Allow the SSL session cache on Win/Mac to be used even after a client cert key is removed

net/third_party/nss/ssl/ssl3con.c

Index: net/third_party/nss/ssl/ssl3con.c
diff --git a/net/third_party/nss/ssl/ssl3con.c b/net/third_party/nss/ssl/ssl3con.c
index f5c08800547f672f719672a433d8d04229b3d17a..6aaa88c9667aabb3dd03d87f5ea14f8cf153b76a 100644
--- a/net/third_party/nss/ssl/ssl3con.c
+++ b/net/third_party/nss/ssl/ssl3con.c
@@ -2012,10 +2012,7 @@ ssl3_ComputeRecordMAC(
 static PRBool
 ssl3_ClientAuthTokenPresent(sslSessionID *sid) {
 #ifdef NSS_PLATFORM_CLIENT_AUTH
-    if (!sid || !sid->u.ssl3.clPlatformAuthValid) {
-	return PR_TRUE;
-    }
-    return ssl_PlatformAuthTokenPresent(&sid->u.ssl3.clPlatformAuthInfo);
+    return PR_TRUE;

[wtc, 2011/02/06 03:02:31]

It would be nice to document the consequence of returning
PR_TRUE without checking.  You can just copy a concise summary
of the CL's description.

[wtc, 2011/02/06 16:29:44]

rsleevi: thank you for looking up the NSS bug.  It reminded
me that NSS may have encountered and solved the same
performance problem, by polling a smart card no more often
than some fixed time interval.

If you're interested in implementing that solution, you may
keep the clPlatformAuthValid code, and just disable it here
in this function.

NSS has a convenient place (lib/pk11wrap layer) to implement
the smart card polling delay logic that can be shared by all
SSL connections.  Our platform client auth code doesn't have
such a central place yet.

 #else
     PK11SlotInfo *slot = NULL;
     PRBool isPresent = PR_TRUE;
@@ -4837,12 +4834,6 @@ ssl3_SendCertificateVerify(sslSocket *ss)
 #ifdef NSS_PLATFORM_CLIENT_AUTH
     rv = ssl3_PlatformSignHashes(&hashes, ss->ssl3.platformClientKey,
                                  &buf, isTLS);
-    if (rv == SECSuccess) {
-        sslSessionID * sid = ss->sec.ci.sid;
-        ssl_GetPlatformAuthInfoForKey(ss->ssl3.platformClientKey,
-                                      &sid->u.ssl3.clPlatformAuthInfo);
-        sid->u.ssl3.clPlatformAuthValid = PR_TRUE;
-    }
     ssl_FreePlatformKey(ss->ssl3.platformClientKey);
     ss->ssl3.platformClientKey = (PlatformKey)NULL;
 #else /* NSS_PLATFORM_CLIENT_AUTH */