1 diff --git a/nss/lib/ssl/ssl3ext.c b/nss/lib/ssl/ssl3ext.c 2 index 6f3fe2f..523e49a 100644 3 --- a/nss/lib/ssl/ssl3ext.c 4 +++ b/nss/lib/ssl/ssl3ext.c 5 @@ -295,9 +295,12 @@ ssl3HelloExtensionSender clientHelloSendersTLS[SSL_MAX_EXTENSIONS] = { 6 { ssl_use_srtp_xtn, &ssl3_SendUseSRTPXtn }, 7 { ssl_channel_id_xtn, &ssl3_ClientSendChannelIDXtn }, 8 { ssl_cert_status_xtn, &ssl3_ClientSendStatusRequestXtn }, 9 - { ssl_signature_algorithms_xtn, &ssl3_ClientSendSigAlgsXtn }, 10 { ssl_signed_certificate_timestamp_xtn, 11 - &ssl3_ClientSendSignedCertTimestampXtn } 12 + &ssl3_ClientSendSignedCertTimestampXtn }, 13 + /* WebSphere Application Server 7.0 is intolerant to the last extension 14 + * being zero-length. It is not intolerant of TLS 1.2, so move 15 + * signature_algorithms to the end. */ 16 + { ssl_signature_algorithms_xtn, &ssl3_ClientSendSigAlgsXtn } 17 /* any extra entries will appear as { 0, NULL } */ 18 }; 19 20 @@ -2347,9 +2350,11 @@ ssl3_CalculatePaddingExtensionLength(unsigned int clientHelloLength) 21 } 22 23 extensionLength = 512 - recordLength; 24 - /* Extensions take at least four bytes to encode. */ 25 - if (extensionLength < 4) { 26 - extensionLength = 4; 27 + /* Extensions take at least four bytes to encode. Always include at least 28 + * one byte of data if including the extension. WebSphere Application Server 29 + * 7.0 is intolerant to the last extension being zero-length. */ 30 + if (extensionLength < 4 + 1) { 31 + extensionLength = 4 + 1; 32 } 33 34 return extensionLength; 35
