going to be merged back to 39? Current trunk is 40.

[agl, 2014/10/14 17:39:51]

We are going to watch and listen to requests once the issue is public but I do
expect that this will be merged to 39 at least.

[agl, 2014/10/14 17:39:51]

Thanks -- I just omitted ios. Done.

+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': False,
+      },
+      'example_value': 'ssl3',
+      'id': 279,
+      'caption': '''Minimum SSL version enabled''',
+      'desc': '''If this policy is not configured then <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will use a default minimum version, which is SSLv3 in Chrome 39 but may be TLS 1.0 in Chrome 40.

[Andrew T Wilson (Slow), 2014/10/14 08:32:53]

The idea is that ssl3 < tls1 for the purposes of this check - I'm wondering if
we need to make this fact clearer in the documentation?

[agl, 2014/10/14 17:39:51]

That's good point. It is something that people have misunderstood in the past.
I've added a note to that effect.

+
+      Otherwise it may be set to one of the following values: "sslv3", "tls1", "tls1.1" or "tls1.2". When set, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will not use SSL/TLS versions less than the specified version. An unrecognized value will be ignored.''',
+    },
   ],
   'messages': {
     # Messages that are not associated to any policies.
     'win_supported_winxpsp2': {
       'desc': '''A label specifying the oldest possible compatible version of Windows. This text will appear right next to a label containing the text 'Supported on:'.''',
       'text': '''Microsoft Windows XP SP2 or later'''
     },
     'mac_chrome_preferences': {
       'desc': '''A text indicating in Mac OS X Workgroup Manager, that currently the preferences of Chromium are being edited''',
       'text': '''<ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> preferences'''
@@ skipping 104 matching lines @@
       'desc': '''Text appended in parentheses next to the policies top-level container to indicate that those policies are of the Recommended level''',
       'text': 'Default Settings (users can override)',
     },
     'doc_complex_policies_on_windows': {
       'desc': '''Text pointing the user to a help article for complex policies on Windows''',
       'text': '''encoded as a JSON string, for details see <ph name="COMPLEX_POLICIES_URL">http://www.chromium.org/administrators/complex-policies-on-windows<ex>http://www.chromium.org/administrators/complex-policies-on-windows</ex></ph>''',
     },
   },
   'placeholders': [],
 }