Cap the record layer version number of TLS ClientHello to TLS 1.0

net/third_party/nss/ssl/sslimpl.h

 /*
  * This file is PRIVATE to SSL and should be the first thing included by
  * any SSL implementation file.
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
@@ skipping 276 matching lines @@
 
     int         (*getpeername)(sslSocket *, PRNetAddr *);
     int         (*getsockname)(sslSocket *, PRNetAddr *);
 };
 
 /* Flags interpreted by ssl send functions. */
 #define ssl_SEND_FLAG_FORCE_INTO_BUFFER 0x40000000
 #define ssl_SEND_FLAG_NO_BUFFER         0x20000000
 #define ssl_SEND_FLAG_USE_EPOCH         0x10000000 /* DTLS only */
 #define ssl_SEND_FLAG_NO_RETRANSMIT     0x08000000 /* DTLS only */
+#define ssl_SEND_FLAG_CAP_RECORD_VERSION \
+                                        0x04000000

[Ryan Sleevi, 2012/07/13 21:20:53]

/* TLS only */ ?

 #define ssl_SEND_FLAG_MASK              0x7f000000
 
 /*
 ** A buffer object.
 */
 struct sslBufferStr {
     unsigned char *     buf;
     unsigned int        len;
     unsigned int        space;
 };
@@ skipping 1100 matching lines @@
 
 extern void      ssl3_SetAlwaysBlock(sslSocket *ss);
 
 extern SECStatus ssl_EnableNagleDelay(sslSocket *ss, PRBool enabled);
 
 extern PRBool    ssl3_CanFalseStart(sslSocket *ss);
 extern SECStatus
 ssl3_CompressMACEncryptRecord(ssl3CipherSpec *   cwSpec,
                               PRBool             isServer,
                               PRBool             isDTLS,
+                              PRBool             capsRecordVersion,
                               SSL3ContentType    type,
                               const SSL3Opaque * pIn,
                               PRUint32           contentLen,
                               sslBuffer *        wrBuf);
 extern PRInt32   ssl3_SendRecord(sslSocket *ss, DTLSEpoch epoch,
                                  SSL3ContentType type,
                                  const SSL3Opaque* pIn, PRInt32 nIn,
                                  PRInt32 flags);
 
 #ifdef NSS_ENABLE_ZLIB
@@ skipping 491 matching lines @@
 #elif defined(_WIN32_WCE)
 #define SSL_GETPID GetCurrentProcessId
 #elif defined(WIN32)
 extern int __cdecl _getpid(void);
 #define SSL_GETPID _getpid
 #else
 #define SSL_GETPID() 0
 #endif
 
 #endif /* __sslimpl_h_ */