Removed unreached code related to ESET MITM detection.

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 430 matching lines @@
       ssl_connection_status_(0),
       client_auth_cert_needed_(false),
       cert_verifier_(context.cert_verifier),
       domain_bound_cert_xtn_negotiated_(false),
       server_bound_cert_service_(context.server_bound_cert_service),
       domain_bound_cert_type_(CLIENT_CERT_INVALID_TYPE),
       domain_bound_cert_request_handle_(NULL),
       handshake_callback_called_(false),
       completed_handshake_(false),
       ssl_session_cache_shard_(context.ssl_session_cache_shard),
-      eset_mitm_detected_(false),
       predicted_cert_chain_correct_(false),
       next_handshake_state_(STATE_NONE),
       nss_fd_(NULL),
       nss_bufs_(NULL),
       net_log_(transport_socket->socket()->NetLog()),
       ssl_host_info_(ssl_host_info),
       transport_security_state_(context.transport_security_state),
       next_proto_status_(kNextProtoUnsupported),
       valid_thread_id_(base::kInvalidThreadId) {
   EnterFunction("");
@@ skipping 179 matching lines @@
   user_write_buf_len_    = 0;
   server_cert_           = NULL;
   if (server_cert_nss_) {
     CERT_DestroyCertificate(server_cert_nss_);
     server_cert_nss_     = NULL;
   }
   local_server_cert_verify_result_.Reset();
   server_cert_verify_result_ = NULL;
   ssl_connection_status_ = 0;
   completed_handshake_   = false;
-  eset_mitm_detected_    = false;
   start_cert_verification_time_ = base::TimeTicks();
   predicted_cert_chain_correct_ = false;
   nss_bufs_              = NULL;
   client_certs_.clear();
   client_auth_cert_needed_ = false;
   domain_bound_cert_xtn_negotiated_ = false;
 
   LeaveFunction("");
 }
 
@@ skipping 776 matching lines @@
       // doesn't require a client cert), we need to invalidate the SSL session
       // so that we won't try to resume the non-client-authenticated session in
       // the next handshake.  This will cause the server to ask for a client
       // cert again.
       if (rv == SECSuccess && SSL_InvalidateSession(nss_fd_) != SECSuccess) {
         LOG(WARNING) << "Couldn't invalidate SSL session: " << PR_GetError();
       }
     }
   } else if (rv == SECSuccess) {
     if (handshake_callback_called_) {
-      if (eset_mitm_detected_) {
-        net_error = ERR_ESET_ANTI_VIRUS_SSL_INTERCEPTION;
-      } else {
-        // We need to see if the predicted certificate chain (in
-        // |ssl_host_info_->state().certs) matches the actual certificate chain
-        // before we call SaveSSLHostInfo, as that will update
-        // |ssl_host_info_|.
-        if (ssl_host_info_.get() && !ssl_host_info_->state().certs.empty()) {
-          PeerCertificateChain certs(nss_fd_);
-          const SSLHostInfo::State& state = ssl_host_info_->state();
-          predicted_cert_chain_correct_ = certs.size() == state.certs.size();
-          if (predicted_cert_chain_correct_) {
-            for (unsigned i = 0; i < certs.size(); i++) {
-              if (certs[i]->derCert.len != state.certs[i].size() ||
-                  memcmp(certs[i]->derCert.data, state.certs[i].data(),
-                         certs[i]->derCert.len) != 0) {
-                predicted_cert_chain_correct_ = false;
-                break;
-              }
+      // We need to see if the predicted certificate chain (in
+      // |ssl_host_info_->state().certs) matches the actual certificate chain
+      // before we call SaveSSLHostInfo, as that will update
+      // |ssl_host_info_|.
+      if (ssl_host_info_.get() && !ssl_host_info_->state().certs.empty()) {
+        PeerCertificateChain certs(nss_fd_);
+        const SSLHostInfo::State& state = ssl_host_info_->state();
+        predicted_cert_chain_correct_ = certs.size() == state.certs.size();
+        if (predicted_cert_chain_correct_) {
+          for (unsigned i = 0; i < certs.size(); i++) {
+            if (certs[i]->derCert.len != state.certs[i].size() ||
+                memcmp(certs[i]->derCert.data, state.certs[i].data(),
+                       certs[i]->derCert.len) != 0) {
+              predicted_cert_chain_correct_ = false;
+              break;
             }
           }
         }
+      }
 
 #if defined(SSL_ENABLE_OCSP_STAPLING)
-        // TODO(agl): figure out how to plumb an OCSP response into the Mac
-        // system library and update IsOCSPStaplingSupported for Mac.
-        if (!predicted_cert_chain_correct_ && IsOCSPStaplingSupported()) {
-          unsigned int len = 0;
-          SSL_GetStapledOCSPResponse(nss_fd_, NULL, &len);
-          if (len) {
-            const unsigned int orig_len = len;
-            scoped_array<uint8> ocsp_response(new uint8[orig_len]);
-            SSL_GetStapledOCSPResponse(nss_fd_, ocsp_response.get(), &len);
-            DCHECK_EQ(orig_len, len);
+      // TODO(agl): figure out how to plumb an OCSP response into the Mac
+      // system library and update IsOCSPStaplingSupported for Mac.
+      if (!predicted_cert_chain_correct_ && IsOCSPStaplingSupported()) {
+        unsigned int len = 0;
+        SSL_GetStapledOCSPResponse(nss_fd_, NULL, &len);
+        if (len) {
+          const unsigned int orig_len = len;
+          scoped_array<uint8> ocsp_response(new uint8[orig_len]);
+          SSL_GetStapledOCSPResponse(nss_fd_, ocsp_response.get(), &len);
+          DCHECK_EQ(orig_len, len);
 
 #if defined(OS_WIN)
-            CRYPT_DATA_BLOB ocsp_response_blob;
-            ocsp_response_blob.cbData = len;
-            ocsp_response_blob.pbData = ocsp_response.get();
-            BOOL ok = CertSetCertificateContextProperty(
-                server_cert_->os_cert_handle(),
-                CERT_OCSP_RESPONSE_PROP_ID,
-                CERT_SET_PROPERTY_IGNORE_PERSIST_ERROR_FLAG,
-                &ocsp_response_blob);
-            if (!ok) {
-              VLOG(1) << "Failed to set OCSP response property: "
-                      << GetLastError();
-            }
+          CRYPT_DATA_BLOB ocsp_response_blob;
+          ocsp_response_blob.cbData = len;
+          ocsp_response_blob.pbData = ocsp_response.get();
+          BOOL ok = CertSetCertificateContextProperty(
+              server_cert_->os_cert_handle(),
+              CERT_OCSP_RESPONSE_PROP_ID,
+              CERT_SET_PROPERTY_IGNORE_PERSIST_ERROR_FLAG,
+              &ocsp_response_blob);
+          if (!ok) {
+            VLOG(1) << "Failed to set OCSP response property: "
+                    << GetLastError();
+          }
 #elif defined(USE_NSS)
-            CacheOCSPResponseFromSideChannelFunction cache_ocsp_response =
-                GetCacheOCSPResponseFromSideChannelFunction();
-            SECItem ocsp_response_item;
-            ocsp_response_item.type = siBuffer;
-            ocsp_response_item.data = ocsp_response.get();
-            ocsp_response_item.len = len;
+          CacheOCSPResponseFromSideChannelFunction cache_ocsp_response =
+              GetCacheOCSPResponseFromSideChannelFunction();
+          SECItem ocsp_response_item;
+          ocsp_response_item.type = siBuffer;
+          ocsp_response_item.data = ocsp_response.get();
+          ocsp_response_item.len = len;
 
-            cache_ocsp_response(
-                CERT_GetDefaultCertDB(), server_cert_nss_, PR_Now(),
-                &ocsp_response_item, NULL);
+          cache_ocsp_response(
+              CERT_GetDefaultCertDB(), server_cert_nss_, PR_Now(),
+              &ocsp_response_item, NULL);
 #endif
-          }
         }
+      }
 #endif
 
-        SaveSSLHostInfo();
-        // SSL handshake is completed. Let's verify the certificate.
-        GotoState(STATE_VERIFY_DNSSEC);
-      }
+      SaveSSLHostInfo();
+      // SSL handshake is completed. Let's verify the certificate.
+      GotoState(STATE_VERIFY_DNSSEC);
       // Done!
     } else {
       // Workaround for https://bugzilla.mozilla.org/show_bug.cgi?id=562434 -
       // SSL_ForceHandshake returned SECSuccess prematurely.
       rv = SECFailure;
       net_error = ERR_SSL_PROTOCOL_ERROR;
       net_log_.AddEvent(NetLog::TYPE_SSL_HANDSHAKE_ERROR,
                         make_scoped_refptr(new SSLErrorParams(net_error, 0)));
     }
   } else {
@@ skipping 1122 matching lines @@
   EnsureThreadIdAssigned();
   base::AutoLock auto_lock(lock_);
   return valid_thread_id_ == base::PlatformThread::CurrentId();
 }
 
 ServerBoundCertService* SSLClientSocketNSS::GetServerBoundCertService() const {
   return server_bound_cert_service_;
 }
 
 }  // namespace net