Switch to using SSL_get0_certificate_types for client auth.

net/socket/ssl_client_socket_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // OpenSSL binding for SSLClientSocket. The class layout and general principle
 // of operation is derived from SSLClientSocketNSS.
 
 #include "net/socket/ssl_client_socket_openssl.h"
 
 #include <errno.h>
@@ skipping 1321 matching lines @@
       X509_NAME *ca_name = (X509_NAME *)sk_X509_NAME_value(authorities, i);
       unsigned char* str = NULL;
       int length = i2d_X509_NAME(ca_name, &str);
       cert_authorities_.push_back(std::string(
           reinterpret_cast<const char*>(str),
           static_cast<size_t>(length)));
       OPENSSL_free(str);
     }
 
     const unsigned char* client_cert_types;
-    size_t num_client_cert_types;
-    SSL_get_client_certificate_types(ssl, &client_cert_types,
-                                     &num_client_cert_types);
+    size_t num_client_cert_types =
+        SSL_get0_certificate_types(ssl, &client_cert_types);

[davidben, 2014/07/23 23:27:55]

Even though this is upstream's API, it does have the downside of going through
SSL_ctrl and thus not having any type-checking. ssl2_ctrl is gone now and
dtls1_ctrl is a tiny tiny wrapper over ssl3_ctrl. Perhaps we should start
ripping all the SSL_ctrl switch-case + macro pairs into individual functions?
Would have to be careful about any consumers that call the SSL_ctrl directly,
and any consumers which #ifdef on the macro. But apart from that....

     for (size_t i = 0; i < num_client_cert_types; i++) {
       cert_key_types_.push_back(
           static_cast<SSLClientCertType>(client_cert_types[i]));
     }
 
     return -1;  // Suspends handshake.
   }
 
   // Second pass: a client certificate should have been selected.
   if (ssl_config_.client_cert.get()) {
@@ skipping 151 matching lines @@
   return socket->MaybeReplayTransportError(
       bio, cmd, argp, argi, argl, retvalue);
 }
 
 scoped_refptr<X509Certificate>
 SSLClientSocketOpenSSL::GetUnverifiedServerCertificateChain() const {
   return server_cert_;
 }
 
 }  // namespace net