Listen for new system certificates.

net/socket/client_socket_pool_manager_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/client_socket_pool_manager_impl.h"
 
 #include "base/logging.h"
 #include "base/values.h"
 #include "net/http/http_network_session.h"
 #include "net/http/http_proxy_client_socket_pool.h"
@@ skipping 371 matching lines @@
   //
   // We should not flush the socket pools if we added trust to a
   // cert.
   //
   // Since the OnCertTrustChanged method doesn't tell us what
   // kind of trust change it is, we have to flush the socket
   // pools to be safe.
   FlushSocketPoolsWithError(ERR_NETWORK_CHANGED);
 }
 
+void ClientSocketPoolManagerImpl::OnDatabaseUpdated() {
+  // We should flush the socket pools if we removed trust from a
+  // cert, because a previously trusted server may have become
+  // untrusted.
+  //
+  // We should not flush the socket pools if we added trust to a
+  // cert.
+  //
+  // Since the OnDatabaseUpdated method doesn't tell us what
+  // kind of trust change it is, we have to flush the socket
+  // pools to be safe.
+  FlushSocketPoolsWithError(ERR_NETWORK_CHANGED);

[wtc, 2013/10/16 15:37:34]

We probably should just have OnCertAdded and OnCertTrustChanged call
OnDatabaseUpdated. It will require updating this comment to make it applicable
to all three observer methods.

[qsr, 2013/10/16 16:02:09]

 I did not do this because I'm not sure to understand the comments well enough.

 The comments says that we should flush when we remove trust, but not when we
add, *but*, the code is flushing on |OnCertAdded| and not on |OnCertRemoved|.
There is a subtlety I'm missing here.

[Ryan Sleevi, 2013/10/16 17:40:52]

OnCertAdded == OnClientCertAdded.

The flushing on adding a client cert is strongly undesirable, an artifact of
when client cert detection was in the SSLClientSocket, as this was needed to
flush caches.

To put a 'proper' solution on the table:
OnCertAdded -> renamed to OnClientCertAdded
Have the ClientCertStore listening for OnClientCertadded.
When a new cert is added, it:
  [short term] only flushes the socket pools if there was a client cert request
that would change
  [long term] only flushes the sockets for the client cert that changed

OnCertTrustChanged is a bit of a misnomer as well; it's likely we should just
call this OnDatabaseUpdated, and try to specifically enumerate the cases that we
care about (since some systems will raise additional alerts we don't care about)

+}
+
 }  // namespace net