Add DTLS support to NSS, contributed by Eric Rescorla.

net/third_party/nss/ssl/sslproto.h

Index: net/third_party/nss/ssl/sslproto.h
===================================================================
--- net/third_party/nss/ssl/sslproto.h	(revision 127709)
+++ net/third_party/nss/ssl/sslproto.h	(working copy)
@@ -49,10 +49,15 @@
 #define SSL_LIBRARY_VERSION_3_0			0x0300
 #define SSL_LIBRARY_VERSION_TLS_1_0		0x0301
 #define SSL_LIBRARY_VERSION_TLS_1_1		0x0302
+/* Note: this is the external format, not the wire format */

[wtc, 2012/03/21 01:22:07]

You meant "internal format" rather than "external format",
right?

[ekr, 2012/03/21 01:36:40]

Yes. My bad.

+#define SSL_LIBRARY_VERSION_DTLS_1_0		0x0302
 
 /* deprecated old name */
 #define SSL_LIBRARY_VERSION_3_1_TLS SSL_LIBRARY_VERSION_TLS_1_0 
 
+/* The DTLS version used in the spec */
+#define SSL_LIBRARY_VERSION_DTLS_1_0_WIRE      ((~0x0100) & 0xffff)

[wtc, 2012/03/21 01:22:07]

Nit: would it be faster to do (0x0100 ^ 0xffff)?

[ekr, 2012/03/21 01:36:40]

Probably, but shouldn't the compiler make this a constant anyway?

[wtc, 2012/03/21 02:12:01]

Yes, you're right.  I thought we may be performing this
operation elsewhere on a variable, which is why I asked
for a more efficient way to compute this.

But I found that you do the DTLS-to-TLS version conversion
using the wire version directly, so it is not necessary
to compute one's complement of the wire version.

+
 /* Header lengths of some of the messages */
 #define SSL_HL_ERROR_HBYTES			3
 #define SSL_HL_CLIENT_HELLO_HBYTES		9