Revert "net: Precede each CBC encrypted application data record with an empty one."

net/third_party/nss/patches/cbcrandomiv.patch

-commit 95cc0cf361c92681803e7ee5d4afe5e40673a4b8
-Author: Adam Langley <agl@chromium.org>
-Date:   Wed Jun 22 13:36:50 2011 -0400
-
-    cbcrandomiv.patch
-
-diff --git a/mozilla/security/nss/lib/ssl/ssl3con.c b/mozilla/security/nss/lib/ssl/ssl3con.c
-index f7064ef..c39b8f8 100644
---- a/mozilla/security/nss/lib/ssl/ssl3con.c
-+++ b/mozilla/security/nss/lib/ssl/ssl3con.c
-@@ -2229,7 +2229,7 @@ ssl3_SendRecord(   sslSocket *        ss,
-        return SECFailure;
-     }
- 
--    while (nIn > 0) {
-+    do {
-        PRUint32  contentLen = PR_MIN(nIn, MAX_FRAGMENT_LENGTH);
- 
-        if (wrBuf->space < contentLen + SSL3_BUFFER_FUDGE) {
-@@ -2306,7 +2306,7 @@ ssl3_SendRecord(   sslSocket *        ss,
-            }
-        }
-        totalSent += contentLen;
--    }
-+    } while (nIn > 0);
-     return totalSent;
- }
- 
-@@ -2321,6 +2321,7 @@ ssl3_SendApplicationData(sslSocket *ss, const unsigned char *in,
- {
-     PRInt32   totalSent        = 0;
-     PRInt32   discarded = 0;
-+    PRBool    isBlockCipher;
- 
-     PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss) );
-     if (len < 0 || !in) {
-@@ -2345,6 +2346,28 @@ ssl3_SendApplicationData(sslSocket *ss, const unsigned char *in,
-        len--;
-        discarded = 1;
-     }
-+
-+    ssl_GetSpecReadLock(ss);
-+    isBlockCipher = ss->ssl3.cwSpec->cipher_def->type == type_block;
-+    ssl_ReleaseSpecReadLock(ss);
-+
-+    if (isBlockCipher && len > 0) {
-+       // We assume that block ciphers are used in CBC mode and prepend an
-+       // empty record. This effectively randomizes the IV in a backwards
-+       // compatible way.
-+       PRInt32 sent = ssl3_SendRecord(ss, content_application_data,
-+                                      in, 0 /* no payload */, flags);
-+       if (sent < 0) {
-+           return SECFailure; /* error code set by ssl3_SendRecord */
-+       }
-+       if (ss->pendingBuf.len) {
-+           /* must be a non-blocking socket */
-+           PORT_Assert(!ssl_SocketIsBlocking(ss));
-+           PORT_Assert(ss->lastWriteBlocked);
-+           return SECFailure;
-+       }
-+    }
-+
-     while (len > totalSent) {
-        PRInt32   sent, toSend;
- 
-@@ -2377,6 +2400,7 @@ ssl3_SendApplicationData(sslSocket *ss, const unsigned char *in,
-            break;      
-        }
-     }
-+
-     if (ss->pendingBuf.len) {
-        /* Must be non-blocking. */
-        PORT_Assert(!ssl_SocketIsBlocking(ss));