Added client-side support for the TLS cached info extension. This feature is disabled by default ...

Added client-side support for the TLS cached info
extension. This feature is disabled by default and
enabled by the flag --enable-cached-info.

BUG=84920
TEST=None

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=90066

[wtc, 2011-06-03 22:56:55]

Thank you for the patch.  I have some preliminary comments
below.  I will check the code carefully next week.

http://codereview.chromium.org/7058049/diff/1021/chrome/common/chrome_switche...
File chrome/common/chrome_switches.cc (right):

http://codereview.chromium.org/7058049/diff/1021/chrome/common/chrome_switche...
chrome/common/chrome_switches.cc:378: // Enables TLS cached info extension
Nit: add a period at the end of this comment.  Our Style
Guide recommends that comments have proper punctuation.
Please check the comments in this patch.

http://codereview.chromium.org/7058049/diff/1021/chrome/common/chrome_switche...
chrome/common/chrome_switches.cc:379: const char kEnableCachedInfo[]  =
"enable-cached-info";
Please name this variable and option with SSL:
  const char kEnableSSLCachedInfo[] = "enable-ssl-cached-info";

http://codereview.chromium.org/7058049/diff/1021/net/socket/ssl_client_socket...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/7058049/diff/1021/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:623: if (ssl_host_info_.get()) {
This should also check that the cached info extension is
enabled.  Please see AGL's diffs for a reference.

Note that I had to back out this change because it introduced
a crash (http://crbug.com/84426).  Until we track down that
crash, cached info extension has to stay disabled by default.

http://codereview.chromium.org/7058049/diff/1021/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:967: LogFailedNSSFunction(net_log_,
"SSL_OptionSet (CachedInfo)", "");
I think we should imitate lines 940 and 972 instead of line
959.

Could you fix line 959 also?

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
File net/third_party/nss/ssl/ssl3con.c (right):

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8071: if (ss->xtnData.negotiated[i] ==
ssl_cached_info_xtn) {
There should be a function that does this search in the
ss->xtnData.negotiated array for a particular extension.
Can you use it?

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8078: if (length == 12) {
Use the using_cert_chain_digest variable in this test.

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8110: else {
Put } and else on the same line:

    } else {

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8226: ss->ssl3.hs.rehandshake = PR_TRUE;
Don't fix the TABs in NSS source code.

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
File net/third_party/nss/ssl/ssl3ext.c (right):

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3ext.c:750: }
Fold these long lines.

[rkn, 2011-06-04 20:50:19]

http://codereview.chromium.org/7058049/diff/1021/chrome/common/chrome_switche...
File chrome/common/chrome_switches.cc (right):

http://codereview.chromium.org/7058049/diff/1021/chrome/common/chrome_switche...
chrome/common/chrome_switches.cc:378: // Enables TLS cached info extension
On 2011/06/03 22:56:55, wtc wrote:
> Nit: add a period at the end of this comment.  Our Style
> Guide recommends that comments have proper punctuation.
> Please check the comments in this patch.

Done.

http://codereview.chromium.org/7058049/diff/1021/chrome/common/chrome_switche...
chrome/common/chrome_switches.cc:379: const char kEnableCachedInfo[]  =
"enable-cached-info";
On 2011/06/03 22:56:55, wtc wrote:
> Please name this variable and option with SSL:
>   const char kEnableSSLCachedInfo[] = "enable-ssl-cached-info";

Done.

http://codereview.chromium.org/7058049/diff/1021/net/socket/ssl_client_socket...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/7058049/diff/1021/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:623: if (ssl_host_info_.get()) {
On 2011/06/03 22:56:55, wtc wrote:
> This should also check that the cached info extension is
> enabled.  Please see AGL's diffs for a reference.
> 
> Note that I had to back out this change because it introduced
> a crash (http://crbug.com/84426).  Until we track down that
> crash, cached info extension has to stay disabled by default.

Done.

http://codereview.chromium.org/7058049/diff/1021/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:967: LogFailedNSSFunction(net_log_,
"SSL_OptionSet (CachedInfo)", "");
On 2011/06/03 22:56:55, wtc wrote:
> I think we should imitate lines 940 and 972 instead of line
> 959.
> 
> Could you fix line 959 also?

Done.

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
File net/third_party/nss/ssl/ssl3con.c (right):

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8071: if (ss->xtnData.negotiated[i] ==
ssl_cached_info_xtn) {
On 2011/06/03 22:56:55, wtc wrote:
> There should be a function that does this search in the
> ss->xtnData.negotiated array for a particular extension.
> Can you use it?

Done.

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8078: if (length == 12) {
On 2011/06/03 22:56:55, wtc wrote:
> Use the using_cert_chain_digest variable in this test.

Done.

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8110: else {
On 2011/06/03 22:56:55, wtc wrote:
> Put } and else on the same line:
> 
>     } else {

Done.

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
File net/third_party/nss/ssl/ssl3ext.c (right):

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3ext.c:750: }
On 2011/06/03 22:56:55, wtc wrote:
> Fold these long lines.

Done.

[rkn, 2011-06-04 20:52:30]

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
File net/third_party/nss/ssl/ssl3con.c (right):

http://codereview.chromium.org/7058049/diff/1021/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8226: ss->ssl3.hs.rehandshake = PR_TRUE;
On 2011/06/03 22:56:55, wtc wrote:
> Don't fix the TABs in NSS source code.

I tried to undo this by downloading and applying a patch from before this change
and then redoing the subsequent changes.

[wtc, 2011-06-17 22:57:09]

LGTM.  I found a bug below, marked with "BUG".

Please upload a new patch set before you check this in.

http://codereview.chromium.org/7058049/diff/8001/chrome/browser/browser_main.cc
File chrome/browser/browser_main.cc (right):

http://codereview.chromium.org/7058049/diff/8001/chrome/browser/browser_main....
chrome/browser/browser_main.cc:238: //  
net::SSLConfigService::EnableSnapStart();
Please remove these three lines (236-238), and move the new
code here.

http://codereview.chromium.org/7058049/diff/8001/chrome/common/chrome_switches.h
File chrome/common/chrome_switches.h (right):

http://codereview.chromium.org/7058049/diff/8001/chrome/common/chrome_switche...
chrome/common/chrome_switches.h:116: extern const char kEnableCachedInfo[];
Nit: please also add "SSL" to the constant's name: kEnableSSLCachedInfo

http://codereview.chromium.org/7058049/diff/8001/chrome/common/chrome_switche...
chrome/common/chrome_switches.h:145: extern const char kEnableSnapStart[];
Remove kEnableSnapStart here and in chrome/common/chrome_switches.cc.

http://codereview.chromium.org/7058049/diff/8001/net/base/ssl_config_service.cc
File net/base/ssl_config_service.cc (right):

http://codereview.chromium.org/7058049/diff/8001/net/base/ssl_config_service....
net/base/ssl_config_service.cc:77: }
Move this up to before line 53.  The Style guide recommends:
  Method definitions in the corresponding .cc file should be
  the same as the declaration order, as much as possible.

http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml#Declaration_Order

http://codereview.chromium.org/7058049/diff/8001/net/base/ssl_config_service.h
File net/base/ssl_config_service.h (right):

http://codereview.chromium.org/7058049/diff/8001/net/base/ssl_config_service....
net/base/ssl_config_service.h:138: // just a digest of its certificate chain
Nit: add a period (.)

http://codereview.chromium.org/7058049/diff/8001/net/socket/ssl_client_socket...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/7058049/diff/8001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:925: "SSL_ENABLE_OCSP_STAPLING");
Nit: add curly braces {} around the "if" statement body
because it is more than one line (even though it's a single
statement).

http://codereview.chromium.org/7058049/diff/8001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:1306: }
Nit: in the "net" directory, don't use curly braces around
simple one-liner "if" statements.

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
File net/third_party/nss/ssl/ssl3con.c (right):

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8021: if (length == 12 &&
ssl3_ExtensionNegotiated(ss, ssl_cached_info_xtn)) {
BUG: you need to check that the received certificate_chain
digest is correct.  If it is wrong, we need to fail with some
SSL alert message.

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8032: ssl3CertNode *certNodeCurrent;
Declare the variable at the beginning of the block (line 8022).

Make the same fix to line 8040.

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8039:
CERT_DupCertificate(ss->ssl3.predictedCertChain[0]);
ss->ssl3.predictedCertChain[0] should not be added to
ss->ssl3.peerCertChain.

There may be some other bug fixes that you need to merge
from your upstream NSS tree.

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
File net/third_party/nss/ssl/ssl3ext.c (right):

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3ext.c:695: //    ? PR_TRUE : PR_FALSE;
Declare predictedCertChain at the beginning of the block.
Please go through the file to fix all occurrences of this
problem.

Remove the commented-out code.

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3ext.c:696: send_empty = (predictedCertChain == NULL)
? PR_TRUE : PR_FALSE;
This can be written simply as:
    send_empty = (predictedCertChain == NULL);

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3ext.c:742: certLen & 0xff};
Nit: format this as:
    unsigned char certLenArray[3] = {
        (certLen & 0xff0000) >> 16,
        (certLen & 0xff00) >> 8,
        certLen & 0xff
    };

[rkn, 2011-06-20 21:21:09]

http://codereview.chromium.org/7058049/diff/8001/chrome/browser/browser_main.cc
File chrome/browser/browser_main.cc (right):

http://codereview.chromium.org/7058049/diff/8001/chrome/browser/browser_main....
chrome/browser/browser_main.cc:238: //  
net::SSLConfigService::EnableSnapStart();
On 2011/06/17 22:57:09, wtc wrote:
> Please remove these three lines (236-238), and move the new
> code here.

Done.

http://codereview.chromium.org/7058049/diff/8001/chrome/common/chrome_switches.h
File chrome/common/chrome_switches.h (right):

http://codereview.chromium.org/7058049/diff/8001/chrome/common/chrome_switche...
chrome/common/chrome_switches.h:116: extern const char kEnableCachedInfo[];
On 2011/06/17 22:57:09, wtc wrote:
> Nit: please also add "SSL" to the constant's name: kEnableSSLCachedInfo

Done.

http://codereview.chromium.org/7058049/diff/8001/chrome/common/chrome_switche...
chrome/common/chrome_switches.h:145: extern const char kEnableSnapStart[];
On 2011/06/17 22:57:09, wtc wrote:
> Remove kEnableSnapStart here and in chrome/common/chrome_switches.cc.

Done.

http://codereview.chromium.org/7058049/diff/8001/net/base/ssl_config_service.cc
File net/base/ssl_config_service.cc (right):

http://codereview.chromium.org/7058049/diff/8001/net/base/ssl_config_service....
net/base/ssl_config_service.cc:77: }
On 2011/06/17 22:57:09, wtc wrote:
> Move this up to before line 53.  The Style guide recommends:
>   Method definitions in the corresponding .cc file should be
>   the same as the declaration order, as much as possible.
> 
>
http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml#Declaration_Order

Done.

http://codereview.chromium.org/7058049/diff/8001/net/base/ssl_config_service.h
File net/base/ssl_config_service.h (right):

http://codereview.chromium.org/7058049/diff/8001/net/base/ssl_config_service....
net/base/ssl_config_service.h:138: // just a digest of its certificate chain
On 2011/06/17 22:57:09, wtc wrote:
> Nit: add a period (.)

Done.

http://codereview.chromium.org/7058049/diff/8001/net/socket/ssl_client_socket...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/7058049/diff/8001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:925: "SSL_ENABLE_OCSP_STAPLING");
On 2011/06/17 22:57:09, wtc wrote:
> Nit: add curly braces {} around the "if" statement body
> because it is more than one line (even though it's a single
> statement).

Done.

http://codereview.chromium.org/7058049/diff/8001/net/socket/ssl_client_socket...
net/socket/ssl_client_socket_nss.cc:1306: }
On 2011/06/17 22:57:09, wtc wrote:
> Nit: in the "net" directory, don't use curly braces around
> simple one-liner "if" statements.

Done.

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
File net/third_party/nss/ssl/ssl3con.c (right):

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8021: if (length == 12 &&
ssl3_ExtensionNegotiated(ss, ssl_cached_info_xtn)) {
On 2011/06/17 22:57:09, wtc wrote:
> BUG: you need to check that the received certificate_chain
> digest is correct.  If it is wrong, we need to fail with some
> SSL alert message.

Done.

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8032: ssl3CertNode *certNodeCurrent;
On 2011/06/17 22:57:09, wtc wrote:
> Declare the variable at the beginning of the block (line 8022).
> 
> Make the same fix to line 8040.

Done (It is ok to put the declaration after the comment right?).

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3con.c:8039:
CERT_DupCertificate(ss->ssl3.predictedCertChain[0]);
On 2011/06/17 22:57:09, wtc wrote:
> ss->ssl3.predictedCertChain[0] should not be added to
> ss->ssl3.peerCertChain.
> 
> There may be some other bug fixes that you need to merge
> from your upstream NSS tree.

Done.

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
File net/third_party/nss/ssl/ssl3ext.c (right):

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3ext.c:695: //    ? PR_TRUE : PR_FALSE;
On 2011/06/17 22:57:09, wtc wrote:
> Declare predictedCertChain at the beginning of the block.
> Please go through the file to fix all occurrences of this
> problem.
> 
> Remove the commented-out code.

Done.

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3ext.c:696: send_empty = (predictedCertChain == NULL)
? PR_TRUE : PR_FALSE;
On 2011/06/17 22:57:09, wtc wrote:
> This can be written simply as:
>     send_empty = (predictedCertChain == NULL);

Done.

http://codereview.chromium.org/7058049/diff/8001/net/third_party/nss/ssl/ssl3...
net/third_party/nss/ssl/ssl3ext.c:742: certLen & 0xff};
On 2011/06/17 22:57:09, wtc wrote:
> Nit: format this as:
>     unsigned char certLenArray[3] = {
>         (certLen & 0xff0000) >> 16,
>         (certLen & 0xff00) >> 8,
>         certLen & 0xff
>     };

Done.

[wtc, 2011-06-20 22:21:51]

LGTM.

You can make the last two changes below in a new CL.  But
please make the other changes before you check this in.  Thanks.

http://codereview.chromium.org/7058049/diff/18001/chrome/common/chrome_switch...
File chrome/common/chrome_switches.h (right):

http://codereview.chromium.org/7058049/diff/18001/chrome/common/chrome_switch...
chrome/common/chrome_switches.h:111: extern const char kEnableSSLCachedInfo[];
Nit: list this in alphabetical order.

Make the same change to chrome/common/chrome_switches.cc.

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl.h
File net/third_party/nss/ssl/ssl.h (right):

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
net/third_party/nss/ssl/ssl.h:143: #define SSL_ENABLE_CACHED_INFO         24 /*
Enable SSL cached information  */
Nit: let's call this "TLS cached information extension", so
change "SSL" to "TLS" in the comment.

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
File net/third_party/nss/ssl/ssl3con.c (right):

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
net/third_party/nss/ssl/ssl3con.c:8026: if (memcmp(b+4,
ss->ssl3.certChainDigest, 8)) {
Nit: add spaces around the '+' sign.

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
net/third_party/nss/ssl/ssl3con.c:8031: ss->ssl3.digestReceived = PR_TRUE;
Nit: perhaps we should do this before the memcmp call above?

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
net/third_party/nss/ssl/ssl3con.c:8064: }
I believe we can rewrite lines 8041-8064 as follows:

    int i;
    for (i = 1; ss->ssl3.predictedCertChain[i] != NULL; i++) {
        c = PORT_ArenaNew(arena, ssl3CertNode);
        if (c == NULL) {
            goto loser;» /* don't send alerts on memory errors */
        }
        c->cert = CERT_DupCertificate(ss->ssl3.predictedCertChain[i]);
        c->next = NULL;
        if (lastCert) {
            lastCert->next = c;
        } else {
            ss->ssl3.peerCertChain = c;
        }
        lastCert = c;
    }

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
net/third_party/nss/ssl/ssl3con.c:8127: trusted = PR_TRUE;
We probably should duplicate these two lines (lines 8126-8127)
in the digested cert chain case above.

[rkn, 2011-06-20 23:52:50]

http://codereview.chromium.org/7058049/diff/18001/chrome/common/chrome_switch...
File chrome/common/chrome_switches.h (right):

http://codereview.chromium.org/7058049/diff/18001/chrome/common/chrome_switch...
chrome/common/chrome_switches.h:111: extern const char kEnableSSLCachedInfo[];
On 2011/06/20 22:21:51, wtc wrote:
> Nit: list this in alphabetical order.
> 
> Make the same change to chrome/common/chrome_switches.cc.

Done.

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl.h
File net/third_party/nss/ssl/ssl.h (right):

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
net/third_party/nss/ssl/ssl.h:143: #define SSL_ENABLE_CACHED_INFO         24 /*
Enable SSL cached information  */
On 2011/06/20 22:21:51, wtc wrote:
> Nit: let's call this "TLS cached information extension", so
> change "SSL" to "TLS" in the comment.

Done. I changed the comment, but I did not change the name
"SSL_ENABLE_CACHED_INFO". I think that is what you intended.

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
File net/third_party/nss/ssl/ssl3con.c (right):

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
net/third_party/nss/ssl/ssl3con.c:8026: if (memcmp(b+4,
ss->ssl3.certChainDigest, 8)) {
On 2011/06/20 22:21:51, wtc wrote:
> Nit: add spaces around the '+' sign.

Done.

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
net/third_party/nss/ssl/ssl3con.c:8031: ss->ssl3.digestReceived = PR_TRUE;
On 2011/06/20 22:21:51, wtc wrote:
> Nit: perhaps we should do this before the memcmp call above?

Done.

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
net/third_party/nss/ssl/ssl3con.c:8064: }
On 2011/06/20 22:21:51, wtc wrote:
> I believe we can rewrite lines 8041-8064 as follows:
> 
>     int i;
>     for (i = 1; ss->ssl3.predictedCertChain[i] != NULL; i++) {
>         c = PORT_ArenaNew(arena, ssl3CertNode);
>         if (c == NULL) {
>             goto loser;» /* don't send alerts on memory errors */
>         }
>         c->cert = CERT_DupCertificate(ss->ssl3.predictedCertChain[i]);
>         c->next = NULL;
>         if (lastCert) {
>             lastCert->next = c;
>         } else {
>             ss->ssl3.peerCertChain = c;
>         }
>         lastCert = c;
>     }

Done. I made this change, but I added the line 

	ss->ssl3.peerCertChain = NULL;

before the for loop in order to handle the case in which the cert chain has
length 1.

http://codereview.chromium.org/7058049/diff/18001/net/third_party/nss/ssl/ssl...
net/third_party/nss/ssl/ssl3con.c:8127: trusted = PR_TRUE;
On 2011/06/20 22:21:51, wtc wrote:
> We probably should duplicate these two lines (lines 8126-8127)
> in the digested cert chain case above.

I am holding off on making this change, because I don't fully understand the
role of c->cert->trust and because the variable "trusted" never seems to be
used.

[commit-bot: I haz the power, 2011-06-21 21:05:45]

Can't apply patch for file net/base/ssl_config_service.cc.
While running patch -p0 --forward --force;
patching file net/base/ssl_config_service.cc
Hunk #2 FAILED at 49.
Hunk #3 succeeded at 85 (offset -11 lines).
1 out of 3 hunks FAILED -- saving rejects to file
net/base/ssl_config_service.cc.rej

[commit-bot: I haz the power, 2011-06-22 19:24:40]

Change committed as 90066