Clear the SSL Client Auth cache when a new SSL Client Certificate is...

content/browser/renderer_host/x509_user_cert_resource_handler.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/x509_user_cert_resource_handler.h"
 
 #include "base/string_util.h"
 #include "chrome/browser/download/download_types.h"
 #include "chrome/browser/ssl/ssl_add_cert_handler.h"
 #include "chrome/common/resource_response.h"
 #include "chrome/common/url_constants.h"
 #include "content/browser/renderer_host/resource_dispatcher_host.h"
 #include "content/browser/renderer_host/resource_dispatcher_host_request_info.h"
 #include "net/base/io_buffer.h"
 #include "net/base/mime_sniffer.h"
 #include "net/base/mime_util.h"
 #include "net/base/x509_certificate.h"
+#include "net/http/http_network_session.h"
 #include "net/http/http_response_headers.h"
+#include "net/http/http_transaction_factory.h"
 #include "net/url_request/url_request.h"
+#include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_status.h"
 
 X509UserCertResourceHandler::X509UserCertResourceHandler(
     ResourceDispatcherHost* host, net::URLRequest* request,
     int render_process_host_id, int render_view_id)
     : host_(host),
       request_(request),
       content_length_(0),
       buffer_(new DownloadBuffer),
       read_buffer_(NULL),
@@ skipping 70 matching lines @@
 
   // TODO(gauravsh): Verify that 'request_id' was actually a keygen form post
   // and only then import the certificate.
   AssembleResource();
   scoped_refptr<net::X509Certificate> cert(
       net::X509Certificate::CreateFromBytes(resource_buffer_->data(),
                                             content_length_));
   // The handler will run the UI and delete itself when it's finished.
   new SSLAddCertHandler(request_, cert, render_process_host_id_,
                         render_view_id_);
+  // Force all new SSL connects to renegotiate, and hence use this new
+  // certificate if necessary.
+  if (request_->context()->http_transaction_factory()) {
+    net::HttpNetworkSession* session =
+        request_->context()->http_transaction_factory()->GetSession();
+    session->ResetSSLState();

[wtc, 2011/02/23 00:38:38]

I think it's better to call session->ResetSSLState() (or
notify the CertDatabase observers as I suggest below) from
CertDatabase::AddUserCert().

The new SSLAddCertHandler call on line 111 above merely
starts the process to add the new cert, but it may fail.

+  }
   return true;
 }
 
 void X509UserCertResourceHandler::OnRequestClosed() {
 }
 
 X509UserCertResourceHandler::~X509UserCertResourceHandler() {
 }
 
 void X509UserCertResourceHandler::AssembleResource() {
   size_t bytes_copied = 0;
   resource_buffer_ = new net::IOBuffer(content_length_);
 
   for (size_t i = 0; i < buffer_->contents.size(); ++i) {
     net::IOBuffer* data = buffer_->contents[i].first;
     const int data_len = buffer_->contents[i].second;
     DCHECK(bytes_copied + data_len <= content_length_);
     memcpy(resource_buffer_->data() + bytes_copied, data->data(), data_len);
     bytes_copied += data_len;
   }
 }