net: disable 1/n-1 record splitting when False Start is disabled.

net/third_party/nss/patches/cbcrandomiv.patch

-From 03c5c660f3668ed1e9c9b6277d64c96d2ab3d890 Mon Sep 17 00:00:00 2001
+From 0c2a0a73b65f94caf681dd884fbdedf9bb7f3b5d Mon Sep 17 00:00:00 2001
 From: Adam Langley <agl@chromium.org>
 Date: Mon, 3 Oct 2011 12:23:29 -0400
 Subject: [PATCH] cbcrandomiv.patch
 
 ---
- mozilla/security/nss/lib/ssl/ssl3con.c |   96 +++++++++++++++++++++++---------
- 1 files changed, 69 insertions(+), 27 deletions(-)
+ mozilla/security/nss/lib/ssl/ssl3con.c |   97 +++++++++++++++++++++++---------
+ 1 files changed, 70 insertions(+), 27 deletions(-)
 
 diff --git a/mozilla/security/nss/lib/ssl/ssl3con.c b/mozilla/security/nss/lib/ssl/ssl3con.c
-index dd99962..2648cbe 100644
+index dd99962..32f53ce 100644
 --- a/mozilla/security/nss/lib/ssl/ssl3con.c
 +++ b/mozilla/security/nss/lib/ssl/ssl3con.c
 @@ -2039,24 +2039,24 @@ ssl3_ClientAuthTokenPresent(sslSessionID *sid) {
      return isPresent;
  }
  
 +/* Caller must hold the spec read lock. wrBuf is sometimes, but not always,
 + * ss->sec.writeBuf.
 + */
  static SECStatus
@@ skipping 61 matching lines @@
 -    ssl_ReleaseSpecReadLock(ss); /************************************/
 -
      return SECSuccess;
 -
 -spec_locked_loser:
 -    ssl_ReleaseSpecReadLock(ss);
 -    return SECFailure;
  }
  
  /* Process the plain text before sending it.
-@@ -2227,20 +2221,70 @@ ssl3_SendRecord(   sslSocket *        ss,
+@@ -2227,20 +2221,71 @@ ssl3_SendRecord(   sslSocket *        ss,
  
      while (nIn > 0) {
         PRUint32  contentLen = PR_MIN(nIn, MAX_FRAGMENT_LENGTH);
 +       unsigned int spaceNeeded;
 +       unsigned int numRecords;
 +
 +       ssl_GetSpecReadLock(ss);    /********************************/
 +
 +       if (nIn > 1 &&
++           ss->opt.enableFalseStart == PR_TRUE &&
 +           ss->ssl3.cwSpec->version <= SSL_LIBRARY_VERSION_3_1_TLS &&
 +           type == content_application_data &&
 +           ss->ssl3.cwSpec->cipher_def->type == type_block /* CBC mode */) {
 +           /* We will split the first byte of the record into its own record,
 +            * as explained in the documentation for SSL_CBC_RANDOM_IV in ssl.h
 +            */
 +           numRecords = 2;
 +       } else {
 +           numRecords = 1;
 +       }
  
 -       if (wrBuf->space < contentLen + SSL3_BUFFER_FUDGE) {
 -           PRInt32 newSpace = PR_MAX(wrBuf->space * 2, contentLen);
 -           newSpace = PR_MIN(newSpace, MAX_FRAGMENT_LENGTH);
 -           newSpace += SSL3_BUFFER_FUDGE;
 -           rv = sslBuffer_Grow(wrBuf, newSpace);
 +       spaceNeeded = contentLen + (numRecords * SSL3_BUFFER_FUDGE);
 +       if (spaceNeeded > wrBuf->space) {
 +           rv = sslBuffer_Grow(wrBuf, spaceNeeded);
             if (rv != SECSuccess) {
                 SSL_DBG(("%d: SSL3[%d]: SendRecord, tried to get %d bytes",
 -                        SSL_GETPID(), ss->fd, newSpace));
 -               return SECFailure; /* sslBuffer_Grow set a memory error code. */
 +                        SSL_GETPID(), ss->fd, spaceNeeded));
 +               goto spec_locked_loser; /* sslBuffer_Grow set a memory error code. */
-            }
-        }
- 
--       rv = ssl3_CompressMACEncryptRecord( ss, type, pIn, contentLen);
++           }
++       }
++
 +       if (numRecords == 2) {
 +           sslBuffer secondRecord;
 +
 +           rv = ssl3_CompressMACEncryptRecord(ss->ssl3.cwSpec,
 +                                              ss->sec.isServer, type, pIn, 1,
 +                                              wrBuf);
 +           if (rv != SECSuccess)
 +               goto spec_locked_loser;
 +
 +           PRINT_BUF(50, (ss, "send (encrypted) record data [1/2]:",
@@ skipping 11 matching lines @@
 +                              secondRecord.buf, secondRecord.len));
 +               wrBuf->len += secondRecord.len;
 +           }
 +       } else {
 +           rv = ssl3_CompressMACEncryptRecord(ss->ssl3.cwSpec,
 +                                              ss->sec.isServer, type, pIn,
 +                                              contentLen, wrBuf);
 +           if (rv == SECSuccess) {
 +               PRINT_BUF(50, (ss, "send (encrypted) record data [1/1]:",
 +                              wrBuf->buf, wrBuf->len));
-+           }
-+       }
-+
+            }
+        }
+ 
+-       rv = ssl3_CompressMACEncryptRecord( ss, type, pIn, contentLen);
 +spec_locked_loser:
 +       ssl_ReleaseSpecReadLock(ss); /************************************/
 +
         if (rv != SECSuccess)
             return SECFailure;
  
-@@ -2248,8 +2292,6 @@ ssl3_SendRecord(   sslSocket *        ss,
+@@ -2248,8 +2293,6 @@ ssl3_SendRecord(   sslSocket *        ss,
         nIn -= contentLen;
         PORT_Assert( nIn >= 0 );
  
 -       PRINT_BUF(50, (ss, "send (encrypted) record data:", wrBuf->buf, wrBuf->len));
 -
         /* If there's still some previously saved ciphertext,
          * or the caller doesn't want us to send the data yet,
          * then add all our new ciphertext to the amount previously saved.