Clear the SSL Client Auth cache when a new SSL Client Certificate is...

chrome/browser/renderer_host/x509_user_cert_resource_handler.cc

Index: chrome/browser/renderer_host/x509_user_cert_resource_handler.cc
===================================================================
--- chrome/browser/renderer_host/x509_user_cert_resource_handler.cc	(revision 74291)
+++ chrome/browser/renderer_host/x509_user_cert_resource_handler.cc	(working copy)
@@ -14,9 +14,15 @@
 #include "net/base/io_buffer.h"
 #include "net/base/mime_sniffer.h"
 #include "net/base/mime_util.h"
+#include "net/base/ssl_client_auth_cache.h"
 #include "net/base/x509_certificate.h"
+#include "net/http/http_network_session.h"
 #include "net/http/http_response_headers.h"
+#include "net/http/http_transaction_factory.h"
+#include "net/socket/client_socket_factory.h"
+#include "net/spdy/spdy_session_pool.h"
 #include "net/url_request/url_request.h"
+#include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_status.h"
 
 X509UserCertResourceHandler::X509UserCertResourceHandler(
@@ -107,6 +113,20 @@
   // The handler will run the UI and delete itself when it's finished.
   new SSLAddCertHandler(request_, cert, render_process_host_id_,
                         render_view_id_);
+  // Force all new SSL connects to renegotiate, and hence use this new
+  // certificate if necessary.
+  if (request_->context()->http_transaction_factory()) {
+    net::HttpNetworkSession* session =
+        request_->context()->http_transaction_factory()->GetSession();

[wtc, 2011/02/15 20:50:40]

It seems bad to expose so much internals of HttpNetworkSession.

It seems better to add a method to http_transaction_factory()
or HttpNetworkSession to clear the relevant state.

Are you sure you want to flush socket pools and close SPDY
sessions?  It seems enough to just clear the SSL client
auth cache and the SSL session cache.

[Ryan Hamilton, 2011/02/16 17:44:40]

Sounds reasonable.  I move all this logic to a new method:
HttpNetworkSession::ResetSSLState.  (Though I wonder if
HandleNewClientCertificate or OnClientCertificateInstalled might be better?)
Yes.  The motivating example in a server which does optional SSL client auth. 
If it does not see a cert in the request, it 302s to a different server which
can issue a client certificate.  When that certificate is installed, the user
navigates back to the initial server and attempts to use the certificate.  If we
do not close the open connection to the initial server, the server will still
not see the new certificate, and will 302 back to the auth front end.

+    // Erase any mapping from host:port to client certificate.
+    session->ssl_client_auth_cache()->Clear();
+    // Clear any cached ssl sessions so that we do not resume with the old
+    // certificate.
+    net::ClientSocketFactory::ClearSSLSessionCache();
+    // Close all connections to force a reconnection.
+    session->FlushSocketPools();
+    session->spdy_session_pool()->CloseAllSessions();
+  }
   return true;
 }