[AC 21.5] Fix NSS 3.24.0 failure

APPROVE COMMIT 21.5

With the introduction of NSS 3.24.0, the NSS code in src/tls.c started
failing on takeoff, because the options to disable SSLv2 and the
SSLv2-compatible hello both still compiled, but failed at runtime.
The option to turn those *on* was removed, therefore the option to
turn them *off* also did nothing but return an error.  Don't try to do
any SSLv2 manipulations on such versions.

diff -r cbcd8cbdce6b src/ChangeLog
--- a/src/ChangeLog Tue May 31 23:06:28 2016 +0100
+++ b/src/ChangeLog Tue May 31 22:21:06 2016 -0600
@@ -1,3 +1,8 @@
+2016-05-31  Jerry James  <[email protected]>
+
+ * tls.c (init_tls): Do no attempt to disable SSLv2 with NSS 3.24.0
+ and newer, where SSLv2 cannot be enabled.
+
 2016-05-31  Aidan Kehoe  <[email protected]>

  * sequence.c (Freduce):
diff -r cbcd8cbdce6b src/tls.c
--- a/src/tls.c Tue May 31 23:06:28 2016 +0100
+++ b/src/tls.c Tue May 31 22:21:06 2016 -0600
@@ -370,12 +370,14 @@
   /* Set options on the model socket */
   if (SSL_OptionSet (nss_model, SSL_SECURITY, PR_TRUE) != SECSuccess)
     signal_error (Qtls_error, "NSS cannot enable model socket", NSS_ERRSTR);
+#if NSS_VMAJOR < 3 || (NSS_VMAJOR == 3 && NSS_VMINOR < 24)
   if (SSL_OptionSet (nss_model, SSL_ENABLE_SSL2, PR_FALSE) != SECSuccess)
     signal_error (Qtls_error, "NSS unable to disable SSLv2", NSS_ERRSTR);
   if (SSL_OptionSet (nss_model, SSL_V2_COMPATIBLE_HELLO, PR_FALSE)
       != SECSuccess)
     signal_error (Qtls_error, "NSS unable to disable SSLv2 handshake",
   NSS_ERRSTR);
+#endif
   if (SSL_OptionSet (nss_model, SSL_ENABLE_DEFLATE, PR_FALSE) != SECSuccess)
     signal_error (Qtls_error, "NSS unable to disable deflate", NSS_ERRSTR);
   if (SSL_OptionSet (nss_model, SSL_HANDSHAKE_AS_CLIENT, PR_TRUE)

-- 
Jerry James
http://www.jamezone.org/