Update NSS to 3.38

- Added HACL*Poly1305 32-bit (INRIA/Microsoft)
- Updated to final TLS 1.3 draft version (28)
- Removed TLS 1.3 prerelease draft limit check
- Removed NPN code
- Enabled dev/urandom-only RNG on Linux with NSS_SEED_ONLY_DEV_URANDOM for non-standard environments
- Fixed several bugs with TLS 1.3 negotiation
- Updated internal certificate store
- Added support for the TLS Record Size Limit Extension.
- Fixed CVE-2018-0495
- Various security fixes in the ASN.1 code.

security/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc

@@ -214,6 +214,98 @@ TEST_F(Tls13CompatTest, EnabledHrrZeroRtt) {
   CheckForCompatHandshake();
 }
 
+class TlsSessionIDEchoFilter : public TlsHandshakeFilter {
+ public:
+  TlsSessionIDEchoFilter(const std::shared_ptr<TlsAgent>& a)
+      : TlsHandshakeFilter(
+            a, {kTlsHandshakeClientHello, kTlsHandshakeServerHello}) {}
+
+ protected:
+  virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
+                                               const DataBuffer& input,
+                                               DataBuffer* output) {
+    TlsParser parser(input);
+
+    // Skip version + random.
+    EXPECT_TRUE(parser.Skip(2 + 32));
+
+    // Capture CH.legacy_session_id.
+    if (header.handshake_type() == kTlsHandshakeClientHello) {
+      EXPECT_TRUE(parser.ReadVariable(&sid_, 1));
+      return KEEP;
+    }
+
+    // Check that server sends one too.
+    uint32_t sid_len = 0;
+    EXPECT_TRUE(parser.Read(&sid_len, 1));
+    EXPECT_EQ(sid_len, sid_.len());
+
+    // Echo the one we captured.
+    *output = input;
+    output->Write(parser.consumed(), sid_.data(), sid_.len());
+
+    return CHANGE;
+  }
+
+ private:
+  DataBuffer sid_;
+};
+
+TEST_F(TlsConnectTest, EchoTLS13CompatibilitySessionID) {
+  ConfigureSessionCache(RESUME_SESSIONID, RESUME_SESSIONID);
+
+  client_->SetOption(SSL_ENABLE_TLS13_COMPAT_MODE, PR_TRUE);
+
+  client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
+                           SSL_LIBRARY_VERSION_TLS_1_3);
+
+  server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
+                           SSL_LIBRARY_VERSION_TLS_1_2);
+
+  server_->SetFilter(MakeTlsFilter<TlsSessionIDEchoFilter>(client_));
+  ConnectExpectAlert(client_, kTlsAlertIllegalParameter);
+
+  client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_SERVER_HELLO);
+  server_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
+}
+
+class TlsSessionIDInjectFilter : public TlsHandshakeFilter {
+ public:
+  TlsSessionIDInjectFilter(const std::shared_ptr<TlsAgent>& a)
+      : TlsHandshakeFilter(a, {kTlsHandshakeServerHello}) {}
+
+ protected:
+  virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
+                                               const DataBuffer& input,
+                                               DataBuffer* output) {
+    TlsParser parser(input);
+
+    // Skip version + random.
+    EXPECT_TRUE(parser.Skip(2 + 32));
+
+    *output = input;
+
+    // Inject a Session ID.
+    const uint8_t fake_sid[SSL3_SESSIONID_BYTES] = {0xff};
+    output->Write(parser.consumed(), sizeof(fake_sid), 1);
+    output->Splice(fake_sid, sizeof(fake_sid), parser.consumed() + 1, 0);
+
+    return CHANGE;
+  }
+};
+
+TEST_F(TlsConnectTest, TLS13NonCompatModeSessionID) {
+  ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
+
+  MakeTlsFilter<TlsSessionIDInjectFilter>(server_);
+  client_->ExpectSendAlert(kTlsAlertIllegalParameter);
+  server_->ExpectSendAlert(kTlsAlertBadRecordMac);
+  ConnectExpectFail();
+
+  client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_SERVER_HELLO);
+  server_->CheckErrorCode(SSL_ERROR_BAD_MAC_READ);
+}
+
 static const uint8_t kCannedCcs[] = {
     kTlsChangeCipherSpecType,
     SSL_LIBRARY_VERSION_TLS_1_2 >> 8,