net: remove forced renegotiation checks

net: remove forced renegotiation checks

We lost this battle. We had to step back from requirement the renegotiation
extension, even on sites which we know support it, because of the number of
MITM proxies.

Since there doesn't seem to be any way forward, this change removes the code.

BUG=55410
TEST=compiles

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=80513

[willchan no longer on Chromium, 2011-04-04 22:40:29]

LGTM, that sucks :(

Is it the proxies or the antivirus progs? If it's just the antivirus progs,
would be it worth keeping the code alive on Mac/Linux (which I assume don't have
the same MITM antivirus progs, or maybe they do).

[agl, 2011-04-05 13:21:39]

On Mon, Apr 4, 2011 at 6:40 PM,  <willchan@chromium.org> wrote:
> Is it the proxies or the antivirus progs? If it's just the antivirus progs,
> would be it worth keeping the code alive on Mac/Linux (which I assume don't
> have
> the same MITM antivirus progs, or maybe they do).

Really the renegotiation checks were just to see if we could have
gotten away with it. In order to be effective, browsers need to
require the renegotiation checks for all sites. Obviously, this is
going to take a very long time so we were trying to be a good citizen
by putting a stake in the ground so that, at least, the network was
clean. Turns out that we were already too late :(


AGL

[wtc, 2011-04-05 17:20:03]

LGTM.

I'm also curious as to why you decided to remove this code
now.  It would nice to write a summary in bug 55410.  I have
some questions related to this below.

It's good to have tried to enforce this.  It's not all in
vain.  I would not have known how prevalent (user-allowed)
SSL MITM is.  I'm also disappointed that these SSL MITM
devices or software haven't all been updated to support
the secure renegotiation extension.

http://codereview.chromium.org/6792032/diff/1/net/http/http_stream_factory_im...
File net/http/http_stream_factory_impl_job.cc (left):

http://codereview.chromium.org/6792032/diff/1/net/http/http_stream_factory_im...
net/http/http_stream_factory_impl_job.cc:893: }
Given this code to allow MITM proxies whenever a proxy is
used, it seems that the problem is with anti-virus software
or proxies that the browser is not aware of?

http://codereview.chromium.org/6792032/diff/1/net/socket/ssl_client_socket_ns...
File net/socket/ssl_client_socket_nss.cc (left):

http://codereview.chromium.org/6792032/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:989: !ssl_config_.mitm_proxies_allowed) {
Hmm... so this code has been disabled (by the 'false') for
a while...

http://codereview.chromium.org/6792032/diff/1/net/socket/ssl_client_socket_ns...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/6792032/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:489: eset_mitm_detected_(false),
I guess we should keep eset_mitm_detected_ because it handles
a different problem (false start incompatibility)?

(I searched for "mitm", "MITM" in the source tree to see if
we missed any file.)

[agl, 2011-04-05 19:55:41]

http://codereview.chromium.org/6792032/diff/1/net/http/http_stream_factory_im...
File net/http/http_stream_factory_impl_job.cc (left):

http://codereview.chromium.org/6792032/diff/1/net/http/http_stream_factory_im...
net/http/http_stream_factory_impl_job.cc:893: }
On 2011/04/05 17:20:03, wtc wrote:
> Given this code to allow MITM proxies whenever a proxy is
> used, it seems that the problem is with anti-virus software
> or proxies that the browser is not aware of?

Indeed.

http://codereview.chromium.org/6792032/diff/1/net/socket/ssl_client_socket_ns...
File net/socket/ssl_client_socket_nss.cc (right):

http://codereview.chromium.org/6792032/diff/1/net/socket/ssl_client_socket_ns...
net/socket/ssl_client_socket_nss.cc:489: eset_mitm_detected_(false),
On 2011/04/05 17:20:03, wtc wrote:
> I guess we should keep eset_mitm_detected_ because it handles
> a different problem (false start incompatibility)?
 
Yes, we still need the ESET MITM code.