Support TLS Channel IDs in NSS

net/third_party/nss/ssl/ssl.h

Index: net/third_party/nss/ssl/ssl.h
diff --git a/net/third_party/nss/ssl/ssl.h b/net/third_party/nss/ssl/ssl.h
index 1368e2f730a6f6fa51aa29ceb2d55daeb05ddf90..09e4fe91aa4aeaad13a81e143eca3790f54546e4 100644
--- a/net/third_party/nss/ssl/ssl.h
+++ b/net/third_party/nss/ssl/ssl.h
@@ -945,6 +945,25 @@ SSL_IMPORT SECStatus SSL_HandshakeNegotiatedExtension(PRFileDesc * socket,
 SSL_IMPORT SECStatus SSL_HandshakeResumedSession(PRFileDesc *fd,
                                                  PRBool *last_handshake_resumed);
 
+/* See SSL_SetClientChannelIDCallback for usage. The callback must return
+ * SECFailure or SECSuccess (not SECWouldBlock). On SECSuccess, the callback
+ * must have written a P-256 key pair to |out_public_key| and

[wtc, 2012/05/31 00:36:32]

Nit: add "EC" after "P-256"

Nit: add '*' to |out_public_key| and |out_private_key|

[agl, 2012/05/31 17:19:53]

Done.

+ * |out_private_key|. */
+typedef SECStatus (PR_CALLBACK *SSLClientChannelIDCallback)(
+    void *arg,
+    PRFileDesc *fd,
+    SECKEYPublicKey **out_public_key,
+    SECKEYPrivateKey **out_private_key);
+
+/* SSL_SetClientChannelIDCallback sets a callback function that will be called
+ * just before a Channel ID is sent. This is only applicable to a client socket
+ * and setting this callback causes the TLS Channel ID extension to be
+ * advertised. */
+SSL_IMPORT SECStatus SSL_SetClientChannelIDCallback(
+    PRFileDesc *fd,
+    SSLClientChannelIDCallback callback,
+    void *arg);
+
 /*
 ** How long should we wait before retransmitting the next flight of
 ** the DTLS handshake? Returns SECFailure if not DTLS or not in a