[WebRTC] Apply port restrictions to peerconnections.

Throw an error if it mismatches.

CLOBBER

@@ -23,4 +23,3 @@
 # don't change CLOBBER for WebIDL changes any more.
 
 Clobber for NSS update
-

config/external/nss/Makefile.in

@@ -174,13 +174,6 @@ DEFAULT_GMAKE_FLAGS += NSS_SSL_ENABLE_ZLIB=
 # Disable building of the test programs in security/nss/lib/zlib
 DEFAULT_GMAKE_FLAGS += PROGRAMS=
 
-# Disable AVX2 for poly1305
-DEFAULT_GMAKE_FLAGS += NSS_DISABLE_AVX2=1
-
-# Disable obsolete ciphers
-DEFAULT_GMAKE_FLAGS += NSS_DISABLE_DEPRECATED_SEED=1
-DEFAULT_GMAKE_FLAGS += NSS_DISABLE_DEPRECATED_RC2=1
-
 # Disable creating .chk files. They will be generated from packager.mk
 # When bug 681624 lands, we can replace CHECKLOC= with SKIP_SHLIBSIGN=1
 DEFAULT_GMAKE_FLAGS += CHECKLOC=

docshell/base/nsDocShell.cpp

@@ -5449,11 +5449,19 @@ nsDocShell::Stop(uint32_t aStopFlags)
   }
 
   if (nsIWebNavigation::STOP_CONTENT & aStopFlags) {
-    // Stop the document loading
+    // Stop the document loading and animations
     if (mContentViewer) {
       nsCOMPtr<nsIContentViewer> cv = mContentViewer;
       cv->Stop();
     }
+  } else if (nsIWebNavigation::STOP_NETWORK & aStopFlags) {
+    // Stop the document loading only
+    if (mContentViewer) {
+      RefPtr<nsIDocument> doc = mContentViewer->GetDocument();
+      if (doc) {
+        doc->StopDocumentLoad();
+      }
+    }
   }
 
   if (nsIWebNavigation::STOP_NETWORK & aStopFlags) {

dom/canvas/WebGLContextTextures.cpp

@@ -390,6 +390,16 @@ WebGLContext::TexImage(const char* funcName, uint8_t funcDims, GLenum rawTarget,
     if (!ValidateTexImageTarget(this, funcName, funcDims, rawTarget, &target, &tex))
         return;
 
+    const bool isUploadFromPbo = bool(src.mPboOffset);
+    const bool isPboBound = bool(mBoundPixelUnpackBuffer);
+    if (isUploadFromPbo != isPboBound) {
+      SynthesizeGLError(LOCAL_GL_INVALID_OPERATION,
+                    "Tex upload from %s but PIXEL_UNPACK_BUFFER %s bound.",
+                    isUploadFromPbo ? "PBO" : "non-PBO",
+                    isPboBound ? "was" : "was not");
+      return;
+    }
+
     const webgl::PackingInfo pi = {unpackFormat, unpackType};
     tex->TexImage(funcName, target, level, internalFormat, width, height, depth, border,
                   pi, src);
@@ -407,6 +417,16 @@ WebGLContext::TexSubImage(const char* funcName, uint8_t funcDims, GLenum rawTarg
     if (!ValidateTexImageTarget(this, funcName, funcDims, rawTarget, &target, &tex))
         return;
 
+    const bool isUploadFromPbo = bool(src.mPboOffset);
+    const bool isPboBound = bool(mBoundPixelUnpackBuffer);
+    if (isUploadFromPbo != isPboBound) {
+      SynthesizeGLError(LOCAL_GL_INVALID_OPERATION,
+                    "Tex upload from %s but PIXEL_UNPACK_BUFFER %s bound.",
+                    isUploadFromPbo ? "PBO" : "non-PBO",
+                    isPboBound ? "was" : "was not");
+      return;
+    }
+
     const webgl::PackingInfo pi = {unpackFormat, unpackType};
     tex->TexSubImage(funcName, target, level, xOffset, yOffset, zOffset, width, height,
                      depth, pi, src);

dom/svg/nsSVGElement.cpp

@@ -1292,24 +1292,6 @@ nsSVGElement::UpdateContentStyleRule()
       continue; // xml:lang has precedence
     }
 
-    if (IsSVGElement(nsGkAtoms::svg)) {
-      // Special case: we don't want <svg> 'width'/'height' mapped into style
-      // if the attribute value isn't a valid <length> according to SVG (which
-      // only supports a subset of the CSS <length> values). We don't enforce
-      // this by checking the attribute value in SVGSVGElement::
-      // IsAttributeMapped since we don't want that method to depend on the
-      // value of the attribute that is being checked. Rather we just prevent
-      // the actual mapping here, as necessary.
-      if (attrName->Atom() == nsGkAtoms::width &&
-          !GetAnimatedLength(nsGkAtoms::width)->HasBaseVal()) {
-        continue;
-      }
-      if (attrName->Atom() == nsGkAtoms::height &&
-          !GetAnimatedLength(nsGkAtoms::height)->HasBaseVal()) {
-        continue;
-      }
-    }
-
     nsAutoString value;
     mAttrsAndChildren.AttrAt(i)->ToString(value);
     mappedAttrParser.ParseMappedAttrValue(attrName->Atom(), value);

media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp

@@ -17,6 +17,8 @@
 #include "nss.h"
 #include "pk11pub.h"
 
+#include "nsNetUtil.h"  // for NS_CheckPortSafety
+
 #include "nsNetCID.h"
 #include "nsIProperty.h"
 #include "nsIPropertyBag2.h"
@@ -494,6 +496,13 @@ PeerConnectionConfiguration::Init(const RTCConfiguration& aSrc)
   return NS_OK;
 }
 
+// list of known acceptable ports for webrtc
+int16_t gGoodWebrtcPortList[] = {
+    3478,  // stun or turn
+    5349,  // stuns or turns
+    0,     // Sentinel value: This MUST be zero
+};
+
 nsresult
 PeerConnectionConfiguration::AddIceServer(const RTCIceServer &aServer)
 {
@@ -567,6 +576,21 @@ PeerConnectionConfiguration::AddIceServer(const RTCIceServer &aServer)
     if (port == -1)
       port = (isStuns || isTurns)? 5349 : 3478;
 
+    // First check the known good ports for webrtc
+    bool knownGoodPort = false;
+    for (int i = 0; !knownGoodPort && gGoodWebrtcPortList[i]; i++) {
+      if (port == gGoodWebrtcPortList[i]) {
+        knownGoodPort = true;
+      }
+    }
+
+    // if not in the list of known good ports for webrtc, check
+    // the generic block list using NS_CheckPortSafety.
+    if (!knownGoodPort) {
+      rv = NS_CheckPortSafety(port, nullptr);
+      NS_ENSURE_SUCCESS(rv, rv);
+    }
+
     if (isTurn || isTurns) {
       NS_ConvertUTF16toUTF8 credential(aServer.mCredential.Value());
       NS_ConvertUTF16toUTF8 username(aServer.mUsername.Value());

modules/libpref/init/all.js

@@ -2484,7 +2484,7 @@ pref("layout.css.isolation.enabled", true);
 pref("layout.css.filters.enabled", true);
 
 // Is support for scrollbar-width property enabled?
-pref("layout.css.scrollbar-width.enabled", false);
+pref("layout.css.scrollbar-width.enabled", true);
 
 // Set the threshold distance in CSS pixels below which scrolling will snap to
 // an edge, when scroll snapping is set to "proximity".

nsprpub/automation/release/nspr-release-helper.py

@@ -17,7 +17,7 @@ f_conf = "configure"
 f_conf_in = "configure.in"
 
 def check_call_noisy(cmd, *args, **kwargs):
-    print("Executing command:", cmd)
+    print "Executing command:", cmd
     check_call(cmd, *args, **kwargs)
 
 o = OptionParser(usage="client.py [options] remove_beta | set_beta | print_library_versions | set_version_to_minor_release | set_version_to_patch_release | create_nspr_release_archive")
@@ -30,7 +30,7 @@ except IndexError:
     sys.exit(2)
 
 def exit_with_failure(what):
-    print("failure: ", what)
+    print "failure: ", what
     sys.exit(2)
 
 def check_files_exist():
@@ -45,31 +45,31 @@ def sed_inplace(sed_expression, filename):
 def toggle_beta_status(is_beta):
     check_files_exist()
     if (is_beta):
-        print("adding Beta status to version numbers")
+        print "adding Beta status to version numbers"
         sed_inplace('s/^\(#define *PR_VERSION *\"[0-9.]\+\)\" *$/\\1 Beta\"/', prinit_h)
         sed_inplace('s/^\(#define *PR_BETA *\)PR_FALSE *$/\\1PR_TRUE/', prinit_h)
 
     else:
-        print("removing Beta status from version numbers")
+        print "removing Beta status from version numbers"
         sed_inplace('s/^\(#define *PR_VERSION *\"[0-9.]\+\) *Beta\" *$/\\1\"/', prinit_h)
         sed_inplace('s/^\(#define *PR_BETA *\)PR_TRUE *$/\\1PR_FALSE/', prinit_h)
-    print("please run 'hg stat' and 'hg diff' to verify the files have been verified correctly")
+    print "please run 'hg stat' and 'hg diff' to verify the files have been verified correctly"
 
 def print_beta_versions():
     check_call_noisy(["egrep", "#define *PR_VERSION|#define *PR_BETA", prinit_h])
 
 def remove_beta_status():
-    print("--- removing beta flags. Existing versions were:")
+    print "--- removing beta flags. Existing versions were:"
     print_beta_versions()
     toggle_beta_status(False)
-    print("--- finished modifications, new versions are:")
+    print "--- finished modifications, new versions are:"
     print_beta_versions()
 
 def set_beta_status():
-    print("--- adding beta flags. Existing versions were:")
+    print "--- adding beta flags. Existing versions were:"
     print_beta_versions()
     toggle_beta_status(True)
-    print("--- finished modifications, new versions are:")
+    print "--- finished modifications, new versions are:"
     print_beta_versions()
 
 def print_library_versions():
@@ -103,17 +103,17 @@ def set_all_lib_versions(version, major, minor, patch):
     set_major_versions(major)
     set_minor_versions(minor)
     set_patch_versions(patch)
-    print()
-    print("===========================")
-    print("======== ATTENTION ========")
-    print()
-    print("You *MUST* manually edit file pr/tests/vercheck.c")
-    print()
-    print("Edit two arrays, named compatible_version and incompatible_version")
-    print("according to the new version you're adding.")
-    print()
-    print("======== ATTENTION ========")
-    print("===========================")
+    print
+    print "==========================="
+    print "======== ATTENTION ========"
+    print
+    print "You *MUST* manually edit file pr/tests/vercheck.c"
+    print
+    print "Edit two arrays, named compatible_version and incompatible_version"
+    print "according to the new version you're adding."
+    print
+    print "======== ATTENTION ========"
+    print "==========================="
 
 def set_version_to_minor_release():
     ensure_arguments_after_action(2, "major_version  minor_version")
@@ -144,12 +144,12 @@ def create_nspr_release_archive():
     check_call_noisy(["mkdir", "-p", nspr_stagedir])
     check_call_noisy(["hg", "archive", "-r", nsprreltag, "--prefix=nspr-" + nsprrel + "/nspr",
                       "../stage/v" + nsprrel + "/src/" + nspr_tar, "-X", ".hgtags"])
-    print("changing to directory " + nspr_stagedir)
+    print "changing to directory " + nspr_stagedir
     os.chdir(nspr_stagedir)
 
     check_call("sha1sum " + nspr_tar + " > SHA1SUMS", shell=True)
     check_call("sha256sum " + nspr_tar + " > SHA256SUMS", shell=True)
-    print("created directory " + nspr_stagedir + " with files:")
+    print "created directory " + nspr_stagedir + " with files:"
     check_call_noisy(["ls", "-l"])
 
 if action in ('remove_beta'):

nsprpub/build/autoconf/README

@@ -1,3 +1,5 @@
 The config.guess and config.sub scripts were downloaded from
-http://git.savannah.gnu.org/cgit/config.git/tree/config.guess?id=2593751ef276497e312d7c4ce7fd049614c7bf80
-http://git.savannah.gnu.org/cgit/config.git/tree/config.sub?id=2593751ef276497e312d7c4ce7fd049614c7bf80
+http://git.savannah.gnu.org/cgit/config.git/tree/config.guess?id=6947a35648e577c2e3a12d5c88d488c6ea94e1c0
+http://git.savannah.gnu.org/cgit/config.git/tree/config.sub?id=6947a35648e577c2e3a12d5c88d488c6ea94e1c0
+
+Our private patches are in the patches/ directory.

nsprpub/build/autoconf/patches/config.sub.patch

@@ -0,0 +1,51 @@
+--- config.sub.orig	2014-03-09 18:34:03 -0700
++++ config.sub	2014-03-14 19:49:48 -0700
+@@ -115,7 +115,7 @@
+ # Here we must recognize all the valid KERNEL-OS combinations.
+ maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
+ case $maybe_os in
+-  nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
++  nto-qnx* | linux-gnu* | linux-dietlibc | linux-newlib* | \
+   linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
+   knetbsd*-gnu* | netbsd*-gnu* | \
+   kopensolaris*-gnu* | \
+@@ -123,10 +123,6 @@
+     os=-$maybe_os
+     basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
+     ;;
+-  android-linux)
+-    os=-linux-android
+-    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
+-    ;;
+   *)
+     basic_machine=`echo $1 | sed 's/-[^-]*$//'`
+     if [ $basic_machine != $1 ]
+@@ -1367,7 +1363,7 @@
+ 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
+ 	      | -chorusos* | -chorusrdb* | -cegcc* \
+ 	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
+-	      | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
++	      | -mingw32* | -mingw64* | -linux-gnu* \
+ 	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
+ 	      | -uxpv* | -beos* | -mpeix* | -udk* \
+ 	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
+@@ -1508,6 +1504,9 @@
+ 		;;
+ 	-nacl*)
+ 		;;
++	-android*)
++		os=-android
++		;;
+ 	-none)
+ 		;;
+ 	*)
+@@ -1777,6 +1776,9 @@
+ 			-vos*)
+ 				vendor=stratus
+ 				;;
++			*-android*|*-linuxandroid*)
++				vendor=linux-
++				;;
+ 		esac
+ 		basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"`
+ 		;;

nsprpub/configure

@@ -1467,7 +1467,7 @@ Optional Features:
   --enable-cplus          Enable some c++ api routines
   --enable-macos-target=VER
                           Set the minimum MacOS version needed at runtime
-                          10.3 for ppc, 10.4 for x86
+                          10.2 for ppc, 10.4 for x86
   --disable-os2-high-mem  Disable high-memory support on OS/2
 
   --enable-strip          Enable stripping of shared libs and programs
@@ -2486,7 +2486,7 @@ test -n "$target_alias" &&
   program_prefix=${target_alias}-
 
 MOD_MAJOR_VERSION=4
-MOD_MINOR_VERSION=29
+MOD_MINOR_VERSION=25
 MOD_PATCH_VERSION=0
 NSPR_MODNAME=nspr20
 _HAVE_PTHREADS=
@@ -5587,7 +5587,6 @@ if test -n "$CROSS_COMPILE"; then
         linux*)       OS_ARCH=Linux ;;
         solaris*)     OS_ARCH=SunOS OS_RELEASE=5 ;;
         mingw*)       OS_ARCH=WINNT CPU_ARCH=x86 ;;
-        cygwin*)      OS_ARCH=WINNT ;;
         darwin*)      OS_ARCH=Darwin ;;
         riscos*)      OS_ARCH=RISCOS ;;
     esac
@@ -6458,22 +6457,12 @@ fi
                 CPU_ARCH=i386
             fi
             ;;
-        aarch64)
-            CPU_ARCH=aarch64
-            ;;
         *)
             CPU_ARCH=ppc
             ;;
     esac
     if test "`echo $CC | grep -c '\-arch '`" = "0"; then
-        case "$CPU_ARCH" in
-        aarch64)
-            CC="$CC -arch arm64"
-            ;;
-        *)
-            CC="$CC -arch $CPU_ARCH"
-            ;;
-        esac
+        CC="$CC -arch $CPU_ARCH"
     fi
     ac_fn_c_check_header_mongrel "$LINENO" "crt_externs.h" "ac_cv_header_crt_externs_h" "$ac_includes_default"
 if test "x$ac_cv_header_crt_externs_h" = xyes; then :
@@ -6493,71 +6482,78 @@ fi
     PR_MD_CSRCS=darwin.c
     PR_MD_ASFILES=os_Darwin.s
 
-    if test -n "$_MACOSX_DEPLOYMENT_TARGET" ; then
-                export MACOSX_DEPLOYMENT_TARGET=$_MACOSX_DEPLOYMENT_TARGET
-    elif test -z "$MACOSX_DEPLOYMENT_TARGET" ; then
-                                case "${target_cpu}" in
-            powerpc*)
-                                export MACOSX_DEPLOYMENT_TARGET=10.3
-                ;;
-            i*86*)
-                                export MACOSX_DEPLOYMENT_TARGET=10.4
-                ;;
-        esac
-    fi
+    # Add Mac OS X support for loading CFM & CFBundle plugins
+    if test -f "${MACOS_SDK_DIR}/System/Library/Frameworks/Carbon.framework/Carbon"; then
+        $as_echo "#define XP_MACOSX 1" >>confdefs.h
 
+        OS_TARGET=MacOSX
 
-    if test "$MACOS_SDK_DIR"; then
-
-        if test ! -d "$MACOS_SDK_DIR"; then
-            as_fn_error $? "SDK not found.  When using --with-macos-sdk, you must
-specify a valid SDK.  SDKs are installed when the optional cross-development
-tools are selected during the Xcode/Developer Tools installation." "$LINENO" 5
+        if test -n "$_MACOSX_DEPLOYMENT_TARGET" ; then
+                        export MACOSX_DEPLOYMENT_TARGET=$_MACOSX_DEPLOYMENT_TARGET
+        elif test -z "$MACOSX_DEPLOYMENT_TARGET" ; then
+                                                case "${target_cpu}" in
+                powerpc*)
+                                        export MACOSX_DEPLOYMENT_TARGET=10.2
+                    ;;
+                i*86*)
+                                        export MACOSX_DEPLOYMENT_TARGET=10.4
+                    ;;
+            esac
         fi
 
 
-        CC_VERSION=`$CC -v 2>&1 | grep 'gcc version'`
-        GCC_VERSION_FULL=`echo $CC_VERSION | $PERL -pe 's/^.*gcc version ([^ ]*).*/$1/'`
-        GCC_VERSION=`echo $GCC_VERSION_FULL | $PERL -pe '(split(/\./))[0]>=4&&s/(^\d*\.\d*).*/$1/;'`
+        if test "$MACOS_SDK_DIR"; then
 
-        GCC_VERSION_MAJOR=`echo $GCC_VERSION_FULL | $PERL -pe 's/(^\d*).*/$1/;'`
-        if test "$GCC_VERSION_MAJOR" -lt "4" ; then
-            SDK_C_FRAMEWORK="-F${MACOS_SDK_DIR}/System/Library/Frameworks"
-            if test -d "${MACOS_SDK_DIR}/Library/Frameworks" ; then
-                SDK_C_FRAMEWORK="$SDK_C_FRAMEWORK -F${MACOS_SDK_DIR}/Library/Frameworks"
+            if test ! -d "$MACOS_SDK_DIR"; then
+                as_fn_error $? "SDK not found.  When using --with-macos-sdk, you must
+specify a valid SDK.  SDKs are installed when the optional cross-development
+tools are selected during the Xcode/Developer Tools installation." "$LINENO" 5
             fi
 
-            SDK_C_INCLUDE="-isystem ${MACOS_SDK_DIR}/usr/include/gcc/darwin/${GCC_VERSION} -isystem ${MACOS_SDK_DIR}/usr/include ${SDK_C_FRAMEWORK}"
 
-            CFLAGS="$CFLAGS -nostdinc ${SDK_C_INCLUDE}"
+            CC_VERSION=`$CC -v 2>&1 | grep 'gcc version'`
+            GCC_VERSION_FULL=`echo $CC_VERSION | $PERL -pe 's/^.*gcc version ([^ ]*).*/$1/'`
+            GCC_VERSION=`echo $GCC_VERSION_FULL | $PERL -pe '(split(/\./))[0]>=4&&s/(^\d*\.\d*).*/$1/;'`
 
-                        CPP="$CPP -nostdinc ${SDK_C_INCLUDE}"
+            GCC_VERSION_MAJOR=`echo $GCC_VERSION_FULL | $PERL -pe 's/(^\d*).*/$1/;'`
+            if test "$GCC_VERSION_MAJOR" -lt "4" ; then
+                SDK_C_FRAMEWORK="-F${MACOS_SDK_DIR}/System/Library/Frameworks"
+                if test -d "${MACOS_SDK_DIR}/Library/Frameworks" ; then
+                    SDK_C_FRAMEWORK="$SDK_C_FRAMEWORK -F${MACOS_SDK_DIR}/Library/Frameworks"
+                fi
+
+                SDK_C_INCLUDE="-isystem ${MACOS_SDK_DIR}/usr/include/gcc/darwin/${GCC_VERSION} -isystem ${MACOS_SDK_DIR}/usr/include ${SDK_C_FRAMEWORK}"
+
+                CFLAGS="$CFLAGS -nostdinc ${SDK_C_INCLUDE}"
+
+                                CPP="$CPP -nostdinc ${SDK_C_INCLUDE}"
 
 
-            HOST_DARWIN_MAJOR=`echo "$build_os" | sed -E -e 's/^darwin([0-9]+).*$/\1/'`
+                HOST_DARWIN_MAJOR=`echo "$build_os" | sed -E -e 's/^darwin([0-9]+).*$/\1/'`
 
-            if test "$HOST_DARWIN_MAJOR" -lt 9 ; then
-                                                                                                MACOS_SDK_LIBS="-L${MACOS_SDK_DIR}/usr/lib/gcc/darwin -L${MACOS_SDK_DIR}/usr/lib/gcc/darwin/${GCC_VERSION_FULL} -L${MACOS_SDK_DIR}/usr/lib ${SDK_C_FRAMEWORK}"
+                if test "$HOST_DARWIN_MAJOR" -lt 9 ; then
+                                                                                                                        MACOS_SDK_LIBS="-L${MACOS_SDK_DIR}/usr/lib/gcc/darwin -L${MACOS_SDK_DIR}/usr/lib/gcc/darwin/${GCC_VERSION_FULL} -L${MACOS_SDK_DIR}/usr/lib ${SDK_C_FRAMEWORK}"
+                else
+                                                                                                                                                                                                        MACOS_SDK_LIBS="-Wl,-syslibroot,${MACOS_SDK_DIR}"
+                fi
+
+                LDFLAGS="${MACOS_SDK_LIBS} $LDFLAGS"
+                export NEXT_ROOT=$MACOS_SDK_DIR
+
+                if test -n "$CROSS_COMPILE" ; then
+                                                                                HOST_CC="NEXT_ROOT= $HOST_CC"
+                    HOST_CXX="NEXT_ROOT= $HOST_CXX"
+                fi
             else
-                                                                                                                                                                MACOS_SDK_LIBS="-Wl,-syslibroot,${MACOS_SDK_DIR}"
-            fi
+                                                CFLAGS="$CFLAGS -isysroot ${MACOS_SDK_DIR}"
 
-            LDFLAGS="${MACOS_SDK_LIBS} $LDFLAGS"
-            export NEXT_ROOT=$MACOS_SDK_DIR
+                                CPP="$CPP -isysroot ${MACOS_SDK_DIR}"
 
-            if test -n "$CROSS_COMPILE" ; then
-                                                                HOST_CC="NEXT_ROOT= $HOST_CC"
-                HOST_CXX="NEXT_ROOT= $HOST_CXX"
-            fi
-        else
-                                    CFLAGS="$CFLAGS -isysroot ${MACOS_SDK_DIR}"
-
-                        CPP="$CPP -isysroot ${MACOS_SDK_DIR}"
-
-                                                            if test "$GCC_VERSION_FULL" != "4.0.0" ; then
-                                                LDFLAGS="$LDFLAGS -isysroot ${MACOS_SDK_DIR}"
-            else
-                                                LDFLAGS="$LDFLAGS -Wl,-syslibroot,${MACOS_SDK_DIR}"
+                                                                                if test "$GCC_VERSION_FULL" != "4.0.0" ; then
+                                                            LDFLAGS="$LDFLAGS -isysroot ${MACOS_SDK_DIR}"
+                else
+                                                            LDFLAGS="$LDFLAGS -Wl,-syslibroot,${MACOS_SDK_DIR}"
+                fi
             fi
         fi
     fi

nsprpub/configure.in

@@ -15,7 +15,7 @@ dnl ========================================================
 dnl = Defaults
 dnl ========================================================
 MOD_MAJOR_VERSION=4
-MOD_MINOR_VERSION=29
+MOD_MINOR_VERSION=25
 MOD_PATCH_VERSION=0
 NSPR_MODNAME=nspr20
 _HAVE_PTHREADS=
@@ -398,7 +398,7 @@ AC_ARG_WITH(macos-sdk,
 AC_ARG_ENABLE(macos-target,
              [  --enable-macos-target=VER
                           Set the minimum MacOS version needed at runtime
-                          [10.3 for ppc, 10.4 for x86]],
+                          [10.2 for ppc, 10.4 for x86]],
              [_MACOSX_DEPLOYMENT_TARGET=$enableval])
 
 dnl ========================================================
@@ -821,7 +821,6 @@ if test -n "$CROSS_COMPILE"; then
         linux*)       OS_ARCH=Linux ;;
         solaris*)     OS_ARCH=SunOS OS_RELEASE=5 ;;
         mingw*)       OS_ARCH=WINNT CPU_ARCH=x86 ;;
-        cygwin*)      OS_ARCH=WINNT ;;
         darwin*)      OS_ARCH=Darwin ;;
         riscos*)      OS_ARCH=RISCOS ;;
     esac
@@ -1327,22 +1326,12 @@ case "$target" in
                 CPU_ARCH=i386
             fi
             ;;
-        aarch64)
-            CPU_ARCH=aarch64
-            ;;
         *)
             CPU_ARCH=ppc
             ;;
     esac
     if test "`echo $CC | grep -c '\-arch '`" = "0"; then
-        case "$CPU_ARCH" in
-        aarch64)
-            CC="$CC -arch arm64"
-            ;;
-        *)
-            CC="$CC -arch $CPU_ARCH"
-            ;;
-        esac
+        CC="$CC -arch $CPU_ARCH"
     fi
     AC_CHECK_HEADER(crt_externs.h, AC_DEFINE(HAVE_CRT_EXTERNS_H))
     DSO_CFLAGS=-fPIC
@@ -1356,110 +1345,116 @@ case "$target" in
     PR_MD_CSRCS=darwin.c
     PR_MD_ASFILES=os_Darwin.s
 
-    if test -n "$_MACOSX_DEPLOYMENT_TARGET" ; then
-        dnl Use the specified value
-        export MACOSX_DEPLOYMENT_TARGET=$_MACOSX_DEPLOYMENT_TARGET
-    elif test -z "$MACOSX_DEPLOYMENT_TARGET" ; then
-        dnl No value specified on the command line or in the environment,
-        dnl use the lesser of the library's minimum or the architecture's
-        dnl minimum.
-        case "${target_cpu}" in
-            powerpc*)
-                dnl Architecture minimum 10.3
-                export MACOSX_DEPLOYMENT_TARGET=10.3
-                ;;
-            i*86*)
-                dnl Architecture minimum 10.4
-                export MACOSX_DEPLOYMENT_TARGET=10.4
-                ;;
-        esac
-    fi
+    # Add Mac OS X support for loading CFM & CFBundle plugins
+    if test -f "${MACOS_SDK_DIR}/System/Library/Frameworks/Carbon.framework/Carbon"; then
+        AC_DEFINE(XP_MACOSX)
+        OS_TARGET=MacOSX
 
-    dnl MACOS_SDK_DIR will be set to the SDK location whenever one is
-    dnl in use.  NEXT_ROOT will be set and exported if it's needed for
-    dnl ld.
-
-    if test "$MACOS_SDK_DIR"; then
-        dnl Sync this section with the one in Mozilla's top level.
-
-        if test ! -d "$MACOS_SDK_DIR"; then
-            AC_MSG_ERROR([SDK not found.  When using --with-macos-sdk, you must
-specify a valid SDK.  SDKs are installed when the optional cross-development
-tools are selected during the Xcode/Developer Tools installation.])
+        if test -n "$_MACOSX_DEPLOYMENT_TARGET" ; then
+            dnl Use the specified value
+            export MACOSX_DEPLOYMENT_TARGET=$_MACOSX_DEPLOYMENT_TARGET
+        elif test -z "$MACOSX_DEPLOYMENT_TARGET" ; then
+            dnl No value specified on the command line or in the environment,
+            dnl use the lesser of the library's minimum or the architecture's
+            dnl minimum.
+            case "${target_cpu}" in
+                powerpc*)
+                    dnl Architecture minimum 10.2
+                    export MACOSX_DEPLOYMENT_TARGET=10.2
+                    ;;
+                i*86*)
+                    dnl Architecture minimum 10.4
+                    export MACOSX_DEPLOYMENT_TARGET=10.4
+                    ;;
+            esac
         fi
 
-        changequote(,)
-        CC_VERSION=`$CC -v 2>&1 | grep 'gcc version'`
-        GCC_VERSION_FULL=`echo $CC_VERSION | $PERL -pe 's/^.*gcc version ([^ ]*).*/$1/'`
-        GCC_VERSION=`echo $GCC_VERSION_FULL | $PERL -pe '(split(/\./))[0]>=4&&s/(^\d*\.\d*).*/$1/;'`
-        changequote([,])
-        GCC_VERSION_MAJOR=`echo $GCC_VERSION_FULL | $PERL -pe 's/(^\d*).*/$1/;'`
-        if test "$GCC_VERSION_MAJOR" -lt "4" ; then
-            SDK_C_FRAMEWORK="-F${MACOS_SDK_DIR}/System/Library/Frameworks"
-            if test -d "${MACOS_SDK_DIR}/Library/Frameworks" ; then
-                SDK_C_FRAMEWORK="$SDK_C_FRAMEWORK -F${MACOS_SDK_DIR}/Library/Frameworks"
+        dnl MACOS_SDK_DIR will be set to the SDK location whenever one is
+        dnl in use.  NEXT_ROOT will be set and exported if it's needed for
+        dnl ld.
+
+        if test "$MACOS_SDK_DIR"; then
+            dnl Sync this section with the one in Mozilla's top level.
+
+            if test ! -d "$MACOS_SDK_DIR"; then
+                AC_MSG_ERROR([SDK not found.  When using --with-macos-sdk, you must
+specify a valid SDK.  SDKs are installed when the optional cross-development
+tools are selected during the Xcode/Developer Tools installation.])
             fi
 
-            SDK_C_INCLUDE="-isystem ${MACOS_SDK_DIR}/usr/include/gcc/darwin/${GCC_VERSION} -isystem ${MACOS_SDK_DIR}/usr/include ${SDK_C_FRAMEWORK}"
-
-            CFLAGS="$CFLAGS -nostdinc ${SDK_C_INCLUDE}"
-
-            dnl CPP needs to be set for AC_CHECK_HEADER.
-            CPP="$CPP -nostdinc ${SDK_C_INCLUDE}"
-
             changequote(,)
-            HOST_DARWIN_MAJOR=`echo "$build_os" | sed -E -e 's/^darwin([0-9]+).*$/\1/'`
+            CC_VERSION=`$CC -v 2>&1 | grep 'gcc version'`
+            GCC_VERSION_FULL=`echo $CC_VERSION | $PERL -pe 's/^.*gcc version ([^ ]*).*/$1/'`
+            GCC_VERSION=`echo $GCC_VERSION_FULL | $PERL -pe '(split(/\./))[0]>=4&&s/(^\d*\.\d*).*/$1/;'`
             changequote([,])
-            if test "$HOST_DARWIN_MAJOR" -lt 9 ; then
-                dnl The build host is running Tiger (10.4) or earlier.
-                dnl ld support for -syslibroot is compiler-agnostic, but
-                dnl only available on Tiger and later.  On Tiger and
-                dnl earlier build hosts, just rely on NEXT_ROOT, because
-                dnl it's not been shown to cause any problems.
-                MACOS_SDK_LIBS="-L${MACOS_SDK_DIR}/usr/lib/gcc/darwin -L${MACOS_SDK_DIR}/usr/lib/gcc/darwin/${GCC_VERSION_FULL} -L${MACOS_SDK_DIR}/usr/lib ${SDK_C_FRAMEWORK}"
+            GCC_VERSION_MAJOR=`echo $GCC_VERSION_FULL | $PERL -pe 's/(^\d*).*/$1/;'`
+            if test "$GCC_VERSION_MAJOR" -lt "4" ; then
+                SDK_C_FRAMEWORK="-F${MACOS_SDK_DIR}/System/Library/Frameworks"
+                if test -d "${MACOS_SDK_DIR}/Library/Frameworks" ; then
+                    SDK_C_FRAMEWORK="$SDK_C_FRAMEWORK -F${MACOS_SDK_DIR}/Library/Frameworks"
+                fi
+
+                SDK_C_INCLUDE="-isystem ${MACOS_SDK_DIR}/usr/include/gcc/darwin/${GCC_VERSION} -isystem ${MACOS_SDK_DIR}/usr/include ${SDK_C_FRAMEWORK}"
+
+                CFLAGS="$CFLAGS -nostdinc ${SDK_C_INCLUDE}"
+
+                dnl CPP needs to be set for AC_CHECK_HEADER.
+                CPP="$CPP -nostdinc ${SDK_C_INCLUDE}"
+
+                changequote(,)
+                HOST_DARWIN_MAJOR=`echo "$build_os" | sed -E -e 's/^darwin([0-9]+).*$/\1/'`
+                changequote([,])
+                if test "$HOST_DARWIN_MAJOR" -lt 9 ; then
+                    dnl The build host is running Tiger (10.4) or earlier.
+                    dnl ld support for -syslibroot is compiler-agnostic, but
+                    dnl only available on Tiger and later.  On Tiger and
+                    dnl earlier build hosts, just rely on NEXT_ROOT, because
+                    dnl it's not been shown to cause any problems.
+                    MACOS_SDK_LIBS="-L${MACOS_SDK_DIR}/usr/lib/gcc/darwin -L${MACOS_SDK_DIR}/usr/lib/gcc/darwin/${GCC_VERSION_FULL} -L${MACOS_SDK_DIR}/usr/lib ${SDK_C_FRAMEWORK}"
+                else
+                    dnl The build host is running Leopard (10.5) or later.
+                    dnl With NEXT_ROOT set, the linker will still not apply
+                    dnl it when resolving dependencies.  This causes problems
+                    dnl on Leopard, where an SDK depends on frameworks which
+                    dnl were present in earlier OS releases (and the associated
+                    dnl SDK) but not in Leopard.  -syslibroot does not have
+                    dnl this problem, but it results in harmless warnings when
+                    dnl NEXT_ROOT is set.  NEXT_ROOT needs to remain set even
+                    dnl on Leopard because the compiler uses it too.
+                    MACOS_SDK_LIBS="-Wl,-syslibroot,${MACOS_SDK_DIR}"
+                fi
+
+                LDFLAGS="${MACOS_SDK_LIBS} $LDFLAGS"
+                export NEXT_ROOT=$MACOS_SDK_DIR
+
+                if test -n "$CROSS_COMPILE" ; then
+                    dnl NEXT_ROOT will be in the environment, but it
+                    dnl shouldn't be set for the build host.  HOST_CXX is
+                    dnl presently unused.
+                    HOST_CC="NEXT_ROOT= $HOST_CC"
+                    HOST_CXX="NEXT_ROOT= $HOST_CXX"
+                fi
             else
-                dnl The build host is running Leopard (10.5) or later.
-                dnl With NEXT_ROOT set, the linker will still not apply
-                dnl it when resolving dependencies.  This causes problems
-                dnl on Leopard, where an SDK depends on frameworks which
-                dnl were present in earlier OS releases (and the associated
-                dnl SDK) but not in Leopard.  -syslibroot does not have
-                dnl this problem, but it results in harmless warnings when
-                dnl NEXT_ROOT is set.  NEXT_ROOT needs to remain set even
-                dnl on Leopard because the compiler uses it too.
-                MACOS_SDK_LIBS="-Wl,-syslibroot,${MACOS_SDK_DIR}"
-            fi
+                dnl gcc >= 4.0 uses different paths than above, but knows
+                dnl how to find them itself.
+                CFLAGS="$CFLAGS -isysroot ${MACOS_SDK_DIR}"
 
-            LDFLAGS="${MACOS_SDK_LIBS} $LDFLAGS"
-            export NEXT_ROOT=$MACOS_SDK_DIR
+                dnl CPP needs to be set for AC_CHECK_HEADER.
+                CPP="$CPP -isysroot ${MACOS_SDK_DIR}"
 
-            if test -n "$CROSS_COMPILE" ; then
-                dnl NEXT_ROOT will be in the environment, but it
-                dnl shouldn't be set for the build host.  HOST_CXX is
-                dnl presently unused.
-                HOST_CC="NEXT_ROOT= $HOST_CC"
-                HOST_CXX="NEXT_ROOT= $HOST_CXX"
-            fi
-        else
-            dnl gcc >= 4.0 uses different paths than above, but knows
-            dnl how to find them itself.
-            CFLAGS="$CFLAGS -isysroot ${MACOS_SDK_DIR}"
-
-            dnl CPP needs to be set for AC_CHECK_HEADER.
-            CPP="$CPP -isysroot ${MACOS_SDK_DIR}"
-
-            dnl If gcc >= 4.0.0, we're guaranteed to be on Tiger, which
-            dnl has an ld that supports -syslibroot.  Don't set
-            dnl NEXT_ROOT because it will be ignored and cause
-            dnl warnings when -syslibroot is specified.
-            if test "$GCC_VERSION_FULL" != "4.0.0" ; then
-                dnl gcc > 4.0.0 will pass -syslibroot to ld automatically
-                dnl based on the -isysroot it receives.
-                LDFLAGS="$LDFLAGS -isysroot ${MACOS_SDK_DIR}"
-            else
-                dnl gcc 4.0.0 doesn't pass -syslibroot to ld, it needs
-                dnl to be explicit.
-                LDFLAGS="$LDFLAGS -Wl,-syslibroot,${MACOS_SDK_DIR}"
+                dnl If gcc >= 4.0.0, we're guaranteed to be on Tiger, which
+                dnl has an ld that supports -syslibroot.  Don't set
+                dnl NEXT_ROOT because it will be ignored and cause
+                dnl warnings when -syslibroot is specified.
+                if test "$GCC_VERSION_FULL" != "4.0.0" ; then
+                    dnl gcc > 4.0.0 will pass -syslibroot to ld automatically
+                    dnl based on the -isysroot it receives.
+                    LDFLAGS="$LDFLAGS -isysroot ${MACOS_SDK_DIR}"
+                else
+                    dnl gcc 4.0.0 doesn't pass -syslibroot to ld, it needs
+                    dnl to be explicit.
+                    LDFLAGS="$LDFLAGS -Wl,-syslibroot,${MACOS_SDK_DIR}"
+                fi
             fi
         fi
     fi

nsprpub/pr/include/md/_darwin.h

@@ -40,7 +40,11 @@
 
 #undef  HAVE_STACK_GROWING_UP
 #define HAVE_DLL
+#if defined(__x86_64__) || TARGET_OS_IPHONE
 #define USE_DLFCN
+#else
+#define USE_MACH_DYLD
+#endif
 #define _PR_HAVE_SOCKADDR_LEN
 #define _PR_STAT_HAS_ST_ATIMESPEC
 #define _PR_HAVE_LARGE_OFF_T
@@ -120,16 +124,7 @@ extern PRInt32 _PR_Darwin_x86_64_AtomicAdd(PRInt32 *ptr, PRInt32 val);
 #define _MD_ATOMIC_ADD(ptr, val)    _PR_Darwin_x86_64_AtomicAdd(ptr, val)
 #endif /* __x86_64__ */
 
-#ifdef __aarch64__
-#define _PR_HAVE_ATOMIC_OPS
-#define _MD_INIT_ATOMIC()
-#define _MD_ATOMIC_INCREMENT(val)   __sync_add_and_fetch(val, 1)
-#define _MD_ATOMIC_DECREMENT(val)   __sync_sub_and_fetch(val, 1)
-#define _MD_ATOMIC_SET(val, newval) __sync_lock_test_and_set(val, newval)
-#define _MD_ATOMIC_ADD(ptr, val)    __sync_add_and_fetch(ptr, val)
-#endif /* __aarch64__ */
-
-#if defined(__arm__)
+#if defined(__arm__) || defined(__aarch64__)
 #define _PR_HAVE_ATOMIC_OPS
 #define _MD_INIT_ATOMIC()
 #define _MD_ATOMIC_INCREMENT(val)   OSAtomicIncrement32(val)
@@ -143,7 +138,7 @@ static inline PRInt32 _MD_ATOMIC_SET(PRInt32 *val, PRInt32 newval)
     return oldval;
 }
 #define _MD_ATOMIC_ADD(ptr, val)    OSAtomicAdd32(val, ptr)
-#endif /* __arm__ */
+#endif /* __arm__ || __aarch64__ */
 
 #define USE_SETJMP
 

nsprpub/pr/include/md/_linux.cfg

@@ -1208,53 +1208,6 @@
 #define PR_BYTES_PER_WORD_LOG2   2
 #define PR_BYTES_PER_DWORD_LOG2  3
 
-#elif defined(__e2k__)
-
-#define IS_LITTLE_ENDIAN 1
-#undef  IS_BIG_ENDIAN
-
-#define IS_64
-
-#define PR_BYTES_PER_BYTE   1
-#define PR_BYTES_PER_SHORT  2
-#define PR_BYTES_PER_INT    4
-#define PR_BYTES_PER_INT64  4
-#define PR_BYTES_PER_LONG   8
-#define PR_BYTES_PER_FLOAT  4
-#define PR_BYTES_PER_DOUBLE 8
-#define PR_BYTES_PER_WORD   8
-#define PR_BYTES_PER_DWORD  8
-
-#define PR_BITS_PER_BYTE    8
-#define PR_BITS_PER_SHORT   16
-#define PR_BITS_PER_INT     32
-#define PR_BITS_PER_INT64   32
-#define PR_BITS_PER_LONG    64
-#define PR_BITS_PER_FLOAT   32
-#define PR_BITS_PER_DOUBLE  64
-#define PR_BITS_PER_WORD    64
-
-#define PR_BITS_PER_BYTE_LOG2   3
-#define PR_BITS_PER_SHORT_LOG2  4
-#define PR_BITS_PER_INT_LOG2    5
-#define PR_BITS_PER_INT64_LOG2  5
-#define PR_BITS_PER_LONG_LOG2   6
-#define PR_BITS_PER_FLOAT_LOG2  5
-#define PR_BITS_PER_DOUBLE_LOG2 6
-#define PR_BITS_PER_WORD_LOG2   6
-
-#define PR_ALIGN_OF_SHORT   2
-#define PR_ALIGN_OF_INT     4
-#define PR_ALIGN_OF_LONG    8
-#define PR_ALIGN_OF_INT64   4
-#define PR_ALIGN_OF_FLOAT   4
-#define PR_ALIGN_OF_DOUBLE  8
-#define PR_ALIGN_OF_POINTER 8
-#define PR_ALIGN_OF_WORD    8
-
-#define PR_BYTES_PER_WORD_LOG2  3
-#define PR_BYTES_PER_DWORD_LOG2 3
-
 #else
 
 #error "Unknown CPU architecture"

nsprpub/pr/include/md/_linux.h

@@ -61,8 +61,6 @@
 #define _PR_SI_ARCHITECTURE "riscv32"
 #elif defined(__riscv) && (__riscv_xlen == 64)
 #define _PR_SI_ARCHITECTURE "riscv64"
-#elif defined(__e2k__)
-#define _PR_SI_ARCHITECTURE "e2k"
 #elif defined(__arc__)
 #define _PR_SI_ARCHITECTURE "arc"
 #elif defined(__nios2__)

nsprpub/pr/include/prinit.h

@@ -31,9 +31,9 @@ PR_BEGIN_EXTERN_C
 ** The format of the version string is
 **     "<major version>.<minor version>[.<patch level>] [<Beta>]"
 */
-#define PR_VERSION  "4.29"
+#define PR_VERSION  "4.25"
 #define PR_VMAJOR   4
-#define PR_VMINOR   29
+#define PR_VMINOR   25
 #define PR_VPATCH   0
 #define PR_BETA     PR_FALSE
 

nsprpub/pr/include/prsystem.h

@@ -43,9 +43,8 @@ typedef enum {
     PR_SI_SYSNAME,
     PR_SI_RELEASE,
     PR_SI_ARCHITECTURE,
-    PR_SI_HOSTNAME_UNTRUNCATED, /* the hostname exactly as configured
+    PR_SI_HOSTNAME_UNTRUNCATED  /* the hostname exactly as configured
                                  * on the system */
-    PR_SI_RELEASE_BUILD
 } PRSysInfo;
 
 

nsprpub/pr/src/Makefile.in

@@ -159,6 +159,10 @@ ifeq ($(OS_TARGET),Android)
 OS_LIBS		+= -llog
 endif
 
+ifeq ($(OS_TARGET),MacOSX)
+OS_LIBS		= -framework CoreServices -framework CoreFoundation
+endif
+
 EXTRA_LIBS += $(OS_LIBS)
 
 #

nsprpub/pr/src/linking/prlink.c

@@ -7,6 +7,11 @@
 
 #include <string.h>
 
+#if defined(XP_MACOSX) && defined(USE_MACH_DYLD)
+#include <Carbon/Carbon.h>
+#include <CoreFoundation/CoreFoundation.h>
+#endif
+
 #ifdef XP_UNIX
 #ifdef USE_DLFCN
 #include <dlfcn.h>
@@ -31,6 +36,8 @@
 #endif
 #elif defined(USE_HPSHL)
 #include <dl.h>
+#elif defined(USE_MACH_DYLD)
+#include <mach-o/dyld.h>
 #endif
 #endif /* XP_UNIX */
 
@@ -39,7 +46,8 @@
 /*
  * On these platforms, symbols have a leading '_'.
  */
-#if defined(XP_OS2) \
+#if (defined(DARWIN) && defined(USE_MACH_DYLD)) \
+    || defined(XP_OS2) \
     || ((defined(OPENBSD) || defined(NETBSD)) && !defined(__ELF__))
 #define NEED_LEADING_UNDERSCORE
 #endif
@@ -62,9 +70,19 @@ struct PRLibrary {
 #endif
 #endif
 
+#if defined(XP_MACOSX) && defined(USE_MACH_DYLD)
+    CFragConnectionID           connection;
+    CFBundleRef                 bundle;
+    Ptr                         main;
+    CFMutableDictionaryRef      wrappers;
+    const struct mach_header*   image;
+#endif
+
 #ifdef XP_UNIX
 #if defined(USE_HPSHL)
     shl_t                       dlh;
+#elif defined(USE_MACH_DYLD)
+    NSModule                    dlh;
 #else
     void*                       dlh;
 #endif
@@ -152,7 +170,7 @@ void _PR_InitLinker(void)
 #elif defined(USE_HPSHL)
     h = NULL;
     /* don't abort with this NULL */
-#elif defined(NO_DLOPEN_NULL)
+#elif defined(USE_MACH_DYLD) || defined(NO_DLOPEN_NULL)
     h = NULL; /* XXXX  toshok */ /* XXXX  vlad */
 #else
 #error no dll strategy
@@ -252,7 +270,7 @@ PR_GetLibraryPath(void)
 #endif
 
 #if defined(XP_UNIX)
-#if defined(USE_DLFCN)
+#if defined(USE_DLFCN) || defined(USE_MACH_DYLD)
     {
         char *p=NULL;
         int len;
@@ -410,6 +428,203 @@ PR_LoadLibrary(const char *name)
     return PR_LoadLibraryWithFlags(libSpec, 0);
 }
 
+#if defined(USE_MACH_DYLD)
+static NSModule
+pr_LoadMachDyldModule(const char *name)
+{
+    NSObjectFileImage ofi;
+    NSModule h = NULL;
+    if (NSCreateObjectFileImageFromFile(name, &ofi)
+        == NSObjectFileImageSuccess) {
+        h = NSLinkModule(ofi, name, NSLINKMODULE_OPTION_PRIVATE
+                         | NSLINKMODULE_OPTION_RETURN_ON_ERROR);
+        if (h == NULL) {
+            NSLinkEditErrors linkEditError;
+            int errorNum;
+            const char *fileName;
+            const char *errorString;
+            NSLinkEditError(&linkEditError, &errorNum, &fileName, &errorString);
+            PR_LOG(_pr_linker_lm, PR_LOG_MIN,
+                   ("LoadMachDyldModule error %d:%d for file %s:\n%s",
+                    linkEditError, errorNum, fileName, errorString));
+        }
+        if (NSDestroyObjectFileImage(ofi) == FALSE) {
+            if (h) {
+                (void)NSUnLinkModule(h, NSUNLINKMODULE_OPTION_NONE);
+                h = NULL;
+            }
+        }
+    }
+    return h;
+}
+#endif
+
+#if defined(XP_MACOSX) && defined(USE_MACH_DYLD)
+
+/*
+** macLibraryLoadProc is a function definition for a Mac shared library
+** loading method. The "name" param is the same full or partial pathname
+** that was passed to pr_LoadLibraryByPathName. The function must fill
+** in the fields of "lm" which apply to its library type. Returns
+** PR_SUCCESS if successful.
+*/
+
+typedef PRStatus (*macLibraryLoadProc)(const char *name, PRLibrary *lm);
+
+#ifdef __ppc__
+
+/*
+** CFM and its TVectors only exist on PowerPC.  Other OS X architectures
+** only use Mach-O as a native binary format.
+*/
+
+static void* TV2FP(CFMutableDictionaryRef dict, const char* name, void *tvp)
+{
+    static uint32 glue[6] = { 0x3D800000, 0x618C0000, 0x800C0000, 0x804C0004, 0x7C0903A6, 0x4E800420 };
+    uint32* newGlue = NULL;
+
+    if (tvp != NULL) {
+        CFStringRef nameRef = CFStringCreateWithCString(NULL, name, kCFStringEncodingASCII);
+        if (nameRef) {
+            CFMutableDataRef glueData = (CFMutableDataRef) CFDictionaryGetValue(dict, nameRef);
+            if (glueData == NULL) {
+                glueData = CFDataCreateMutable(NULL, sizeof(glue));
+                if (glueData != NULL) {
+                    newGlue = (uint32*) CFDataGetMutableBytePtr(glueData);
+                    memcpy(newGlue, glue, sizeof(glue));
+                    newGlue[0] |= ((UInt32)tvp >> 16);
+                    newGlue[1] |= ((UInt32)tvp & 0xFFFF);
+                    MakeDataExecutable(newGlue, sizeof(glue));
+                    CFDictionaryAddValue(dict, nameRef, glueData);
+                    CFRelease(glueData);
+
+                    PR_LOG(_pr_linker_lm, PR_LOG_MIN, ("TV2FP: created wrapper for CFM function %s().", name));
+                }
+            } else {
+                PR_LOG(_pr_linker_lm, PR_LOG_MIN, ("TV2FP: found wrapper for CFM function %s().", name));
+
+                newGlue = (uint32*) CFDataGetMutableBytePtr(glueData);
+            }
+            CFRelease(nameRef);
+        }
+    }
+
+    return newGlue;
+}
+
+static PRStatus
+pr_LoadViaCFM(const char *name, PRLibrary *lm)
+{
+    OSErr err;
+    Str255 errName;
+    FSRef ref;
+    FSSpec fileSpec;
+    Boolean tempUnusedBool;
+
+    /*
+     * Make an FSSpec from the path name and call GetDiskFragment.
+     */
+
+    /* Use direct conversion of POSIX path to FSRef to FSSpec. */
+    err = FSPathMakeRef((const UInt8*)name, &ref, NULL);
+    if (err != noErr) {
+        return PR_FAILURE;
+    }
+    err = FSGetCatalogInfo(&ref, kFSCatInfoNone, NULL, NULL,
+                           &fileSpec, NULL);
+    if (err != noErr) {
+        return PR_FAILURE;
+    }
+
+    /* Resolve an alias if this was one */
+    err = ResolveAliasFile(&fileSpec, true, &tempUnusedBool,
+                           &tempUnusedBool);
+    if (err != noErr) {
+        return PR_FAILURE;
+    }
+
+    /* Finally, try to load the library */
+    err = GetDiskFragment(&fileSpec, 0, kCFragGoesToEOF, fileSpec.name,
+                          kLoadCFrag, &lm->connection, &lm->main, errName);
+
+    if (err == noErr && lm->connection) {
+        /*
+         * if we're a mach-o binary, need to wrap all CFM function
+         * pointers. need a hash-table of already seen function
+         * pointers, etc.
+         */
+        lm->wrappers = CFDictionaryCreateMutable(NULL, 16,
+                       &kCFTypeDictionaryKeyCallBacks,
+                       &kCFTypeDictionaryValueCallBacks);
+        if (lm->wrappers) {
+            lm->main = TV2FP(lm->wrappers, "main", lm->main);
+        } else {
+            err = memFullErr;
+        }
+    }
+    return (err == noErr) ? PR_SUCCESS : PR_FAILURE;
+}
+#endif /* __ppc__ */
+
+/*
+** Creates a CFBundleRef if the pathname refers to a Mac OS X bundle
+** directory. The caller is responsible for calling CFRelease() to
+** deallocate.
+*/
+
+static PRStatus
+pr_LoadCFBundle(const char *name, PRLibrary *lm)
+{
+    CFURLRef bundleURL;
+    CFBundleRef bundle = NULL;
+    char pathBuf[PATH_MAX];
+    const char *resolvedPath;
+    CFStringRef pathRef;
+
+    /* Takes care of relative paths and symlinks */
+    resolvedPath = realpath(name, pathBuf);
+    if (!resolvedPath) {
+        return PR_FAILURE;
+    }
+
+    pathRef = CFStringCreateWithCString(NULL, pathBuf, kCFStringEncodingUTF8);
+    if (pathRef) {
+        bundleURL = CFURLCreateWithFileSystemPath(NULL, pathRef,
+                    kCFURLPOSIXPathStyle, true);
+        if (bundleURL) {
+            bundle = CFBundleCreate(NULL, bundleURL);
+            CFRelease(bundleURL);
+        }
+        CFRelease(pathRef);
+    }
+
+    lm->bundle = bundle;
+    return (bundle != NULL) ? PR_SUCCESS : PR_FAILURE;
+}
+
+static PRStatus
+pr_LoadViaDyld(const char *name, PRLibrary *lm)
+{
+    lm->dlh = pr_LoadMachDyldModule(name);
+    if (lm->dlh == NULL) {
+        lm->image = NSAddImage(name, NSADDIMAGE_OPTION_RETURN_ON_ERROR
+                               | NSADDIMAGE_OPTION_WITH_SEARCHING);
+        if (lm->image == NULL) {
+            NSLinkEditErrors linkEditError;
+            int errorNum;
+            const char *fileName;
+            const char *errorString;
+            NSLinkEditError(&linkEditError, &errorNum, &fileName, &errorString);
+            PR_LOG(_pr_linker_lm, PR_LOG_MIN,
+                   ("LoadMachDyldModule error %d:%d for file %s:\n%s",
+                    linkEditError, errorNum, fileName, errorString));
+        }
+    }
+    return (lm->dlh != NULL || lm->image != NULL) ? PR_SUCCESS : PR_FAILURE;
+}
+
+#endif /* XP_MACOSX && USE_MACH_DYLD */
+
 /*
 ** Dynamically load a library. Only load libraries once, so scan the load
 ** map first.
@@ -518,7 +733,36 @@ pr_LoadLibraryByPathname(const char *name, PRIntn flags)
     }
 #endif /* WIN32 */
 
-#if defined(XP_UNIX)
+#if defined(XP_MACOSX) && defined(USE_MACH_DYLD)
+    {
+        int     i;
+        PRStatus status;
+
+        static const macLibraryLoadProc loadProcs[] = {
+#ifdef __ppc__
+            pr_LoadViaDyld, pr_LoadCFBundle, pr_LoadViaCFM
+#else  /* __ppc__ */
+            pr_LoadViaDyld, pr_LoadCFBundle
+#endif /* __ppc__ */
+        };
+
+        for (i = 0; i < sizeof(loadProcs) / sizeof(loadProcs[0]); i++) {
+            if ((status = loadProcs[i](name, lm)) == PR_SUCCESS) {
+                break;
+            }
+        }
+        if (status != PR_SUCCESS) {
+            oserr = cfragNoLibraryErr;
+            PR_DELETE(lm);
+            goto unlock;
+        }
+        lm->name = strdup(name);
+        lm->next = pr_loadmap;
+        pr_loadmap = lm;
+    }
+#endif
+
+#if defined(XP_UNIX) && !(defined(XP_MACOSX) && defined(USE_MACH_DYLD))
 #ifdef HAVE_DLL
     {
 #if defined(USE_DLFCN)
@@ -532,9 +776,6 @@ pr_LoadLibraryByPathname(const char *name, PRIntn flags)
         int dl_flags = 0;
 #endif
         void *h = NULL;
-#if defined(DARWIN)
-        PRBool okToLoad = PR_FALSE;
-#endif
 
         if (flags & PR_LD_LAZY) {
             dl_flags |= RTLD_LAZY;
@@ -549,36 +790,12 @@ pr_LoadLibraryByPathname(const char *name, PRIntn flags)
             dl_flags |= RTLD_LOCAL;
         }
 #if defined(DARWIN)
-        /* If the file contains an absolute or relative path (slash)
-         * and the path doesn't look like a System path, then require
-         * the file exists.
-         * The reason is that DARWIN's dlopen ignores the provided path
-         * and checks for the plain filename in DYLD_LIBRARY_PATH,
-         * which could load an unexpected version of a library. */
-        if (strchr(name, PR_DIRECTORY_SEPARATOR) == NULL) {
-          /* no slash, allow to load from any location */
-          okToLoad = PR_TRUE;
-        } else {
-          const char systemPrefix1[] = "/System/";
-          const size_t systemPrefixLen1 = strlen(systemPrefix1);
-          const char systemPrefix2[] = "/usr/lib/";
-          const size_t systemPrefixLen2 = strlen(systemPrefix2);
-          const size_t name_len = strlen(name);
-          if (((name_len > systemPrefixLen1) &&
-               (strncmp(name, systemPrefix1, systemPrefixLen1) == 0)) ||
-             ((name_len > systemPrefixLen2) &&
-               (strncmp(name, systemPrefix2, systemPrefixLen2) == 0))) {
-            /* found at beginning, it's a system library.
-             * Skip filesystem check (required for macOS 11),
-             * allow loading from any location */
-            okToLoad = PR_TRUE;
-          } else if (PR_Access(name, PR_ACCESS_EXISTS) == PR_SUCCESS) {
-            /* file exists, allow to load */
-            okToLoad = PR_TRUE;
-          }
-        }
-        if (okToLoad) {
-          h = dlopen(name, dl_flags);
+        /* ensure the file exists if it contains a slash character i.e. path */
+        /* DARWIN's dlopen ignores the provided path and checks for the */
+        /* plain filename in DYLD_LIBRARY_PATH */
+        if (strchr(name, PR_DIRECTORY_SEPARATOR) == NULL ||
+            PR_Access(name, PR_ACCESS_EXISTS) == PR_SUCCESS) {
+            h = dlopen(name, dl_flags);
         }
 #else
         h = dlopen(name, dl_flags);
@@ -603,6 +820,8 @@ pr_LoadLibraryByPathname(const char *name, PRIntn flags)
         }
         /* No equivalent of PR_LD_GLOBAL and PR_LD_LOCAL. */
         h = shl_load(name, shl_flags, 0L);
+#elif defined(USE_MACH_DYLD)
+        NSModule h = pr_LoadMachDyldModule(name);
 #else
 #error Configuration error
 #endif
@@ -617,7 +836,7 @@ pr_LoadLibraryByPathname(const char *name, PRIntn flags)
         pr_loadmap = lm;
     }
 #endif /* HAVE_DLL */
-#endif /* XP_UNIX */
+#endif /* XP_UNIX && !(XP_MACOSX && USE_MACH_DYLD) */
 
     lm->refCount = 1;
 
@@ -676,6 +895,10 @@ PR_UnloadLibrary(PRLibrary *lib)
     result = dlclose(lib->dlh);
 #elif defined(USE_HPSHL)
     result = shl_unload(lib->dlh);
+#elif defined(USE_MACH_DYLD)
+    if (lib->dlh) {
+        result = NSUnLinkModule(lib->dlh, NSUNLINKMODULE_OPTION_NONE) ? 0 : -1;
+    }
 #else
 #error Configuration error
 #endif
@@ -688,6 +911,20 @@ PR_UnloadLibrary(PRLibrary *lib)
     }
 #endif  /* XP_PC */
 
+#if defined(XP_MACOSX) && defined(USE_MACH_DYLD)
+    /* Close the connection */
+    if (lib->connection) {
+        CloseConnection(&(lib->connection));
+    }
+    if (lib->bundle) {
+        CFRelease(lib->bundle);
+    }
+    if (lib->wrappers) {
+        CFRelease(lib->wrappers);
+    }
+    /* No way to unload an image (lib->image) */
+#endif
+
     /* unlink from library search list */
     if (pr_loadmap == lib) {
         pr_loadmap = pr_loadmap->next;
@@ -777,6 +1014,53 @@ pr_FindSymbolInLib(PRLibrary *lm, const char *name)
     f = GetProcAddress(lm->dlh, name);
 #endif  /* WIN32 */
 
+#if defined(XP_MACOSX) && defined(USE_MACH_DYLD)
+    /* add this offset to skip the leading underscore in name */
+#define SYM_OFFSET 1
+    if (lm->bundle) {
+        CFStringRef nameRef = CFStringCreateWithCString(NULL, name + SYM_OFFSET, kCFStringEncodingASCII);
+        if (nameRef) {
+            f = CFBundleGetFunctionPointerForName(lm->bundle, nameRef);
+            CFRelease(nameRef);
+        }
+    }
+    if (lm->connection) {
+        Ptr                 symAddr;
+        CFragSymbolClass    symClass;
+        Str255              pName;
+
+        PR_LOG(_pr_linker_lm, PR_LOG_MIN, ("Looking up symbol: %s", name + SYM_OFFSET));
+
+        c2pstrcpy(pName, name + SYM_OFFSET);
+
+        f = (FindSymbol(lm->connection, pName, &symAddr, &symClass) == noErr) ? symAddr : NULL;
+
+#ifdef __ppc__
+        /* callers expect mach-o function pointers, so must wrap tvectors with glue. */
+        if (f && symClass == kTVectorCFragSymbol) {
+            f = TV2FP(lm->wrappers, name + SYM_OFFSET, f);
+        }
+#endif /* __ppc__ */
+
+        if (f == NULL && strcmp(name + SYM_OFFSET, "main") == 0) {
+            f = lm->main;
+        }
+    }
+    if (lm->image) {
+        NSSymbol symbol;
+        symbol = NSLookupSymbolInImage(lm->image, name,
+                                       NSLOOKUPSYMBOLINIMAGE_OPTION_BIND
+                                       | NSLOOKUPSYMBOLINIMAGE_OPTION_RETURN_ON_ERROR);
+        if (symbol != NULL) {
+            f = NSAddressOfSymbol(symbol);
+        }
+        else {
+            f = NULL;
+        }
+    }
+#undef SYM_OFFSET
+#endif /* XP_MACOSX && USE_MACH_DYLD */
+
 #ifdef XP_UNIX
 #ifdef HAVE_DLL
 #ifdef USE_DLFCN
@@ -785,6 +1069,17 @@ pr_FindSymbolInLib(PRLibrary *lm, const char *name)
     if (shl_findsym(&lm->dlh, name, TYPE_PROCEDURE, &f) == -1) {
         f = NULL;
     }
+#elif defined(USE_MACH_DYLD)
+    if (lm->dlh) {
+        NSSymbol symbol;
+        symbol = NSLookupSymbolInModule(lm->dlh, name);
+        if (symbol != NULL) {
+            f = NSAddressOfSymbol(symbol);
+        }
+        else {
+            f = NULL;
+        }
+    }
 #endif
 #endif /* HAVE_DLL */
 #endif /* XP_UNIX */
@@ -967,6 +1262,23 @@ PR_GetLibraryFilePathname(const char *name, PRFuncPtr addr)
         strcpy(result, dli.dli_fname);
     }
     return result;
+#elif defined(USE_MACH_DYLD)
+    char *result;
+    const char *image_name;
+    int i, count = _dyld_image_count();
+
+    for (i = 0; i < count; i++) {
+        image_name = _dyld_get_image_name(i);
+        if (strstr(image_name, name) != NULL) {
+            result = PR_Malloc(strlen(image_name)+1);
+            if (result != NULL) {
+                strcpy(result, image_name);
+            }
+            return result;
+        }
+    }
+    PR_SetError(PR_LIBRARY_NOT_LOADED_ERROR, 0);
+    return NULL;
 #elif defined(AIX)
     char *result;
 #define LD_INFO_INCREMENT 64

nsprpub/pr/src/md/unix/os_Linux_ia64.s

@@ -68,4 +68,4 @@ _PR_ia64_AtomicSet:
         .endp _PR_ia64_AtomicSet#
 
 // Magic indicating no need for an executable stack
-.section .note.GNU-stack, "", @progbits
+.section .note.GNU-stack, "", @progbits ; .previous

nsprpub/pr/src/md/unix/os_Linux_ppc.s

@@ -72,4 +72,4 @@ _PR_ppc_AtomicAdd:
 .Lfe4:  .size _PR_ppc_AtomicAdd,.Lfe4-_PR_ppc_AtomicAdd
 
 # Magic indicating no need for an executable stack
-.section .note.GNU-stack, "", @progbits
+.section .note.GNU-stack, "", @progbits ; .previous

nsprpub/pr/src/md/unix/os_Linux_x86.s

@@ -82,4 +82,4 @@ _PR_x86_AtomicAdd:
     ret
 
 // Magic indicating no need for an executable stack
-.section .note.GNU-stack, "", @progbits
+.section .note.GNU-stack, "", @progbits ; .previous

nsprpub/pr/src/md/unix/os_Linux_x86_64.s

@@ -71,4 +71,4 @@ _PR_x86_64_AtomicAdd:
     .size _PR_x86_64_AtomicAdd, .-_PR_x86_64_AtomicAdd
 
 // Magic indicating no need for an executable stack
-.section .note.GNU-stack, "", @progbits
+.section .note.GNU-stack, "", @progbits ; .previous

nsprpub/pr/src/md/unix/unix.c

@@ -3481,8 +3481,7 @@ PRStatus _MD_getsysinfo(PRSysInfo cmd, char *name, PRUint32 namelen)
 {
     struct utsname info;
 
-    PR_ASSERT((cmd == PR_SI_SYSNAME) || (cmd == PR_SI_RELEASE) ||
-              (cmd == PR_SI_RELEASE_BUILD));
+    PR_ASSERT((cmd == PR_SI_SYSNAME) || (cmd == PR_SI_RELEASE));
 
     if (uname(&info) == -1) {
         _PR_MD_MAP_DEFAULT_ERROR(errno);
@@ -3494,9 +3493,6 @@ PRStatus _MD_getsysinfo(PRSysInfo cmd, char *name, PRUint32 namelen)
     else if (PR_SI_RELEASE == cmd) {
         (void)PR_snprintf(name, namelen, info.release);
     }
-    else if (PR_SI_RELEASE_BUILD == cmd) {
-        (void)PR_snprintf(name, namelen, info.version);
-    }
     else {
         return PR_FAILURE;
     }

nsprpub/pr/src/md/windows/ntmisc.c

@@ -812,8 +812,7 @@ PRStatus _MD_WindowsGetSysInfo(PRSysInfo cmd, char *name, PRUint32 namelen)
 {
     OSVERSIONINFO osvi;
 
-    PR_ASSERT((cmd == PR_SI_SYSNAME) || (cmd == PR_SI_RELEASE) ||
-              (cmd == PR_SI_RELEASE_BUILD));
+    PR_ASSERT((cmd == PR_SI_SYSNAME) || (cmd == PR_SI_RELEASE));
 
     ZeroMemory(&osvi, sizeof(OSVERSIONINFO));
     osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
@@ -828,13 +827,9 @@ PRStatus _MD_WindowsGetSysInfo(PRSysInfo cmd, char *name, PRUint32 namelen)
             if (PR_SI_SYSNAME == cmd) {
                 (void)PR_snprintf(name, namelen, "Windows_NT");
             }
-            else if (PR_SI_RELEASE == cmd) {
+            else if (PR_SI_RELEASE == cmd)
                 (void)PR_snprintf(name, namelen, "%d.%d",osvi.dwMajorVersion,
                                   osvi.dwMinorVersion);
-            }
-            else if (PR_SI_RELEASE_BUILD == cmd) {
-                (void)PR_snprintf(name, namelen, "%d", osvi.dwBuildNumber);
-            }
             break;
         case VER_PLATFORM_WIN32_WINDOWS:
             if (PR_SI_SYSNAME == cmd) {
@@ -848,8 +843,6 @@ PRStatus _MD_WindowsGetSysInfo(PRSysInfo cmd, char *name, PRUint32 namelen)
             } else if (PR_SI_RELEASE == cmd) {
                 (void)PR_snprintf(name, namelen, "%d.%d",osvi.dwMajorVersion,
                                   osvi.dwMinorVersion);
-            } else if (PR_SI_RELEASE_BUILD == cmd) {
-                (void)PR_snprintf(name, namelen, "%d", osvi.dwBuildNumber);
             }
             break;
 #ifdef VER_PLATFORM_WIN32_CE
@@ -857,15 +850,9 @@ PRStatus _MD_WindowsGetSysInfo(PRSysInfo cmd, char *name, PRUint32 namelen)
             if (PR_SI_SYSNAME == cmd) {
                 (void)PR_snprintf(name, namelen, "Windows_CE");
             }
-            else if (PR_SI_RELEASE == cmd) {
+            else if (PR_SI_RELEASE == cmd)
                 (void)PR_snprintf(name, namelen, "%d.%d",osvi.dwMajorVersion,
                                   osvi.dwMinorVersion);
-            }
-            else if (PR_SI_RELEASE_BUILD == cmd) {
-              if (namelen) {
-                *name = 0;
-              }
-            }
             break;
 #endif
         default:
@@ -875,11 +862,6 @@ PRStatus _MD_WindowsGetSysInfo(PRSysInfo cmd, char *name, PRUint32 namelen)
             else if (PR_SI_RELEASE == cmd) {
                 (void)PR_snprintf(name, namelen, "%d.%d",0,0);
             }
-            else if (PR_SI_RELEASE_BUILD == cmd) {
-              if (namelen) {
-                *name = 0;
-              }
-            }
             break;
     }
     return PR_SUCCESS;

nsprpub/pr/src/md/windows/w95sock.c

@@ -7,9 +7,6 @@
  *
  */
 
-#if defined(_WIN64)
-#include <winsock2.h>
-#endif
 #include "primpl.h"
 
 #define READ_FD     1

nsprpub/pr/src/misc/prdtoa.c

@@ -304,6 +304,17 @@ static double private_mem[PRIVATE_mem], *pmem_next = private_mem;
 
 #else /* ifndef Bad_float_h */
 #include "float.h"
+/*
+ * MacOS 10.2 defines the macro FLT_ROUNDS to an internal function
+ * which does not exist on 10.1.  We can safely #define it to 1 here
+ * to allow 10.2 builds to run on 10.1, since we can't use fesetround()
+ * (which does not exist on 10.1 either).
+ */
+#if defined(XP_MACOSX) && (!defined(MAC_OS_X_VERSION_10_2) || \
+    MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_2)
+#undef FLT_ROUNDS
+#define FLT_ROUNDS 1
+#endif /* DT < 10.2 */
 #endif /* Bad_float_h */
 
 #ifndef __MATH_H__

nsprpub/pr/src/misc/prnetdb.c

@@ -166,7 +166,9 @@ static PRBool _pr_have_inet6_if = PR_FALSE;
 #undef DEBUG_QUERY_IFS
 
 #if defined(AIX) \
-    || (defined(DARWIN) && !defined(HAVE_GETIFADDRS))
+    || (defined(DARWIN) && (!defined(HAVE_GETIFADDRS) \
+        || (defined(XP_MACOSX) && (!defined(MAC_OS_X_VERSION_10_2) || \
+        MAC_OS_X_VERSION_MIN_REQUIRED < MAC_OS_X_VERSION_10_2))))
 
 /*
  * Use SIOCGIFCONF ioctl on platforms that don't have routing

nsprpub/pr/src/misc/prsystem.c

@@ -152,19 +152,6 @@ PR_IMPLEMENT(PRStatus) PR_GetSystemInfo(PRSysInfo cmd, char *buf, PRUint32 bufle
 #endif /* OS2 */
             break;
 
-        case PR_SI_RELEASE_BUILD:
-          /* Return the version of the operating system */
-#if defined(XP_UNIX) || defined(WIN32)
-            if (PR_FAILURE == _PR_MD_GETSYSINFO(cmd, buf, (PRUintn)buflen)) {
-              return PR_FAILURE;
-            }
-#else
-            if (buflen) {
-                *buf = 0;
-            }
-#endif /* XP_UNIX || WIN32 */
-            break;
-
         case PR_SI_ARCHITECTURE:
             /* Return the architecture of the machine (ie. x86, mips, alpha, ...)*/
             (void)PR_snprintf(buf, buflen, _PR_SI_ARCHITECTURE);

nsprpub/pr/tests/Makefile.in

@@ -211,7 +211,6 @@ ifdef NS_USE_GCC
 else
   EXTRA_LIBS += ws2_32.lib
   LDOPTS = -NOLOGO -DEBUG -DEBUGTYPE:CV -INCREMENTAL:NO
-  CFLAGS += -Fd$(@:.$(OBJ_SUFFIX)=.pdb)
   ifdef PROFILE
     LDOPTS += -PROFILE -MAP
   endif # profile

nsprpub/pr/tests/sel_spd.c

@@ -16,10 +16,6 @@
 #include <errno.h>
 #include <string.h>
 
-#if defined(XP_UNIX)
-#include <unistd.h>
-#endif
-
 #ifdef DEBUG
 #define PORT_INC_DO +100
 #else

nsprpub/pr/tests/testfile.c

@@ -17,10 +17,6 @@
 #include <pthread.h>
 #endif
 
-#if defined(XP_UNIX)
-#include <unistd.h>
-#endif
-
 #if defined(XP_OS2)
 #define INCL_DOSFILEMGR
 #include <os2.h>

nsprpub/pr/tests/vercheck.c

@@ -41,7 +41,7 @@ static char *compatible_version[] = {
     "4.10.5", "4.10.6", "4.10.7", "4.10.8", "4.10.9",
     "4.10.10", "4.11", "4.12", "4.13", "4.14", "4.15",
     "4.16", "4.17", "4.18", "4.19", "4.20", "4.21", "4.22",
-    "4.23", "4.24", "4.25", "4,26", "4.27", "4.28",
+    "4.23", "4.24",
     PR_VERSION
 };
 
@@ -57,8 +57,8 @@ static char *incompatible_version[] = {
     "3.0", "3.0.1",
     "3.1", "3.1.1", "3.1.2", "3.1.3",
     "3.5", "3.5.1",
-    "4.29.1",
-    "4.30", "4.30.1",
+    "4.25.1",
+    "4.26", "4.26.1",
     "10.0", "11.1", "12.14.20"
 };
 

security/apps/AppTrustDomain.cpp

@@ -292,6 +292,7 @@ AppTrustDomain::DigestBuf(Input item,
 
 Result
 AppTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
+                                /*optional*/ const Input*,
                                 /*optional*/ const Input*,
                                 /*optional*/ const Input*)
 {
@@ -301,7 +302,8 @@ AppTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
 }
 
 Result
-AppTrustDomain::IsChainValid(const DERArray& certChain, Time time)
+AppTrustDomain::IsChainValid(const DERArray& certChain, Time time,
+                             const CertPolicyId& requiredPolicy)
 {
   SECStatus srv = ConstructCERTCertListFromReversedDERArray(certChain,
                                                             mCertChain);

security/apps/AppTrustDomain.h

@@ -37,9 +37,11 @@ public:
                                  mozilla::pkix::Time time,
                                  mozilla::pkix::Duration validityDuration,
                     /*optional*/ const mozilla::pkix::Input* stapledOCSPresponse,
-                    /*optional*/ const mozilla::pkix::Input* aiaExtension) override;
+                    /*optional*/ const mozilla::pkix::Input* aiaExtension,
+                    /*optional*/ const mozilla::pkix::Input* sctExtension) override;
   virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
-                              mozilla::pkix::Time time) override;
+                              mozilla::pkix::Time time,
+                              const mozilla::pkix::CertPolicyId& requiredPolicy) override;
   virtual Result CheckSignatureDigestAlgorithm(
                    mozilla::pkix::DigestAlgorithm digestAlg,
                    mozilla::pkix::EndEntityOrCA endEntityOrCA,

security/certverifier/CTLogVerifier.cpp

@@ -10,7 +10,7 @@
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/Assertions.h"
 #include "pkix/pkixnss.h"
-#include "pkixutil.h"
+#include "pkix/pkixutil.h"
 
 namespace mozilla { namespace ct {
 
@@ -42,12 +42,12 @@ public:
   }
 
   Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         const Input*, const Input*) override
+                         const Input*, const Input*, const Input*) override
   {
     return Result::FATAL_ERROR_LIBRARY_FAILURE;
   }
 
-  Result IsChainValid(const DERArray&, Time) override
+  Result IsChainValid(const DERArray&, Time, const CertPolicyId&) override
   {
     return Result::FATAL_ERROR_LIBRARY_FAILURE;
   }

security/certverifier/CTObjectsExtractor.cpp

@@ -13,7 +13,7 @@
 #include "mozilla/RangedPtr.h"
 #include "mozilla/Vector.h"
 #include "pkix/pkixnss.h"
-#include "pkixutil.h"
+#include "pkix/pkixutil.h"
 
 namespace mozilla { namespace ct {
 

security/certverifier/NSSCertDBTrustDomain.cpp

@@ -348,7 +348,8 @@ NSSCertDBTrustDomain::CheckRevocation(EndEntityOrCA endEntityOrCA,
                                       const CertID& certID, Time time,
                                       Duration validityDuration,
                          /*optional*/ const Input* stapledOCSPResponse,
-                         /*optional*/ const Input* aiaExtension)
+                         /*optional*/ const Input* aiaExtension,
+                         /*optional*/ const Input* sctExtension)
 {
   // Actively distrusted certificates will have already been blocked by
   // GetCertTrust.
@@ -788,7 +789,9 @@ CheckForStartComOrWoSign(const UniqueCERTCertList& certChain)
 }
 
 Result
-NSSCertDBTrustDomain::IsChainValid(const DERArray& certArray, Time time)
+NSSCertDBTrustDomain::IsChainValid(const DERArray& certArray,
+                                   Time time,
+                                   const CertPolicyId& requiredPolicy)
 {
   MOZ_LOG(gCertVerifierLog, LogLevel::Debug,
          ("NSSCertDBTrustDomain: IsChainValid"));

security/certverifier/NSSCertDBTrustDomain.h

@@ -134,11 +134,13 @@ public:
                    mozilla::pkix::Time time,
                    mozilla::pkix::Duration validityDuration,
       /*optional*/ const mozilla::pkix::Input* stapledOCSPResponse,
-      /*optional*/ const mozilla::pkix::Input* aiaExtension)
+      /*optional*/ const mozilla::pkix::Input* aiaExtension,
+      /*optional*/ const mozilla::pkix::Input* sctExtension)
                    override;
 
   virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
-                              mozilla::pkix::Time time) override;
+                              mozilla::pkix::Time time,
+                              const mozilla::pkix::CertPolicyId& requiredPolicy) override;
 
   virtual void NoteAuxiliaryExtension(
                    mozilla::pkix::AuxiliaryExtension extension,

security/certverifier/OCSPVerificationTrustDomain.cpp

@@ -35,7 +35,7 @@ OCSPVerificationTrustDomain::FindIssuer(Input, IssuerChecker&, Time)
 }
 
 Result
-OCSPVerificationTrustDomain::IsChainValid(const DERArray&, Time)
+OCSPVerificationTrustDomain::IsChainValid(const DERArray&, Time, const CertPolicyId&)
 {
   // We do not expect this to be called for OCSP signers
   return Result::FATAL_ERROR_LIBRARY_FAILURE;
@@ -44,7 +44,7 @@ OCSPVerificationTrustDomain::IsChainValid(const DERArray&, Time)
 Result
 OCSPVerificationTrustDomain::CheckRevocation(EndEntityOrCA, const CertID&,
                                              Time, Duration, const Input*,
-                                             const Input*)
+                                             const Input*, const Input*)
 {
   // We do not expect this to be called for OCSP signers
   return Result::FATAL_ERROR_LIBRARY_FAILURE;

security/certverifier/OCSPVerificationTrustDomain.h

@@ -68,11 +68,13 @@ public:
                    mozilla::pkix::Time time,
                    mozilla::pkix::Duration validityDuration,
       /*optional*/ const mozilla::pkix::Input* stapledOCSPResponse,
-      /*optional*/ const mozilla::pkix::Input* aiaExtension)
+      /*optional*/ const mozilla::pkix::Input* aiaExtension,
+      /*optional*/ const mozilla::pkix::Input* sctExtension)
                    override;
 
   virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
-                              mozilla::pkix::Time time) override;
+                              mozilla::pkix::Time time,
+                              const mozilla::pkix::CertPolicyId& requiredPolicy) override;
 
   virtual void NoteAuxiliaryExtension(
                    mozilla::pkix::AuxiliaryExtension extension,

security/certverifier/moz.build

@@ -35,7 +35,6 @@ if not CONFIG['NSS_NO_EV_CERTS']:
 LOCAL_INCLUDES += [
     '/security/manager/ssl',
     '/security/pkix/include',
-    '/security/pkix/lib',
 ]
 
 DIRS += [

security/manager/ssl/CSTrustDomain.cpp

@@ -129,7 +129,8 @@ CSTrustDomain::CheckRevocation(EndEntityOrCA endEntityOrCA,
                                const CertID& certID, Time time,
                                Duration validityDuration,
                                /*optional*/ const Input* stapledOCSPresponse,
-                               /*optional*/ const Input* aiaExtension)
+                               /*optional*/ const Input* aiaExtension,
+                               /*optional*/ const Input* sctExtension)
 {
   // We're relying solely on the CertBlocklist for revocation - and we're
   // performing checks on this in GetCertTrust (as per nsNSSCertDBTrustDomain)
@@ -137,7 +138,8 @@ CSTrustDomain::CheckRevocation(EndEntityOrCA endEntityOrCA,
 }
 
 Result
-CSTrustDomain::IsChainValid(const DERArray& certChain, Time time)
+CSTrustDomain::IsChainValid(const DERArray& certChain, Time time,
+                            const CertPolicyId& requiredPolicy)
 {
   // Check that our chain is not empty
   if (certChain.GetLength() == 0) {

security/manager/ssl/CSTrustDomain.h

@@ -36,9 +36,11 @@ public:
     const mozilla::pkix::CertID& certID, mozilla::pkix::Time time,
     mozilla::pkix::Duration validityDuration,
     /*optional*/ const mozilla::pkix::Input* stapledOCSPresponse,
-    /*optional*/ const mozilla::pkix::Input* aiaExtension) override;
+    /*optional*/ const mozilla::pkix::Input* aiaExtension,
+    /*optional*/ const mozilla::pkix::Input* sctExtension) override;
   virtual Result IsChainValid(const mozilla::pkix::DERArray& certChain,
-                              mozilla::pkix::Time time) override;
+                              mozilla::pkix::Time time,
+                              const mozilla::pkix::CertPolicyId& requiredPolicy) override;
   virtual Result CheckSignatureDigestAlgorithm(
     mozilla::pkix::DigestAlgorithm digestAlg,
     mozilla::pkix::EndEntityOrCA endEntityOrCA,

security/nss/automation/abi-check/expected-report-libnss3.so.txt

@@ -1,8 +1,22 @@
+7 Added functions:
 
-4 Added functions:
+  [A] 'function SECStatus PK11_AEADOp(PK11Context*, CK_GENERATOR_FUNCTION, int, unsigned char*, int, const unsigned char*, int, unsigned char*, int*, int, unsigned char*, int, const unsigned char*, int)'    {PK11_AEADOp@@NSS_3.52}
+  [A] 'function SECStatus PK11_AEADRawOp(PK11Context*, void*, int, const unsigned char*, int, unsigned char*, int*, int, const unsigned char*, int)'    {PK11_AEADRawOp@@NSS_3.52}
+  [A] 'function CK_OBJECT_HANDLE PK11_GetObjectHandle(PK11ObjectType, void*, PK11SlotInfo**)'    {PK11_GetObjectHandle@@NSS_3.52}
+  [A] 'function SECStatus PK11_ReadRawAttributes(PLArenaPool*, PK11ObjectType, void*, CK_ATTRIBUTE*, unsigned int)'    {PK11_ReadRawAttributes@@NSS_3.52}
+  [A] 'function SECStatus PK11_SymKeysToSameSlot(CK_MECHANISM_TYPE, CK_ATTRIBUTE_TYPE, CK_ATTRIBUTE_TYPE, PK11SymKey*, PK11SymKey*, PK11SymKey**, PK11SymKey**)'    {PK11_SymKeysToSameSlot@@NSS_3.52}
+  [A] 'function PRBool _PK11_ContextGetAEADSimulation(PK11Context*)'    {_PK11_ContextGetAEADSimulation@@NSS_3.52}
+  [A] 'function SECStatus _PK11_ContextSetAEADSimulation(PK11Context*)'    {_PK11_ContextSetAEADSimulation@@NSS_3.52}
+
+1 function with some indirect sub-type change:
+
+  [C]'function SECStatus PK11_GetModInfo(SECMODModule*, CK_INFO*)' at pk11util.c:613:1 has some indirect sub-type changes:
+    parameter 1 of type 'SECMODModule*' has sub-type changes:
+      in pointed to type 'typedef SECMODModule' at secmodt.h:29:1:
+        underlying type 'struct SECMODModuleStr' at secmodt.h:44:1 changed:
+          type size changed from 1600 to 1664 (in bits)
+          1 data member insertion:
+            'CK_FLAGS SECMODModuleStr::flags', at offset 1600 (in bits) at secmodt.h:76:1
+          no data member change (1 filtered);
 
-  [A] 'function SECStatus CERT_AddCertToListHeadWithData(CERTCertList*, CERTCertificate*, void*)'    {CERT_AddCertToListHeadWithData@@NSS_3.59}
-  [A] 'function SECStatus CERT_AddCertToListTailWithData(CERTCertList*, CERTCertificate*, void*)'    {CERT_AddCertToListTailWithData@@NSS_3.59}
-  [A] 'function PK11SymKey* PK11_PubUnwrapSymKeyWithMechanism(SECKEYPrivateKey*, CK_MECHANISM_TYPE, SECItem*, SECItem*, CK_MECHANISM_TYPE, CK_ATTRIBUTE_TYPE, int)'    {PK11_PubUnwrapSymKeyWithMechanism@@NSS_3.59}
-  [A] 'function SECStatus PK11_PubWrapSymKeyWithMechanism(SECKEYPublicKey*, CK_MECHANISM_TYPE, SECItem*, PK11SymKey*, SECItem*)'    {PK11_PubWrapSymKeyWithMechanism@@NSS_3.59}
 

security/nss/automation/abi-check/expected-report-libnssutil3.so.txt

@@ -1,6 +0,0 @@
-
-2 Added functions:
-
-  [A] 'function PRBool NSS_IsPolicyLocked()'    {NSS_IsPolicyLocked@@NSSUTIL_3.59}
-  [A] 'function void NSS_LockPolicy()'    {NSS_LockPolicy@@NSSUTIL_3.59}
-

security/nss/automation/abi-check/expected-report-libsoftokn3.so.txt

@@ -0,0 +1,10 @@
+
+6 Added functions:
+
+  [A] 'function CK_RV C_GetInterface(CK_UTF8CHAR_PTR, CK_VERSION_PTR, CK_INTERFACE_PTR_PTR, CK_FLAGS)'    {C_GetInterface@@NSS_3.52}
+  [A] 'function CK_RV C_GetInterfaceList(CK_INTERFACE_PTR, CK_ULONG_PTR)'    {C_GetInterfaceList@@NSS_3.52}
+  [A] 'function CK_RV FC_GetInterface(CK_UTF8CHAR_PTR, CK_VERSION_PTR, CK_INTERFACE_PTR_PTR, CK_FLAGS)'    {FC_GetInterface@@NSS_3.52}
+  [A] 'function CK_RV FC_GetInterfaceList(CK_INTERFACE_PTR, CK_ULONG_PTR)'    {FC_GetInterfaceList@@NSS_3.52}
+  [A] 'function CK_RV NSC_GetInterface(CK_UTF8CHAR_PTR, CK_VERSION_PTR, CK_INTERFACE_PTR_PTR, CK_FLAGS)'    {NSC_GetInterface@@NSS_3.52}
+  [A] 'function CK_RV NSC_GetInterfaceList(CK_INTERFACE_PTR, CK_ULONG_PTR)'    {NSC_GetInterfaceList@@NSS_3.52}
+

security/nss/automation/abi-check/previous-nss-release

@@ -1 +1 @@
-NSS_3_58_BRANCH
+NSS_3_51_BRANCH

security/nss/automation/release/nspr-version.txt

@@ -1,4 +1,4 @@
-4.29
+4.25
 
 # The first line of this file must contain the human readable NSPR
 # version number, which is the minimum required version of NSPR

security/nss/automation/taskcluster/graph/src/extend.js

@@ -100,18 +100,11 @@ queue.filter(task => {
 
   // Don't run all additional hardware tests on ARM.
   if (task.group == "Cipher" && task.platform == "aarch64" && task.env &&
-      (task.env.NSS_DISABLE_PCLMUL == "1" || task.env.NSS_DISABLE_SSE4_1 == "1"
+      (task.env.NSS_DISABLE_PCLMUL == "1" || task.env.NSS_DISABLE_HW_AES == "1"
        || task.env.NSS_DISABLE_AVX == "1" || task.env.NSS_DISABLE_AVX2 == "1")) {
     return false;
   }
 
-  // Don't run ARM specific hardware tests on non-ARM.
-  // TODO: our server that runs task cluster doesn't support Intel SHA extensions.
-  if (task.group == "Cipher" && task.platform != "aarch64" && task.env &&
-      (task.env.NSS_DISABLE_HW_SHA1 == "1" || task.env.NSS_DISABLE_HW_SHA2 == "1")) {
-    return false;
-  }
-
   // Don't run DBM builds on aarch64.
   if (task.group == "DBM" && task.platform == "aarch64") {
     return false;
@@ -1010,16 +1003,9 @@ function scheduleTests(task_build, task_cert, test_base) {
     name: "Cipher tests", symbol: "Default", tests: "cipher", group: "Cipher"
   }));
   queue.scheduleTask(merge(cert_base_long, {
-    name: "Cipher tests", symbol: "NoAES", tests: "cipher",
+    name: "Cipher tests", symbol: "NoAESNI", tests: "cipher",
     env: {NSS_DISABLE_HW_AES: "1"}, group: "Cipher"
   }));
-  queue.scheduleTask(merge(cert_base_long, {
-    name: "Cipher tests", symbol: "NoSHA", tests: "cipher",
-    env: {
-      NSS_DISABLE_HW_SHA1: "1",
-      NSS_DISABLE_HW_SHA2: "1"
-    }, group: "Cipher"
-  }));
   queue.scheduleTask(merge(cert_base_long, {
     name: "Cipher tests", symbol: "NoPCLMUL", tests: "cipher",
     env: {NSS_DISABLE_PCLMUL: "1"}, group: "Cipher"

security/nss/automation/taskcluster/scripts/build_gyp.sh

@@ -12,7 +12,7 @@ if [[ -f nss/nspr.patch && "$ALLOW_NSPR_PATCH" == "1" ]]; then
 fi
 
 # Build.
-nss/build.sh -g -v --enable-libpkix -Denable_draft_hpke=1 "$@"
+nss/build.sh -g -v --enable-libpkix "$@"
 
 # Package.
 if [[ $(uname) = "Darwin" ]]; then

security/nss/automation/taskcluster/scripts/run_hacl.sh

@@ -13,7 +13,7 @@ set -e -x -v
 # HACL CI.
 # When bug 1593647 is resolved, extract the code on CI again.
 git clone -q "https://github.com/project-everest/hacl-star" ~/hacl-star
-git -C ~/hacl-star checkout -q e4311991b1526734f99f4e3a0058895a46c63e5c
+git -C ~/hacl-star checkout -q 079854e0072041d60859b6d8af2743bc6a37dc05
 
 # Format the C snapshot.
 cd ~/hacl-star/dist/mozilla

security/nss/automation/taskcluster/windows/build_gyp.sh

@@ -38,7 +38,7 @@ if [[ -f nss/nspr.patch && "$ALLOW_NSPR_PATCH" == "1" ]]; then
 fi
 
 # Build with gyp.
-./nss/build.sh -g -v --enable-libpkix -Denable_draft_hpke=1 "$@"
+./nss/build.sh -g -v --enable-libpkix "$@"
 
 # Package.
 7z a public/build/dist.7z dist

security/nss/cmd/bltest/blapitest.c

@@ -608,11 +608,9 @@ typedef enum {
     bltestDES_CBC,     /* .            */
     bltestDES_EDE_ECB, /* .            */
     bltestDES_EDE_CBC, /* .            */
-#ifndef NSS_DISABLE_DEPRECATED_RC2
-    bltestRC2_ECB, /* .            */
-    bltestRC2_CBC, /* .            */
-#endif
-    bltestRC4, /* .            */
+    bltestRC2_ECB,     /* .            */
+    bltestRC2_CBC,     /* .            */
+    bltestRC4,         /* .            */
 #ifdef NSS_SOFTOKEN_DOES_RC5
     bltestRC5_ECB, /* .            */
     bltestRC5_CBC, /* .            */
@@ -624,23 +622,21 @@ typedef enum {
     bltestAES_GCM,      /* .                     */
     bltestCAMELLIA_ECB, /* .                     */
     bltestCAMELLIA_CBC, /* .                     */
-#ifndef NSS_DISABLE_DEPRECATED_SEED
-    bltestSEED_ECB, /* SEED algorithm      */
-    bltestSEED_CBC, /* SEED algorithm      */
-#endif
-    bltestCHACHA20, /* ChaCha20 + Poly1305   */
-    bltestRSA,      /* Public Key Ciphers    */
-    bltestRSA_OAEP, /* . (Public Key Enc.)   */
-    bltestRSA_PSS,  /* . (Public Key Sig.)   */
-    bltestECDSA,    /* . (Public Key Sig.)   */
-    bltestDSA,      /* . (Public Key Sig.)   */
-    bltestMD2,      /* Hash algorithms       */
-    bltestMD5,      /* .             */
-    bltestSHA1,     /* .             */
-    bltestSHA224,   /* .             */
-    bltestSHA256,   /* .             */
-    bltestSHA384,   /* .             */
-    bltestSHA512,   /* .             */
+    bltestSEED_ECB,     /* SEED algorithm      */
+    bltestSEED_CBC,     /* SEED algorithm      */
+    bltestCHACHA20,     /* ChaCha20 + Poly1305   */
+    bltestRSA,          /* Public Key Ciphers    */
+    bltestRSA_OAEP,     /* . (Public Key Enc.)   */
+    bltestRSA_PSS,      /* . (Public Key Sig.)   */
+    bltestECDSA,        /* . (Public Key Sig.)   */
+    bltestDSA,          /* . (Public Key Sig.)   */
+    bltestMD2,          /* Hash algorithms       */
+    bltestMD5,          /* .             */
+    bltestSHA1,         /* .             */
+    bltestSHA224,       /* .             */
+    bltestSHA256,       /* .             */
+    bltestSHA384,       /* .             */
+    bltestSHA512,       /* .             */
     NUMMODES
 } bltestCipherMode;
 
@@ -650,10 +646,8 @@ static char *mode_strings[] =
       "des_cbc",
       "des3_ecb",
       "des3_cbc",
-#ifndef NSS_DISABLE_DEPRECATED_RC2
       "rc2_ecb",
       "rc2_cbc",
-#endif
       "rc4",
 #ifdef NSS_SOFTOKEN_DOES_RC5
       "rc5_ecb",
@@ -666,10 +660,8 @@ static char *mode_strings[] =
       "aes_gcm",
       "camellia_ecb",
       "camellia_cbc",
-#ifndef NSS_DISABLE_DEPRECATED_SEED
       "seed_ecb",
       "seed_cbc",
-#endif
       "chacha20_poly1305",
       "rsa",
       "rsa_oaep",
@@ -800,12 +792,8 @@ struct bltestCipherInfoStr {
 PRBool
 is_symmkeyCipher(bltestCipherMode mode)
 {
-/* change as needed! */
-#ifndef NSS_DISABLE_DEPRECATED_SEED
+    /* change as needed! */
     if (mode >= bltestDES_ECB && mode <= bltestSEED_CBC)
-#else
-    if (mode >= bltestDES_ECB && mode <= bltestCAMELLIA_CBC)
-#endif
         return PR_TRUE;
     return PR_FALSE;
 }
@@ -883,9 +871,7 @@ cipher_requires_IV(bltestCipherMode mode)
     switch (mode) {
         case bltestDES_CBC:
         case bltestDES_EDE_CBC:
-#ifndef NSS_DISABLE_DEPRECATED_RC2
         case bltestRC2_CBC:
-#endif
 #ifdef NSS_SOFTOKEN_DOES_RC5
         case bltestRC5_CBC:
 #endif
@@ -894,9 +880,7 @@ cipher_requires_IV(bltestCipherMode mode)
         case bltestAES_CTR:
         case bltestAES_GCM:
         case bltestCAMELLIA_CBC:
-#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_CBC:
-#endif
         case bltestCHACHA20:
             return PR_TRUE;
         default:
@@ -1094,7 +1078,6 @@ des_Decrypt(void *cx, unsigned char *output, unsigned int *outputLen,
                        input, inputLen);
 }
 
-#ifndef NSS_DISABLE_DEPRECATED_RC2
 SECStatus
 rc2_Encrypt(void *cx, unsigned char *output, unsigned int *outputLen,
             unsigned int maxOutputLen, const unsigned char *input,
@@ -1112,7 +1095,6 @@ rc2_Decrypt(void *cx, unsigned char *output, unsigned int *outputLen,
     return RC2_Decrypt((RC2Context *)cx, output, outputLen, maxOutputLen,
                        input, inputLen);
 }
-#endif /* NSS_DISABLE_DEPRECATED_RC2 */
 
 SECStatus
 rc4_Encrypt(void *cx, unsigned char *output, unsigned int *outputLen,
@@ -1194,7 +1176,6 @@ camellia_Decrypt(void *cx, unsigned char *output, unsigned int *outputLen,
                             input, inputLen);
 }
 
-#ifndef NSS_DISABLE_DEPRECATED_SEED
 SECStatus
 seed_Encrypt(void *cx, unsigned char *output, unsigned int *outputLen,
              unsigned int maxOutputLen, const unsigned char *input,
@@ -1212,7 +1193,6 @@ seed_Decrypt(void *cx, unsigned char *output, unsigned int *outputLen,
     return SEED_Decrypt((SEEDContext *)cx, output, outputLen, maxOutputLen,
                         input, inputLen);
 }
-#endif /* NSS_DISABLE_DEPRECATED_SEED */
 
 SECStatus
 rsa_PublicKeyOp(void *cx, SECItem *output, const SECItem *input)
@@ -1381,7 +1361,6 @@ bltest_des_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
     return SECSuccess;
 }
 
-#ifndef NSS_DISABLE_DEPRECATED_RC2
 SECStatus
 bltest_rc2_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
 {
@@ -1427,7 +1406,6 @@ bltest_rc2_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
         cipherInfo->cipher.symmkeyCipher = rc2_Decrypt;
     return SECSuccess;
 }
-#endif /* NSS_DISABLE_DEPRECATED_RC2 */
 
 SECStatus
 bltest_rc4_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
@@ -1609,7 +1587,6 @@ bltest_camellia_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
     return SECSuccess;
 }
 
-#ifndef NSS_DISABLE_DEPRECATED_SEED
 SECStatus
 bltest_seed_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
 {
@@ -1653,7 +1630,6 @@ bltest_seed_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
 
     return SECSuccess;
 }
-#endif /* NSS_DISABLE_DEPRECATED_SEED */
 
 SECStatus
 bltest_chacha20_init(bltestCipherInfo *cipherInfo, PRBool encrypt)
@@ -2269,14 +2245,12 @@ cipherInit(bltestCipherInfo *cipherInfo, PRBool encrypt)
                               cipherInfo->input.pBuf.len);
             return bltest_des_init(cipherInfo, encrypt);
             break;
-#ifndef NSS_DISABLE_DEPRECATED_RC2
         case bltestRC2_ECB:
         case bltestRC2_CBC:
             SECITEM_AllocItem(cipherInfo->arena, &cipherInfo->output.buf,
                               cipherInfo->input.pBuf.len);
             return bltest_rc2_init(cipherInfo, encrypt);
             break;
-#endif /* NSS_DISABLE_DEPRECATED_RC2 */
         case bltestRC4:
             SECITEM_AllocItem(cipherInfo->arena, &cipherInfo->output.buf,
                               cipherInfo->input.pBuf.len);
@@ -2308,14 +2282,12 @@ cipherInit(bltestCipherInfo *cipherInfo, PRBool encrypt)
                               cipherInfo->input.pBuf.len);
             return bltest_camellia_init(cipherInfo, encrypt);
             break;
-#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_ECB:
         case bltestSEED_CBC:
             SECITEM_AllocItem(cipherInfo->arena, &cipherInfo->output.buf,
                               cipherInfo->input.pBuf.len);
             return bltest_seed_init(cipherInfo, encrypt);
             break;
-#endif /* NSS_DISABLE_DEPRECATED_SEED */
         case bltestCHACHA20:
             outlen = cipherInfo->input.pBuf.len + (encrypt ? 16 : 0);
             SECITEM_AllocItem(cipherInfo->arena, &cipherInfo->output.buf, outlen);
@@ -2614,23 +2586,19 @@ cipherFinish(bltestCipherInfo *cipherInfo)
         case bltestCAMELLIA_CBC:
             Camellia_DestroyContext((CamelliaContext *)cipherInfo->cx, PR_TRUE);
             break;
-#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_ECB:
         case bltestSEED_CBC:
             SEED_DestroyContext((SEEDContext *)cipherInfo->cx, PR_TRUE);
             break;
-#endif /* NSS_DISABLE_DEPRECATED_SEED */
         case bltestCHACHA20:
             ChaCha20Poly1305_DestroyContext((ChaCha20Poly1305Context *)
                                                 cipherInfo->cx,
                                             PR_TRUE);
             break;
-#ifndef NSS_DISABLE_DEPRECATED_RC2
         case bltestRC2_ECB:
         case bltestRC2_CBC:
             RC2_DestroyContext((RC2Context *)cipherInfo->cx, PR_TRUE);
             break;
-#endif /* NSS_DISABLE_DEPRECATED_RC2 */
         case bltestRC4:
             RC4_DestroyContext((RC4Context *)cipherInfo->cx, PR_TRUE);
             break;
@@ -2779,14 +2747,10 @@ print_td:
         case bltestAES_GCM:
         case bltestCAMELLIA_ECB:
         case bltestCAMELLIA_CBC:
-#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_ECB:
         case bltestSEED_CBC:
-#endif
-#ifndef NSS_DISABLE_DEPRECATED_RC2
         case bltestRC2_ECB:
         case bltestRC2_CBC:
-#endif
         case bltestRC4:
             if (td)
                 fprintf(stdout, "%8s", "symmkey");
@@ -2970,29 +2934,21 @@ get_params(PLArenaPool *arena, bltestParams *params,
             load_file_data(arena, &params->ask.aad, filename, bltestBinary);
         case bltestDES_CBC:
         case bltestDES_EDE_CBC:
-#ifndef NSS_DISABLE_DEPRECATED_RC2
         case bltestRC2_CBC:
-#endif
         case bltestAES_CBC:
         case bltestAES_CTS:
         case bltestAES_CTR:
         case bltestCAMELLIA_CBC:
-#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_CBC:
-#endif
             sprintf(filename, "%s/tests/%s/%s%d", testdir, modestr, "iv", j);
             load_file_data(arena, &params->sk.iv, filename, bltestBinary);
         case bltestDES_ECB:
         case bltestDES_EDE_ECB:
-#ifndef NSS_DISABLE_DEPRECATED_RC2
         case bltestRC2_ECB:
-#endif
         case bltestRC4:
         case bltestAES_ECB:
         case bltestCAMELLIA_ECB:
-#ifndef NSS_DISABLE_DEPRECATED_SEED
         case bltestSEED_ECB:
-#endif
             sprintf(filename, "%s/tests/%s/%s%d", testdir, modestr, "key", j);
             load_file_data(arena, &params->sk.key, filename, bltestBinary);
             break;

security/nss/cmd/lib/basicutil.c

@@ -17,7 +17,6 @@
 
 #include "basicutil.h"
 #include <stdarg.h>
-#include <stddef.h>
 #include <sys/stat.h>
 #include <errno.h>
 
@@ -633,8 +632,7 @@ void
 SECU_PrintPRandOSError(const char *progName)
 {
     char buffer[513];
-    PRInt32 errLenInt = PR_GetErrorTextLength();
-    size_t errLen = errLenInt < 0 ? 0 : (size_t)errLenInt;
+    PRInt32 errLen = PR_GetErrorTextLength();
     if (errLen > 0 && errLen < sizeof buffer) {
         PR_GetErrorText(buffer);
     }
@@ -741,6 +739,7 @@ SECU_HexString2SECItem(PLArenaPool *arena, SECItem *item, const char *str)
     int byteval = 0;
     int tmp = PORT_Strlen(str);
 
+    PORT_Assert(arena);
     PORT_Assert(item);
 
     if ((tmp % 2) != 0) {
@@ -761,9 +760,7 @@ SECU_HexString2SECItem(PLArenaPool *arena, SECItem *item, const char *str)
         } else if ((str[i] >= 'A') && (str[i] <= 'F')) {
             tmp = str[i] - 'A' + 10;
         } else {
-            if (!arena) {
-                SECITEM_FreeItem(item, PR_FALSE);
-            }
+            /* item is in arena and gets freed by the caller */
             return NULL;
         }
 

security/nss/cmd/lib/secutil.c

@@ -4159,57 +4159,3 @@ exportKeyingMaterials(PRFileDesc *fd,
 
     return SECSuccess;
 }
-
-SECStatus
-readPSK(const char *arg, SECItem *psk, SECItem *label)
-{
-    SECStatus rv = SECFailure;
-    char *str = PORT_Strdup(arg);
-    if (!str) {
-        goto cleanup;
-    }
-
-    char *pskBytes = strtok(str, ":");
-    if (!pskBytes) {
-        goto cleanup;
-    }
-    if (PORT_Strncasecmp(pskBytes, "0x", 2) != 0) {
-        goto cleanup;
-    }
-
-    psk = SECU_HexString2SECItem(NULL, psk, &pskBytes[2]);
-    if (!psk || !psk->data || psk->len != strlen(&str[2]) / 2) {
-        goto cleanup;
-    }
-
-    SECItem labelItem = { siBuffer, NULL, 0 };
-    char *inLabel = strtok(NULL, ":");
-    if (inLabel) {
-        labelItem.data = (unsigned char *)PORT_Strdup(inLabel);
-        if (!labelItem.data) {
-            goto cleanup;
-        }
-        labelItem.len = strlen(inLabel);
-
-        if (PORT_Strncasecmp(inLabel, "0x", 2) == 0) {
-            rv = SECU_SECItemHexStringToBinary(&labelItem);
-            if (rv != SECSuccess) {
-                SECITEM_FreeItem(&labelItem, PR_FALSE);
-                goto cleanup;
-            }
-        }
-        rv = SECSuccess;
-    } else {
-        PRUint8 defaultLabel[] = { 'C', 'l', 'i', 'e', 'n', 't', '_',
-                                   'i', 'd', 'e', 'n', 't', 'i', 't', 'y' };
-        SECItem src = { siBuffer, defaultLabel, sizeof(defaultLabel) };
-        rv = SECITEM_CopyItem(NULL, &labelItem, &src);
-    }
-    if (rv == SECSuccess) {
-        *label = labelItem;
-    }
-
-cleanup:
-    PORT_Free(str);
-    return rv;
-}

security/nss/cmd/lib/secutil.h

@@ -424,8 +424,6 @@ SECStatus exportKeyingMaterials(PRFileDesc *fd,
                                 const secuExporter *exporters,
                                 unsigned int exporterCount);
 
-SECStatus readPSK(const char *arg, SECItem *psk, SECItem *label);
-
 /*
  *
  *  Error messaging

security/nss/cmd/selfserv/selfserv.c

@@ -138,8 +138,6 @@ static SECItem bigBuf;
 static int configureDHE = -1;        /* -1: don't configure, 0 disable, >=1 enable*/
 static int configureReuseECDHE = -1; /* -1: don't configure, 0 refresh, >=1 reuse*/
 static int configureWeakDHE = -1;    /* -1: don't configure, 0 disable, >=1 enable*/
-SECItem psk = { siBuffer, NULL, 0 };
-SECItem pskLabel = { siBuffer, NULL, 0 };
 
 static PRThread *acceptorThread;
 
@@ -169,7 +167,7 @@ PrintUsageHeader(const char *progName)
             "         [ T <good|revoked|unknown|badsig|corrupted|none|ocsp>] [-A ca]\n"
             "         [-C SSLCacheEntries] [-S dsa_nickname] [-Q]\n"
             "         [-I groups] [-J signatureschemes] [-e ec_nickname]\n"
-            "         -U [0|1] -H [0|1|2] -W [0|1] [-z externalPsk]\n"
+            "         -U [0|1] -H [0|1|2] -W [0|1]\n"
             "\n",
             progName);
 }
@@ -243,11 +241,7 @@ PrintParameterUsage()
         "     LABEL[:OUTPUT-LENGTH[:CONTEXT]]\n"
         "   where LABEL and CONTEXT can be either a free-form string or\n"
         "   a hex string if it is preceded by \"0x\"; OUTPUT-LENGTH\n"
-        "   is a decimal integer.\n"
-        "-z Configure a TLS 1.3 External PSK with the given hex string for a key.\n"
-        "   To specify a label, use ':' as a delimiter. For example:\n"
-        "   0xAAAABBBBCCCCDDDD:mylabel. Otherwise, the default label of\n"
-        "  'Client_identity' will be used.\n",
+        "   is a decimal integer.\n",
         stderr);
 }
 
@@ -1847,32 +1841,6 @@ handshakeCallback(PRFileDesc *fd, void *client_data)
     }
 }
 
-static SECStatus
-importPsk(PRFileDesc *model_sock)
-{
-    SECU_PrintAsHex(stdout, &psk, "Using External PSK", 0);
-    PK11SlotInfo *slot = NULL;
-    PK11SymKey *symKey = NULL;
-    slot = PK11_GetInternalSlot();
-    if (!slot) {
-        errWarn("PK11_GetInternalSlot failed");
-        return SECFailure;
-    }
-    symKey = PK11_ImportSymKey(slot, CKM_HKDF_KEY_GEN, PK11_OriginUnwrap,
-                               CKA_DERIVE, &psk, NULL);
-    PK11_FreeSlot(slot);
-    if (!symKey) {
-        errWarn("PK11_ImportSymKey failed\n");
-        return SECFailure;
-    }
-
-    SECStatus rv = SSL_AddExternalPsk(model_sock, symKey,
-                                      (const PRUint8 *)pskLabel.data,
-                                      pskLabel.len, ssl_hash_sha256);
-    PK11_FreeSymKey(symKey);
-    return rv;
-}
-
 void
 server_main(
     PRFileDesc *listen_sock,
@@ -2082,13 +2050,6 @@ server_main(
         }
     }
 
-    if (psk.data) {
-        rv = importPsk(model_sock);
-        if (rv != SECSuccess) {
-            errExit("importPsk failed");
-        }
-    }
-
     if (MakeCertOK)
         SSL_BadCertHook(model_sock, myBadCertHandler, NULL);
 
@@ -2330,9 +2291,10 @@ main(int argc, char **argv)
     /* please keep this list of options in ASCII collating sequence.
     ** numbers, then capital letters, then lower case, alphabetical.
     ** XXX: 'B', and 'q' were used in the past but removed
-    **      in 3.28, please leave some time before resuing those. */
+    **      in 3.28, please leave some time before resuing those.
+    **      'z' was removed in 3.39. */
     optstate = PL_CreateOptState(argc, argv,
-                                 "2:A:C:DEGH:I:J:L:M:NP:QRS:T:U:V:W:YZa:bc:d:e:f:g:hi:jk:lmn:op:rst:uvw:x:yz:");
+                                 "2:A:C:DEGH:I:J:L:M:NP:QRS:T:U:V:W:YZa:bc:d:e:f:g:hi:jk:lmn:op:rst:uvw:x:y");
     while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
         ++optionsFound;
         switch (optstate->option) {
@@ -2554,16 +2516,6 @@ main(int argc, char **argv)
                 zeroRTT = PR_TRUE;
                 break;
 
-            case 'z':
-                rv = readPSK(optstate->value, &psk, &pskLabel);
-                if (rv != SECSuccess) {
-                    PL_DestroyOptState(optstate);
-                    fprintf(stderr, "Bad PSK specified.\n");
-                    Usage(progName);
-                    exit(1);
-                }
-                break;
-
             case 'Q':
                 enableALPN = PR_TRUE;
                 break;
@@ -2919,8 +2871,6 @@ cleanup:
     if (antiReplay) {
         SSL_ReleaseAntiReplayContext(antiReplay);
     }
-    SECITEM_ZfreeItem(&psk, PR_FALSE);
-    SECITEM_ZfreeItem(&pskLabel, PR_FALSE);
     if (NSS_Shutdown() != SECSuccess) {
         SECU_PrintError(progName, "NSS_Shutdown");
         if (loggerThread) {

security/nss/cmd/tstclnt/tstclnt.c

@@ -109,8 +109,6 @@ SSLNamedGroup *enabledGroups = NULL;
 unsigned int enabledGroupsCount = 0;
 const SSLSignatureScheme *enabledSigSchemes = NULL;
 unsigned int enabledSigSchemeCount = 0;
-SECItem psk = { siBuffer, NULL, 0 };
-SECItem pskLabel = { siBuffer, NULL, 0 };
 
 const char *
 signatureSchemeName(SSLSignatureScheme scheme)
@@ -231,7 +229,7 @@ PrintUsageHeader()
             "  [-r N] [-w passwd] [-W pwfile] [-q [-t seconds]]\n"
             "  [-I groups] [-J signatureschemes]\n"
             "  [-A requestfile] [-L totalconnections] [-P {client,server}]\n"
-            "  [-N encryptedSniKeys] [-Q] [-z externalPsk]\n"
+            "  [-N encryptedSniKeys] [-Q]\n"
             "\n",
             progName);
 }
@@ -327,12 +325,6 @@ PrintParameterUsage()
                     "%-20s a hex string if it is preceded by \"0x\"; OUTPUT-LENGTH\n"
                     "%-20s is a decimal integer.\n",
             "-x", "", "", "", "", "");
-    fprintf(stderr,
-            "%-20s Configure a TLS 1.3 External PSK with the given hex string for a key\n"
-            "%-20s To specify a label, use ':' as a delimiter. For example\n"
-            "%-20s 0xAAAABBBBCCCCDDDD:mylabel. Otherwise, the default label of\n"
-            "%-20s 'Client_identity' will be used.\n",
-            "-z externalPsk", "", "", "");
 }
 
 static void
@@ -1238,31 +1230,6 @@ connectToServer(PRFileDesc *s, PRPollDesc *pollset)
     return SECSuccess;
 }
 
-static SECStatus
-importPsk(PRFileDesc *s)
-{
-    SECU_PrintAsHex(stdout, &psk, "Using External PSK", 0);
-    PK11SlotInfo *slot = NULL;
-    PK11SymKey *symKey = NULL;
-    slot = PK11_GetInternalSlot();
-    if (!slot) {
-        SECU_PrintError(progName, "PK11_GetInternalSlot failed");
-        return SECFailure;
-    }
-    symKey = PK11_ImportSymKey(slot, CKM_HKDF_KEY_GEN, PK11_OriginUnwrap,
-                               CKA_DERIVE, &psk, NULL);
-    PK11_FreeSlot(slot);
-    if (!symKey) {
-        SECU_PrintError(progName, "PK11_ImportSymKey failed");
-        return SECFailure;
-    }
-
-    SECStatus rv = SSL_AddExternalPsk(s, symKey, (const PRUint8 *)pskLabel.data,
-                                      pskLabel.len, ssl_hash_sha256);
-    PK11_FreeSymKey(symKey);
-    return rv;
-}
-
 static int
 run()
 {
@@ -1531,15 +1498,6 @@ run()
         }
     }
 
-    if (psk.data) {
-        rv = importPsk(s);
-        if (rv != SECSuccess) {
-            SECU_PrintError(progName, "importPsk failed");
-            error = 1;
-            goto done;
-        }
-    }
-
     serverCertAuth.dbHandle = CERT_GetDefaultCertDB();
 
     SSL_AuthCertificateHook(s, ownAuthCertificate, &serverCertAuth);
@@ -1794,8 +1752,11 @@ main(int argc, char **argv)
         }
     }
 
+    /* Note: 'z' was removed in 3.39
+     * Please leave some time before reusing these.
+     */
     optstate = PL_CreateOptState(argc, argv,
-                                 "46A:BCDEFGHI:J:KL:M:N:OP:QR:STUV:W:X:YZa:bc:d:fgh:m:n:op:qr:st:uvw:x:z:");
+                                 "46A:BCDEFGHI:J:KL:M:N:OP:QR:STUV:W:X:YZa:bc:d:fgh:m:n:op:qr:st:uvw:x:");
     while ((optstatus = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
         switch (optstate->option) {
             case '?':
@@ -2054,15 +2015,6 @@ main(int argc, char **argv)
                     Usage();
                 }
                 break;
-
-            case 'z':
-                rv = readPSK(optstate->value, &psk, &pskLabel);
-                if (rv != SECSuccess) {
-                    PL_DestroyOptState(optstate);
-                    fprintf(stderr, "Bad PSK specified.\n");
-                    Usage();
-                }
-                break;
         }
     }
     PL_DestroyOptState(optstate);
@@ -2258,8 +2210,6 @@ done:
     PORT_Free(host);
     PORT_Free(zeroRttData);
     PORT_Free(encryptedSNIKeys);
-    SECITEM_ZfreeItem(&psk, PR_FALSE);
-    SECITEM_ZfreeItem(&pskLabel, PR_FALSE);
 
     if (enabledGroups) {
         PORT_Free(enabledGroups);

security/nss/coreconf/README

@@ -291,13 +291,6 @@ OVERVIEW of "rules.mk":
         CATEGORY/rule::         Purpose
         ===================     =======================================
 
-        $(PUBLIC_EXPORT_DIR)::            create directory used to
-                                          house public "C" header files
-
-        $(PRIVATE_EXPORT_DIR)::           create directory used to
-                                          house private "C" header
-                                          files
-
         GENERAL
         -------
         all::                   "default" all-encompassing rule which
@@ -524,6 +517,13 @@ OVERVIEW of "rules.mk":
         CATEGORY/rule::                   Purpose
         ===================               =============================
 
+        $(PUBLIC_EXPORT_DIR)::            create directory used to
+                                          house public "C" header files
+
+        $(PRIVATE_EXPORT_DIR)::           create directory used to
+                                          house private "C" header
+                                          files
+
         $(SOURCE_XP_DIR)/
         release/include::                 create directory used to
                                           house "C" header files

security/nss/coreconf/arch.mk

@@ -10,7 +10,7 @@
 # OS_TEST	(from uname -m)
 # OS_RELEASE	(from uname -v and/or -r)
 # OS_TARGET	User defined, or set to OS_ARCH
-# CPU_ARCH  	(from uname -m or -p, ONLY on WINNT)
+# CPU_ARCH  	(from unmame -m or -p, ONLY on WINNT)
 # OS_CONFIG	OS_TARGET + OS_RELEASE
 # OBJDIR_TAG    (uses GCOV_TAG, 64BIT_TAG)
 # OBJDIR_NAME
@@ -116,7 +116,6 @@ ifeq ($(OS_ARCH),Linux)
 	OS_RELEASE := $(word 1,$(OS_RELEASE)).$(word 2,$(OS_RELEASE))
     endif
     KERNEL = Linux
-    include $(CORE_DEPTH)/coreconf/Linux.mk
 endif
 
 # Since all uses of OS_ARCH that follow affect only userland, we can
@@ -140,6 +139,16 @@ ifeq ($(OS_ARCH),OS_2)
     OS_RELEASE := $(shell uname -v)
 endif
 
+#######################################################################
+# Master "Core Components" macros for Hardware features               #
+#######################################################################
+
+# NSS Build system does not properly support MozillaBuild 2 MSYS1
+# So we simply aren't going to enable AVX2 at all
+# Plus there seems to be an issue with it anyway for other reasons
+NSS_DISABLE_AVX2 = 1
+export NSS_DISABLE_AVX2
+
 #######################################################################
 # Master "Core Components" macros for getting the OS target           #
 #######################################################################

security/nss/coreconf/config.gypi

@@ -12,7 +12,7 @@
         # chromium uses pymod_do_main, but gyp doesn't set a sensible
         # Python sys.path (gyp_chromium does).
         'python%': '<(python)',
-        'host_arch%': '<!("<(python)" <(DEPTH)/coreconf/detect_host_arch.py)',
+        'host_arch%': '<!(<(python) <(DEPTH)/coreconf/detect_host_arch.py)',
       },
       'python%': '<(python)',
       'host_arch%': '<(host_arch)',
@@ -37,7 +37,7 @@
         },{
           'use_system_sqlite%': 0,
         }],
-        ['OS=="mac" or OS=="ios" or OS=="solaris" or OS=="win"', {
+        ['OS=="mac" or OS=="ios" or OS=="win"', {
           'cc_use_gnu_ld%': 0,
         }, {
           'cc_use_gnu_ld%': 1,
@@ -66,12 +66,12 @@
           ],
         }],
         ['"<(GENERATOR)"=="ninja"', {
-          'cc_is_clang%': '<!("<(python)" <(DEPTH)/coreconf/check_cc.py clang)',
+          'cc_is_clang%': '<!(<(python) <(DEPTH)/coreconf/check_cc.py clang)',
         }, {
           'cc_is_clang%': '0',
         }],
         ['"<(GENERATOR)"=="ninja"', {
-          'cc_is_gcc%': '<!("<(python)" <(DEPTH)/coreconf/check_cc.py gcc)',
+          'cc_is_gcc%': '<!(<(python) <(DEPTH)/coreconf/check_cc.py gcc)',
         }, {
           'cc_is_gcc%': '0',
         }],
@@ -97,12 +97,8 @@
     'cc_use_gnu_ld%': '<(cc_use_gnu_ld)',
     # Some defaults
     'disable_arm_hw_aes%': 0,
-    'disable_arm_hw_sha1%': 0,
-    'disable_arm_hw_sha2%': 0,
     'disable_tests%': 0,
     'disable_chachapoly%': 0,
-    'disable_deprecated_seed%': 0,
-    'disable_deprecated_rc2%': 0,
     'disable_dbm%': 1,
     'disable_libpkix%': 1,
     'disable_werror%': 0,
@@ -132,7 +128,6 @@
     'mozpkix_only%': 0,
     'coverage%': 0,
     'softfp_cflags%': '',
-    'enable_draft_hpke%': 0,
   },
   'target_defaults': {
     # Settings specific to targets should go here.
@@ -207,7 +202,7 @@
           },
         },
       }],
-      [ 'target_arch=="arm64" or target_arch=="aarch64" or target_arch=="sparc64" or target_arch=="ppc64" or target_arch=="ppc64le" or target_arch=="s390x" or target_arch=="mips64" or target_arch=="e2k"', {
+      [ 'target_arch=="arm64" or target_arch=="aarch64" or target_arch=="sparc64" or target_arch=="ppc64" or target_arch=="ppc64le" or target_arch=="s390x" or target_arch=="mips64"', {
         'defines': [
           'NSS_USE_64',
         ],
@@ -397,11 +392,6 @@
               '_REENTRANT',
             ],
           }],
-          [ 'OS!="mac" and OS!="ios" and OS!="solaris" and OS!="win"', {
-            'ldflags': [
-              '-z', 'noexecstack',
-            ],
-          }],
           [ 'OS!="mac" and OS!="ios" and OS!="win"', {
             'cflags': [
               '-fPIC',
@@ -415,6 +405,9 @@
             'cflags_cc': [
               '-std=c++11',
             ],
+            'ldflags': [
+              '-z', 'noexecstack',
+            ],
             'conditions': [
               [ 'target_arch=="ia32"', {
                 'cflags': ['-m32'],
@@ -444,11 +437,11 @@
           }],
           [ 'disable_werror==0 and OS!="android" and OS!="win"', {
             'cflags': [
-              '<!@("<(python)" <(DEPTH)/coreconf/werror.py)',
+              '<!@(<(python) <(DEPTH)/coreconf/werror.py)',
             ],
             'xcode_settings': {
               'OTHER_CFLAGS': [
-                '<!@("<(python)" <(DEPTH)/coreconf/werror.py)',
+                '<!@(<(python) <(DEPTH)/coreconf/werror.py)',
               ],
             },
           }],
@@ -571,26 +564,11 @@
               'NSS_DISABLE_DBM',
             ],
           }],
-          [ 'enable_draft_hpke==1', {
-            'defines': [
-              'NSS_ENABLE_DRAFT_HPKE',
-            ],
-          }],
           [ 'disable_libpkix==1', {
             'defines': [
               'NSS_DISABLE_LIBPKIX',
             ],
           }],
-          [ 'disable_deprecated_seed==1', {
-            'defines': [
-              'NSS_DISABLE_DEPRECATED_SEED',
-            ],
-          }],
-          [ 'disable_deprecated_rc2==1', {
-            'defines': [
-              'NSS_DISABLE_DEPRECATED_RC2',
-            ],
-          }],
         ],
       },
       # Common settings for debug should go here.
@@ -664,7 +642,7 @@
     },
   },
   'conditions': [
-    [ 'cc_use_gnu_ld==1 or OS=="solaris"', {
+    [ 'cc_use_gnu_ld==1', {
       'variables': {
         'process_map_file': ['/bin/sh', '-c', '/usr/bin/env grep -v ";-" >(mapfile) | sed -e "s,;+,," -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,;," > >@(_outputs)'],
       },

security/nss/coreconf/config.mk

@@ -179,22 +179,10 @@ ifdef NSS_DISABLE_CHACHAPOLY
 DEFINES += -DNSS_DISABLE_CHACHAPOLY
 endif
 
-ifdef NSS_DISABLE_DEPRECATED_SEED
-DEFINES += -DNSS_DISABLE_DEPRECATED_SEED
-endif
-
-ifdef NSS_DISABLE_DEPRECATED_RC2
-DEFINES += -DNSS_DISABLE_DEPRECATED_RC2
-endif
-
 ifdef NSS_PKIX_NO_LDAP
 DEFINES += -DNSS_PKIX_NO_LDAP
 endif
 
-ifdef NSS_ENABLE_DRAFT_HPKE
-DEFINES += -DNSS_ENABLE_DRAFT_HPKE
-endif
-
 # FIPS support requires startup tests to be executed at load time of shared modules.
 # For performance reasons, these tests are disabled by default.
 # When compiling binaries that must support FIPS mode,

security/nss/coreconf/coreconf.dep

@@ -10,3 +10,4 @@
  */
 
 #error "Do not include this header file."
+

security/nss/coreconf/detect_host_arch.py

@@ -15,8 +15,6 @@ def main():
         host_arch = 'x64'
     elif fnmatch.fnmatch(host_arch, 'i?86') or host_arch == 'i86pc':
         host_arch = 'ia32'
-    elif host_arch == 'arm64':
-        pass
     elif host_arch.startswith('arm'):
         host_arch = 'arm'
     elif host_arch.startswith('mips'):

security/nss/coreconf/rules.mk

@@ -810,7 +810,7 @@ ifneq ($(BUILD_OPT),)
 REGDATE = $(subst \ ,, $(shell $(PERL)  $(CORE_DEPTH)/$(MODULE)/scripts/now))
 endif
 
-tests:: $(REGRESSION_SPEC)
+tests:: $(REGRESSION_SPEC) 
 	cd $(PLATFORM); \
 	../$(SOURCE_MD_DIR)/bin/regress$(PROG_SUFFIX) specfile=../$(REGRESSION_SPEC) progress $(EXTRA_REGRESS_OPTIONS); \
 	if test ! -d $(TESTS_DIR); then \
@@ -824,7 +824,7 @@ ifneq ($(BUILD_OPT),)
 	echo "then run 'reporter specfile=$(RESULTS_DIR)/rptspec'"
 endif
 else
-tests::
+tests:: 
 	@echo Error: you didn't specify REGRESSION_SPEC in your manifest.mn file!;
 endif
 

security/nss/cpputil/nss_scoped_ptrs.h

@@ -11,7 +11,6 @@
 #include "cert.h"
 #include "keyhi.h"
 #include "p12.h"
-#include "pk11hpke.h"
 #include "pk11pqg.h"
 #include "pk11pub.h"
 #include "pkcs11uri.h"
@@ -28,9 +27,6 @@ struct ScopedDelete {
   void operator()(CERTSubjectPublicKeyInfo* spki) {
     SECKEY_DestroySubjectPublicKeyInfo(spki);
   }
-  void operator()(HpkeContext* context) {
-    PK11_HPKE_DestroyContext(context, true);
-  }
   void operator()(PK11Context* context) { PK11_DestroyContext(context, true); }
   void operator()(PK11GenericObject* obj) { PK11_DestroyGenericObject(obj); }
   void operator()(PK11SlotInfo* slot) { PK11_FreeSlot(slot); }
@@ -74,7 +70,6 @@ SCOPED(CERTCertificateList);
 SCOPED(CERTDistNames);
 SCOPED(CERTName);
 SCOPED(CERTSubjectPublicKeyInfo);
-SCOPED(HpkeContext);
 SCOPED(PK11Context);
 SCOPED(PK11GenericObject);
 SCOPED(PK11SlotInfo);

security/nss/gtests/common/testvectors/hkdf-vectors.h

@@ -0,0 +1,161 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef hkdf_vectors_h__
+#define hkdf_vectors_h__
+
+#include <vector>
+
+typedef struct hkdf_result_str {
+  SECStatus expect_rv;
+  bool output_match;
+} hkdf_result;
+
+typedef struct hkdf_vector_str {
+  uint32_t test_id;
+  CK_MECHANISM_TYPE mech;
+  size_t l;
+  std::vector<uint8_t> ikm;
+  std::vector<uint8_t> salt;
+  std::vector<uint8_t> info;
+  std::vector<uint8_t> okm;
+  hkdf_result res;
+} hkdf_vector;
+
+// Vectors sourced from https://tools.ietf.org/html/rfc5869
+// Test IDs correspond to those in Appendix A.
+const hkdf_vector kHkdfTestVectors[] = {
+    {1,
+     CKM_NSS_HKDF_SHA256,
+     42,
+     {0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+      0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b},
+     {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+      0x0c},
+     {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9},
+     {0x3c, 0xb2, 0x5f, 0x25, 0xfa, 0xac, 0xd5, 0x7a, 0x90, 0x43, 0x4f,
+      0x64, 0xd0, 0x36, 0x2f, 0x2a, 0x2d, 0x2d, 0x0a, 0x90, 0xcf, 0x1a,
+      0x5a, 0x4c, 0x5d, 0xb0, 0x2d, 0x56, 0xec, 0xc4, 0xc5, 0xbf, 0x34,
+      0x00, 0x72, 0x08, 0xd5, 0xb8, 0x87, 0x18, 0x58, 0x65},
+     {SECSuccess, true}},
+
+    {2,
+     CKM_NSS_HKDF_SHA256,
+     82,
+     {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+      0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+      0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
+      0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+      0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
+      0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+      0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f},
+     {0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+      0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
+      0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83,
+      0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
+      0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
+      0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
+      0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf},
+     {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb,
+      0xbc, 0xbd, 0xbe, 0xbf, 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
+      0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3,
+      0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf,
+      0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb,
+      0xec, 0xed, 0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
+      0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff},
+     {0xb1, 0x1e, 0x39, 0x8d, 0xc8, 0x03, 0x27, 0xa1, 0xc8, 0xe7, 0xf7, 0x8c,
+      0x59, 0x6a, 0x49, 0x34, 0x4f, 0x01, 0x2e, 0xda, 0x2d, 0x4e, 0xfa, 0xd8,
+      0xa0, 0x50, 0xcc, 0x4c, 0x19, 0xaf, 0xa9, 0x7c, 0x59, 0x04, 0x5a, 0x99,
+      0xca, 0xc7, 0x82, 0x72, 0x71, 0xcb, 0x41, 0xc6, 0x5e, 0x59, 0x0e, 0x09,
+      0xda, 0x32, 0x75, 0x60, 0x0c, 0x2f, 0x09, 0xb8, 0x36, 0x77, 0x93, 0xa9,
+      0xac, 0xa3, 0xdb, 0x71, 0xcc, 0x30, 0xc5, 0x81, 0x79, 0xec, 0x3e, 0x87,
+      0xc1, 0x4c, 0x01, 0xd5, 0xc1, 0xf3, 0x43, 0x4f, 0x1d, 0x87},
+     {SECSuccess, true}},
+
+    {3,
+     CKM_NSS_HKDF_SHA256,
+     42,
+     {0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+      0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b},
+     {},
+     {},
+     {0x8d, 0xa4, 0xe7, 0x75, 0xa5, 0x63, 0xc1, 0x8f, 0x71, 0x5f, 0x80,
+      0x2a, 0x06, 0x3c, 0x5a, 0x31, 0xb8, 0xa1, 0x1f, 0x5c, 0x5e, 0xe1,
+      0x87, 0x9e, 0xc3, 0x45, 0x4e, 0x5f, 0x3c, 0x73, 0x8d, 0x2d, 0x9d,
+      0x20, 0x13, 0x95, 0xfa, 0xa4, 0xb6, 0x1a, 0x96, 0xc8},
+     {SECSuccess, true}},
+
+    {4,
+     CKM_NSS_HKDF_SHA1,
+     42,
+     {0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b},
+     {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+      0x0c},
+     {0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9},
+     {0x08, 0x5a, 0x01, 0xea, 0x1b, 0x10, 0xf3, 0x69, 0x33, 0x06, 0x8b,
+      0x56, 0xef, 0xa5, 0xad, 0x81, 0xa4, 0xf1, 0x4b, 0x82, 0x2f, 0x5b,
+      0x09, 0x15, 0x68, 0xa9, 0xcd, 0xd4, 0xf1, 0x55, 0xfd, 0xa2, 0xc2,
+      0x2e, 0x42, 0x24, 0x78, 0xd3, 0x05, 0xf3, 0xf8, 0x96},
+     {SECSuccess, true}},
+
+    {5,
+     CKM_NSS_HKDF_SHA1,
+     82,
+     {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+      0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
+      0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
+      0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
+      0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x3b,
+      0x3c, 0x3d, 0x3e, 0x3f, 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
+      0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f},
+     {0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x6b,
+      0x6c, 0x6d, 0x6e, 0x6f, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
+      0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f, 0x80, 0x81, 0x82, 0x83,
+      0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
+      0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0x9b,
+      0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
+      0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf},
+     {0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb,
+      0xbc, 0xbd, 0xbe, 0xbf, 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
+      0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3,
+      0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf,
+      0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xeb,
+      0xec, 0xed, 0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
+      0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff},
+     {0x0b, 0xd7, 0x70, 0xa7, 0x4d, 0x11, 0x60, 0xf7, 0xc9, 0xf1, 0x2c, 0xd5,
+      0x91, 0x2a, 0x06, 0xeb, 0xff, 0x6a, 0xdc, 0xae, 0x89, 0x9d, 0x92, 0x19,
+      0x1f, 0xe4, 0x30, 0x56, 0x73, 0xba, 0x2f, 0xfe, 0x8f, 0xa3, 0xf1, 0xa4,
+      0xe5, 0xad, 0x79, 0xf3, 0xf3, 0x34, 0xb3, 0xb2, 0x02, 0xb2, 0x17, 0x3c,
+      0x48, 0x6e, 0xa3, 0x7c, 0xe3, 0xd3, 0x97, 0xed, 0x03, 0x4c, 0x7f, 0x9d,
+      0xfe, 0xb1, 0x5c, 0x5e, 0x92, 0x73, 0x36, 0xd0, 0x44, 0x1f, 0x4c, 0x43,
+      0x00, 0xe2, 0xcf, 0xf0, 0xd0, 0x90, 0x0b, 0x52, 0xd3, 0xb4},
+     {SECSuccess, true}},
+
+    {6,
+     CKM_NSS_HKDF_SHA1,
+     42,
+     {0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+      0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b},
+     {},
+     {},
+     {0x0a, 0xc1, 0xaf, 0x70, 0x02, 0xb3, 0xd7, 0x61, 0xd1, 0xe5, 0x52,
+      0x98, 0xda, 0x9d, 0x05, 0x06, 0xb9, 0xae, 0x52, 0x05, 0x72, 0x20,
+      0xa3, 0x06, 0xe0, 0x7b, 0x6b, 0x87, 0xe8, 0xdf, 0x21, 0xd0, 0xea,
+      0x00, 0x03, 0x3d, 0xe0, 0x39, 0x84, 0xd3, 0x49, 0x18},
+     {SECSuccess, true}},
+
+    {7,
+     CKM_NSS_HKDF_SHA1,
+     42,
+     {0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c,
+      0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c, 0x0c},
+     {},
+     {},
+     {0x2c, 0x91, 0x11, 0x72, 0x04, 0xd7, 0x45, 0xf3, 0x50, 0x0d, 0x63,
+      0x6a, 0x62, 0xf6, 0x4f, 0x0a, 0xb3, 0xba, 0xe5, 0x48, 0xaa, 0x53,
+      0xd4, 0x23, 0xb0, 0xd1, 0xf2, 0x7e, 0xbb, 0xa6, 0xf5, 0xe5, 0x67,
+      0x3a, 0x08, 0x1d, 0x70, 0xcc, 0xe7, 0xac, 0xfc, 0x48},
+     {SECSuccess, true}}};
+#endif  // hkdf_vectors_h__

security/nss/gtests/common/testvectors/hmac-sha256-vectors.h

@@ -1,841 +0,0 @@
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/* This file is generated from sources in nss/gtests/common/wycheproof
- * automatically and should not be touched manually.
- * Generation is trigged by calling python3 genTestVectors.py */
-
-#ifndef hmac_sha256_vectors_h__
-#define hmac_sha256_vectors_h__
-
-#include "testvectors_base/test-structs.h"
-
-const HmacTestVector kHmacSha256WycheproofVectors[] = {
-    {1, "empty message",
-     "1e225cafb90339bba1b24076d4206c3e79c355805d851682bc818baa4f5a7779", "",
-     "b175b57d89ea6cb606fb3363f2538abd73a4c00b4a1386905bac809004cf1933", false},
-
-    {2, "short message",
-     "8159fd15133cd964c9a6964c94f0ea269a806fd9f43f0da58b6cd1b33d189b2a", "77",
-     "dfc5105d5eecf7ae7b8b8de3930e7659e84c4172f2555142f1e568fc1872ad93", false},
-
-    {3, "short message",
-     "85a7cbaae825bb82c9b6f6c5c2af5ac03d1f6daa63d2a93c189948ec41b9ded9", "a59b",
-     "0fe2f13bba2198f6dda1a084be928e304e9cb16a56bc0b7b939a073280244373", false},
-
-    {4, "short message",
-     "48f3029334e55cfbd574ccc765fb2c3685aab1f4837d23370874a3e634c3a76d",
-     "c7b8b2",
-     "6c13f79bb2d5b6f9a315fe8fd6cbb5cb817a660687009deccd88c377429e596d", false},
-
-    {5, "short message",
-     "de8b5b5b2f09645be47ecb6407a4e1d9c6b33ae3c2d22517d3357da0357a3139",
-     "cc021d65",
-     "e87538eb167e62d7cb236690ff3f034a9c12d417aa8dfa694d7405f9e1f85fe8", false},
-
-    {6, "short message",
-     "b7938910f518f13205ca1492c669001a14ff913c8ab4a0dc3564e7418e91297c",
-     "a4a6ef6ebd",
-     "01a93f4ed216d0b280896301e366aa67b25e6b6a5a6e84f291a13391c6e496c5", false},
-
-    {7, "short message",
-     "1bb997ff4de8a5a391de5c08a33bc2c7c2891e47ad5b9c63110192f78b98fe78",
-     "667e015df7fc",
-     "06b5d8c5392323a802bc5cdd0b3c527454a873d9651c368836eaa4ad982ba546", false},
-
-    {8, "short message",
-     "32fdeda39f98b4f4426c2d2ac00ab5dd4bfabb68f311447256ed6d3d3a51b154",
-     "4163a9f77e41f5",
-     "1b0103729f48c2772bb132aef9ebd6dd6aafc9145df6d5c514b233ee92ef4a00", false},
-
-    {9, "short message",
-     "233e4fdee70bcc20235b6977ddfc05b0df66f5635d827c66e5a63cdb16a24938",
-     "fdb2ee4b6d1a0ac2",
-     "120b26ee1355c134c262513c7922deb6c4fd90303de4cd61b9f9cd08f22d6e18", false},
-
-    {10, "short message",
-     "b984c6734e0bd12b1737b2fc7a1b3803b4dfec402140a57b9eccc35414ae661b",
-     "dea584d0e2a14ad5fd",
-     "88bc2282e5fce47ec6d9895395cd47fff91a0cdc589a8fd56d8d344616533a3d", false},
-
-    {11, "short message",
-     "d0caf1456ac5e255fa6afd61a79dc8c716f5358a298a508271363fe1ff983561",
-     "18261dc806913c534666",
-     "f678f081d83cf126ad6bd52c2dffd786214f519c47452b85a97458d0c10c3ee5", false},
-
-    {12, "short message",
-     "835bc8241ed817735ec9d3d0e2df4c173ee4dded4a8ef0c04a96c48f11820463",
-     "26f8083e944bacf04e9a4d",
-     "e0e46cd7d1a75b3d102893da64def46e455308761f1d908786628ca7ee22a0eb", false},
-
-    {13, "short message",
-     "055f95c9461b0809575eccdfa5cdd06275f25d30915c4eb8db40e1acd3ab7591",
-     "bfb7d6a08dbaa5225f320887",
-     "e76d5c8c070a6b3c4824e9f342dc3056e63819509e1def98b585aeba0d638a00", false},
-
-    {14, "short message",
-     "e40f7a3eb88ddec4c6347ea4d67610756c82c8ebcc237629bf873ccabc32984a",
-     "7fe43febc78474649e45bf99b2",
-     "aa57d020aa24ad823472c2b80ff2d0cf475f7de0068f9a59e8112fede53a3581", false},
-
-    {15, "short message",
-     "b020ad1de1c141f7ec615ee5701521773f9b232e4d06376c382894ce51a61f48",
-     "81c7581a194b5e71b41146a582c1",
-     "f45c72603cc160c0762f703407844a7781dfe0f1ddf0aaf4ccd8205e94469aed", false},
-
-    {16, "short message",
-     "9f3fd61a105202648ecff6074c95e502c1c51acd32ec538a5cce89ef841f7989",
-     "2a76f2acdace42e3b779724946912c",
-     "0226ee13cc05e2340135b3f4b27a9da1a160f6170fe805dadd98a3711ec9c421", false},
-
-    {17, "", "6fa353868c82e5deeedac7f09471a61bf749ab5498239e947e012eee3c82d7c4",
-     "aeed3e4d4cb9bbb60d482e98c126c0f5",
-     "9ed7f0e73812a27a87a3808ee0c89a6456499e835974ba57c5aab2a0d8c69e93", false},
-
-    {18, "", "5300489494ca86221c91d6d953952ae1a5e097139dc9cf1179c2f56433753824",
-     "90fea6cf2bd811b449f333ee9233e57697",
-     "5b692cba13b54fffc3adcbb0e015cc011fbfd61235303ff0ad2a49775083bf22", false},
-
-    {19, "", "383e7c5c13476a62268423ef0500479f9e86e236c5a081c6449189e6afdf2af5",
-     "3202705af89f9555c540b0e1276911d01971abb2c35c78b2",
-     "4e4901592ba46476408d758435c7d1b489d2689afd84ceaaee78bfb91fd9391d", false},
-
-    {20, "", "186e248ad824e1eb93329a7fdcd565b6cb4eaf3f85b90b910777128d8c538d27",
-     "92ef9ff52f46eccc7e38b9ee19fd2de3b37726c8e6ce9e1b96db5dda4c317902",
-     "3fc1d73dd4a8858c1fc3d8c4a3f33ed5ad0c70210038394a5902cb26fe287348", false},
-
-    {21, "long message",
-     "28855c7efc8532d92567300933cc1ca2d0586f55dcc9f054fcca2f05254fbf7f",
-     "9c09207ff0e6e582cb3747dca954c94d45c05e93f1e6f21179cf0e25b4cede74b5479d32f"
-     "5166935c86f0441905865",
-     "788c0589000fb7f0b5d51f1596472bc9ec413421a43df96ee32b02b5d275ffe3", false},
-
-    {22, "long message",
-     "8e540cb30c94836ae2a5950f355d482a7002e255207e94fda3f7ef1a099013a0",
-     "d6500f95e11262e308bf3df4df4b855f33e857563d4543f195639a0a17b442eb9fdcc1367"
-     "d2eee75c8f805730b89290f",
-     "39697e70ce741feb33dedc069f00b5627fd9b837d10cbdd5b6d19cfbd511dd2c", false},
-
-    {23, "long message",
-     "69c50d5274358188cff4c0fae742243d4e8a5e5ba55d94ff40edd90f6a43dd10",
-     "1ac5255aff052828d8ea21b376f1ebdd4bb879949913900405aebce83e48feb6813b5e9c8"
-     "9f94501a8ade41b26b815c521",
-     "4b0b4d0416fa2e11586fbfa7fb11261e69991dfa34019b9893d69a2be8c1fc80", false},
-
-    {24, "long message",
-     "23209b7c5aadcbd13f7279af1a86d3c7ae8f179d1bcaaad0dff9a15302e78dbf",
-     "84bdac37e1af35d9356404e2787d47ece58348dea76a4a46e8aade3463d4db8c94a051be3"
-     "733b38d756984865d56c60e8025f15e3f968f093e7fb7ebc7e31189c5692d15ed4256737b"
-     "9b1894e5809503aaa1c9983fb096aa21916361eeb6ef455b129723a1a1ddf9deddea20852"
-     "9a648",
-     "4a85c479d1650dbd73bc5248074a55ff50218bddaa8d1fddaaf44946dc19aefb", false},
-
-    {25, "long message",
-     "7c9cc667cae175f448faa96647319633b2d48531373ae7d316c44ddd8b9f69cf",
-     "9233c1d73b498c5106ff88951e07b9652cb0ddae740737ec205c9876d094978bfc947f7dc"
-     "937119fd6a93915b19b625958a7a22363aa2ac33fb869ed16b303336ab740a0498a2df66a"
-     "6599da710094481a7b544bd955b6f97135ba4673401db2db144a6e287041e47a51ed9b6ba"
-     "956c13508c1c0c25310105239ab73629e30",
-     "ca1b80441d333909c2bb30769650055051ed20f17de8ee953cb9070af56c704f", false},
-
-    {26, "long message",
-     "82314540564ea3ce30591e97f68b2602de40fa29f773c2508327471b8348e8c4",
-     "6a6d2f45cebf2757ae16ea33c68617671d77f8fdf80bed8fc5cdc5c8b7086bd28e7eb3eec"
-     "c7163491104e5309455e67f836579b82a1da3bf5991a8e2b2f189a49e05700e46c409ed5d"
-     "e77780a5f389e3f13dad406c9d55675329c5c921f07034180937c0f6ef34a2308b6ff3e1a"
-     "0e9dc1ea65f5632730e8744d1db2c40a6595b",
-     "0900b3e6535d34f90e2c335775e86bf38ee7e3d26fb60cd9cdf639eb3496b94c", false},
-
-    {27, "long message",
-     "d115acc9a636915241795f48852052e07b51273ae2448251ec1d0d0f9807f3db",
-     "696d2456de853fa028f486fef437b6b6d1b530a8475e299db3a9005ae9cef8401985b7d31"
-     "e172e8f439ccd1ad1ec44c9b86b78f3f243c1305b53bc21abad7a8fc5256311bfd34c98e3"
-     "7dfdc649e7ae4bda08cf2994b063c0c7106ed0b02a1f48af9191cbfb0d6a953b7e04327df"
-     "e8c93779cb574ba9cba575d01674e83621aa0c5f400d6e6cd24b301e33c9f3303e73bf357"
-     "408c1be86c2489c09de998ff2ef32df554f1247d9313ce1a7160115d06f4c18d6556ff798"
-     "6ef8a55e2adcfa27e4c69c71cc2ff01639e9d49bd9ed0687f530ffeb0890132457df20880"
-     "81bc4a2f7f0a9f4dcea2c80d991db7f3747a1803d7619aaf3dd382c69536a0bcdb931cbe",
-     "82f92977f0b605eaada510ffceb53ad75fde16a8029f1b75b406a84270dbb8b7", false},
-
-    {28, "Flipped bit 0 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d28b42096d80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {29, "Flipped bit 0 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d9b99f2709a3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {30, "Flipped bit 1 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d18b42096d80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {31, "Flipped bit 1 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "dab99f2709a3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {32, "Flipped bit 7 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "538b42096d80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {33, "Flipped bit 7 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "58b99f2709a3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {34, "Flipped bit 8 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38a42096d80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {35, "Flipped bit 8 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b89f2709a3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {36, "Flipped bit 31 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42896d80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {37, "Flipped bit 31 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99fa709a3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {38, "Flipped bit 32 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096c80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {39, "Flipped bit 32 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2708a3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {40, "Flipped bit 33 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096f80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {41, "Flipped bit 33 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f270ba3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {42, "Flipped bit 63 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f4df826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {43, "Flipped bit 63 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3caf4172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {44, "Flipped bit 64 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f836b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {45, "Flipped bit 64 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74162cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {46, "Flipped bit 71 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f026b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {47, "Flipped bit 71 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74972cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {48, "Flipped bit 77 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f824b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {49, "Flipped bit 77 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74170cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {50, "Flipped bit 80 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b45a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {51, "Flipped bit 80 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74172cbf93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {52, "Flipped bit 96 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d4607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {53, "Flipped bit 96 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74172cbe93834c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {54, "Flipped bit 97 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d7607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {55, "Flipped bit 97 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74172cbe93804c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {56, "Flipped bit 103 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a955607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {57, "Flipped bit 103 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74172cbe93024c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {58, "Flipped bit 248 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1ca", true},
-
-    {59, "Flipped bit 248 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14f", true},
-
-    {60, "Flipped bit 249 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1c9", true},
-
-    {61, "Flipped bit 249 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14c", true},
-
-    {62, "Flipped bit 254 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc18b", true},
-
-    {63, "Flipped bit 254 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef10e", true},
-
-    {64, "Flipped bit 255 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc14b", true},
-
-    {65, "Flipped bit 255 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3ca74172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef1ce", true},
-
-    {66, "Flipped bits 0 and 64 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d28b42096d80f45f836b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {67, "Flipped bits 0 and 64 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d9b99f2709a3ca74162cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {68, "Flipped bits 31 and 63 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42896d80f4df826b44a9d5607de72496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {69, "Flipped bits 31 and 63 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99fa709a3caf4172cbe93824c1f29b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {70, "Flipped bits 63 and 127 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f4df826b44a9d5607d672496a415d3f4a1a8c88e3bb9da8dc1cb", true},
-
-    {71, "Flipped bits 63 and 127 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d8b99f2709a3caf4172cbe93824c1fa9b23a0c1e9c21bd851ff2d2c39dbef14e", true},
-
-    {72, "all bits of tag flipped",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "2c74bdf6927f0ba07d94bb562a9f8218db695bea2c0b5e573771c44625723e34", true},
-
-    {73, "all bits of tag flipped",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "274660d8f65c358be8d3416c7db3e0d64dc5f3e163de427ae00d2d3c62410eb1", true},
-
-    {74, "Tag changed to all zero",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "0000000000000000000000000000000000000000000000000000000000000000", true},
-
-    {75, "Tag changed to all zero",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "0000000000000000000000000000000000000000000000000000000000000000", true},
-
-    {76, "tag changed to all 1",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", true},
-
-    {77, "tag changed to all 1",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", true},
-
-    {78, "msbs changed in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "530bc289ed0074df02ebc42955e0fd67a416249553742128480ebb395a0d414b", true},
-
-    {79, "msbs changed in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "58391fa789234af497ac3e1302cc9fa932ba8c9e1ca13d059f7252431d3e71ce", true},
-
-    {80, "lsbs changed in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d28a43086c81f55e836a45a8d4617ce62597a514d2f5a0a9c98f3ab8db8cc0ca", true},
-
-    {81, "lsbs changed in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f",
-     "d9b89e2608a2cb75162dbf92834d1e28b33b0d1f9d20bc841ef3d3c29cbff04f", true},
-
-    {82, "empty message",
-     "7bf9e536b66a215c22233fe2daaa743a898b9acb9f7802de70b40e3d6e43ef97", "",
-     "f4605585949747de26f3ee98a738b172", false},
-
-    {83, "short message",
-     "e754076ceab3fdaf4f9bcab7d4f0df0cbbafbc87731b8f9b7cd2166472e8eebc", "40",
-     "0dc00d7217bbafe8d78bf961189b8fd2", false},
-
-    {84, "short message",
-     "ea3b016bdd387dd64d837c71683808f335dbdc53598a4ea8c5f952473fafaf5f", "6601",
-     "ff296b368d3bf059cc48682f6949ccaa", false},
-
-    {85, "short message",
-     "73d4709637857dafab6ad8b2b0a51b06524717fedf100296644f7cfdaae1805b",
-     "f1d300", "2d02bd1c25b1fe52b1ead07374d6e883", false},
-
-    {86, "short message",
-     "d5c81b399d4c0d1583a13da56de6d2dc45a66e7b47c24ab1192e246dc961dd77",
-     "2ae63cbf", "4d9e8bddf9b7a1218309d5988aa1b0d9", false},
-
-    {87, "short message",
-     "2521203fa0dddf59d837b2830f87b1aa61f958155df3ca4d1df2457cb4284dc8",
-     "af3a015ea1", "cb8a4b413350b42f4ac3533cc7f47864", false},
-
-    {88, "short message",
-     "665a02bc265a66d01775091da56726b6668bfd903cb7af66fb1b78a8a062e43c",
-     "3f56935def3f", "1cfce745db1ca7de9a1d4420e612ca55", false},
-
-    {89, "short message",
-     "facd75b22221380047305bc981f570e2a1af38928ea7e2059e3af5fc6b82b493",
-     "57bb86beed156f", "0bde0d0c756df09d4f6da81b299a3adf", false},
-
-    {90, "short message",
-     "505aa98819809ef63b9a368a1e8bc2e922da45b03ce02d9a7966b15006dba2d5",
-     "2e4e7ef728fe11af", "406a5c2bd3e6a9595f9b7dff608d59a7", false},
-
-    {91, "short message",
-     "f942093842808ba47f64e427f7351dde6b9546e66de4e7d60aa6f328182712cf",
-     "852a21d92848e627c7", "0b1bf9e98d0a794fa55c09b63e25799f", false},
-
-    {92, "short message",
-     "64be162b39c6e5f1fed9c32d9f674d9a8cde6eaa2443214d86bd4a1fb53b81b4",
-     "195a3b292f93baff0a2c", "71f33f6021d90858cadb1353d7fbe8d7", false},
-
-    {93, "short message",
-     "b259a555d44b8a20c5489e2f38392ddaa6be9e35b9833b67e1b5fdf6cb3e4c6c",
-     "afd73117330c6e8528a6e4", "4b8d76372ebe5e5caa56ca4e5c59cdd3", false},
-
-    {94, "short message",
-     "2c6fc62daa77ba8c6881b3dd6989898fef646663cc7b0a3db8228a707b85f2dc",
-     "0ff54d6b6759120c2e8a51e3", "c580c542846a96e84ea77701778455bf", false},
-
-    {95, "short message",
-     "abab815d51df29f740e4e2079fb798e0152836e6ab57d1536ae8929e52c06eb8",
-     "f0058d412a104e53d820b95a7f", "13cdb005059338f0f28e2d8ce1af5d0a", false},
-
-    {96, "short message",
-     "3d5da1af83f7287458bff7a7651ea5d8db72259401333f6b82096996dd7eaf19",
-     "aacc36972f183057919ff57b49e1", "bd993e4428cbc0e275e4d80b6f520363", false},
-
-    {97, "short message",
-     "c19bdf314c6cf64381425467f42aefa17c1cc9358be16ce31b1d214859ce86aa",
-     "5d066a92c300e9b6ddd63a7c13ae33", "86c9f4dde0b257a7053a7b03c7504409",
-     false},
-
-    {98, "", "612e837843ceae7f61d49625faa7e7494f9253e20cb3adcea686512b043936cd",
-     "cc37fae15f745a2f40e2c8b192f2b38d", "b96bcacafac30094f18ac5039e7b3656",
-     false},
-
-    {99, "", "73216fafd0022d0d6ee27198b2272578fa8f04dd9f44467fbb6437aa45641bf7",
-     "d5247b8f6c3edcbfb1d591d13ece23d2f5", "6e597c4c3861a380c06854b446fc2a87",
-     false},
-
-    {100, "",
-     "0427a70e257528f3ab70640bba1a5de12cf3885dd4c8e284fbbb55feb35294a5",
-     "13937f8544f44270d01175a011f7670e93fa6ba7ef02336e",
-     "f731aaf2f04023d621f10495344679a0", false},
-
-    {101, "",
-     "96e1e4896fb2cd05f133a6a100bc5609a7ac3ca6d81721e922dadd69ad07a892",
-     "91a17e4dfcc3166a1add26ff0e7c12056e8a654f28a6de24f4ba739ceb5b5b18",
-     "95243eb1a9d448174ae4fccf4a53ebfe", false},
-
-    {102, "long message",
-     "41201567be4e6ea06de2295fd0e6e8a7d862bb57311894f525d8adeabba4a3e4",
-     "58c8c73bdd3f350c97477816eae4d0789c9369c0e99c248902c700bc29ed986425985eb3f"
-     "a55709b73bf620cd9b1cb",
-     "343367207f71425d8f81f3110b0405f6", false},
-
-    {103, "long message",
-     "649e373e681ef52e3c10ac265484750932a9918f28fb824f7cb50adab39781fe",
-     "39b447bd3a01983c1cb761b456d69000948ceb870562a536126a0d18a8e7e49b16de8fe67"
-     "2f13d0808d8b7d957899917",
-     "151618eec4f503f3b63b539de0a58966", false},
-
-    {104, "long message",
-     "7b0d237f7b536e2c6950990e61b361b384333dda690045c591321a4e3f79747f",
-     "3d6283d11c0219b525620e9bf5b9fd887d3f0f707acb1fbdffab0d97a5c6d07fc547762e0"
-     "e7dd7c43ad35fab1c790f8047",
-     "ce201c0dcfdc3f2bef360609a31fb19e", false},
-
-    {105, "long message",
-     "17c92663741f012e5bb6714e614c2d155948617f10936269d954c58aba2ae62d",
-     "7fdd6a15c861d0313f6635d77dc55e115ff18c8ab063b5d03eab472eeca87a378188f2581"
-     "3515cf90b6cffa94a8ff36b29d65603eab3fbd2aa9500b261e184049893dc6ca2010becac"
-     "163053f211070bdda621b8bd8af77e450268603b52db34c90be836dfebddef42303f724e6"
-     "3bf0f",
-     "76e8dfd94db4af9d79d9718eec46cb2d", false},
-
-    {106, "long message",
-     "424c6b22606fcc094ae82fc5d3cbe484174c2211b3ec778091cac34a8e38a152",
-     "d96ff062e2490e8e0c54c5a8b89e85b25a66d93d7c2b93bdfef846b70d38672746a4b988d"
-     "08f15a5c527ca4f2c80e53f7c6ac0521bc57ebe38209180cbf934e0bbeb58cfb63d75da64"
-     "af41d09ce174af1896f42522910fced35ea000402e95fd3ac7aa6d5e0a6b533b0879bc466"
-     "019b3a5e6b16e4bd1ea6cdfc9ccc1d6f0f0",
-     "eda709c7009714c372d0d6a63dfde469", false},
-
-    {107, "long message",
-     "15d553c8da433d53cdc7f15087a70349caab57b379a4078928ce9b99302e31a6",
-     "d6c0c53b73f74fb426adfdc143d70db7f7a8f8ed32a2faef263cf9ab117537b6b9d1728bd"
-     "1000c1f28906c6ce6ad21862bfa4d689c1a8ebe3868b992098b7f981b2af5189a6adedff5"
-     "3a6c70c83693f5c8d6385a9a8a4dca017c5716ac4d5b9765c5ca2ab5f9867e02795198c0b"
-     "9527e07d08af52dbcb91ceb3d8b412a2b2402",
-     "8ca1402bf8fc23442ac2067be925b828", false},
-
-    {108, "long message",
-     "ffe559468a1031dfb3ced2e381e74b5821a36d9abf5f2e59895a7fdca0fa56a0",
-     "238899a84a3cf15202a1fbef4741e133fb24c009a0cd83854c6d1d7c9266d4c3eafe6d1df"
-     "c18f13845ccdad7fe277627b5fd5ff2555ce6dfde1ee078540a0a3590c6d9bf2fb63ba9af"
-     "be9380e797be7cd017645c5a3613eef38ef89e3b7461e6e700ff2b4deef5636c9d2198b14"
-     "3f797ca1820a3dcc5d462ebf4a8c4c09eb202a23592eb9524082c79adda8fcd56d256041a"
-     "26bf8f523962ba911ce5a5786570d65be3c4df722ed8830302065febdf944715298a1fbb7"
-     "d10b68d7da2bf889324314ce51e815c7fbf03aa0a8358aff3a86eb7a33f9a4923660db304"
-     "7e793bebb0c6918f4395d400381723fdae2832c36efc8e368a68f30f6351c3bc942cd560",
-     "a830b313f4936dea56a3aefd6a3ebe7d", false},
-
-    {109, "Flipped bit 0 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d28b42096d80f45f826b44a9d5607de7", true},
-
-    {110, "Flipped bit 0 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d9b99f2709a3ca74172cbe93824c1f29",
-     true},
-
-    {111, "Flipped bit 1 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d18b42096d80f45f826b44a9d5607de7", true},
-
-    {112, "Flipped bit 1 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "dab99f2709a3ca74172cbe93824c1f29",
-     true},
-
-    {113, "Flipped bit 7 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "538b42096d80f45f826b44a9d5607de7", true},
-
-    {114, "Flipped bit 7 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "58b99f2709a3ca74172cbe93824c1f29",
-     true},
-
-    {115, "Flipped bit 8 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38a42096d80f45f826b44a9d5607de7", true},
-
-    {116, "Flipped bit 8 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b89f2709a3ca74172cbe93824c1f29",
-     true},
-
-    {117, "Flipped bit 31 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42896d80f45f826b44a9d5607de7", true},
-
-    {118, "Flipped bit 31 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99fa709a3ca74172cbe93824c1f29",
-     true},
-
-    {119, "Flipped bit 32 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096c80f45f826b44a9d5607de7", true},
-
-    {120, "Flipped bit 32 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2708a3ca74172cbe93824c1f29",
-     true},
-
-    {121, "Flipped bit 33 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096f80f45f826b44a9d5607de7", true},
-
-    {122, "Flipped bit 33 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f270ba3ca74172cbe93824c1f29",
-     true},
-
-    {123, "Flipped bit 63 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f4df826b44a9d5607de7", true},
-
-    {124, "Flipped bit 63 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3caf4172cbe93824c1f29",
-     true},
-
-    {125, "Flipped bit 64 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f836b44a9d5607de7", true},
-
-    {126, "Flipped bit 64 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74162cbe93824c1f29",
-     true},
-
-    {127, "Flipped bit 71 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f026b44a9d5607de7", true},
-
-    {128, "Flipped bit 71 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74972cbe93824c1f29",
-     true},
-
-    {129, "Flipped bit 77 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f824b44a9d5607de7", true},
-
-    {130, "Flipped bit 77 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74170cbe93824c1f29",
-     true},
-
-    {131, "Flipped bit 80 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b45a9d5607de7", true},
-
-    {132, "Flipped bit 80 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74172cbf93824c1f29",
-     true},
-
-    {133, "Flipped bit 96 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d4607de7", true},
-
-    {134, "Flipped bit 96 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74172cbe93834c1f29",
-     true},
-
-    {135, "Flipped bit 97 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d7607de7", true},
-
-    {136, "Flipped bit 97 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74172cbe93804c1f29",
-     true},
-
-    {137, "Flipped bit 103 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a955607de7", true},
-
-    {138, "Flipped bit 103 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74172cbe93024c1f29",
-     true},
-
-    {139, "Flipped bit 120 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d5607de6", true},
-
-    {140, "Flipped bit 120 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74172cbe93824c1f28",
-     true},
-
-    {141, "Flipped bit 121 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d5607de5", true},
-
-    {142, "Flipped bit 121 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74172cbe93824c1f2b",
-     true},
-
-    {143, "Flipped bit 126 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d5607da7", true},
-
-    {144, "Flipped bit 126 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74172cbe93824c1f69",
-     true},
-
-    {145, "Flipped bit 127 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f45f826b44a9d5607d67", true},
-
-    {146, "Flipped bit 127 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3ca74172cbe93824c1fa9",
-     true},
-
-    {147, "Flipped bits 0 and 64 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d28b42096d80f45f836b44a9d5607de7", true},
-
-    {148, "Flipped bits 0 and 64 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d9b99f2709a3ca74162cbe93824c1f29",
-     true},
-
-    {149, "Flipped bits 31 and 63 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42896d80f4df826b44a9d5607de7", true},
-
-    {150, "Flipped bits 31 and 63 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99fa709a3caf4172cbe93824c1f29",
-     true},
-
-    {151, "Flipped bits 63 and 127 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d38b42096d80f4df826b44a9d5607d67", true},
-
-    {152, "Flipped bits 63 and 127 in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d8b99f2709a3caf4172cbe93824c1fa9",
-     true},
-
-    {153, "all bits of tag flipped",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "2c74bdf6927f0ba07d94bb562a9f8218", true},
-
-    {154, "all bits of tag flipped",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "274660d8f65c358be8d3416c7db3e0d6",
-     true},
-
-    {155, "Tag changed to all zero",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "00000000000000000000000000000000", true},
-
-    {156, "Tag changed to all zero",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "00000000000000000000000000000000",
-     true},
-
-    {157, "tag changed to all 1",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "ffffffffffffffffffffffffffffffff", true},
-
-    {158, "tag changed to all 1",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "ffffffffffffffffffffffffffffffff",
-     true},
-
-    {159, "msbs changed in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "530bc289ed0074df02ebc42955e0fd67", true},
-
-    {160, "msbs changed in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "58391fa789234af497ac3e1302cc9fa9",
-     true},
-
-    {161, "lsbs changed in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "",
-     "d28a43086c81f55e836a45a8d4617ce6", true},
-
-    {162, "lsbs changed in tag",
-     "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
-     "000102030405060708090a0b0c0d0e0f", "d9b89e2608a2cb75162dbf92834d1e28",
-     true},
-
-    {163, "short key", "a349ac0a9f9f74e48e099cc3dbf9a9c9", "",
-     "3a8437b877b75cc08a4d8d7559a8fc6869a58c713da63d1d4b350d59b597e30c", false},
-
-    {164, "short key", "ac686ba0f1a51b4ec4f0b30492b7f556",
-     "2fa43a14ae500507deb95ab5bd32b0fe",
-     "008532a53d0c0ab22027ae249023375374e2239b959609e8339b05a15742a675", false},
-
-    {165, "short key", "73ef9ef1a4225e51e3c1db3ace1fa24f",
-     "ffad380d9aabb0acede5c1bf112925cdfc3d379fc2376a4fe2644490d0430ac3",
-     "9c7cb9f7c207ec46d1e3c55764731c4ab5ddbae4e1401e52a895df0cff4787c9", false},
-
-    {166, "short key", "e34f15c7bd819930fe9d66e0c166e61c", "",
-     "1d765ab9e29892f7bfec2975ad4bc2dc", false},
-
-    {167, "short key", "e09eaa5a3f5e56d279d5e7a03373f6ea",
-     "ef4eab37181f98423e53e947e7050fd0", "cfc19ec07902ec8be489606d8f40d172",
-     false},
-
-    {168, "short key", "9bd3902ed0996c869b572272e76f3889",
-     "a7ba19d49ee1ea02f098aa8e30c740d893a4456ccc294040484ed8a00a55f93e",
-     "ac50adad9785a89c7282d8ab881dc615", false},
-
-    {169, "long key",
-     "8a0c46eb8a2959e39865330079763341e7439dab149694ee57e0d61ec73d947e1d5301cd9"
-     "74e18a5e0d1cf0d2c37e8aadd9fd589d57ef32e47024a99bc3f70c077",
-     "", "f5bfb940561fb4db73ebba49bf2e4893bb0cca618a71b7ecf6aca38231e167ea",
-     false},
-
-    {170, "long key",
-     "2877ebb81f80334fd00516337446c5cf5ad4a3a2e197269e5b0ad1889dfe2b4b0aaa676fa"
-     "c55b36ce3affc7f1092ab89c53273a837bd5bc94d1a9d9e5b02e9856f",
-     "ba448db88f154f775028fdecf9e6752d",
-     "1690ed4180642899e0deb9ec2270374e8b0a484217f5a682c524316eca219b64", false},
-
-    {171, "long key",
-     "21178e26bc28ffc27c06f762ba190a627075856d7ca6feab79ac63149b17126e34fd9e559"
-     "0e0e90aac801df09505d8af2dd0a2703b352c573ac9d2cb063927f2af",
-     "7d5f1d6b993452b1b53a4375760d10a20d46a0ab9ec3943fc4b07a2ce735e731",
-     "e542ac8ac8f364bae4b7da8b7a0777df350f001de4e8cfa2d9ef0b15019496ec", false},
-
-    {172, "long key",
-     "813e0c078c221375e80590ace6774eafd2d2c242350988d02efa550e05aecbe100c1b8bf1"
-     "54c932cf9e57177015c816c42bc7fbc71ceaa5328c7316b7f0f30330f",
-     "", "bb6ab66f51e53fa086c9c61a26ca27e0", false},
-
-    {173, "long key",
-     "5713343096b0aaf0562a6b92c1a15535924160475a4e4233589159728c562e3b2ad96f740"
-     "c6a4da2bc3f768ce98c9bd66bac28d1646ff592028c940d455f35eeb4",
-     "71712de2fac1fb855673bff72af64257", "c18165b8b97db1ca5e2486a32b39731e",
-     false},
-
-    {174, "long key",
-     "7208afbecf5f1f34828f98b719414e280716de64f5edd1ae1c774153cd2022337bb20fade"
-     "1b7856f1dbfd40e2b4307f1293ceff1692ee90d8c90b5fdf953ab01a5",
-     "43b53302b604d613e62db002044a4782d572ac8fbd3cd0ece91b43bc52e18e98",
-     "2fecfe45d79339c57dddba68ab34f5f1", false}};
-
-#endif  // hmac_sha256_vectors_h__

security/nss/gtests/common/testvectors/hpke-vectors.h

@@ -1,233 +0,0 @@
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef hpke_vectors_h__
-#define hpke_vectors_h__
-
-#include "pk11hpke.h"
-#include <vector>
-
-typedef struct hpke_encrypt_vector_str {
-  std::string pt;
-  std::string aad;
-  std::string ct;
-} hpke_encrypt_vector;
-
-typedef struct hpke_export_vector_str {
-  std::string ctxt;
-  size_t len;
-  std::string exported;
-} hpke_export_vector;
-
-/* Note: The following test vec values are implicitly checked via:
- * shared_secret: secret derivation
- * key_sched_context: key/nonce derivations
- * secret: key/nonce derivations
- * exporter_secret: export vectors */
-typedef struct hpke_vector_str {
-  uint32_t test_id;
-  HpkeModeId mode;
-  HpkeKemId kem_id;
-  HpkeKdfId kdf_id;
-  HpkeAeadId aead_id;
-  std::string info;
-  std::string pkcs8_e;
-  std::string pkcs8_r;
-  std::string psk;
-  std::string psk_id;
-  std::string enc;
-  std::string key;
-  std::string nonce;
-  std::vector<hpke_encrypt_vector> encrypt_vecs;
-  std::vector<hpke_export_vector> export_vecs;
-} hpke_vector;
-
-const hpke_vector kHpkeTestVectors[] = {
-    // A.1. DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM, Base mode
-    {0,
-     static_cast<HpkeModeId>(0),
-     static_cast<HpkeKemId>(32),
-     static_cast<HpkeKdfId>(1),
-     static_cast<HpkeAeadId>(1),
-     "4f6465206f6e2061204772656369616e2055726e",
-     "3067020100301406072a8648ce3d020106092b06010401da470f01044c304a"
-     "02010104208c490e5b0c7dbe0c6d2192484d2b7a0423b3b4544f2481095a9"
-     "9dbf238fb350fa1230321008a07563949fac6232936ed6f36c4fa735930ecd"
-     "eaef6734e314aeac35a56fd0a",
-     "3067020100301406072a8648ce3d020106092b06010401da470f01044c304a"
-     "02010104205a8aa0d2476b28521588e0c704b14db82cdd4970d340d293a957"
-     "6deaee9ec1c7a1230321008756e2580c07c1d2ffcb662f5fadc6d6ff13da85"
-     "abd7adfecf984aaa102c1269",
-     "",
-     "",
-     "8a07563949fac6232936ed6f36c4fa735930ecdeaef6734e314aeac35a56fd0a",
-     "550ee0b7ec1ea2532f2e2bac87040a4c",
-     "2b855847756795a57229559a",
-     {// Encryptions
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d30",
-       "971ba65db526758ea30ae748cd769bc8d90579b62a037816057f24ce4274"
-       "16bd47c05ed1c2446ac8e19ec9ae79"},
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d31",
-       "f18f1ec397667ca069b9a6ee0bebf0890cd5caa34bb9875b3600ca0142cb"
-       "a774dd35f2aafd79a02a08ca5f2806"},
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d32",
-       "51a8dea350fe6e753f743ec17c956de4cbdfa35f3018fc6a12752c51d137"
-       "2c5093959f18c7253da9c953c6cfbe"}},
-     {// Exports
-      {"436f6e746578742d30", 32,
-       "0df04ac640d34a56561419bab20a68e6b7331070208004f89c7b973f4c47"
-       "2e92"},
-      {"436f6e746578742d31", 32,
-       "723c2c8f80e6b827e72bd8e80973a801a05514afe3d4bc46e82e505dceb9"
-       "53aa"},
-      {"436f6e746578742d32", 32,
-       "38010c7d5d81093a11b55e2403a258e9a195bcf066817b332dd996b0a9bc"
-       "bc9a"},
-      {"436f6e746578742d33", 32,
-       "ebf6ab4c3186131de9b2c3c0bc3e2ad21dfcbc4efaf050cd0473f5b1535a"
-       "8b6d"},
-      {"436f6e746578742d34", 32,
-       "c4823eeb3efd2d5216b2d3b16e542bf57470dc9b9ea9af6bce85b151a358"
-       "9d90"}}},
-
-    // A.1. DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM, PSK mode
-    {1,
-     static_cast<HpkeModeId>(1),
-     static_cast<HpkeKemId>(32),
-     static_cast<HpkeKdfId>(1),
-     static_cast<HpkeAeadId>(1),
-     "4f6465206f6e2061204772656369616e2055726e",
-     "3067020100301406072a8648ce3d020106092b06010401da470f01044c304a020"
-     "1010420e7d2b539792a48a24451303ccd0cfe77176b6cb06823c439edfd217458"
-     "a1398aa12303210008d39d3e7f9b586341b6004dafba9679d2bd9340066edb247"
-     "e3e919013efcd0f",
-     "3067020100301406072a8648ce3d020106092b06010401da470f01044c304a020"
-     "10104204b41ef269169090551fcea177ecdf622bca86d82298e21cd93119b804c"
-     "cc5eaba123032100a5c85773bed3a831e7096f7df4ff5d1d8bac48fc97bfac366"
-     "141efab91892a3a",
-     "5db3b80a81cb63ca59470c83414ef70a",
-     "456e6e796e20447572696e206172616e204d6f726961",
-     "08d39d3e7f9b586341b6004dafba9679d2bd9340066edb247e3e919013efcd0f",
-     "811e9b2d7a10f4f9d58786bf8a534ca6",
-     "b79b0c5a8c3808e238b10411",
-     {// Encryptions
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d30",
-       "fb68f911b4e4033d1547f646ea30c9cee987fb4b4a8c30918e5de6e96de32fc"
-       "63466f2fc05e09aeff552489741"},
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d31",
-       "85e7472fbb7e2341af35fb2a0795df9a85caa99a8f584056b11d452bc160470"
-       "672e297f9892ce2c5020e794ae1"},
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d32",
-       "74229b7491102bcf94cf7633888bc48baa4e5a73cc544bfad4ff61585506fac"
-       "b44b359ade03c0b2b35c6430e4c"}},
-     {// Exports
-      {"436f6e746578742d30", 32,
-       "bd292b132fae00243851451c3f3a87e9e11c3293c14d61b114b7e12e07245ffd"},
-      {"436f6e746578742d31", 32,
-       "695de26bc9336caee01cb04826f6e224f4d2108066ab17fc18f0c993dce05f24"},
-      {"436f6e746578742d32", 32,
-       "c53f26ef1bf4f5fd5469d807c418a0e103d035c76ccdbc6afb5bc42b24968f6c"},
-      {"436f6e746578742d33", 32,
-       "8cea4a595dfe3de84644ca8ea7ea9401a345f0db29bb4beebc2c471afc602ec4"},
-      {"436f6e746578742d34", 32,
-       "e6313f12f6c2054c69018f273211c54fcf2439d90173392eaa34b4caac929068"}}},
-
-    // A.2. DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, ChaCha20Poly1305, Base mode
-    {2,
-     static_cast<HpkeModeId>(0),
-     static_cast<HpkeKemId>(32),
-     static_cast<HpkeKdfId>(1),
-     static_cast<HpkeAeadId>(3),
-     "4f6465206f6e2061204772656369616e2055726e",
-     "3067020100301406072a8648ce3d020106092b06010401da470f01044c304a020"
-     "10104205006a9a0f0138b9b5d577ed4a67c4f795aee8fc146ac63d7a4167765be"
-     "3ad7dca123032100716281787b035b2fee90455d951fa70b3db6cc92f13bedfd7"
-     "58c3487994b7020",
-     "3067020100301406072a8648ce3d020106092b06010401da470f01044c304a020"
-     "101042062139576dcbf9878ccd56262d1b28dbea897821c03370d81971513cc74"
-     "aea3ffa1230321001ae26f65041b36ad69eb392c198bfd33df1c6ff17a910cb3e"
-     "49db7506b6a4e7f",
-     "",
-     "",
-     "716281787b035b2fee90455d951fa70b3db6cc92f13bedfd758c3487994b7020",
-     "1d5e71e2885ddadbcc479798cc65ea74d308f2a9e99c0cc7fe480adce66b5722",
-     "8354a7fcfef97d4bbef6d24e",
-     {// Encryptions
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d30",
-       "fa4632a400962c98143e58450e75d879365359afca81a5f5b5997c6555647ec"
-       "302045a80c57d3e2c2abe7e1ced"},
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d31",
-       "8313fcbf760714f5a93b6864820e48dcec3ddd476ad4408ff1c1a1f7bfb8cb8"
-       "699fada4a9e59bf8086eb1c0635"},
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d32",
-       "020f2856d95b85e1def9549bf327c484d327616f1e213045f117be4c287571a"
-       "b983958f74766cbc6f8197c8d8d"}},
-     {// Exports
-      {"436f6e746578742d30", 32,
-       "22bbe971392c685b55e13544cdaf976f36b89dc1dbe1296c2884971a5aa9e331"},
-      {"436f6e746578742d31", 32,
-       "5c0fa72053a2622d8999b726446db9ef743e725e2cb040afac2d83eae0d41981"},
-      {"436f6e746578742d32", 32,
-       "72b0f9999fd37ac2b948a07dadd01132587501a5a9460d596c1f7383299a2442"},
-      {"436f6e746578742d33", 32,
-       "73d2308ed5bdd63aacd236effa0db2d3a30742b6293a924d95a372e76d90486b"},
-      {"436f6e746578742d34", 32,
-       "d4f8878dbc471935e86cdee08746e53837bbb4b6013003bebb0bc1cc3e074085"}}},
-
-    // A.2. DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, ChaCha20Poly1305, PSK mode
-    {3,
-     static_cast<HpkeModeId>(1),
-     static_cast<HpkeKemId>(32),
-     static_cast<HpkeKdfId>(1),
-     static_cast<HpkeAeadId>(3),
-     "4f6465206f6e2061204772656369616e2055726e",
-     "3067020100301406072a8648ce3d020106092b06010401da470f01044c304a020"
-     "10104204bfdb62b95ae2a1f29f20ea49e24aa2673e0d240c6e967f668f55ed5de"
-     "e996dca123032100f4639297e3305b03d34dd5d86522ddc6ba11a608a0003670a"
-     "30734823cdd3763",
-     "3067020100301406072a8648ce3d020106092b06010401da470f01044c304a020"
-     "1010420a6ab4e1bb782d580d837843089d65ebe271a0ee9b5a951777cecf1293c"
-     "58c150a123032100c49b46ed73ecb7d3a6a3e44f54b8f00f9ab872b57dd79ded6"
-     "6d7231a14c64144",
-     "5db3b80a81cb63ca59470c83414ef70a",
-     "456e6e796e20447572696e206172616e204d6f726961",
-     "f4639297e3305b03d34dd5d86522ddc6ba11a608a0003670a30734823cdd3763",
-     "396c06a52b39d0930594aa2c6944561cc1741f638557a12bef1c1cad349157c9",
-     "baa4ecf96b5d6d536d0d7210",
-     {// Encryptions
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d30",
-       "f97ca72675b8199e8ffec65b4c200d901110b177b246f241b6f9716fb60b35b"
-       "32a6d452675534b591e8141468a"},
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d31",
-       "57796e2b9dd0ddf807f1a7cb5884dfc50e61468c4fd69fa03963731e51674ca"
-       "88fee94eeac3290734e1627ded6"},
-      {"4265617574792069732074727574682c20747275746820626561757479",
-       "436f756e742d32",
-       "b514150af1057151687d0036a9b4a3ad50fb186253f839d8433622baa85719e"
-       "d5d2532017a0ce7b9ca0007f276"}},
-     {// Exports
-      {"436f6e746578742d30", 32,
-       "735400cd9b9193daffe840f412074728ade6b1978e9ae27957aacd588dbd7c9e"},
-      {"436f6e746578742d31", 32,
-       "cf4e351e1943d171ff2d88726f18160086ecbec52a8151dba8cf5ba0737a6097"},
-      {"436f6e746578742d32", 32,
-       "8e23b44d4f23dd906d1c100580a670d171132c9786212c4ca2876a1541a84fae"},
-      {"436f6e746578742d33", 32,
-       "56252a940ece53d4013eb619b444ee1d019a08eec427ded2b6dbf24be624a4a0"},
-      {"436f6e746578742d34", 32,
-       "fc6cdca9ce8ab062401478ffd16ee1c07e2b15d7c781d4227f07c6043d937fad"}}}};
-
-#endif  // hpke_vectors_h__

security/nss/gtests/common/testvectors_base/test-structs.h

@@ -32,7 +32,6 @@ typedef struct AesCmacTestVectorStr {
   std::string tag;
   bool invalid;
 } AesCmacTestVector;
-typedef AesCmacTestVector HmacTestVector;
 
 typedef struct AesGcmKatValueStr {
   uint32_t id;
@@ -58,17 +57,6 @@ typedef struct ChaChaTestVectorStr {
   bool invalid_iv;
 } ChaChaTestVector;
 
-typedef struct EcdsaTestVectorStr {
-  SECOidTag hash_oid;
-  uint32_t id;
-  std::vector<uint8_t> sig;
-  std::vector<uint8_t> public_key;
-  std::vector<uint8_t> msg;
-  bool valid;
-} EcdsaTestVector;
-
-typedef EcdsaTestVector DsaTestVector;
-
 typedef struct EcdhTestVectorStr {
   uint32_t id;
   std::vector<uint8_t> private_key;
@@ -78,16 +66,6 @@ typedef struct EcdhTestVectorStr {
   bool valid;
 } EcdhTestVector;
 
-typedef struct HkdfTestVectorStr {
-  uint32_t id;
-  std::string ikm;
-  std::string salt;
-  std::string info;
-  std::string okm;
-  uint32_t size;
-  bool valid;
-} HkdfTestVector;
-
 typedef struct RsaSignatureTestVectorStr {
   SECOidTag hash_oid;
   uint32_t id;

security/nss/gtests/common/wycheproof/genTestVectors.py

@@ -158,57 +158,6 @@ class ECDH():
 
         return result
 
-class DSA():
-    pub_keys = {}
-    def format_testcase(self, testcase, key, hash_oid, keySize, out_defs):
-        key_name = "kPubKey"
-        if key in self.pub_keys:
-            key_name = self.pub_keys[key]
-        else:
-            key_name += str(len(self.pub_keys))
-            self.pub_keys[key] = key_name
-            out_defs.append('static const std::vector<uint8_t> ' + key_name + string_to_hex_array(key) + ';\n\n')
-        result = '\n// Comment: {}'.format(testcase['comment'])
-        result += '\n// tcID: {}\n'.format(testcase['tcId'])
-        result += '{{{}, {},\n'.format(hash_oid, testcase['tcId'])
-        result += '{},\n'.format(string_to_hex_array(testcase['sig']))
-        result += '{},\n'.format(key_name)
-        result += '{},\n'.format(string_to_hex_array(testcase['msg']))
-        valid = testcase['result'] == 'valid' or (testcase['result'] == 'acceptable' and 'NoLeadingZero' in testcase['flags'])
-        result += '{}}},\n'.format(str(valid).lower())
-
-        return result
-
-class ECDSA():
-    """Class that provides the generator function for a single ECDSA test case."""
-
-    def format_testcase(self, testcase, key, hash_oid, keySize, out_defs):
-        result = '\n// Comment: {}'.format(testcase['comment'])
-        result += '\n// tcID: {}\n'.format(testcase['tcId'])
-        result += '{{{}, {},\n'.format(hash_oid, testcase['tcId'])
-        result += '{},\n'.format(string_to_hex_array(testcase['sig']))
-        result += '{},\n'.format(string_to_hex_array(key))
-        result += '{},\n'.format(string_to_hex_array(testcase['msg']))
-        valid = testcase['result'] == 'valid'
-        if not valid and testcase['result'] == 'acceptable':
-            valid = 'MissingZero' in testcase['flags']
-        result += '{}}},\n'.format(str(valid).lower())
-
-        return result
-
-class HKDF():
-    """Class that provides the generator function for a single HKDF test case."""
-
-    def format_testcase(self, vector):
-        """Format an HKDF testcase object. Return a string in C-header format."""
-        result = '{{ {},\n'.format(vector['tcId'])
-        for key in ['ikm', 'salt', 'info', "okm"]:
-            result += ' \"{}\",\n'.format(vector[key])
-        result += ' {},\n'.format(vector['size'])
-        result += ' {}}},\n\n'.format(str(vector['result'] == 'valid').lower())
-
-        return result
-
 class RSA_PKCS1_SIGNATURE():
     pub_keys = {}
 
@@ -361,7 +310,7 @@ def generate_vectors_file(params):
             if 'key' in group:
                 if 'curve' in group['key'] and group['key']['curve'] not in ['secp256r1', 'secp384r1', 'secp521r1']:
                     continue
-                vectors_file += params['formatter'].format_testcase(test, group['keyDer'], getSha(group['sha']), group['key']['keySize'], shared_defs)
+                vectors_file += params['formatter'].format_testcase(test, group['keyDer'], getSha(group['sha']), group['key']['keySize'])
             elif 'type' in group and group['type'] == 'RsassaPssVerify':
                 sLen = group['sLen'] if 'sLen' in group else 0
                 vectors_file += params['formatter'].format_testcase(test, group['keyDer'], getSha(group['sha']), getMgfSha(group['mgfSha']), sLen, shared_defs)
@@ -482,61 +431,6 @@ curve25519_params = {
     // tests at this moment because validity of the public key is not checked.\n'
 }
 
-dsa_params = {
-    'source_dir': 'source_vectors/',
-    'source_file': 'dsa_test.json',
-    'target': '../testvectors/dsa-vectors.h',
-    'array_init': 'const DsaTestVector kDsaWycheproofVectors[] = {\n',
-    'formatter' : DSA(),
-    'crop_size_end': -2,
-    'section': 'dsa_vectors_h__',
-    'comment' : ''
-}
-
-hkdf_sha1_params = {
-    'source_dir': 'source_vectors/',
-    'source_file': 'hkdf_sha1_test.json',
-    'target': '../testvectors/hkdf-sha1-vectors.h',
-    'array_init': 'const HkdfTestVector kHkdfSha1WycheproofVectors[] = {\n',
-    'formatter' : HKDF(),
-    'crop_size_end': -3,
-    'section': 'hkdf_sha1_vectors_h__',
-    'comment' : ''
-}
-
-hkdf_sha256_params = {
-    'source_dir': 'source_vectors/',
-    'source_file': 'hkdf_sha256_test.json',
-    'target': '../testvectors/hkdf-sha256-vectors.h',
-    'array_init': 'const HkdfTestVector kHkdfSha256WycheproofVectors[] = {\n',
-    'formatter' : HKDF(),
-    'crop_size_end': -3,
-    'section': 'hkdf_sha256_vectors_h__',
-    'comment' : ''
-}
-
-hkdf_sha384_params = {
-    'source_dir': 'source_vectors/',
-    'source_file': 'hkdf_sha384_test.json',
-    'target': '../testvectors/hkdf-sha384-vectors.h',
-    'array_init': 'const HkdfTestVector kHkdfSha384WycheproofVectors[] = {\n',
-    'formatter' : HKDF(),
-    'crop_size_end': -3,
-    'section': 'hkdf_sha384_vectors_h__',
-    'comment' : ''
-}
-
-hkdf_sha512_params = {
-    'source_dir': 'source_vectors/',
-    'source_file': 'hkdf_sha512_test.json',
-    'target': '../testvectors/hkdf-sha512-vectors.h',
-    'array_init': 'const HkdfTestVector kHkdfSha512WycheproofVectors[] = {\n',
-    'formatter' : HKDF(),
-    'crop_size_end': -3,
-    'section': 'hkdf_sha512_vectors_h__',
-    'comment' : ''
-}
-
 p256ecdh_params = {
     'source_dir': 'source_vectors/',
     'source_file': 'ecdh_secp256r1_test.json',
@@ -570,39 +464,6 @@ p521ecdh_params = {
     'comment' : ''
 }
 
-p256ecdsa_sha256_params = {
-    'source_dir': 'source_vectors/',
-    'source_file': 'ecdsa_secp256r1_sha256_test.json',
-    'target': '../testvectors/p256ecdsa-sha256-vectors.h',
-    'array_init': 'const EcdsaTestVector kP256EcdsaSha256Vectors[] = {\n',
-    'formatter' : ECDSA(),
-    'crop_size_end': -2,
-    'section': 'p256ecdsa_sha256_vectors_h__',
-    'comment' : ''
-}
-
-p384ecdsa_sha384_params = {
-    'source_dir': 'source_vectors/',
-    'source_file': 'ecdsa_secp384r1_sha384_test.json',
-    'target': '../testvectors/p384ecdsa-sha384-vectors.h',
-    'array_init': 'const EcdsaTestVector kP384EcdsaSha384Vectors[] = {\n',
-    'formatter' : ECDSA(),
-    'crop_size_end': -2,
-    'section': 'p384ecdsa_sha384_vectors_h__',
-    'comment' : ''
-}
-
-p521ecdsa_sha512_params = {
-    'source_dir': 'source_vectors/',
-    'source_file': 'ecdsa_secp521r1_sha512_test.json',
-    'target': '../testvectors/p521ecdsa-sha512-vectors.h',
-    'array_init': 'const EcdsaTestVector kP521EcdsaSha512Vectors[] = {\n',
-    'formatter' : ECDSA(),
-    'crop_size_end': -2,
-    'section': 'p521ecdsa_sha512_vectors_h__',
-    'comment' : ''
-}
-
 rsa_signature_2048_sha224_params = {
     'source_dir': 'source_vectors/',
     'source_file': 'rsa_signature_2048_sha224_test.json',
@@ -919,14 +780,6 @@ def generate_test_vectors():
                  aes_gcm_params,
                  chacha_poly_params,
                  curve25519_params,
-                 dsa_params,
-                 hkdf_sha1_params,
-                 hkdf_sha256_params,
-                 hkdf_sha384_params,
-                 hkdf_sha512_params,
-                 p256ecdsa_sha256_params,
-                 p384ecdsa_sha384_params,
-                 p521ecdsa_sha512_params,
                  p256ecdh_params,
                  p384ecdh_params,
                  p521ecdh_params,

security/nss/gtests/freebl_gtest/mpi_unittest.cc

@@ -192,39 +192,6 @@ TEST_F(MPITest, MpiFixlenOctetsZero) {
   TestToFixedOctets(zero, sizeof(mp_digit) + 1);
 }
 
-TEST_F(MPITest, MpiRadixSizeNeg) {
-  char* str;
-  mp_int a;
-  mp_err rv;
-  const char* negative_edge =
-      "-5400000000000000003000000002200020090919017007777777777870000090"
-      "00000000007500443416610000000000000000000000000000000000000000000"
-      "00000000000000000000000000000000000000000000000000000000075049054"
-      "18610000800555594485440016000031555550000000000000000220030200909"
-      "19017007777777700000000000000000000000000000000000000000000000000"
-      "00000000000500000000000000000000000000004668129841661000071000000"
-      "00000000000000000000000000000000000000000000000007504434166100000"
-      "00000000000000000000000000000000000000000000000000000000000000000"
-      "00000000075049054186100008005555944854400184572169555500000000000"
-      "0000022003020090919017007777777700000000000000000000";
-
-  rv = mp_init(&a);
-  ASSERT_EQ(MP_OKAY, rv);
-  rv = mp_read_variable_radix(&a, negative_edge, 10);
-  ASSERT_EQ(MP_OKAY, rv);
-
-  const int radixSize = mp_radix_size(&a, 10);
-  ASSERT_LE(0, radixSize);
-
-  str = (char*)malloc(radixSize);
-  ASSERT_NE(nullptr, str);
-  rv = mp_toradix(&a, str, 10);
-  ASSERT_EQ(MP_OKAY, rv);
-  ASSERT_EQ(0, strcmp(negative_edge, str));
-  free(str);
-  mp_clear(&a);
-}
-
 TEST_F(MPITest, MpiFixlenOctetsVarlen) {
   std::vector<uint8_t> packed;
   for (size_t i = 0; i < sizeof(mp_digit) * 2; ++i) {
@@ -306,44 +273,6 @@ TEST_F(MPITest, MpiSqrMulClamp) {
   }
 }
 
-TEST_F(MPITest, MpiInvModLoop) {
-  mp_int a;
-  mp_int m;
-  mp_int c_actual;
-  mp_int c_expect;
-  MP_DIGITS(&a) = 0;
-  MP_DIGITS(&m) = 0;
-  MP_DIGITS(&c_actual) = 0;
-  MP_DIGITS(&c_expect) = 0;
-  ASSERT_EQ(MP_OKAY, mp_init(&a));
-  ASSERT_EQ(MP_OKAY, mp_init(&m));
-  ASSERT_EQ(MP_OKAY, mp_init(&c_actual));
-  ASSERT_EQ(MP_OKAY, mp_init(&c_expect));
-  mp_read_radix(&a,
-                "3e10b9f4859fb9e8150cc0d94e83ef428d655702a0b6fb1e684f4755eb6be6"
-                "5ac6048cdfc533f73a9bad76125801051f",
-                16);
-  mp_read_radix(&m,
-                "ffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372d"
-                "df581a0db248b0a77aecec196accc52973",
-                16);
-  mp_read_radix(&c_expect,
-                "12302214814361c15ab6c0f2131150af186099f8c22f6c9d6e77ad496b551c"
-                "7c8039e61098bfe2af66474420659435c6",
-                16);
-
-  int rv = mp_invmod(&a, &m, &c_actual);
-  ASSERT_EQ(MP_OKAY, rv);
-
-  rv = mp_cmp(&c_actual, &c_expect);
-  EXPECT_EQ(0, rv);
-
-  mp_clear(&a);
-  mp_clear(&m);
-  mp_clear(&c_actual);
-  mp_clear(&c_expect);
-}
-
 // This test is slow. Disable it by default so we can run these tests on CI.
 class DISABLED_MPITest : public ::testing::Test {};
 

security/nss/gtests/mozpkix_gtest/pkixbuild_tests.cpp

@@ -152,11 +152,14 @@ private:
     return Success;
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         /*optional*/ const Input*, /*optional*/ const Input*,
-                         /*optional*/ const Input*)
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time,
+                         Time validityBeginning, Duration,
+                         /*optional*/ const Input*, /*optional*/ const Input*)
                          override
   {
+    // All of the certificates in this test for which this is called have a
+    // validity period that begins "one day before now".
+    EXPECT_EQ(TimeFromEpochInSeconds(oneDayBeforeNow), validityBeginning);
     return Success;
   }
 
@@ -302,11 +305,14 @@ public:
     return Success;
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         /*optional*/ const Input*, /*optional*/ const Input*,
-                         /*optional*/ const Input*)
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time,
+                         Time validityBeginning, Duration,
+                         /*optional*/ const Input*, /*optional*/ const Input*)
                          override
   {
+    // All of the certificates in this test for which this is called have a
+    // validity period that begins "one day before now".
+    EXPECT_EQ(TimeFromEpochInSeconds(oneDayBeforeNow), validityBeginning);
     return Success;
   }
 
@@ -323,9 +329,8 @@ public:
   {
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         /*optional*/ const Input*, /*optional*/ const Input*,
-                         /*optional*/ const Input*)
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Time, Duration,
+                         /*optional*/ const Input*, /*optional*/ const Input*)
                          override
   {
     ADD_FAILURE();
@@ -445,11 +450,14 @@ public:
     return Success;
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         /*optional*/ const Input*, /*optional*/ const Input*,
-                         /*optional*/ const Input*)
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time,
+                         Time validityBeginning, Duration,
+                         /*optional*/ const Input*, /*optional*/ const Input*)
                          override
   {
+    // All of the certificates in this test for which this is called have a
+    // validity period that begins "one day before now".
+    EXPECT_EQ(TimeFromEpochInSeconds(oneDayBeforeNow), validityBeginning);
     return Success;
   }
 
@@ -669,11 +677,14 @@ private:
     return Success;
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         /*optional*/ const Input*,
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time,
+                         Time validityBeginning, Duration,
                          /*optional*/ const Input*,
                          /*optional*/ const Input*) override
   {
+    // All of the certificates in this test for which this is called have a
+    // validity period that begins "one day before now".
+    EXPECT_EQ(TimeFromEpochInSeconds(oneDayBeforeNow), validityBeginning);
     return Success;
   }
 
@@ -728,8 +739,8 @@ class RevokedEndEntityTrustDomain final : public MultiplePathTrustDomain
 {
 public:
   Result CheckRevocation(EndEntityOrCA endEntityOrCA, const CertID&, Time,
-                         Duration, /*optional*/ const Input*,
-                         /*optional*/ const Input*, /*optional*/ const Input*) override
+                         Time, Duration, /*optional*/ const Input*,
+                         /*optional*/ const Input*) override
   {
     if (endEntityOrCA == EndEntityOrCA::MustBeEndEntity) {
       return Result::ERROR_REVOKED_CERTIFICATE;
@@ -833,11 +844,14 @@ private:
     return Success;
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         /*optional*/ const Input*, /*optional*/ const Input*,
-                         /*optional*/ const Input*)
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time,
+                         Time validityBeginning, Duration,
+                         /*optional*/ const Input*, /*optional*/ const Input*)
                          override
   {
+    // All of the certificates in this test for which this is called have a
+    // validity period that begins "one day before now".
+    EXPECT_EQ(TimeFromEpochInSeconds(oneDayBeforeNow), validityBeginning);
     return Success;
   }
 

security/nss/gtests/mozpkix_gtest/pkixcert_extension_tests.cpp

@@ -70,9 +70,8 @@ private:
     return Success;
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         /*optional*/ const Input*, /*optional*/ const Input*,
-                         /*optional*/ const Input*)
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Time, Duration,
+                         /*optional*/ const Input*, /*optional*/ const Input*)
                          override
   {
     return Success;

security/nss/gtests/mozpkix_gtest/pkixcert_signature_algorithm_tests.cpp

@@ -7,55 +7,9 @@
 
 #include "mozpkix/pkixder.h"
 
-#include "secoid.h"
-
 using namespace mozilla::pkix;
 using namespace mozilla::pkix::test;
 
-/* These tests generate invalid certificates on the fly, We want to test
- * validation of those certificates, not the generation, so we
- * need to temporarily allow disallowed signature policies before
- * we do the actual certificate or ocsp signing
- */
-class HashAlgorithmPolicies
-{
-   static const int numberOfHashes = 4; /* sigh */
-   static const SECOidTag hashOids[numberOfHashes];
-
-   PRUint32 savedPolicy[numberOfHashes];
-
-public:
-   void EnableHashSignaturePolicy(void);
-   void RestoreHashSignaturePolicy(void);
-};
-
-const SECOidTag HashAlgorithmPolicies::hashOids[numberOfHashes] = {
-   SEC_OID_MD2,
-   SEC_OID_MD4,
-   SEC_OID_MD5,
-   SEC_OID_SHA1 };
-
-void
-HashAlgorithmPolicies::EnableHashSignaturePolicy(void)
-{
-    for (int i=0;i < numberOfHashes; i++) {
-        ASSERT_EQ(SECSuccess,
-                  NSS_GetAlgorithmPolicy(hashOids[i], &savedPolicy[i]));
-        ASSERT_EQ(SECSuccess,
-                  NSS_SetAlgorithmPolicy(hashOids[i], NSS_USE_ALG_IN_SIGNATURE, 0));
-    }
-}
-
-void
-HashAlgorithmPolicies::RestoreHashSignaturePolicy(void)
-{
-    for (int i=0;i < numberOfHashes; i++) {
-        ASSERT_EQ(SECSuccess,
-                  NSS_SetAlgorithmPolicy(hashOids[i], savedPolicy[i],
-                                        NSS_USE_ALG_IN_SIGNATURE));
-    }
-}
-
 static ByteString
 CreateCert(const char* issuerCN,
            const char* subjectCN,
@@ -81,20 +35,16 @@ CreateCert(const char* issuerCN,
   }
 
   ScopedTestKeyPair reusedKey(CloneReusedKeyPair());
-  HashAlgorithmPolicies policies;
-  policies.EnableHashSignaturePolicy();
   ByteString certDER(CreateEncodedCertificate(v3, signatureAlgorithm,
                                               serialNumber, issuerDER,
                                               oneDayBeforeNow, oneDayAfterNow,
                                               subjectDER, *reusedKey,
                                               extensions, *reusedKey,
                                               signatureAlgorithm));
-  policies.RestoreHashSignaturePolicy();
   EXPECT_FALSE(ENCODING_FAILED(certDER));
   return certDER;
 }
 
-
 class AlgorithmTestsTrustDomain final : public DefaultCryptoTrustDomain
 {
 public:
@@ -142,8 +92,8 @@ private:
     return checker.Check(issuerCert, nullptr, keepGoing);
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         const Input*, const Input*, const Input*) override
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Time, Duration,
+                         const Input*, const Input*) override
   {
     return Success;
   }

security/nss/gtests/mozpkix_gtest/pkixcheck_CheckExtendedKeyUsage_tests.cpp

@@ -558,8 +558,8 @@ private:
     return checker.Check(derCert, nullptr, keepGoing);
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         const Input*, const Input*, const Input*) override
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Time, Duration,
+                         const Input*, const Input*) override
   {
     return Success;
   }

security/nss/gtests/mozpkix_gtest/pkixcheck_CheckSignatureAlgorithm_tests.cpp

@@ -302,8 +302,7 @@ public:
     return Success;
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         /*optional*/ const Input*,
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Time, Duration,
                          /*optional*/ const Input*,
                          /*optional*/ const Input*) override
   {

security/nss/gtests/mozpkix_gtest/pkixgtest.h

@@ -100,8 +100,7 @@ class EverythingFailsByDefaultTrustDomain : public TrustDomain {
                       Result::FATAL_ERROR_LIBRARY_FAILURE);
   }
 
-  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Duration,
-                         /*optional*/ const Input*,
+  Result CheckRevocation(EndEntityOrCA, const CertID&, Time, Time, Duration,
                          /*optional*/ const Input*,
                          /*optional*/ const Input*) override {
     ADD_FAILURE();

security/nss/gtests/mozpkix_gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp

@@ -26,8 +26,6 @@
 
 #include "mozpkix/pkixder.h"
 
-#include "secoid.h"
-
 using namespace mozilla::pkix;
 using namespace mozilla::pkix::test;
 
@@ -340,12 +338,6 @@ TEST_F(pkixocsp_VerifyEncodedResponse_successful, unknown)
 TEST_F(pkixocsp_VerifyEncodedResponse_successful,
        good_unsupportedSignatureAlgorithm)
 {
-  PRUint32 policyMd5;
-  ASSERT_EQ(SECSuccess,NSS_GetAlgorithmPolicy(SEC_OID_MD5, &policyMd5));
-
-  /* our encode won't work if MD5 isn't allowed by policy */
-  ASSERT_EQ(SECSuccess,
-            NSS_SetAlgorithmPolicy(SEC_OID_MD5, NSS_USE_ALG_IN_SIGNATURE, 0));
   ByteString responseString(
                CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID, byKey,
@@ -355,9 +347,6 @@ TEST_F(pkixocsp_VerifyEncodedResponse_successful,
   Input response;
   ASSERT_EQ(Success,
             response.Init(responseString.data(), responseString.length()));
-  /* now restore the existing policy */
-  ASSERT_EQ(SECSuccess,
-           NSS_SetAlgorithmPolicy(SEC_OID_MD5, policyMd5, NSS_USE_ALG_IN_SIGNATURE));
   bool expired;
   ASSERT_EQ(Result::ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID,
@@ -941,23 +930,14 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
   // Note that the algorithm ID (md5WithRSAEncryption) identifies the signature
   // algorithm that will be used to sign the certificate that issues the OCSP
   // responses, not the responses themselves.
-  PRUint32 policyMd5;
-  ASSERT_EQ(SECSuccess,NSS_GetAlgorithmPolicy(SEC_OID_MD5, &policyMd5));
-
-  /* our encode won't work if MD5 isn't allowed by policy */
-  ASSERT_EQ(SECSuccess,
-            NSS_SetAlgorithmPolicy(SEC_OID_MD5, NSS_USE_ALG_IN_SIGNATURE, 0));
   ByteString responseString(
                CreateEncodedIndirectOCSPSuccessfulResponse(
                          "good_indirect_unsupportedSignatureAlgorithm",
                          OCSPResponseContext::good, byKey,
                          md5WithRSAEncryption()));
   Input response;
-  /* now restore the existing policy */
   ASSERT_EQ(Success,
             response.Init(responseString.data(), responseString.length()));
-  ASSERT_EQ(SECSuccess,
-            NSS_SetAlgorithmPolicy(SEC_OID_MD5, policyMd5, NSS_USE_ALG_IN_SIGNATURE));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),

security/nss/gtests/pk11_gtest/manifest.mn

@@ -16,15 +16,12 @@ CPPSRCS = \
       pk11_curve25519_unittest.cc \
       pk11_der_private_key_import_unittest.cc \
       pk11_des_unittest.cc \
-      pk11_dsa_unittest.cc \
       pk11_ecdsa_unittest.cc \
       pk11_ecdh_unittest.cc \
       pk11_encrypt_derive_unittest.cc \
       pk11_export_unittest.cc \
       pk11_find_certs_unittest.cc \
       pk11_hkdf_unittest.cc \
-      pk11_hmac_unittest.cc \
-      pk11_hpke_unittest.cc \
       pk11_import_unittest.cc \
       pk11_kbkdf.cc \
       pk11_keygen.cc \

security/nss/gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc

@@ -45,7 +45,7 @@ class Pkcs11ChaCha20Poly1305Test
     SECItem params = {siBuffer, reinterpret_cast<unsigned char*>(&aead_params),
                       sizeof(aead_params)};
 
-    // Encrypt with bad parameters (TagLen is too long).
+    // Encrypt with bad parameters.
     unsigned int encrypted_len = 0;
     std::vector<uint8_t> encrypted(data_len + aead_params.ulTagLen);
     aead_params.ulTagLen = 158072;
@@ -54,16 +54,9 @@ class Pkcs11ChaCha20Poly1305Test
                      &encrypted_len, encrypted.size(), data, data_len);
     EXPECT_EQ(SECFailure, rv);
     EXPECT_EQ(0U, encrypted_len);
-
-    // Encrypt with bad parameters (TagLen is too short).
-    aead_params.ulTagLen = 2;
-    rv = PK11_Encrypt(key.get(), kMech, &params, encrypted.data(),
-                      &encrypted_len, encrypted.size(), data, data_len);
-    EXPECT_EQ(SECFailure, rv);
-    EXPECT_EQ(0U, encrypted_len);
+    aead_params.ulTagLen = 16;
 
     // Encrypt.
-    aead_params.ulTagLen = 16;
     rv = PK11_Encrypt(key.get(), kMech, &params, encrypted.data(),
                       &encrypted_len, encrypted.size(), data, data_len);
 

security/nss/gtests/pk11_gtest/pk11_cipherop_unittest.cc

@@ -77,53 +77,4 @@ TEST(Pkcs11CipherOp, SingleCtxMultipleUnalignedCipherOps) {
   NSS_ShutdownContext(globalctx);
 }
 
-TEST(Pkcs11CipherOp, SingleCtxMultipleUnalignedCipherOpsChaCha20) {
-  PK11SlotInfo* slot;
-  PK11SymKey* key;
-  PK11Context* ctx;
-
-  NSSInitContext* globalctx =
-      NSS_InitContext("", "", "", "", NULL,
-                      NSS_INIT_READONLY | NSS_INIT_NOCERTDB | NSS_INIT_NOMODDB |
-                          NSS_INIT_FORCEOPEN | NSS_INIT_NOROOTINIT);
-
-  const CK_MECHANISM_TYPE cipher = CKM_NSS_CHACHA20_CTR;
-
-  slot = PK11_GetInternalSlot();
-  ASSERT_TRUE(slot);
-
-  // Use arbitrary bytes for the ChaCha20 key and IV
-  uint8_t key_bytes[32];
-  for (size_t i = 0; i < 32; i++) {
-    key_bytes[i] = i;
-  }
-  SECItem keyItem = {siBuffer, key_bytes, 32};
-
-  uint8_t iv_bytes[16];
-  for (size_t i = 0; i < 16; i++) {
-    key_bytes[i] = i;
-  }
-  SECItem ivItem = {siBuffer, iv_bytes, 16};
-
-  SECItem* param = PK11_ParamFromIV(cipher, &ivItem);
-
-  key = PK11_ImportSymKey(slot, cipher, PK11_OriginUnwrap, CKA_ENCRYPT,
-                          &keyItem, NULL);
-  ctx = PK11_CreateContextBySymKey(cipher, CKA_ENCRYPT, key, param);
-  ASSERT_TRUE(key);
-  ASSERT_TRUE(ctx);
-
-  uint8_t outbuf[128];
-  // This is supposed to fail for Chacha20. This is because the underlying
-  // PK11_CipherOp operation is calling the C_EncryptUpdate function for
-  // which multi-part is disabled for ChaCha20 in counter mode.
-  ASSERT_EQ(GetBytes(ctx, outbuf, 7), SECFailure);
-
-  PK11_FreeSymKey(key);
-  PK11_FreeSlot(slot);
-  SECITEM_FreeItem(param, PR_TRUE);
-  PK11_DestroyContext(ctx, PR_TRUE);
-  NSS_ShutdownContext(globalctx);
-}
-
 }  // namespace nss_test

security/nss/gtests/pk11_gtest/pk11_dsa_unittest.cc

@@ -1,79 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include <memory>
-#include "nss.h"
-#include "pk11pub.h"
-#include "sechash.h"
-#include "cryptohi.h"
-
-#include "cpputil.h"
-#include "databuffer.h"
-
-#include "gtest/gtest.h"
-#include "nss_scoped_ptrs.h"
-
-#include "testvectors/dsa-vectors.h"
-
-namespace nss_test {
-
-class Pkcs11DsaTest : public ::testing::TestWithParam<DsaTestVector> {
- protected:
-  void Derive(const uint8_t* sig, size_t sig_len, const uint8_t* spki,
-              size_t spki_len, const uint8_t* data, size_t data_len,
-              bool expect_success, const uint32_t test_id,
-              const SECOidTag hash_oid) {
-    std::stringstream s;
-    s << "Test with original ID #" << test_id << " failed.\n";
-    s << "Expected Success: " << expect_success << "\n";
-    std::string msg = s.str();
-
-    SECItem spki_item = {siBuffer, toUcharPtr(spki),
-                         static_cast<unsigned int>(spki_len)};
-
-    ScopedCERTSubjectPublicKeyInfo cert_spki(
-        SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item));
-    ASSERT_TRUE(cert_spki) << msg;
-
-    ScopedSECKEYPublicKey pub_key(SECKEY_ExtractPublicKey(cert_spki.get()));
-    ASSERT_TRUE(pub_key) << msg;
-
-    SECItem sig_item = {siBuffer, toUcharPtr(sig),
-                        static_cast<unsigned int>(sig_len)};
-    ScopedSECItem decoded_sig_item(
-        DSAU_DecodeDerSigToLen(&sig_item, SECKEY_SignatureLen(pub_key.get())));
-    if (!decoded_sig_item) {
-      ASSERT_FALSE(expect_success) << msg;
-      return;
-    }
-
-    DataBuffer hash;
-    hash.Allocate(static_cast<size_t>(HASH_ResultLenByOidTag(hash_oid)));
-    SECStatus rv = PK11_HashBuf(hash_oid, toUcharPtr(hash.data()),
-                                toUcharPtr(data), data_len);
-    ASSERT_EQ(SECSuccess, rv) << msg;
-
-    // Verify.
-    SECItem hash_item = {siBuffer, toUcharPtr(hash.data()),
-                         static_cast<unsigned int>(hash.len())};
-    rv = PK11_VerifyWithMechanism(pub_key.get(), CKM_DSA, nullptr,
-                                  decoded_sig_item.get(), &hash_item, nullptr);
-    EXPECT_EQ(expect_success ? SECSuccess : SECFailure, rv);
-  };
-
-  void Derive(const DsaTestVector vector) {
-    Derive(vector.sig.data(), vector.sig.size(), vector.public_key.data(),
-           vector.public_key.size(), vector.msg.data(), vector.msg.size(),
-           vector.valid, vector.id, vector.hash_oid);
-  };
-};
-
-TEST_P(Pkcs11DsaTest, WycheproofVectors) { Derive(GetParam()); }
-
-INSTANTIATE_TEST_CASE_P(DsaTest, Pkcs11DsaTest,
-                        ::testing::ValuesIn(kDsaWycheproofVectors));
-
-}  // namespace nss_test

security/nss/gtests/pk11_gtest/pk11_ecdsa_unittest.cc

@@ -6,16 +6,12 @@
 #include "nss.h"
 #include "pk11pub.h"
 #include "sechash.h"
-#include "cryptohi.h"
 
 #include "gtest/gtest.h"
 #include "nss_scoped_ptrs.h"
 
 #include "pk11_ecdsa_vectors.h"
 #include "pk11_signature_test.h"
-#include "testvectors/p256ecdsa-sha256-vectors.h"
-#include "testvectors/p384ecdsa-sha384-vectors.h"
-#include "testvectors/p521ecdsa-sha512-vectors.h"
 
 namespace nss_test {
 
@@ -176,48 +172,4 @@ TEST_F(Pkcs11EcdsaSha256Test, ImportSpkiPointNotOnCurve) {
   EXPECT_EQ(handle, static_cast<decltype(handle)>(CK_INVALID_HANDLE));
 }
 
-class Pkcs11EcdsaWycheproofTest
-    : public ::testing::TestWithParam<EcdsaTestVector> {
- protected:
-  void Derive(const EcdsaTestVector vec) {
-    SECItem spki_item = {siBuffer, toUcharPtr(vec.public_key.data()),
-                         static_cast<unsigned int>(vec.public_key.size())};
-    SECItem sig_item = {siBuffer, toUcharPtr(vec.sig.data()),
-                        static_cast<unsigned int>(vec.sig.size())};
-
-    DataBuffer hash;
-    hash.Allocate(static_cast<size_t>(HASH_ResultLenByOidTag(vec.hash_oid)));
-    SECStatus rv = PK11_HashBuf(vec.hash_oid, toUcharPtr(hash.data()),
-                                toUcharPtr(vec.msg.data()), vec.msg.size());
-    ASSERT_EQ(rv, SECSuccess);
-    SECItem hash_item = {siBuffer, toUcharPtr(hash.data()),
-                         static_cast<unsigned int>(hash.len())};
-
-    ScopedCERTSubjectPublicKeyInfo cert_spki(
-        SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item));
-    ASSERT_TRUE(cert_spki);
-    ScopedSECKEYPublicKey pub_key(SECKEY_ExtractPublicKey(cert_spki.get()));
-    ASSERT_TRUE(pub_key);
-
-    rv = VFY_VerifyDigestDirect(&hash_item, pub_key.get(), &sig_item,
-                                SEC_OID_ANSIX962_EC_PUBLIC_KEY, vec.hash_oid,
-                                nullptr);
-    EXPECT_EQ(rv, vec.valid ? SECSuccess : SECFailure);
-  };
-};
-
-TEST_P(Pkcs11EcdsaWycheproofTest, Verify) { Derive(GetParam()); }
-
-INSTANTIATE_TEST_CASE_P(WycheproofP256SignatureSha256Test,
-                        Pkcs11EcdsaWycheproofTest,
-                        ::testing::ValuesIn(kP256EcdsaSha256Vectors));
-
-INSTANTIATE_TEST_CASE_P(WycheproofP384SignatureSha384Test,
-                        Pkcs11EcdsaWycheproofTest,
-                        ::testing::ValuesIn(kP384EcdsaSha384Vectors));
-
-INSTANTIATE_TEST_CASE_P(WycheproofP521SignatureSha512Test,
-                        Pkcs11EcdsaWycheproofTest,
-                        ::testing::ValuesIn(kP521EcdsaSha512Vectors));
-
 }  // namespace nss_test

security/nss/gtests/pk11_gtest/pk11_encrypt_derive_unittest.cc

@@ -72,12 +72,10 @@ class EncryptDeriveTest
         return CKM_CAMELLIA_ECB_ENCRYPT_DATA;
       case CKM_CAMELLIA_CBC:
         return CKM_CAMELLIA_CBC_ENCRYPT_DATA;
-#ifndef NSS_DISABLE_DEPRECATED_SEED
       case CKM_SEED_ECB:
         return CKM_SEED_ECB_ENCRYPT_DATA;
       case CKM_SEED_CBC:
         return CKM_SEED_CBC_ENCRYPT_DATA;
-#endif
       default:
         ADD_FAILURE() << "Unknown mechanism";
         break;
@@ -95,9 +93,7 @@ class EncryptDeriveTest
       case CKM_DES3_ECB:
       case CKM_AES_ECB:
       case CKM_CAMELLIA_ECB:
-#ifndef NSS_DISABLE_DEPRECATED_SEED
       case CKM_SEED_ECB:
-#endif
         string_data.pData = toUcharPtr(kInput);
         string_data.ulLen = keysize();
         param.data = reinterpret_cast<uint8_t*>(&string_data);
@@ -114,9 +110,7 @@ class EncryptDeriveTest
 
       case CKM_AES_CBC:
       case CKM_CAMELLIA_CBC:
-#ifndef NSS_DISABLE_DEPRECATED_SEED
       case CKM_SEED_CBC:
-#endif
         aes_data.pData = toUcharPtr(kInput);
         aes_data.length = keysize();
         PORT_Memcpy(aes_data.iv, kIv, keysize());
@@ -138,18 +132,14 @@ class EncryptDeriveTest
       case CKM_DES3_ECB:
       case CKM_AES_ECB:
       case CKM_CAMELLIA_ECB:
-#ifndef NSS_DISABLE_DEPRECATED_SEED
       case CKM_SEED_ECB:
-#endif
         // No parameter needed here.
         break;
 
       case CKM_DES3_CBC:
       case CKM_AES_CBC:
       case CKM_CAMELLIA_CBC:
-#ifndef NSS_DISABLE_DEPRECATED_SEED
       case CKM_SEED_CBC:
-#endif
         param.data = toUcharPtr(kIv);
         param.len = keysize();
         break;
@@ -196,13 +186,8 @@ class EncryptDeriveTest
 TEST_P(EncryptDeriveTest, Test) { TestEncryptDerive(); }
 
 static const CK_MECHANISM_TYPE kEncryptDeriveMechanisms[] = {
-    CKM_DES3_ECB, CKM_DES3_CBC, CKM_AES_ECB, CKM_AES_ECB, CKM_AES_CBC,
-    CKM_CAMELLIA_ECB, CKM_CAMELLIA_CBC
-#ifndef NSS_DISABLE_DEPRECATED_SEED
-    ,
-    CKM_SEED_ECB, CKM_SEED_CBC
-#endif
-};
+    CKM_DES3_ECB,     CKM_DES3_CBC,     CKM_AES_ECB,  CKM_AES_ECB, CKM_AES_CBC,
+    CKM_CAMELLIA_ECB, CKM_CAMELLIA_CBC, CKM_SEED_ECB, CKM_SEED_CBC};
 
 INSTANTIATE_TEST_CASE_P(EncryptDeriveTests, EncryptDeriveTest,
                         ::testing::ValuesIn(kEncryptDeriveMechanisms));

security/nss/gtests/pk11_gtest/pk11_find_certs_unittest.cc

@@ -142,11 +142,11 @@ class PK11FindCertsTestBase : public ::testing::Test {
     mod_spec.append(test_name);
     mod_spec.append("'");
     m_slot = SECMOD_OpenUserDB(mod_spec.c_str());
-    ASSERT_NE(nullptr, m_slot);
+    ASSERT_NE(m_slot, nullptr);
   }
 
   virtual void TearDown() {
-    ASSERT_EQ(SECSuccess, SECMOD_CloseUserDB(m_slot));
+    ASSERT_EQ(SECMOD_CloseUserDB(m_slot), SECSuccess);
     PK11_FreeSlot(m_slot);
     std::string test_cert_db_path(test_cert_db_dir_.GetPath());
     ASSERT_EQ(0, unlink((test_cert_db_path + "/cert9.db").c_str()));
@@ -159,41 +159,6 @@ class PK11FindCertsTestBase : public ::testing::Test {
 
 class PK11FindRawCertsBySubjectTest : public PK11FindCertsTestBase {};
 
-TEST_F(PK11FindCertsTestBase, CertAddListWithData) {
-  ScopedPK11SlotInfo slot(PK11_GetInternalKeySlot());
-  ASSERT_TRUE(slot);
-  SECItem cert1_item = {siBuffer, const_cast<uint8_t*>(kTestCert1DER.data()),
-                        (unsigned int)kTestCert1DER.size()};
-  SECItem cert2_item = {siBuffer, const_cast<uint8_t*>(kTestCert2DER.data()),
-                        (unsigned int)kTestCert2DER.size()};
-
-  // Make certificates. ScopedCERTCertList will own.
-  ScopedCERTCertList list(CERT_NewCertList());
-  ASSERT_TRUE(list);
-  CERTCertificate* cert1 = CERT_NewTempCertificate(
-      CERT_GetDefaultCertDB(), &cert1_item, nullptr, false, false);
-  CERTCertificate* cert2 = CERT_NewTempCertificate(
-      CERT_GetDefaultCertDB(), &cert2_item, nullptr, false, false);
-  ASSERT_NE(nullptr, cert1);
-  ASSERT_NE(nullptr, cert2);
-  ASSERT_NE(cert1, cert2);
-
-  SECStatus rv = CERT_AddCertToListHeadWithData(list.get(), cert1, cert1);
-  EXPECT_EQ(SECSuccess, rv);
-  rv = CERT_AddCertToListTailWithData(list.get(), cert2, cert2);
-  EXPECT_EQ(SECSuccess, rv);
-
-  CERTCertListNode* node = CERT_LIST_HEAD(list.get());
-  ASSERT_NE(nullptr, node);
-  EXPECT_EQ(node->cert, cert1);
-  EXPECT_EQ(node->appData, cert1);
-
-  node = CERT_LIST_TAIL(list.get());
-  ASSERT_NE(nullptr, node);
-  EXPECT_EQ(node->cert, cert2);
-  EXPECT_EQ(node->appData, cert2);
-}
-
 // If we don't have any certificates, we shouldn't get any when we search for
 // them.
 TEST_F(PK11FindRawCertsBySubjectTest, TestNoCertsImportedNoCertsFound) {
@@ -203,8 +168,8 @@ TEST_F(PK11FindRawCertsBySubjectTest, TestNoCertsImportedNoCertsFound) {
   CERTCertificateList* certificates = nullptr;
   SECStatus rv =
       PK11_FindRawCertsWithSubject(m_slot, &subject_item, &certificates);
-  EXPECT_EQ(SECSuccess, rv);
-  EXPECT_EQ(nullptr, certificates);
+  EXPECT_EQ(rv, SECSuccess);
+  EXPECT_EQ(certificates, nullptr);
 }
 
 // If we have one certificate but it has an unrelated subject DN, we shouldn't
@@ -214,9 +179,9 @@ TEST_F(PK11FindRawCertsBySubjectTest, TestOneCertImportedNoCertsFound) {
   SECItem cert_item = {siBuffer,
                        const_cast<unsigned char*>(kUnrelatedTestCertDER.data()),
                        (unsigned int)kUnrelatedTestCertDER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert_item, CK_INVALID_HANDLE,
-                               cert_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert_item, CK_INVALID_HANDLE,
+                               cert_nickname, false),
+            SECSuccess);
 
   SECItem subject_item = {
       siBuffer, const_cast<unsigned char*>(kTestCertSubjectDER.data()),
@@ -224,8 +189,8 @@ TEST_F(PK11FindRawCertsBySubjectTest, TestOneCertImportedNoCertsFound) {
   CERTCertificateList* certificates = nullptr;
   SECStatus rv =
       PK11_FindRawCertsWithSubject(m_slot, &subject_item, &certificates);
-  EXPECT_EQ(SECSuccess, rv);
-  EXPECT_EQ(nullptr, certificates);
+  EXPECT_EQ(rv, SECSuccess);
+  EXPECT_EQ(certificates, nullptr);
 }
 
 TEST_F(PK11FindRawCertsBySubjectTest, TestMultipleMatchingCertsFound) {
@@ -233,23 +198,23 @@ TEST_F(PK11FindRawCertsBySubjectTest, TestMultipleMatchingCertsFound) {
   SECItem cert1_item = {siBuffer,
                         const_cast<unsigned char*>(kTestCert1DER.data()),
                         (unsigned int)kTestCert1DER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert1_item, CK_INVALID_HANDLE,
-                               cert1_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert1_item, CK_INVALID_HANDLE,
+                               cert1_nickname, false),
+            SECSuccess);
   char cert2_nickname[] = "Test Cert 2";
   SECItem cert2_item = {siBuffer,
                         const_cast<unsigned char*>(kTestCert2DER.data()),
                         (unsigned int)kTestCert2DER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert2_item, CK_INVALID_HANDLE,
-                               cert2_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert2_item, CK_INVALID_HANDLE,
+                               cert2_nickname, false),
+            SECSuccess);
   char unrelated_cert_nickname[] = "Unrelated Test Cert";
   SECItem unrelated_cert_item = {
       siBuffer, const_cast<unsigned char*>(kUnrelatedTestCertDER.data()),
       (unsigned int)kUnrelatedTestCertDER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &unrelated_cert_item, CK_INVALID_HANDLE,
-                               unrelated_cert_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &unrelated_cert_item, CK_INVALID_HANDLE,
+                               unrelated_cert_nickname, false),
+            SECSuccess);
 
   CERTCertificateList* certificates = nullptr;
   SECItem subject_item = {
@@ -257,10 +222,10 @@ TEST_F(PK11FindRawCertsBySubjectTest, TestMultipleMatchingCertsFound) {
       (unsigned int)kTestCertSubjectDER.size()};
   SECStatus rv =
       PK11_FindRawCertsWithSubject(m_slot, &subject_item, &certificates);
-  EXPECT_EQ(SECSuccess, rv);
-  ASSERT_NE(nullptr, certificates);
+  EXPECT_EQ(rv, SECSuccess);
+  ASSERT_NE(certificates, nullptr);
   ScopedCERTCertificateList scoped_certificates(certificates);
-  ASSERT_EQ(2, scoped_certificates->len);
+  ASSERT_EQ(scoped_certificates->len, 2);
 
   std::vector<uint8_t> found_cert1(
       scoped_certificates->certs[0].data,
@@ -280,9 +245,9 @@ TEST_F(PK11FindRawCertsBySubjectTest, TestNoCertsOnInternalSlots) {
   SECItem cert1_item = {siBuffer,
                         const_cast<unsigned char*>(kTestCert1DER.data()),
                         (unsigned int)kTestCert1DER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert1_item, CK_INVALID_HANDLE,
-                               cert1_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert1_item, CK_INVALID_HANDLE,
+                               cert1_nickname, false),
+            SECSuccess);
 
   SECItem subject_item = {
       siBuffer, const_cast<unsigned char*>(kTestCertSubjectDER.data()),
@@ -291,15 +256,15 @@ TEST_F(PK11FindRawCertsBySubjectTest, TestNoCertsOnInternalSlots) {
   ScopedPK11SlotInfo internal_key_slot(PK11_GetInternalKeySlot());
   SECStatus rv = PK11_FindRawCertsWithSubject(
       internal_key_slot.get(), &subject_item, &internal_key_slot_certificates);
-  EXPECT_EQ(SECSuccess, rv);
-  EXPECT_EQ(nullptr, internal_key_slot_certificates);
+  EXPECT_EQ(rv, SECSuccess);
+  EXPECT_EQ(internal_key_slot_certificates, nullptr);
 
   CERTCertificateList* internal_slot_certificates = nullptr;
   ScopedPK11SlotInfo internal_slot(PK11_GetInternalSlot());
   rv = PK11_FindRawCertsWithSubject(internal_slot.get(), &subject_item,
                                     &internal_slot_certificates);
-  EXPECT_EQ(SECSuccess, rv);
-  EXPECT_EQ(nullptr, internal_slot_certificates);
+  EXPECT_EQ(rv, SECSuccess);
+  EXPECT_EQ(internal_slot_certificates, nullptr);
 }
 
 // issuer:test cert
@@ -340,9 +305,10 @@ TEST_F(PK11FindRawCertsBySubjectTest, TestFindEmptySubject) {
   SECItem empty_subject_cert_item = {
       siBuffer, const_cast<unsigned char*>(kEmptySubjectCertDER.data()),
       (unsigned int)kEmptySubjectCertDER.size()};
-  ASSERT_EQ(SECSuccess, PK11_ImportDERCert(m_slot, &empty_subject_cert_item,
-                                           CK_INVALID_HANDLE,
-                                           empty_subject_cert_nickname, false));
+  ASSERT_EQ(
+      PK11_ImportDERCert(m_slot, &empty_subject_cert_item, CK_INVALID_HANDLE,
+                         empty_subject_cert_nickname, false),
+      SECSuccess);
 
   SECItem subject_item = {siBuffer,
                           const_cast<unsigned char*>(kEmptySubjectDER.data()),
@@ -350,15 +316,15 @@ TEST_F(PK11FindRawCertsBySubjectTest, TestFindEmptySubject) {
   CERTCertificateList* certificates = nullptr;
   SECStatus rv =
       PK11_FindRawCertsWithSubject(m_slot, &subject_item, &certificates);
-  EXPECT_EQ(SECSuccess, rv);
-  ASSERT_NE(nullptr, certificates);
+  EXPECT_EQ(rv, SECSuccess);
+  ASSERT_NE(certificates, nullptr);
   ScopedCERTCertificateList scoped_certificates(certificates);
-  ASSERT_EQ(1, scoped_certificates->len);
+  ASSERT_EQ(scoped_certificates->len, 1);
 
   std::vector<uint8_t> found_cert(
       scoped_certificates->certs[0].data,
       scoped_certificates->certs[0].data + scoped_certificates->certs[0].len);
-  EXPECT_EQ(kEmptySubjectCertDER, found_cert);
+  EXPECT_EQ(found_cert, kEmptySubjectCertDER);
 }
 
 // Searching for a zero-length subject doesn't make sense (the minimum subject
@@ -369,16 +335,16 @@ TEST_F(PK11FindRawCertsBySubjectTest, TestSearchForNullSubject) {
   SECItem cert1_item = {siBuffer,
                         const_cast<unsigned char*>(kTestCert1DER.data()),
                         (unsigned int)kTestCert1DER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert1_item, CK_INVALID_HANDLE,
-                               cert1_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert1_item, CK_INVALID_HANDLE,
+                               cert1_nickname, false),
+            SECSuccess);
 
   SECItem subject_item = {siBuffer, nullptr, 0};
   CERTCertificateList* certificates = nullptr;
   SECStatus rv =
       PK11_FindRawCertsWithSubject(m_slot, &subject_item, &certificates);
-  EXPECT_EQ(SECSuccess, rv);
-  EXPECT_EQ(nullptr, certificates);
+  EXPECT_EQ(rv, SECSuccess);
+  EXPECT_EQ(certificates, nullptr);
 }
 
 class PK11GetCertsMatchingPrivateKeyTest : public PK11FindCertsTestBase {};
@@ -442,10 +408,11 @@ TEST_F(PK11GetCertsMatchingPrivateKeyTest, TestNoCertsAtAll) {
       (unsigned int)kTestPrivateKeyInfoDER.size(),
   };
   SECKEYPrivateKey* priv_key = nullptr;
-  ASSERT_EQ(SECSuccess, PK11_ImportDERPrivateKeyInfoAndReturnKey(
-                            m_slot, &private_key_info, nullptr, nullptr, false,
-                            false, KU_ALL, &priv_key, nullptr));
-  ASSERT_NE(nullptr, priv_key);
+  ASSERT_EQ(PK11_ImportDERPrivateKeyInfoAndReturnKey(
+                m_slot, &private_key_info, nullptr, nullptr, false, false,
+                KU_ALL, &priv_key, nullptr),
+            SECSuccess);
+  ASSERT_NE(priv_key, nullptr);
   ScopedSECKEYPrivateKey scoped_priv_key(priv_key);
   ScopedCERTCertList certs(
       PK11_GetCertsMatchingPrivateKey(scoped_priv_key.get()));
@@ -459,19 +426,20 @@ TEST_F(PK11GetCertsMatchingPrivateKeyTest, TestNoCertsForKey) {
       (unsigned int)kTestPrivateKeyInfoDER.size(),
   };
   SECKEYPrivateKey* priv_key = nullptr;
-  ASSERT_EQ(SECSuccess, PK11_ImportDERPrivateKeyInfoAndReturnKey(
-                            m_slot, &private_key_info, nullptr, nullptr, false,
-                            false, KU_ALL, &priv_key, nullptr));
-  ASSERT_NE(nullptr, priv_key);
+  ASSERT_EQ(PK11_ImportDERPrivateKeyInfoAndReturnKey(
+                m_slot, &private_key_info, nullptr, nullptr, false, false,
+                KU_ALL, &priv_key, nullptr),
+            SECSuccess);
+  ASSERT_NE(priv_key, nullptr);
   ScopedSECKEYPrivateKey scoped_priv_key(priv_key);
 
   char cert_nickname[] = "Test Cert With Other Key";
   SECItem cert_item = {
       siBuffer, const_cast<unsigned char*>(kTestCertWithOtherKeyDER.data()),
       (unsigned int)kTestCertWithOtherKeyDER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert_item, CK_INVALID_HANDLE,
-                               cert_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert_item, CK_INVALID_HANDLE,
+                               cert_nickname, false),
+            SECSuccess);
 
   ScopedCERTCertList certs(
       PK11_GetCertsMatchingPrivateKey(scoped_priv_key.get()));
@@ -481,8 +449,8 @@ TEST_F(PK11GetCertsMatchingPrivateKeyTest, TestNoCertsForKey) {
 void CheckCertListForSubjects(
     ScopedCERTCertList& list,
     const std::vector<const char*>& expected_subjects) {
-  ASSERT_NE(nullptr, list.get());
-  ASSERT_NE(0ul, expected_subjects.size());
+  ASSERT_NE(list.get(), nullptr);
+  ASSERT_NE(expected_subjects.size(), 0ul);
   for (const auto& expected_subject : expected_subjects) {
     size_t list_length = 0;
     bool found = false;
@@ -495,7 +463,7 @@ void CheckCertListForSubjects(
       }
     }
     ASSERT_TRUE(found);
-    ASSERT_EQ(expected_subjects.size(), list_length);
+    ASSERT_EQ(list_length, expected_subjects.size());
   }
 }
 
@@ -506,27 +474,28 @@ TEST_F(PK11GetCertsMatchingPrivateKeyTest, TestOneCertForKey) {
       (unsigned int)kTestPrivateKeyInfoDER.size(),
   };
   SECKEYPrivateKey* priv_key = nullptr;
-  ASSERT_EQ(SECSuccess, PK11_ImportDERPrivateKeyInfoAndReturnKey(
-                            m_slot, &private_key_info, nullptr, nullptr, false,
-                            false, KU_ALL, &priv_key, nullptr));
-  ASSERT_NE(nullptr, priv_key);
+  ASSERT_EQ(PK11_ImportDERPrivateKeyInfoAndReturnKey(
+                m_slot, &private_key_info, nullptr, nullptr, false, false,
+                KU_ALL, &priv_key, nullptr),
+            SECSuccess);
+  ASSERT_NE(priv_key, nullptr);
   ScopedSECKEYPrivateKey scoped_priv_key(priv_key);
 
   char cert1_nickname[] = "Test Cert 1";
   SECItem cert1_item = {siBuffer,
                         const_cast<unsigned char*>(kTestCert1DER.data()),
                         (unsigned int)kTestCert1DER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert1_item, CK_INVALID_HANDLE,
-                               cert1_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert1_item, CK_INVALID_HANDLE,
+                               cert1_nickname, false),
+            SECSuccess);
 
   char cert_nickname[] = "Test Cert With Other Key";
   SECItem cert_item = {
       siBuffer, const_cast<unsigned char*>(kTestCertWithOtherKeyDER.data()),
       (unsigned int)kTestCertWithOtherKeyDER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert_item, CK_INVALID_HANDLE,
-                               cert_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert_item, CK_INVALID_HANDLE,
+                               cert_nickname, false),
+            SECSuccess);
 
   ScopedCERTCertList certs(
       PK11_GetCertsMatchingPrivateKey(scoped_priv_key.get()));
@@ -540,87 +509,39 @@ TEST_F(PK11GetCertsMatchingPrivateKeyTest, TestTwoCertsForKey) {
       (unsigned int)kTestPrivateKeyInfoDER.size(),
   };
   SECKEYPrivateKey* priv_key = nullptr;
-  ASSERT_EQ(SECSuccess, PK11_ImportDERPrivateKeyInfoAndReturnKey(
-                            m_slot, &private_key_info, nullptr, nullptr, false,
-                            false, KU_ALL, &priv_key, nullptr));
-  ASSERT_NE(nullptr, priv_key);
+  ASSERT_EQ(PK11_ImportDERPrivateKeyInfoAndReturnKey(
+                m_slot, &private_key_info, nullptr, nullptr, false, false,
+                KU_ALL, &priv_key, nullptr),
+            SECSuccess);
+  ASSERT_NE(priv_key, nullptr);
   ScopedSECKEYPrivateKey scoped_priv_key(priv_key);
 
   char cert1_nickname[] = "Test Cert 1";
   SECItem cert1_item = {siBuffer,
                         const_cast<unsigned char*>(kTestCert1DER.data()),
                         (unsigned int)kTestCert1DER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert1_item, CK_INVALID_HANDLE,
-                               cert1_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert1_item, CK_INVALID_HANDLE,
+                               cert1_nickname, false),
+            SECSuccess);
   char cert2_nickname[] = "Test Cert 2 (same key, different subject)";
   SECItem cert2_item = {
       siBuffer, const_cast<unsigned char*>(kUnrelatedTestCertDER.data()),
       (unsigned int)kUnrelatedTestCertDER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert2_item, CK_INVALID_HANDLE,
-                               cert2_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert2_item, CK_INVALID_HANDLE,
+                               cert2_nickname, false),
+            SECSuccess);
 
   char cert_nickname[] = "Test Cert With Other Key";
   SECItem cert_item = {
       siBuffer, const_cast<unsigned char*>(kTestCertWithOtherKeyDER.data()),
       (unsigned int)kTestCertWithOtherKeyDER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert_item, CK_INVALID_HANDLE,
-                               cert_nickname, false));
+  ASSERT_EQ(PK11_ImportDERCert(m_slot, &cert_item, CK_INVALID_HANDLE,
+                               cert_nickname, false),
+            SECSuccess);
 
   ScopedCERTCertList certs(
       PK11_GetCertsMatchingPrivateKey(scoped_priv_key.get()));
   CheckCertListForSubjects(certs, {"CN=test cert", "CN=unrelated subject DN"});
 }
 
-class PK11FindEncodedCertInSlotTest : public PK11FindCertsTestBase {};
-
-TEST_F(PK11FindEncodedCertInSlotTest, TestFindEncodedCert) {
-  char cert_nickname[] = "Test Cert";
-  SECItem cert_item = {siBuffer,
-                       const_cast<unsigned char*>(kTestCert1DER.data()),
-                       (unsigned int)kTestCert1DER.size()};
-  ASSERT_EQ(SECSuccess,
-            PK11_ImportDERCert(m_slot, &cert_item, CK_INVALID_HANDLE,
-                               cert_nickname, false));
-
-  // This certificate was just imported, so finding it by its encoded value
-  // should succeed.
-  CK_OBJECT_HANDLE cert_handle_in_slot =
-      PK11_FindEncodedCertInSlot(m_slot, &cert_item, nullptr);
-  // CK_INVALID_HANDLE is #defined to be the literal 0, which the compiler
-  // interprets as a signed value, which then causes a warning-as-an-error
-  // about comparing values of different signs.
-  ASSERT_NE(static_cast<CK_ULONG>(CK_INVALID_HANDLE), cert_handle_in_slot);
-
-  // The certificate should not exist on the internal slot, so this should
-  // return CK_INVALID_HANDLE.
-  ScopedPK11SlotInfo internal_slot(PK11_GetInternalSlot());
-  ASSERT_NE(nullptr, internal_slot);
-  CK_OBJECT_HANDLE cert_handle_in_internal_slot =
-      PK11_FindEncodedCertInSlot(internal_slot.get(), &cert_item, nullptr);
-  ASSERT_EQ(static_cast<CK_ULONG>(CK_INVALID_HANDLE),
-            cert_handle_in_internal_slot);
-
-  // The certificate should not exist on the internal key slot, so this should
-  // return CK_INVALID_HANDLE.
-  ScopedPK11SlotInfo internal_key_slot(PK11_GetInternalKeySlot());
-  ASSERT_NE(nullptr, internal_key_slot);
-  CK_OBJECT_HANDLE cert_handle_in_internal_key_slot =
-      PK11_FindEncodedCertInSlot(internal_key_slot.get(), &cert_item, nullptr);
-  ASSERT_EQ(static_cast<CK_ULONG>(CK_INVALID_HANDLE),
-            cert_handle_in_internal_key_slot);
-
-  // This certificate hasn't been imported to any token, so looking for it
-  // should return CK_INVALID_HANDLE.
-  SECItem unknown_cert_item = {siBuffer,
-                               const_cast<unsigned char*>(kTestCert2DER.data()),
-                               (unsigned int)kTestCert2DER.size()};
-  CK_OBJECT_HANDLE unknown_cert_handle_in_slot =
-      PK11_FindEncodedCertInSlot(m_slot, &unknown_cert_item, nullptr);
-  ASSERT_EQ(static_cast<CK_ULONG>(CK_INVALID_HANDLE),
-            unknown_cert_handle_in_slot);
-}
-
 }  // namespace nss_test