Clear the SSL Client Auth cache when a new SSL Client Certificate is...

chrome/browser/renderer_host/x509_user_cert_resource_handler.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/x509_user_cert_resource_handler.h"
 
 #include "base/string_util.h"
 #include "chrome/browser/download/download_types.h"
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
 #include "chrome/browser/renderer_host/resource_dispatcher_host_request_info.h"
 #include "chrome/browser/ssl/ssl_add_cert_handler.h"
 #include "chrome/common/resource_response.h"
 #include "chrome/common/url_constants.h"
 #include "net/base/io_buffer.h"
 #include "net/base/mime_sniffer.h"
 #include "net/base/mime_util.h"
+#include "net/base/ssl_client_auth_cache.h"
 #include "net/base/x509_certificate.h"
+#include "net/http/http_network_session.h"
 #include "net/http/http_response_headers.h"
+#include "net/http/http_transaction_factory.h"
+#include "net/socket/client_socket_factory.h"
+#include "net/spdy/spdy_session_pool.h"
 #include "net/url_request/url_request.h"
+#include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_status.h"
 
 X509UserCertResourceHandler::X509UserCertResourceHandler(
     ResourceDispatcherHost* host, net::URLRequest* request,
     int render_process_host_id, int render_view_id)
     : host_(host),
       request_(request),
       content_length_(0),
       buffer_(new DownloadBuffer),
       read_buffer_(NULL),
@@ skipping 70 matching lines @@
 
   // TODO(gauravsh): Verify that 'request_id' was actually a keygen form post
   // and only then import the certificate.
   AssembleResource();
   scoped_refptr<net::X509Certificate> cert(
       net::X509Certificate::CreateFromBytes(resource_buffer_->data(),
                                             content_length_));
   // The handler will run the UI and delete itself when it's finished.
   new SSLAddCertHandler(request_, cert, render_process_host_id_,
                         render_view_id_);
+  // Force all new SSL connects to renegotiate, and hence use this new
+  // certificate if necessary.
+  if (request_->context()->http_transaction_factory()) {
+    net::HttpNetworkSession* session =
+        request_->context()->http_transaction_factory()->GetSession();

[wtc, 2011/02/15 20:50:40]

It seems bad to expose so much internals of HttpNetworkSession.

It seems better to add a method to http_transaction_factory()
or HttpNetworkSession to clear the relevant state.

Are you sure you want to flush socket pools and close SPDY
sessions?  It seems enough to just clear the SSL client
auth cache and the SSL session cache.

[Ryan Hamilton, 2011/02/16 17:44:40]

Sounds reasonable.  I move all this logic to a new method:
HttpNetworkSession::ResetSSLState.  (Though I wonder if
HandleNewClientCertificate or OnClientCertificateInstalled might be better?)
Yes.  The motivating example in a server which does optional SSL client auth. 
If it does not see a cert in the request, it 302s to a different server which
can issue a client certificate.  When that certificate is installed, the user
navigates back to the initial server and attempts to use the certificate.  If we
do not close the open connection to the initial server, the server will still
not see the new certificate, and will 302 back to the auth front end.

+    // Erase any mapping from host:port to client certificate.
+    session->ssl_client_auth_cache()->Clear();
+    // Clear any cached ssl sessions so that we do not resume with the old
+    // certificate.
+    net::ClientSocketFactory::ClearSSLSessionCache();
+    // Close all connections to force a reconnection.
+    session->FlushSocketPools();
+    session->spdy_session_pool()->CloseAllSessions();
+  }
   return true;
 }
 
 void X509UserCertResourceHandler::OnRequestClosed() {
 }
 
 X509UserCertResourceHandler::~X509UserCertResourceHandler() {
 }
 
 void X509UserCertResourceHandler::AssembleResource() {
   size_t bytes_copied = 0;
   resource_buffer_ = new net::IOBuffer(content_length_);
 
   for (size_t i = 0; i < buffer_->contents.size(); ++i) {
     net::IOBuffer* data = buffer_->contents[i].first;
     const int data_len = buffer_->contents[i].second;
     DCHECK(bytes_copied + data_len <= content_length_);
     memcpy(resource_buffer_->data() + bytes_copied, data->data(), data_len);
     bytes_copied += data_len;
   }
 }