Cap the record layer version number of TLS ClientHello to TLS 1.0

Cap the record layer version number of TLS ClientHello to TLS 1.0
if we don't know what TLS version the server supports.

Fix the -p option for the patch commands in applypatches.sh.

R=agl@chromium.org,rsleevi@chromium.org
BUG=136666
TEST=manual: visit https://cybozulive.com/, https://www.billpaysite.com/,
and https://members.mh-frontier.jp/mypage/ on Linux or Mac. The connection
should succeed.

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=147056

[wtc, 2012-07-13 21:04:27]

agl,rsleevi: please review.

https://chromiumcodereview.appspot.com/10777021/diff/4001/net/third_party/nss...
File net/third_party/nss/ssl/ssl3con.c (right):

https://chromiumcodereview.appspot.com/10777021/diff/4001/net/third_party/nss...
net/third_party/nss/ssl/ssl3con.c:4091: if (sidOK && ssl3_NegotiateVersion(ss,
sid->version,

Note that if the client is trying to resume a session, it
caps the version with sid->version.  So we will set
serverVersionKnown to true for this case below.

[Ryan Sleevi, 2012-07-13 21:20:53]

https://chromiumcodereview.appspot.com/10777021/diff/4001/net/third_party/nss...
File net/third_party/nss/ssl/ssl3con.c (right):

https://chromiumcodereview.appspot.com/10777021/diff/4001/net/third_party/nss...
net/third_party/nss/ssl/ssl3con.c:2060: PRBool             capsRecordVersion,
should this be singular - capRecordVersion - to indicate it's a command?

with capsRecordVersion, "caps" seems like a verb, so it's not clear what/who the
subject is. If I substitute in "peer", as in "the peer caps the record version",
this doesn't seem accurate, since it's not the peer who caps, it's the client
who needs to cap to talk to the peer.

Same for other occurrences of the pluralized form

https://chromiumcodereview.appspot.com/10777021/diff/4001/net/third_party/nss...
net/third_party/nss/ssl/ssl3con.c:2222: version = cwSpec->version;
nit:

SSL3ProtocolVersion version = cwSpec->version?

https://chromiumcodereview.appspot.com/10777021/diff/4001/net/third_party/nss...
net/third_party/nss/ssl/ssl3con.c:2293: PORT_Assert(ss->ssl3.hs.ws ==
wait_server_hello);
Is this true for client-initiated renegotiation? I would think the hs.ws may be
different then

https://chromiumcodereview.appspot.com/10777021/diff/4001/net/third_party/nss...
File net/third_party/nss/ssl/sslimpl.h (right):

https://chromiumcodereview.appspot.com/10777021/diff/4001/net/third_party/nss...
net/third_party/nss/ssl/sslimpl.h:298: 0x04000000
/* TLS only */ ?

[wtc, 2012-07-13 22:11:38]

rsleevi: thank you for the review.  I will make all the changes
you suggested.

https://chromiumcodereview.appspot.com/10777021/diff/4001/net/third_party/nss...
File net/third_party/nss/ssl/ssl3con.c (right):

https://chromiumcodereview.appspot.com/10777021/diff/4001/net/third_party/nss...
net/third_party/nss/ssl/ssl3con.c:2293: PORT_Assert(ss->ssl3.hs.ws ==
wait_server_hello);

On 2012/07/13 21:20:53, Ryan Sleevi wrote:
> Is this true for client-initiated renegotiation? I would think the hs.ws may
be
> different then

Yes, ss->ssl3.hs.ws is also wait_server_hello for
client-initiated renegotiation.  ssl3_SendClientHello calls
ssl3_InitState at the beginning, which sets ss->ssl3.hs.ws
to wait_server_hello. Note that ssl3_SendClientHello also
sets ss->ssl3.hs.ws to wait_server_hello before returning,
but this assertion is checked before that.  This is a little
confusing because the side effect of ssl3_InitState is not
obvious.

Do you think I should remove this assertion to avoid that
confusion?  Alternatively I can change ssl3_SendClientHello
to explicitly set ss->ssl3.hs.ws to wait_server_hello earlier.

[agl, 2012-07-14 17:09:41]

LGTM with Ryan's suggested changes.

[wtc, 2012-07-17 01:15:52]

Please review patch set 3.  I made the changes that rsleevi
suggested, and included the patch file.  Thanks.

[Ryan Sleevi, 2012-07-17 01:19:13]

lgtm

[commit-bot: I haz the power, 2012-07-17 17:32:31]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/wtc@chromium.org/10777021/11001

[commit-bot: I haz the power, 2012-07-17 18:52:28]

Change committed as 147056