Wire up SSL client authentication for OpenSSL/Android through the net/ stack

net/base/cert_database_openssl.cc

Index: net/base/cert_database_openssl.cc
diff --git a/net/base/cert_database_openssl.cc b/net/base/cert_database_openssl.cc
index 47effe2876475f4c9c285f5d49a94d6061dbb60c..b330cb847dc09ac7cf1c44aca94044856c0cbc2b 100644
--- a/net/base/cert_database_openssl.cc
+++ b/net/base/cert_database_openssl.cc
@@ -27,10 +27,6 @@ int CertDatabase::CheckUserCert(X509Certificate* cert) {
   if (cert->HasExpired())
     return ERR_CERT_DATE_INVALID;
 
-  if (!OpenSSLPrivateKeyStore::GetInstance()->FetchPrivateKey(
-      X509_PUBKEY_get(X509_get_X509_PUBKEY(cert->os_cert_handle()))))
-    return ERR_NO_PRIVATE_KEY_FOR_CERT;

[Ryan Sleevi, 2013/02/28 00:58:35]

Can you remind me where you plan to stick this check?

Can you add a comment here explaining where the 'real' meat lives, and why?

[digit1, 2013/02/28 15:46:56]

Yes, in short form:

- This method is never called on Android, because its only
  user, except on ChromeOS, is SSLAddCertHandler. For more
  details see chrome/browser/ssl/ssl_add_certificate.cc and
  ssl_add_certificate_android.cc

- For the Linux build, the store will always be empty.
  More precisely, OpenSSLPrivateKeyStore::StoreKeyPair(),
  which can populate it, is only used by
  KeygenHandler::GenKeyAndSignChallenge(), so the function
  would always return ERR_NO_PRIVATE_KEY_FOR_CERT, during
  unit testing, except if said test checks for full
  keygen handling (i.e. key pair generation + installation,
  then download of a server-generated client certificate
  which will trigger a SSLAddCertHandler).

  Another possibility is a unit test that directly calls
  StoreKeyPair() to "install" a test key pair in the
  private store, then triggers a fake certificate download
  through a SSLCertAddHandler. However, such a test would
  be Linux/OpenSSL-specific, and I'm unsure there is any
  real value in implementing it.

Anyway, I've restored the old implementation, changing FetchPrivateKey() to
HasPrivateKey() to make things a bit clearer.

-
   return OK;
 }