[ios] Removed CRLSets usage for WKWebView.

ios/web/net/crw_cert_verification_controller.mm

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/net/crw_cert_verification_controller.h"
 
 #include "base/logging.h"
 #include "base/mac/bind_objc_block.h"
 #import "base/memory/ref_counted.h"
 #import "base/memory/scoped_ptr.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/rand_util.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/threading/worker_pool.h"
 #include "ios/web/net/cert_verifier_block_adapter.h"
 #include "ios/web/public/browser_state.h"
 #include "ios/web/public/certificate_policy_cache.h"
 #include "ios/web/public/web_thread.h"
 #import "ios/web/web_state/wk_web_view_security_util.h"
 #include "net/cert/cert_verify_result.h"
-#include "net/ssl/ssl_config_service.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
 
 namespace {
 
 // Enum for Web.CertVerifyAgreement UMA metric to report certificate
 // verification mismatch between SecTrust API and CertVerifier. SecTrust API is
 // used for making load/no-load decision and CertVerifier is used for getting
 // the reason of verification failure. It is expected that mismatches will
 // happen for those 2 approaches (e.g. SecTrust API accepts the cert but
@@ skipping 391 matching lines @@
         // WeakNSObject does not work across different threads, hence this block
         // retains self.
         if (!_certVerifier) {
           completionHandler(net::CertVerifyResult(), net::ERR_FAILED);
           return;
         }
 
         web::CertVerifierBlockAdapter::Params params(
             blockCert.Pass(), base::SysNSStringToUTF8(host));
         params.flags = self.certVerifyFlags;
-        params.crl_set = net::SSLConfigService::GetCRLSet();
         // OCSP response is not provided by iOS API.
+        // CRLSets are not used for getting the reason of rejection, because
+        // of low benefits and high cost of storing CRLSet on the disk.

[Ryan Sleevi, 2015/11/23 22:26:12]

Reword:
// CRLSets are not used, as the OS is used to make load/no-load decisions, not
the CertVerifier.

[Eugene But (OOO till 7-30), 2015/11/23 22:36:00]

Done.

         _certVerifier->Verify(params, ^(net::CertVerifyResult result, int) {
           completionHandler(result, YES);
         });
       }));
 
   if (!dispatched) {
     completionHandler(net::CertVerifyResult(), NO);
   }
 }
 
@@ skipping 39 matching lines @@
   web::CertPolicy::Judgment judgment = _certPolicyCache->QueryPolicy(
       leafCert.get(), base::SysNSStringToUTF8(host),
       certVerifierResult.cert_status);
 
   return (judgment == web::CertPolicy::ALLOWED)
              ? web::CERT_ACCEPT_POLICY_RECOVERABLE_ERROR_ACCEPTED_BY_USER
              : web::CERT_ACCEPT_POLICY_RECOVERABLE_ERROR_UNDECIDED_BY_USER;
 }
 
 @end