Listen for new system certificates.

net/socket/client_socket_pool_manager_impl.cc

Index: net/socket/client_socket_pool_manager_impl.cc
diff --git a/net/socket/client_socket_pool_manager_impl.cc b/net/socket/client_socket_pool_manager_impl.cc
index b557874d011161845f4d672f331ac6425c07daf4..066e27d452b943dd173c68858d103f067a50b350 100644
--- a/net/socket/client_socket_pool_manager_impl.cc
+++ b/net/socket/client_socket_pool_manager_impl.cc
@@ -389,4 +389,18 @@ void ClientSocketPoolManagerImpl::OnCertTrustChanged(
   FlushSocketPoolsWithError(ERR_NETWORK_CHANGED);
 }
 
+void ClientSocketPoolManagerImpl::OnDatabaseUpdated() {
+  // We should flush the socket pools if we removed trust from a
+  // cert, because a previously trusted server may have become
+  // untrusted.
+  //
+  // We should not flush the socket pools if we added trust to a
+  // cert.
+  //
+  // Since the OnDatabaseUpdated method doesn't tell us what
+  // kind of trust change it is, we have to flush the socket
+  // pools to be safe.
+  FlushSocketPoolsWithError(ERR_NETWORK_CHANGED);

[wtc, 2013/10/16 15:37:34]

We probably should just have OnCertAdded and OnCertTrustChanged call
OnDatabaseUpdated. It will require updating this comment to make it applicable
to all three observer methods.

[qsr, 2013/10/16 16:02:09]

 I did not do this because I'm not sure to understand the comments well enough.

 The comments says that we should flush when we remove trust, but not when we
add, *but*, the code is flushing on |OnCertAdded| and not on |OnCertRemoved|.
There is a subtlety I'm missing here.

[Ryan Sleevi, 2013/10/16 17:40:52]

OnCertAdded == OnClientCertAdded.

The flushing on adding a client cert is strongly undesirable, an artifact of
when client cert detection was in the SSLClientSocket, as this was needed to
flush caches.

To put a 'proper' solution on the table:
OnCertAdded -> renamed to OnClientCertAdded
Have the ClientCertStore listening for OnClientCertadded.
When a new cert is added, it:
  [short term] only flushes the socket pools if there was a client cert request
that would change
  [long term] only flushes the sockets for the client cert that changed

OnCertTrustChanged is a bit of a misnomer as well; it's likely we should just
call this OnDatabaseUpdated, and try to specifically enumerate the cases that we
care about (since some systems will raise additional alerts we don't care about)

+}
+
 }  // namespace net