Shard the SSL session cache by version fallback.

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 3338 matching lines @@
   // field at the beginning.  PRNetAddr has a two-byte address
   // family field at the beginning.
   peername.raw.family = storage.addr->sa_family;
 
   memio_SetPeerName(nss_fd_, &peername);
 
   // Set the peer ID for session reuse.  This is necessary when we create an
   // SSL tunnel through a proxy -- GetPeerName returns the proxy's address
   // rather than the destination server's address in that case.
   std::string peer_id = host_and_port_.ToString();
-  // If the ssl_session_cache_shard_ is non-empty, we append it to the peer id.
-  // This will cause session cache misses between sockets with different values
-  // of ssl_session_cache_shard_ and this is used to partition the session cache
-  // for incognito mode.
-  if (!ssl_session_cache_shard_.empty()) {
-    peer_id += "/" + ssl_session_cache_shard_;
+  // Append |ssl_session_cache_shard_| to the peer id. This is used to partition
+  // the session cache for incognito mode.
+  peer_id += "/" + ssl_session_cache_shard_;
+  peer_id += "/";
+  // Shard the session cache based on maximum protocol version. This causes
+  // fallback connections to use a separate session cache.
+  switch (ssl_config_.version_max) {
+    case SSL_PROTOCOL_VERSION_SSL3:
+      peer_id += "ssl3";
+      break;
+    case SSL_PROTOCOL_VERSION_TLS1:
+      peer_id += "tls1";
+      break;
+    case SSL_PROTOCOL_VERSION_TLS1_1:
+      peer_id += "tls1.1";
+      break;
+    case SSL_PROTOCOL_VERSION_TLS1_2:
+      peer_id += "tls1.2";
+      break;
+    default:
+      NOTREACHED();
   }
+
   SECStatus rv = SSL_SetSockPeerID(nss_fd_, const_cast<char*>(peer_id.c_str()));
   if (rv != SECSuccess)
     LogFailedNSSFunction(net_log_, "SSL_SetSockPeerID", peer_id.c_str());
 
   return OK;
 }
 
 void SSLClientSocketNSS::DoConnectCallback(int rv) {
   EnterFunction(rv);
   DCHECK_NE(ERR_IO_PENDING, rv);
@@ skipping 261 matching lines @@
 scoped_refptr<X509Certificate>
 SSLClientSocketNSS::GetUnverifiedServerCertificateChain() const {
   return core_->state().server_cert.get();
 }
 
 ChannelIDService* SSLClientSocketNSS::GetChannelIDService() const {
   return channel_id_service_;
 }
 
 }  // namespace net