Reject renegotiations in SSLClientSocket by default.

net/http/http_stream_factory_impl_job.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_stream_factory_impl_job.h"
 
 #include <algorithm>
 #include <string>
 
 #include "base/bind.h"
@@ skipping 1100 matching lines @@
     bool using_proxy = (proxy_info_.is_http() || proxy_info_.is_https()) &&
                        (request_info_.url.SchemeIs("http") ||
                         request_info_.url.SchemeIs("ftp"));
     if (stream_factory_->for_websockets_) {
       DCHECK(request_);
       DCHECK(request_->websocket_handshake_stream_create_helper());
       websocket_stream_.reset(
           request_->websocket_handshake_stream_create_helper()
               ->CreateBasicStream(connection_.Pass(), using_proxy));
     } else {
+      // HTTP/1.1 requires renegotiations enabled to support TLS client
+      // authentication coming in during a request.
+      connection_->socket()->SetRenegotiationsAllowed(true);

[Ryan Sleevi, 2015/05/07 01:41:26]

This is also needed for WebSockets, which can and do use client certs

[davidben, 2015/05/07 19:12:34]

Well, this doesn't break all client certs. Sane deployments (relatively
speaking) of client certs don't do the awful renego hack. :-) But you're right.
It should be up at the top of this block, in case someone does the renego hack
on the WebSockets entry point. Fixed.

       stream_.reset(new HttpBasicStream(connection_.release(), using_proxy));
     }
     return OK;
   }
 
   CHECK(!stream_.get());
 
   bool direct = !IsHttpsProxyAndHttpUrl();
   if (existing_spdy_session_.get()) {
     // We picked up an existing session, so we don't need our socket.
@@ skipping 374 matching lines @@
 
 void HttpStreamFactoryImpl::Job::
     MaybeCopyConnectionAttemptsFromClientSocketHandleToRequest() {
   if (IsOrphaned() || !connection_)
     return;
 
   request_->AddConnectionAttempts(connection_->connection_attempts());
 }
 
 }  // namespace net