net: don't do TLS False Start with RC4.

net/third_party/nss/ssl/ssl3con.c

Index: net/third_party/nss/ssl/ssl3con.c
diff --git a/net/third_party/nss/ssl/ssl3con.c b/net/third_party/nss/ssl/ssl3con.c
index ee960890f836fb8bdb2ec76ca64bc1145f793d5b..3b0c22e02af5e7dcc6a8dcbf3bba2d9d73035e12 100644
--- a/net/third_party/nss/ssl/ssl3con.c
+++ b/net/third_party/nss/ssl/ssl3con.c
@@ -6416,7 +6416,10 @@ ssl3_CanFalseStart(sslSocket *ss) {
 	(ss->ssl3.hs.kea_def->kea == kea_dhe_dss ||
 	 ss->ssl3.hs.kea_def->kea == kea_dhe_rsa ||
 	 ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa ||
-	 ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa);
+	 ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) &&
+        /* In light of recent RC4 analysis (http://www.isg.rhul.ac.uk/tls/), we
+         * don't allow False Start with RC4. */

[Ryan Sleevi, 2013/04/15 18:08:35]

Perhaps this should be integrated with the comments on 6410-6414 to provide more
meaningful context on why RC4 isn't allowed.

[agl, 2013/04/16 14:59:29]

Done.

+        ss->ssl3.cwSpec->cipher_def->cipher != cipher_rc4;
     ssl_ReleaseSpecReadLock(ss);
     return rv;
 }