Add DTLS support to NSS, contributed by Eric Rescorla.

net/third_party/nss/ssl/derive.c

 /*
  * Key Derivation that doesn't use PKCS11
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
@@ skipping 565 matching lines @@
  * specified cert make sure the extract operation is attempted from the slot
  * where the private key resides.
  * If MS can be extracted for all ciphers, (*pcanbypass) is set to TRUE and
  * SECSuccess is returned. In all other cases but one (*pcanbypass) is
  * set to FALSE and SECFailure is returned.
  * In that last case Derive() has been called successfully but the MS is null, 
  * CanBypass sets (*pcanbypass) to FALSE and returns SECSuccess indicating the
  * arguments were all valid but the slot cannot be bypassed.
  */
 
+/* XXX Add SSL_CBP_TLS1_1 and test it in protocolmask when setting isTLS. */
+
 SECStatus 
 SSL_CanBypass(CERTCertificate *cert, SECKEYPrivateKey *srvPrivkey,
               PRUint32 protocolmask, PRUint16 *ciphersuites, int nsuites,
               PRBool *pcanbypass, void *pwArg)
 {   SECStatus         rv;
     int               i;
     PRUint16          suite;
     PK11SymKey *      pms = NULL;
     SECKEYPublicKey * srvPubkey = NULL;
     KeyType           privKeytype;
@@ skipping 276 matching lines @@
 
     if (srvPubkey) {
         SECKEY_DestroyPublicKey(srvPubkey);
         srvPubkey = NULL;
     }
 
 
     return rv;
 }