Move client certificates retrieval logic out of the SSL sockets.

content/browser/loader/resource_loader.cc

Index: content/browser/loader/resource_loader.cc
diff --git a/content/browser/loader/resource_loader.cc b/content/browser/loader/resource_loader.cc
index a45229ee70ec4df164d8686cd132b5e862d3ae64..6056d879bd46054b8eca6119ff068022901dab6c 100644
--- a/content/browser/loader/resource_loader.cc
+++ b/content/browser/loader/resource_loader.cc
@@ -21,6 +21,8 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/resource_response.h"
 #include "content/public/common/url_constants.h"
+#include "net/base/client_cert_store.h"
+#include "net/base/client_cert_store_impl.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_response_headers.h"
 #include "webkit/appcache/appcache_interceptor.h"
@@ -269,6 +271,11 @@ void ResourceLoader::OnCertificateRequested(
     return;
   }
 
+#if defined(USE_NSS) && !defined(OS_IOS)
+  scoped_ptr<net::ClientCertStore> store(new net::ClientCertStoreImpl());

[Ryan Sleevi, 2013/01/29 19:59:49]

Rather than creating a new object every time, you should create it when the
ResourceLoader is created.

I expect that in the future, we'll do some of the following changes:
1) Make it asynchronous
2) When #1 happens, we'll want to make it pooled (based on the CAs requested),
so that we're not spinning up a ton of workers all to request the same client
certs (eg: when using an SSL proxy, a very common scenario)
3) To potentially allow the ClientCertStore to cache results, only flushing when
the OS store changes (which we can get notifications for).
4) If/when we dep-inject

Having it be a member variable sets it up for the transition of
ownership/lifetime in the long-term, and in the near-term it just ensures that
no wrong assumptions get baked in on the lifetime of |store|

[ppi, 2013/01/30 15:34:56]

Sounds good, thanks! Made the pointer a member variable initialized in
ResourceLoader constructor in patch set 4.

+  store->GetClientCerts(*cert_info, &cert_info->client_certs);
+#endif
+
   if (cert_info->client_certs.empty()) {
     // No need to query the user if there are no certs to choose from.
     request_->ContinueWithCertificate(NULL);