net: don't remember TLS intolerant servers.

net/url_request/url_request_unittest.cc

Index: net/url_request/url_request_unittest.cc
diff --git a/net/url_request/url_request_unittest.cc b/net/url_request/url_request_unittest.cc
index d825711f42d15623b4dc972273958f4c3ce7b1cd..843b314f9326bdc8f8c3d37a308547521d0883b1 100644
--- a/net/url_request/url_request_unittest.cc
+++ b/net/url_request/url_request_unittest.cc
@@ -1726,6 +1726,28 @@ TEST_F(HTTPSCRLSetTest, ExpiredCRLSet) {
   EXPECT_FALSE(cert_status & CERT_STATUS_REV_CHECKING_ENABLED);
 }
 
+TEST_F(HTTPSRequestTest, SSLv3Fallback) {
+  TestServer::HTTPSOptions https_options(
+      TestServer::HTTPSOptions::CERT_OK);
+  https_options.tls_intolerant = true;
+  TestServer test_server(https_options,
+                         FilePath(FILE_PATH_LITERAL("net/data/ssl")));
+  ASSERT_TRUE(test_server.Start());
+
+  TestDelegate d;
+  scoped_refptr<TestURLRequestContext> context(new TestURLRequestContext(true));
+  context->Init();
+  d.set_allow_certificate_errors(true);
+  URLRequest r(test_server.GetURL(""), &d);
+  r.set_context(context.get());
+  r.Start();
+
+  MessageLoop::current()->Run();
+
+  EXPECT_EQ(1, d.response_started_count());
+  EXPECT_NE(0, d.bytes_received());

[wtc, 2012/04/26 00:49:14]

Is it easy to check that SSLv3 was used?

I guess a nonzero d.response_started_count() implies that
SSLv3 fallback must have succeeded.

[agl, 2012/04/26 17:03:29]

I remembered that we have a connection_status flag for this already
(SSL_CONNECTION_SSL3_FALLBACK) so I've added a test for that.

+}
+
 // This tests that a load of www.google.com with a certificate error sets
 // the |certificate_errors_are_fatal| flag correctly. This flag will cause
 // the interstitial to be fatal.