net: False Start only for NPN capable servers.

net/third_party/nss/ssl/ssl3con.c

Index: net/third_party/nss/ssl/ssl3con.c
diff --git a/net/third_party/nss/ssl/ssl3con.c b/net/third_party/nss/ssl/ssl3con.c
index e8a7f01782d761aed89bf0c40686ca5d16fa0242..d0eb0425d48522c9c3d7bb2e67a5ef18cf9cb3f4 100644
--- a/net/third_party/nss/ssl/ssl3con.c
+++ b/net/third_party/nss/ssl/ssl3con.c
@@ -6086,6 +6086,7 @@ ssl3_CanFalseStart(sslSocket *ss) {
     rv = ss->opt.enableFalseStart &&
 	 !ss->sec.isServer &&
 	 !ss->ssl3.hs.isResuming &&
+	 ssl3_ExtensionNegotiated(ss, ssl_next_proto_nego_xtn) &&

[wtc, 2012/04/17 22:46:09]

If we do it this way, we need to update the documentation
of SSL_ENABLE_FALSE_START in the NSS ssl.h header file.

Alternatively, NSS can let applications control this.
Chrome would call
SSL_HandshakeNegotiatedExtension(fd, ssl_next_proto_nego_xtn)
in SSLClientSocketNSS::OwnAuthCertHandler, and call
SSL_OptionSet(fd, SSL_ENABLE_FALSE_START, PR_FALSE) to
set ss->opt.enableFalseStart to PR_FALSE.

 	 ss->ssl3.cwSpec &&
 	 ss->ssl3.cwSpec->cipher_def->secret_key_size >= 10 &&
 	(ss->ssl3.hs.kea_def->exchKeyType == ssl_kea_rsa ||