NSS: add `balloon' extension to when we might hit the F5 bug.

net/third_party/nss/ssl/ssl3con.c

Index: net/third_party/nss/ssl/ssl3con.c
diff --git a/net/third_party/nss/ssl/ssl3con.c b/net/third_party/nss/ssl/ssl3con.c
index 8b8b758c0b47c50fb1b55a51658bf84ee3493a9b..f5b973b2fbd64206bdc9d653f6c1e490275c0a97 100644
--- a/net/third_party/nss/ssl/ssl3con.c
+++ b/net/third_party/nss/ssl/ssl3con.c
@@ -4974,7 +4974,7 @@ ssl3_SendClientHello(sslSocket *ss, PRBool resending)
     int              actual_count = 0;
     PRBool           isTLS = PR_FALSE;
     PRBool           requestingResume = PR_FALSE;
-    PRInt32          total_exten_len = 0;
+    PRInt32          total_exten_len = 0, balloonExtensionLen;
     unsigned         numCompressionMethods;
     PRInt32          flags;
 
@@ -5241,6 +5241,10 @@ ssl3_SendClientHello(sslSocket *ss, PRBool resending)
 	length += 1 + ss->ssl3.hs.cookieLen;
     }
 
+    balloonExtensionLen = ssl3_CalculateBalloonExtensionLength(length);
+    total_exten_len += balloonExtensionLen;
+    length += balloonExtensionLen;

[wtc, 2013/11/06 21:51:58]

This workaround should be disabled if IS_DTLS(ss) is true.

We should add a comment here to explain the purpose of the workaround.

[wtc, 2013/11/06 22:25:07]

This workaround can also be turned off for renegotiation, which doesn't exist in
SSLv2.

[agl, 2013/11/08 19:39:17]

Done.

I've tested various sizes of renegotiation ClientHello on a known bad server
(wellsfargo.com) and all I get is a handshake_failure alert for all of them.

[wtc, 2013/11/08 20:10:06]

Thank you for the experiments. I guess they don't respond to client-initiated
renegotiations, perhaps for security reasons.

+
     rv = ssl3_AppendHandshakeHeader(ss, client_hello, length);
     if (rv != SECSuccess) {
 	return rv;	/* err set by ssl3_AppendHandshake* */
@@ -5360,6 +5364,13 @@ ssl3_SendClientHello(sslSocket *ss, PRBool resending)
 	    return SECFailure;
 	}
 	maxBytes -= extLen;
+
+	extLen = ssl3_AppendBalloonExtension(ss, balloonExtensionLen, maxBytes);
+	if (extLen < 0) {
+	    return SECFailure;
+	}
+	maxBytes -= extLen;
+
 	PORT_Assert(!maxBytes);
     } 
     if (ss->ssl3.hs.sendingSCSV) {