When renegotiating, continue to use the client_version used in the initial ClientHello

net/third_party/nss/ssl/sslsock.c

Index: net/third_party/nss/ssl/sslsock.c
===================================================================
--- net/third_party/nss/ssl/sslsock.c	(revision 151171)
+++ net/third_party/nss/ssl/sslsock.c	(working copy)
@@ -1921,7 +1921,7 @@
 	return SECFailure;
     }
 
-    if (!ssl3_VersionRangeIsValid(ssl_variant_stream, vrange)) {
+    if (!ssl3_VersionRangeIsValid(ss->protocolVariant, vrange)) {

[Ryan Sleevi, 2012/08/15 03:39:07]

same here?

[wtc, 2012/08/15 16:16:59]

Yes, this is part of the unrelated bug fix for EKR's
DTLS code.

 	PORT_SetError(SSL_ERROR_INVALID_VERSION_RANGE);
 	return SECFailure;
     }