From ff92fcfb907b6aa69bc7e35670797fc0440756bd Mon Sep 17 00:00:00 2001
From: Fabian Frank <fabian@pagefault.de>
Date: Thu, 6 Feb 2014 00:41:53 -0800
Subject: nss: prefer highest available TLS version

Offer TLSv1.0 to 1.2 by default, still fall back to SSLv3
if --tlsv1[.N] was not specified on the command line.
---
 lib/vtls/nss.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c
index 0d5f740d8..1c5ff4f3e 100644
--- a/lib/vtls/nss.c
+++ b/lib/vtls/nss.c
@@ -1193,8 +1193,9 @@ static CURLcode nss_init_sslver(SSLVersionRange *sslver,
     if(data->state.ssl_connect_retry) {
       infof(data, "TLS disabled due to previous handshake failure\n");
       sslver->max = SSL_LIBRARY_VERSION_3_0;
+      return CURLE_OK;
     }
-    return CURLE_OK;
+  /* intentional fall-through to default to highest TLS version if possible */
 
   case CURL_SSLVERSION_TLSv1:
     sslver->min = SSL_LIBRARY_VERSION_TLS_1_0;
-- 
cgit v1.2.3