Disable Nagle on Linux and TLS cut through support

net/third_party/nss/ssl/ssl3con.c

 /*
  * SSL3 Protocol
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 5639 matching lines @@
             ssl_GetRecvBufLock(ss);
             if (ss->ssl3.hs.msgState.buf != NULL) {
                 rv = ssl3_HandleRecord(ss, NULL, &ss->gs.buf);
             }
             ssl_ReleaseRecvBufLock(ss);
         }
     }
     return rv;
 }
 
-
+PRBool
+ssl3_CanFalseStart(sslSocket *ss) {
+    return ss->opt.enableFalseStart &&
+           !ss->sec.isServer &&
+           !ss->ssl3.hs.isResuming &&
+           ss->ssl3.cwSpec &&
+           ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10 &&
+           ss->ssl3.hs.kea_def->exchKeyType == kt_rsa;

[wtc, 2010/02/20 00:39:51]

I believe you should compare this with ssl_kea_rsa.  See

http://mxr.mozilla.org/security/source/security/nss/lib/ssl/sslimpl.h#666
http://mxr.mozilla.org/security/source/security/nss/lib/ssl/sslimpl.h#72
http://mxr.mozilla.org/security/source/security/nss/lib/ssl/sslt.h#70

See also
http://mxr.mozilla.org/security/source/security/nss/lib/ssl/sslt.h#80
which says kt_rsa is for backward compatibility.

+}
 
 /* Called from ssl3_HandleHandshakeMessage() when it has deciphered a complete
  * ssl3 Server Hello Done message.
  * Caller must hold Handshake and RecvBuf locks.
  */
 static SECStatus
 ssl3_HandleServerHelloDone(sslSocket *ss)
 {
     SECStatus     rv;
     SSL3WaitState ws          = ss->ssl3.hs.ws;
@@ skipping 57 matching lines @@
     if (rv != SECSuccess) {
         goto loser;     /* err code was set. */
     }
 
     ssl_ReleaseXmitBufLock(ss);         /*******************************/
 
     if (ssl3_ExtensionNegotiated(ss, ssl_session_ticket_xtn))
         ss->ssl3.hs.ws = wait_new_session_ticket;
     else
         ss->ssl3.hs.ws = wait_change_cipher;
+
+    /* Do the handshake callback for sslv3 here. */
+    if (ss->handshakeCallback != NULL && ssl3_CanFalseStart(ss)) {
+        (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
+    }
+
     return SECSuccess;
 
 loser:
     ssl_ReleaseXmitBufLock(ss);
     return rv;
 }
 
 /*
  * Routines used by servers
  */
@@ skipping 2754 matching lines @@
         /* If the wrap failed, we don't cache the sid.
          * The connection continues normally however.
          */
         if (rv == SECSuccess) {
             (*ss->sec.cache)(sid);
         }
     }
     ss->ssl3.hs.ws = idle_handshake;
 
     /* Do the handshake callback for sslv3 here. */
-    if (ss->handshakeCallback != NULL) {
+    if (ss->handshakeCallback != NULL && !ssl3_CanFalseStart(ss)) {
         (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
     }
 
     return SECSuccess;
 }
 
 /* Called from ssl3_HandleHandshake() when it has gathered a complete ssl3
  * hanshake message.
  * Caller must hold Handshake and RecvBuf locks.
  */
@@ skipping 976 matching lines @@
 
     ss->ssl3.initialized = PR_FALSE;
 
     if (ss->ssl3.nextProto.data) {
         PORT_Free(ss->ssl3.nextProto.data);
         ss->ssl3.nextProto.data = NULL;
     }
 }
 
 /* End of ssl3con.c */