ssl_SecureSend should not do handshake when the handshake wait state is...

net/third_party/nss/ssl/sslsecur.c

 /*
  * Various SSL functions.
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 130 matching lines @@
                 (!ss->firstHsDone) &&              /* only first time */
                 (ss->version < SSL_LIBRARY_VERSION_3_0)) {  /* not ssl3 */
                 ss->firstHsDone     = PR_TRUE;
                 (ss->handshakeCallback)(ss->fd, ss->handshakeCallbackData);
             }
             ss->firstHsDone         = PR_TRUE;
             ss->gs.writeOffset = 0;
             ss->gs.readOffset  = 0;
             break;
         }
-        if (ss->version >= SSL_LIBRARY_VERSION_3_0 &&
-            (ss->ssl3.hs.ws == wait_change_cipher ||
-             ss->ssl3.hs.ws == wait_new_session_ticket) &&
-            ssl3_CanFalseStart(ss)) {
-            break;
-        }
         rv = (*ss->handshake)(ss);
         ++loopCount;
     /* This code must continue to loop on SECWouldBlock, 
      * or any positive value.   See XXX_1 comments.
      */
     } while (rv != SECFailure);         /* was (rv >= 0); XXX_1 */
 
     PORT_Assert(ss->opt.noLocks || !ssl_HaveRecvBufLock(ss));
     PORT_Assert(ss->opt.noLocks || !ssl_HaveXmitBufLock(ss));
 
@@ skipping 1031 matching lines @@
     }
     ssl_ReleaseXmitBufLock(ss);
     if (rv < 0) {
         goto done;
     }
 
     if (len > 0) 
         ss->writerThread = PR_GetCurrentThread();
     /* If any of these is non-zero, the initial handshake is not done. */
     if (!ss->firstHsDone) {
+        PRBool canFalseStart = PR_FALSE;
         ssl_Get1stHandshakeLock(ss);
-        if (ss->handshake || ss->nextHandshake || ss->securityHandshake) {
+        if (ss->version >= SSL_LIBRARY_VERSION_3_0 &&
+            (ss->ssl3.hs.ws == wait_change_cipher ||
+             ss->ssl3.hs.ws == wait_finished ||
+             ss->ssl3.hs.ws == wait_new_session_ticket) &&
+            ssl3_CanFalseStart(ss)) {
+            canFalseStart = PR_TRUE;
+        }
+        if (!canFalseStart &&
+            (ss->handshake || ss->nextHandshake || ss->securityHandshake)) {
             rv = ssl_Do1stHandshake(ss);
         }
         ssl_Release1stHandshakeLock(ss);
     }
     if (rv < 0) {
         ss->writerThread = NULL;
         goto done;
     }
 
     /* Check for zero length writes after we do housekeeping so we make forward
@@ skipping 307 matching lines @@
     if (!ss) {
         SSL_DBG(("%d: SSL[%d]: bad socket in SNISocketConfigHook",
                  SSL_GETPID(), fd));
         return SECFailure;
     }
 
     ss->sniSocketConfig = func;
     ss->sniSocketConfigArg = arg;
     return SECSuccess;
 }