Linux: allow TLS renegotiation.

net/socket/ssl_client_socket_nss.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived
 // from AuthCertificateCallback() in
 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp.
 
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ skipping 296 matching lines @@
 #else
   #error "You need to install NSS-3.12 or later to build chromium"
 #endif
 
 #ifdef SSL_ENABLE_DEFLATE
   rv = SSL_OptionSet(nss_fd_, SSL_ENABLE_DEFLATE, PR_TRUE);
   if (rv != SECSuccess)
      LOG(INFO) << "SSL_ENABLE_DEFLATE failed.  Old system nss?";
 #endif
 
+#ifdef SSL_ENABLE_RENEGOTIATION
+  /* We allow servers to request renegotiation. Since we're a client,

[wtc, 2010/01/05 19:48:51]

Please use C++ comment delimiter "//" because this is a C++
file.

+   * prohibiting this is rather a waste of time. Only servers are in a position
+   * to prevent renegotiation attacks.
+   * http://extendedsubset.com/?p=8 */
+  rv = SSL_OptionSet(nss_fd_, SSL_ENABLE_RENEGOTIATION,
+                     SSL_RENEGOTIATE_UNRESTRICTED);

[wtc, 2010/01/05 19:48:51]

We should file a bug to remind us to change this when we
update to NSS 3.12.6, which will implement the renegotiation
info extension.

+  if (rv != SECSuccess)
+     LOG(INFO) << "SSL_ENABLE_RENEGOTIATION failed.";
+#endif
+
 #ifdef SSL_NEXT_PROTO_NEGOTIATED
   if (!ssl_config_.next_protos.empty()) {
     rv = SSL_SetNextProtoNego(
        nss_fd_,
        reinterpret_cast<const unsigned char *>(ssl_config_.next_protos.data()),
        ssl_config_.next_protos.size());
     if (rv != SECSuccess)
        LOG(INFO) << "SSL_SetNextProtoNego failed.";
   }
 #endif
@@ skipping 829 matching lines @@
   }
   PRErrorCode prerr = PR_GetError();
   if (prerr == PR_WOULD_BLOCK_ERROR) {
     return ERR_IO_PENDING;
   }
   LeaveFunction("");
   return NetErrorFromNSPRError(prerr);
 }
 
 }  // namespace net