Reject renegotiations in SSLClientSocket by default.

net/third_party/nss/ssl/ssl3con.c

 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /*
  * SSL3 Protocol
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /* TODO(ekr): Implement HelloVerifyRequest on server side. OK for now. */
 
@@ skipping 5514 matching lines @@
     PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss) );
 
     if (ss->ssl3.hs.ws == wait_server_hello)
         return SECSuccess;
     if (ss->ssl3.hs.ws != idle_handshake || ss->sec.isServer) {
         (void)SSL3_SendAlert(ss, alert_fatal, unexpected_message);
         PORT_SetError(SSL_ERROR_RX_UNEXPECTED_HELLO_REQUEST);
         return SECFailure;
     }
     if (ss->opt.enableRenegotiation == SSL_RENEGOTIATE_NEVER) {
-        ssl_GetXmitBufLock(ss);

[davidben, 2015/05/06 23:30:18]

Without removing these, SSL3_SendAlert triggers an alert.

[Ryan Sleevi, 2015/05/07 01:41:26]

Let's do this in a separate CL. At the least, I want to see an upstream bug
before we land this patch. It is correct though (because SSL3_SendAlert grabs
these locks)

[davidben, 2015/05/07 19:12:34]

Done. https://codereview.chromium.org/1134493002/

-        rv = SSL3_SendAlert(ss, alert_warning, no_renegotiation);
-        ssl_ReleaseXmitBufLock(ss);
+        (void)SSL3_SendAlert(ss, alert_warning, no_renegotiation);
         PORT_SetError(SSL_ERROR_RENEGOTIATION_NOT_ALLOWED);
         return SECFailure;
     }
 
     if (sid) {
         if (ss->sec.uncache)
             ss->sec.uncache(sid);
         ssl_FreeSID(sid);
         ss->sec.ci.sid = NULL;
     }
@@ skipping 7342 matching lines @@
             PORT_Free(ss->ssl3.hs.recvdFragments.buf);
         }
     }
 
     ss->ssl3.initialized = PR_FALSE;
 
     SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 }
 
 /* End of ssl3con.c */