Add DTLS support to NSS, contributed by Eric Rescorla.

net/third_party/nss/ssl/sslsecur.c

 /*
  * Various SSL functions.
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 597 matching lines @@
         SSL_TRC(30, ("%d: SSL[%d]: partial data ready, available=%d",
                      SSL_GETPID(), ss->fd, available));
     }
 
     /* Dole out clear data to reader */
     amount = PR_MIN(len, available);
     PORT_Memcpy(out, ss->gs.buf.buf + ss->gs.readOffset, amount);
     if (!(flags & PR_MSG_PEEK)) {
         ss->gs.readOffset += amount;
     }
+    PORT_Assert(ss->gs.readOffset <= ss->gs.writeOffset);

[wtc, 2012/03/21 23:12:16]

Nit: should we assert the invariant before the return
statement?  Or is it only safe to asser the invariant when
the function returns successfully?

I can see here is a good place to assert because we just
updated ss->gs.readOffset.

[ekr, 2012/03/22 15:07:17]

I'm not sure about the first question, but your last statement seems plausible.

     rv = amount;
 
     SSL_TRC(30, ("%d: SSL[%d]: amount=%d available=%d",
                  SSL_GETPID(), ss->fd, amount, available));
     PRINT_BUF(4, (ss, "DoRecv receiving plaintext:", out, amount));
 
 done:
     ssl_ReleaseRecvBufLock(ss);
     return rv;
 }
@@ skipping 957 matching lines @@
     if (!ss) {
         SSL_DBG(("%d: SSL[%d]: bad socket in SNISocketConfigHook",
                  SSL_GETPID(), fd));
         return SECFailure;
     }
 
     ss->sniSocketConfig = func;
     ss->sniSocketConfigArg = arg;
     return SECSuccess;
 }