Make SSL False Start work with asynchronous certificate validation

net/third_party/nss/ssl/sslsock.c

Index: net/third_party/nss/ssl/sslsock.c
===================================================================
--- net/third_party/nss/ssl/sslsock.c	(revision 227672)
+++ net/third_party/nss/ssl/sslsock.c	(working copy)
@@ -366,6 +366,8 @@
 	    ss->badCertArg            = os->badCertArg;
 	    ss->handshakeCallback     = os->handshakeCallback;
 	    ss->handshakeCallbackData = os->handshakeCallbackData;
+	    ss->canFalseStartCallback = os->canFalseStartCallback;
+	    ss->canFalseStartCallbackData = os->canFalseStartCallbackData;
 	    ss->pkcs11PinArg          = os->pkcs11PinArg;
 	    ss->getChannelID          = os->getChannelID;
 	    ss->getChannelIDArg       = os->getChannelIDArg;
@@ -2457,10 +2459,14 @@
 	    } else if (new_flags & PR_POLL_WRITE) {
 		    /* The caller is trying to write, but the handshake is 
 		    ** blocked waiting for data to read, and the first 
-		    ** handshake has been sent.  so do NOT to poll on write.
+		    ** handshake has been sent.  So do NOT to poll on write
+		    ** unless we did false start.
 		    */
-		    new_flags ^=  PR_POLL_WRITE;   /* don't select on write. */
-		    new_flags |=  PR_POLL_READ;	   /* do    select on read. */
+		    if (!(ss->version >= SSL_LIBRARY_VERSION_3_0 &&
+			ss->ssl3.hs.canFalseStart)) {

[wtc, 2013/10/17 00:10:53]

I think we can remove the ss->version >= SSL_LIBRARY_VERSION_3_0 check because
ss->ssl3.hs.canFalseStart can only be true if ss->version >=
SSL_LIBRARY_VERSION_3_0.

[briansmith, 2013/10/17 01:42:40]

I don't know if we can rely on ss->ssl3.hs being initialized correctly for the
SSL 2.0 case though, since ssl3_init was not called.

[wtc, 2013/10/17 15:28:14]

I see. I missed that.

+			new_flags ^= PR_POLL_WRITE; /* don't select on write. */
+		    }
+		    new_flags |= PR_POLL_READ;      /* do    select on read. */
 	    }
 	}
     } else if ((new_flags & PR_POLL_READ) && (SSL_DataPending(fd) > 0)) {