Implement the encrypt-then-MAC TLS extension.

net/third_party/nss/ssl/sslsock.c

Index: net/third_party/nss/ssl/sslsock.c
===================================================================
--- net/third_party/nss/ssl/sslsock.c	(revision 252347)
+++ net/third_party/nss/ssl/sslsock.c	(working copy)
@@ -89,7 +89,8 @@
     PR_TRUE,    /* enableNPN          */
     PR_FALSE,   /* enableALPN         */
     PR_FALSE,   /* enableSignedCertTimestamps */
-    PR_FALSE    /* enableFallbackSCSV */
+    PR_FALSE,   /* enableFallbackSCSV */
+    PR_FALSE    /* enableEncryptThenMAC */
 };
 
 /*
@@ -797,6 +798,10 @@
        ss->opt.enableFallbackSCSV = on;
        break;
 
+      case SSL_ENABLE_ENCRYPT_THEN_MAC:
+       ss->opt.enableEncryptThenMAC = on;
+       break;
+
       default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
 	rv = SECFailure;
@@ -873,6 +878,7 @@
 	on = ss->opt.enableSignedCertTimestamps;
 	break;
     case SSL_ENABLE_FALLBACK_SCSV: on = ss->opt.enableFallbackSCSV; break;
+    case SSL_ENABLE_ENCRYPT_THEN_MAC: on = ss->opt.enableEncryptThenMAC; break;
 
     default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
@@ -942,6 +948,9 @@
     case SSL_ENABLE_FALLBACK_SCSV:
 	on = ssl_defaults.enableFallbackSCSV;
 	break;
+    case SSL_ENABLE_ENCRYPT_THEN_MAC:
+	on = ssl_defaults.enableEncryptThenMAC;
+	break;
 
     default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
@@ -1125,6 +1134,10 @@
        ssl_defaults.enableFallbackSCSV = on;
        break;
 
+      case SSL_ENABLE_ENCRYPT_THEN_MAC:
+       ssl_defaults.enableEncryptThenMAC = on;
+       break;
+
       default:
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
 	return SECFailure;