[NSS] ported mozilla upstream changes:

- Bug 1552254 internal_error alert on Certificate Request with sha1+ecdsa in TLS 1.3 (be6a9782)
- Bug 1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate. r=rrelyea (800111fa)
- Bug 1756271 - Remove token member from NSSSlot struct. r=rrelyea (55052f78)
- Bug 1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun. r=nss-reviewers,jschanck (2f2c8564)
- Bug 1755264 - TLS 1.3 Illegal legacy_version handling/alerts. r=djackson (7d931c59)
- Bug 1751305 - Remove expired explicitly distrusted certificates from certdata.txt. r=KathleenWilson (b722e523)
- Bug 1751298 - Add Telia Root CA v2 root certificate. r=KathleenWilson (1fcbbd7e)
- Bug 1754890 - Add two D-TRUST 2020 root certificates. r=KathleenWilson (f63fb86d)

security/nss/lib/certdb/certdb.c

@@ -2552,6 +2552,10 @@ CERT_DestroyCertList(CERTCertList *certs)
 {
     PRCList *node;
 
+    if (!certs) {
+        return;
+    }
+
     while (!PR_CLIST_IS_EMPTY(&certs->list)) {
         node = PR_LIST_HEAD(&certs->list);
         CERT_DestroyCertificate(((CERTCertListNode *)node)->cert);
@@ -2866,6 +2870,86 @@ CERT_FilterCertListForUserCerts(CERTCertList *certList)
     return (SECSuccess);
 }
 
+/* return true if cert is in the list */
+PRBool
+CERT_IsInList(const CERTCertificate *cert, const CERTCertList *certList)
+{
+    CERTCertListNode *node;
+    for (node = CERT_LIST_HEAD(certList); !CERT_LIST_END(node, certList);
+         node = CERT_LIST_NEXT(node)) {
+        if (node->cert == cert) {
+            return PR_TRUE;
+        }
+    }
+    return PR_FALSE;
+}
+
+/* returned certList is the intersection of the certs on certList and the
+ * certs on filterList */
+SECStatus
+CERT_FilterCertListByCertList(CERTCertList *certList,
+                              const CERTCertList *filterList)
+{
+    CERTCertListNode *node, *freenode;
+    CERTCertificate *cert;
+
+    if (!certList) {
+        return SECFailure;
+    }
+
+    if (!filterList || CERT_LIST_EMPTY(certList)) {
+        /* if the filterList is empty, just clear out certList and return */
+        for (node = CERT_LIST_HEAD(certList); !CERT_LIST_END(node, certList);) {
+            freenode = node;
+            node = CERT_LIST_NEXT(node);
+            CERT_RemoveCertListNode(freenode);
+        }
+        return SECSuccess;
+    }
+
+    node = CERT_LIST_HEAD(certList);
+
+    while (!CERT_LIST_END(node, certList)) {
+        cert = node->cert;
+        if (!CERT_IsInList(cert, filterList)) {
+            // no matching cert on filter list, remove it from certlist */
+            freenode = node;
+            node = CERT_LIST_NEXT(node);
+            CERT_RemoveCertListNode(freenode);
+        } else {
+            /* matching cert, keep it around */
+            node = CERT_LIST_NEXT(node);
+        }
+    }
+
+    return (SECSuccess);
+}
+
+SECStatus
+CERT_FilterCertListByNickname(CERTCertList *certList, char *nickname,
+                              void *pwarg)
+{
+    CERTCertList *nameList;
+    SECStatus rv;
+
+    if (!certList) {
+        return SECFailure;
+    }
+
+    /* we could try to match the nickname to the individual cert,
+     * but nickname parsing is quite complicated, so it's best just
+     * to use the existing code and get a list of certs that match the
+     * nickname. We can then compare that list with our input cert list
+     * and return only those certs that are on both. */
+    nameList = PK11_FindCertsFromNickname(nickname, pwarg);
+
+    /* namelist could be NULL, this will force certList to become empty */
+    rv = CERT_FilterCertListByCertList(certList, nameList);
+    /* CERT_DestroyCertList can now accept a NULL pointer */
+    CERT_DestroyCertList(nameList);
+    return rv;
+}
+
 static PZLock *certRefCountLock = NULL;
 
 /*