Remove gmail cert from SSLSocketAdapter.

remoting/jingle_glue/ssl_socket_adapter.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "remoting/jingle_glue/ssl_socket_adapter.h"
 
 #include "base/base64.h"
 #include "base/compiler_specific.h"
 #include "base/message_loop.h"
 #include "jingle/glue/utils.h"
 #include "net/base/address_list.h"
 #include "net/base/cert_verifier.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/net_errors.h"
 #include "net/base/ssl_config_service.h"
 #include "net/base/sys_addrinfo.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/url_request/url_request_context.h"
 
 namespace remoting {
 
-namespace {
-
-// NSS doesn't load root certificates when running in sandbox, so we
-// need to have gmail's cert hardcoded.
-//
-// TODO(sergeyu): Remove this when we don't make XMPP connection from
-// inside of sandbox.
-const char kGmailCertBase64[] =
-    "MIIC2TCCAkKgAwIBAgIDBz+SMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT"
-    "MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0"
-    "aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDcwNDExMTcxNzM4WhcNMTIwNDEwMTcxNzM4"
-    "WjBkMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMN"
-    "TW91bnRhaW4gVmlldzEUMBIGA1UEChMLR29vZ2xlIEluYy4xEjAQBgNVBAMTCWdt"
-    "YWlsLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1Hds2jWwXAVGef06"
-    "7PeSJF/h9BnoYlTdykx0lBTDc92/JLvuq0lJkytqll1UR4kHmF4vwqQkwcqOK03w"
-    "k8qDK8fh6M13PYhvPEXP02ozsuL3vqE8hcCva2B9HVnOPY17Qok37rYQ+yexswN5"
-    "eh0+93nddEa1PyHgEQ8CDKCJaWUCAwEAAaOBrjCBqzAOBgNVHQ8BAf8EBAMCBPAw"
-    "HQYDVR0OBBYEFJcjzXEevMEDIEvuQiT7puEJY737MDoGA1UdHwQzMDEwL6AtoCuG"
-    "KWh0dHA6Ly9jcmwuZ2VvdHJ1c3QuY29tL2NybHMvc2VjdXJlY2EuY3JsMB8GA1Ud"
-    "IwQYMBaAFEjmaPkr0rKV10fYIyAQTzOYkJ/UMB0GA1UdJQQWMBQGCCsGAQUFBwMB"
-    "BggrBgEFBQcDAjANBgkqhkiG9w0BAQUFAAOBgQB74cGpjdENf9U+WEd29dfzY3Tz"
-    "JehnlY5cH5as8bOTe7PNPzj967OJ7TPWEycMwlS7CsqIsmfRGOFFfoHxo+iPugZ8"
-    "uO2Kd++QHCXL+MumGjkW4FcTFmceV/Q12Wdh3WApcqIZZciQ79MAeFh7bzteAYqf"
-    "wC98YQwylC9wVhf1yw==";
-
-}  // namespace
-
 SSLSocketAdapter* SSLSocketAdapter::Create(AsyncSocket* socket) {
   return new SSLSocketAdapter(socket);
 }
 
 SSLSocketAdapter::SSLSocketAdapter(AsyncSocket* socket)
     : SSLAdapter(socket),
       ignore_bad_cert_(false),
       cert_verifier_(new net::CertVerifier()),
       ALLOW_THIS_IN_INITIALIZER_LIST(
           connected_callback_(this, &SSLSocketAdapter::OnConnected)),
@@ skipping 30 matching lines @@
     LOG(DFATAL) << "Chrome message loop (needed by SSL certificate "
                 << "verification) does not exist";
     return net::ERR_UNEXPECTED;
   }
 
   // SSLConfigService is not thread-safe, and the default values for SSLConfig
   // are correct for us, so we don't use the config service to initialize this
   // object.
   net::SSLConfig ssl_config;
 
-  std::string gmail_cert_binary;
-  base::Base64Decode(kGmailCertBase64, &gmail_cert_binary);
-  scoped_refptr<net::X509Certificate> gmail_cert =
-      net::X509Certificate::CreateFromBytes(gmail_cert_binary.data(),
-                                            gmail_cert_binary.size());
-  DCHECK(gmail_cert);
-  net::SSLConfig::CertAndStatus gmail_cert_status;
-  gmail_cert_status.cert = gmail_cert;
-  gmail_cert_status.cert_status = 0;
-  ssl_config.allowed_bad_certs.push_back(gmail_cert_status);
-
   transport_socket_->set_addr(talk_base::SocketAddress(hostname_, 0));
   ssl_socket_.reset(
       net::ClientSocketFactory::GetDefaultFactory()->CreateSSLClientSocket(
           transport_socket_, net::HostPortPair(hostname_, 443), ssl_config,
           NULL /* ssl_host_info */,
           cert_verifier_.get()));
 
   int result = ssl_socket_->Connect(&connected_callback_);
 
   if (result == net::ERR_IO_PENDING || result == net::OK) {
@@ skipping 282 matching lines @@
         write_buffer_len_ = buffer_len;
         return;
       }
     }
     was_used_to_convey_data_ = true;
     callback->RunWithParams(Tuple1<int>(result));
   }
 }
 
 }  // namespace remoting