&ss->ssl3->hs.client_random, &ss->ssl3->hs.server_random, &hashes);
&ss->ssl3.hs.client_random, &ss->ssl3.hs.server_random, &hashes, ss->opt.bypassPKCS11);
ssl3_SendServerKeyExchange(sslSocket *ss){const ssl3KEADef *     kea_def     = ss->ssl3->hs.kea_def;    SECStatus          rv          = SECFailure;    int                length;    PRBool             isTLS;    SECItem            signed_hash = {siBuffer, NULL, 0};    SSL3Hashes         hashes;    SECKEYPublicKey *  sdPub;	/* public key for step-down */#ifdef NSS_ENABLE_ECC    SECKEYPublicKey *  ecdhePub;    SECItem            ec_params = {siBuffer, NULL, 0};    ECName             curve;    SSL3KEAType        certIndex;#endif /* NSS_ENABLE_ECC */    SSL_TRC(3, ("%d: SSL3[%d]: send server_key_exchange handshake",		SSL_GETPID(), ss->fd));    PORT_Assert( ssl_HaveXmitBufLock(ss));    PORT_Assert( ssl_HaveSSL3HandshakeLock(ss));    switch (kea_def->exchKeyType) {    case kt_rsa:	/* Perform SSL Step-Down here. */	sdPub = ss->stepDownKeyPair->pubKey;	PORT_Assert(sdPub != NULL);	if (!sdPub) {	    PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);	    return SECFailure;	}    	rv = ssl3_ComputeExportRSAKeyHash(sdPub->u.rsa.modulus,					  sdPub->u.rsa.publicExponent,	                                  &ss->ssl3->hs.client_random,	                                  &ss->ssl3->hs.server_random,	                                  &hashes);        if (rv != SECSuccess) {	    ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);	    return rv;	}	isTLS = (PRBool)(ss->ssl3->pwSpec->version > SSL_LIBRARY_VERSION_3_0);	rv = ssl3_SignHashes(&hashes, ss->serverCerts[kt_rsa].serverKey, 	                     &signed_hash, isTLS);        if (rv != SECSuccess) {	    goto loser;		/* ssl3_SignHashes has set err. */	}	if (signed_hash.data == NULL) {	    /* how can this happen and rv == SECSuccess ?? */	    PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);	    goto loser;	}	length = 2 + sdPub->u.rsa.modulus.len +	         2 + sdPub->u.rsa.publicExponent.len +	         2 + signed_hash.len;	rv = ssl3_AppendHandshakeHeader(ss, server_key_exchange, length);	if (rv != SECSuccess) {	    goto loser; 	/* err set by AppendHandshake. */	}	rv = ssl3_AppendHandshakeVariable(ss, sdPub->u.rsa.modulus.data,					  sdPub->u.rsa.modulus.len, 2);	if (rv != SECSuccess) {	    goto loser; 	/* err set by AppendHandshake. */	}	rv = ssl3_AppendHandshakeVariable(				ss, sdPub->u.rsa.publicExponent.data,				sdPub->u.rsa.publicExponent.len, 2);	if (rv != SECSuccess) {	    goto loser; 	/* err set by AppendHandshake. */	}	rv = ssl3_AppendHandshakeVariable(ss, signed_hash.data,	                                  signed_hash.len, 2);	if (rv != SECSuccess) {	    goto loser; 	/* err set by AppendHandshake. */	}	PORT_Free(signed_hash.data);	return SECSuccess;#ifdef NSS_ENABLE_ECC    case kt_ecdh:	/* Generate ephemeral ECDH key pair and send the public key */	rv = ssl3_CreateECDHEphemeralKeys(ss);	if (rv != SECSuccess) {	    goto loser; 	/* err set by AppendHandshake. */	}	    	ecdhePub = ss->ephemeralECDHKeyPair->pubKey;	PORT_Assert(ecdhePub != NULL);	if (!ecdhePub) {	    PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);	    return SECFailure;	}			ec_params.len = 2;	ec_params.data = (unsigned char*)PORT_Alloc(ec_params.len);	curve = params2ecName(&ecdhePub->u.ec.DEREncodedParams);	if (curve != ec_noName) {	    ec_params.data[0] = ec_type_named;	    ec_params.data[1] = curve;	} else {	    PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);	    goto loser;	}			rv = ssl3_ComputeECDHKeyHash(ec_params, ecdhePub->u.ec.publicValue,					  &ss->ssl3->hs.client_random,					  &ss->ssl3->hs.server_random,	                                  &hashes);        if (rv != SECSuccess) {	    ssl_MapLowLevelError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);	    goto loser;	}	isTLS = (PRBool)(ss->ssl3->pwSpec->version > SSL_LIBRARY_VERSION_3_0);	/* XXX SSLKEAType isn't really a good choice for 	 * indexing certificates but that's all we have	 * for now.	 */	if (kea_def->kea == kea_ecdhe_rsa)	    certIndex = kt_rsa;	else /* kea_def->kea == kea_ecdhe_ecdsa */	    certIndex = kt_ecdh;	rv = ssl3_SignHashes(&hashes, ss->serverCerts[certIndex].serverKey, 	                     &signed_hash, isTLS);        if (rv != SECSuccess) {	    goto loser;		/* ssl3_SignHashes has set err. */	}	if (signed_hash.data == NULL) {	    /* how can this happen and rv == SECSuccess ?? */	    PORT_SetError(SSL_ERROR_SERVER_KEY_EXCHANGE_FAILURE);	    goto loser;	}	length = ec_params.len + 	         1 + ecdhePub->u.ec.publicValue.len + 	         2 + signed_hash.len;	rv = ssl3_AppendHandshakeHeader(ss, server_key_exchange, length);	if (rv != SECSuccess) {	    goto loser; 	/* err set by AppendHandshake. */	}	rv = ssl3_AppendHandshake(ss, ec_params.data, ec_params.len);	if (rv != SECSuccess) {	    goto loser; 	/* err set by AppendHandshake. */	}	rv = ssl3_AppendHandshakeVariable(ss, ecdhePub->u.ec.publicValue.data,	                                  ecdhePub->u.ec.publicValue.len, 1);	if (rv != SECSuccess) {	    goto loser; 	/* err set by AppendHandshake. */	}	rv = ssl3_AppendHandshakeVariable(ss, signed_hash.data,	                                  signed_hash.len, 2);	if (rv != SECSuccess) {	    goto loser; 	/* err set by AppendHandshake. */	}	PORT_Free(ec_params.data);	PORT_Free(signed_hash.data);	return SECSuccess;#endif /* NSS_ENABLE_ECC */    case kt_dh:    case kt_null:    default:	PORT_SetError(SEC_ERROR_UNSUPPORTED_KEYALG);	break;    }loser:#ifdef NSS_ENABLE_ECC    if (ec_params.data != NULL) 	PORT_Free(ec_params.data);#endif /* NSS_ENABLE_ECC */    if (signed_hash.data != NULL)     	PORT_Free(signed_hash.data);    return SECFailure;}