Add DTLS support to NSS, contributed by Eric Rescorla.

net/third_party/nss/ssl/sslcon.c

 /* 
  * SSL v2 handshake functions, and functions common to SSL2 and SSL3.
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 1231 matching lines @@
  */
 SECStatus
 ssl_GatherRecord1stHandshake(sslSocket *ss)
 {
     int rv;
 
     PORT_Assert( ss->opt.noLocks || ssl_Have1stHandshakeLock(ss) );
 
     ssl_GetRecvBufLock(ss);
 
-    if (ss->version >= SSL_LIBRARY_VERSION_3_0) {
+    /* The special case DTLS logic is needed here because the
+     * SSL/TLS version wants to auto-detect SSL2 vs. SSL3
+     * on the initial handshake (ss->version == 0) but with DTLS it gets 
+     * confused, so we force the ssl3 version
+     **/
+    if ((ss->version >= SSL_LIBRARY_VERSION_3_0) || IS_DTLS(ss)) {
         /* Wait for handshake to complete, or application data to arrive.  */
         rv = ssl3_GatherCompleteHandshake(ss, 0);
     } else {
         /* See if we have a complete record */
         rv = ssl2_GatherRecord(ss, 0);
     }
     SSL_TRC(10, ("%d: SSL[%d]: handshake gathering, rv=%d",
                  SSL_GETPID(), ss->fd, rv));
 
     ssl_ReleaseRecvBufLock(ss);
@@ skipping 1839 matching lines @@
         if (ss->peerID != NULL) {
             sid->peerID = PORT_Strdup(ss->peerID);
         }
         if (ss->url != NULL) {
             sid->urlSvrName = PORT_Strdup(ss->url);
         }
     }
     ss->sec.ci.sid = sid;
 
     PORT_Assert(sid != NULL);
-
     if ((sid->version >= SSL_LIBRARY_VERSION_3_0 || !ss->opt.v2CompatibleHello) &&
         !SSL3_ALL_VERSIONS_DISABLED(&ss->vrange)) {
         ss->gs.state      = GS_INIT;
         ss->handshake     = ssl_GatherRecord1stHandshake;
 
         /* ssl3_SendClientHello will override this if it succeeds. */
         ss->version       = SSL_LIBRARY_VERSION_3_0;
 
         ssl_GetSSL3HandshakeLock(ss);
         ssl_GetXmitBufLock(ss);
-        rv =  ssl3_SendClientHello(ss);
+        rv =  ssl3_SendClientHello(ss, PR_FALSE);
         ssl_ReleaseXmitBufLock(ss);
         ssl_ReleaseSSL3HandshakeLock(ss);
 
         return rv;
     }
 #if defined(NSS_ENABLE_ECC) && !defined(NSS_ECC_MORE_THAN_SUITE_B)
     /* ensure we don't neogtiate ECC cipher suites with SSL2 hello */
     ssl3_DisableECCSuites(ss, NULL); /* disable all ECC suites */
     if (ss->cipherSpecs != NULL) {
         PORT_Free(ss->cipherSpecs);
@@ skipping 578 matching lines @@
 
     c = __nss_ssl_rcsid[0] + __nss_ssl_sccsid[0]; 
     return NSS_VersionCheck(importedVersion);
 }
 
 const char *
 NSSSSL_GetVersion(void)
 {
     return NSS_VERSION;
 }