Make SSL False Start work with asynchronous certificate validation

net/third_party/nss/ssl/sslauth.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "cert.h"
 #include "secitem.h"
 #include "ssl.h"
 #include "sslimpl.h"
 #include "sslproto.h"
 #include "pk11func.h"
 #include "ocsp.h"
@@ skipping 82 matching lines @@
 
 
 /* NEED LOCKS IN HERE.  */
 SECStatus
 SSL_SecurityStatus(PRFileDesc *fd, int *op, char **cp, int *kp0, int *kp1,
                    char **ip, char **sp)
 {
     sslSocket *ss;
     const char *cipherName;
     PRBool isDes = PR_FALSE;
-    PRBool enoughFirstHsDone = PR_FALSE;
 
     ss = ssl_FindSocket(fd);
     if (!ss) {
         SSL_DBG(("%d: SSL[%d]: bad socket in SecurityStatus",
                  SSL_GETPID(), fd));
         return SECFailure;
     }
 
     if (cp) *cp = 0;
     if (kp0) *kp0 = 0;
     if (kp1) *kp1 = 0;
     if (ip) *ip = 0;
     if (sp) *sp = 0;
     if (op) {
         *op = SSL_SECURITY_STATUS_OFF;
     }
 
-    if (ss->firstHsDone) {
-        enoughFirstHsDone = PR_TRUE;
-    } else if (ss->version >= SSL_LIBRARY_VERSION_3_0 &&
-               ssl3_CanFalseStart(ss)) {
-        enoughFirstHsDone = PR_TRUE;
-    }
-
-    if (ss->opt.useSecurity && enoughFirstHsDone) {
+    if (ss->opt.useSecurity && ss->enoughFirstHsDone) {
         if (ss->version < SSL_LIBRARY_VERSION_3_0) {
             cipherName = ssl_cipherName[ss->sec.cipherType];
         } else {
             cipherName = ssl3_cipherName[ss->sec.cipherType];
         }
         PORT_Assert(cipherName);
         if (cipherName) {
             if (PORT_Strstr(cipherName, "DES")) isDes = PR_TRUE;
 
             if (cp) {
@@ skipping 189 matching lines @@
     hostname = ss->url;
     if (hostname && hostname[0])
         rv = CERT_VerifyCertName(ss->sec.peerCert, hostname);
     else 
         rv = SECFailure;
     if (rv != SECSuccess)
         PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
 
     return rv;
 }