Remove support for 'system' SSL on Mac (SecureTransport) and Win (SChannel)

Remove support for the command-line fallback --use-system-ssl, as it
adds to the maintenance burden and presents a security risk due to
inconsistent patching by the OS vendors. On all platforms but Android,
NSS is used for SSL in all situations.

This does not change how certificate verification is handled, just
the underlying SSL implementation.

BUG=170214
TBR=sky

Review URL: https://chromiumcodereview.appspot.com/11876044

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@177068 0039d316-1c4b-4281-b951-d872f2087c98

6 files changed, 3 insertions, 3546 deletions

diff --git a/net/socket/client_socket_factory.cc b/net/socket/client_socket_factory.cc
index 881a15c..a058f49 100644
--- a/net/socket/client_socket_factory.cc
+++ b/net/socket/client_socket_factory.cc
@@ -10,15 +10,9 @@
 #include "build/build_config.h"
 #include "net/base/cert_database.h"
 #include "net/socket/client_socket_handle.h"
-#if defined(OS_WIN)
-#include "net/socket/ssl_client_socket_nss.h"
-#include "net/socket/ssl_client_socket_win.h"
-#elif defined(USE_OPENSSL)
+#if defined(USE_OPENSSL)
 #include "net/socket/ssl_client_socket_openssl.h"
-#elif defined(USE_NSS) || defined(OS_IOS)
-#include "net/socket/ssl_client_socket_nss.h"
-#elif defined(OS_MACOSX)
-#include "net/socket/ssl_client_socket_mac.h"
+#elif defined(USE_NSS) || defined(OS_MACOSX) || defined(OS_WIN)
 #include "net/socket/ssl_client_socket_nss.h"
 #endif
 #include "net/socket/tcp_client_socket.h"
@@ -30,8 +24,6 @@ class X509Certificate;
 
 namespace {
 
-bool g_use_system_ssl = false;
-
 // ChromeOS and Linux may require interaction with smart cards or TPMs, which
 // may cause NSS functions to block for upwards of several seconds. To avoid
 // blocking all activity on the current task runner, such as network or IPC
@@ -112,25 +104,9 @@ class DefaultClientSocketFactory : public ClientSocketFactory,
 #if defined(USE_OPENSSL)
     return new SSLClientSocketOpenSSL(transport_socket, host_and_port,
                                       ssl_config, context);
-#elif defined(USE_NSS) || defined(OS_IOS)
+#elif defined(USE_NSS) || defined(OS_MACOSX) || defined(OS_WIN)
     return new SSLClientSocketNSS(nss_task_runner, transport_socket,
                                   host_and_port, ssl_config, context);
-#elif defined(OS_WIN)
-    if (g_use_system_ssl) {
-      return new SSLClientSocketWin(transport_socket, host_and_port,
-                                    ssl_config, context);
-    }
-    return new SSLClientSocketNSS(nss_task_runner, transport_socket,
-                                  host_and_port, ssl_config,
-                                  context);
-#elif defined(OS_MACOSX)
-    if (g_use_system_ssl) {
-      return new SSLClientSocketMac(transport_socket, host_and_port,
-                                    ssl_config, context);
-    }
-    return new SSLClientSocketNSS(nss_task_runner, transport_socket,
-                                  host_and_port, ssl_config,
-                                  context);
 #else
     NOTIMPLEMENTED();
     return NULL;
@@ -168,17 +144,4 @@ ClientSocketFactory* ClientSocketFactory::GetDefaultFactory() {
   return g_default_client_socket_factory.Pointer();
 }
 
-// static
-void ClientSocketFactory::UseSystemSSL() {
-  g_use_system_ssl = true;
-
-#if defined(OS_WIN)
-  // Reflect the capability of SSLClientSocketWin.
-  SSLConfigService::SetDefaultVersionMax(SSL_PROTOCOL_VERSION_TLS1);
-#elif defined(OS_MACOSX) && !defined(OS_IOS)
-  // Reflect the capability of SSLClientSocketMac.
-  SSLConfigService::SetDefaultVersionMax(SSL_PROTOCOL_VERSION_TLS1);
-#endif
-}
-
 }  // namespace net
diff --git a/net/socket/client_socket_factory.h b/net/socket/client_socket_factory.h
index a4e778c..65022f2 100644
--- a/net/socket/client_socket_factory.h
+++ b/net/socket/client_socket_factory.h
@@ -64,9 +64,6 @@ class NET_EXPORT ClientSocketFactory {
 
   // Returns the default ClientSocketFactory.
   static ClientSocketFactory* GetDefaultFactory();
-
-  // Instructs the default ClientSocketFactory to use the system SSL library.
-  static void UseSystemSSL();
 };
 
 }  // namespace net
diff --git a/net/socket/ssl_client_socket_mac.cc b/net/socket/ssl_client_socket_mac.cc
deleted file mode 100644
index 69ef093..0000000
--- a/net/socket/ssl_client_socket_mac.cc
+++ /dev/null
@@ -1,1471 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/socket/ssl_client_socket_mac.h"
-
-#include <CoreServices/CoreServices.h>
-#include <netdb.h>
-#include <sys/socket.h>
-#include <sys/types.h>
-
-#include <algorithm>
-
-#include "base/bind.h"
-#include "base/lazy_instance.h"
-#include "base/mac/mac_logging.h"
-#include "base/mac/scoped_cftyperef.h"
-#include "base/string_util.h"
-#include "net/base/address_list.h"
-#include "net/base/cert_verifier.h"
-#include "net/base/io_buffer.h"
-#include "net/base/net_errors.h"
-#include "net/base/net_log.h"
-#include "net/base/single_request_cert_verifier.h"
-#include "net/base/ssl_cert_request_info.h"
-#include "net/base/ssl_connection_status_flags.h"
-#include "net/base/ssl_info.h"
-#include "net/base/x509_certificate_net_log_param.h"
-#include "net/base/x509_util.h"
-#include "net/socket/client_socket_handle.h"
-#include "net/socket/ssl_error_params.h"
-
-// Welcome to Mac SSL. We've been waiting for you.
-//
-// The Mac SSL implementation is, like the Windows and NSS implementations, a
-// giant state machine. This design constraint is due to the asynchronous nature
-// of our underlying transport mechanism. We can call down to read/write on the
-// network, but what happens is that either it completes immediately or returns
-// saying that we'll get a callback sometime in the future. In that case, we
-// have to return to our caller but pick up where we left off when we
-// resume. Thus the fun.
-//
-// On Windows, we use Security Contexts, which are driven by us. We fetch data
-// from the network, we call the context to decrypt the data, and so on. On the
-// Mac, however, we provide Secure Transport with callbacks to get data from the
-// network, and it calls us back to fetch the data from the network for
-// it. Therefore, there are different sets of states in our respective state
-// machines, fewer on the Mac because Secure Transport keeps a lot of its own
-// state. The discussion about what each of the states means lives in comments
-// in the DoHandshakeLoop() function.
-//
-// Secure Transport is designed for use by either blocking or non-blocking
-// network I/O. If, for example, you called SSLRead() to fetch data, Secure
-// Transport will, unless it has some cached data, issue a read to your network
-// callback read function to fetch it some more encrypted data. It's expecting
-// one of two things. If your function is hooked up to a blocking source, then
-// it'll block pending receipt of the data from the other end. That's fine, as
-// when you return with the data, Secure Transport will do its thing. On the
-// other hand, suppose that your socket is non-blocking and tells your function
-// that it would block. Then you let Secure Transport know, and it'll tell the
-// original caller that it would have blocked and that they need to call it
-// "later."
-//
-// When's "later," though? We have fully-asynchronous networking, so we get a
-// callback when our data's ready. But Secure Transport has no way for us to
-// tell it that data has arrived, so we must re-execute the call that triggered
-// the I/O (we rely on our state machine to do this). When we do so Secure
-// Transport will ask once again for the data. Chances are that it'll be the
-// same request as the previous time, but that's not actually guaranteed. But as
-// long as we buffer what we have and keep track of where we were, it works
-// quite well.
-//
-// Except for network writes. They shoot this plan straight to hell.
-//
-// Faking a blocking connection with an asynchronous connection (theoretically
-// more powerful) simply doesn't work for writing. Suppose that Secure Transport
-// requests a write of data to the network. With blocking I/O, we'd just block
-// until the write completed, and with non-blocking I/O we'd know how many bytes
-// we wrote before we would have blocked. But with the asynchronous I/O, the
-// transport underneath us can tell us that it'll let us know sometime "later"
-// whether or not things succeeded, and how many bytes were written. What do we
-// return to Secure Transport? We can't return a byte count, but we can't return
-// "later" as we're not guaranteed to be called in the future with the same data
-// to write.
-//
-// So, like in any good relationship, we're forced to lie. Whenever Secure
-// Transport asks for data to be written, we take it all and lie about it always
-// being written. We spin in a loop (see SSLWriteCallback() and
-// OnTransportWriteComplete()) independent of the main state machine writing
-// the data to the network, and get the data out. The main consequence of this
-// independence from the state machine is that we require a full-duplex
-// transport underneath us since we can't use it to keep our reading and
-// writing straight. Fortunately, the NSS implementation also has this issue
-// to deal with, so we share the same Libevent-based full-duplex TCP socket.
-//
-// A side comment on return values might be in order. Those who haven't taken
-// the time to read the documentation (ahem, header comments) in our various
-// files might be a bit surprised to see result values being treated as both
-// lengths and errors. Like Shimmer, they are both. In both the case of
-// immediate results as well as results returned in callbacks, a negative return
-// value indicates an error, a zero return value indicates end-of-stream (for
-// reads), and a positive return value indicates the number of bytes read or
-// written. Thus, many functions start off with |if (result < 0) return
-// result;|. That gets the error condition out of the way, and from that point
-// forward the result can be treated as a length.
-
-namespace net {
-
-namespace {
-
-// Pause if we have 2MB of data in flight, resume once we're down below 1MB.
-const unsigned int kWriteSizePauseLimit = 2 * 1024 * 1024;
-const unsigned int kWriteSizeResumeLimit = 1 * 1024 * 1024;
-
-#if MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_5
-// When compiled against the Mac OS X 10.5 SDK, define symbolic constants for
-// cipher suites added in Mac OS X 10.6.
-enum {
-  // ECC cipher suites from RFC 4492.
-  TLS_ECDH_ECDSA_WITH_NULL_SHA           = 0xC001,
-  TLS_ECDH_ECDSA_WITH_RC4_128_SHA        = 0xC002,
-  TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA   = 0xC003,
-  TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA    = 0xC004,
-  TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA    = 0xC005,
-  TLS_ECDHE_ECDSA_WITH_NULL_SHA          = 0xC006,
-  TLS_ECDHE_ECDSA_WITH_RC4_128_SHA       = 0xC007,
-  TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA  = 0xC008,
-  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA   = 0xC009,
-  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA   = 0xC00A,
-  TLS_ECDH_RSA_WITH_NULL_SHA             = 0xC00B,
-  TLS_ECDH_RSA_WITH_RC4_128_SHA          = 0xC00C,
-  TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA     = 0xC00D,
-  TLS_ECDH_RSA_WITH_AES_128_CBC_SHA      = 0xC00E,
-  TLS_ECDH_RSA_WITH_AES_256_CBC_SHA      = 0xC00F,
-  TLS_ECDHE_RSA_WITH_NULL_SHA            = 0xC010,
-  TLS_ECDHE_RSA_WITH_RC4_128_SHA         = 0xC011,
-  TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA    = 0xC012,
-  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA     = 0xC013,
-  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA     = 0xC014,
-  TLS_ECDH_anon_WITH_NULL_SHA            = 0xC015,
-  TLS_ECDH_anon_WITH_RC4_128_SHA         = 0xC016,
-  TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA    = 0xC017,
-  TLS_ECDH_anon_WITH_AES_128_CBC_SHA     = 0xC018,
-  TLS_ECDH_anon_WITH_AES_256_CBC_SHA     = 0xC019,
-};
-#endif
-
-// For an explanation of the Mac OS X error codes, please refer to:
-// http://developer.apple.com/mac/library/documentation/Security/Reference/secureTransportRef/Reference/reference.html
-int NetErrorFromOSStatus(OSStatus status) {
-  switch (status) {
-    case errSSLWouldBlock:
-      return ERR_IO_PENDING;
-    case paramErr:
-    case errSSLBadCipherSuite:
-    case errSSLBadConfiguration:
-      return ERR_INVALID_ARGUMENT;
-    case errSSLClosedNoNotify:
-      return ERR_CONNECTION_RESET;
-    case errSSLClosedAbort:
-      return ERR_CONNECTION_ABORTED;
-    case errSSLInternal:
-      return ERR_UNEXPECTED;
-    case errSSLBadRecordMac:
-    case errSSLCrypto:
-    case errSSLConnectionRefused:
-    case errSSLDecryptionFail:
-    case errSSLFatalAlert:
-    case errSSLIllegalParam:  // Received an illegal_parameter alert.
-    case errSSLPeerDecodeError:  // Received a decode_error alert.
-    case errSSLPeerDecryptError:  // Received a decrypt_error alert.
-    case errSSLPeerExportRestriction:  // Received an export_restriction alert.
-    case errSSLPeerHandshakeFail:  // Received a handshake_failure alert.
-    case errSSLPeerNoRenegotiation:  // Received a no_renegotiation alert
-    case errSSLPeerUnexpectedMsg:  // Received an unexpected_message alert.
-    case errSSLProtocol:
-    case errSSLRecordOverflow:
-      return ERR_SSL_PROTOCOL_ERROR;
-    case errSSLHostNameMismatch:
-      return ERR_CERT_COMMON_NAME_INVALID;
-    case errSSLCertExpired:
-    case errSSLCertNotYetValid:
-      return ERR_CERT_DATE_INVALID;
-    case errSSLNoRootCert:
-    case errSSLUnknownRootCert:
-      return ERR_CERT_AUTHORITY_INVALID;
-    case errSSLXCertChainInvalid:
-    case errSSLBadCert:
-      return ERR_CERT_INVALID;
-
-    case errSSLClosedGraceful:
-    case noErr:
-      return OK;
-
-    // (Note that all errSSLPeer* codes indicate errors reported by the peer,
-    // so the cert-related ones refer to my _client_ cert.)
-    // TODO(wtc): Add fine-grained error codes for client certificate errors
-    // reported by the server using the following SSL/TLS alert messages:
-    //   access_denied
-    //   bad_certificate
-    //   unsupported_certificate
-    //   certificate_expired
-    //   certificate_revoked
-    //   certificate_unknown
-    //   unknown_ca
-    case errSSLPeerCertUnknown...errSSLPeerBadCert:
-    case errSSLPeerUnknownCA:
-    case errSSLPeerAccessDenied:
-      OSSTATUS_LOG(WARNING, status) << "Server rejected client cert";
-      return ERR_BAD_SSL_CLIENT_AUTH_CERT;
-
-    case errSSLNegotiation:
-    case errSSLPeerInsufficientSecurity:
-    case errSSLPeerProtocolVersion:
-      return ERR_SSL_VERSION_OR_CIPHER_MISMATCH;
-
-    case errSSLBufferOverflow:
-    case errSSLModuleAttach:
-    case errSSLSessionNotFound:
-    default:
-      OSSTATUS_LOG(WARNING, status)
-          << "Unknown error mapped to net::ERR_FAILED";
-      return ERR_FAILED;
-  }
-}
-
-OSStatus OSStatusFromNetError(int net_error) {
-  switch (net_error) {
-    case ERR_IO_PENDING:
-      return errSSLWouldBlock;
-    case ERR_INTERNET_DISCONNECTED:
-    case ERR_TIMED_OUT:
-    case ERR_CONNECTION_ABORTED:
-    case ERR_CONNECTION_RESET:
-    case ERR_CONNECTION_REFUSED:
-    case ERR_ADDRESS_UNREACHABLE:
-    case ERR_ADDRESS_INVALID:
-      return errSSLClosedAbort;
-    case ERR_UNEXPECTED:
-      return errSSLInternal;
-    case ERR_INVALID_ARGUMENT:
-      return paramErr;
-    case OK:
-      return noErr;
-    default:
-      LOG(WARNING) << "Unknown error " << net_error << " mapped to paramErr";
-      return paramErr;
-  }
-}
-
-// Converts from a cipher suite to its key size. If the suite is marked with a
-// **, it's not actually implemented in Secure Transport and won't be returned
-// (but we'll code for it anyway).  The reference here is
-// http://www.opensource.apple.com/darwinsource/10.5.5/libsecurity_ssl-32463/lib/cipherSpecs.c
-// Seriously, though, there has to be an API for this, but I can't find one.
-// Anybody?
-int KeySizeOfCipherSuite(SSLCipherSuite suite) {
-  switch (suite) {
-    // SSL 2 only
-
-    case SSL_RSA_WITH_DES_CBC_MD5:
-      return 56;
-    case SSL_RSA_WITH_3DES_EDE_CBC_MD5:
-      return 112;
-    case SSL_RSA_WITH_RC2_CBC_MD5:
-    case SSL_RSA_WITH_IDEA_CBC_MD5:              // **
-      return 128;
-    case SSL_NO_SUCH_CIPHERSUITE:                // **
-      return 0;
-
-    // SSL 2, 3, TLS
-
-    case SSL_NULL_WITH_NULL_NULL:
-    case SSL_RSA_WITH_NULL_MD5:
-    case SSL_RSA_WITH_NULL_SHA:                  // **
-    case SSL_FORTEZZA_DMS_WITH_NULL_SHA:         // **
-    case TLS_ECDH_ECDSA_WITH_NULL_SHA:
-    case TLS_ECDHE_ECDSA_WITH_NULL_SHA:
-    case TLS_ECDH_RSA_WITH_NULL_SHA:
-    case TLS_ECDHE_RSA_WITH_NULL_SHA:
-    case TLS_ECDH_anon_WITH_NULL_SHA:
-      return 0;
-    case SSL_RSA_EXPORT_WITH_RC4_40_MD5:
-    case SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5:
-    case SSL_RSA_EXPORT_WITH_DES40_CBC_SHA:
-    case SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA:   // **
-    case SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA:   // **
-    case SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA:
-    case SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA:
-    case SSL_DH_anon_EXPORT_WITH_RC4_40_MD5:
-    case SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA:
-      return 40;
-    case SSL_RSA_WITH_DES_CBC_SHA:
-    case SSL_DH_DSS_WITH_DES_CBC_SHA:            // **
-    case SSL_DH_RSA_WITH_DES_CBC_SHA:            // **
-    case SSL_DHE_DSS_WITH_DES_CBC_SHA:
-    case SSL_DHE_RSA_WITH_DES_CBC_SHA:
-    case SSL_DH_anon_WITH_DES_CBC_SHA:
-      return 56;
-    case SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA: // **
-      return 80;
-    case SSL_RSA_WITH_3DES_EDE_CBC_SHA:
-    case SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA:       // **
-    case SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA:       // **
-    case SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA:
-    case SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
-    case SSL_DH_anon_WITH_3DES_EDE_CBC_SHA:
-    case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA:
-    case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:
-    case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA:
-    case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:
-    case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA:
-      return 112;
-    case SSL_RSA_WITH_RC4_128_MD5:
-    case SSL_RSA_WITH_RC4_128_SHA:
-    case SSL_RSA_WITH_IDEA_CBC_SHA:              // **
-    case SSL_DH_anon_WITH_RC4_128_MD5:
-    case TLS_ECDH_ECDSA_WITH_RC4_128_SHA:
-    case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:
-    case TLS_ECDH_RSA_WITH_RC4_128_SHA:
-    case TLS_ECDHE_RSA_WITH_RC4_128_SHA:
-    case TLS_ECDH_anon_WITH_RC4_128_SHA:
-      return 128;
-
-    // TLS AES options (see RFC 3268 and RFC 4492)
-
-    case TLS_RSA_WITH_AES_128_CBC_SHA:
-    case TLS_DH_DSS_WITH_AES_128_CBC_SHA:        // **
-    case TLS_DH_RSA_WITH_AES_128_CBC_SHA:        // **
-    case TLS_DHE_DSS_WITH_AES_128_CBC_SHA:
-    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
-    case TLS_DH_anon_WITH_AES_128_CBC_SHA:
-    case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA:
-    case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
-    case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA:
-    case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
-    case TLS_ECDH_anon_WITH_AES_128_CBC_SHA:
-      return 128;
-    case TLS_RSA_WITH_AES_256_CBC_SHA:
-    case TLS_DH_DSS_WITH_AES_256_CBC_SHA:        // **
-    case TLS_DH_RSA_WITH_AES_256_CBC_SHA:        // **
-    case TLS_DHE_DSS_WITH_AES_256_CBC_SHA:
-    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
-    case TLS_DH_anon_WITH_AES_256_CBC_SHA:
-    case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA:
-    case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
-    case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA:
-    case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
-    case TLS_ECDH_anon_WITH_AES_256_CBC_SHA:
-      return 256;
-
-    default:
-      return -1;
-  }
-}
-
-// Whitelist the cipher suites we want to enable.  We disable the following
-// cipher suites.
-// - Null encryption cipher suites.
-// - Weak cipher suites: < 80 bits of security strength.
-// - FORTEZZA cipher suites (obsolete).
-// - IDEA cipher suites (RFC 5469 explains why).
-// - Anonymous cipher suites.
-//
-// Why don't we use a blacklist?  A blacklist that isn't updated for a new
-// Mac OS X release is a potential security issue because the new release
-// may have new null encryption or anonymous cipher suites, whereas a
-// whitelist that isn't updated for a new Mac OS X release just means we
-// won't support any new cipher suites in that release.
-bool ShouldEnableCipherSuite(SSLCipherSuite suite) {
-  switch (suite) {
-    case SSL_RSA_WITH_3DES_EDE_CBC_MD5:
-    case SSL_RSA_WITH_RC2_CBC_MD5:
-
-    case SSL_RSA_WITH_3DES_EDE_CBC_SHA:
-    case SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA:       // **
-    case SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA:       // **
-    case SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA:
-    case SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
-    case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA:
-    case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:
-    case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA:
-    case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:
-
-    case SSL_RSA_WITH_RC4_128_MD5:
-    case SSL_RSA_WITH_RC4_128_SHA:
-    case TLS_ECDH_ECDSA_WITH_RC4_128_SHA:
-    case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA:
-    case TLS_ECDH_RSA_WITH_RC4_128_SHA:
-    case TLS_ECDHE_RSA_WITH_RC4_128_SHA:
-
-    case TLS_RSA_WITH_AES_128_CBC_SHA:
-    case TLS_DH_DSS_WITH_AES_128_CBC_SHA:        // **
-    case TLS_DH_RSA_WITH_AES_128_CBC_SHA:        // **
-    case TLS_DHE_DSS_WITH_AES_128_CBC_SHA:
-    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
-    case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA:
-    case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:
-    case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA:
-    case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:
-
-    case TLS_RSA_WITH_AES_256_CBC_SHA:
-    case TLS_DH_DSS_WITH_AES_256_CBC_SHA:        // **
-    case TLS_DH_RSA_WITH_AES_256_CBC_SHA:        // **
-    case TLS_DHE_DSS_WITH_AES_256_CBC_SHA:
-    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
-    case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA:
-    case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:
-    case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA:
-    case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:
-      return true;
-
-    default:
-      return false;
-  }
-}
-
-// Returns the server's certificate.  The caller must release a reference
-// to the return value when done.  Returns NULL on failure.
-X509Certificate* GetServerCert(SSLContextRef ssl_context) {
-  CFArrayRef certs;
-  OSStatus status = SSLCopyPeerCertificates(ssl_context, &certs);
-  // SSLCopyPeerCertificates may succeed but return a null |certs|
-  // (if we're using an anonymous cipher suite or if we call it
-  // before the certificate message has arrived and been parsed).
-  if (status != noErr || !certs)
-    return NULL;
-  base::mac::ScopedCFTypeRef<CFArrayRef> scoped_certs(certs);
-
-  DCHECK_GT(CFArrayGetCount(certs), 0);
-
-  // Add each of the intermediate certificates in the server's chain to the
-  // server's X509Certificate object. This makes them available to
-  // X509Certificate::Verify() for chain building.
-  std::vector<SecCertificateRef> intermediate_ca_certs;
-  CFIndex certs_length = CFArrayGetCount(certs);
-  for (CFIndex i = 1; i < certs_length; ++i) {
-    SecCertificateRef cert_ref = reinterpret_cast<SecCertificateRef>(
-        const_cast<void*>(CFArrayGetValueAtIndex(certs, i)));
-    intermediate_ca_certs.push_back(cert_ref);
-  }
-
-  SecCertificateRef server_cert = static_cast<SecCertificateRef>(
-      const_cast<void*>(CFArrayGetValueAtIndex(certs, 0)));
-  return X509Certificate::CreateFromHandle(server_cert,
-                                           intermediate_ca_certs);
-}
-
-// Dynamically look up a pointer to a function exported by a bundle.
-template <typename FNTYPE>
-FNTYPE LookupFunction(CFStringRef bundleName, CFStringRef fnName) {
-  CFBundleRef bundle = CFBundleGetBundleWithIdentifier(bundleName);
-  if (!bundle)
-    return NULL;
-  return reinterpret_cast<FNTYPE>(
-      CFBundleGetFunctionPointerForName(bundle, fnName));
-}
-
-struct CipherSuiteIsDisabledFunctor {
-  explicit CipherSuiteIsDisabledFunctor(
-      const std::vector<uint16>& disabled_cipher_suites)
-      : disabled_cipher_suites_(disabled_cipher_suites) {}
-
-  // Returns true if the given |cipher_suite| appears within the set of
-  // |disabled_cipher_suites|.
-  bool operator()(SSLCipherSuite cipher_suite) const {
-    return binary_search(disabled_cipher_suites_.begin(),
-                         disabled_cipher_suites_.end(),
-                         static_cast<uint16>(cipher_suite));
-  }
-
-  const std::vector<uint16>& disabled_cipher_suites_;
-};
-
-// Class to determine what cipher suites are available and which cipher
-// suites should be enabled, based on the overall security policy.
-class EnabledCipherSuites {
- public:
-  const std::vector<SSLCipherSuite>& ciphers() const { return ciphers_; }
-
- private:
-  friend struct base::DefaultLazyInstanceTraits<EnabledCipherSuites>;
-  EnabledCipherSuites();
-  ~EnabledCipherSuites() {}
-
-  std::vector<SSLCipherSuite> ciphers_;
-
-  DISALLOW_COPY_AND_ASSIGN(EnabledCipherSuites);
-};
-
-static base::LazyInstance<EnabledCipherSuites> g_enabled_cipher_suites =
-    LAZY_INSTANCE_INITIALIZER;
-
-EnabledCipherSuites::EnabledCipherSuites() {
-  SSLContextRef ssl_context;
-  OSStatus status = SSLNewContext(false, &ssl_context);
-  if (status != noErr)
-    return;
-
-  size_t num_supported_ciphers;
-  status = SSLGetNumberSupportedCiphers(ssl_context, &num_supported_ciphers);
-  if (status != noErr) {
-    SSLDisposeContext(ssl_context);
-    return;
-  }
-  DCHECK_NE(num_supported_ciphers, 0U);
-
-  std::vector<SSLCipherSuite> supported_ciphers(num_supported_ciphers);
-  status = SSLGetSupportedCiphers(ssl_context, &supported_ciphers[0],
-                                  &num_supported_ciphers);
-  SSLDisposeContext(ssl_context);
-  if (status != noErr)
-    return;
-
-  for (size_t i = 0; i < num_supported_ciphers; ++i) {
-    if (ShouldEnableCipherSuite(supported_ciphers[i]))
-      ciphers_.push_back(supported_ciphers[i]);
-  }
-}
-
-}  // namespace
-
-//-----------------------------------------------------------------------------
-
-SSLClientSocketMac::SSLClientSocketMac(ClientSocketHandle* transport_socket,
-                                       const HostPortPair& host_and_port,
-                                       const SSLConfig& ssl_config,
-                                       const SSLClientSocketContext& context)
-    : transport_(transport_socket),
-      host_and_port_(host_and_port),
-      ssl_config_(ssl_config),
-      user_read_buf_len_(0),
-      user_write_buf_len_(0),
-      next_handshake_state_(STATE_NONE),
-      cert_verifier_(context.cert_verifier),
-      renegotiating_(false),
-      client_cert_requested_(false),
-      ssl_context_(NULL),
-      bytes_read_after_renegotiation_(0),
-      pending_send_error_(OK),
-      net_log_(transport_socket->socket()->NetLog()) {
-  // Sort the list of ciphers to disable, since disabling ciphers on Mac
-  // requires subtracting from a list of enabled ciphers while maintaining
-  // ordering, as opposed to merely needing to iterate them as with NSS.
-  sort(ssl_config_.disabled_cipher_suites.begin(),
-       ssl_config_.disabled_cipher_suites.end());
-}
-
-SSLClientSocketMac::~SSLClientSocketMac() {
-  Disconnect();
-}
-
-int SSLClientSocketMac::Connect(const CompletionCallback& callback) {
-  DCHECK(transport_.get());
-  DCHECK(next_handshake_state_ == STATE_NONE);
-  DCHECK(user_connect_callback_.is_null());
-
-  net_log_.BeginEvent(NetLog::TYPE_SSL_CONNECT);
-
-  int rv = InitializeSSLContext();
-  if (rv != OK) {
-    net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv);
-    return rv;
-  }
-
-  next_handshake_state_ = STATE_HANDSHAKE;
-  rv = DoHandshakeLoop(OK);
-  if (rv == ERR_IO_PENDING) {
-    user_connect_callback_ = callback;
-  } else {
-    net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv);
-  }
-  return rv;
-}
-
-void SSLClientSocketMac::Disconnect() {
-  next_handshake_state_ = STATE_NONE;
-
-  if (ssl_context_) {
-    SSLClose(ssl_context_);
-    SSLDisposeContext(ssl_context_);
-    ssl_context_ = NULL;
-    VLOG(1) << "----- Disposed SSLContext";
-  }
-
-  // Shut down anything that may call us back.
-  verifier_.reset();
-  transport_->socket()->Disconnect();
-}
-
-bool SSLClientSocketMac::IsConnected() const {
-  // Ideally, we should also check if we have received the close_notify alert
-  // message from the server, and return false in that case.  We're not doing
-  // that, so this function may return a false positive.  Since the upper
-  // layer (HttpNetworkTransaction) needs to handle a persistent connection
-  // closed by the server when we send a request anyway, a false positive in
-  // exchange for simpler code is a good trade-off.
-  return completed_handshake() && transport_->socket()->IsConnected();
-}
-
-bool SSLClientSocketMac::IsConnectedAndIdle() const {
-  // Unlike IsConnected, this method doesn't return a false positive.
-  //
-  // Strictly speaking, we should check if we have received the close_notify
-  // alert message from the server, and return false in that case.  Although
-  // the close_notify alert message means EOF in the SSL layer, it is just
-  // bytes to the transport layer below, so
-  // transport_->socket()->IsConnectedAndIdle() returns the desired false
-  // when we receive close_notify.
-  return completed_handshake() && transport_->socket()->IsConnectedAndIdle();
-}
-
-int SSLClientSocketMac::GetPeerAddress(IPEndPoint* address) const {
-  return transport_->socket()->GetPeerAddress(address);
-}
-
-int SSLClientSocketMac::GetLocalAddress(IPEndPoint* address) const {
-  return transport_->socket()->GetLocalAddress(address);
-}
-
-const BoundNetLog& SSLClientSocketMac::NetLog() const {
-  return net_log_;
-}
-
-void SSLClientSocketMac::SetSubresourceSpeculation() {
-  if (transport_.get() && transport_->socket()) {
-    transport_->socket()->SetSubresourceSpeculation();
-  } else {
-    NOTREACHED();
-  }
-}
-
-void SSLClientSocketMac::SetOmniboxSpeculation() {
-  if (transport_.get() && transport_->socket()) {
-    transport_->socket()->SetOmniboxSpeculation();
-  } else {
-    NOTREACHED();
-  }
-}
-
-bool SSLClientSocketMac::WasEverUsed() const {
-  if (transport_.get() && transport_->socket()) {
-    return transport_->socket()->WasEverUsed();
-  }
-  NOTREACHED();
-  return false;
-}
-
-bool SSLClientSocketMac::UsingTCPFastOpen() const {
-  if (transport_.get() && transport_->socket()) {
-    return transport_->socket()->UsingTCPFastOpen();
-  }
-  NOTREACHED();
-  return false;
-}
-
-int64 SSLClientSocketMac::NumBytesRead() const {
-  if (transport_.get() && transport_->socket()) {
-    return transport_->socket()->NumBytesRead();
-  }
-  NOTREACHED();
-  return -1;
-}
-
-base::TimeDelta SSLClientSocketMac::GetConnectTimeMicros() const {
-  if (transport_.get() && transport_->socket()) {
-    return transport_->socket()->GetConnectTimeMicros();
-  }
-  NOTREACHED();
-  return base::TimeDelta::FromMicroseconds(-1);
-}
-
-int SSLClientSocketMac::Read(IOBuffer* buf, int buf_len,
-                             const CompletionCallback& callback) {
-  DCHECK(completed_handshake());
-  DCHECK(user_read_callback_.is_null());
-  DCHECK(!user_read_buf_);
-
-  user_read_buf_ = buf;
-  user_read_buf_len_ = buf_len;
-
-  int rv = DoPayloadRead();
-  if (rv == ERR_IO_PENDING) {
-    user_read_callback_ = callback;
-  } else {
-    user_read_buf_ = NULL;
-    user_read_buf_len_ = 0;
-  }
-  return rv;
-}
-
-int SSLClientSocketMac::Write(IOBuffer* buf, int buf_len,
-                              const CompletionCallback& callback) {
-  DCHECK(completed_handshake());
-  DCHECK(user_write_callback_.is_null());
-  DCHECK(!user_write_buf_);
-
-  user_write_buf_ = buf;
-  user_write_buf_len_ = buf_len;
-
-  int rv = DoPayloadWrite();
-  if (rv == ERR_IO_PENDING) {
-    user_write_callback_ = callback;
-  } else {
-    user_write_buf_ = NULL;
-    user_write_buf_len_ = 0;
-  }
-  return rv;
-}
-
-bool SSLClientSocketMac::SetReceiveBufferSize(int32 size) {
-  return transport_->socket()->SetReceiveBufferSize(size);
-}
-
-bool SSLClientSocketMac::SetSendBufferSize(int32 size) {
-  return transport_->socket()->SetSendBufferSize(size);
-}
-
-bool SSLClientSocketMac::GetSSLInfo(SSLInfo* ssl_info) {
-  ssl_info->Reset();
-  if (!server_cert_)
-    return false;
-
-  ssl_info->cert = server_cert_verify_result_.verified_cert;
-  ssl_info->cert_status = server_cert_verify_result_.cert_status;
-  ssl_info->public_key_hashes = server_cert_verify_result_.public_key_hashes;
-  ssl_info->is_issued_by_known_root =
-      server_cert_verify_result_.is_issued_by_known_root;
-  ssl_info->client_cert_sent =
-      ssl_config_.send_client_cert && ssl_config_.client_cert;
-  ssl_info->channel_id_sent = WasChannelIDSent();
-
-  // security info
-  SSLCipherSuite suite;
-  OSStatus status = SSLGetNegotiatedCipher(ssl_context_, &suite);
-  if (!status) {
-    ssl_info->security_bits = KeySizeOfCipherSuite(suite);
-    ssl_info->connection_status |=
-        (suite & SSL_CONNECTION_CIPHERSUITE_MASK) <<
-        SSL_CONNECTION_CIPHERSUITE_SHIFT;
-  }
-
-  if (ssl_config_.version_fallback)
-    ssl_info->connection_status |= SSL_CONNECTION_VERSION_FALLBACK;
-
-  return true;
-}
-
-void SSLClientSocketMac::GetSSLCertRequestInfo(
-    SSLCertRequestInfo* cert_request_info) {
-  cert_request_info->host_and_port = host_and_port_.ToString();
-  cert_request_info->cert_authorities.clear();
-  cert_request_info->cert_key_types.clear();
-  cert_request_info->client_certs.clear();
-
-  // Retrieve the cert issuers accepted by the server. This information is
-  // currently (temporarily) being saved both in |valid_issuers| and
-  // |cert_authorities|, the latter being the target solution. The refactoring
-  // effort is being tracked in http://crbug.com/166642.
-  std::vector<CertPrincipal> valid_issuers;
-  CFArrayRef valid_issuer_names = NULL;
-  if (SSLCopyDistinguishedNames(ssl_context_, &valid_issuer_names) == noErr &&
-      valid_issuer_names != NULL) {
-    VLOG(1) << "Server has " << CFArrayGetCount(valid_issuer_names)
-            << " valid issuer names";
-    int n = CFArrayGetCount(valid_issuer_names);
-    for (int i = 0; i < n; i++) {
-      CFDataRef issuer = reinterpret_cast<CFDataRef>(
-          CFArrayGetValueAtIndex(valid_issuer_names, i));
-      // Add the DER-encoded issuer DistinguishedName to |cert_authorities|.
-      cert_request_info->cert_authorities.push_back(std::string(
-          reinterpret_cast<const char*>(CFDataGetBytePtr(issuer)),
-          static_cast<size_t>(CFDataGetLength(issuer))));
-      // Add the CertPrincipal object representing the issuer to
-      // |valid_issuers|.
-      CertPrincipal p;
-      if (p.ParseDistinguishedName(CFDataGetBytePtr(issuer),
-                                   CFDataGetLength(issuer))) {
-        valid_issuers.push_back(p);
-      }
-    }
-    CFRelease(valid_issuer_names);
-  }
-
-  // Now get the available client certs whose issuers are allowed by the server.
-  // TODO(rch):  we should consider passing a host-port pair as the first
-  // argument to X509Certificate::GetSSLClientCertificates.
-  X509Certificate::GetSSLClientCertificates(host_and_port_.host(),
-                                            valid_issuers,
-                                            &cert_request_info->client_certs);
-  std::sort(cert_request_info->client_certs.begin(),
-            cert_request_info->client_certs.end(),
-            x509_util::ClientCertSorter());
-
-  VLOG(1) << "Asking user to choose between "
-          << cert_request_info->client_certs.size() << " client certs...";
-}
-
-int SSLClientSocketMac::ExportKeyingMaterial(const base::StringPiece& label,
-                                             bool has_context,
-                                             const base::StringPiece& context,
-                                             unsigned char* out,
-                                             unsigned int outlen) {
-  return ERR_NOT_IMPLEMENTED;
-}
-
-int SSLClientSocketMac::GetTLSUniqueChannelBinding(std::string* out) {
-  return ERR_NOT_IMPLEMENTED;
-}
-
-SSLClientSocket::NextProtoStatus
-SSLClientSocketMac::GetNextProto(std::string* proto,
-                                 std::string* server_protos) {
-  proto->clear();
-  server_protos->clear();
-  return kNextProtoUnsupported;
-}
-
-ServerBoundCertService* SSLClientSocketMac::GetServerBoundCertService() const {
-  return NULL;
-}
-
-int SSLClientSocketMac::InitializeSSLContext() {
-  VLOG(1) << "----- InitializeSSLContext";
-  OSStatus status = noErr;
-
-  status = SSLNewContext(false, &ssl_context_);
-  if (status)
-    return NetErrorFromOSStatus(status);
-
-  status = SSLSetProtocolVersionEnabled(ssl_context_,
-                                        kSSLProtocol2,
-                                        false);
-  if (status)
-    return NetErrorFromOSStatus(status);
-
-  // If ssl_config_.version_max > SSL_PROTOCOL_VERSION_TLS1, it means the
-  // SSLConfigService::SetDefaultVersionMax(SSL_PROTOCOL_VERSION_TLS1) call
-  // in ClientSocketFactory::UseSystemSSL() is not effective.
-  DCHECK_LE(ssl_config_.version_max, SSL_PROTOCOL_VERSION_TLS1);
-
-  bool ssl3_enabled = (ssl_config_.version_min == SSL_PROTOCOL_VERSION_SSL3);
-  status = SSLSetProtocolVersionEnabled(ssl_context_,
-                                        kSSLProtocol3,
-                                        ssl3_enabled);
-  if (status)
-    return NetErrorFromOSStatus(status);
-
-  bool tls1_enabled = (ssl_config_.version_min <= SSL_PROTOCOL_VERSION_TLS1 &&
-                       ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1);
-  status = SSLSetProtocolVersionEnabled(ssl_context_,
-                                        kTLSProtocol1,
-                                        tls1_enabled);
-  if (status)
-    return NetErrorFromOSStatus(status);
-
-  std::vector<SSLCipherSuite> enabled_ciphers =
-      g_enabled_cipher_suites.Get().ciphers();
-
-  CipherSuiteIsDisabledFunctor is_disabled_cipher(
-      ssl_config_.disabled_cipher_suites);
-  std::vector<SSLCipherSuite>::iterator new_end =
-      std::remove_if(enabled_ciphers.begin(), enabled_ciphers.end(),
-                     is_disabled_cipher);
-  if (new_end != enabled_ciphers.end())
-    enabled_ciphers.erase(new_end, enabled_ciphers.end());
-
-  status = SSLSetEnabledCiphers(
-      ssl_context_,
-      enabled_ciphers.empty() ? NULL : &enabled_ciphers[0],
-      enabled_ciphers.size());
-
-  if (status)
-    return NetErrorFromOSStatus(status);
-
-  status = SSLSetIOFuncs(ssl_context_, SSLReadCallback, SSLWriteCallback);
-  if (status)
-    return NetErrorFromOSStatus(status);
-
-  status = SSLSetConnection(ssl_context_, this);
-  if (status)
-    return NetErrorFromOSStatus(status);
-
-  // Passing the domain name enables the server_name TLS extension (SNI).
-  status = SSLSetPeerDomainName(ssl_context_,
-                                host_and_port_.host().data(),
-                                host_and_port_.host().length());
-  if (status)
-    return NetErrorFromOSStatus(status);
-
-  // Disable certificate verification within Secure Transport; we'll
-  // be handling that ourselves.
-  status = SSLSetEnableCertVerify(ssl_context_, false);
-  if (status)
-    return NetErrorFromOSStatus(status);
-
-  if (ssl_config_.send_client_cert) {
-    status = SetClientCert();
-    if (status)
-      return NetErrorFromOSStatus(status);
-    return OK;
-  }
-
-  // Concatenate the hostname and peer address to use as the peer ID. To
-  // resume a session, we must connect to the same server on the same port
-  // using the same hostname (i.e., localhost and 127.0.0.1 are considered
-  // different peers, which puts us through certificate validation again
-  // and catches hostname/certificate name mismatches.
-  IPEndPoint endpoint;
-  int rv = transport_->socket()->GetPeerAddress(&endpoint);
-  if (rv != OK)
-    return rv;
-  std::string peer_id(host_and_port_.ToString());
-  peer_id += std::string(reinterpret_cast<const char*>(&endpoint.address()[0]),
-                         endpoint.address().size());
-  // SSLSetPeerID() treats peer_id as a binary blob, and makes its
-  // own copy.
-  status = SSLSetPeerID(ssl_context_, peer_id.data(), peer_id.length());
-  if (status)
-    return NetErrorFromOSStatus(status);
-
-  return OK;
-}
-
-void SSLClientSocketMac::DoConnectCallback(int rv) {
-  DCHECK(rv != ERR_IO_PENDING);
-  DCHECK(!user_connect_callback_.is_null());
-
-  CompletionCallback c = user_connect_callback_;
-  user_connect_callback_.Reset();
-  c.Run(rv > OK ? OK : rv);
-}
-
-void SSLClientSocketMac::DoReadCallback(int rv) {
-  DCHECK(rv != ERR_IO_PENDING);
-  DCHECK(!user_read_callback_.is_null());
-
-  // Since Run may result in Read being called, clear user_read_callback_ up
-  // front.
-  CompletionCallback c = user_read_callback_;
-  user_read_callback_.Reset();
-  user_read_buf_ = NULL;
-  user_read_buf_len_ = 0;
-  c.Run(rv);
-}
-
-void SSLClientSocketMac::DoWriteCallback(int rv) {
-  DCHECK(rv != ERR_IO_PENDING);
-  DCHECK(!user_write_callback_.is_null());
-
-  // Since Run may result in Write being called, clear user_write_callback_ up
-  // front.
-  CompletionCallback c = user_write_callback_;
-  user_write_callback_.Reset();
-  user_write_buf_ = NULL;
-  user_write_buf_len_ = 0;
-  c.Run(rv);
-}
-
-void SSLClientSocketMac::OnHandshakeIOComplete(int result) {
-  int rv = DoHandshakeLoop(result);
-  if (rv != ERR_IO_PENDING) {
-    // If there is no connect callback available to call, we are
-    // renegotiating (which occurs because we are in the middle of a Read
-    // when the renegotiation process starts).  So we complete the Read
-    // here.
-    if (user_connect_callback_.is_null()) {
-      DoReadCallback(rv);
-      return;
-    }
-    net_log_.EndEventWithNetErrorCode(NetLog::TYPE_SSL_CONNECT, rv);
-    DoConnectCallback(rv);
-  }
-}
-
-void SSLClientSocketMac::OnTransportReadComplete(int result) {
-  if (result > 0) {
-    recv_buffer_.insert(recv_buffer_.end(),
-                        read_io_buf_->data(),
-                        read_io_buf_->data() + result);
-  }
-  read_io_buf_ = NULL;
-
-  if (!completed_handshake()) {
-    OnHandshakeIOComplete(result);
-    return;
-  }
-
-  if (user_read_buf_) {
-    if (result < 0) {
-      DoReadCallback(result);
-      return;
-    }
-    int rv = DoPayloadRead();
-    if (rv != ERR_IO_PENDING)
-      DoReadCallback(rv);
-  }
-}
-
-void SSLClientSocketMac::OnTransportWriteComplete(int result) {
-  write_io_buf_ = NULL;
-
-  if (result < 0) {
-    pending_send_error_ = result;
-    return;
-  }
-
-  send_buffer_.erase(send_buffer_.begin(),
-                     send_buffer_.begin() + result);
-  if (!send_buffer_.empty())
-    SSLWriteCallback(this, NULL, NULL);
-
-  if (!completed_handshake()) {
-    OnHandshakeIOComplete(result);
-    return;
-  }
-
-  // If paused because too much data is in flight, try writing again and make
-  // the promised callback.
-  if (user_write_buf_ && send_buffer_.size() < kWriteSizeResumeLimit) {
-    int rv = DoPayloadWrite();
-    if (rv != ERR_IO_PENDING)
-      DoWriteCallback(rv);
-  }
-}
-
-int SSLClientSocketMac::DoHandshakeLoop(int last_io_result) {
-  DCHECK(next_handshake_state_ != STATE_NONE);
-  int rv = last_io_result;
-  do {
-    State state = next_handshake_state_;
-    next_handshake_state_ = STATE_NONE;
-    switch (state) {
-      case STATE_HANDSHAKE:
-        // Do the SSL/TLS handshake.
-        rv = DoHandshake();
-        break;
-      case STATE_VERIFY_CERT:
-        // Kick off server certificate validation.
-        rv = DoVerifyCert();
-        break;
-      case STATE_VERIFY_CERT_COMPLETE:
-        // Check the results of the server certificate validation.
-        rv = DoVerifyCertComplete(rv);
-        break;
-      case STATE_COMPLETED_RENEGOTIATION:
-        // The renegotiation handshake has completed, and the Read() call
-        // that was interrupted by the renegotiation needs to be resumed in
-        // order to to satisfy the original caller's request.
-        rv = DoCompletedRenegotiation(rv);
-        break;
-      case STATE_COMPLETED_HANDSHAKE:
-        next_handshake_state_ = STATE_COMPLETED_HANDSHAKE;
-        // This is the end of our state machine, so return.
-        return rv;
-      default:
-        rv = ERR_UNEXPECTED;
-        NOTREACHED() << "unexpected state";
-        break;
-    }
-  } while (rv != ERR_IO_PENDING && next_handshake_state_ != STATE_NONE);
-  return rv;
-}
-
-int SSLClientSocketMac::DoHandshake() {
-  client_cert_requested_ = false;
-
-  OSStatus status;
-  if (!renegotiating_) {
-    status = SSLHandshake(ssl_context_);
-  } else {
-    // Renegotiation can only be detected by a call to DoPayloadRead(),
-    // which means |user_read_buf_| should be valid.
-    DCHECK(user_read_buf_);
-
-    // On OS X 10.5.x, SSLSetSessionOption with
-    // kSSLSessionOptionBreakOnServerAuth is broken for renegotiation, as
-    // SSLRead() does not internally handle errSSLServerAuthCompleted being
-    // returned during handshake. In order to support certificate validation
-    // after a renegotiation, SSLRead() sets |renegotiating_| to be true and
-    // returns errSSLWouldBlock when it detects an attempt to read the
-    // ServerHello after responding to a HelloRequest. It would be
-    // appropriate to call SSLHandshake() at this point to restart the
-    // handshake state machine, however, on 10.5.x, SSLHandshake() is buggy
-    // and will always return noErr (indicating handshake completion),
-    // without doing any actual work. Because of this, the only way to
-    // advance SecureTransport's internal handshake state machine is to
-    // continuously call SSLRead() until the handshake is marked complete.
-    // Once the handshake is completed, if it completed successfully, the
-    // user read callback is invoked with |bytes_read_after_renegotiation_|
-    // as the callback result. On 10.6.0+, both errSSLServerAuthCompleted
-    // and SSLHandshake() work as expected, so this strange workaround is
-    // only necessary while OS X 10.5.x is still supported.
-    bytes_read_after_renegotiation_ = 0;
-    status = SSLRead(ssl_context_, user_read_buf_->data(),
-                     user_read_buf_len_, &bytes_read_after_renegotiation_);
-    if (bytes_read_after_renegotiation_ > 0) {
-      // With SecureTransport, as of 10.6.5, if application data is read,
-      // then the handshake should be completed. This is because
-      // SecureTransport does not (yet) support exchanging application data
-      // in the midst of handshakes. This is permitted in the TLS
-      // specification, as peers may exchange messages using the previous
-      // cipher spec up until they exchange ChangeCipherSpec messages.
-      // However, in addition to SecureTransport not supporting this, we do
-      // not permit callers to enter Read() or Write() when a handshake is
-      // occurring, in part due to the deception that happens in
-      // SSLWriteCallback(). Thus we need to make sure the handshake is
-      // truly completed before processing application data, and if any was
-      // read before the handshake is completed, it will be dropped and the
-      // connection aborted.
-      SSLSessionState session_state = kSSLIdle;
-      status = SSLGetSessionState(ssl_context_, &session_state);
-      if (session_state != kSSLConnected)
-        status = errSSLProtocol;
-    }
-  }
-
-  SSLClientCertificateState client_cert_state;
-  if (SSLGetClientCertificateState(ssl_context_, &client_cert_state) != noErr)
-    client_cert_state = kSSLClientCertNone;
-  if (client_cert_state > kSSLClientCertNone)
-    client_cert_requested_ = true;
-
-  int net_error = ERR_FAILED;
-  switch (status) {
-    case noErr:
-      return DidCompleteHandshake();
-    case errSSLWouldBlock:
-      next_handshake_state_ = STATE_HANDSHAKE;
-      return ERR_IO_PENDING;
-    case errSSLClosedGraceful:
-      // The server unexpectedly closed on us.
-      net_error = ERR_SSL_PROTOCOL_ERROR;
-      break;
-    case errSSLClosedAbort:
-    case errSSLPeerHandshakeFail:
-      if (client_cert_requested_) {
-        if (!ssl_config_.send_client_cert) {
-          // The server aborted, likely due to requiring a client certificate
-          // and one wasn't sent.
-          VLOG(1) << "Server requested SSL cert during handshake";
-          net_error = ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
-        } else {
-          // The server aborted, likely due to not liking the client
-          // certificate that was sent.
-          LOG(WARNING) << "Server aborted SSL handshake";
-          net_error = ERR_BAD_SSL_CLIENT_AUTH_CERT;
-        }
-        // Don't fall through - the error was intentionally remapped.
-        break;
-      }
-      // Fall through if a client cert wasn't requested.
-    default:
-      net_error = NetErrorFromOSStatus(status);
-      DCHECK(!IsCertificateError(net_error));
-      if (!ssl_config_.send_client_cert &&
-         (client_cert_state == kSSLClientCertRejected ||
-          net_error == ERR_BAD_SSL_CLIENT_AUTH_CERT)) {
-        // The server unexpectedly sent a peer certificate error alert when no
-        // certificate had been sent.
-        net_error = ERR_SSL_PROTOCOL_ERROR;
-      }
-      break;
-  }
-
-  net_log_.AddEvent(NetLog::TYPE_SSL_HANDSHAKE_ERROR,
-                    CreateNetLogSSLErrorCallback(net_error, status));
-  return net_error;
-}
-
-int SSLClientSocketMac::DoVerifyCert() {
-  next_handshake_state_ = STATE_VERIFY_CERT_COMPLETE;
-
-  DCHECK(server_cert_);
-
-  VLOG(1) << "DoVerifyCert...";
-  CertStatus cert_status;
-  if (ssl_config_.IsAllowedBadCert(server_cert_, &cert_status)) {
-    VLOG(1) << "Received an expected bad cert with status: " << cert_status;
-    server_cert_verify_result_.Reset();
-    server_cert_verify_result_.cert_status = cert_status;
-    server_cert_verify_result_.verified_cert = server_cert_;
-    return OK;
-  }
-
-  int flags = 0;
-  if (ssl_config_.rev_checking_enabled)
-    flags |= CertVerifier::VERIFY_REV_CHECKING_ENABLED;
-  if (ssl_config_.verify_ev_cert)
-    flags |= CertVerifier::VERIFY_EV_CERT;
-  if (ssl_config_.cert_io_enabled)
-    flags |= CertVerifier::VERIFY_CERT_IO_ENABLED;
-  verifier_.reset(new SingleRequestCertVerifier(cert_verifier_));
-  return verifier_->Verify(
-      server_cert_, host_and_port_.host(), flags,
-      NULL /* no CRL set */,
-      &server_cert_verify_result_,
-      base::Bind(&SSLClientSocketMac::OnHandshakeIOComplete,
-                 base::Unretained(this)),
-      net_log_);
-}
-
-int SSLClientSocketMac::DoVerifyCertComplete(int result) {
-  DCHECK(verifier_.get());
-  verifier_.reset();
-
-  VLOG(1) << "...DoVerifyCertComplete (result=" << result << ")";
-  if (result == OK && client_cert_requested_ &&
-      !ssl_config_.send_client_cert) {
-    // Caller hasn't specified a client cert, so let it know the server is
-    // asking for one, and abort the connection.
-    return ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
-  }
-  VLOG(1) << "Handshake finished! (DoVerifyCertComplete)";
-
-  if (renegotiating_) {
-    DidCompleteRenegotiation();
-    return result;
-  }
-
-  // The initial handshake has completed.
-  next_handshake_state_ = STATE_COMPLETED_HANDSHAKE;
-
-  return result;
-}
-
-int SSLClientSocketMac::SetClientCert() {
-  if (!ssl_config_.send_client_cert || !ssl_config_.client_cert)
-    return noErr;
-
-  base::mac::ScopedCFTypeRef<CFArrayRef> cert_refs(
-      ssl_config_.client_cert->CreateClientCertificateChain());
-  VLOG(1) << "SSLSetCertificate(" << CFArrayGetCount(cert_refs) << " certs)";
-  OSStatus result = SSLSetCertificate(ssl_context_, cert_refs);
-  if (result)
-    OSSTATUS_LOG(ERROR, result) << "SSLSetCertificate failed";
-  return result;
-}
-
-int SSLClientSocketMac::DoPayloadRead() {
-  size_t processed = 0;
-  OSStatus status = SSLRead(ssl_context_, user_read_buf_->data(),
-                            user_read_buf_len_, &processed);
-  if (status == errSSLWouldBlock && renegotiating_) {
-    CHECK_EQ(static_cast<size_t>(0), processed);
-    next_handshake_state_ = STATE_HANDSHAKE;
-    return DoHandshakeLoop(OK);
-  }
-  // There's a subtle difference here in semantics of the "would block" errors.
-  // In our code, ERR_IO_PENDING means the whole operation is async, while
-  // errSSLWouldBlock means that the stream isn't ending (and is often returned
-  // along with partial data). So even though "would block" is returned, if we
-  // have data, let's just return it. This is further complicated by the fact
-  // that errSSLWouldBlock is also used to short-circuit SSLRead()'s
-  // transparent renegotiation, so that we can update our state machine above,
-  // which otherwise would get out of sync with the SSLContextRef's internal
-  // state machine.
-  if (processed > 0) {
-    net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED,
-                                  processed, user_read_buf_->data());
-    return processed;
-  }
-
-  switch (status) {
-    case errSSLClosedNoNotify:
-      // TODO(wtc): Unless we have received the close_notify alert, we need to
-      // return an error code indicating that the SSL connection ended
-      // uncleanly, a potential truncation attack.  See http://crbug.com/18586.
-      return OK;
-
-    default:
-      return NetErrorFromOSStatus(status);
-  }
-}
-
-int SSLClientSocketMac::DoPayloadWrite() {
-  // Too much data in flight?
-  if (send_buffer_.size() > kWriteSizePauseLimit)
-    return ERR_IO_PENDING;
-
-  size_t processed = 0;
-  OSStatus status = SSLWrite(ssl_context_,
-                             user_write_buf_->data(),
-                             user_write_buf_len_,
-                             &processed);
-
-  if (processed > 0) {
-    net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_SENT, processed,
-                                  user_write_buf_->data());
-    return processed;
-  }
-
-  return NetErrorFromOSStatus(status);
-}
-
-int SSLClientSocketMac::DoCompletedRenegotiation(int result) {
-  // The user had a read in progress, which was interrupted by the
-  // renegotiation. Return the application data that was processed after the
-  // handshake completed.
-  next_handshake_state_ = STATE_COMPLETED_HANDSHAKE;
-  if (result != OK)
-    return result;
-  return bytes_read_after_renegotiation_;
-}
-
-void SSLClientSocketMac::DidCompleteRenegotiation() {
-  DCHECK(user_connect_callback_.is_null());
-  renegotiating_ = false;
-  next_handshake_state_ = STATE_COMPLETED_RENEGOTIATION;
-}
-
-int SSLClientSocketMac::DidCompleteHandshake() {
-  DCHECK(!server_cert_ || renegotiating_);
-  VLOG(1) << "Handshake completed, next verify cert";
-
-  scoped_refptr<X509Certificate> new_server_cert(
-      GetServerCert(ssl_context_));
-  if (!new_server_cert)
-    return ERR_UNEXPECTED;
-  net_log_.AddEvent(
-      NetLog::TYPE_SSL_CERTIFICATES_RECEIVED,
-      base::Bind(&NetLogX509CertificateCallback,
-                 base::Unretained(new_server_cert.get())));
-
-  if (renegotiating_ &&
-      X509Certificate::IsSameOSCert(server_cert_->os_cert_handle(),
-                                    new_server_cert->os_cert_handle())) {
-    // We already verified the server certificate.  Either it is good or the
-    // user has accepted the certificate error.
-    DidCompleteRenegotiation();
-  } else {
-    server_cert_ = new_server_cert;
-    next_handshake_state_ = STATE_VERIFY_CERT;
-  }
-  return OK;
-}
-
-// static
-OSStatus SSLClientSocketMac::SSLReadCallback(SSLConnectionRef connection,
-                                             void* data,
-                                             size_t* data_length) {
-  DCHECK(data);
-  DCHECK(data_length);
-  SSLClientSocketMac* us =
-      const_cast<SSLClientSocketMac*>(
-          static_cast<const SSLClientSocketMac*>(connection));
-
-  if (us->read_io_buf_) {
-    // We have I/O in flight; promise we'll get back to them and use the
-    // existing callback to do so.
-    *data_length = 0;
-    return errSSLWouldBlock;
-  }
-  if (us->completed_handshake()) {
-    // The state machine for SSLRead, located in libsecurity_ssl's
-    // sslTransport.c, will attempt to fully complete the renegotiation
-    // transparently in SSLRead once it reads the server's HelloRequest
-    // message. In order to make sure that the server certificate is
-    // (re-)verified and that any other parameters are logged (eg:
-    // certificate request state), we try to detect that the
-    // SSLClientSocketMac's state machine is out of sync with the
-    // SSLContext's. When that happens, we break out by faking
-    // errSSLWouldBlock, and set a flag so that DoPayloadRead() knows that
-    // it's not actually blocked. DoPayloadRead() will then restart the
-    // handshake state machine, and finally resume the original Read()
-    // once it successfully completes, similar to the behaviour of
-    // SSLClientSocketWin's DoDecryptPayload() and DoLoop() behave.
-    SSLSessionState state;
-    OSStatus status = SSLGetSessionState(us->ssl_context_, &state);
-    if (status) {
-      *data_length = 0;
-      return status;
-    }
-    if (state == kSSLHandshake) {
-      *data_length = 0;
-      us->renegotiating_ = true;
-      return errSSLWouldBlock;
-    }
-  }
-
-  size_t total_read = us->recv_buffer_.size();
-
-  int rv = 1;  // any old value to spin the loop below
-  while (rv > 0 && total_read < *data_length) {
-    us->read_io_buf_ = new IOBuffer(*data_length - total_read);
-    rv = us->transport_->socket()->Read(
-        us->read_io_buf_,
-        *data_length - total_read,
-        base::Bind(&SSLClientSocketMac::OnTransportReadComplete,
-                   base::Unretained(us)));
-
-    if (rv >= 0) {
-      us->recv_buffer_.insert(us->recv_buffer_.end(),
-                              us->read_io_buf_->data(),
-                              us->read_io_buf_->data() + rv);
-      us->read_io_buf_ = NULL;
-      total_read += rv;
-    }
-  }
-
-  *data_length = total_read;
-  if (total_read) {
-    memcpy(data, &us->recv_buffer_[0], total_read);
-    us->recv_buffer_.clear();
-  }
-
-  if (rv != ERR_IO_PENDING)
-    us->read_io_buf_ = NULL;
-
-  if (rv < 0)
-    return OSStatusFromNetError(rv);
-  else if (rv == 0)  // stream closed
-    return errSSLClosedGraceful;
-  else
-    return noErr;
-}
-
-// static
-OSStatus SSLClientSocketMac::SSLWriteCallback(SSLConnectionRef connection,
-                                              const void* data,
-                                              size_t* data_length) {
-  SSLClientSocketMac* us =
-      const_cast<SSLClientSocketMac*>(
-          static_cast<const SSLClientSocketMac*>(connection));
-
-  if (us->pending_send_error_ != OK) {
-    OSStatus status = OSStatusFromNetError(us->pending_send_error_);
-    us->pending_send_error_ = OK;
-    return status;
-  }
-
-  if (data)
-    us->send_buffer_.insert(us->send_buffer_.end(),
-                            static_cast<const char*>(data),
-                            static_cast<const char*>(data) + *data_length);
-
-  if (us->write_io_buf_) {
-    // If we have I/O in flight, just add the data to the end of the buffer and
-    // return to our caller. The existing callback will trigger the write of the
-    // new data when it sees that data remains in the buffer after removing the
-    // sent data. As always, lie to our caller.
-    return noErr;
-  }
-
-  int rv;
-  do {
-    us->write_io_buf_ = new IOBuffer(us->send_buffer_.size());
-    memcpy(us->write_io_buf_->data(), &us->send_buffer_[0],
-           us->send_buffer_.size());
-    rv = us->transport_->socket()->Write(
-        us->write_io_buf_,
-        us->send_buffer_.size(),
-        base::Bind(&SSLClientSocketMac::OnTransportWriteComplete,
-                   base::Unretained(us)));
-    if (rv > 0) {
-      us->send_buffer_.erase(us->send_buffer_.begin(),
-                             us->send_buffer_.begin() + rv);
-      us->write_io_buf_ = NULL;
-    }
-  } while (rv > 0 && !us->send_buffer_.empty());
-
-  if (rv < 0 && rv != ERR_IO_PENDING) {
-    us->write_io_buf_ = NULL;
-    return OSStatusFromNetError(rv);
-  }
-
-  // always lie to our caller
-  return noErr;
-}
-
-}  // namespace net
diff --git a/net/socket/ssl_client_socket_mac.h b/net/socket/ssl_client_socket_mac.h
deleted file mode 100644
index a3d91f8..0000000
--- a/net/socket/ssl_client_socket_mac.h
+++ /dev/null
@@ -1,184 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef NET_SOCKET_SSL_CLIENT_SOCKET_MAC_H_
-#define NET_SOCKET_SSL_CLIENT_SOCKET_MAC_H_
-
-#include <Security/Security.h>
-
-#include <string>
-#include <vector>
-
-#include "base/memory/scoped_ptr.h"
-#include "net/base/cert_verify_result.h"
-#include "net/base/completion_callback.h"
-#include "net/base/host_port_pair.h"
-#include "net/base/net_log.h"
-#include "net/base/ssl_config_service.h"
-#include "net/socket/ssl_client_socket.h"
-
-namespace net {
-
-class CertVerifier;
-class ClientSocketHandle;
-class SingleRequestCertVerifier;
-
-// An SSL client socket implemented with Secure Transport.
-class SSLClientSocketMac : public SSLClientSocket {
- public:
-  // Takes ownership of the |transport_socket|, which must already be connected.
-  // The hostname specified in |host_and_port| will be compared with the name(s)
-  // in the server's certificate during the SSL handshake.  If SSL client
-  // authentication is requested, the host_and_port field of SSLCertRequestInfo
-  // will be populated with |host_and_port|.  |ssl_config| specifies
-  // the SSL settings.
-  SSLClientSocketMac(ClientSocketHandle* transport_socket,
-                     const HostPortPair& host_and_port,
-                     const SSLConfig& ssl_config,
-                     const SSLClientSocketContext& context);
-  virtual ~SSLClientSocketMac();
-
-  // SSLClientSocket implementation.
-  virtual void GetSSLCertRequestInfo(
-      SSLCertRequestInfo* cert_request_info) OVERRIDE;
-  virtual NextProtoStatus GetNextProto(std::string* proto,
-                                       std::string* server_protos) OVERRIDE;
-  virtual ServerBoundCertService* GetServerBoundCertService() const OVERRIDE;
-
-  // SSLSocket implementation.
-  virtual int ExportKeyingMaterial(const base::StringPiece& label,
-                                   bool has_context,
-                                   const base::StringPiece& context,
-                                   unsigned char* out,
-                                   unsigned int outlen) OVERRIDE;
-  virtual int GetTLSUniqueChannelBinding(std::string* out) OVERRIDE;
-
-  // StreamSocket implementation.
-  virtual int Connect(const CompletionCallback& callback) OVERRIDE;
-  virtual void Disconnect() OVERRIDE;
-  virtual bool IsConnected() const OVERRIDE;
-  virtual bool IsConnectedAndIdle() const OVERRIDE;
-  virtual int GetPeerAddress(IPEndPoint* address) const OVERRIDE;
-  virtual int GetLocalAddress(IPEndPoint* address) const OVERRIDE;
-  virtual const BoundNetLog& NetLog() const OVERRIDE;
-  virtual void SetSubresourceSpeculation() OVERRIDE;
-  virtual void SetOmniboxSpeculation() OVERRIDE;
-  virtual bool WasEverUsed() const OVERRIDE;
-  virtual bool UsingTCPFastOpen() const OVERRIDE;
-  virtual int64 NumBytesRead() const OVERRIDE;
-  virtual base::TimeDelta GetConnectTimeMicros() const OVERRIDE;
-  virtual bool GetSSLInfo(SSLInfo* ssl_info) OVERRIDE;
-
-  // Socket implementation.
-  virtual int Read(IOBuffer* buf,
-                   int buf_len,
-                   const CompletionCallback& callback) OVERRIDE;
-  virtual int Write(IOBuffer* buf,
-                    int buf_len,
-                    const CompletionCallback& callback) OVERRIDE;
-  virtual bool SetReceiveBufferSize(int32 size) OVERRIDE;
-  virtual bool SetSendBufferSize(int32 size) OVERRIDE;
-
- private:
-  bool completed_handshake() const {
-    return next_handshake_state_ == STATE_COMPLETED_HANDSHAKE;
-  }
-  // Initializes the SSLContext.  Returns a net error code.
-  int InitializeSSLContext();
-
-  void DoConnectCallback(int result);
-  void DoReadCallback(int result);
-  void DoWriteCallback(int result);
-  void OnHandshakeIOComplete(int result);
-  void OnTransportReadComplete(int result);
-  void OnTransportWriteComplete(int result);
-
-  int DoHandshakeLoop(int last_io_result);
-
-  int DoPayloadRead();
-  int DoPayloadWrite();
-  int DoHandshake();
-  int DoVerifyCert();
-  int DoVerifyCertComplete(int result);
-  int DoCompletedRenegotiation(int result);
-
-  void DidCompleteRenegotiation();
-  int DidCompleteHandshake();
-
-  int SetClientCert();
-
-  static OSStatus SSLReadCallback(SSLConnectionRef connection,
-                                  void* data,
-                                  size_t* data_length);
-  static OSStatus SSLWriteCallback(SSLConnectionRef connection,
-                                   const void* data,
-                                   size_t* data_length);
-
-  scoped_ptr<ClientSocketHandle> transport_;
-  HostPortPair host_and_port_;
-  SSLConfig ssl_config_;
-
-  CompletionCallback user_connect_callback_;
-  CompletionCallback user_read_callback_;
-  CompletionCallback user_write_callback_;
-
-  // Used by Read function.
-  scoped_refptr<IOBuffer> user_read_buf_;
-  int user_read_buf_len_;
-
-  // Used by Write function.
-  scoped_refptr<IOBuffer> user_write_buf_;
-  int user_write_buf_len_;
-
-  enum State {
-    STATE_NONE,
-    STATE_HANDSHAKE,
-    STATE_VERIFY_CERT,
-    STATE_VERIFY_CERT_COMPLETE,
-    STATE_COMPLETED_RENEGOTIATION,
-    STATE_COMPLETED_HANDSHAKE,
-    // After the handshake, the socket remains in the
-    // STATE_COMPLETED_HANDSHAKE state until renegotiation is requested by
-    // the server. When renegotiation is requested, the state machine
-    // restarts at STATE_HANDSHAKE, advances through to
-    // STATE_VERIFY_CERT_COMPLETE, and then continues to
-    // STATE_COMPLETED_RENEGOTIATION. After STATE_COMPLETED_RENEGOTIATION
-    // has been processed, it goes back to STATE_COMPLETED_HANDSHAKE and
-    // will remain there until the server requests renegotiation again.
-    // During the initial handshake, STATE_COMPLETED_RENEGOTIATION is
-    // skipped.
-  };
-  State next_handshake_state_;
-
-  scoped_refptr<X509Certificate> server_cert_;
-  CertVerifier* const cert_verifier_;
-  scoped_ptr<SingleRequestCertVerifier> verifier_;
-  CertVerifyResult server_cert_verify_result_;
-
-  // The initial handshake has already completed, and the current handshake
-  // is server-initiated renegotiation.
-  bool renegotiating_;
-  bool client_cert_requested_;
-  SSLContextRef ssl_context_;
-
-  // During a renegotiation, the amount of application data read following
-  // the handshake's completion.
-  size_t bytes_read_after_renegotiation_;
-
-  // These buffers hold data retrieved from/sent to the underlying transport
-  // before it's fed to the SSL engine.
-  std::vector<char> send_buffer_;
-  int pending_send_error_;
-  std::vector<char> recv_buffer_;
-
-  // These are the IOBuffers used for operations on the underlying transport.
-  scoped_refptr<IOBuffer> read_io_buf_;
-  scoped_refptr<IOBuffer> write_io_buf_;
-
-  BoundNetLog net_log_;
-};
-
-}  // namespace net
-
-#endif  // NET_SOCKET_SSL_CLIENT_SOCKET_MAC_H_
diff --git a/net/socket/ssl_client_socket_win.cc b/net/socket/ssl_client_socket_win.cc
deleted file mode 100644
index ecc7f0e..0000000
--- a/net/socket/ssl_client_socket_win.cc
+++ /dev/null
@@ -1,1635 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/socket/ssl_client_socket_win.h"
-
-#include <schnlsp.h>
-
-#include <algorithm>
-#include <map>
-
-#include "base/bind.h"
-#include "base/compiler_specific.h"
-#include "base/lazy_instance.h"
-#include "base/stl_util.h"
-#include "base/string_util.h"
-#include "base/synchronization/lock.h"
-#include "base/utf_string_conversions.h"
-#include "net/base/cert_verifier.h"
-#include "net/base/connection_type_histograms.h"
-#include "net/base/host_port_pair.h"
-#include "net/base/io_buffer.h"
-#include "net/base/net_log.h"
-#include "net/base/net_errors.h"
-#include "net/base/single_request_cert_verifier.h"
-#include "net/base/ssl_cert_request_info.h"
-#include "net/base/ssl_connection_status_flags.h"
-#include "net/base/ssl_info.h"
-#include "net/base/x509_certificate_net_log_param.h"
-#include "net/base/x509_util.h"
-#include "net/socket/client_socket_handle.h"
-
-#pragma comment(lib, "secur32.lib")
-
-namespace net {
-
-//-----------------------------------------------------------------------------
-
-// TODO(wtc): See http://msdn.microsoft.com/en-us/library/aa377188(VS.85).aspx
-// for the other error codes we may need to map.
-static int MapSecurityError(SECURITY_STATUS err) {
-  // There are numerous security error codes, but these are the ones we thus
-  // far find interesting.
-  switch (err) {
-    case SEC_E_WRONG_PRINCIPAL:  // Schannel - server certificate error.
-    case CERT_E_CN_NO_MATCH:  // CryptoAPI
-      return ERR_CERT_COMMON_NAME_INVALID;
-    case SEC_E_UNTRUSTED_ROOT:  // Schannel - server certificate error or
-                                // unknown_ca alert.
-    case CERT_E_UNTRUSTEDROOT:  // CryptoAPI
-      return ERR_CERT_AUTHORITY_INVALID;
-    case SEC_E_CERT_EXPIRED:  // Schannel - server certificate error or
-                              // certificate_expired alert.
-    case CERT_E_EXPIRED:  // CryptoAPI
-      return ERR_CERT_DATE_INVALID;
-    case CRYPT_E_NO_REVOCATION_CHECK:
-      return ERR_CERT_NO_REVOCATION_MECHANISM;
-    case CRYPT_E_REVOCATION_OFFLINE:
-      return ERR_CERT_UNABLE_TO_CHECK_REVOCATION;
-    case CRYPT_E_REVOKED:  // CryptoAPI and Schannel server certificate error,
-                           // or certificate_revoked alert.
-      return ERR_CERT_REVOKED;
-
-    // We received one of the following alert messages from the server:
-    //   bad_certificate
-    //   unsupported_certificate
-    //   certificate_unknown
-    case SEC_E_CERT_UNKNOWN:
-    case CERT_E_ROLE:
-      return ERR_CERT_INVALID;
-
-    // We received one of the following alert messages from the server:
-    //   decode_error
-    //   export_restriction
-    //   handshake_failure
-    //   illegal_parameter
-    //   record_overflow
-    //   unexpected_message
-    // and all other TLS alerts not explicitly specified elsewhere.
-    case SEC_E_ILLEGAL_MESSAGE:
-    // We received one of the following alert messages from the server:
-    //   decrypt_error
-    //   decryption_failed
-    case SEC_E_DECRYPT_FAILURE:
-    // We received one of the following alert messages from the server:
-    //   bad_record_mac
-    //   decompression_failure
-    case SEC_E_MESSAGE_ALTERED:
-    // TODO(rsleevi): Add SEC_E_INTERNAL_ERROR, which corresponds to an
-    // internal_error alert message being received. However, it is also used
-    // by Schannel for authentication errors that happen locally, so it has
-    // been omitted to prevent masking them as protocol errors.
-      return ERR_SSL_PROTOCOL_ERROR;
-
-    case SEC_E_LOGON_DENIED:  // Received a access_denied alert.
-      return ERR_BAD_SSL_CLIENT_AUTH_CERT;
-
-    case SEC_E_UNSUPPORTED_FUNCTION:  // Received a protocol_version alert.
-    case SEC_E_ALGORITHM_MISMATCH:  // Received an insufficient_security alert.
-      return ERR_SSL_VERSION_OR_CIPHER_MISMATCH;
-
-    case SEC_E_NO_CREDENTIALS:
-      return ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY;
-    case SEC_E_INVALID_HANDLE:
-    case SEC_E_INVALID_TOKEN:
-      LOG(ERROR) << "Unexpected error " << err;
-      return ERR_UNEXPECTED;
-    case SEC_E_OK:
-      return OK;
-    default:
-      LOG(WARNING) << "Unknown error " << err << " mapped to net::ERR_FAILED";
-      return ERR_FAILED;
-  }
-}
-
-//-----------------------------------------------------------------------------
-
-// A bitmask consisting of these bit flags encodes which versions of the SSL
-// protocol (SSL 3.0 and TLS 1.0) are enabled.
-// TODO(wtc): support TLS 1.1 and TLS 1.2 on Windows Vista and later.
-enum {
-  SSL3 = 1 << 0,
-  TLS1 = 1 << 1,
-  SSL_VERSION_MASKS = 1 << 2  // The number of SSL version bitmasks.
-};
-
-// CredHandleClass simply gives a default constructor and a destructor to
-// SSPI's CredHandle type (a C struct).
-class CredHandleClass : public CredHandle {
- public:
-  CredHandleClass() {
-    SecInvalidateHandle(this);
-  }
-
-  ~CredHandleClass() {
-    if (SecIsValidHandle(this)) {
-      SECURITY_STATUS status = FreeCredentialsHandle(this);
-      DCHECK(status == SEC_E_OK);
-    }
-  }
-};
-
-// A table of CredHandles.
-class CredHandleTable {
- public:
-  CredHandleTable() {}
-
-  ~CredHandleTable() {
-    STLDeleteContainerPairSecondPointers(client_cert_creds_.begin(),
-                                         client_cert_creds_.end());
-  }
-
-  int GetHandle(PCCERT_CONTEXT client_cert,
-                int ssl_version_mask,
-                CredHandle** handle_ptr) {
-    DCHECK(0 < ssl_version_mask &&
-           ssl_version_mask < arraysize(anonymous_creds_));
-    CredHandleClass* handle;
-    base::AutoLock lock(lock_);
-    if (client_cert) {
-      CredHandleMapKey key = std::make_pair(client_cert, ssl_version_mask);
-      CredHandleMap::const_iterator it = client_cert_creds_.find(key);
-      if (it == client_cert_creds_.end()) {
-        handle = new CredHandleClass;
-        client_cert_creds_[key] = handle;
-      } else {
-        handle = it->second;
-      }
-    } else {
-      handle = &anonymous_creds_[ssl_version_mask];
-    }
-    if (!SecIsValidHandle(handle)) {
-      int result = InitializeHandle(handle, client_cert, ssl_version_mask);
-      if (result != OK)
-        return result;
-    }
-    *handle_ptr = handle;
-    return OK;
-  }
-
- private:
-  // CredHandleMapKey is a std::pair consisting of these two components:
-  //   PCCERT_CONTEXT client_cert
-  //   int ssl_version_mask
-  typedef std::pair<PCCERT_CONTEXT, int> CredHandleMapKey;
-
-  typedef std::map<CredHandleMapKey, CredHandleClass*> CredHandleMap;
-
-  // Returns OK on success or a network error code on failure.
-  static int InitializeHandle(CredHandle* handle,
-                              PCCERT_CONTEXT client_cert,
-                              int ssl_version_mask);
-
-  base::Lock lock_;
-
-  // Anonymous (no client certificate) CredHandles for all possible
-  // combinations of SSL versions.  Defined as an array for fast lookup.
-  CredHandleClass anonymous_creds_[SSL_VERSION_MASKS];
-
-  // CredHandles that use a client certificate.
-  CredHandleMap client_cert_creds_;
-};
-
-static base::LazyInstance<CredHandleTable> g_cred_handle_table =
-    LAZY_INSTANCE_INITIALIZER;
-
-// static
-int CredHandleTable::InitializeHandle(CredHandle* handle,
-                                      PCCERT_CONTEXT client_cert,
-                                      int ssl_version_mask) {
-  SCHANNEL_CRED schannel_cred = {0};
-  schannel_cred.dwVersion = SCHANNEL_CRED_VERSION;
-  if (client_cert) {
-    schannel_cred.cCreds = 1;
-    schannel_cred.paCred = &client_cert;
-    // Schannel will make its own copy of client_cert.
-  }
-
-  // The global system registry settings take precedence over the value of
-  // schannel_cred.grbitEnabledProtocols.
-  schannel_cred.grbitEnabledProtocols = 0;
-  if (ssl_version_mask & SSL3)
-    schannel_cred.grbitEnabledProtocols |= SP_PROT_SSL3;
-  if (ssl_version_mask & TLS1)
-    schannel_cred.grbitEnabledProtocols |= SP_PROT_TLS1;
-
-  // The default session lifetime is 36000000 milliseconds (ten hours).  Set
-  // schannel_cred.dwSessionLifespan to change the number of milliseconds that
-  // Schannel keeps the session in its session cache.
-
-  // We can set the key exchange algorithms (RSA or DH) in
-  // schannel_cred.{cSupportedAlgs,palgSupportedAlgs}.
-
-  // Although SCH_CRED_AUTO_CRED_VALIDATION is convenient, we have to use
-  // SCH_CRED_MANUAL_CRED_VALIDATION for three reasons.
-  // 1. SCH_CRED_AUTO_CRED_VALIDATION doesn't allow us to get the certificate
-  //    context if the certificate validation fails.
-  // 2. SCH_CRED_AUTO_CRED_VALIDATION returns only one error even if the
-  //    certificate has multiple errors.
-  // 3. SCH_CRED_AUTO_CRED_VALIDATION doesn't allow us to ignore untrusted CA
-  //    and expired certificate errors.  There are only flags to ignore the
-  //    name mismatch and unable-to-check-revocation errors.
-  //
-  // We specify SCH_CRED_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT to cause the TLS
-  // certificate status request extension (commonly known as OCSP stapling)
-  // to be sent on Vista or later.  This flag matches the
-  // CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT flag that we pass to the
-  // CertGetCertificateChain calls.  Note: we specify this flag even when
-  // revocation checking is disabled to avoid doubling the number of
-  // credentials handles we need to acquire.
-  //
-  // TODO(wtc): Look into undocumented or poorly documented flags:
-  //   SCH_CRED_RESTRICTED_ROOTS
-  //   SCH_CRED_REVOCATION_CHECK_CACHE_ONLY
-  //   SCH_CRED_CACHE_ONLY_URL_RETRIEVAL
-  //   SCH_CRED_MEMORY_STORE_CERT
-  schannel_cred.dwFlags |= SCH_CRED_NO_DEFAULT_CREDS |
-                           SCH_CRED_MANUAL_CRED_VALIDATION |
-                           SCH_CRED_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT;
-  TimeStamp expiry;
-  SECURITY_STATUS status;
-
-  status = AcquireCredentialsHandle(
-      NULL,  // Not used
-      UNISP_NAME,  // Microsoft Unified Security Protocol Provider
-      SECPKG_CRED_OUTBOUND,
-      NULL,  // Not used
-      &schannel_cred,
-      NULL,  // Not used
-      NULL,  // Not used
-      handle,
-      &expiry);  // Optional
-  if (status != SEC_E_OK)
-    LOG(ERROR) << "AcquireCredentialsHandle failed: " << status;
-  return MapSecurityError(status);
-}
-
-// For the SSL sockets to share SSL sessions by session resumption handshakes,
-// they need to use the same CredHandle.  The GetCredHandle function creates
-// and stores a shared CredHandle in *handle_ptr.  On success, GetCredHandle
-// returns OK.  On failure, GetCredHandle returns a network error code and
-// leaves *handle_ptr unchanged.
-//
-// The versions of the SSL protocol enabled are a property of the CredHandle.
-// So we need a separate CredHandle for each combination of SSL versions.
-// Most of the time Chromium will use only one or two combinations of SSL
-// versions (for example, SSL3 | TLS1 for normal use, plus SSL3 when visiting
-// TLS-intolerant servers).  These CredHandles are initialized only when
-// needed.
-
-static int GetCredHandle(PCCERT_CONTEXT client_cert,
-                         int ssl_version_mask,
-                         CredHandle** handle_ptr) {
-  if (ssl_version_mask <= 0 || ssl_version_mask >= SSL_VERSION_MASKS) {
-    NOTREACHED();
-    return ERR_UNEXPECTED;
-  }
-  return g_cred_handle_table.Get().GetHandle(client_cert,
-                                             ssl_version_mask,
-                                             handle_ptr);
-}
-
-//-----------------------------------------------------------------------------
-
-// This callback is intended to be used with CertFindChainInStore. In addition
-// to filtering by extended/enhanced key usage, we do not show expired
-// certificates and require digital signature usage in the key usage
-// extension.
-//
-// This matches our behavior on Mac OS X and that of NSS. It also matches the
-// default behavior of IE8. See http://support.microsoft.com/kb/890326 and
-// http://blogs.msdn.com/b/askie/archive/2009/06/09/my-expired-client-certificates-no-longer-display-when-connecting-to-my-web-server-using-ie8.aspx
-static BOOL WINAPI ClientCertFindCallback(PCCERT_CONTEXT cert_context,
-                                          void* find_arg) {
-  // Verify the certificate's KU is good.
-  BYTE key_usage;
-  if (CertGetIntendedKeyUsage(X509_ASN_ENCODING, cert_context->pCertInfo,
-                              &key_usage, 1)) {
-    if (!(key_usage & CERT_DIGITAL_SIGNATURE_KEY_USAGE))
-      return FALSE;
-  } else {
-    DWORD err = GetLastError();
-    // If |err| is non-zero, it's an actual error. Otherwise the extension
-    // just isn't present, and we treat it as if everything was allowed.
-    if (err) {
-      DLOG(ERROR) << "CertGetIntendedKeyUsage failed: " << err;
-      return FALSE;
-    }
-  }
-
-  // Verify the current time is within the certificate's validity period.
-  if (CertVerifyTimeValidity(NULL, cert_context->pCertInfo) != 0)
-    return FALSE;
-
-  // Verify private key metadata is associated with this certificate.
-  DWORD size = 0;
-  if (!CertGetCertificateContextProperty(
-          cert_context, CERT_KEY_PROV_INFO_PROP_ID, NULL, &size)) {
-    return FALSE;
-  }
-
-  return TRUE;
-}
-
-static bool IsCertificateChainIdentical(const X509Certificate* a,
-                                        const X509Certificate* b) {
-  DCHECK(a);
-  DCHECK(b);
-  const X509Certificate::OSCertHandles& a_intermediates =
-      a->GetIntermediateCertificates();
-  const X509Certificate::OSCertHandles& b_intermediates =
-      b->GetIntermediateCertificates();
-  if (a_intermediates.size() != b_intermediates.size() || !a->Equals(b))
-    return false;
-  for (size_t i = 0; i < a_intermediates.size(); ++i) {
-    if (!X509Certificate::IsSameOSCert(a_intermediates[i], b_intermediates[i]))
-      return false;
-  }
-  return true;
-}
-
-//-----------------------------------------------------------------------------
-
-// Size of recv_buffer_
-//
-// Ciphertext is decrypted one SSL record at a time, so recv_buffer_ needs to
-// have room for a full SSL record, with the header and trailer.  Here is the
-// breakdown of the size:
-//   5: SSL record header
-//   16K: SSL record maximum size
-//   64: >= SSL record trailer (16 or 20 have been observed)
-static const int kRecvBufferSize = (5 + 16*1024 + 64);
-
-SSLClientSocketWin::SSLClientSocketWin(ClientSocketHandle* transport_socket,
-                                       const HostPortPair& host_and_port,
-                                       const SSLConfig& ssl_config,
-                                       const SSLClientSocketContext& context)
-    : transport_(transport_socket),
-      host_and_port_(host_and_port),
-      ssl_config_(ssl_config),
-      user_read_buf_len_(0),
-      user_write_buf_len_(0),
-      next_state_(STATE_NONE),
-      cert_verifier_(context.cert_verifier),
-      creds_(NULL),
-      isc_status_(SEC_E_OK),
-      payload_send_buffer_len_(0),
-      bytes_sent_(0),
-      decrypted_ptr_(NULL),
-      bytes_decrypted_(0),
-      received_ptr_(NULL),
-      bytes_received_(0),
-      writing_first_token_(false),
-      ignore_ok_result_(false),
-      renegotiating_(false),
-      need_more_data_(false),
-      net_log_(transport_socket->socket()->NetLog()) {
-  memset(&stream_sizes_, 0, sizeof(stream_sizes_));
-  memset(in_buffers_, 0, sizeof(in_buffers_));
-  memset(&send_buffer_, 0, sizeof(send_buffer_));
-  memset(&ctxt_, 0, sizeof(ctxt_));
-}
-
-SSLClientSocketWin::~SSLClientSocketWin() {
-  Disconnect();
-}
-
-bool SSLClientSocketWin::GetSSLInfo(SSLInfo* ssl_info) {
-  ssl_info->Reset();
-  if (!server_cert_)
-    return false;
-
-  ssl_info->cert = server_cert_verify_result_.verified_cert;
-  ssl_info->cert_status = server_cert_verify_result_.cert_status;
-  ssl_info->public_key_hashes = server_cert_verify_result_.public_key_hashes;
-  ssl_info->is_issued_by_known_root =
-      server_cert_verify_result_.is_issued_by_known_root;
-  ssl_info->client_cert_sent =
-      ssl_config_.send_client_cert && ssl_config_.client_cert;
-  ssl_info->channel_id_sent = WasChannelIDSent();
-  SecPkgContext_ConnectionInfo connection_info;
-  SECURITY_STATUS status = QueryContextAttributes(
-      &ctxt_, SECPKG_ATTR_CONNECTION_INFO, &connection_info);
-  if (status == SEC_E_OK) {
-    // TODO(wtc): compute the overall security strength, taking into account
-    // dwExchStrength and dwHashStrength.  dwExchStrength needs to be
-    // normalized.
-    ssl_info->security_bits = connection_info.dwCipherStrength;
-    // TODO(wtc): connection_info.dwProtocol is the negotiated version.
-    // Save it in ssl_info->connection_status.
-  }
-  // SecPkgContext_CipherInfo comes from CNG and is available on Vista or
-  // later only.  On XP, the next QueryContextAttributes call fails with
-  // SEC_E_UNSUPPORTED_FUNCTION (0x80090302), so ssl_info->connection_status
-  // won't contain the cipher suite.  If this is a problem, we can build the
-  // cipher suite from the aiCipher, aiHash, and aiExch fields of
-  // SecPkgContext_ConnectionInfo based on Appendix C of RFC 5246.
-  SecPkgContext_CipherInfo cipher_info = { SECPKGCONTEXT_CIPHERINFO_V1 };
-  status = QueryContextAttributes(
-      &ctxt_, SECPKG_ATTR_CIPHER_INFO, &cipher_info);
-  if (status == SEC_E_OK) {
-    // TODO(wtc): find out what the cipher_info.dwBaseCipherSuite field is.
-    ssl_info->connection_status |=
-        (cipher_info.dwCipherSuite & SSL_CONNECTION_CIPHERSUITE_MASK) <<
-        SSL_CONNECTION_CIPHERSUITE_SHIFT;
-    // SChannel doesn't support TLS compression, so cipher_info doesn't have
-    // any field related to the compression method.
-  }
-
-  if (ssl_config_.version_fallback)
-    ssl_info->connection_status |= SSL_CONNECTION_VERSION_FALLBACK;
-
-  return true;
-}
-
-void SSLClientSocketWin::GetSSLCertRequestInfo(
-    SSLCertRequestInfo* cert_request_info) {
-  cert_request_info->host_and_port = host_and_port_.ToString();
-  cert_request_info->cert_authorities.clear();
-  cert_request_info->cert_key_types.clear();
-  cert_request_info->client_certs.clear();
-
-  // Get the server criteria for client certificates. Schannel doesn't return
-  // the certificate_types field of the CertificateRequest message to us, so we
-  // can't fill the |cert_key_types| field.
-  SecPkgContext_IssuerListInfoEx issuer_list;
-  SECURITY_STATUS status = QueryContextAttributes(
-      &ctxt_, SECPKG_ATTR_ISSUER_LIST_EX, &issuer_list);
-  if (status != SEC_E_OK) {
-    DLOG(ERROR) << "QueryContextAttributes (issuer list) failed: " << status;
-    return;
-  }
-
-  for (size_t i = 0; i < issuer_list.cIssuers; i++) {
-    cert_request_info->cert_authorities.push_back(std::string(
-        reinterpret_cast<const char*>(issuer_list.aIssuers[i].pbData),
-        static_cast<size_t>(issuer_list.aIssuers[i].cbData)));
-  }
-
-  // Retrieve the list of matching client certificates. This is to be moved out
-  // of here as a part of refactoring effort being tracked in
-  // http://crbug.com/166642.
-
-  // Client certificates of the user are in the "MY" system certificate store.
-  HCERTSTORE my_cert_store = CertOpenSystemStore(NULL, L"MY");
-  if (!my_cert_store) {
-    LOG(ERROR) << "Could not open the \"MY\" system certificate store: "
-               << GetLastError();
-    FreeContextBuffer(issuer_list.aIssuers);
-    return;
-  }
-
-  // Enumerate the client certificates.
-  CERT_CHAIN_FIND_BY_ISSUER_PARA find_by_issuer_para;
-  memset(&find_by_issuer_para, 0, sizeof(find_by_issuer_para));
-  find_by_issuer_para.cbSize = sizeof(find_by_issuer_para);
-  find_by_issuer_para.pszUsageIdentifier = szOID_PKIX_KP_CLIENT_AUTH;
-  find_by_issuer_para.cIssuer = issuer_list.cIssuers;
-  find_by_issuer_para.rgIssuer = issuer_list.aIssuers;
-  find_by_issuer_para.pfnFindCallback = ClientCertFindCallback;
-
-  PCCERT_CHAIN_CONTEXT chain_context = NULL;
-  DWORD find_flags = CERT_CHAIN_FIND_BY_ISSUER_CACHE_ONLY_FLAG |
-                     CERT_CHAIN_FIND_BY_ISSUER_CACHE_ONLY_URL_FLAG;
-
-  for (;;) {
-    // Find a certificate chain.
-    chain_context = CertFindChainInStore(my_cert_store,
-                                         X509_ASN_ENCODING,
-                                         find_flags,
-                                         CERT_CHAIN_FIND_BY_ISSUER,
-                                         &find_by_issuer_para,
-                                         chain_context);
-    if (!chain_context) {
-      DWORD err = GetLastError();
-      if (err != CRYPT_E_NOT_FOUND)
-        DLOG(ERROR) << "CertFindChainInStore failed: " << err;
-      break;
-    }
-
-    // Get the leaf certificate.
-    PCCERT_CONTEXT cert_context =
-        chain_context->rgpChain[0]->rgpElement[0]->pCertContext;
-    // Copy the certificate into a NULL store, so that the "MY" store can be
-    // closed before returning from this function.
-    PCCERT_CONTEXT cert_context2 = NULL;
-    BOOL ok = CertAddCertificateContextToStore(NULL, cert_context,
-                                               CERT_STORE_ADD_USE_EXISTING,
-                                               &cert_context2);
-    if (!ok) {
-      NOTREACHED();
-      continue;
-    }
-
-    // Grab the intermediates, if any.
-    X509Certificate::OSCertHandles intermediates;
-    for (DWORD i = 1; i < chain_context->rgpChain[0]->cElement; ++i) {
-      PCCERT_CONTEXT chain_intermediate =
-          chain_context->rgpChain[0]->rgpElement[i]->pCertContext;
-      PCCERT_CONTEXT copied_intermediate = NULL;
-      ok = CertAddCertificateContextToStore(NULL, chain_intermediate,
-                                            CERT_STORE_ADD_USE_EXISTING,
-                                            &copied_intermediate);
-      if (ok)
-        intermediates.push_back(copied_intermediate);
-    }
-    scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromHandle(
-        cert_context2, intermediates);
-    cert_request_info->client_certs.push_back(cert);
-    CertFreeCertificateContext(cert_context2);
-    for (size_t i = 0; i < intermediates.size(); ++i)
-      CertFreeCertificateContext(intermediates[i]);
-  }
-
-  std::sort(cert_request_info->client_certs.begin(),
-            cert_request_info->client_certs.end(),
-            x509_util::ClientCertSorter());
-
-  FreeContextBuffer(issuer_list.aIssuers);
-
-  BOOL ok = CertCloseStore(my_cert_store, CERT_CLOSE_STORE_CHECK_FLAG);
-  DCHECK(ok);
-}
-
-int SSLClientSocketWin::ExportKeyingMaterial(const base::StringPiece& label,
-                                             bool has_context,
-                                             const base::StringPiece& context,
-                                             unsigned char* out,
-                                             unsigned int outlen) {
-  return ERR_NOT_IMPLEMENTED;
-}
-
-int SSLClientSocketWin::GetTLSUniqueChannelBinding(std::string* out) {
-  return ERR_NOT_IMPLEMENTED;
-}
-
-SSLClientSocket::NextProtoStatus
-SSLClientSocketWin::GetNextProto(std::string* proto,
-                                 std::string* server_protos) {
-  proto->clear();
-  server_protos->clear();
-  return kNextProtoUnsupported;
-}
-
-ServerBoundCertService* SSLClientSocketWin::GetServerBoundCertService() const {
-  return NULL;
-}
-
-int SSLClientSocketWin::Connect(const CompletionCallback& callback) {
-  DCHECK(transport_.get());
-  DCHECK(next_state_ == STATE_NONE);
-  DCHECK(user_connect_callback_.is_null());
-
-  net_log_.BeginEvent(NetLog::TYPE_SSL_CONNECT);
-
-  int rv = InitializeSSLContext();
-  if (rv != OK) {
-    net_log_.EndEvent(NetLog::TYPE_SSL_CONNECT);
-    return rv;
-  }
-
-  writing_first_token_ = true;
-  next_state_ = STATE_HANDSHAKE_WRITE;
-  rv = DoLoop(OK);
-  if (rv == ERR_IO_PENDING) {
-    user_connect_callback_ = callback;
-  } else {
-    net_log_.EndEvent(NetLog::TYPE_SSL_CONNECT);
-  }
-  return rv;
-}
-
-int SSLClientSocketWin::InitializeSSLContext() {
-  // If ssl_config_.version_max > SSL_PROTOCOL_VERSION_TLS1, it means the
-  // SSLConfigService::SetDefaultVersionMax(SSL_PROTOCOL_VERSION_TLS1) call
-  // in ClientSocketFactory::UseSystemSSL() is not effective.
-  DCHECK_LE(ssl_config_.version_max, SSL_PROTOCOL_VERSION_TLS1);
-  int ssl_version_mask = 0;
-  if (ssl_config_.version_min == SSL_PROTOCOL_VERSION_SSL3)
-    ssl_version_mask |= SSL3;
-  if (ssl_config_.version_min <= SSL_PROTOCOL_VERSION_TLS1 &&
-      ssl_config_.version_max >= SSL_PROTOCOL_VERSION_TLS1) {
-    ssl_version_mask |= TLS1;
-  }
-  // If we pass 0 to GetCredHandle, we will let Schannel select the protocols,
-  // rather than enabling no protocols.  So we have to fail here.
-  if (ssl_version_mask == 0)
-    return ERR_NO_SSL_VERSIONS_ENABLED;
-  PCCERT_CONTEXT cert_context = NULL;
-  if (ssl_config_.client_cert)
-    cert_context = ssl_config_.client_cert->os_cert_handle();
-  int result = GetCredHandle(cert_context, ssl_version_mask, &creds_);
-  if (result != OK)
-    return result;
-
-  memset(&ctxt_, 0, sizeof(ctxt_));
-
-  SecBufferDesc buffer_desc;
-  DWORD out_flags;
-  DWORD flags = ISC_REQ_SEQUENCE_DETECT   |
-                ISC_REQ_REPLAY_DETECT     |
-                ISC_REQ_CONFIDENTIALITY   |
-                ISC_RET_EXTENDED_ERROR    |
-                ISC_REQ_ALLOCATE_MEMORY   |
-                ISC_REQ_STREAM;
-
-  send_buffer_.pvBuffer = NULL;
-  send_buffer_.BufferType = SECBUFFER_TOKEN;
-  send_buffer_.cbBuffer = 0;
-
-  buffer_desc.cBuffers = 1;
-  buffer_desc.pBuffers = &send_buffer_;
-  buffer_desc.ulVersion = SECBUFFER_VERSION;
-
-  TimeStamp expiry;
-  SECURITY_STATUS status;
-
-  status = InitializeSecurityContext(
-      creds_,
-      NULL,  // NULL on the first call
-      const_cast<wchar_t*>(ASCIIToWide(host_and_port_.host()).c_str()),
-      flags,
-      0,  // Reserved
-      0,  // Not used with Schannel.
-      NULL,  // NULL on the first call
-      0,  // Reserved
-      &ctxt_,  // Receives the new context handle
-      &buffer_desc,
-      &out_flags,
-      &expiry);
-  if (status != SEC_I_CONTINUE_NEEDED) {
-    LOG(ERROR) << "InitializeSecurityContext failed: " << status;
-    if (status == SEC_E_INVALID_HANDLE) {
-      // The only handle we passed to this InitializeSecurityContext call is
-      // creds_, so print its contents to figure out why it's invalid.
-      if (creds_) {
-        LOG(ERROR) << "creds_->dwLower = " << creds_->dwLower
-                   << "; creds_->dwUpper = " << creds_->dwUpper;
-      } else {
-        LOG(ERROR) << "creds_ is NULL";
-      }
-    }
-    return MapSecurityError(status);
-  }
-
-  return OK;
-}
-
-
-void SSLClientSocketWin::Disconnect() {
-  // TODO(wtc): Send SSL close_notify alert.
-  next_state_ = STATE_NONE;
-
-  // Shut down anything that may call us back.
-  verifier_.reset();
-  transport_->socket()->Disconnect();
-
-  if (send_buffer_.pvBuffer)
-    FreeSendBuffer();
-  if (SecIsValidHandle(&ctxt_)) {
-    DeleteSecurityContext(&ctxt_);
-    SecInvalidateHandle(&ctxt_);
-  }
-  if (server_cert_)
-    server_cert_ = NULL;
-
-  // TODO(wtc): reset more members?
-  bytes_decrypted_ = 0;
-  bytes_received_ = 0;
-  writing_first_token_ = false;
-  renegotiating_ = false;
-  need_more_data_ = false;
-}
-
-bool SSLClientSocketWin::IsConnected() const {
-  // Ideally, we should also check if we have received the close_notify alert
-  // message from the server, and return false in that case.  We're not doing
-  // that, so this function may return a false positive.  Since the upper
-  // layer (HttpNetworkTransaction) needs to handle a persistent connection
-  // closed by the server when we send a request anyway, a false positive in
-  // exchange for simpler code is a good trade-off.
-  return completed_handshake() && transport_->socket()->IsConnected();
-}
-
-bool SSLClientSocketWin::IsConnectedAndIdle() const {
-  // Unlike IsConnected, this method doesn't return a false positive.
-  //
-  // Strictly speaking, we should check if we have received the close_notify
-  // alert message from the server, and return false in that case.  Although
-  // the close_notify alert message means EOF in the SSL layer, it is just
-  // bytes to the transport layer below, so
-  // transport_->socket()->IsConnectedAndIdle() returns the desired false
-  // when we receive close_notify.
-  return completed_handshake() && transport_->socket()->IsConnectedAndIdle();
-}
-
-int SSLClientSocketWin::GetPeerAddress(IPEndPoint* address) const {
-  return transport_->socket()->GetPeerAddress(address);
-}
-
-int SSLClientSocketWin::GetLocalAddress(IPEndPoint* address) const {
-  return transport_->socket()->GetLocalAddress(address);
-}
-
-void SSLClientSocketWin::SetSubresourceSpeculation() {
-  if (transport_.get() && transport_->socket()) {
-    transport_->socket()->SetSubresourceSpeculation();
-  } else {
-    NOTREACHED();
-  }
-}
-
-void SSLClientSocketWin::SetOmniboxSpeculation() {
-  if (transport_.get() && transport_->socket()) {
-    transport_->socket()->SetOmniboxSpeculation();
-  } else {
-    NOTREACHED();
-  }
-}
-
-bool SSLClientSocketWin::WasEverUsed() const {
-  if (transport_.get() && transport_->socket()) {
-    return transport_->socket()->WasEverUsed();
-  }
-  NOTREACHED();
-  return false;
-}
-
-bool SSLClientSocketWin::UsingTCPFastOpen() const {
-  if (transport_.get() && transport_->socket()) {
-    return transport_->socket()->UsingTCPFastOpen();
-  }
-  NOTREACHED();
-  return false;
-}
-
-int64 SSLClientSocketWin::NumBytesRead() const {
-  if (transport_.get() && transport_->socket()) {
-    return transport_->socket()->NumBytesRead();
-  }
-  NOTREACHED();
-  return -1;
-}
-
-base::TimeDelta SSLClientSocketWin::GetConnectTimeMicros() const {
-  if (transport_.get() && transport_->socket()) {
-    return transport_->socket()->GetConnectTimeMicros();
-  }
-  NOTREACHED();
-  return base::TimeDelta::FromMicroseconds(-1);
-}
-
-int SSLClientSocketWin::Read(IOBuffer* buf, int buf_len,
-                             const CompletionCallback& callback) {
-  DCHECK(completed_handshake());
-  DCHECK(user_read_callback_.is_null());
-
-  // If we have surplus decrypted plaintext, satisfy the Read with it without
-  // reading more ciphertext from the transport socket.
-  if (bytes_decrypted_ != 0) {
-    int len = std::min(buf_len, bytes_decrypted_);
-    net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED, len,
-                                  decrypted_ptr_);
-    memcpy(buf->data(), decrypted_ptr_, len);
-    decrypted_ptr_ += len;
-    bytes_decrypted_ -= len;
-    if (bytes_decrypted_ == 0) {
-      decrypted_ptr_ = NULL;
-      if (bytes_received_ != 0) {
-        memmove(recv_buffer_.get(), received_ptr_, bytes_received_);
-        received_ptr_ = recv_buffer_.get();
-      }
-    }
-    return len;
-  }
-
-  DCHECK(!user_read_buf_);
-  // http://crbug.com/16371: We're seeing |buf->data()| return NULL.  See if the
-  // user is passing in an IOBuffer with a NULL |data_|.
-  CHECK(buf);
-  CHECK(buf->data());
-  user_read_buf_ = buf;
-  user_read_buf_len_ = buf_len;
-
-  int rv = DoPayloadRead();
-  if (rv == ERR_IO_PENDING) {
-    user_read_callback_ = callback;
-  } else {
-    user_read_buf_ = NULL;
-    user_read_buf_len_ = 0;
-  }
-  return rv;
-}
-
-int SSLClientSocketWin::Write(IOBuffer* buf, int buf_len,
-                              const CompletionCallback& callback) {
-  DCHECK(completed_handshake());
-  DCHECK(user_write_callback_.is_null());
-
-  DCHECK(!user_write_buf_);
-  user_write_buf_ = buf;
-  user_write_buf_len_ = buf_len;
-
-  int rv = DoPayloadEncrypt();
-  if (rv != OK)
-    return rv;
-
-  rv = DoPayloadWrite();
-  if (rv == ERR_IO_PENDING) {
-    user_write_callback_ = callback;
-  } else {
-    user_write_buf_ = NULL;
-    user_write_buf_len_ = 0;
-  }
-  return rv;
-}
-
-bool SSLClientSocketWin::SetReceiveBufferSize(int32 size) {
-  return transport_->socket()->SetReceiveBufferSize(size);
-}
-
-bool SSLClientSocketWin::SetSendBufferSize(int32 size) {
-  return transport_->socket()->SetSendBufferSize(size);
-}
-
-void SSLClientSocketWin::OnHandshakeIOComplete(int result) {
-  int rv = DoLoop(result);
-
-  // The SSL handshake has some round trips.  We need to notify the caller of
-  // success or any error, other than waiting for IO.
-  if (rv != ERR_IO_PENDING) {
-    // If there is no connect callback available to call, we are renegotiating
-    // (which occurs because we are in the middle of a Read when the
-    // renegotiation process starts).  So we complete the Read here.
-    if (user_connect_callback_.is_null()) {
-      CompletionCallback c = user_read_callback_;
-      user_read_callback_.Reset();
-      user_read_buf_ = NULL;
-      user_read_buf_len_ = 0;
-      c.Run(rv);
-      return;
-    }
-    net_log_.EndEvent(NetLog::TYPE_SSL_CONNECT);
-    CompletionCallback c = user_connect_callback_;
-    user_connect_callback_.Reset();
-    c.Run(rv);
-  }
-}
-
-void SSLClientSocketWin::OnReadComplete(int result) {
-  DCHECK(completed_handshake());
-
-  result = DoPayloadReadComplete(result);
-  if (result > 0)
-    result = DoPayloadDecrypt();
-  if (result != ERR_IO_PENDING) {
-    DCHECK(!user_read_callback_.is_null());
-    CompletionCallback c = user_read_callback_;
-    user_read_callback_.Reset();
-    user_read_buf_ = NULL;
-    user_read_buf_len_ = 0;
-    c.Run(result);
-  }
-}
-
-void SSLClientSocketWin::OnWriteComplete(int result) {
-  DCHECK(completed_handshake());
-
-  int rv = DoPayloadWriteComplete(result);
-  if (rv != ERR_IO_PENDING) {
-    DCHECK(!user_write_callback_.is_null());
-    CompletionCallback c = user_write_callback_;
-    user_write_callback_.Reset();
-    user_write_buf_ = NULL;
-    user_write_buf_len_ = 0;
-    c.Run(rv);
-  }
-}
-
-
-int SSLClientSocketWin::DoLoop(int last_io_result) {
-  DCHECK(next_state_ != STATE_NONE);
-  int rv = last_io_result;
-  do {
-    State state = next_state_;
-    next_state_ = STATE_NONE;
-    switch (state) {
-      case STATE_HANDSHAKE_READ:
-        rv = DoHandshakeRead();
-        break;
-      case STATE_HANDSHAKE_READ_COMPLETE:
-        rv = DoHandshakeReadComplete(rv);
-        break;
-      case STATE_HANDSHAKE_WRITE:
-        rv = DoHandshakeWrite();
-        break;
-      case STATE_HANDSHAKE_WRITE_COMPLETE:
-        rv = DoHandshakeWriteComplete(rv);
-        break;
-      case STATE_VERIFY_CERT:
-        rv = DoVerifyCert();
-        break;
-      case STATE_VERIFY_CERT_COMPLETE:
-        rv = DoVerifyCertComplete(rv);
-        break;
-      case STATE_COMPLETED_RENEGOTIATION:
-        rv = DoCompletedRenegotiation(rv);
-        break;
-      case STATE_COMPLETED_HANDSHAKE:
-        next_state_ = STATE_COMPLETED_HANDSHAKE;
-        // This is the end of our state machine, so return.
-        return rv;
-      default:
-        rv = ERR_UNEXPECTED;
-        LOG(DFATAL) << "unexpected state " << state;
-        break;
-    }
-  } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE);
-  return rv;
-}
-
-int SSLClientSocketWin::DoHandshakeRead() {
-  next_state_ = STATE_HANDSHAKE_READ_COMPLETE;
-
-  if (!recv_buffer_.get())
-    recv_buffer_.reset(new char[kRecvBufferSize]);
-
-  int buf_len = kRecvBufferSize - bytes_received_;
-
-  if (buf_len <= 0) {
-    LOG(DFATAL) << "Receive buffer is too small!";
-    return ERR_UNEXPECTED;
-  }
-
-  DCHECK(!transport_read_buf_);
-  transport_read_buf_ = new IOBuffer(buf_len);
-
-  return transport_->socket()->Read(
-      transport_read_buf_, buf_len,
-      base::Bind(&SSLClientSocketWin::OnHandshakeIOComplete,
-                 base::Unretained(this)));
-}
-
-int SSLClientSocketWin::DoHandshakeReadComplete(int result) {
-  if (result < 0) {
-    transport_read_buf_ = NULL;
-    return result;
-  }
-
-  if (transport_read_buf_) {
-    // A transition to STATE_HANDSHAKE_READ_COMPLETE is set in multiple places,
-    // not only in DoHandshakeRead(), so we may not have a transport_read_buf_.
-    DCHECK_LE(result, kRecvBufferSize - bytes_received_);
-    char* buf = recv_buffer_.get() + bytes_received_;
-    memcpy(buf, transport_read_buf_->data(), result);
-    transport_read_buf_ = NULL;
-  }
-
-  if (result == 0 && !ignore_ok_result_)
-    return ERR_SSL_PROTOCOL_ERROR;  // Incomplete response :(
-
-  ignore_ok_result_ = false;
-
-  bytes_received_ += result;
-
-  // Process the contents of recv_buffer_.
-  TimeStamp expiry;
-  DWORD out_flags;
-
-  DWORD flags = ISC_REQ_SEQUENCE_DETECT |
-                ISC_REQ_REPLAY_DETECT |
-                ISC_REQ_CONFIDENTIALITY |
-                ISC_RET_EXTENDED_ERROR |
-                ISC_REQ_ALLOCATE_MEMORY |
-                ISC_REQ_STREAM;
-
-  if (ssl_config_.send_client_cert)
-    flags |= ISC_REQ_USE_SUPPLIED_CREDS;
-
-  SecBufferDesc in_buffer_desc, out_buffer_desc;
-
-  in_buffer_desc.cBuffers = 2;
-  in_buffer_desc.pBuffers = in_buffers_;
-  in_buffer_desc.ulVersion = SECBUFFER_VERSION;
-
-  in_buffers_[0].pvBuffer = recv_buffer_.get();
-  in_buffers_[0].cbBuffer = bytes_received_;
-  in_buffers_[0].BufferType = SECBUFFER_TOKEN;
-
-  in_buffers_[1].pvBuffer = NULL;
-  in_buffers_[1].cbBuffer = 0;
-  in_buffers_[1].BufferType = SECBUFFER_EMPTY;
-
-  out_buffer_desc.cBuffers = 1;
-  out_buffer_desc.pBuffers = &send_buffer_;
-  out_buffer_desc.ulVersion = SECBUFFER_VERSION;
-
-  send_buffer_.pvBuffer = NULL;
-  send_buffer_.BufferType = SECBUFFER_TOKEN;
-  send_buffer_.cbBuffer = 0;
-
-  isc_status_ = InitializeSecurityContext(
-      creds_,
-      &ctxt_,
-      NULL,
-      flags,
-      0,
-      0,
-      &in_buffer_desc,
-      0,
-      NULL,
-      &out_buffer_desc,
-      &out_flags,
-      &expiry);
-
-  if (isc_status_ == SEC_E_INVALID_TOKEN) {
-    // Peer sent us an SSL record type that's invalid during SSL handshake.
-    // TODO(wtc): move this to MapSecurityError after sufficient testing.
-    LOG(ERROR) << "InitializeSecurityContext failed: " << isc_status_;
-    return ERR_SSL_PROTOCOL_ERROR;
-  }
-
-  if (send_buffer_.cbBuffer != 0 &&
-      (isc_status_ == SEC_E_OK ||
-       isc_status_ == SEC_I_CONTINUE_NEEDED ||
-      (FAILED(isc_status_) && (out_flags & ISC_RET_EXTENDED_ERROR)))) {
-    next_state_ = STATE_HANDSHAKE_WRITE;
-    return OK;
-  }
-  return DidCallInitializeSecurityContext();
-}
-
-int SSLClientSocketWin::DidCallInitializeSecurityContext() {
-  if (isc_status_ == SEC_E_INCOMPLETE_MESSAGE) {
-    next_state_ = STATE_HANDSHAKE_READ;
-    return OK;
-  }
-
-  if (isc_status_ == SEC_E_OK) {
-    if (in_buffers_[1].BufferType == SECBUFFER_EXTRA) {
-      // Save this data for later.
-      memmove(recv_buffer_.get(),
-              recv_buffer_.get() + (bytes_received_ - in_buffers_[1].cbBuffer),
-              in_buffers_[1].cbBuffer);
-      bytes_received_ = in_buffers_[1].cbBuffer;
-    } else {
-      bytes_received_ = 0;
-    }
-    return DidCompleteHandshake();
-  }
-
-  if (FAILED(isc_status_)) {
-    LOG(ERROR) << "InitializeSecurityContext failed: " << isc_status_;
-    if (isc_status_ == SEC_E_INTERNAL_ERROR) {
-      // "The Local Security Authority cannot be contacted".  This happens
-      // when the user denies access to the private key for SSL client auth.
-      return ERR_SSL_CLIENT_AUTH_PRIVATE_KEY_ACCESS_DENIED;
-    }
-    int result = MapSecurityError(isc_status_);
-    // We told Schannel to not verify the server certificate
-    // (SCH_CRED_MANUAL_CRED_VALIDATION), so any certificate error returned by
-    // InitializeSecurityContext must be referring to the bad or missing
-    // client certificate.
-    if (IsCertificateError(result)) {
-      // TODO(wtc): Add fine-grained error codes for client certificate errors
-      // reported by the server using the following SSL/TLS alert messages:
-      //   access_denied
-      //   bad_certificate
-      //   unsupported_certificate
-      //   certificate_expired
-      //   certificate_revoked
-      //   certificate_unknown
-      //   unknown_ca
-      return ERR_BAD_SSL_CLIENT_AUTH_CERT;
-    }
-    return result;
-  }
-
-  if (isc_status_ == SEC_I_INCOMPLETE_CREDENTIALS)
-    return ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
-
-  if (isc_status_ == SEC_I_NO_RENEGOTIATION) {
-    // Received a no_renegotiation alert message.  Although this is just a
-    // warning, SChannel doesn't seem to allow us to continue after this
-    // point, so we have to return an error.  See http://crbug.com/36835.
-    return ERR_SSL_NO_RENEGOTIATION;
-  }
-
-  DCHECK(isc_status_ == SEC_I_CONTINUE_NEEDED);
-  if (in_buffers_[1].BufferType == SECBUFFER_EXTRA) {
-    memmove(recv_buffer_.get(),
-            recv_buffer_.get() + (bytes_received_ - in_buffers_[1].cbBuffer),
-            in_buffers_[1].cbBuffer);
-    bytes_received_ = in_buffers_[1].cbBuffer;
-    next_state_ = STATE_HANDSHAKE_READ_COMPLETE;
-    ignore_ok_result_ = true;  // OK doesn't mean EOF.
-    return OK;
-  }
-
-  bytes_received_ = 0;
-  next_state_ = STATE_HANDSHAKE_READ;
-  return OK;
-}
-
-int SSLClientSocketWin::DoHandshakeWrite() {
-  next_state_ = STATE_HANDSHAKE_WRITE_COMPLETE;
-
-  // We should have something to send.
-  DCHECK(send_buffer_.pvBuffer);
-  DCHECK(send_buffer_.cbBuffer > 0);
-  DCHECK(!transport_write_buf_);
-
-  const char* buf = static_cast<char*>(send_buffer_.pvBuffer) + bytes_sent_;
-  int buf_len = send_buffer_.cbBuffer - bytes_sent_;
-  transport_write_buf_ = new IOBuffer(buf_len);
-  memcpy(transport_write_buf_->data(), buf, buf_len);
-
-  return transport_->socket()->Write(
-      transport_write_buf_, buf_len,
-      base::Bind(&SSLClientSocketWin::OnHandshakeIOComplete,
-                 base::Unretained(this)));
-}
-
-int SSLClientSocketWin::DoHandshakeWriteComplete(int result) {
-  DCHECK(transport_write_buf_);
-  transport_write_buf_ = NULL;
-  if (result < 0)
-    return result;
-
-  DCHECK(result != 0);
-
-  bytes_sent_ += result;
-  DCHECK(bytes_sent_ <= static_cast<int>(send_buffer_.cbBuffer));
-
-  if (bytes_sent_ >= static_cast<int>(send_buffer_.cbBuffer)) {
-    bool overflow = (bytes_sent_ > static_cast<int>(send_buffer_.cbBuffer));
-    FreeSendBuffer();
-    bytes_sent_ = 0;
-    if (overflow) {  // Bug!
-      LOG(DFATAL) << "overflow";
-      return ERR_UNEXPECTED;
-    }
-    if (writing_first_token_) {
-      writing_first_token_ = false;
-      DCHECK(bytes_received_ == 0);
-      next_state_ = STATE_HANDSHAKE_READ;
-      return OK;
-    }
-    return DidCallInitializeSecurityContext();
-  }
-
-  // Send the remaining bytes.
-  next_state_ = STATE_HANDSHAKE_WRITE;
-  return OK;
-}
-
-// Set server_cert_status_ and return OK or a network error.
-int SSLClientSocketWin::DoVerifyCert() {
-  next_state_ = STATE_VERIFY_CERT_COMPLETE;
-
-  DCHECK(server_cert_);
-  CertStatus cert_status;
-  if (ssl_config_.IsAllowedBadCert(server_cert_, &cert_status)) {
-    VLOG(1) << "Received an expected bad cert with status: " << cert_status;
-    server_cert_verify_result_.Reset();
-    server_cert_verify_result_.cert_status = cert_status;
-    server_cert_verify_result_.verified_cert = server_cert_;
-    return OK;
-  }
-
-  int flags = 0;
-  if (ssl_config_.rev_checking_enabled)
-    flags |= CertVerifier::VERIFY_REV_CHECKING_ENABLED;
-  if (ssl_config_.verify_ev_cert)
-    flags |= CertVerifier::VERIFY_EV_CERT;
-  if (ssl_config_.cert_io_enabled)
-    flags |= CertVerifier::VERIFY_CERT_IO_ENABLED;
-  verifier_.reset(new SingleRequestCertVerifier(cert_verifier_));
-  return verifier_->Verify(
-      server_cert_, host_and_port_.host(), flags,
-      NULL /* no CRL set */,
-      &server_cert_verify_result_,
-      base::Bind(&SSLClientSocketWin::OnHandshakeIOComplete,
-                 base::Unretained(this)),
-      net_log_);
-}
-
-int SSLClientSocketWin::DoVerifyCertComplete(int result) {
-  DCHECK(verifier_.get());
-  verifier_.reset();
-
-  if (result == OK)
-    LogConnectionTypeMetrics();
-  if (renegotiating_) {
-    DidCompleteRenegotiation();
-    return result;
-  }
-
-  // The initial handshake has completed.
-  next_state_ = STATE_COMPLETED_HANDSHAKE;
-  return result;
-}
-
-int SSLClientSocketWin::DoPayloadRead() {
-  DCHECK(recv_buffer_.get());
-
-  int buf_len = kRecvBufferSize - bytes_received_;
-
-  if (buf_len <= 0) {
-    NOTREACHED() << "Receive buffer is too small!";
-    return ERR_FAILED;
-  }
-
-  int rv;
-  // If bytes_received_, we have some data from a previous read still ready
-  // for decoding.  Otherwise, we need to issue a real read.
-  if (!bytes_received_ || need_more_data_) {
-    DCHECK(!transport_read_buf_);
-    transport_read_buf_ = new IOBuffer(buf_len);
-
-    rv = transport_->socket()->Read(
-        transport_read_buf_, buf_len,
-        base::Bind(&SSLClientSocketWin::OnReadComplete,
-                   base::Unretained(this)));
-    if (rv != ERR_IO_PENDING)
-      rv = DoPayloadReadComplete(rv);
-    if (rv <= 0)
-      return rv;
-  }
-
-  // Decode what we've read.  If there is not enough data to decode yet,
-  // this may return ERR_IO_PENDING still.
-  return DoPayloadDecrypt();
-}
-
-// result is the number of bytes that have been read; it should not be
-// less than zero; a value of zero means that no additional bytes have
-// been read.
-int SSLClientSocketWin::DoPayloadReadComplete(int result) {
-  DCHECK(completed_handshake());
-
-  // If IO Pending, there is nothing to do here.
-  if (result == ERR_IO_PENDING)
-    return result;
-
-  // We completed a Read, so reset the need_more_data_ flag.
-  need_more_data_ = false;
-
-  // Check for error
-  if (result <= 0) {
-    transport_read_buf_ = NULL;
-    if (result == 0 && bytes_received_ != 0) {
-      // TODO(wtc): Unless we have received the close_notify alert, we need
-      // to return an error code indicating that the SSL connection ended
-      // uncleanly, a potential truncation attack.  See
-      // http://crbug.com/18586.
-      return ERR_SSL_PROTOCOL_ERROR;
-    }
-    return result;
-  }
-
-  // Transfer the data from transport_read_buf_ to recv_buffer_.
-  if (transport_read_buf_) {
-    DCHECK_LE(result, kRecvBufferSize - bytes_received_);
-    char* buf = recv_buffer_.get() + bytes_received_;
-    memcpy(buf, transport_read_buf_->data(), result);
-    transport_read_buf_ = NULL;
-  }
-
-  bytes_received_ += result;
-
-  return result;
-}
-
-int SSLClientSocketWin::DoPayloadDecrypt() {
-  // Process the contents of recv_buffer_.
-  int len = 0;  // the number of bytes we've copied to the user buffer.
-  while (bytes_received_) {
-    SecBuffer buffers[4];
-    buffers[0].pvBuffer = recv_buffer_.get();
-    buffers[0].cbBuffer = bytes_received_;
-    buffers[0].BufferType = SECBUFFER_DATA;
-
-    buffers[1].BufferType = SECBUFFER_EMPTY;
-    buffers[2].BufferType = SECBUFFER_EMPTY;
-    buffers[3].BufferType = SECBUFFER_EMPTY;
-
-    SecBufferDesc buffer_desc;
-    buffer_desc.cBuffers = 4;
-    buffer_desc.pBuffers = buffers;
-    buffer_desc.ulVersion = SECBUFFER_VERSION;
-
-    SECURITY_STATUS status;
-    status = DecryptMessage(&ctxt_, &buffer_desc, 0, NULL);
-
-    if (status == SEC_E_INCOMPLETE_MESSAGE) {
-      need_more_data_ = true;
-      return DoPayloadRead();
-    }
-
-    if (status == SEC_I_CONTEXT_EXPIRED) {
-      // Received the close_notify alert.
-      bytes_received_ = 0;
-      return OK;
-    }
-
-    if (status != SEC_E_OK && status != SEC_I_RENEGOTIATE) {
-      DCHECK(status != SEC_E_MESSAGE_ALTERED);
-      LOG(ERROR) << "DecryptMessage failed: " << status;
-      return MapSecurityError(status);
-    }
-
-    // The received ciphertext was decrypted in place in recv_buffer_.  Remember
-    // the location and length of the decrypted plaintext and any unused
-    // ciphertext.
-    decrypted_ptr_ = NULL;
-    bytes_decrypted_ = 0;
-    received_ptr_ = NULL;
-    bytes_received_ = 0;
-    for (int i = 1; i < 4; i++) {
-      switch (buffers[i].BufferType) {
-        case SECBUFFER_DATA:
-          DCHECK(!decrypted_ptr_ && bytes_decrypted_ == 0);
-          decrypted_ptr_ = static_cast<char*>(buffers[i].pvBuffer);
-          bytes_decrypted_ = buffers[i].cbBuffer;
-          break;
-        case SECBUFFER_EXTRA:
-          DCHECK(!received_ptr_ && bytes_received_ == 0);
-          received_ptr_ = static_cast<char*>(buffers[i].pvBuffer);
-          bytes_received_ = buffers[i].cbBuffer;
-          break;
-        default:
-          break;
-      }
-    }
-
-    DCHECK(len == 0);
-    if (bytes_decrypted_ != 0) {
-      len = std::min(user_read_buf_len_, bytes_decrypted_);
-      memcpy(user_read_buf_->data(), decrypted_ptr_, len);
-      decrypted_ptr_ += len;
-      bytes_decrypted_ -= len;
-    }
-    if (bytes_decrypted_ == 0) {
-      decrypted_ptr_ = NULL;
-      if (bytes_received_ != 0) {
-        memmove(recv_buffer_.get(), received_ptr_, bytes_received_);
-        received_ptr_ = recv_buffer_.get();
-      }
-    }
-
-    if (status == SEC_I_RENEGOTIATE) {
-      if (bytes_received_ != 0) {
-        // The server requested renegotiation, but there are some data yet to
-        // be decrypted.  The Platform SDK WebClient.c sample doesn't handle
-        // this, so we don't know how to handle this.  Assume this cannot
-        // happen.
-        LOG(ERROR) << "DecryptMessage returned SEC_I_RENEGOTIATE with a buffer "
-                   << "of type SECBUFFER_EXTRA.";
-        return ERR_SSL_RENEGOTIATION_REQUESTED;
-      }
-      if (len != 0) {
-        // The server requested renegotiation, but there are some decrypted
-        // data.  We can't start renegotiation until we have returned all
-        // decrypted data to the caller.
-        //
-        // This hasn't happened during testing.  Assume this cannot happen even
-        // though we know how to handle this.
-        LOG(ERROR) << "DecryptMessage returned SEC_I_RENEGOTIATE with a buffer "
-                   << "of type SECBUFFER_DATA.";
-        return ERR_SSL_RENEGOTIATION_REQUESTED;
-      }
-      // Jump to the handshake sequence.  Will come back when the rehandshake is
-      // done.
-      renegotiating_ = true;
-      ignore_ok_result_ = true;  // OK doesn't mean EOF.
-      // If renegotiation handshake occurred, we need to go back into the
-      // handshake state machine.
-      next_state_ = STATE_HANDSHAKE_READ_COMPLETE;
-      return DoLoop(OK);
-    }
-
-    // We've already copied data into the user buffer, so quit now.
-    // TODO(mbelshe): We really should keep decoding as long as we can.  This
-    // break out is causing us to return pretty small chunks of data up to the
-    // application, even though more is already buffered and ready to be
-    // decoded.
-    if (len)
-      break;
-  }
-
-  // If we decrypted 0 bytes, don't report 0 bytes read, which would be
-  // mistaken for EOF.  Continue decrypting or read more.
-  if (len == 0)
-    return DoPayloadRead();
-  net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_RECEIVED, len,
-                                user_read_buf_->data());
-  return len;
-}
-
-int SSLClientSocketWin::DoPayloadEncrypt() {
-  DCHECK(completed_handshake());
-  DCHECK(user_write_buf_);
-  DCHECK(user_write_buf_len_ > 0);
-
-  ULONG message_len = std::min(
-      stream_sizes_.cbMaximumMessage, static_cast<ULONG>(user_write_buf_len_));
-  ULONG alloc_len =
-      message_len + stream_sizes_.cbHeader + stream_sizes_.cbTrailer;
-  user_write_buf_len_ = message_len;
-
-  payload_send_buffer_.reset(new char[alloc_len]);
-  memcpy(&payload_send_buffer_[stream_sizes_.cbHeader],
-         user_write_buf_->data(), message_len);
-  net_log_.AddByteTransferEvent(NetLog::TYPE_SSL_SOCKET_BYTES_SENT, message_len,
-                                user_write_buf_->data());
-
-  SecBuffer buffers[4];
-  buffers[0].pvBuffer = payload_send_buffer_.get();
-  buffers[0].cbBuffer = stream_sizes_.cbHeader;
-  buffers[0].BufferType = SECBUFFER_STREAM_HEADER;
-
-  buffers[1].pvBuffer = &payload_send_buffer_[stream_sizes_.cbHeader];
-  buffers[1].cbBuffer = message_len;
-  buffers[1].BufferType = SECBUFFER_DATA;
-
-  buffers[2].pvBuffer = &payload_send_buffer_[stream_sizes_.cbHeader +
-                                              message_len];
-  buffers[2].cbBuffer = stream_sizes_.cbTrailer;
-  buffers[2].BufferType = SECBUFFER_STREAM_TRAILER;
-
-  buffers[3].BufferType = SECBUFFER_EMPTY;
-
-  SecBufferDesc buffer_desc;
-  buffer_desc.cBuffers = 4;
-  buffer_desc.pBuffers = buffers;
-  buffer_desc.ulVersion = SECBUFFER_VERSION;
-
-  SECURITY_STATUS status = EncryptMessage(&ctxt_, 0, &buffer_desc, 0);
-
-  if (FAILED(status)) {
-    LOG(ERROR) << "EncryptMessage failed: " << status;
-    return MapSecurityError(status);
-  }
-
-  payload_send_buffer_len_ = buffers[0].cbBuffer +
-                             buffers[1].cbBuffer +
-                             buffers[2].cbBuffer;
-  DCHECK(bytes_sent_ == 0);
-  return OK;
-}
-
-int SSLClientSocketWin::DoPayloadWrite() {
-  DCHECK(completed_handshake());
-
-  // We should have something to send.
-  DCHECK(payload_send_buffer_.get());
-  DCHECK(payload_send_buffer_len_ > 0);
-  DCHECK(!transport_write_buf_);
-
-  const char* buf = payload_send_buffer_.get() + bytes_sent_;
-  int buf_len = payload_send_buffer_len_ - bytes_sent_;
-  transport_write_buf_ = new IOBuffer(buf_len);
-  memcpy(transport_write_buf_->data(), buf, buf_len);
-
-  int rv = transport_->socket()->Write(
-      transport_write_buf_, buf_len,
-      base::Bind(&SSLClientSocketWin::OnWriteComplete,
-                 base::Unretained(this)));
-  if (rv != ERR_IO_PENDING)
-    rv = DoPayloadWriteComplete(rv);
-  return rv;
-}
-
-int SSLClientSocketWin::DoPayloadWriteComplete(int result) {
-  DCHECK(transport_write_buf_);
-  transport_write_buf_ = NULL;
-  if (result < 0)
-    return result;
-
-  DCHECK(result != 0);
-
-  bytes_sent_ += result;
-  DCHECK(bytes_sent_ <= payload_send_buffer_len_);
-
-  if (bytes_sent_ >= payload_send_buffer_len_) {
-    bool overflow = (bytes_sent_ > payload_send_buffer_len_);
-    payload_send_buffer_.reset();
-    payload_send_buffer_len_ = 0;
-    bytes_sent_ = 0;
-    if (overflow) {  // Bug!
-      LOG(DFATAL) << "overflow";
-      return ERR_UNEXPECTED;
-    }
-    // Done
-    return user_write_buf_len_;
-  }
-
-  // Send the remaining bytes.
-  return DoPayloadWrite();
-}
-
-int SSLClientSocketWin::DoCompletedRenegotiation(int result) {
-  // The user had a read in progress, which was usurped by the renegotiation.
-  // Restart the read sequence.
-  next_state_ = STATE_COMPLETED_HANDSHAKE;
-  if (result != OK)
-    return result;
-  return DoPayloadRead();
-}
-
-int SSLClientSocketWin::DidCompleteHandshake() {
-  SECURITY_STATUS status = QueryContextAttributes(
-      &ctxt_, SECPKG_ATTR_STREAM_SIZES, &stream_sizes_);
-  if (status != SEC_E_OK) {
-    LOG(ERROR) << "QueryContextAttributes (stream sizes) failed: " << status;
-    return MapSecurityError(status);
-  }
-  DCHECK(!server_cert_ || renegotiating_);
-  PCCERT_CONTEXT server_cert_handle = NULL;
-  status = QueryContextAttributes(
-      &ctxt_, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &server_cert_handle);
-  if (status != SEC_E_OK) {
-    LOG(ERROR) << "QueryContextAttributes (remote cert) failed: " << status;
-    return MapSecurityError(status);
-  }
-
-  X509Certificate::OSCertHandles intermediates;
-  PCCERT_CONTEXT intermediate = NULL;
-  // In testing, enumerating the store returned from SChannel appears to
-  // enumerate certificates in reverse of the order they were added, meaning
-  // that issuer certificates appear before the subject certificates. This is
-  // likely because the default Windows memory store is implemented as a
-  // linked-list. Reverse the list, so that intermediates are ordered from
-  // subject to issuer.
-  // Note that the store also includes the end-entity (server) certificate,
-  // so exclude this certificate from the set of |intermediates|.
-  while ((intermediate = CertEnumCertificatesInStore(
-              server_cert_handle->hCertStore, intermediate))) {
-    if (!X509Certificate::IsSameOSCert(server_cert_handle, intermediate))
-      intermediates.push_back(CertDuplicateCertificateContext(intermediate));
-  }
-  std::reverse(intermediates.begin(), intermediates.end());
-
-  scoped_refptr<X509Certificate> new_server_cert(
-      X509Certificate::CreateFromHandle(server_cert_handle, intermediates));
-  net_log_.AddEvent(
-      NetLog::TYPE_SSL_CERTIFICATES_RECEIVED,
-      base::Bind(&NetLogX509CertificateCallback,
-                 base::Unretained(new_server_cert.get())));
-  if (renegotiating_ && IsCertificateChainIdentical(server_cert_,
-                                                    new_server_cert)) {
-    // We already verified the server certificate.  Either it is good or the
-    // user has accepted the certificate error.
-    DidCompleteRenegotiation();
-  } else {
-    server_cert_ = new_server_cert;
-    next_state_ = STATE_VERIFY_CERT;
-  }
-  CertFreeCertificateContext(server_cert_handle);
-  for (size_t i = 0; i < intermediates.size(); ++i)
-    CertFreeCertificateContext(intermediates[i]);
-  return OK;
-}
-
-// Called when a renegotiation is completed.  |result| is the verification
-// result of the server certificate received during renegotiation.
-void SSLClientSocketWin::DidCompleteRenegotiation() {
-  DCHECK(user_connect_callback_.is_null());
-  DCHECK(!user_read_callback_.is_null());
-  renegotiating_ = false;
-  next_state_ = STATE_COMPLETED_RENEGOTIATION;
-}
-
-void SSLClientSocketWin::LogConnectionTypeMetrics() const {
-  UpdateConnectionTypeHistograms(CONNECTION_SSL);
-  if (server_cert_verify_result_.has_md5)
-    UpdateConnectionTypeHistograms(CONNECTION_SSL_MD5);
-  if (server_cert_verify_result_.has_md2)
-    UpdateConnectionTypeHistograms(CONNECTION_SSL_MD2);
-  if (server_cert_verify_result_.has_md4)
-    UpdateConnectionTypeHistograms(CONNECTION_SSL_MD4);
-  if (server_cert_verify_result_.has_md5_ca)
-    UpdateConnectionTypeHistograms(CONNECTION_SSL_MD5_CA);
-  if (server_cert_verify_result_.has_md2_ca)
-    UpdateConnectionTypeHistograms(CONNECTION_SSL_MD2_CA);
-}
-
-void SSLClientSocketWin::FreeSendBuffer() {
-  SECURITY_STATUS status = FreeContextBuffer(send_buffer_.pvBuffer);
-  DCHECK(status == SEC_E_OK);
-  memset(&send_buffer_, 0, sizeof(send_buffer_));
-}
-
-}  // namespace net
diff --git a/net/socket/ssl_client_socket_win.h b/net/socket/ssl_client_socket_win.h
deleted file mode 100644
index 0877cbc..0000000
--- a/net/socket/ssl_client_socket_win.h
+++ /dev/null
@@ -1,213 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef NET_SOCKET_SSL_CLIENT_SOCKET_WIN_H_
-#define NET_SOCKET_SSL_CLIENT_SOCKET_WIN_H_
-
-#define SECURITY_WIN32  // Needs to be defined before including security.h
-
-#include <windows.h>
-#include <wincrypt.h>
-#include <security.h>
-
-#include <string>
-
-#include "base/memory/scoped_ptr.h"
-#include "net/base/cert_verify_result.h"
-#include "net/base/completion_callback.h"
-#include "net/base/host_port_pair.h"
-#include "net/base/net_log.h"
-#include "net/base/ssl_config_service.h"
-#include "net/socket/ssl_client_socket.h"
-
-namespace net {
-
-class BoundNetLog;
-class CertVerifier;
-class ClientSocketHandle;
-class HostPortPair;
-class SingleRequestCertVerifier;
-
-// An SSL client socket implemented with the Windows Schannel.
-class SSLClientSocketWin : public SSLClientSocket {
- public:
-  // Takes ownership of the |transport_socket|, which must already be connected.
-  // The hostname specified in |host_and_port| will be compared with the name(s)
-  // in the server's certificate during the SSL handshake.  If SSL client
-  // authentication is requested, the host_and_port field of SSLCertRequestInfo
-  // will be populated with |host_and_port|.  |ssl_config| specifies
-  // the SSL settings.
-  SSLClientSocketWin(ClientSocketHandle* transport_socket,
-                     const HostPortPair& host_and_port,
-                     const SSLConfig& ssl_config,
-                     const SSLClientSocketContext& context);
-  ~SSLClientSocketWin();
-
-  // SSLClientSocket implementation.
-  virtual void GetSSLCertRequestInfo(SSLCertRequestInfo* cert_request_info);
-  virtual NextProtoStatus GetNextProto(std::string* proto,
-                                       std::string* server_protos);
-  virtual ServerBoundCertService* GetServerBoundCertService() const OVERRIDE;
-
-  // SSLSocket implementation.
-  virtual int ExportKeyingMaterial(const base::StringPiece& label,
-                                   bool has_context,
-                                   const base::StringPiece& context,
-                                   unsigned char* out,
-                                   unsigned int outlen);
-  virtual int GetTLSUniqueChannelBinding(std::string* out) OVERRIDE;
-
-  // StreamSocket implementation.
-  virtual int Connect(const CompletionCallback& callback) OVERRIDE;
-  virtual void Disconnect() OVERRIDE;
-  virtual bool IsConnected() const OVERRIDE;
-  virtual bool IsConnectedAndIdle() const OVERRIDE;
-  virtual int GetPeerAddress(IPEndPoint* address) const OVERRIDE;
-  virtual int GetLocalAddress(IPEndPoint* address) const OVERRIDE;
-  virtual const BoundNetLog& NetLog() const  OVERRIDE{ return net_log_; }
-  virtual void SetSubresourceSpeculation() OVERRIDE;
-  virtual void SetOmniboxSpeculation() OVERRIDE;
-  virtual bool WasEverUsed() const OVERRIDE;
-  virtual bool UsingTCPFastOpen() const OVERRIDE;
-  virtual int64 NumBytesRead() const OVERRIDE;
-  virtual base::TimeDelta GetConnectTimeMicros() const OVERRIDE;
-  virtual bool GetSSLInfo(SSLInfo* ssl_info) OVERRIDE;
-
-  // Socket implementation.
-  virtual int Read(IOBuffer* buf, int buf_len,
-                   const CompletionCallback& callback) OVERRIDE;
-  virtual int Write(IOBuffer* buf, int buf_len,
-                    const CompletionCallback& callback) OVERRIDE;
-
-  virtual bool SetReceiveBufferSize(int32 size) OVERRIDE;
-  virtual bool SetSendBufferSize(int32 size) OVERRIDE;
-
- private:
-  bool completed_handshake() const {
-    return next_state_ == STATE_COMPLETED_HANDSHAKE;
-  }
-
-  // Initializes the SSL options and security context. Returns a net error code.
-  int InitializeSSLContext();
-
-  void OnHandshakeIOComplete(int result);
-  void OnReadComplete(int result);
-  void OnWriteComplete(int result);
-
-  int DoLoop(int last_io_result);
-  int DoHandshakeRead();
-  int DoHandshakeReadComplete(int result);
-  int DoHandshakeWrite();
-  int DoHandshakeWriteComplete(int result);
-  int DoVerifyCert();
-  int DoVerifyCertComplete(int result);
-
-  int DoPayloadRead();
-  int DoPayloadReadComplete(int result);
-  int DoPayloadDecrypt();
-  int DoPayloadEncrypt();
-  int DoPayloadWrite();
-  int DoPayloadWriteComplete(int result);
-  int DoCompletedRenegotiation(int result);
-
-  int DidCallInitializeSecurityContext();
-  int DidCompleteHandshake();
-  void DidCompleteRenegotiation();
-  void LogConnectionTypeMetrics() const;
-  void FreeSendBuffer();
-
-  scoped_ptr<ClientSocketHandle> transport_;
-  HostPortPair host_and_port_;
-  SSLConfig ssl_config_;
-
-  // User function to callback when the Connect() completes.
-  CompletionCallback user_connect_callback_;
-
-  // User function to callback when a Read() completes.
-  CompletionCallback user_read_callback_;
-  scoped_refptr<IOBuffer> user_read_buf_;
-  int user_read_buf_len_;
-
-  // User function to callback when a Write() completes.
-  CompletionCallback user_write_callback_;
-  scoped_refptr<IOBuffer> user_write_buf_;
-  int user_write_buf_len_;
-
-  // Used to Read and Write using transport_.
-  scoped_refptr<IOBuffer> transport_read_buf_;
-  scoped_refptr<IOBuffer> transport_write_buf_;
-
-  enum State {
-    STATE_NONE,
-    STATE_HANDSHAKE_READ,
-    STATE_HANDSHAKE_READ_COMPLETE,
-    STATE_HANDSHAKE_WRITE,
-    STATE_HANDSHAKE_WRITE_COMPLETE,
-    STATE_VERIFY_CERT,
-    STATE_VERIFY_CERT_COMPLETE,
-    STATE_COMPLETED_RENEGOTIATION,
-    STATE_COMPLETED_HANDSHAKE
-    // After the handshake, the socket remains
-    // in the STATE_COMPLETED_HANDSHAKE state,
-    // unless a renegotiate handshake occurs.
-  };
-  State next_state_;
-
-  SecPkgContext_StreamSizes stream_sizes_;
-  scoped_refptr<X509Certificate> server_cert_;
-  CertVerifier* const cert_verifier_;
-  scoped_ptr<SingleRequestCertVerifier> verifier_;
-  CertVerifyResult server_cert_verify_result_;
-
-  CredHandle* creds_;
-  CtxtHandle ctxt_;
-  SecBuffer in_buffers_[2];  // Input buffers for InitializeSecurityContext.
-  SecBuffer send_buffer_;  // Output buffer for InitializeSecurityContext.
-  SECURITY_STATUS isc_status_;  // Return value of InitializeSecurityContext.
-  scoped_array<char> payload_send_buffer_;
-  int payload_send_buffer_len_;
-  int bytes_sent_;
-
-  // recv_buffer_ holds the received ciphertext.  Since Schannel decrypts
-  // data in place, sometimes recv_buffer_ may contain decrypted plaintext and
-  // any undecrypted ciphertext.  (Ciphertext is decrypted one full SSL record
-  // at a time.)
-  //
-  // If bytes_decrypted_ is 0, the received ciphertext is at the beginning of
-  // recv_buffer_, ready to be passed to DecryptMessage.
-  scoped_array<char> recv_buffer_;
-  char* decrypted_ptr_;  // Points to the decrypted plaintext in recv_buffer_
-  int bytes_decrypted_;  // The number of bytes of decrypted plaintext.
-  char* received_ptr_;  // Points to the received ciphertext in recv_buffer_
-  int bytes_received_;  // The number of bytes of received ciphertext.
-
-  // True if we're writing the first token (handshake message) to the server,
-  // false if we're writing a subsequent token.  After we have written a token
-  // successfully, DoHandshakeWriteComplete checks this member to set the next
-  // state.
-  bool writing_first_token_;
-
-  // Only used in the STATE_HANDSHAKE_READ_COMPLETE and
-  // STATE_PAYLOAD_READ_COMPLETE states.  True if a 'result' argument of OK
-  // should be ignored, to prevent it from being interpreted as EOF.
-  //
-  // The reason we need this flag is that OK means not only "0 bytes of data
-  // were read" but also EOF.  We set ignore_ok_result_ to true when we need
-  // to continue processing previously read data without reading more data.
-  // We have to pass a 'result' of OK to the DoLoop method, and don't want it
-  // to be interpreted as EOF.
-  bool ignore_ok_result_;
-
-  // Renegotiation is in progress.
-  bool renegotiating_;
-
-  // True when the decrypter needs more data in order to decrypt.
-  bool need_more_data_;
-
-  BoundNetLog net_log_;
-};
-
-}  // namespace net
-
-#endif  // NET_SOCKET_SSL_CLIENT_SOCKET_WIN_H_