Clear the SSL Client Auth cache when a new SSL Client Certificate is...

net/socket/client_socket_factory.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/client_socket_factory.h"
 
 #include "base/lazy_instance.h"
 #include "build/build_config.h"
 #include "net/socket/client_socket_handle.h"
 #if defined(OS_WIN)
@@ skipping 86 matching lines @@
 ClientSocketFactory* ClientSocketFactory::GetDefaultFactory() {
   return g_default_client_socket_factory.Pointer();
 }
 
 // static
 void ClientSocketFactory::SetSSLClientSocketFactory(
     SSLClientSocketFactory factory) {
   g_ssl_factory = factory;
 }
 
+void ClientSocketFactory::DefaultClearSSLSessionCache() {
+#if defined(OS_WIN)
+  // no-op
+#elif defined(USE_OPENSSL)
+  // no-op
+#elif defined(USE_NSS)
+  return SSLClientSocketNSS::ClearSessionCache();
+#elif defined(OS_MACOSX)
+  return SSLClientSocketNSS::ClearSessionCache();

[wtc, 2011/02/15 20:50:40]

For OS_WIN and OS_MACOSX, this function should call
SSLClientSocketNSS::ClearSessionCache() by default.

The complication is that we support the --use-system-ssl
command-line option on these two platforms.  If --use-system-ssl
is specified, we won't use NSS for SSL.  It seems that
you are handling this.

[Ryan Hamilton, 2011/02/16 17:44:40]

You're right, of course.  However, I notice a very odd asymmetry between mac and
windows.  On both systems we use NSS by default (well, we use NSS by default
everywhere now).  However, the method DefaultSSLClientSocketFactory says:

#if defined(OS_WIN)
  return new SSLClientSocketWin(transport_socket, host_and_port, ssl_config,
                                cert_verifier);
...
#elif defined(OS_MACOSX)
  return new SSLClientSocketNSS(transport_socket, host_and_port, ssl_config,
                                shi.release(), cert_verifier, dns_cert_checker);
...

Then as a consequence, browser_main is similarly contorted:

browser_main_win.cc:

    if (!parsed_command_line().HasSwitch(switches::kUseSystemSSL)) {
      net::ClientSocketFactory::SetSSLClientSocketFactory(
          net::SSLClientSocketNSSFactory);

browser_main_mac.cc:

    if (parsed_command_line().HasSwitch(switches::kUseSystemSSL)) {
      net::ClientSocketFactory::SetSSLClientSocketFactory(
          net::SSLClientSocketMacFactory);

Notice that the predicates are reverse, as are the actions.
I propose that we make the following change.

* Modify DefaultSSLClientSocketFactory to return new SSLClientSocketNSS for win
(which is to say all cases except for openssl.  Out of curiosity, under what
circumstances to we use openssl?  Only if explicitly compiled to use it?)
* Modify browser_main_mac.cc and browser_main_win.cc to check for
--use-system-ssl and, if present, invoke: ClientSocketFactory::UseSystemSSL()

Does this work for you?

[wtc, 2011/02/23 01:17:34]

Yes.  The USE_OPENSSL build option is intended for the
Android browser.

+#else
+  NOTIMPLEMENTED();
+#endif
+}
+
+void (*g_clear_ssl_session_cache)() =
+    ClientSocketFactory::DefaultClearSSLSessionCache;
+
+void ClientSocketFactory::ClearSSLSessionCache() {
+  g_clear_ssl_session_cache();
+}
+
+void ClientSocketFactory::SetClearSSLSessionCache(void (*clear)()) {
+  g_clear_ssl_session_cache = clear;
+}
+
 }  // namespace net