Reintegrate certificate selection in HttpNetworkTransaction DoLoop

net/http/http_network_transaction.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include <set>
 #include <vector>
 
 #include "base/compiler_specific.h"
@@ skipping 424 matching lines @@
   pending_auth_target_ = HttpAuth::AUTH_PROXY;
 
   DoCallback(OK);
 }
 
 void HttpNetworkTransaction::OnNeedsClientAuth(
     const scoped_refptr<SSLCertRequestInfo>& cert_info) {
   DCHECK_EQ(STATE_INIT_STREAM_COMPLETE, next_state_);
 
   response_.cert_request_info = cert_info;
-  int result = HandleCertificateRequest(ERR_SSL_CLIENT_AUTH_CERT_NEEDED);
-  DoCallback(result);
+  OnIOComplete(ERR_SSL_CLIENT_AUTH_CERT_NEEDED);
 }
 
 HttpNetworkTransaction::~HttpNetworkTransaction() {
   if (stream_.get()) {
     HttpResponseHeaders* headers = GetResponseHeaders();
     // TODO(mbelshe): The stream_ should be able to compute whether or not the
     //                stream should be kept alive.  No reason to compute here
     //                and pass it in.
     bool keep_alive = next_state_ == STATE_NONE &&
                       stream_->IsResponseBodyComplete() &&
@@ skipping 115 matching lines @@
                                                  net_log_,
                                                  session_,
                                                  &stream_request_);
   return ERR_IO_PENDING;
 }
 
 int HttpNetworkTransaction::DoInitStreamComplete(int result) {
   if (result == OK) {
     next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN;
     DCHECK(stream_.get());
+  } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
+    result = HandleCertificateRequest(result);
   }
 
   // At this point we are done with the stream_request_.
   stream_request_ = NULL;
   return result;
 }
 
 int HttpNetworkTransaction::DoGenerateProxyAuthToken() {
   next_state_ = STATE_GENERATE_PROXY_AUTH_TOKEN_COMPLETE;
   if (!ShouldApplyProxyAuth())
@@ skipping 388 matching lines @@
   // There are two paths through which the server can request a certificate
   // from us.  The first is during the initial handshake, the second is
   // during SSL renegotiation.
   //
   // In both cases, we want to close the connection before proceeding.
   // We do this for two reasons:
   //   First, we don't want to keep the connection to the server hung for a
   //   long time while the user selects a certificate.
   //   Second, even if we did keep the connection open, NSS has a bug where
   //   restarting the handshake for ClientAuth is currently broken.
+  DCHECK_EQ(error, ERR_SSL_CLIENT_AUTH_CERT_NEEDED);
 
   if (stream_.get()) {
     // Since we already have a stream, we're being called as part of SSL
     // renegotiation.
     DCHECK(!stream_request_.get());
     stream_->Close(true);
     stream_.reset();
   }
 
   if (stream_request_.get()) {
     // The server is asking for a client certificate during the initial
     // handshake.
-    DCHECK_EQ(STATE_INIT_STREAM_COMPLETE, next_state_);
     stream_request_->Cancel();
     stream_request_ = NULL;
-    next_state_ = STATE_INIT_STREAM;
   }
 
   // If the user selected one of the certificate in client_certs for this
   // server before, use it automatically.
   X509Certificate* client_cert = session_->ssl_client_auth_cache()->
                                  Lookup(GetHostAndPort(request_->url));
   if (client_cert) {
     const std::vector<scoped_refptr<X509Certificate> >& client_certs =
         response_.cert_request_info->client_certs;
     for (size_t i = 0; i < client_certs.size(); ++i) {
       if (client_cert->fingerprint().Equals(client_certs[i]->fingerprint())) {
+        // TODO(davidben): Add a unit test which covers this path; we need to be
+        // able to send a legitimate certificate and also bypass/clear the
+        // SSL session cache.
         ssl_config_.client_cert = client_cert;
         ssl_config_.send_client_cert = true;
         next_state_ = STATE_INIT_STREAM;
         // Reset the other member variables.
         // Note: this is necessary only with SSL renegotiation.
         ResetStateForRestart();
         return OK;
       }
     }
   }
@@ skipping 155 matching lines @@
     default:
       return priority;
   }
 }
 
 
 
 #undef STATE_CASE
 
 }  // namespace net