Allow the SSL session cache on Win/Mac to be used even after a client cert key is removed

net/third_party/nss/ssl/ssl3con.c

 /*
  * SSL3 Protocol
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 1994 matching lines @@
     if (rv != SECSuccess) {
         rv = SECFailure;
         ssl_MapLowLevelError(SSL_ERROR_MAC_COMPUTATION_FAILURE);
     }
     return rv;
 }
 
 static PRBool
 ssl3_ClientAuthTokenPresent(sslSessionID *sid) {
 #ifdef NSS_PLATFORM_CLIENT_AUTH
-    if (!sid || !sid->u.ssl3.clPlatformAuthValid) {
-        return PR_TRUE;
-    }
-    return ssl_PlatformAuthTokenPresent(&sid->u.ssl3.clPlatformAuthInfo);
+    return PR_TRUE;

[wtc, 2011/02/06 03:02:31]

It would be nice to document the consequence of returning
PR_TRUE without checking.  You can just copy a concise summary
of the CL's description.

[wtc, 2011/02/06 16:29:44]

rsleevi: thank you for looking up the NSS bug.  It reminded
me that NSS may have encountered and solved the same
performance problem, by polling a smart card no more often
than some fixed time interval.

If you're interested in implementing that solution, you may
keep the clPlatformAuthValid code, and just disable it here
in this function.

NSS has a convenient place (lib/pk11wrap layer) to implement
the smart card polling delay logic that can be shared by all
SSL connections.  Our platform client auth code doesn't have
such a central place yet.

 #else
     PK11SlotInfo *slot = NULL;
     PRBool isPresent = PR_TRUE;
 
     /* we only care if we are doing client auth */
     if (!sid || !sid->u.ssl3.clAuthValid) {
         return PR_TRUE;
     }
 
     /* get the slot */
     slot = SECMOD_LookupSlot(sid->u.ssl3.clAuthModuleID,
                              sid->u.ssl3.clAuthSlotID);
     if (slot == NULL ||
         !PK11_IsPresent(slot) ||

[wtc, 2011/02/06 16:34:13]

What I meant by the lib/pk11wrap layer of NSS is the
PK11_ functions, such as this PK11_IsPresent(slot) call
here.

It is possible that implementing the same solution for
platform client auth will change the code significantly,
and we might as will just remove the current
clPlatformAuthValid now.

         sid->u.ssl3.clAuthSeries     != PK11_GetSlotSeries(slot) ||
         sid->u.ssl3.clAuthSlotID     != PK11_GetSlotID(slot)     ||
         sid->u.ssl3.clAuthModuleID   != PK11_GetModuleID(slot)   ||
         (PK11_NeedLogin(slot) && !PK11_IsLoggedIn(slot, NULL))) {
         isPresent = PR_FALSE;
     } 
     if (slot) {
         PK11_FreeSlot(slot);
     }
     return isPresent;
@@ skipping 2787 matching lines @@
     rv = ssl3_ComputeHandshakeHashes(ss, ss->ssl3.pwSpec, &hashes, 0);
     ssl_ReleaseSpecReadLock(ss);
     if (rv != SECSuccess) {
         goto done;      /* err code was set by ssl3_ComputeHandshakeHashes */
     }
 
     isTLS = (PRBool)(ss->ssl3.pwSpec->version > SSL_LIBRARY_VERSION_3_0);
 #ifdef NSS_PLATFORM_CLIENT_AUTH
     rv = ssl3_PlatformSignHashes(&hashes, ss->ssl3.platformClientKey,
                                  &buf, isTLS);
-    if (rv == SECSuccess) {
-        sslSessionID * sid = ss->sec.ci.sid;
-        ssl_GetPlatformAuthInfoForKey(ss->ssl3.platformClientKey,
-                                      &sid->u.ssl3.clPlatformAuthInfo);
-        sid->u.ssl3.clPlatformAuthValid = PR_TRUE;
-    }
     ssl_FreePlatformKey(ss->ssl3.platformClientKey);
     ss->ssl3.platformClientKey = (PlatformKey)NULL;
 #else /* NSS_PLATFORM_CLIENT_AUTH */
     rv = ssl3_SignHashes(&hashes, ss->ssl3.clientPrivateKey, &buf, isTLS);
     if (rv == SECSuccess) {
         PK11SlotInfo * slot;
         sslSessionID * sid   = ss->sec.ci.sid;
 
         /* Remember the info about the slot that did the signing.
         ** Later, when doing an SSL restart handshake, verify this.
@@ skipping 5031 matching lines @@
 
     ss->ssl3.initialized = PR_FALSE;
 
     if (ss->ssl3.nextProto.data) {
         PORT_Free(ss->ssl3.nextProto.data);
         ss->ssl3.nextProto.data = NULL;
     }
 }
 
 /* End of ssl3con.c */