Move client certificates retrieval logic out of the SSL sockets.

content/browser/loader/resource_loader.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/loader/resource_loader.h"
 
 #include "base/command_line.h"
 #include "base/message_loop.h"
 #include "base/time.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/loader/doomed_resource_handler.h"
 #include "content/browser/loader/resource_loader_delegate.h"
 #include "content/browser/loader/resource_request_info_impl.h"
 #include "content/browser/ssl/ssl_client_auth_handler.h"
 #include "content/browser/ssl/ssl_manager.h"
 #include "content/common/ssl_status_serialization.h"
 #include "content/public/browser/cert_store.h"
 #include "content/public/browser/resource_dispatcher_host_login_delegate.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/resource_response.h"
 #include "content/public/common/url_constants.h"
+#include "net/base/client_cert_store.h"
+#include "net/base/client_cert_store_impl.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_response_headers.h"
 #include "webkit/appcache/appcache_interceptor.h"
 
 using base::TimeDelta;
 using base::TimeTicks;
 
 namespace content {
 namespace {
 
@@ skipping 24 matching lines @@
 ResourceLoader::ResourceLoader(scoped_ptr<net::URLRequest> request,
                                scoped_ptr<ResourceHandler> handler,
                                ResourceLoaderDelegate* delegate)
     : deferred_stage_(DEFERRED_NONE),
       request_(request.Pass()),
       handler_(handler.Pass()),
       delegate_(delegate),
       last_upload_position_(0),
       waiting_for_upload_progress_ack_(false),
       is_transferring_(false),
+#if defined(USE_NSS) && !defined(OS_IOS)

[Ryan Sleevi, 2013/01/30 19:54:51]

This is the wrong use of the define. USE_NSS == "Use NSS for certificate
validation", not "Use NSS for crypto"

Pretty sure this conditional should be:
#if !defined(USE_OPENSSL)

[ppi, 2013/02/01 22:22:34]

Thanks! Fixed in patch set 6.

+      client_cert_store_(new net::ClientCertStoreImpl()),
+#endif
       weak_ptr_factory_(this) {
   request_->set_delegate(this);
   handler_->SetController(this);
 }
 
 ResourceLoader::~ResourceLoader() {
   if (login_delegate_)
     login_delegate_->OnRequestCancelled();
   if (ssl_client_auth_handler_)
     ssl_client_auth_handler_->OnRequestCancelled();
@@ skipping 184 matching lines @@
 void ResourceLoader::OnCertificateRequested(
     net::URLRequest* unused,
     net::SSLCertRequestInfo* cert_info) {
   DCHECK_EQ(request_.get(), unused);
 
   if (!delegate_->AcceptSSLClientCertificateRequest(this, cert_info)) {
     request_->Cancel();
     return;
   }
 
+#if defined(USE_NSS) && !defined(OS_IOS)
+  client_cert_store_->GetClientCerts(*cert_info, &cert_info->client_certs);
+#endif
+
   if (cert_info->client_certs.empty()) {
     // No need to query the user if there are no certs to choose from.
     request_->ContinueWithCertificate(NULL);
     return;
   }

[Ryan Sleevi, 2013/01/30 19:54:51]

Shouldn't the #endif cover up to here? because client_certs.empty() will always
be true for OpenSSL.

[ppi, 2013/02/01 22:22:34]

Definitely, thanks! Fixed in patch set 6.

 
   DCHECK(!ssl_client_auth_handler_) <<
       "OnCertificateRequested called with ssl_client_auth_handler pending";
   ssl_client_auth_handler_ = new SSLClientAuthHandler(request_.get(),
                                                       cert_info);
   ssl_client_auth_handler_->SelectCertificate();
 }
 
 void ResourceLoader::OnSSLCertificateError(net::URLRequest* request,
                                            const net::SSLInfo& ssl_info,
@@ skipping 332 matching lines @@
     // we resume.
     deferred_stage_ = DEFERRED_FINISH;
   }
 }
 
 void ResourceLoader::CallDidFinishLoading() {
   delegate_->DidFinishLoading(this);
 }
 
 }  // namespace content