Reject renegotiations in SSLClientSocket by default.

net/socket/stream_socket.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_STREAM_SOCKET_H_
 #define NET_SOCKET_STREAM_SOCKET_H_
 
 #include "net/log/net_log.h"
 #include "net/socket/next_proto.h"
 #include "net/socket/socket.h"
@@ skipping 77 matching lines @@
   virtual bool WasNpnNegotiated() const = 0;
 
   // Returns the protocol negotiated via NPN for this socket, or
   // kProtoUnknown will be returned if NPN is not applicable.
   virtual NextProto GetNegotiatedProtocol() const = 0;
 
   // Gets the SSL connection information of the socket.  Returns false if
   // SSL was not used by this socket.
   virtual bool GetSSLInfo(SSLInfo* ssl_info) = 0;
 
+  // If an SSL socket, configures whether renegotiations are allowed. By
+  // default, the socket rejects all renegotiations from the peer. This method
+  // may be called after Connect completes to change this behavior. If enabled,
+  // ERR_SSL_CLIENT_AUTH_CERT_NEEDED may be returned from Read.
+  virtual void SetRenegotiationsAllowed(bool allowed) {}

[Ryan Sleevi, 2015/05/07 01:41:26]

= 0

[davidben, 2015/05/07 19:12:34]

Fiiiine. Well, you get to review it. FWIW, EnableTCPFastOpenIfSupported is also
a {}, probably for similar reasons.

+
  protected:
   // The following class is only used to gather statistics about the history of
   // a socket.  It is only instantiated and used in basic sockets, such as
   // TCPClientSocket* instances.  Other classes that are derived from
   // StreamSocket should forward any potential settings to their underlying
   // transport sockets.
   class UseHistory {
    public:
     UseHistory();
     ~UseHistory();
@@ skipping 26 matching lines @@
     // identify the motivation.
     bool omnibox_speculation_;
     bool subresource_speculation_;
     DISALLOW_COPY_AND_ASSIGN(UseHistory);
   };
 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_STREAM_SOCKET_H_