Update net/third_party/nss to NSS 3.15.4.

net/third_party/nss/patches/alpn.patch

 diff -pu a/nss/lib/ssl/ssl3con.c b/nss/lib/ssl/ssl3con.c
---- a/nss/lib/ssl/ssl3con.c     2013-07-31 14:17:20.669282120 -0700
-+++ b/nss/lib/ssl/ssl3con.c     2013-07-31 14:28:56.549496061 -0700
-@@ -9912,8 +9912,10 @@ ssl3_SendNextProto(sslSocket *ss)
+--- a/nss/lib/ssl/ssl3con.c     2014-01-03 19:41:44.744240754 -0800
++++ b/nss/lib/ssl/ssl3con.c     2014-01-03 19:41:52.234363230 -0800
+@@ -10458,8 +10458,10 @@ ssl3_SendNextProto(sslSocket *ss)
      int padding_len;
      static const unsigned char padding[32] = {0};
  
 -    if (ss->ssl3.nextProto.len == 0)
 +    if (ss->ssl3.nextProto.len == 0 ||
 +        ss->ssl3.nextProtoState == SSL_NEXT_PROTO_SELECTED) {
         return SECSuccess;
 +    }
  
      PORT_Assert( ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
      PORT_Assert( ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
 diff -pu a/nss/lib/ssl/ssl3ext.c b/nss/lib/ssl/ssl3ext.c
---- a/nss/lib/ssl/ssl3ext.c     2013-07-31 14:10:00.342814862 -0700
-+++ b/nss/lib/ssl/ssl3ext.c     2013-07-31 14:28:56.549496061 -0700
-@@ -53,8 +53,12 @@ static SECStatus ssl3_HandleRenegotiationInfoXtn(sslSocket *ss,
+--- a/nss/lib/ssl/ssl3ext.c     2014-01-03 19:39:28.442012014 -0800
++++ b/nss/lib/ssl/ssl3ext.c     2014-01-03 19:41:52.234363230 -0800
+@@ -52,8 +52,12 @@ static SECStatus ssl3_HandleRenegotiatio
      PRUint16 ex_type, SECItem *data);
  static SECStatus ssl3_ClientHandleNextProtoNegoXtn(sslSocket *ss,
                         PRUint16 ex_type, SECItem *data);
 +static SECStatus ssl3_ClientHandleAppProtoXtn(sslSocket *ss,
 +                       PRUint16 ex_type, SECItem *data);
  static SECStatus ssl3_ServerHandleNextProtoNegoXtn(sslSocket *ss,
                         PRUint16 ex_type, SECItem *data);
 +static PRInt32 ssl3_ClientSendAppProtoXtn(sslSocket *ss, PRBool append,
 +                                              PRUint32 maxBytes);
  static PRInt32 ssl3_ClientSendNextProtoNegoXtn(sslSocket *ss, PRBool append,
                                                PRUint32 maxBytes);
  static PRInt32 ssl3_SendUseSRTPXtn(sslSocket *ss, PRBool append,
-@@ -252,6 +256,7 @@ static const ssl3HelloExtensionHandler serverHelloHandlersTLS[] = {
+@@ -251,6 +255,7 @@ static const ssl3HelloExtensionHandler s
      { ssl_session_ticket_xtn,     &ssl3_ClientHandleSessionTicketXtn },
      { ssl_renegotiation_info_xtn, &ssl3_HandleRenegotiationInfoXtn },
      { ssl_next_proto_nego_xtn,    &ssl3_ClientHandleNextProtoNegoXtn },
 +    { ssl_app_layer_protocol_xtn, &ssl3_ClientHandleAppProtoXtn },
      { ssl_use_srtp_xtn,           &ssl3_HandleUseSRTPXtn },
      { ssl_channel_id_xtn,         &ssl3_ClientHandleChannelIDXtn },
      { ssl_cert_status_xtn,        &ssl3_ClientHandleStatusRequestXtn },
-@@ -271,18 +276,19 @@ static const ssl3HelloExtensionHandler serverHelloHandlersSSL3[] = {
+@@ -270,18 +275,19 @@ static const ssl3HelloExtensionHandler s
   */
  static const 
  ssl3HelloExtensionSender clientHelloSendersTLS[SSL_MAX_EXTENSIONS] = {
 -    { ssl_server_name_xtn,        &ssl3_SendServerNameXtn        },
 -    { ssl_renegotiation_info_xtn, &ssl3_SendRenegotiationInfoXtn },
 +    { ssl_server_name_xtn,            &ssl3_SendServerNameXtn        },
 +    { ssl_renegotiation_info_xtn,     &ssl3_SendRenegotiationInfoXtn },
  #ifdef NSS_ENABLE_ECC
 -    { ssl_elliptic_curves_xtn,    &ssl3_SendSupportedCurvesXtn },
 -    { ssl_ec_point_formats_xtn,   &ssl3_SendSupportedPointFormatsXtn },
 +    { ssl_elliptic_curves_xtn,        &ssl3_SendSupportedCurvesXtn },
 +    { ssl_ec_point_formats_xtn,       &ssl3_SendSupportedPointFormatsXtn },
  #endif
 -    { ssl_session_ticket_xtn,     &ssl3_SendSessionTicketXtn },
 -    { ssl_next_proto_nego_xtn,    &ssl3_ClientSendNextProtoNegoXtn },
 -    { ssl_use_srtp_xtn,           &ssl3_SendUseSRTPXtn },
 -    { ssl_channel_id_xtn,         &ssl3_ClientSendChannelIDXtn },
 -    { ssl_cert_status_xtn,        &ssl3_ClientSendStatusRequestXtn },
 -    { ssl_signature_algorithms_xtn, &ssl3_ClientSendSigAlgsXtn }
 +    { ssl_session_ticket_xtn,         &ssl3_SendSessionTicketXtn },
 +    { ssl_next_proto_nego_xtn,        &ssl3_ClientSendNextProtoNegoXtn },
 +    { ssl_app_layer_protocol_xtn,     &ssl3_ClientSendAppProtoXtn },
 +    { ssl_use_srtp_xtn,               &ssl3_SendUseSRTPXtn },
 +    { ssl_channel_id_xtn,             &ssl3_ClientSendChannelIDXtn },
 +    { ssl_cert_status_xtn,            &ssl3_ClientSendStatusRequestXtn },
 +    { ssl_signature_algorithms_xtn,   &ssl3_ClientSendSigAlgsXtn }
      /* any extra entries will appear as { 0, NULL }    */
  };
  
-@@ -606,6 +612,11 @@ ssl3_ClientHandleNextProtoNegoXtn(sslSocket *ss, PRUint16 ex_type,
+@@ -614,6 +620,11 @@ ssl3_ClientHandleNextProtoNegoXtn(sslSoc
  
      PORT_Assert(!ss->firstHsDone);
  
 +    if (ssl3_ExtensionNegotiated(ss, ssl_app_layer_protocol_xtn)) {
 +       PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
 +       return SECFailure;
 +    }
 +
      rv = ssl3_ValidateNextProtoNego(data->data, data->len);
      if (rv != SECSuccess)
         return rv;
-@@ -639,6 +650,44 @@ ssl3_ClientHandleNextProtoNegoXtn(sslSocket *ss, PRUint16 ex_type,
+@@ -647,6 +658,44 @@ ssl3_ClientHandleNextProtoNegoXtn(sslSoc
      return SECITEM_CopyItem(NULL, &ss->ssl3.nextProto, &result);
  }
  
 +static SECStatus
 +ssl3_ClientHandleAppProtoXtn(sslSocket *ss, PRUint16 ex_type, SECItem *data)
 +{
 +    const unsigned char* d = data->data;
 +    PRUint16 name_list_len;
 +    SECItem protocol_name;
 +
@@ skipping 24 matching lines @@
 +
 +    SECITEM_FreeItem(&ss->ssl3.nextProto, PR_FALSE);
 +    ss->ssl3.nextProtoState = SSL_NEXT_PROTO_SELECTED;
 +    ss->xtnData.negotiated[ss->xtnData.numNegotiated++] = ex_type;
 +    return SECITEM_CopyItem(NULL, &ss->ssl3.nextProto, &protocol_name);
 +}
 +
  static PRInt32
  ssl3_ClientSendNextProtoNegoXtn(sslSocket * ss, PRBool append,
                                 PRUint32 maxBytes)
-@@ -672,6 +721,70 @@ loser:
+@@ -680,6 +729,70 @@ loser:
      return -1;
  }
  
 +static PRInt32
 +ssl3_ClientSendAppProtoXtn(sslSocket * ss, PRBool append, PRUint32 maxBytes)
 +{
 +    PRInt32 extension_length;
 +    unsigned char *alpn_protos = NULL;
 +
 +    /* Renegotiations do not send this extension. */
@@ skipping 51 matching lines @@
 +loser:
 +    if (alpn_protos)
 +       PORT_Free(alpn_protos);
 +    return -1;
 +}
 +
  static SECStatus
  ssl3_ClientHandleChannelIDXtn(sslSocket *ss, PRUint16 ex_type,
                              SECItem *data)
 diff -pu a/nss/lib/ssl/ssl.h b/nss/lib/ssl/ssl.h
---- a/nss/lib/ssl/ssl.h 2013-07-31 14:10:35.113325316 -0700
-+++ b/nss/lib/ssl/ssl.h 2013-07-31 14:28:56.589496647 -0700
-@@ -203,6 +203,16 @@ SSL_IMPORT SECStatus SSL_SetNextProtoCal
+--- a/nss/lib/ssl/ssl.h 2014-01-03 19:40:03.522585625 -0800
++++ b/nss/lib/ssl/ssl.h 2014-01-03 19:41:52.234363230 -0800
+@@ -206,6 +206,16 @@ SSL_IMPORT SECStatus SSL_SetNextProtoCal
   * protocol in server-preference order. If no matching protocol is found it
   * selects the first supported protocol.
   *
 + * Using this function also allows the client to transparently support ALPN.
 + * The same set of protocols will be advertised via ALPN and, if the server
 + * uses ALPN to select a protocol, SSL_GetNextProto will return
 + * SSL_NEXT_PROTO_SELECTED as the state.
 + *
 + * Since NPN uses the first protocol as the fallback protocol, when sending an
 + * ALPN extension, the first protocol is moved to the end of the list. This
 + * indicates that the fallback protocol is the least preferred. The other
 + * protocols should be in preference order.
 + *
   * The supported protocols are specified in |data| in wire-format (8-bit
   * length-prefixed). For example: "\010http/1.1\006spdy/2". */
  SSL_IMPORT SECStatus SSL_SetNextProtoNego(PRFileDesc *fd,
-@@ -212,7 +217,8 @@ SSL_IMPORT SECStatus SSL_SetNextProtoNeg
+@@ -215,7 +225,8 @@ SSL_IMPORT SECStatus SSL_SetNextProtoNeg
  typedef enum SSLNextProtoState { 
    SSL_NEXT_PROTO_NO_SUPPORT = 0, /* No peer support                */
    SSL_NEXT_PROTO_NEGOTIATED = 1, /* Mutual agreement               */
 -  SSL_NEXT_PROTO_NO_OVERLAP = 2  /* No protocol overlap found      */
 +  SSL_NEXT_PROTO_NO_OVERLAP = 2, /* No protocol overlap found      */
 +  SSL_NEXT_PROTO_SELECTED   = 3  /* Server selected proto (ALPN)   */
  } SSLNextProtoState;
  
  /* SSL_GetNextProto can be used in the HandshakeCallback or any time after
 diff -pu a/nss/lib/ssl/sslt.h b/nss/lib/ssl/sslt.h
---- a/nss/lib/ssl/sslt.h        2013-07-31 14:13:43.806096237 -0700
-+++ b/nss/lib/ssl/sslt.h        2013-07-31 14:28:56.609496941 -0700
-@@ -195,12 +195,13 @@ typedef enum {
+--- a/nss/lib/ssl/sslt.h        2014-01-03 19:41:26.443941511 -0800
++++ b/nss/lib/ssl/sslt.h        2014-01-03 19:41:52.234363230 -0800
+@@ -200,12 +200,13 @@ typedef enum {
  #endif
      ssl_signature_algorithms_xtn     = 13,
      ssl_use_srtp_xtn                 = 14,
 +    ssl_app_layer_protocol_xtn       = 16,
      ssl_session_ticket_xtn           = 35,
      ssl_next_proto_nego_xtn          = 13172,
-     ssl_channel_id_xtn               = 30031,
+     ssl_channel_id_xtn               = 30032,
      ssl_renegotiation_info_xtn       = 0xff01  /* experimental number */
  } SSLExtensionType;
  
 -#define SSL_MAX_EXTENSIONS             10
 +#define SSL_MAX_EXTENSIONS             11
  
  #endif /* __sslt_h_ */