Add DTLS support to NSS, contributed by Eric Rescorla.

net/third_party/nss/ssl/derive.c

 /*
  * Key Derivation that doesn't use PKCS11
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 565 matching lines @@
  * specified cert make sure the extract operation is attempted from the slot
  * where the private key resides.
  * If MS can be extracted for all ciphers, (*pcanbypass) is set to TRUE and
  * SECSuccess is returned. In all other cases but one (*pcanbypass) is
  * set to FALSE and SECFailure is returned.
  * In that last case Derive() has been called successfully but the MS is null, 
  * CanBypass sets (*pcanbypass) to FALSE and returns SECSuccess indicating the
  * arguments were all valid but the slot cannot be bypassed.
  */
 
+/* TODO: Add a SSL_CBP_TLS1_1 mask here */

[Ryan Sleevi, 2012/03/22 22:26:37]

Should this be XXX, per NSS style?

I think the TODOs have been introduced by me or agl.

[ekr, 2012/03/23 12:46:41]

I'm the one who added this TODO, but I'll leave this to the people who
understand the style better.

+   
 SECStatus 
 SSL_CanBypass(CERTCertificate *cert, SECKEYPrivateKey *srvPrivkey,
               PRUint32 protocolmask, PRUint16 *ciphersuites, int nsuites,
               PRBool *pcanbypass, void *pwArg)
 {   SECStatus         rv;
     int               i;
     PRUint16          suite;
     PK11SymKey *      pms = NULL;
     SECKEYPublicKey * srvPubkey = NULL;
     KeyType           privKeytype;
@@ skipping 276 matching lines @@
 
     if (srvPubkey) {
         SECKEY_DestroyPublicKey(srvPubkey);
         srvPubkey = NULL;
     }
 
 
     return rv;
 }