Clear the SSL Client Auth cache when a new SSL Client Certificate is...

net/socket/client_socket_factory.cc

Index: net/socket/client_socket_factory.cc
===================================================================
--- net/socket/client_socket_factory.cc	(revision 74291)
+++ net/socket/client_socket_factory.cc	(working copy)
@@ -104,4 +104,29 @@
   g_ssl_factory = factory;
 }
 
+void ClientSocketFactory::DefaultClearSSLSessionCache() {
+#if defined(OS_WIN)
+  // no-op
+#elif defined(USE_OPENSSL)
+  // no-op
+#elif defined(USE_NSS)
+  return SSLClientSocketNSS::ClearSessionCache();
+#elif defined(OS_MACOSX)
+  return SSLClientSocketNSS::ClearSessionCache();

[wtc, 2011/02/15 20:50:40]

For OS_WIN and OS_MACOSX, this function should call
SSLClientSocketNSS::ClearSessionCache() by default.

The complication is that we support the --use-system-ssl
command-line option on these two platforms.  If --use-system-ssl
is specified, we won't use NSS for SSL.  It seems that
you are handling this.

[Ryan Hamilton, 2011/02/16 17:44:40]

You're right, of course.  However, I notice a very odd asymmetry between mac and
windows.  On both systems we use NSS by default (well, we use NSS by default
everywhere now).  However, the method DefaultSSLClientSocketFactory says:

#if defined(OS_WIN)
  return new SSLClientSocketWin(transport_socket, host_and_port, ssl_config,
                                cert_verifier);
...
#elif defined(OS_MACOSX)
  return new SSLClientSocketNSS(transport_socket, host_and_port, ssl_config,
                                shi.release(), cert_verifier, dns_cert_checker);
...

Then as a consequence, browser_main is similarly contorted:

browser_main_win.cc:

    if (!parsed_command_line().HasSwitch(switches::kUseSystemSSL)) {
      net::ClientSocketFactory::SetSSLClientSocketFactory(
          net::SSLClientSocketNSSFactory);

browser_main_mac.cc:

    if (parsed_command_line().HasSwitch(switches::kUseSystemSSL)) {
      net::ClientSocketFactory::SetSSLClientSocketFactory(
          net::SSLClientSocketMacFactory);

Notice that the predicates are reverse, as are the actions.
I propose that we make the following change.

* Modify DefaultSSLClientSocketFactory to return new SSLClientSocketNSS for win
(which is to say all cases except for openssl.  Out of curiosity, under what
circumstances to we use openssl?  Only if explicitly compiled to use it?)
* Modify browser_main_mac.cc and browser_main_win.cc to check for
--use-system-ssl and, if present, invoke: ClientSocketFactory::UseSystemSSL()

Does this work for you?

[wtc, 2011/02/23 01:17:34]

Yes.  The USE_OPENSSL build option is intended for the
Android browser.

+#else
+  NOTIMPLEMENTED();
+#endif
+}
+
+void (*g_clear_ssl_session_cache)() =
+    ClientSocketFactory::DefaultClearSSLSessionCache;
+
+void ClientSocketFactory::ClearSSLSessionCache() {
+  g_clear_ssl_session_cache();
+}
+
+void ClientSocketFactory::SetClearSSLSessionCache(void (*clear)()) {
+  g_clear_ssl_session_cache = clear;
+}
+
 }  // namespace net