From d68b1f693dc388800ccf58cd4f330c7ad44ca779 Mon Sep 17 00:00:00 2001
From: Jeremy Rose <nornagon@nornagon.net>
Date: Tue, 18 Aug 2020 10:05:43 -0700
Subject: [PATCH] tls: enable renegotiation when using boringssl

---
 src/tls_wrap.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/tls_wrap.cc b/src/tls_wrap.cc
index 04c035a1e8f3e5..91faeafb62b660 100644
--- a/src/tls_wrap.cc
+++ b/src/tls_wrap.cc
@@ -131,6 +131,12 @@ void TLSWrap::InitSSL() {
   // - https://wiki.openssl.org/index.php/TLS1.3#Non-application_data_records
   SSL_set_mode(ssl_.get(), SSL_MODE_AUTO_RETRY);
 
+#ifdef OPENSSL_IS_BORINGSSL
+  // OpenSSL allows renegotiation by default, but BoringSSL disables it.
+  // Configure BoringSSL to match OpenSSL's behavior.
+  SSL_set_renegotiate_mode(ssl_.get(), ssl_renegotiate_freely);
+#endif
+
   SSL_set_app_data(ssl_.get(), this);
   // Using InfoCallback isn't how we are supposed to check handshake progress:
   //   https://github.com/openssl/openssl/issues/7199#issuecomment-420915993