Allow SSL_HandshakeNegotiatedExtension to be called before the handshake

net/third_party/nss/patches/negotiatedextension.patch

Index: net/third_party/nss/patches/negotiatedextension.patch
===================================================================
--- net/third_party/nss/patches/negotiatedextension.patch	(revision 0)
+++ net/third_party/nss/patches/negotiatedextension.patch	(revision 0)
@@ -0,0 +1,45 @@
+Index: mozilla/security/nss/lib/ssl/sslreveal.c
+===================================================================
+RCS file: /cvsroot/mozilla/security/nss/lib/ssl/sslreveal.c,v
+retrieving revision 1.8
+diff -u -p -u -8 -r1.8 sslreveal.c
+--- mozilla/security/nss/lib/ssl/sslreveal.c	3 Aug 2010 18:48:45 -0000	1.8
++++ mozilla/security/nss/lib/ssl/sslreveal.c	25 Aug 2011 00:48:18 -0000
+@@ -106,36 +106,29 @@ SSL_RevealURL(PRFileDesc * fd)
+ SECStatus
+ SSL_HandshakeNegotiatedExtension(PRFileDesc * socket, 
+                                  SSLExtensionType extId,
+                                  PRBool *pYes)
+ {
+   /* some decisions derived from SSL_GetChannelInfo */
+   sslSocket * sslsocket = NULL;
+   SECStatus rv = SECFailure;
+-  PRBool enoughFirstHsDone = PR_FALSE;
+ 
+   if (!pYes)
+     return rv;
+ 
+   sslsocket = ssl_FindSocket(socket);
+   if (!sslsocket) {
+     SSL_DBG(("%d: SSL[%d]: bad socket in HandshakeNegotiatedExtension",
+              SSL_GETPID(), socket));
+     return rv;
+   }
+ 
+-  if (sslsocket->firstHsDone) {
+-    enoughFirstHsDone = PR_TRUE;
+-  } else if (sslsocket->ssl3.initialized && ssl3_CanFalseStart(sslsocket)) {
+-    enoughFirstHsDone = PR_TRUE;
+-  }
+-
+   /* according to public API SSL_GetChannelInfo, this doesn't need a lock */
+-  if (sslsocket->opt.useSecurity && enoughFirstHsDone) {
++  if (sslsocket->opt.useSecurity) {
+     if (sslsocket->ssl3.initialized) { /* SSL3 and TLS */
+       /* now we know this socket went through ssl3_InitState() and
+        * ss->xtnData got initialized, which is the only member accessed by
+        * ssl3_ExtensionNegotiated();
+        * Member xtnData appears to get accessed in functions that handle
+        * the handshake (hello messages and extension sending),
+        * therefore the handshake lock should be sufficient.
+        */