Address post-review comments on r56727.

net/base/ssl_config_service.h

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_SSL_CONFIG_SERVICE_H_
 #define NET_BASE_SSL_CONFIG_SERVICE_H_
 #pragma once
 
 #include <vector>
 
@@ skipping 15 matching lines @@
 
   bool rev_checking_enabled;  // True if server certificate revocation
                               // checking is enabled.
   bool ssl2_enabled;  // True if SSL 2.0 is enabled.
   bool ssl3_enabled;  // True if SSL 3.0 is enabled.
   bool tls1_enabled;  // True if TLS 1.0 is enabled.
   bool ssl3_fallback;  // True if we are falling back to SSL 3.0 (one still
                        // needs to clear tls1_enabled).
   bool dnssec_enabled;  // True if we'll accept DNSSEC chains in certificates.
 
   // True if we believe that this connection might be MITM attacked. This

[wtc, 2010/08/22 04:44:35]

Should this say
  True if we allow this connection to be MITM attacked.
?

   // sounds a little worse than it is: large networks sometimes MITM attack all
   // SSL connections on egress. We want to know this because we might not have
   // the end-to-end connection that we believe that we have based on the
   // hostname. Therefore, certain certificate checks can't be performed and we
   // can't use outside knowledge about whether the server has the renegotiation
   // extension.
   bool mitm_proxies_allowed;
 
   bool false_start_enabled;  // True if we'll use TLS False Start.
 
@@ skipping 64 matching lines @@
 
   // Returns true if the given hostname is known to be incompatible with TLS
   // False Start.
   static bool IsKnownFalseStartIncompatibleServer(const std::string& hostname);
 
   // Enables the acceptance of self-signed certificates which contain an
   // embedded DNSSEC chain proving their validity.
   static void EnableDNSSEC();
   static bool dnssec_enabled();
 
-  // Enables the |may_be_manipulated| flag in SSLConfig objects. See the
-  // comment about this flag in |SSLConfig|.
+  // Sets a global flag which causes SetSSLConfigFlags to set the

[wtc, 2010/08/22 04:44:35]

Nit: SetSSLConfigFlags is an implementation detail (protected
method).

How about this?
    Sets a global flag which allows SSL connections to
    be MITM attacked.
or
    Allows SSL connections to be MITM attacked.

+  // |mitm_proxies_allowed| flag in SSLConfig objects. See the comment about
+  // this flag in |SSLConfig|.
   static void AllowMITMProxies();
   static bool mitm_proxies_allowed();
 
   // Disables False Start in SSL connections.
   static void DisableFalseStart();
   // True if we use False Start for SSL and TLS.
   static bool false_start_enabled();
 
  protected:
-  // SetFlags sets the values of several flags based on global configuration.
-  static void SetSSLConfigFlags(SSLConfig*);
-
   friend class base::RefCountedThreadSafe<SSLConfigService>;
 
   virtual ~SSLConfigService() {}
+
+  // SetFlags sets the values of several flags based on global configuration.
+  static void SetSSLConfigFlags(SSLConfig*);
 };
 
 }  // namespace net
 
 #endif  // NET_BASE_SSL_CONFIG_SERVICE_H_