Update the NSS patches. Add snapstart2.patch and peercertchain.patch....

net/third_party/nss/ssl/sslimpl.h

 /*
  * This file is PRIVATE to SSL and should be the first thing included by
  * any SSL implementation file.
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
@@ skipping 455 matching lines @@
                                const unsigned char *in,
                                int                  inlen);
 typedef SECStatus (*SSLCompressor)(void *               context,
                                    unsigned char *      out,
                                    int *                outlen,
                                    int                  maxout,
                                    const unsigned char *in,
                                    int                  inlen);
 typedef SECStatus (*SSLDestroy)(void *context, PRBool freeit);
 
+#ifdef NSS_PLATFORM_CLIENT_AUTH
+#if defined(XP_WIN32)
+typedef PCERT_KEY_CONTEXT PlatformKey;
+#elif defined(XP_MACOSX)
+typedef SecKeyRef PlatformKey;
+#else
+typedef void *PlatformKey;
+#endif
+#endif
+
 
 
 /*
 ** ssl3State and CipherSpec structs
 */
 
 /* The SSL bulk cipher definition */
 typedef enum {
     cipher_null,
     cipher_rc4, 
@@ skipping 338 matching lines @@
     TLSSnapStartType      snapStartType;
     /* When we perform a Snap Start handshake, we hash our ClientHello as if
      * the Snap Start extension wasn't included. However, if the server rejects
      * our Snap Start attempt, then it will hash the whole ClientHello. Thus we
      * store the original ClientHello that we sent in case we need to reset our
      * Finished hash to cover it. */
     SECItem               origClientHello;
 #ifdef NSS_ENABLE_ECC
     PRUint32              negotiatedECCurves; /* bit mask */
 #endif /* NSS_ENABLE_ECC */
     PRBool                nextProtoNego;/* Our peer has sent this extension */

[wtc, 2011/02/17 00:04:29]

Note that this line comes from nextproto.patch, which causes a conflict with
clientauth.patch that I generated with CVS.

Someone with git prowess can solve this problem better.  I just moved the
NSS_PLATFORM_CLIENT_AUTH code elsewhere.

 } SSL3HandshakeState;
 
-#ifdef NSS_PLATFORM_CLIENT_AUTH
-#if defined(XP_WIN32)
-typedef PCERT_KEY_CONTEXT PlatformKey;
-#elif defined(XP_MACOSX)
-typedef SecKeyRef PlatformKey;
-#else
-typedef void *PlatformKey;
-#endif
-#endif
 
 
 /*
 ** This is the "ssl3" struct, as in "ss->ssl3".
 ** note:
 ** usually,   crSpec == cwSpec and prSpec == pwSpec.  
 ** Sometimes, crSpec == pwSpec and prSpec == cwSpec.
 ** But there are never more than 2 actual specs.  
 ** No spec must ever be modified if either "current" pointer points to it.
 */
@@ skipping 928 matching lines @@
 #elif defined(_WIN32_WCE)
 #define SSL_GETPID GetCurrentProcessId
 #elif defined(WIN32)
 extern int __cdecl _getpid(void);
 #define SSL_GETPID _getpid
 #else
 #define SSL_GETPID() 0
 #endif
 
 #endif /* __sslimpl_h_ */