net: don't add padding extension for SSLv3.

net/third_party/nss/ssl/ssl3con.c

Index: net/third_party/nss/ssl/ssl3con.c
diff --git a/net/third_party/nss/ssl/ssl3con.c b/net/third_party/nss/ssl/ssl3con.c
index 567d481203a4e98a3f43f25cb5fdf091445e7e46..8eb3ab5c4f67f68bebe16874de5860c87c863380 100644
--- a/net/third_party/nss/ssl/ssl3con.c
+++ b/net/third_party/nss/ssl/ssl3con.c
@@ -4975,7 +4975,7 @@ ssl3_SendClientHello(sslSocket *ss, PRBool resending)
     PRBool           isTLS = PR_FALSE;
     PRBool           requestingResume = PR_FALSE;
     PRInt32          total_exten_len = 0;
-    unsigned         paddingExtensionLen;
+    PRInt32          paddingExtensionLen;

[wtc, 2013/11/11 21:50:33]

This variable receives the return value of ssl3_CalculatePaddingExtensionLength.
Since ssl3_CalculatePaddingExtensionLength cannot fail, it is better for this
variable to have the unsigned type.

[agl, 2013/11/12 16:21:57]

Done.

     unsigned         numCompressionMethods;
     PRInt32          flags;
 
@@ -5248,7 +5248,7 @@ ssl3_SendClientHello(sslSocket *ss, PRBool resending)
      * in F5 devices.
      *
      * This is not done for DTLS nor for renegotiation. */
-    if (!IS_DTLS(ss) && !ss->firstHsDone) {
+    if (!IS_DTLS(ss) && isTLS && !ss->firstHsDone) {
         paddingExtensionLen = ssl3_CalculatePaddingExtensionLength(length);
         total_exten_len += paddingExtensionLen;
         length += paddingExtensionLen;