Add client-side support for the origin bound certificate TLS extension.

net/third_party/nss/ssl/sslimpl.h

Index: net/third_party/nss/ssl/sslimpl.h
===================================================================
--- net/third_party/nss/ssl/sslimpl.h	(revision 91902)
+++ net/third_party/nss/ssl/sslimpl.h	(working copy)
@@ -350,6 +350,8 @@
     unsigned int enableFalseStart       : 1;  /* 23 */
     unsigned int enableOCSPStapling     : 1;  /* 24 */
     unsigned int enableCachedInfo       : 1;  /* 25 */
+    unsigned int enableOBCerts          : 1;  /* 26 */
+

[wtc, 2011/07/13 01:17:15]

Delete this blank line.

 } sslOptions;
 
 typedef enum { sslHandshakingUndetermined = 0,
@@ -1568,10 +1570,14 @@
 			PRUint16 ex_type, SECItem *data);
 extern SECStatus ssl3_ClientHandleStatusRequestXtn(sslSocket *ss,
 			PRUint16 ex_type, SECItem *data);
+extern SECStatus ssl3_ClientHandleOBCertXtn(sslSocket *ss,
+			PRUint16 ex_type, SECItem *data);
 extern SECStatus ssl3_ServerHandleSessionTicketXtn(sslSocket *ss,
 			PRUint16 ex_type, SECItem *data);
 extern SECStatus ssl3_ServerHandleNextProtoNegoXtn(sslSocket *ss,
 			PRUint16 ex_type, SECItem *data);
+extern SECStatus ssl3_ServerHandleOBCertXtn(sslSocket *ss,
+			PRUint16 ex_type, SECItem *data);
 
 /* ClientHello and ServerHello extension senders.
  * Note that not all extension senders are exposed here; only those that
@@ -1589,6 +1595,10 @@
                      PRUint32 maxBytes);
 extern PRInt32 ssl3_ClientSendCachedInfoXtn(sslSocket *ss, PRBool append,
                      PRUint32 maxBytes);

[wtc, 2011/07/13 01:17:15]

This reminds me that you should merge your upstream NSS
cached info extension patch to Chromium, which has the
server cached info extension sender.

+extern PRInt32 ssl3_ClientSendOBCertXtn(sslSocket *ss, PRBool append,
+			PRUint32 maxBytes);
+extern PRInt32 ssl3_ServerSendOBCertXtn(sslSocket *ss, PRBool append,
+			PRUint32 maxBytes);
 
 /* Assigns new cert, cert chain and keys to ss->serverCerts
  * struct. If certChain is NULL, tries to find one. Aborts if