From 877c4b8482976c45bc46077d7116ea44e8ff225b Mon Sep 17 00:00:00 2001 From: Masatoshi Kimura Date: Wed, 25 May 2016 19:36:57 +0900 Subject: [PATCH] Bug 1275252 - Deal with some TLS 1.3 intolerance. r=keeler --- security/manager/ssl/nsNSSIOLayer.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/security/manager/ssl/nsNSSIOLayer.cpp b/security/manager/ssl/nsNSSIOLayer.cpp index 1c50eb954bf7..6ba59dda69f6 100644 --- a/security/manager/ssl/nsNSSIOLayer.cpp +++ b/security/manager/ssl/nsNSSIOLayer.cpp @@ -1052,6 +1052,7 @@ uint32_t tlsIntoleranceTelemetryBucket(PRErrorCode err) case SSL_ERROR_DECODE_ERROR_ALERT: return 14; case PR_CONNECT_RESET_ERROR: return 16; case PR_END_OF_FILE_ERROR: return 17; + case SSL_ERROR_INTERNAL_ERROR_ALERT: return 18; default: return 0; } } @@ -2543,8 +2544,11 @@ nsSSLIOLayerSetOptions(PRFileDesc* fd, bool forSTARTTLS, if (range.max < maxEnabledVersion) { MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("[%p] nsSSLIOLayerSetOptions: enabling TLS_FALLBACK_SCSV\n", fd)); - if (SECSuccess != SSL_OptionSet(fd, SSL_ENABLE_FALLBACK_SCSV, true)) { - return NS_ERROR_FAILURE; + // Some servers will choke if we send the fallback SCSV with TLS 1.2. + if (range.max < SSL_LIBRARY_VERSION_TLS_1_2) { + if (SECSuccess != SSL_OptionSet(fd, SSL_ENABLE_FALLBACK_SCSV, true)) { + return NS_ERROR_FAILURE; + } } // tell NSS the max enabled version to make anti-downgrade effective if (SECSuccess != SSL_SetDowngradeCheckVersion(fd, maxEnabledVersion)) {