Support TLS Channel IDs in NSS

net/third_party/nss/ssl/SSLerrs.h

Index: net/third_party/nss/ssl/SSLerrs.h
diff --git a/net/third_party/nss/ssl/SSLerrs.h b/net/third_party/nss/ssl/SSLerrs.h
index e3f9a1cc0fbce81729a83a976c5efcb6def81fbe..49c5dda51d84742447a8018407cbd557258b218d 100644
--- a/net/third_party/nss/ssl/SSLerrs.h
+++ b/net/third_party/nss/ssl/SSLerrs.h
@@ -429,3 +429,12 @@ ER3(SSL_ERROR_RX_MALFORMED_HELLO_VERIFY_REQUEST, (SSL_ERROR_BASE + 122),
 
 ER3(SSL_ERROR_RX_UNEXPECTED_HELLO_VERIFY_REQUEST, (SSL_ERROR_BASE + 123),
 "SSL received an unexpected Hello Verify Request handshake message.")
+
+ER3(SSL_ERROR_BAD_CHANNEL_ID_DATA, (SSL_ERROR_BASE + 124),
+"SSL received a malformed TLS Channel ID extension.")
+
+ER3(SSL_ERROR_INVALID_CHANNEL_ID_KEY, (SSL_ERROR_BASE + 125),
+"An invalid TLS Channel ID key was returned by the callback.")

[wtc, 2012/05/31 18:19:53]

Nit: it's not clear what "callback" means.  How about
"The application provided an invalid TLS Channel ID key." or
"The TLS Channel ID key was invalid."

[agl, 2012/05/31 19:48:24]

Done.

+
+ER3(SSL_ERROR_GET_CHANNEL_ID_FAILED, (SSL_ERROR_BASE + 126),
+"The callback set by SSL_SetClientChannelIDCallback failed.")

[wtc, 2012/05/31 18:19:53]

Nit: this error message seems to expose too much implementation
detail.  (Some applications simply display these error
messages to their users.)

How about "The application could not get a TLS Channel ID."
or "The application could not provide a TLS Channel ID."?

An alternative design is to require the callback to call
PORT_SetError() to set an NSPR/NSS error code, and NSS
just reports that error.

[agl, 2012/05/31 19:48:24]

Done.