Update from chromium https://crrev.com/302282

net/third_party/nss/patches/fallbackscsv.patch

 diff -pu a/nss/lib/ssl/ssl3con.c b/nss/lib/ssl/ssl3con.c
 --- a/nss/lib/ssl/ssl3con.c     2014-01-17 18:46:51.999581198 -0800
 +++ b/nss/lib/ssl/ssl3con.c     2014-01-17 18:47:05.509804656 -0800
 @@ -3473,6 +3473,9 @@ ssl3_HandleAlert(sslSocket *ss, sslBuffe
      case certificate_unknown:  error = SSL_ERROR_CERTIFICATE_UNKNOWN_ALERT;
                                                                           break;
      case illegal_parameter:    error = SSL_ERROR_ILLEGAL_PARAMETER_ALERT;break;
 +    case inappropriate_fallback:
 +        error = SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT;
 +        break;
@@ skipping 26 matching lines @@
 +    /* make room for SCSV */
      if (ss->ssl3.hs.sendingSCSV) {
 -       ++num_suites;   /* make room for SCSV */
 +       ++num_suites;
 +    }
 +    if (fallbackSCSV) {
 +       ++num_suites;
      }
  
      /* count compression methods */
-@@ -5353,6 +5365,15 @@ ssl3_SendClientHello(sslSocket *ss, PRBo
-        }
-        actual_count++;
-     }
+@@ -5389,11 +5389,21 @@ ssl3_SendClientHello(sslSocket *ss, PRBo
+            if (rv != SECSuccess) {
+                if (sid->u.ssl3.lock) { NSSRWLock_UnlockRead(sid->u.ssl3.lock); }
+                return rv;      /* err set by ssl3_AppendHandshake* */
+            }
+        }
+    }
+
 +    if (fallbackSCSV) {
 +       rv = ssl3_AppendHandshakeNumber(ss, TLS_FALLBACK_SCSV,
 +                                       sizeof(ssl3CipherSuite));
 +       if (rv != SECSuccess) {
 +           if (sid->u.ssl3.lock) { PR_RWLock_Unlock(sid->u.ssl3.lock); }
 +           return rv;  /* err set by ssl3_AppendHandshake* */
 +       }
 +       actual_count++;
 +    }
-     for (i = 0; i < ssl_V3_SUITES_IMPLEMENTED; i++) {
-        ssl3CipherSuiteCfg *suite = &ss->cipherSuites[i];
-        if (config_match(suite, ss->ssl3.policy, PR_TRUE, &ss->vrange)) {
++
+    /* if cards were removed or inserted between count_cipher_suites and
+     * generating our list, detect the error here rather than send it off to
+     * the server.. */
+    if (actual_count != num_suites) {
 @@ -8084,6 +8105,19 @@ ssl3_HandleClientHello(sslSocket *ss, SS
         goto loser;             /* malformed */
      }
  
 +    /* If the ClientHello version is less than our maximum version, check for a
 +     * TLS_FALLBACK_SCSV and reject the connection if found. */
 +    if (ss->vrange.max > ss->clientHelloVersion) {
 +       for (i = 0; i + 1 < suites.len; i += 2) {
 +           PRUint16 suite_i = (suites.data[i] << 8) | suites.data[i + 1];
 +           if (suite_i != TLS_FALLBACK_SCSV)
@@ skipping 125 matching lines @@
         ssl_defaults.enableSignedCertTimestamps = on;
         break;
  
 +      case SSL_ENABLE_FALLBACK_SCSV:
 +       ssl_defaults.enableFallbackSCSV = on;
 +       break;
 +
        default:
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;