Switch SSLClientSocketOpenSSL to the new BoringSSL renego API.

The current double-negative API was confusing. Fortunately, we needed to make
it an enum in BoringSSL for some other consumer, so that was an excuse to fix
it and deprecate the old one. Also we default to rejecting renego now, so
there's no need to explicitly configure it that way.

BUG=none

Review URL: https://codereview.chromium.org/1410163004

Cr-Commit-Position: refs/heads/master@{#357869}

1 files changed, 1 insertions, 5 deletions

diff --git a/net/socket/ssl_client_socket_openssl.cc b/net/socket/ssl_client_socket_openssl.cc
index 29c59f7..0d39f64 100644
--- a/net/socket/ssl_client_socket_openssl.cc
+++ b/net/socket/ssl_client_socket_openssl.cc
@@ -960,10 +960,6 @@ int SSLClientSocketOpenSSL::Init() {
   if (cert_verifier_->SupportsOCSPStapling())
     SSL_enable_ocsp_stapling(ssl_);
 
-  // By default, renegotiations are rejected. After the initial handshake
-  // completes, some application protocols may re-enable it.
-  SSL_set_reject_peer_renegotiations(ssl_, 1);
-
   return OK;
 }
 
@@ -1136,7 +1132,7 @@ int SSLClientSocketOpenSSL::DoHandshakeComplete(int result) {
   set_signed_cert_timestamps_received(sct_list_len != 0);
 
   if (IsRenegotiationAllowed())
-    SSL_set_reject_peer_renegotiations(ssl_, 0);
+    SSL_set_renegotiate_mode(ssl_, ssl_renegotiate_freely);
 
   // Verify the certificate.
   UpdateServerCert();