net: add NSS support for RFC 5705

net/third_party/nss/ssl/ssl.h

 /*
  * This file contains prototypes for the public SSL functions.
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 668 matching lines @@
 ** Caller supplies the info struct.  Function fills it in.
 */
 SSL_IMPORT SECStatus SSL_GetChannelInfo(PRFileDesc *fd, SSLChannelInfo *info,
                                         PRUintn len);
 SSL_IMPORT SECStatus SSL_GetCipherSuiteInfo(PRUint16 cipherSuite, 
                                         SSLCipherSuiteInfo *info, PRUintn len);
 
 /* Returnes negotiated through SNI host info. */
 SSL_IMPORT SECItem *SSL_GetNegotiatedHostInfo(PRFileDesc *fd);
 
+/* Export keying material according to RFC 5705.
+** fd must correspond to a TLS 1.0 or higher socket and out must
+** already be allocated.
+*/
+SSL_IMPORT SECStatus SSL_ExportKeyingMaterial(PRFileDesc *fd,
+                                              const char *label,
+                                              const unsigned char *context,
+                                              unsigned int contextlen,
+                                              unsigned char *out,
+                                              unsigned int outlen);

[wtc, 2011/07/22 17:33:17]

I suggest that we specify the label as
    const char *label,
    unsigned int labellen,

Not requiring the string be null-terminated is more
friendly to std::string and StringPiece.

Note: the RFC defines labels as:

   Labels here have the same definition as in TLS, i.e., an ASCII string
   with no terminating NULL.

The RFC also recommends that labels begin with "EXPORTER"
or "EXPERIMENTAL" (for private use).

+
 /*
 ** Return a new reference to the certificate that was most recently sent
 ** to the peer on this SSL/TLS connection, or NULL if none has been sent.
 */
 SSL_IMPORT CERTCertificate * SSL_LocalCertificate(PRFileDesc *fd);
 
 /* Test an SSL configuration to see if  SSL_BYPASS_PKCS11 can be turned on.
 ** Check the key exchange algorithm for each cipher in the list to see if
 ** a master secret key can be extracted after being derived with the mechanism
 ** required by the protocolmask argument. If the KEA will use keys from the
@@ skipping 32 matching lines @@
                                                       SSLExtensionType extId,
                                                       PRBool *yes);
 
 SSL_IMPORT SECStatus SSL_HandshakeResumedSession(PRFileDesc *fd,
                                                  PRBool *last_handshake_resumed);
 
 
 SEC_END_PROTOS
 
 #endif /* __ssl_h_ */