Remove redundant 3-SHAKE mitigation.

Remove redundant 3-SHAKE mitigation.

As of
https://boringssl.googlesource.com/boringssl/+/a58baaf9e68f887a9e1daf88cb25d911a376851f,
this check now lives in BoringSSL. This simplifies the
PeerCertificateChain stuff and removes one place where we use
crypto/x509.

BUG=671420
Review-Url: https://codereview.chromium.org/2728823002
Cr-Commit-Position: refs/heads/master@{#455161}
Committed: https://chromium.googlesource.com/chromium/src/+/c7e06c9e565912928d1a21811676c2b18801559a

[davidben, 2017-03-02 22:39:10]

The CQ bit was checked by davidben@chromium.org to run a CQ dry run

[davidben, 2017-03-02 22:39:21]

Description was changed from

==========
Remove redundant 3-SHAKE mitigation.

As of
https://boringssl.googlesource.com/boringssl/+/a58baaf9e68f887a9e1daf88cb25d9...,
this check now lives in BoringSSL. This simplifies the
PeerCertificateChain stuff.

BUG=none
==========

to

==========
Remove redundant 3-SHAKE mitigation.

As of
https://boringssl.googlesource.com/boringssl/+/a58baaf9e68f887a9e1daf88cb25d9...,
this check now lives in BoringSSL. This simplifies the
PeerCertificateChain stuff and removes one place where we use
crypto/x509.

BUG=671420
==========

[commit-bot: I haz the power, 2017-03-02 22:39:48]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-02 23:37:13]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-02 23:37:14]

Dry run: Try jobs failed on following builders:
  win_chromium_rel_ng on master.tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_...)

[davidben, 2017-03-07 00:15:14]

The CQ bit was checked by davidben@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-07 00:16:03]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[davidben, 2017-03-07 00:17:57]

The CQ bit was checked by davidben@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-07 00:18:32]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[davidben, 2017-03-07 00:19:33]

davidben@chromium.org changed reviewers:
+ svaldez@chromium.org

[davidben, 2017-03-07 00:19:34]

https://codereview.chromium.org/2728823002/diff/60001/net/socket/ssl_client_s...
File net/socket/ssl_client_socket_unittest.cc (left):

https://codereview.chromium.org/2728823002/diff/60001/net/socket/ssl_client_s...
net/socket/ssl_client_socket_unittest.cc:1151: EXPECT_FALSE(ssl_info.cert);
Note this is a behavior change: before we'd get far enough for GetSSLInfo to
work. Now we don't. There are other codepaths where we return an error code in
this state, so I don't think this changes anything. The point of
ERR_SSL_SERVER_CERT_BAD_FORMAT was to align with ERR_SSL_PROTOCOL_ERROR.

[commit-bot: I haz the power, 2017-03-07 01:54:29]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-07 01:54:30]

Dry run: Try jobs failed on following builders:
  win_chromium_rel_ng on master.tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_...)

[svaldez, 2017-03-07 15:05:04]

https://codereview.chromium.org/2728823002/diff/60001/net/socket/ssl_client_s...
File net/socket/ssl_client_socket_impl.cc (right):

https://codereview.chromium.org/2728823002/diff/60001/net/socket/ssl_client_s...
net/socket/ssl_client_socket_impl.cc:1684: int
SSLClientSocketImpl::CertVerifyCallback(X509_STORE_CTX* store_ctx) {
Can we just remove the CertVerifyCallback entirely?

[davidben, 2017-03-07 17:25:26]

https://codereview.chromium.org/2728823002/diff/60001/net/socket/ssl_client_s...
File net/socket/ssl_client_socket_impl.cc (right):

https://codereview.chromium.org/2728823002/diff/60001/net/socket/ssl_client_s...
net/socket/ssl_client_socket_impl.cc:1684: int
SSLClientSocketImpl::CertVerifyCallback(X509_STORE_CTX* store_ctx) {
On 2017/03/07 15:05:04, svaldez wrote:
> Can we just remove the CertVerifyCallback entirely?

This is what stops us from running OpenSSL's verifier. :-)

[svaldez, 2017-03-07 17:26:42]

lgtm

[davidben, 2017-03-07 17:29:40]

The CQ bit was checked by davidben@chromium.org

[commit-bot: I haz the power, 2017-03-07 17:30:22]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-07 18:54:15]

CQ is committing da patch.

Bot data: {"patchset_id": 60001, "attempt_start_ts": 1488907780229260,
"parent_rev": "4194a955fd464fd5182ad9e87f8519558310e229", "commit_rev":
"c7e06c9e565912928d1a21811676c2b18801559a"}

[commit-bot: I haz the power, 2017-03-07 18:54:56]

Description was changed from

==========
Remove redundant 3-SHAKE mitigation.

As of
https://boringssl.googlesource.com/boringssl/+/a58baaf9e68f887a9e1daf88cb25d9...,
this check now lives in BoringSSL. This simplifies the
PeerCertificateChain stuff and removes one place where we use
crypto/x509.

BUG=671420
==========

to

==========
Remove redundant 3-SHAKE mitigation.

As of
https://boringssl.googlesource.com/boringssl/+/a58baaf9e68f887a9e1daf88cb25d9...,
this check now lives in BoringSSL. This simplifies the
PeerCertificateChain stuff and removes one place where we use
crypto/x509.

BUG=671420

Review-Url: https://codereview.chromium.org/2728823002
Cr-Commit-Position: refs/heads/master@{#455161}
Committed:
https://chromium.googlesource.com/chromium/src/+/c7e06c9e565912928d1a21811676...
==========

[commit-bot: I haz the power, 2017-03-07 18:54:58]

Committed patchset #4 (id:60001) as
https://chromium.googlesource.com/chromium/src/+/c7e06c9e565912928d1a21811676...