Ensure the patched NSS libssl used on Win and Mac behaves the same as upstream when handling client…

Ensure the patched NSS libssl used on Win and Mac behaves the same as upstream when handling client auth

When configuring client auth callbacks, ensure that the modified libssl used
on Win/Mac behaves the same as a stock upstream libssl, in that the NSS
client auth callback function is called if it is set. The previous behaviour
was to only call the platform-specific client auth hook, but that relies on
applications being aware of the platform-specific client auth patch, which
is not desirable for WebRTC.

BUG=158504
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=167868

[Ryan Sleevi, 2012-11-14 00:41:15]

ekr: FYI while I test.
wtc: Not for review yet.

[Ryan Sleevi, 2012-11-14 03:23:24]

Confirmed client auth works on Win as normal
Confirmed client auth works with libjingle tests using libjingle checkout
(specifically, libjingle_p2p_unittest --gtest_filter=DtlsTransportChannelTest.*
with a manual uprev of the libjingle Chromium DEPS)
Confirmed non-client auth continues to work as expected (no cert sent)

wtc: For your review

[wtc, 2012-11-14 20:44:19]

Patch set 1 LGTM. Thanks.

https://codereview.chromium.org/11359197/diff/1/net/third_party/nss/ssl/ssl3c...
File net/third_party/nss/ssl/ssl3con.c (right):

https://codereview.chromium.org/11359197/diff/1/net/third_party/nss/ssl/ssl3c...
net/third_party/nss/ssl/ssl3con.c:6044: if (ss->getPlatformClientAuthData !=
NULL) {

We should add a comment for SSL_GetPlatformClientAuthDataHook
in ssl.h to point out that the SSLGetPlatformClientAuthData
function, if set, will suppress the SSLGetClientAuthData
function.

https://codereview.chromium.org/11359197/diff/1/net/third_party/nss/ssl/ssl3c...
net/third_party/nss/ssl/ssl3con.c:6063: }

We should write an upstream NSS patch to change lines 6055-6063 to:

    if (ss->getClientAuthData != NULL) {
        /* XXX Should pass cert_types in this call!! */
        rv = (SECStatus)(*ss->getClientAuthData)(ss->getClientAuthDataArg,
        ...
    } else {
        rv = SECFailure; /* force it to send a no_certificate alert */
    }

Then the logic of this if-else-if-else statement will be
clearer.

[commit-bot: I haz the power, 2012-11-15 02:34:38]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rsleevi@chromium.org/11359197/3016

[commit-bot: I haz the power, 2012-11-15 05:37:20]

Change committed as 167868