Add DTLS support to NSS, contributed by Eric Rescorla.

net/third_party/nss/ssl/sslsecur.c

Index: net/third_party/nss/ssl/sslsecur.c
===================================================================
--- net/third_party/nss/ssl/sslsecur.c	(revision 127709)
+++ net/third_party/nss/ssl/sslsecur.c	(working copy)
@@ -119,7 +119,7 @@
 	PORT_Assert(ss->opt.noLocks || !ssl_HaveRecvBufLock(ss));
 	PORT_Assert(ss->opt.noLocks || !ssl_HaveXmitBufLock(ss));
 	PORT_Assert(ss->opt.noLocks || !ssl_HaveSSL3HandshakeLock(ss));
-
+	
 	if (ss->handshake == 0) {
 	    /* Previous handshake finished. Switch to next one */
 	    ss->handshake = ss->nextHandshake;
@@ -563,7 +563,7 @@
     available = ss->gs.writeOffset - ss->gs.readOffset;
     if (available == 0) {
 	/* Get some more data */
-	if (ss->version >= SSL_LIBRARY_VERSION_3_0) {
+        if (ss->version >= SSL_LIBRARY_VERSION_3_0) {
 	    /* Wait for application data to arrive.  */
 	    rv = ssl3_GatherAppDataRecord(ss, 0);
 	} else {
@@ -615,6 +615,7 @@
     if (!(flags & PR_MSG_PEEK)) {
 	ss->gs.readOffset += amount;
     }
+    PORT_Assert(ss->gs.readOffset <= ss->gs.writeOffset);

[wtc, 2012/03/21 01:22:07]

Did you mean to add this assertion, or did you add it for
debugging and forget to remove it?

[ekr, 2012/03/21 01:36:40]

I suspect that I added it for debugging and forgot to remove it, but OTOH, it
seems like in fact it should be an invariant, right?

[wtc, 2012/03/21 02:12:01]

I am not familiar with this code, but I suspect this should
be an invariant because the code above does
    available = ss->gs.writeOffset - ss->gs.readOffset;
in two places and appears to assume available is >= 0.

Is this the best place to check this invariant?

     rv = amount;
 
     SSL_TRC(30, ("%d: SSL[%d]: amount=%d available=%d",