Update NSS to 3.32.1-RTM

security/nss/.gitignore

@@ -17,3 +17,5 @@ GTAGS
 .ycm_extra_conf.py*
 fuzz/libFuzzer/*
 fuzz/corpus
+fuzz/out
+.chk

security/nss/Makefile

@@ -28,6 +28,7 @@ include $(CORE_DEPTH)/coreconf/config.mk
 
 ifdef NSS_DISABLE_GTESTS
 DIRS := $(filter-out gtests,$(DIRS))
+DIRS := $(filter-out cpputil,$(DIRS))
 endif
 
 #######################################################################
@@ -96,15 +97,6 @@ NSPR_CONFIGURE_ENV := $(filter-out -arch x86_64,$(NSPR_CONFIGURE_ENV))
 NSPR_CONFIGURE_ENV := $(filter-out -arch i386,$(NSPR_CONFIGURE_ENV))
 NSPR_CONFIGURE_ENV := $(filter-out -arch ppc,$(NSPR_CONFIGURE_ENV))
 
-ifdef SANITIZER_CFLAGS
-ifdef BUILD_OPT
-NSPR_CONFIGURE_OPTS += --enable-debug-symbols
-endif
-NSPR_CONFIGURE_ENV += CFLAGS='$(SANITIZER_CFLAGS)' \
-                      CXXFLAGS='$(SANITIZER_CFLAGS)' \
-                      LDFLAGS='$(SANITIZER_LDFLAGS)'
-endif
-
 #
 # Some pwd commands on Windows (for example, the pwd
 # command in Cygwin) return a pathname that begins

security/nss/TAG-INFO

@@ -1 +1 @@
-NSS_3_28_6_RTM
+NSS_3_32_1_RTM

security/nss/automation/abi-check/previous-nss-release

@@ -0,0 +1 @@
+NSS_3_31_BRANCH

security/nss/automation/buildbot-slave/build.sh

@@ -19,6 +19,9 @@ proc_args()
             "--test-nss")
                 TEST_NSS=1
                 ;;
+            "--check-abi")
+                CHECK_ABI=1
+                ;;
             "--build-jss")
                 BUILD_JSS=1
                 ;;
@@ -40,6 +43,7 @@ proc_args()
                 echo "    --build-jss"
                 echo "    --test-nss"
                 echo "    --test-jss"
+                echo "    --check-abi"
                 exit 1
                 ;;
         esac 
@@ -215,6 +219,65 @@ test_nss()
     return ${RET}
 }
 
+check_abi()
+{
+    print_log "######## NSS ABI CHECK - ${BITS} bits - ${OPT} ########"
+    print_log "######## creating temporary HG clones ########"
+
+    rm -rf ${HGDIR}/baseline
+    mkdir ${HGDIR}/baseline
+    BASE_NSS=`cat ${HGDIR}/nss/automation/abi-check/previous-nss-release`
+    hg clone -u "${BASE_NSS}" "${HGDIR}/nss" "${HGDIR}/baseline/nss"
+    if [ $? -ne 0 ]; then
+        echo "invalid tag in automation/abi-check/previous-nss-release"
+        return 1
+    fi
+
+    BASE_NSPR=NSPR_$(head -1 ${HGDIR}/baseline/nss/automation/release/nspr-version.txt | cut -d . -f 1-2 | tr . _)_BRANCH
+    hg clone -u "${BASE_NSPR}" "${HGDIR}/nspr" "${HGDIR}/baseline/nspr"
+    if [ $? -ne 0 ]; then
+        echo "invalid tag ${BASE_NSPR} derived from ${BASE_NSS} automation/release/nspr-version.txt"
+        return 1
+    fi
+
+    print_log "######## building older NSPR/NSS ########"
+    pushd ${HGDIR}/baseline/nss
+
+    print_log "$ ${MAKE} ${NSS_BUILD_TARGET}"
+    ${MAKE} ${NSS_BUILD_TARGET} 2>&1 | tee -a ${LOG_ALL}
+    RET=$?
+    print_result "NSS - build - ${BITS} bits - ${OPT}" ${RET} 0
+    if [ ${RET} -ne 0 ]; then
+        tail -100 ${LOG_ALL}
+        return ${RET}
+    fi
+    popd
+
+    ABI_REPORT=${OUTPUTDIR}/abi-diff.txt
+    rm -f ${ABI_REPORT}
+    PREVDIST=${HGDIR}/baseline/dist
+    NEWDIST=${HGDIR}/dist
+    ALL_SOs="libfreebl3.so libfreeblpriv3.so libnspr4.so libnss3.so libnssckbi.so libnssdbm3.so libnsssysinit.so libnssutil3.so libplc4.so libplds4.so libsmime3.so libsoftokn3.so libssl3.so"
+    for SO in ${ALL_SOs}; do
+        if [ ! -f nss/automation/abi-check/expected-report-$SO.txt ]; then
+            touch nss/automation/abi-check/expected-report-$SO.txt
+        fi
+        abidiff --hd1 $PREVDIST/public/ --hd2 $NEWDIST/public \
+            $PREVDIST/*/lib/$SO $NEWDIST/*/lib/$SO \
+            > nss/automation/abi-check/new-report-$SO.txt
+        diff -u nss/automation/abi-check/expected-report-$SO.txt \
+                nss/automation/abi-check/new-report-$SO.txt >> ${ABI_REPORT}
+    done
+
+    if [ -s ${ABI_REPORT} ]; then
+        print_log "FAILED: there are new unexpected ABI changes"
+        cat ${ABI_REPORT}
+        return 1
+    fi
+
+    return 0
+}
+
 test_jss()
 {
     print_log "######## JSS - tests - ${BITS} bits - ${OPT} ########"
@@ -243,6 +306,39 @@ test_jss()
     return ${RET}
 }
 
+create_objdir_dist_link()
+{
+    # compute relevant 'dist' OBJDIR_NAME subdirectory names for JSS and NSS
+    OS_TARGET=`uname -s`
+    OS_RELEASE=`uname -r | sed 's/-.*//' | sed 's/-.*//' | cut -d . -f1,2`
+    CPU_TAG=_`uname -m`
+    # OBJDIR_NAME_COMPILER appears to be defined for NSS but not JSS
+    OBJDIR_NAME_COMPILER=_cc
+    LIBC_TAG=_glibc
+    IMPL_STRATEGY=_PTH
+    if [ "${RUN_BITS}" = "64" ]; then
+        OBJDIR_TAG=_${RUN_BITS}_${RUN_OPT}.OBJ
+    else
+        OBJDIR_TAG=_${RUN_OPT}.OBJ
+    fi
+
+    # define NSS_OBJDIR_NAME
+    NSS_OBJDIR_NAME=${OS_TARGET}${OS_RELEASE}${CPU_TAG}${OBJDIR_NAME_COMPILER}
+    NSS_OBJDIR_NAME=${NSS_OBJDIR_NAME}${LIBC_TAG}${IMPL_STRATEGY}${OBJDIR_TAG}
+    print_log "create_objdir_dist_link(): NSS_OBJDIR_NAME='${NSS_OBJDIR_NAME}'"
+
+    # define JSS_OBJDIR_NAME
+    JSS_OBJDIR_NAME=${OS_TARGET}${OS_RELEASE}${CPU_TAG}
+    JSS_OBJDIR_NAME=${JSS_OBJDIR_NAME}${LIBC_TAG}${IMPL_STRATEGY}${OBJDIR_TAG}
+    print_log "create_objdir_dist_link(): JSS_OBJDIR_NAME='${JSS_OBJDIR_NAME}'"
+
+    if [ -e "${HGDIR}/dist/${NSS_OBJDIR_NAME}" ]; then
+        SOURCE=${HGDIR}/dist/${NSS_OBJDIR_NAME}
+        TARGET=${HGDIR}/dist/${JSS_OBJDIR_NAME}
+        ln -s ${SOURCE} ${TARGET} >/dev/null 2>&1
+    fi
+}
+
 build_and_test()
 {
     if [ -n "${BUILD_NSS}" ]; then
@@ -255,7 +351,13 @@ build_and_test()
         [ $? -eq 0 ] || return 1
     fi
 
+    if [ -n "${CHECK_ABI}" ]; then
+        check_abi
+        [ $? -eq 0 ] || return 1
+    fi
+
     if [ -n "${BUILD_JSS}" ]; then
+        create_objdir_dist_link
         build_jss
         [ $? -eq 0 ] || return 1
     fi
@@ -326,6 +428,7 @@ main()
 {
     VALID=0
     RET=1
+    FAIL=0
 
     for BITS in 32 64; do
         echo ${RUN_BITS} | grep ${BITS} > /dev/null
@@ -338,7 +441,10 @@ main()
             set_env
             run_all
             RET=$?
-	    print_log "### result of run_all is ${RET}"
+            print_log "### result of run_all is ${RET}"
+            if [ ${RET} -ne 0 ]; then
+                FAIL=${RET}
+            fi
         done
     done
 
@@ -347,7 +453,7 @@ main()
         return 1
     fi
 
-    return ${RET}
+    return ${FAIL}
 }
 
 #function killallsub()
@@ -375,6 +481,8 @@ echo "tinderbox args: $0 $@"
 proc_args "$@"
 main
 
-#RET=$?
+RET=$?
+print_log "### result of main is ${RET}"
+
 #rm $IS_RUNNING_FILE
-#exit ${RET}
+exit ${RET}

security/nss/automation/clang-format/Dockerfile

@@ -0,0 +1,26 @@
+FROM ubuntu:16.04
+MAINTAINER Franziskus Kiefer <franziskuskiefer@gmail.com>
+
+RUN useradd -d /home/worker -s /bin/bash -m worker
+WORKDIR /home/worker
+
+# Install dependencies.
+ADD setup.sh /tmp/setup.sh
+RUN bash /tmp/setup.sh
+
+# Change user.
+USER worker
+
+# Env variables.
+ENV HOME /home/worker
+ENV SHELL /bin/bash
+ENV USER worker
+ENV LOGNAME worker
+ENV HOSTNAME taskcluster-worker
+ENV LANG en_US.UTF-8
+ENV LC_ALL en_US.UTF-8
+ENV HOST localhost
+ENV DOMSUF localdomain
+
+# Entrypoint.
+ENTRYPOINT ["/home/worker/nss/automation/clang-format/run_clang_format.sh"]

security/nss/automation/clang-format/run_clang_format.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+if [[ $(id -u) -eq 0 ]]; then
+    # Drop privileges by re-running this script.
+    # Note: this mangles arguments, better to avoid running scripts as root.
+    exec su worker -c "$0 $*"
+fi
+
+# Apply clang-format on the provided folder and verify that this doesn't change any file.
+# If any file differs after formatting, the script eventually exits with 1.
+# Any differences between formatted and unformatted files is printed to stdout to give a hint what's wrong.
+
+# Includes a default set of directories NOT to clang-format on.
+blacklist=(
+     "./automation" \
+     "./coreconf" \
+     "./doc" \
+     "./pkg" \
+     "./tests" \
+     "./lib/libpkix" \
+     "./lib/zlib" \
+     "./lib/sqlite" \
+     "./gtests/google_test" \
+     "./.hg" \
+     "./out" \
+)
+
+top="$(dirname $0)/../.."
+cd "$top"
+
+if [ $# -gt 0 ]; then
+    dirs=("$@")
+else
+    dirs=($(find . -maxdepth 2 -mindepth 1 -type d ! -path . \( ! -regex '.*/' \)))
+fi
+
+format_folder()
+{
+    for black in "${blacklist[@]}"; do
+        if [[ "$1" == "$black"* ]]; then
+            echo "skip $1"
+            return 1
+        fi
+    done
+    return 0
+}
+
+for dir in "${dirs[@]}"; do
+    if format_folder "$dir" ; then
+        c="${dir//[^\/]}"
+        echo "formatting $dir ..."
+        depth=""
+        if [ "${#c}" == "1" ]; then
+            depth="-maxdepth 1"
+        fi
+        find "$dir" $depth -type f \( -name '*.[ch]' -o -name '*.cc' \) -exec clang-format -i {} \+
+    fi
+done
+
+TMPFILE=$(mktemp /tmp/$(basename $0).XXXXXX)
+trap 'rm $TMPFILE' exit
+if (cd $(dirname $0); hg root >/dev/null 2>&1); then
+    hg diff --git "$top" | tee $TMPFILE
+else
+    git -C "$top" diff | tee $TMPFILE
+fi
+[[ ! -s $TMPFILE ]]

security/nss/automation/clang-format/setup.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+# Update packages.
+export DEBIAN_FRONTEND=noninteractive
+apt-get -y update && apt-get -y upgrade
+
+# Install packages.
+apt_packages=()
+apt_packages+=('ca-certificates')
+apt_packages+=('curl')
+apt_packages+=('xz-utils')
+apt_packages+=('mercurial')
+apt_packages+=('git')
+apt_packages+=('locales')
+apt-get install -y --no-install-recommends ${apt_packages[@]}
+
+# Download clang.
+curl -L http://releases.llvm.org/3.9.1/clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz -o clang.tar.xz
+curl -L http://releases.llvm.org/3.9.1/clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz.sig -o clang.tar.xz.sig
+# Verify the signature.
+gpg --keyserver pool.sks-keyservers.net --recv-keys B6C8F98282B944E3B0D5C2530FC3042E345AD05D
+gpg --verify clang.tar.xz.sig
+# Install into /usr/local/.
+tar xJvf *.tar.xz -C /usr/local --strip-components=1
+
+# Cleanup.
+function cleanup() {
+  rm -f clang.tar.xz clang.tar.xz.sig
+}
+trap cleanup ERR EXIT
+
+locale-gen en_US.UTF-8
+dpkg-reconfigure locales
+
+# Cleanup.
+rm -rf ~/.ccache ~/.cache
+apt-get autoremove -y
+apt-get clean
+apt-get autoclean
+
+# We're done. Remove this script.
+rm $0

security/nss/automation/ossfuzz/build.sh

@@ -0,0 +1,57 @@
+#!/bin/bash -eu
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+################################################################################
+
+# List of targets disabled for oss-fuzz.
+declare -A disabled=([pkcs8]=1)
+
+# List of targets we want to fuzz in TLS and non-TLS mode.
+declare -A tls_targets=([tls-client]=1 [tls-server]=1 [dtls-client]=1 [dtls-server]=1)
+
+# Helper function that copies a fuzzer binary and its seed corpus.
+copy_fuzzer()
+{
+    local fuzzer=$1
+    local name=$2
+
+    # Copy the binary.
+    cp ../dist/Debug/bin/$fuzzer $OUT/$name
+
+    # Zip and copy the corpus, if any.
+    if [ -d "$SRC/nss-corpus/$name" ]; then
+        zip $OUT/${name}_seed_corpus.zip $SRC/nss-corpus/$name/*
+    else
+        zip $OUT/${name}_seed_corpus.zip $SRC/nss-corpus/*/*
+    fi
+}
+
+# Copy libFuzzer options
+cp fuzz/options/*.options $OUT/
+
+# Build the library (non-TLS fuzzing mode).
+CXX="$CXX -stdlib=libc++" LDFLAGS="$CFLAGS" \
+    ./build.sh -c -v --fuzz=oss --fuzz --disable-tests
+
+# Copy fuzzing targets.
+for fuzzer in $(find ../dist/Debug/bin -name "nssfuzz-*" -printf "%f\n"); do
+    name=${fuzzer:8}
+    if [ -z "${disabled[$name]:-}" ]; then
+        [ -n "${tls_targets[$name]:-}" ] && name="${name}-no_fuzzer_mode"
+        copy_fuzzer $fuzzer $name
+    fi
+done
+
+# Build the library again (TLS fuzzing mode).
+CXX="$CXX -stdlib=libc++" LDFLAGS="$CFLAGS" \
+    ./build.sh -c -v --fuzz=oss --fuzz=tls --disable-tests
+
+# Copy dual mode targets in TLS mode.
+for name in "${!tls_targets[@]}"; do
+    if [ -z "${disabled[$name]:-}" ]; then
+        copy_fuzzer nssfuzz-$name $name
+    fi
+done

security/nss/automation/release/nspr-version.txt

@@ -1,4 +1,4 @@
-4.13.1
+4.16
 
 # The first line of this file must contain the human readable NSPR
 # version number, which is the minimum required version of NSPR

security/nss/automation/release/nss-release-helper.py

@@ -10,11 +10,27 @@ import shutil
 import glob
 from optparse import OptionParser
 from subprocess import check_call
+from subprocess import check_output
 
 nssutil_h = "lib/util/nssutil.h"
 softkver_h = "lib/softoken/softkver.h"
 nss_h = "lib/nss/nss.h"
 nssckbi_h = "lib/ckfw/builtins/nssckbi.h"
+abi_base_version_file = "automation/abi-check/previous-nss-release"
+
+abi_report_files = ['automation/abi-check/expected-report-libfreebl3.so.txt',
+                    'automation/abi-check/expected-report-libfreeblpriv3.so.txt',
+                    'automation/abi-check/expected-report-libnspr4.so.txt',
+                    'automation/abi-check/expected-report-libnss3.so.txt',
+                    'automation/abi-check/expected-report-libnssckbi.so.txt',
+                    'automation/abi-check/expected-report-libnssdbm3.so.txt',
+                    'automation/abi-check/expected-report-libnsssysinit.so.txt',
+                    'automation/abi-check/expected-report-libnssutil3.so.txt',
+                    'automation/abi-check/expected-report-libplc4.so.txt',
+                    'automation/abi-check/expected-report-libplds4.so.txt',
+                    'automation/abi-check/expected-report-libsmime3.so.txt',
+                    'automation/abi-check/expected-report-libsoftokn3.so.txt',
+                    'automation/abi-check/expected-report-libssl3.so.txt']
 
 def check_call_noisy(cmd, *args, **kwargs):
     print "Executing command:", cmd
@@ -132,6 +148,26 @@ def set_root_ca_version():
     sed_inplace('s/^\(#define *NSS_BUILTINS_LIBRARY_VERSION_MINOR *\).*$/\\1' + minor + '/', nssckbi_h)
 
 def set_all_lib_versions(version, major, minor, patch, build):
+    grep_major = check_output(['grep', 'define.*NSS_VMAJOR', nss_h])
+    grep_minor = check_output(['grep', 'define.*NSS_VMINOR', nss_h])
+
+    old_major = int(grep_major.split()[2]);
+    old_minor = int(grep_minor.split()[2]);
+
+    new_major = int(major)
+    new_minor = int(minor)
+
+    if (old_major < new_major or (old_major == new_major and old_minor < new_minor)):
+        print "You're increasing the minor (or major) version:"
+        print "- erasing ABI comparison expectations"
+        new_branch = "NSS_" + str(old_major) + "_" + str(old_minor) + "_BRANCH"
+        print "- setting reference branch to the branch of the previous version: " + new_branch
+        with open(abi_base_version_file, "w") as abi_base:
+            abi_base.write("%s\n" % new_branch)
+        for report_file in abi_report_files:
+            with open(report_file, "w") as report_file_handle:
+                report_file_handle.truncate()
+
     set_full_lib_versions(version)
     set_major_versions(major)
     set_minor_versions(minor)

security/nss/automation/taskcluster/docker-aarch64/Dockerfile

@@ -0,0 +1,30 @@
+FROM franziskus/xenial:aarch64
+MAINTAINER Franziskus Kiefer <franziskuskiefer@gmail.com>
+
+RUN useradd -d /home/worker -s /bin/bash -m worker
+WORKDIR /home/worker
+
+# Add build and test scripts.
+ADD bin /home/worker/bin
+RUN chmod +x /home/worker/bin/*
+
+# Install dependencies.
+ADD setup.sh /tmp/setup.sh
+RUN bash /tmp/setup.sh
+
+# Change user.
+# USER worker # See bug 1347473.
+
+# Env variables.
+ENV HOME /home/worker
+ENV SHELL /bin/bash
+ENV USER worker
+ENV LOGNAME worker
+ENV HOSTNAME taskcluster-worker
+ENV LANG en_US.UTF-8
+ENV LC_ALL en_US.UTF-8
+ENV HOST localhost
+ENV DOMSUF localdomain
+
+# Set a default command for debugging.
+CMD ["/bin/bash", "--login"]

security/nss/automation/taskcluster/docker-aarch64/bin/checkout.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+if [ $(id -u) = 0 ]; then
+    # Drop privileges by re-running this script.
+    exec su worker $0
+fi
+
+# Default values for testing.
+REVISION=${NSS_HEAD_REVISION:-default}
+REPOSITORY=${NSS_HEAD_REPOSITORY:-https://hg.mozilla.org/projects/nss}
+
+# Clone NSS.
+for i in 0 2 5; do
+    sleep $i
+    hg clone -r $REVISION $REPOSITORY nss && exit 0
+    rm -rf nss
+done
+exit 1

security/nss/automation/taskcluster/docker-aarch64/setup.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+export DEBIAN_FRONTEND=noninteractive
+
+apt-get -y update
+apt-get -y install software-properties-common
+
+# Add more repos
+add-apt-repository "deb http://ports.ubuntu.com/ xenial main restricted universe multiverse"
+add-apt-repository "deb http://ports.ubuntu.com/ xenial-security main restricted universe multiverse"
+add-apt-repository "deb http://ports.ubuntu.com/ xenial-updates main restricted universe multiverse"
+add-apt-repository "deb http://ports.ubuntu.com/ xenial-backports main restricted universe multiverse"
+
+# Update.
+apt-get -y update
+apt-get -y dist-upgrade
+
+apt_packages=()
+apt_packages+=('build-essential')
+apt_packages+=('ca-certificates')
+apt_packages+=('curl')
+apt_packages+=('libxml2-utils')
+apt_packages+=('zlib1g-dev')
+apt_packages+=('ninja-build')
+apt_packages+=('gyp')
+apt_packages+=('mercurial')
+apt_packages+=('locales')
+
+# Install packages.
+apt-get install -y --no-install-recommends ${apt_packages[@]}
+
+locale-gen en_US.UTF-8
+dpkg-reconfigure locales
+
+# Cleanup.
+rm -rf ~/.ccache ~/.cache
+apt-get autoremove -y
+apt-get clean
+apt-get autoclean
+rm $0

security/nss/automation/taskcluster/docker-arm/setup.sh

@@ -12,6 +12,7 @@ apt_packages=()
 apt_packages+=('build-essential')
 apt_packages+=('ca-certificates')
 apt_packages+=('curl')
+apt_packages+=('locales')
 apt_packages+=('python-dev')
 apt_packages+=('python-pip')
 apt_packages+=('python-setuptools')

security/nss/automation/taskcluster/docker-clang-3.9/Dockerfile

@@ -0,0 +1,30 @@
+FROM ubuntu:16.04
+MAINTAINER Tim Taubert <ttaubert@mozilla.com>
+
+RUN useradd -d /home/worker -s /bin/bash -m worker
+WORKDIR /home/worker
+
+# Add build and test scripts.
+ADD bin /home/worker/bin
+RUN chmod +x /home/worker/bin/*
+
+# Install dependencies.
+ADD setup.sh /tmp/setup.sh
+RUN bash /tmp/setup.sh
+
+# Change user.
+USER worker
+
+# Env variables.
+ENV HOME /home/worker
+ENV SHELL /bin/bash
+ENV USER worker
+ENV LOGNAME worker
+ENV HOSTNAME taskcluster-worker
+ENV LANG en_US.UTF-8
+ENV LC_ALL en_US.UTF-8
+ENV HOST localhost
+ENV DOMSUF localdomain
+
+# Set a default command for debugging.
+CMD ["/bin/bash", "--login"]

security/nss/automation/taskcluster/docker-clang-3.9/bin/checkout.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+if [ $(id -u) = 0 ]; then
+    # Drop privileges by re-running this script.
+    exec su worker $0
+fi
+
+# Default values for testing.
+REVISION=${NSS_HEAD_REVISION:-default}
+REPOSITORY=${NSS_HEAD_REPOSITORY:-https://hg.mozilla.org/projects/nss}
+
+# Clone NSS.
+for i in 0 2 5; do
+    sleep $i
+    hg clone -r $REVISION $REPOSITORY nss && exit 0
+    rm -rf nss
+done
+exit 1

security/nss/automation/taskcluster/docker-clang-3.9/setup.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+# Update packages.
+export DEBIAN_FRONTEND=noninteractive
+apt-get -y update && apt-get -y upgrade
+
+# Need this to add keys for PPAs below.
+apt-get install -y --no-install-recommends apt-utils
+
+apt_packages=()
+apt_packages+=('ca-certificates')
+apt_packages+=('curl')
+apt_packages+=('locales')
+apt_packages+=('xz-utils')
+
+# Latest Mercurial.
+apt_packages+=('mercurial')
+apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 41BD8711B1F0EC2B0D85B91CF59CE3A8323293EE
+echo "deb http://ppa.launchpad.net/mercurial-ppa/releases/ubuntu xenial main" > /etc/apt/sources.list.d/mercurial.list
+
+# Install packages.
+apt-get -y update
+apt-get install -y --no-install-recommends ${apt_packages[@]}
+
+# Download clang.
+curl -LO http://releases.llvm.org/3.9.1/clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz
+curl -LO http://releases.llvm.org/3.9.1/clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz.sig
+# Verify the signature.
+gpg --keyserver pool.sks-keyservers.net --recv-keys B6C8F98282B944E3B0D5C2530FC3042E345AD05D
+gpg --verify *.tar.xz.sig
+# Install into /usr/local/.
+tar xJvf *.tar.xz -C /usr/local --strip-components=1
+# Cleanup.
+rm *.tar.xz*
+
+locale-gen en_US.UTF-8
+dpkg-reconfigure locales
+
+# Cleanup.
+rm -rf ~/.ccache ~/.cache
+apt-get autoremove -y
+apt-get clean
+apt-get autoclean
+rm $0

security/nss/automation/taskcluster/docker-decision/setup.sh

@@ -7,7 +7,7 @@ export DEBIAN_FRONTEND=noninteractive
 apt-get -y update && apt-get -y upgrade
 
 # Need those to install newer packages below.
-apt-get install -y --no-install-recommends apt-utils curl ca-certificates
+apt-get install -y --no-install-recommends apt-utils curl ca-certificates locales
 
 # Latest Mercurial.
 apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 41BD8711B1F0EC2B0D85B91CF59CE3A8323293EE

security/nss/automation/taskcluster/docker-fuzz/Dockerfile

@@ -0,0 +1,33 @@
+FROM ubuntu:16.04
+MAINTAINER Tim Taubert <ttaubert@mozilla.com>
+
+RUN useradd -d /home/worker -s /bin/bash -m worker
+WORKDIR /home/worker
+
+# Add build and test scripts.
+ADD bin /home/worker/bin
+RUN chmod +x /home/worker/bin/*
+
+# Install dependencies.
+ADD setup.sh /tmp/setup.sh
+RUN bash /tmp/setup.sh
+
+# Change user.
+USER worker
+
+# Env variables.
+ENV HOME /home/worker
+ENV SHELL /bin/bash
+ENV USER worker
+ENV LOGNAME worker
+ENV HOSTNAME taskcluster-worker
+ENV LANG en_US.UTF-8
+ENV LC_ALL en_US.UTF-8
+ENV HOST localhost
+ENV DOMSUF localdomain
+
+# LLVM 4.0
+ENV PATH "${PATH}:/home/worker/third_party/llvm-build/Release+Asserts/bin/"
+
+# Set a default command for debugging.
+CMD ["/bin/bash", "--login"]

security/nss/automation/taskcluster/docker-fuzz/bin/checkout.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+if [ $(id -u) = 0 ]; then
+    # Drop privileges by re-running this script.
+    exec su worker $0
+fi
+
+# Default values for testing.
+REVISION=${NSS_HEAD_REVISION:-default}
+REPOSITORY=${NSS_HEAD_REPOSITORY:-https://hg.mozilla.org/projects/nss}
+
+# Clone NSS.
+for i in 0 2 5; do
+    sleep $i
+    hg clone -r $REVISION $REPOSITORY nss && exit 0
+    rm -rf nss
+done
+exit 1

security/nss/automation/taskcluster/docker-fuzz/setup.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+# Update packages.
+export DEBIAN_FRONTEND=noninteractive
+apt-get -y update && apt-get -y upgrade
+
+# Need this to add keys for PPAs below.
+apt-get install -y --no-install-recommends apt-utils
+
+apt_packages=()
+apt_packages+=('build-essential')
+apt_packages+=('ca-certificates')
+apt_packages+=('curl')
+apt_packages+=('git')
+apt_packages+=('gyp')
+apt_packages+=('libssl-dev')
+apt_packages+=('libxml2-utils')
+apt_packages+=('locales')
+apt_packages+=('ninja-build')
+apt_packages+=('pkg-config')
+apt_packages+=('zlib1g-dev')
+
+# 32-bit builds
+apt_packages+=('gcc-multilib')
+apt_packages+=('g++-multilib')
+
+# Latest Mercurial.
+apt_packages+=('mercurial')
+apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 41BD8711B1F0EC2B0D85B91CF59CE3A8323293EE
+echo "deb http://ppa.launchpad.net/mercurial-ppa/releases/ubuntu xenial main" > /etc/apt/sources.list.d/mercurial.list
+
+# Install packages.
+apt-get -y update
+apt-get install -y --no-install-recommends ${apt_packages[@]}
+
+# 32-bit builds
+dpkg --add-architecture i386
+apt-get -y update
+apt-get install -y --no-install-recommends libssl-dev:i386
+
+# Install LLVM/clang-4.0.
+mkdir clang-tmp
+git clone -n --depth 1 https://chromium.googlesource.com/chromium/src/tools/clang clang-tmp/clang
+git -C clang-tmp/clang checkout HEAD scripts/update.py
+clang-tmp/clang/scripts/update.py
+rm -fr clang-tmp
+
+locale-gen en_US.UTF-8
+dpkg-reconfigure locales
+
+# Cleanup.
+rm -rf ~/.ccache ~/.cache
+apt-get autoremove -y
+apt-get clean
+apt-get autoclean
+rm $0

security/nss/automation/taskcluster/docker/Dockerfile

@@ -12,6 +12,9 @@ RUN chmod +x /home/worker/bin/*
 ADD setup.sh /tmp/setup.sh
 RUN bash /tmp/setup.sh
 
+# Change user.
+USER worker
+
 # Env variables.
 ENV HOME /home/worker
 ENV SHELL /bin/bash
@@ -23,5 +26,8 @@ ENV LC_ALL en_US.UTF-8
 ENV HOST localhost
 ENV DOMSUF localdomain
 
+# Rust + Go
+ENV PATH "${PATH}:/home/worker/.cargo/bin/:/usr/lib/go-1.6/bin"
+
 # Set a default command for debugging.
 CMD ["/bin/bash", "--login"]

security/nss/automation/taskcluster/docker/setup.sh

@@ -16,6 +16,8 @@ apt_packages+=('curl')
 apt_packages+=('npm')
 apt_packages+=('git')
 apt_packages+=('golang-1.6')
+apt_packages+=('libxml2-utils')
+apt_packages+=('locales')
 apt_packages+=('ninja-build')
 apt_packages+=('pkg-config')
 apt_packages+=('zlib1g-dev')
@@ -45,11 +47,19 @@ echo "deb http://ppa.launchpad.net/ubuntu-toolchain-r/test/ubuntu xenial main" >
 apt-get -y update
 apt-get install -y --no-install-recommends ${apt_packages[@]}
 
-# 32-bit builds
+# Download clang.
-ln -s /usr/include/x86_64-linux-gnu/zconf.h /usr/include
+curl -LO http://releases.llvm.org/4.0.0/clang+llvm-4.0.0-x86_64-linux-gnu-ubuntu-16.04.tar.xz
+curl -LO http://releases.llvm.org/4.0.0/clang+llvm-4.0.0-x86_64-linux-gnu-ubuntu-16.04.tar.xz.sig
+# Verify the signature.
+gpg --keyserver pool.sks-keyservers.net --recv-keys B6C8F98282B944E3B0D5C2530FC3042E345AD05D
+gpg --verify *.tar.xz.sig
+# Install into /usr/local/.
+tar xJvf *.tar.xz -C /usr/local --strip-components=1
+# Cleanup.
+rm *.tar.xz*
 
-# Install clang-3.9 into /usr/local/.
+# Install latest Rust (stable).
-curl -L http://llvm.org/releases/3.9.0/clang+llvm-3.9.0-x86_64-linux-gnu-ubuntu-16.04.tar.xz | tar xJv -C /usr/local --strip-components=1
+su worker -c "curl https://sh.rustup.rs -sSf | sh -s -- -y"
 
 locale-gen en_US.UTF-8
 dpkg-reconfigure locales

security/nss/automation/taskcluster/graph/src/extend.js

@@ -5,7 +5,20 @@
 import merge from "./merge";
 import * as queue from "./queue";
 
-const LINUX_IMAGE = {name: "linux", path: "automation/taskcluster/docker"};
+const LINUX_IMAGE = {
+  name: "linux",
+  path: "automation/taskcluster/docker"
+};
+
+const LINUX_CLANG39_IMAGE = {
+  name: "linux-clang-3.9",
+  path: "automation/taskcluster/docker-clang-3.9"
+};
+
+const FUZZ_IMAGE = {
+  name: "fuzz",
+  path: "automation/taskcluster/docker-fuzz"
+};
 
 const WINDOWS_CHECKOUT_CMD =
   "bash -c \"hg clone -r $NSS_HEAD_REVISION $NSS_HEAD_REPOSITORY nss || " +
@@ -17,33 +30,45 @@ const WINDOWS_CHECKOUT_CMD =
 queue.filter(task => {
   if (task.group == "Builds") {
     // Remove extra builds on {A,UB}San and ARM.
-    if (task.collection == "asan" || task.collection == "arm-debug" ||
+    if (task.collection == "asan" || task.platform == "aarch64") {
-        task.collection == "gyp-asan") {
       return false;
     }
 
-    // Remove extra builds w/o libpkix for non-linux64-debug.
+    // Make modular builds only on Linux make.
-    if (task.symbol == "noLibpkix" &&
+    if (task.symbol == "modular" && task.collection != "make") {
-        (task.platform != "linux64" || task.collection != "debug")) {
       return false;
     }
   }
 
-  if (task.tests == "bogo") {
+  if (task.tests == "bogo" || task.tests == "interop") {
-    // No BoGo tests on Windows.
+    // No windows
-    if (task.platform == "windows2012-64") {
+    if (task.platform == "windows2012-64" ||
+        task.platform == "windows2012-32") {
       return false;
     }
 
-    // No BoGo tests on ARM.
+    // No ARM; TODO: enable
-    if (task.collection == "arm-debug") {
+    if (task.platform == "aarch64") {
       return false;
     }
   }
 
-  // GYP builds with -Ddisable_libpkix=1 by default.
+  // Only old make builds have -Ddisable_libpkix=0 and can run chain tests.
-  if ((task.collection == "gyp" || task.collection == "gyp-asan") &&
+  if (task.tests == "chains" && task.collection != "make") {
-      task.tests == "chains") {
+    return false;
+  }
+
+  if (task.group == "Test") {
+    // Don't run test builds on old make platforms
+    if (task.collection == "make") {
+      return false;
+    }
+  }
+
+  // Don't run additional hardware tests on ARM (we don't have anything there).
+  if (task.group == "Cipher" && task.platform == "aarch64" && task.env &&
+      (task.env.NSS_DISABLE_PCLMUL == "1" || task.env.NSS_DISABLE_HW_AES == "1"
+       || task.env.NSS_DISABLE_AVX == "1")) {
     return false;
   }
 
@@ -51,29 +76,18 @@ queue.filter(task => {
 });
 
 queue.map(task => {
-  if (task.collection == "asan" || task.collection == "gyp-asan") {
+  if (task.collection == "asan") {
     // CRMF and FIPS tests still leak, unfortunately.
     if (task.tests == "crmf" || task.tests == "fips") {
       task.env.ASAN_OPTIONS = "detect_leaks=0";
     }
   }
 
-  if (task.collection == "arm-debug") {
-    // These tests take quite some time on our poor ARM devices.
-    if (task.tests == "chains" || (task.tests == "ssl" && task.cycle == "standard")) {
-      task.maxRunTime = 14400;
-    }
-  }
-
   // Windows is slow.
   if (task.platform == "windows2012-64" && task.tests == "chains") {
     task.maxRunTime = 7200;
   }
 
-  // Enable TLS 1.3 for every task.
-  task.env = task.env || {};
-  task.env.NSS_ENABLE_TLS_1_3 = "1";
-
   return task;
 });
 
@@ -81,58 +95,48 @@ queue.map(task => {
 
 export default async function main() {
   await scheduleLinux("Linux 32 (opt)", {
-    env: {BUILD_OPT: "1"},
     platform: "linux32",
     image: LINUX_IMAGE
-  });
+  }, "-m32 --opt");
 
   await scheduleLinux("Linux 32 (debug)", {
     platform: "linux32",
     collection: "debug",
     image: LINUX_IMAGE
-  });
+  }, "-m32");
 
   await scheduleLinux("Linux 64 (opt)", {
-    env: {USE_64: "1", BUILD_OPT: "1"},
     platform: "linux64",
     image: LINUX_IMAGE
-  });
+  }, "--opt");
 
   await scheduleLinux("Linux 64 (debug)", {
-    env: {USE_64: "1"},
     platform: "linux64",
     collection: "debug",
     image: LINUX_IMAGE
   });
 
-  await scheduleLinux("Linux 64 (debug, gyp)", {
+  await scheduleLinux("Linux 64 (debug, make)", {
-    command: [
+    env: {USE_64: "1"},
-      "/bin/bash",
-      "-c",
-      "bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh"
-    ],
     platform: "linux64",
-    collection: "gyp",
+    image: LINUX_IMAGE,
-    image: LINUX_IMAGE
+    collection: "make",
+    command: [
+       "/bin/bash",
+       "-c",
+       "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
+    ],
   });
 
-  await scheduleLinux("Linux 64 (debug, gyp, asan, ubsan)", {
+  await scheduleLinux("Linux 32 (debug, make)", {
+    platform: "linux32",
+    image: LINUX_IMAGE,
+    collection: "make",
     command: [
-      "/bin/bash",
+       "/bin/bash",
-      "-c",
+       "-c",
-      "bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh -g -v --ubsan --asan"
+       "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
     ],
-    env: {
-      ASAN_OPTIONS: "detect_odr_violation=0", // bug 1316276
-      UBSAN_OPTIONS: "print_stacktrace=1",
-      NSS_DISABLE_ARENA_FREE_LIST: "1",
-      NSS_DISABLE_UNLOAD: "1",
-      CC: "clang",
-      CCC: "clang++"
-    },
-    platform: "linux64",
-    collection: "gyp-asan",
-    image: LINUX_IMAGE
   });
 
   await scheduleLinux("Linux 64 (ASan, debug)", {
@@ -142,49 +146,87 @@ export default async function main() {
       NSS_DISABLE_UNLOAD: "1",
       CC: "clang",
       CCC: "clang++",
-      USE_UBSAN: "1",
-      USE_ASAN: "1",
-      USE_64: "1"
     },
     platform: "linux64",
     collection: "asan",
-    image: LINUX_IMAGE
+    image: LINUX_IMAGE,
-  });
+    features: ["allowPtrace"],
+  }, "--ubsan --asan");
+
+  await scheduleWindows("Windows 2012 64 (debug, make)", {
+    platform: "windows2012-64",
+    collection: "make",
+    env: {USE_64: "1"}
+  }, "build.sh");
+
+  await scheduleWindows("Windows 2012 32 (debug, make)", {
+    platform: "windows2012-32",
+    collection: "make"
+  }, "build.sh");
 
   await scheduleWindows("Windows 2012 64 (opt)", {
-    env: {BUILD_OPT: "1"}
+    platform: "windows2012-64",
-  });
+  }, "build_gyp.sh --opt");
 
   await scheduleWindows("Windows 2012 64 (debug)", {
+    platform: "windows2012-64",
     collection: "debug"
-  });
+  }, "build_gyp.sh");
+
+  await scheduleWindows("Windows 2012 32 (opt)", {
+    platform: "windows2012-32",
+  }, "build_gyp.sh --opt -m32");
+
+  await scheduleWindows("Windows 2012 32 (debug)", {
+    platform: "windows2012-32",
+    collection: "debug"
+  }, "build_gyp.sh -m32");
 
   await scheduleFuzzing();
-
+  await scheduleFuzzing32();
-  await scheduleTestBuilds();
 
   await scheduleTools();
 
-  await scheduleLinux("Linux 32 (ARM, debug)", {
+  let aarch64_base = {
-    image: "franziskus/nss-arm-ci",
+    image: "franziskus/nss-aarch64-ci",
     provisioner: "localprovisioner",
-    collection: "arm-debug",
+    workerType: "nss-aarch64",
-    workerType: "nss-rpi",
+    platform: "aarch64",
-    platform: "linux32",
+    maxRunTime: 7200
-    maxRunTime: 7200,
+  };
-    tier: 3
+
-  });
+  await scheduleLinux("Linux AArch64 (debug)",
+    merge({
+      command: [
+        "/bin/bash",
+        "-c",
+        "bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh"
+      ],
+      collection: "debug",
+    }, aarch64_base)
+  );
+
+  await scheduleLinux("Linux AArch64 (opt)",
+    merge({
+      command: [
+        "/bin/bash",
+        "-c",
+        "bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh --opt"
+      ],
+      collection: "opt",
+    }, aarch64_base)
+  );
 }
 
 /*****************************************************************************/
 
-async function scheduleLinux(name, base) {
+async function scheduleLinux(name, base, args = "") {
   // Build base definition.
   let build_base = merge({
     command: [
       "/bin/bash",
       "-c",
-      "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh"
+      "bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh " + args
     ],
     artifacts: {
       public: {
@@ -224,12 +266,12 @@ async function scheduleLinux(name, base) {
   // Extra builds.
   let extra_base = merge({group: "Builds"}, build_base);
   queue.scheduleTask(merge(extra_base, {
-    name: `${name} w/ clang-3.9`,
+    name: `${name} w/ clang-4.0`,
     env: {
       CC: "clang",
       CCC: "clang++",
     },
-    symbol: "clang-3.9"
+    symbol: "clang-4.0"
   }));
 
   queue.scheduleTask(merge(extra_base, {
@@ -251,30 +293,54 @@ async function scheduleLinux(name, base) {
   }));
 
   queue.scheduleTask(merge(extra_base, {
-    name: `${name} w/ NSS_DISABLE_LIBPKIX=1`,
+    name: `${name} w/ modular builds`,
-    env: {NSS_DISABLE_LIBPKIX: "1"},
+    env: {NSS_BUILD_MODULAR: "1"},
-    symbol: "noLibpkix"
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh",
+    ],
+    symbol: "modular"
   }));
 
+  await scheduleTestBuilds(merge(base, {group: "Test"}), args);
+
   return queue.submit();
 }
 
 /*****************************************************************************/
 
+function scheduleFuzzingRun(base, name, target, max_len, symbol = null, corpus = null) {
+  const MAX_FUZZ_TIME = 300;
+
+  queue.scheduleTask(merge(base, {
+    name,
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && nss/automation/taskcluster/scripts/fuzz.sh " +
+        `${target} nss/fuzz/corpus/${corpus || target} ` +
+        `-max_total_time=${MAX_FUZZ_TIME} ` +
+        `-max_len=${max_len}`
+    ],
+    symbol: symbol || name
+  }));
+}
+
 async function scheduleFuzzing() {
   let base = {
     env: {
-       // bug 1316276
+      ASAN_OPTIONS: "allocator_may_return_null=1:detect_stack_use_after_return=1",
-      ASAN_OPTIONS: "allocator_may_return_null=1:detect_odr_violation=0",
       UBSAN_OPTIONS: "print_stacktrace=1",
       NSS_DISABLE_ARENA_FREE_LIST: "1",
       NSS_DISABLE_UNLOAD: "1",
       CC: "clang",
       CCC: "clang++"
     },
+    features: ["allowPtrace"],
     platform: "linux64",
     collection: "fuzz",
-    image: LINUX_IMAGE
+    image: FUZZ_IMAGE
   };
 
   // Build base definition.
@@ -301,9 +367,22 @@ async function scheduleFuzzing() {
     name: "Linux x64 (debug, fuzz)"
   }));
 
+  // The task that builds NSPR+NSS (TLS fuzzing mode).
+  let task_build_tls = queue.scheduleTask(merge(build_base, {
+    name: "Linux x64 (debug, TLS fuzz)",
+    symbol: "B",
+    group: "TLS",
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && " +
+      "nss/automation/taskcluster/scripts/build_gyp.sh -g -v --fuzz=tls"
+    ],
+  }));
+
   // Schedule tests.
   queue.scheduleTask(merge(base, {
-    parent: task_build,
+    parent: task_build_tls,
     name: "Gtests",
     command: [
       "/bin/bash",
@@ -317,56 +396,155 @@ async function scheduleFuzzing() {
     kind: "test"
   }));
 
-  queue.scheduleTask(merge(base, {
+  // Schedule fuzzing runs.
-    parent: task_build,
+  let run_base = merge(base, {parent: task_build, kind: "test"});
-    name: "Cert",
+  scheduleFuzzingRun(run_base, "CertDN", "certDN", 4096);
+  scheduleFuzzingRun(run_base, "QuickDER", "quickder", 10000);
+
+  // Schedule MPI fuzzing runs.
+  let mpi_base = merge(run_base, {group: "MPI"});
+  let mpi_names = ["add", "addmod", "div", "expmod", "mod", "mulmod", "sqr",
+                   "sqrmod", "sub", "submod"];
+  for (let name of mpi_names) {
+    scheduleFuzzingRun(mpi_base, `MPI (${name})`, `mpi-${name}`, 4096, name);
+  }
+  scheduleFuzzingRun(mpi_base, `MPI (invmod)`, `mpi-invmod`, 256, "invmod");
+
+  // Schedule TLS fuzzing runs (non-fuzzing mode).
+  let tls_base = merge(run_base, {group: "TLS"});
+  scheduleFuzzingRun(tls_base, "TLS Client", "tls-client", 20000, "client-nfm",
+                     "tls-client-no_fuzzer_mode");
+  scheduleFuzzingRun(tls_base, "TLS Server", "tls-server", 20000, "server-nfm",
+                     "tls-server-no_fuzzer_mode");
+  scheduleFuzzingRun(tls_base, "DTLS Client", "dtls-client", 20000,
+                     "dtls-client-nfm", "dtls-client-no_fuzzer_mode");
+  scheduleFuzzingRun(tls_base, "DTLS Server", "dtls-server", 20000,
+                     "dtls-server-nfm", "dtls-server-no_fuzzer_mode");
+
+  // Schedule TLS fuzzing runs (fuzzing mode).
+  let tls_fm_base = merge(tls_base, {parent: task_build_tls});
+  scheduleFuzzingRun(tls_fm_base, "TLS Client", "tls-client", 20000, "client");
+  scheduleFuzzingRun(tls_fm_base, "TLS Server", "tls-server", 20000, "server");
+  scheduleFuzzingRun(tls_fm_base, "DTLS Client", "dtls-client", 20000, "dtls-client");
+  scheduleFuzzingRun(tls_fm_base, "DTLS Server", "dtls-server", 20000, "dtls-server");
+
+  return queue.submit();
+}
+
+async function scheduleFuzzing32() {
+  let base = {
+    env: {
+      ASAN_OPTIONS: "allocator_may_return_null=1:detect_stack_use_after_return=1",
+      UBSAN_OPTIONS: "print_stacktrace=1",
+      NSS_DISABLE_ARENA_FREE_LIST: "1",
+      NSS_DISABLE_UNLOAD: "1",
+      CC: "clang",
+      CCC: "clang++"
+    },
+    features: ["allowPtrace"],
+    platform: "linux32",
+    collection: "fuzz",
+    image: FUZZ_IMAGE
+  };
+
+  // Build base definition.
+  let build_base = merge({
     command: [
       "/bin/bash",
       "-c",
-      "bin/checkout.sh && nss/automation/taskcluster/scripts/fuzz.sh " +
+      "bin/checkout.sh && " +
-        "cert nss/fuzz/corpus/cert -max_total_time=300"
+      "nss/automation/taskcluster/scripts/build_gyp.sh -g -v --fuzz -m32"
     ],
-    // Need a privileged docker container to remove this.
+    artifacts: {
-    env: {ASAN_OPTIONS: "detect_leaks=0"},
+      public: {
-    symbol: "SCert",
+        expires: 24 * 7,
+        type: "directory",
+        path: "/home/worker/artifacts"
+      }
+    },
+    kind: "build",
+    symbol: "B"
+  }, base);
+
+  // The task that builds NSPR+NSS.
+  let task_build = queue.scheduleTask(merge(build_base, {
+    name: "Linux 32 (debug, fuzz)"
+  }));
+
+  // The task that builds NSPR+NSS (TLS fuzzing mode).
+  let task_build_tls = queue.scheduleTask(merge(build_base, {
+    name: "Linux 32 (debug, TLS fuzz)",
+    symbol: "B",
+    group: "TLS",
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && " +
+      "nss/automation/taskcluster/scripts/build_gyp.sh -g -v --fuzz=tls -m32"
+    ],
+  }));
+
+  // Schedule tests.
+  queue.scheduleTask(merge(base, {
+    parent: task_build_tls,
+    name: "Gtests",
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
+    ],
+    env: {GTESTFILTER: "*Fuzz*"},
+    tests: "ssl_gtests gtests",
+    cycle: "standard",
+    symbol: "Gtest",
     kind: "test"
   }));
 
-  queue.scheduleTask(merge(base, {
+  // Schedule fuzzing runs.
-    parent: task_build,
+  let run_base = merge(base, {parent: task_build, kind: "test"});
-    name: "SPKI",
+  scheduleFuzzingRun(run_base, "CertDN", "certDN", 4096);
-    command: [
+  scheduleFuzzingRun(run_base, "QuickDER", "quickder", 10000);
-      "/bin/bash",
+
-      "-c",
+  // Schedule MPI fuzzing runs.
-      "bin/checkout.sh && nss/automation/taskcluster/scripts/fuzz.sh " +
+  let mpi_base = merge(run_base, {group: "MPI"});
-        "spki nss/fuzz/corpus/spki -max_total_time=300"
+  let mpi_names = ["add", "addmod", "div", "expmod", "mod", "mulmod", "sqr",
-    ],
+                   "sqrmod", "sub", "submod"];
-    // Need a privileged docker container to remove this.
+  for (let name of mpi_names) {
-    env: {ASAN_OPTIONS: "detect_leaks=0"},
+    scheduleFuzzingRun(mpi_base, `MPI (${name})`, `mpi-${name}`, 4096, name);
-    symbol: "SPKI",
+  }
-    kind: "test"
+  scheduleFuzzingRun(mpi_base, `MPI (invmod)`, `mpi-invmod`, 256, "invmod");
-  }));
+
+  // Schedule TLS fuzzing runs (non-fuzzing mode).
+  let tls_base = merge(run_base, {group: "TLS"});
+  scheduleFuzzingRun(tls_base, "TLS Client", "tls-client", 20000, "client-nfm",
+                     "tls-client-no_fuzzer_mode");
+  scheduleFuzzingRun(tls_base, "TLS Server", "tls-server", 20000, "server-nfm",
+                     "tls-server-no_fuzzer_mode");
+  scheduleFuzzingRun(tls_base, "DTLS Client", "dtls-client", 20000,
+                     "dtls-client-nfm", "dtls-client-no_fuzzer_mode");
+  scheduleFuzzingRun(tls_base, "DTLS Server", "dtls-server", 20000,
+                     "dtls-server-nfm", "dtls-server-no_fuzzer_mode");
+
+  // Schedule TLS fuzzing runs (fuzzing mode).
+  let tls_fm_base = merge(tls_base, {parent: task_build_tls});
+  scheduleFuzzingRun(tls_fm_base, "TLS Client", "tls-client", 20000, "client");
+  scheduleFuzzingRun(tls_fm_base, "TLS Server", "tls-server", 20000, "server");
+  scheduleFuzzingRun(tls_fm_base, "DTLS Client", "dtls-client", 20000, "dtls-client");
+  scheduleFuzzingRun(tls_fm_base, "DTLS Server", "dtls-server", 20000, "dtls-server");
 
   return queue.submit();
 }
 
 /*****************************************************************************/
 
-async function scheduleTestBuilds() {
+async function scheduleTestBuilds(base, args = "") {
-  let base = {
-    platform: "linux64",
-    collection: "gyp",
-    group: "Test",
-    image: LINUX_IMAGE
-  };
-
   // Build base definition.
   let build = merge({
     command: [
       "/bin/bash",
       "-c",
       "bin/checkout.sh && " +
-      "nss/automation/taskcluster/scripts/build_gyp.sh -g -v --test"
+      "nss/automation/taskcluster/scripts/build_gyp.sh -g -v --test --ct-verif " + args
     ],
     artifacts: {
       public: {
@@ -377,7 +555,7 @@ async function scheduleTestBuilds() {
     },
     kind: "build",
     symbol: "B",
-    name: "Linux 64 (debug, gyp, test)"
+    name: "Linux 64 (debug, test)"
   }, base);
 
   // The task that builds NSPR+NSS.
@@ -397,6 +575,19 @@ async function scheduleTestBuilds() {
     symbol: "mpi",
     kind: "test"
   }));
+  queue.scheduleTask(merge(base, {
+    parent: task_build,
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
+    ],
+    name: "Gtests",
+    symbol: "Gtest",
+    tests: "gtests",
+    cycle: "standard",
+    kind: "test"
+  }));
 
   return queue.submit();
 }
@@ -404,10 +595,9 @@ async function scheduleTestBuilds() {
 
 /*****************************************************************************/
 
-async function scheduleWindows(name, base) {
+async function scheduleWindows(name, base, build_script) {
   base = merge(base, {
     workerType: "nss-win2012r2",
-    platform: "windows2012-64",
     env: {
       PATH: "c:\\mozilla-build\\python;c:\\mozilla-build\\msys\\local\\bin;" +
             "c:\\mozilla-build\\7zip;c:\\mozilla-build\\info-zip;" +
@@ -417,7 +607,6 @@ async function scheduleWindows(name, base) {
             "c:\\mozilla-build\\wget",
       DOMSUF: "localdomain",
       HOST: "localhost",
-      USE_64: "1"
     }
   });
 
@@ -425,7 +614,7 @@ async function scheduleWindows(name, base) {
   let build_base = merge(base, {
     command: [
       WINDOWS_CHECKOUT_CMD,
-      "bash -c nss/automation/taskcluster/windows/build.sh"
+      `bash -c 'nss/automation/taskcluster/windows/${build_script}'`
     ],
     artifacts: [{
       expires: 24 * 7,
@@ -474,11 +663,26 @@ function scheduleTests(task_build, task_cert, test_base) {
   queue.scheduleTask(merge(no_cert_base, {
     name: "Bogo tests", symbol: "Bogo", tests: "bogo", cycle: "standard"
   }));
+  queue.scheduleTask(merge(no_cert_base, {
+    name: "Interop tests", symbol: "Interop", tests: "interop", cycle: "standard"
+  }));
   queue.scheduleTask(merge(no_cert_base, {
     name: "Chains tests", symbol: "Chains", tests: "chains"
   }));
   queue.scheduleTask(merge(no_cert_base, {
-    name: "Cipher tests", symbol: "Cipher", tests: "cipher"
+    name: "Cipher tests", symbol: "Default", tests: "cipher", group: "Cipher"
+  }));
+  queue.scheduleTask(merge(no_cert_base, {
+    name: "Cipher tests", symbol: "NoAESNI", tests: "cipher",
+    env: {NSS_DISABLE_HW_AES: "1"}, group: "Cipher"
+  }));
+  queue.scheduleTask(merge(no_cert_base, {
+    name: "Cipher tests", symbol: "NoPCLMUL", tests: "cipher",
+    env: {NSS_DISABLE_PCLMUL: "1"}, group: "Cipher"
+  }));
+  queue.scheduleTask(merge(no_cert_base, {
+    name: "Cipher tests", symbol: "NoAVX", tests: "cipher",
+    env: {NSS_DISABLE_AVX: "1"}, group: "Cipher"
   }));
   queue.scheduleTask(merge(no_cert_base, {
     name: "EC tests", symbol: "EC", tests: "ec"
@@ -531,7 +735,6 @@ function scheduleTests(task_build, task_cert, test_base) {
 
 async function scheduleTools() {
   let base = {
-    image: LINUX_IMAGE,
     platform: "nss-tools",
     kind: "test"
   };
@@ -539,16 +742,18 @@ async function scheduleTools() {
   queue.scheduleTask(merge(base, {
     symbol: "clang-format-3.9",
     name: "clang-format-3.9",
+    image: LINUX_CLANG39_IMAGE,
     command: [
       "/bin/bash",
       "-c",
-      "bin/checkout.sh && nss/automation/taskcluster/scripts/run_clang_format.sh"
+      "bin/checkout.sh && nss/automation/clang-format/run_clang_format.sh"
     ]
   }));
 
   queue.scheduleTask(merge(base, {
-    symbol: "scan-build-3.9",
+    symbol: "scan-build-4.0",
-    name: "scan-build-3.9",
+    name: "scan-build-4.0",
+    image: LINUX_IMAGE,
     env: {
       USE_64: "1",
       CC: "clang",

security/nss/automation/taskcluster/graph/src/queue.js

@@ -25,10 +25,18 @@ function fromNow(hours) {
 }
 
 function parseRoutes(routes) {
-  return [
+  let rv = [
     `tc-treeherder.v2.${process.env.TC_PROJECT}.${process.env.NSS_HEAD_REVISION}.${process.env.NSS_PUSHLOG_ID}`,
     ...routes
   ];
+
+  // Notify about failures (except on try).
+  if (process.env.TC_PROJECT != "nss-try") {
+    rv.push(`notify.email.${process.env.TC_OWNER}.on-failed`,
+            `notify.email.${process.env.TC_OWNER}.on-exception`);
+  }
+
+  return rv;
 }
 
 function parseFeatures(list) {
@@ -80,6 +88,7 @@ function parseTreeherder(def) {
 }
 
 function convertTask(def) {
+  let scopes = [];
   let dependencies = [];
 
   let env = merge({
@@ -110,19 +119,24 @@ function convertTask(def) {
     payload.image = def.image;
   }
 
-  if (def.features) {
-    payload.features = parseFeatures(def.features);
-  }
-
   if (def.artifacts) {
     payload.artifacts = parseArtifacts(def.artifacts);
   }
 
+  if (def.features) {
+    payload.features = parseFeatures(def.features);
+
+    if (payload.features.allowPtrace) {
+      scopes.push("docker-worker:feature:allowPtrace");
+    }
+  }
+
   return {
     provisionerId: def.provisioner || "aws-provisioner-v1",
     workerType: def.workerType || "hg-worker",
     schedulerId: "task-graph-scheduler",
 
+    scopes,
     created: fromNow(0),
     deadline: fromNow(24),
 

security/nss/automation/taskcluster/graph/src/try_syntax.js

@@ -22,8 +22,10 @@ function parseOptions(opts) {
   }
 
   // Parse platforms.
-  let allPlatforms = ["linux", "linux64", "linux64-asan", "win64", "arm",
+  let allPlatforms = ["linux", "linux64", "linux64-asan",
-                      "linux64-gyp", "linux64-gyp-asan", "linux64-fuzz"];
+                      "win", "win64", "win-make", "win64-make",
+                      "linux64-make", "linux-make", "linux-fuzz",
+                      "linux64-fuzz", "aarch64"];
   let platforms = intersect(opts.platform.split(/\s*,\s*/), allPlatforms);
 
   // If the given value is nonsense or "none" default to all platforms.
@@ -34,7 +36,7 @@ function parseOptions(opts) {
   // Parse unit tests.
   let aliases = {"gtests": "gtest"};
   let allUnitTests = ["bogo", "crmf", "chains", "cipher", "db", "ec", "fips",
-                      "gtest", "lowhash", "merge", "sdr", "smime", "tools",
+                      "gtest", "interop", "lowhash", "merge", "sdr", "smime", "tools",
                       "ssl", "mpi", "scert", "spki"];
   let unittests = intersect(opts.unittests.split(/\s*,\s*/).map(t => {
     return aliases[t] || t;
@@ -82,11 +84,13 @@ function filter(opts) {
     // Filter unit tests.
     if (task.tests) {
       let found = opts.unittests.some(test => {
-        // TODO: think of something more intelligent here.
+        if (task.group && task.group.toLowerCase() == "ssl" && test == "ssl") {
-        if (task.symbol.toLowerCase().startsWith("mpi") && test == "mpi") {
           return true;
         }
-        return (task.group || task.symbol).toLowerCase().startsWith(test);
+        if (task.group && task.group.toLowerCase() == "cipher" && test == "cipher") {
+          return true;
+        }
+        return task.symbol.toLowerCase().startsWith(test);
       });
 
       if (!found) {
@@ -105,12 +109,15 @@ function filter(opts) {
     let found = opts.platforms.some(platform => {
       let aliases = {
         "linux": "linux32",
+        "linux-fuzz": "linux32",
         "linux64-asan": "linux64",
         "linux64-fuzz": "linux64",
-        "linux64-gyp": "linux64",
+        "linux64-make": "linux64",
-        "linux64-gyp-asan": "linux64",
+        "linux-make": "linux32",
+        "win64-make": "windows2012-64",
+        "win-make": "windows2012-32",
         "win64": "windows2012-64",
-        "arm": "linux32"
+        "win": "windows2012-32"
       };
 
       // Check the platform name.
@@ -119,13 +126,10 @@ function filter(opts) {
       // Additional checks.
       if (platform == "linux64-asan") {
         keep &= coll("asan");
-      } else if (platform == "arm") {
+      } else if (platform == "linux64-make" || platform == "linux-make" ||
-        keep &= coll("arm-opt") || coll("arm-debug");
+                 platform == "win64-make" || platform == "win-make") {
-      } else if (platform == "linux64-gyp") {
+        keep &= coll("make");
-        keep &= coll("gyp");
+      } else if (platform == "linux64-fuzz" || platform == "linux-fuzz") {
-      } else if (platform == "linux64-gyp-asan") {
-        keep &= coll("gyp-asan");
-      } else if (platform == "linux64-fuzz") {
         keep &= coll("fuzz");
       } else {
         keep &= coll("opt") || coll("debug");
@@ -139,8 +143,8 @@ function filter(opts) {
     }
 
     // Finally, filter by build type.
-    let isDebug = coll("debug") || coll("asan") || coll("arm-debug") ||
+    let isDebug = coll("debug") || coll("asan") || coll("make") ||
-                  coll("gyp") || coll("fuzz");
+                  coll("fuzz");
     return (isDebug && opts.builds.includes("d")) ||
            (!isDebug && opts.builds.includes("o"));
   }

security/nss/automation/taskcluster/scripts/build.sh

@@ -1,14 +1,17 @@
 #!/usr/bin/env bash
 
-source $(dirname $0)/tools.sh
+source $(dirname "$0")/tools.sh
 
-if [[ $(id -u) -eq 0 ]]; then
+if [ -n "$NSS_BUILD_MODULAR" ]; then
-    # Drop privileges by re-running this script.
+    $(dirname "$0")/build_nspr.sh || exit $?
-    exec su worker $0
+    $(dirname "$0")/build_util.sh || exit $?
+    $(dirname "$0")/build_softoken.sh || exit $?
+    $(dirname "$0")/build_nss.sh || exit $?
+    exit
 fi
 
 # Clone NSPR if needed.
-hg_clone https://hg.mozilla.org/projects/nspr nspr default
+hg_clone https://hg.mozilla.org/projects/nspr ./nspr default
 
 # Build.
 make -C nss nss_build_all

security/nss/automation/taskcluster/scripts/build_gyp.sh

@@ -1,17 +1,12 @@
 #!/usr/bin/env bash
 
-source $(dirname $0)/tools.sh
+source $(dirname "$0")/tools.sh
-
-if [[ $(id -u) -eq 0 ]]; then
-    # Drop privileges by re-running this script.
-    exec su worker -c "$0 $*"
-fi
 
 # Clone NSPR if needed.
-hg_clone https://hg.mozilla.org/projects/nspr nspr default
+hg_clone https://hg.mozilla.org/projects/nspr ./nspr default
 
 # Build.
-nss/build.sh ${*--g -v}
+nss/build.sh -g -v "$@"
 
 # Package.
 mkdir artifacts

security/nss/automation/taskcluster/scripts/build_nspr.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+source $(dirname $0)/tools.sh
+
+# Clone NSPR if needed.
+hg_clone https://hg.mozilla.org/projects/nspr nspr default
+
+# Build.
+rm -rf dist
+make -C nss build_nspr
+
+# Package.
+test -d artifacts || mkdir artifacts
+rm -rf dist-nspr
+mv dist dist-nspr
+tar cvfjh artifacts/dist-nspr.tar.bz2 dist-nspr

security/nss/automation/taskcluster/scripts/build_nss.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+source $(dirname $0)/tools.sh
+source $(dirname $0)/split.sh
+
+test -d dist-softoken || { echo "run build_softoken.sh first" 1>&2; exit 1; }
+
+rm -rf nss-nss
+split_nss nss nss-nss
+
+# Build.
+export NSS_BUILD_WITHOUT_SOFTOKEN=1
+export NSS_USE_SYSTEM_FREEBL=1
+
+platform=`make -s -C nss platform`
+
+export NSPR_LIB_DIR="$PWD/dist-nspr/$platform/lib"
+export NSSUTIL_LIB_DIR="$PWD/dist-util/$platform/lib"
+export FREEBL_LIB_DIR="$PWD/dist-softoken/$platform/lib"
+export SOFTOKEN_LIB_DIR="$PWD/dist-softoken/$platform/lib"
+export FREEBL_LIBS=-lfreebl
+
+export NSS_NO_PKCS11_BYPASS=1
+export FREEBL_NO_DEPEND=1
+
+export LIBRARY_PATH="$PWD/dist-nspr/$platform/lib:$PWD/dist-util/$platform/lib:$PWD/dist-softoken/$platform/lib"
+export LD_LIBRARY_PATH="$LIBRARY_PATH:$LD_LIBRARY_PATH"
+export INCLUDES="-I$PWD/dist-nspr/$platform/include -I$PWD/dist-util/public/nss -I$PWD/dist-softoken/public/nss"
+
+rm -rf dist
+make -C nss-nss nss_build_all
+
+# Package.
+test -d artifacts || mkdir artifacts
+rm -rf dist-nss
+mv dist dist-nss
+tar cvfjh artifacts/dist-nss.tar.bz2 dist-nss

security/nss/automation/taskcluster/scripts/build_softoken.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+source $(dirname $0)/tools.sh
+source $(dirname $0)/split.sh
+
+test -d dist-util || { echo "run build_util.sh first" 1>&2; exit 1; }
+
+rm -rf nss-softoken
+split_softoken nss nss-softoken
+
+# Build.
+platform=`make -s -C nss platform`
+export LIBRARY_PATH="$PWD/dist-nspr/$platform/lib:$PWD/dist-util/$platform/lib"
+export LD_LIBRARY_PATH="$LIBRARY_PATH:$LD_LIBRARY_PATH"
+export INCLUDES="-I$PWD/dist-nspr/$platform/include -I$PWD/dist-util/public/nss"
+export NSS_BUILD_SOFTOKEN_ONLY=1
+
+rm -rf dist
+make -C nss-softoken nss_build_all
+
+mv dist/private/nss/blapi.h dist/public/nss
+mv dist/private/nss/alghmac.h dist/public/nss
+
+# Package.
+test -d artifacts || mkdir artifacts
+rm -rf dist-softoken
+mv dist dist-softoken
+tar cvfjh artifacts/dist-softoken.tar.bz2 dist-softoken

security/nss/automation/taskcluster/scripts/build_util.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+source $(dirname $0)/tools.sh
+source $(dirname $0)/split.sh
+
+rm -rf nss-util
+split_util nss nss-util
+
+# Build.
+platform=`make -s -C nss platform`
+export LIBRARY_PATH="$PWD/dist-nspr/$platform/lib"
+export LD_LIBRARY_PATH="$LIBRARY_PATH:$LD_LIBRARY_PATH"
+export INCLUDES="-I$PWD/dist-nspr/$platform/include"
+export NSS_BUILD_UTIL_ONLY=1
+
+rm -rf dist
+make -C nss-util nss_build_all
+
+# Package.
+test -d artifacts || mkdir artifacts
+rm -rf dist-util
+mv dist dist-util
+tar cvfjh artifacts/dist-util.tar.bz2 dist-util

security/nss/automation/taskcluster/scripts/extend_task_graph.sh

@@ -1,11 +1,6 @@
 #!/usr/bin/env bash
 
-set -v -e -x
+source $(dirname "$0")/tools.sh
-
-if [ $(id -u) = 0 ]; then
-    # Drop privileges by re-running this script.
-    exec su worker $0
-fi
 
 mkdir -p /home/worker/artifacts
 

security/nss/automation/taskcluster/scripts/fuzz.sh

@@ -1,20 +1,32 @@
 #!/usr/bin/env bash
 
-source $(dirname $0)/tools.sh
+source $(dirname "$0")/tools.sh
 
-if [ $(id -u) = 0 ]; then
+type="$1"
-    # Drop privileges by re-running this script.
+shift
-    exec su worker -c "$0 $*"
-fi
 
 # Fetch artifact if needed.
 fetch_dist
 
 # Clone corpus.
-./nss/fuzz/clone_corpus.sh
+./nss/fuzz/config/clone_corpus.sh
+
+# Ensure we have a corpus.
+if [ ! -d "nss/fuzz/corpus/$type" ]; then
+  mkdir -p nss/fuzz/corpus/$type
+
+  set +x
+
+  # Create a corpus out of what we have.
+  for f in $(find nss/fuzz/corpus -type f); do
+    cp $f "nss/fuzz/corpus/$type"
+  done
+
+  set -x
+fi
 
 # Fetch objdir name.
 objdir=$(cat dist/latest)
 
 # Run nssfuzz.
-LD_LIBRARY_PATH=$LD_LIBRARY_PATH:dist/$objdir/lib dist/$objdir/bin/nssfuzz $*
+dist/$objdir/bin/nssfuzz-"$type" "$@"

security/nss/automation/taskcluster/scripts/gen_certs.sh

@@ -1,16 +1,6 @@
 #!/usr/bin/env bash
 
-set -v -e -x
+source $(dirname "$0")/tools.sh
-
-source $(dirname $0)/tools.sh
-
-if [ $(id -u) = 0 ]; then
-    # Stupid Docker.
-    echo "127.0.0.1 localhost.localdomain" >> /etc/hosts
-
-    # Drop privileges by re-running this script.
-    exec su worker $0
-fi
 
 # Fetch artifact if needed.
 fetch_dist

security/nss/automation/taskcluster/scripts/run_clang_format.sh

@@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-
-set -v -e -x
-
-if [ $(id -u) -eq 0 ]; then
-    # Drop privileges by re-running this script.
-    exec su worker $0 "$@"
-fi
-
-# Apply clang-format on the provided folder and verify that this doesn't change any file.
-# If any file differs after formatting, the script eventually exits with 1.
-# Any differences between formatted and unformatted files is printed to stdout to give a hint what's wrong.
-
-# Includes a default set of directories.
-
-if [ $# -gt 0 ]; then
-    dirs=("$@")
-else
-    top=$(dirname $0)/../../..
-    dirs=( \
-         "$top/cmd" \
-         "$top/fuzz" \
-         "$top/lib/base" \
-         "$top/lib/certdb" \
-         "$top/lib/certhigh" \
-         "$top/lib/ckfw" \
-         "$top/lib/crmf" \
-         "$top/lib/cryptohi" \
-         "$top/lib/dbm" \
-         "$top/lib/dev" \
-         "$top/lib/freebl" \
-         "$top/lib/jar" \
-         "$top/lib/nss" \
-         "$top/lib/pk11wrap" \
-         "$top/lib/pkcs7" \
-         "$top/lib/pkcs12" \
-         "$top/lib/pki" \
-         "$top/lib/smime" \
-         "$top/lib/softoken" \
-         "$top/lib/ssl" \
-         "$top/lib/sysinit" \
-         "$top/lib/util" \
-         "$top/gtests/common" \
-         "$top/gtests/der_gtest" \
-         "$top/gtests/freebl_gtest" \
-         "$top/gtests/pk11_gtest" \
-         "$top/gtests/ssl_gtest" \
-         "$top/gtests/util_gtest" \
-    )
-fi
-
-for dir in "${dirs[@]}"; do
-    find "$dir" -type f \( -name '*.[ch]' -o -name '*.cc' \) -exec clang-format -i {} \+
-done
-
-TMPFILE=$(mktemp /tmp/$(basename $0).XXXXXX)
-trap 'rm $TMPFILE' exit
-if (cd $(dirname $0); hg root >/dev/null 2>&1); then
-    hg diff --git "$top" | tee $TMPFILE
-else
-    git -C "$top" diff | tee $TMPFILE
-fi
-[[ ! -s $TMPFILE ]]

security/nss/automation/taskcluster/scripts/run_scan_build.sh

@@ -1,15 +1,10 @@
 #!/usr/bin/env bash
 
-source $(dirname $0)/tools.sh
+source $(dirname "$0")/tools.sh
-
-if [ $(id -u) = 0 ]; then
-    # Drop privileges by re-running this script.
-    exec su worker $0 $@
-fi
 
 # Clone NSPR if needed.
 if [ ! -d "nspr" ]; then
-    hg_clone https://hg.mozilla.org/projects/nspr nspr default
+    hg_clone https://hg.mozilla.org/projects/nspr ./nspr default
 fi
 
 # Build.

security/nss/automation/taskcluster/scripts/run_tests.sh

@@ -1,14 +1,6 @@
 #!/usr/bin/env bash
 
-source $(dirname $0)/tools.sh
+source $(dirname "$0")/tools.sh
-
-if [ $(id -u) = 0 ]; then
-    # Stupid Docker.
-    echo "127.0.0.1 localhost.localdomain" >> /etc/hosts
-
-    # Drop privileges by re-running this script.
-    exec su worker $0
-fi
 
 # Fetch artifact if needed.
 fetch_dist

security/nss/automation/taskcluster/scripts/split.sh

@@ -0,0 +1,154 @@
+copy_top()
+{
+  srcdir_="$1"
+  dstdir_="$2"
+  files=`find "$srcdir_" -maxdepth 1 -mindepth 1 -type f`
+  for f in $files; do
+    cp -p "$f" "$dstdir_"
+  done
+}
+
+split_util() {
+  nssdir="$1"
+  dstdir="$2"
+
+  # Prepare a source tree only containing files to build nss-util:
+  #
+  #   nss/dbm                     full directory
+  #   nss/coreconf                full directory
+  #   nss                         top files only
+  #   nss/lib                     top files only
+  #   nss/lib/util                full directory
+
+  # Copy everything.
+  cp -R $nssdir $dstdir
+
+  # Skip gtests when building.
+  sed '/^DIRS = /s/ cpputil gtests$//' $nssdir/manifest.mn > $dstdir/manifest.mn-t && mv $dstdir/manifest.mn-t $dstdir/manifest.mn
+
+  # Remove subdirectories that we don't want.
+  rm -rf $dstdir/cmd
+  rm -rf $dstdir/tests
+  rm -rf $dstdir/lib
+  rm -rf $dstdir/automation
+  rm -rf $dstdir/gtests
+  rm -rf $dstdir/cpputil
+  rm -rf $dstdir/doc
+
+  # Start with an empty cmd lib directories to be filled selectively.
+  mkdir $dstdir/cmd
+  cp $nssdir/cmd/Makefile $dstdir/cmd
+  cp $nssdir/cmd/manifest.mn $dstdir/cmd
+  cp $nssdir/cmd/platlibs.mk $dstdir/cmd
+  cp $nssdir/cmd/platrules.mk $dstdir/cmd
+
+  # Copy some files at the top and the util subdirectory recursively.
+  mkdir $dstdir/lib
+  cp $nssdir/lib/Makefile $dstdir/lib
+  cp $nssdir/lib/manifest.mn $dstdir/lib
+  cp -R $nssdir/lib/util $dstdir/lib/util
+}
+
+split_softoken() {
+  nssdir="$1"
+  dstdir="$2"
+
+  # Prepare a source tree only containing files to build nss-softoken:
+  #
+  #   nss/dbm                     full directory
+  #   nss/coreconf                full directory
+  #   nss                         top files only
+  #   nss/lib                     top files only
+  #   nss/lib/freebl              full directory
+  #   nss/lib/softoken            full directory
+  #   nss/lib/softoken/dbm        full directory
+
+  # Copy everything.
+  cp -R $nssdir $dstdir
+
+  # Skip gtests when building.
+  sed '/^DIRS = /s/ cpputil gtests$//' $nssdir/manifest.mn > $dstdir/manifest.mn-t && mv $dstdir/manifest.mn-t $dstdir/manifest.mn
+
+  # Remove subdirectories that we don't want.
+  rm -rf $dstdir/cmd
+  rm -rf $dstdir/tests
+  rm -rf $dstdir/lib
+  rm -rf $dstdir/pkg
+  rm -rf $dstdir/automation
+  rm -rf $dstdir/gtests
+  rm -rf $dstdir/cpputil
+  rm -rf $dstdir/doc
+
+  # Start with an empty lib directory and copy only what we need.
+  mkdir $dstdir/lib
+  copy_top $nssdir/lib $dstdir/lib
+  cp -R $nssdir/lib/dbm $dstdir/lib/dbm
+  cp -R $nssdir/lib/freebl $dstdir/lib/freebl
+  cp -R $nssdir/lib/softoken $dstdir/lib/softoken
+  cp -R $nssdir/lib/sqlite $dstdir/lib/sqlite
+
+  mkdir $dstdir/cmd
+  copy_top $nssdir/cmd $dstdir/cmd
+  cp -R $nssdir/cmd/bltest $dstdir/cmd/bltest
+  cp -R $nssdir/cmd/ecperf $dstdir/cmd/ecperf
+  cp -R $nssdir/cmd/fbectest $dstdir/cmd/fbectest
+  cp -R $nssdir/cmd/fipstest $dstdir/cmd/fipstest
+  cp -R $nssdir/cmd/lib $dstdir/cmd/lib
+  cp -R $nssdir/cmd/lowhashtest $dstdir/cmd/lowhashtest
+  cp -R $nssdir/cmd/shlibsign $dstdir/cmd/shlibsign
+
+  mkdir $dstdir/tests
+  copy_top $nssdir/tests $dstdir/tests
+
+  cp -R $nssdir/tests/cipher $dstdir/tests/cipher
+  cp -R $nssdir/tests/common $dstdir/tests/common
+  cp -R $nssdir/tests/ec $dstdir/tests/ec
+  cp -R $nssdir/tests/lowhash $dstdir/tests/lowhash
+
+  cp $nssdir/lib/util/verref.h $dstdir/lib/freebl
+  cp $nssdir/lib/util/verref.h $dstdir/lib/softoken
+  cp $nssdir/lib/util/verref.h $dstdir/lib/softoken/legacydb
+}
+
+split_nss() {
+  nssdir="$1"
+  dstdir="$2"
+
+  # Prepare a source tree only containing files to build nss:
+  #
+  #   nss/dbm                     full directory
+  #   nss/coreconf                full directory
+  #   nss                         top files only
+  #   nss/lib                     top files only
+  #   nss/lib/freebl              full directory
+  #   nss/lib/softoken            full directory
+  #   nss/lib/softoken/dbm        full directory
+
+  # Copy everything.
+  cp -R $nssdir $dstdir
+
+  # Remove subdirectories that we don't want.
+  rm -rf $dstdir/lib/freebl
+  rm -rf $dstdir/lib/softoken
+  rm -rf $dstdir/lib/util
+  rm -rf $dstdir/cmd/bltest
+  rm -rf $dstdir/cmd/fipstest
+  rm -rf $dstdir/cmd/rsaperf_low
+
+  # Copy these headers until the upstream bug is accepted
+  # Upstream https://bugzilla.mozilla.org/show_bug.cgi?id=820207
+  cp $nssdir/lib/softoken/lowkeyi.h $dstdir/cmd/rsaperf
+  cp $nssdir/lib/softoken/lowkeyti.h $dstdir/cmd/rsaperf
+
+  # Copy verref.h which will be needed later during the build phase.
+  cp $nssdir/lib/util/verref.h $dstdir/lib/ckfw/builtins/verref.h
+  cp $nssdir/lib/util/verref.h $dstdir/lib/nss/verref.h
+  cp $nssdir/lib/util/verref.h $dstdir/lib/smime/verref.h
+  cp $nssdir/lib/util/verref.h $dstdir/lib/ssl/verref.h
+  cp $nssdir/lib/util/templates.c $dstdir/lib/nss/templates.c
+
+  # FIXME: Skip util_gtest because it links with libnssutil.a.  Note
+  # that we can't use libnssutil3.so instead, because util_gtest
+  # depends on internal symbols not exported from the shared library.
+  sed '/	util_gtest \\/d' $dstdir/gtests/manifest.mn > $dstdir/gtests/manifest.mn-t && mv $dstdir/gtests/manifest.mn-t $dstdir/gtests/manifest.mn
+}

security/nss/automation/taskcluster/scripts/tools.sh

@@ -2,11 +2,21 @@
 
 set -v -e -x
 
+if [[ $(id -u) -eq 0 ]]; then
+    # Drop privileges by re-running this script.
+    # Note: this mangles arguments, better to avoid running scripts as root.
+    exec su worker -c "$0 $*"
+fi
+
 # Usage: hg_clone repo dir [revision=@]
 hg_clone() {
     repo=$1
     dir=$2
     rev=${3:-@}
+    if [ -d "$dir" ]; then
+        hg pull -R "$dir" -ur "$rev" "$repo" && return
+        rm -rf "$dir"
+    fi
     for i in 0 2 5; do
         sleep $i
         hg clone -r "$rev" "$repo" "$dir" && return

security/nss/automation/taskcluster/windows/build.sh

@@ -3,7 +3,11 @@
 set -v -e -x
 
 # Set up the toolchain.
-source $(dirname $0)/setup.sh
+if [ "$USE_64" = 1 ]; then
+  source $(dirname $0)/setup64.sh
+else
+  source $(dirname $0)/setup32.sh
+fi
 
 # Clone NSPR.
 hg_clone https://hg.mozilla.org/projects/nspr nspr default

security/nss/automation/taskcluster/windows/build_gyp.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+# Set up the toolchain.
+if [[ "$@" == *"-m32"* ]]; then
+  source $(dirname $0)/setup32.sh
+else
+  source $(dirname $0)/setup64.sh
+fi
+
+# Install GYP.
+cd gyp
+python -m virtualenv test-env
+test-env/Scripts/python setup.py install
+test-env/Scripts/python -m pip install --upgrade pip
+test-env/Scripts/pip install --upgrade setuptools
+cd ..
+
+export GYP_MSVS_OVERRIDE_PATH="${VSPATH}"
+export GYP_MSVS_VERSION="2015"
+export GYP="${PWD}/gyp/test-env/Scripts/gyp"
+
+# Fool GYP.
+touch "${VSPATH}/VC/vcvarsall.bat"
+
+# Clone NSPR.
+hg_clone https://hg.mozilla.org/projects/nspr nspr default
+
+# Build with gyp.
+GYP=${GYP} ./nss/build.sh -g -v "$@"
+
+# Package.
+7z a public/build/dist.7z dist

security/nss/automation/taskcluster/windows/releng.manifest

@@ -1,10 +1,26 @@
 [
   {
-    "version": "Visual Studio 2015 Update 2 / SDK 10.0.10586.0/212",
+    "version": "Visual Studio 2015 Update 3 14.0.25425.01 / SDK 10.0.14393.0",
-    "size": 332442800,
+    "size": 326656969,
-    "digest": "995394a4a515c7cb0f8595f26f5395361a638870dd0bbfcc22193fe1d98a0c47126057d5999cc494f3f3eac5cb49160e79757c468f83ee5797298e286ef6252c",
+    "digest": "babc414ffc0457d27f5a1ed24a8e4873afbe2f1c1a4075469a27c005e1babc3b2a788f643f825efedff95b79686664c67ec4340ed535487168a3482e68559bc7",
     "algorithm": "sha512",
-    "filename": "vs2015u2.zip",
+    "filename": "vs2015u3.zip",
+    "unpack": true
+  },
+  {
+    "version": "Ninja 1.7.1",
+    "size": 184821,
+    "digest": "e4f9a1ae624a2630e75264ba37d396d9c7407d6e6aea3763056210ba6e1387908bd31cf4037a6a3661a418e86c4d2761e0c333e6a3bd0d66549d2b0d72d3f43b",
+    "algorithm": "sha512",
+    "filename": "ninja171.zip",
+    "unpack": true
+  },
+  {
+    "size": 13063963,
+    "visibility": "public",
+    "digest": "47a19f8f863eab3414abab2b9e9bd901ab896c799b3d9254b456b2f59374b085b99de805e21069a0819f01eecb3f43f7e2395a8c644c04bcbfa5711261cca29d",
+    "algorithm": "sha512",
+    "filename": "gyp-2017-05-23.zip",
     "unpack": true
   }
 ]

security/nss/automation/taskcluster/windows/setup.sh

@@ -2,6 +2,13 @@
 
 set -v -e -x
 
+export VSPATH="$(pwd)/vs2015u3"
+export NINJA_PATH="$(pwd)/ninja/bin"
+
+export WINDOWSSDKDIR="${VSPATH}/SDK"
+export VS90COMNTOOLS="${VSPATH}/VC"
+export INCLUDE="${VSPATH}/VC/include:${VSPATH}/SDK/Include/10.0.14393.0/ucrt:${VSPATH}/SDK/Include/10.0.14393.0/shared:${VSPATH}/SDK/Include/10.0.14393.0/um"
+
 # Usage: hg_clone repo dir [revision=@]
 hg_clone() {
     repo=$1
@@ -16,15 +23,4 @@ hg_clone() {
 }
 
 hg_clone https://hg.mozilla.org/build/tools tools default
-
 tools/scripts/tooltool/tooltool_wrapper.sh $(dirname $0)/releng.manifest https://api.pub.build.mozilla.org/tooltool/ non-existant-file.sh /c/mozilla-build/python/python.exe /c/builds/tooltool.py --authentication-file /c/builds/relengapi.tok -c /c/builds/tooltool_cache
-VSPATH="$(pwd)/vs2015u2"
-
-export WINDOWSSDKDIR="${VSPATH}/SDK"
-export WIN32_REDIST_DIR="${VSPATH}/VC/redist/x64/Microsoft.VC140.CRT"
-export WIN_UCRT_REDIST_DIR="${VSPATH}/SDK/Redist/ucrt/DLLs/x64"
-
-export PATH="${VSPATH}/VC/bin/amd64:${VSPATH}/VC/bin:${VSPATH}/SDK/bin/x64:${VSPATH}/VC/redist/x64/Microsoft.VC140.CRT:${VSPATH}/SDK/Redist/ucrt/DLLs/x64:${PATH}"
-
-export INCLUDE="${VSPATH}/VC/include:${VSPATH}/SDK/Include/10.0.10586.0/ucrt:${VSPATH}/SDK/Include/10.0.10586.0/shared:${VSPATH}/SDK/Include/10.0.10586.0/um"
-export LIB="${VSPATH}/VC/lib/amd64:${VSPATH}/SDK/lib/10.0.10586.0/ucrt/x64:${VSPATH}/SDK/lib/10.0.10586.0/um/x64"

security/nss/automation/taskcluster/windows/setup32.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+source $(dirname $0)/setup.sh
+
+export WIN32_REDIST_DIR="${VSPATH}/VC/redist/x86/Microsoft.VC140.CRT"
+export WIN_UCRT_REDIST_DIR="${VSPATH}/SDK/Redist/ucrt/DLLs/x86"
+export PATH="${NINJA_PATH}:${VSPATH}/VC/bin/amd64_x86:${VSPATH}/VC/bin/amd64:${VSPATH}/VC/bin:${VSPATH}/SDK/bin/x86:${VSPATH}/SDK/bin/x64:${VSPATH}/VC/redist/x86/Microsoft.VC140.CRT:${VSPATH}/VC/redist/x64/Microsoft.VC140.CRT:${VSPATH}/SDK/Redist/ucrt/DLLs/x86:${VSPATH}/SDK/Redist/ucrt/DLLs/x64:${PATH}"
+export LIB="${VSPATH}/VC/lib:${VSPATH}/SDK/lib/10.0.14393.0/ucrt/x86:${VSPATH}/SDK/lib/10.0.14393.0/um/x86"

security/nss/automation/taskcluster/windows/setup64.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+source $(dirname $0)/setup.sh
+
+export WIN32_REDIST_DIR="${VSPATH}/VC/redist/x64/Microsoft.VC140.CRT"
+export WIN_UCRT_REDIST_DIR="${VSPATH}/SDK/Redist/ucrt/DLLs/x64"
+export PATH="${NINJA_PATH}:${VSPATH}/VC/bin/amd64:${VSPATH}/VC/bin:${VSPATH}/SDK/bin/x64:${VSPATH}/VC/redist/x64/Microsoft.VC140.CRT:${VSPATH}/SDK/Redist/ucrt/DLLs/x64:${PATH}"
+export LIB="${VSPATH}/VC/lib/amd64:${VSPATH}/SDK/lib/10.0.14393.0/ucrt/x64:${VSPATH}/SDK/lib/10.0.14393.0/um/x64"

security/nss/build.sh

@@ -1,4 +1,10 @@
-#!/bin/bash
+#!/usr/bin/env bash
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+################################################################################
+#
 # This script builds NSS with gyp and ninja.
 #
 # This build system is still under development.  It does not yet support all
@@ -6,41 +12,27 @@
 
 set -e
 
-source $(dirname $0)/coreconf/nspr.sh
+cwd=$(cd $(dirname $0); pwd -P)
+source "$cwd"/coreconf/nspr.sh
+source "$cwd"/coreconf/sanitizers.sh
+GYP=${GYP:-gyp}
 
 # Usage info
-show_help() {
+show_help()
-cat << EOF
+{
+    cat "$cwd"/help.txt
+}
 
-Usage: ${0##*/} [-hcgv] [-j <n>] [--test] [--fuzz] [--scan-build[=output]]
+run_verbose()
-                [-m32] [--opt|-o] [--asan] [--ubsan] [--sancov[=edge|bb|func]]
+{
-                [--pprof] [--msan]
+    if [ "$verbose" = 1 ]; then
-
+        echo "$@"
-This script builds NSS with gyp and ninja.
+        exec 3>&1
-
+    else
-This build system is still under development.  It does not yet support all
+        exec 3>/dev/null
-the features or platforms that NSS supports.
+    fi
-
+    "$@" 1>&3 2>&3
-NSS build tool options:
+    exec 3>&-
-
-    -h            display this help and exit
-    -c            clean before build
-    -g            force a rebuild of gyp (and NSPR, because why not)
-    -j <n>        run at most <n> concurrent jobs
-    -v            verbose build
-    -m32          do a 32-bit build on a 64-bit system
-    --test        ignore map files and export everything we have
-    --fuzz        enable fuzzing mode. this always enables test builds
-    --scan-build  run the build with scan-build (scan-build has to be in the path)
-                  --scan-build=/out/path sets the output path for scan-build
-    --opt|-o      do an opt build
-    --asan        do an asan build
-    --ubsan       do an ubsan build
-    --msan        do an msan build
-    --sancov      do sanitize coverage builds
-                  --sancov=func sets coverage to function level for example
-    --pprof       build with gperftool support
-EOF
 }
 
 if [ -n "$CCC" ] && [ -z "$CXX" ]; then
@@ -51,154 +43,171 @@ opt_build=0
 build_64=0
 clean=0
 rebuild_gyp=0
+rebuild_nspr=0
 target=Debug
 verbose=0
 fuzz=0
+fuzz_tls=0
+fuzz_oss=0
+no_local_nspr=0
+armhf=0
 
-# parse parameters to store in config
+gyp_params=(--depth="$cwd" --generator-output=".")
-params=$(echo "$*" | perl -pe 's/-c|-v|-g|-j [0-9]*|-h//g' | perl -pe 's/^\s*(.*?)\s*$/\1/')
+nspr_params=()
-params=$(echo "$params $CC $CCC" | tr " " "\n" | perl -pe '/^\s*$/d')
+ninja_params=()
-params=$(echo "${params[*]}" | sort)
-
-cwd=$(cd $(dirname $0); pwd -P)
-dist_dir="$cwd/../dist"
 
 # try to guess sensible defaults
-arch=$(python "$cwd/coreconf/detect_host_arch.py")
+arch=$(python "$cwd"/coreconf/detect_host_arch.py)
 if [ "$arch" = "x64" -o "$arch" = "aarch64" ]; then
     build_64=1
+elif [ "$arch" = "arm" ]; then
+    armhf=1
 fi
 
-gyp_params=()
-ninja_params=()
-scanbuild=()
-
-enable_fuzz()
-{
-    fuzz=1
-    nspr_sanitizer asan
-    nspr_sanitizer ubsan
-    nspr_sanitizer sancov edge
-    gyp_params+=(-Duse_asan=1)
-    gyp_params+=(-Duse_ubsan=1)
-    gyp_params+=(-Duse_sancov=edge)
-
-    # Adding debug symbols even for opt builds.
-    nspr_opt+=(--enable-debug-symbols)
-}
-
 # parse command line arguments
 while [ $# -gt 0 ]; do
     case $1 in
         -c) clean=1 ;;
-        -g) rebuild_gyp=1 ;;
+        --gyp|-g) rebuild_gyp=1 ;;
+        --nspr) nspr_clean; rebuild_nspr=1 ;;
         -j) ninja_params+=(-j "$2"); shift ;;
         -v) ninja_params+=(-v); verbose=1 ;;
         --test) gyp_params+=(-Dtest_build=1) ;;
-        --fuzz) gyp_params+=(-Dtest_build=1 -Dfuzz=1); enable_fuzz ;;
+        --fuzz) fuzz=1 ;;
-        --scan-build) scanbuild=(scan-build) ;;
+        --fuzz=oss) fuzz=1; fuzz_oss=1 ;;
-        --scan-build=?*) scanbuild=(scan-build -o "${1#*=}") ;;
+        --fuzz=tls) fuzz=1; fuzz_tls=1 ;;
+        --scan-build) enable_scanbuild  ;;
+        --scan-build=?*) enable_scanbuild "${1#*=}" ;;
         --opt|-o) opt_build=1 ;;
         -m32|--m32) build_64=0 ;;
-        --asan) gyp_params+=(-Duse_asan=1); nspr_sanitizer asan ;;
+        --asan) enable_sanitizer asan ;;
-        --ubsan) gyp_params+=(-Duse_ubsan=1); nspr_sanitizer ubsan ;;
+        --msan) enable_sanitizer msan ;;
-        --sancov) gyp_params+=(-Duse_sancov=edge); nspr_sanitizer sancov edge ;;
+        --ubsan) enable_ubsan ;;
-        --sancov=?*) gyp_params+=(-Duse_sancov="${1#*=}"); nspr_sanitizer sancov "${1#*=}" ;;
+        --ubsan=?*) enable_ubsan "${1#*=}" ;;
+        --sancov) enable_sancov ;;
+        --sancov=?*) enable_sancov "${1#*=}" ;;
         --pprof) gyp_params+=(-Duse_pprof=1) ;;
-        --msan) gyp_params+=(-Duse_msan=1); nspr_sanitizer msan ;;
+        --ct-verif) gyp_params+=(-Dct_verif=1) ;;
-        *) show_help; exit ;;
+        --disable-tests) gyp_params+=(-Ddisable_tests=1) ;;
+        --no-zdefs) gyp_params+=(-Dno_zdefs=1) ;;
+        --system-sqlite) gyp_params+=(-Duse_system_sqlite=1) ;;
+        --with-nspr=?*) set_nspr_path "${1#*=}"; no_local_nspr=1 ;;
+        --system-nspr) set_nspr_path "/usr/include/nspr/:"; no_local_nspr=1 ;;
+        --enable-libpkix) gyp_params+=(-Ddisable_libpkix=0) ;;
+        *) show_help; exit 2 ;;
     esac
     shift
 done
 
-if [ "$opt_build" = "1" ]; then
+if [ "$opt_build" = 1 ]; then
     target=Release
-    nspr_opt+=(--disable-debug --enable-optimize)
 else
     target=Debug
 fi
-if [ "$build_64" == "1" ]; then
+if [ "$build_64" = 1 ]; then
-    nspr_opt+=(--enable-64bit)
+    nspr_params+=(--enable-64bit)
-else
+elif [ ! "$armhf" = 1 ]; then
     gyp_params+=(-Dtarget_arch=ia32)
-    nspr_opt+=(--enable-x32)
 fi
-
+if [ "$fuzz" = 1 ]; then
-# clone fuzzing stuff
+    source "$cwd"/coreconf/fuzz.sh
-if [ "$fuzz" = "1" ]; then
-    [ $verbose = 0 ] && exec 3>/dev/null || exec 3>&1
-
-    echo "[1/2] Cloning libFuzzer files ..."
-    $cwd/fuzz/clone_libfuzzer.sh 1>&3 2>&3
-
-    echo "[2/2] Cloning fuzzing corpus ..."
-    $cwd/fuzz/clone_corpus.sh 1>&3 2>&3
-
-    exec 3>&-
-fi
-
-# check if we have to rebuild gyp
-if [ "$params" != "$(cat $cwd/out/config 2>/dev/null)" -o "$rebuild_gyp" == 1 -o "$clean" == 1 ]; then
-    rebuild_gyp=1
-    rm -rf "$cwd/../nspr/$target" # force NSPR to rebuild
 fi
 
 # set paths
-target_dir="$cwd/out/$target"
+target_dir="$cwd"/out/$target
-
+mkdir -p "$target_dir"
-# get the realpath of $dist_dir
+dist_dir="$cwd"/../dist
-dist_dir=$(mkdir -p $dist_dir; cd $dist_dir; pwd -P)
+dist_dir=$(mkdir -p "$dist_dir"; cd "$dist_dir"; pwd -P)
-
+gyp_params+=(-Dnss_dist_dir="$dist_dir")
-# get object directory
-obj_dir="$dist_dir/$target"
-gyp_params+=(-Dnss_dist_dir=$dist_dir)
-gyp_params+=(-Dnss_dist_obj_dir=$obj_dir)
-gyp_params+=(-Dnspr_lib_dir=$obj_dir/lib)
-gyp_params+=(-Dnspr_include_dir=$obj_dir/include/nspr)
 
 # -c = clean first
 if [ "$clean" = 1 ]; then
-    rm -rf "$cwd/out"
+    nspr_clean
-    rm -rf "$cwd/../nspr/$target"
+    rm -rf "$cwd"/out
     rm -rf "$dist_dir"
 fi
 
+# This saves a canonical representation of arguments that we are passing to gyp
+# or the NSPR build so that we can work out if a rebuild is needed.
+# Caveat: This can fail for arguments that are position-dependent.
+# e.g., "-e 2 -f 1" and "-e 1 -f 2" canonicalize the same.
+check_config()
+{
+    local newconf="$1".new oldconf="$1"
+    shift
+    mkdir -p $(dirname "$newconf")
+    echo CC="$CC" >"$newconf"
+    echo CCC="$CCC" >>"$newconf"
+    echo CXX="$CXX" >>"$newconf"
+    for i in "$@"; do echo $i; done | sort >>"$newconf"
+
+    # Note: The following diff fails if $oldconf isn't there as well, which
+    # happens if we don't have a previous successful build.
+    ! diff -q "$newconf" "$oldconf" >/dev/null 2>&1
+}
+
+gyp_config="$cwd"/out/gyp_config
+nspr_config="$cwd"/out/$target/nspr_config
+
+# If we don't have a build directory make sure that we rebuild.
+if [ ! -d "$target_dir" ]; then
+    rebuild_nspr=1
+    rebuild_gyp=1
+elif [ ! -d "$dist_dir"/$target ]; then
+    rebuild_nspr=1
+fi
+
+# Update NSPR ${C,CXX,LD}FLAGS.
+nspr_set_flags $sanitizer_flags
+
+if check_config "$nspr_config" "${nspr_params[@]}" \
+                 nspr_cflags="$nspr_cflags" \
+                 nspr_cxxflags="$nspr_cxxflags" \
+                 nspr_ldflags="$nspr_ldflags"; then
+    rebuild_nspr=1
+fi
+
+# Forward sanitizer flags.
+if [ ! -z "$sanitizer_flags" ]; then
+    gyp_params+=(-Dsanitizer_flags="$sanitizer_flags")
+fi
+
+if check_config "$gyp_config" "${gyp_params[@]}"; then
+    rebuild_gyp=1
+fi
+
 # save the chosen target
-mkdir -p $dist_dir
+mkdir -p "$dist_dir"
-echo $target > $dist_dir/latest
+echo $target > "$dist_dir"/latest
 
-# pass on CC and CCC
+if [[ "$rebuild_nspr" = 1 && "$no_local_nspr" = 0 ]]; then
-if [ "${#scanbuild[@]}" -gt 0 ]; then
+    nspr_build "${nspr_params[@]}"
-    if [ -n "$CC" ]; then
+    mv -f "$nspr_config".new "$nspr_config"
-       scanbuild+=(--use-cc="$CC")
+fi
+if [ "$rebuild_gyp" = 1 ]; then
+    if ! hash ${GYP} 2> /dev/null; then
+        echo "Please install gyp" 1>&2
+        exit 1
     fi
-    if [ -n "$CCC" ]; then
+    # These extra arguments aren't used in determining whether to rebuild.
-       scanbuild+=(--use-c++="$CCC")
+    obj_dir="$dist_dir"/$target
+    gyp_params+=(-Dnss_dist_obj_dir=$obj_dir)
+    if [ "$no_local_nspr" = 0 ]; then
+        set_nspr_path "$obj_dir/include/nspr:$obj_dir/lib"
     fi
- fi
 
-# These steps can take a while, so don't overdo them.
+    run_verbose run_scanbuild ${GYP} -f ninja "${gyp_params[@]}" "$cwd"/nss.gyp
-# Force a redo with -g.
-if [ "$rebuild_gyp" = 1 -o ! -d "$target_dir" ]; then
-    build_nspr $verbose
 
-    # Run gyp.
+    mv -f "$gyp_config".new "$gyp_config"
-    [ $verbose = 1 ] && set -v -x
-    "${scanbuild[@]}" gyp -f ninja "${gyp_params[@]}" --depth="$cwd" \
-      --generator-output="." "$cwd/nss.gyp"
-    [ $verbose = 1 ] && set +v +x
-
-    # Store used parameters for next run.
-    echo "$params" > "$cwd/out/config"
 fi
 
 # Run ninja.
-if which ninja >/dev/null 2>&1; then
+if hash ninja 2>/dev/null; then
-    ninja=(ninja)
+    ninja=ninja
-elif which ninja-build >/dev/null 2>&1; then
+elif hash ninja-build 2>/dev/null; then
-    ninja=(ninja-build)
+    ninja=ninja-build
 else
     echo "Please install ninja" 1>&2
     exit 1
 fi
-"${scanbuild[@]}" $ninja -C "$target_dir" "${ninja_params[@]}"
+run_scanbuild $ninja -C "$target_dir" "${ninja_params[@]}"

security/nss/cmd/addbuiltin/addbuiltin.c

@@ -31,6 +31,29 @@ dumpbytes(unsigned char *buf, int len)
     printf("\n");
 }
 
+int
+hasPositiveTrust(unsigned int trust)
+{
+    if (trust & CERTDB_TRUSTED) {
+        if (trust & CERTDB_TRUSTED_CA) {
+            return PR_TRUE;
+        } else {
+            return PR_FALSE;
+        }
+    } else {
+        if (trust & CERTDB_TRUSTED_CA) {
+            return PR_TRUE;
+        } else if (trust & CERTDB_VALID_CA) {
+            return PR_TRUE;
+        } else if (trust & CERTDB_TERMINAL_RECORD) {
+            return PR_FALSE;
+        } else {
+            return PR_FALSE;
+        }
+    }
+    return PR_FALSE;
+}
+
 char *
 getTrustString(unsigned int trust)
 {
@@ -202,6 +225,11 @@ ConvertCertificate(SECItem *sdder, char *nickname, CERTCertTrust *trust,
         printf("CKA_VALUE MULTILINE_OCTAL\n");
         dumpbytes(sdder->data, sdder->len);
         printf("END\n");
+        if (hasPositiveTrust(trust->sslFlags) ||
+            hasPositiveTrust(trust->emailFlags) ||
+            hasPositiveTrust(trust->objectSigningFlags)) {
+            printf("CKA_NSS_MOZILLA_CA_POLICY CK_BBOOL CK_TRUE\n");
+        }
     }
 
     if ((trust->sslFlags | trust->emailFlags | trust->objectSigningFlags) ==

security/nss/cmd/bltest/blapitest.c

@@ -917,6 +917,7 @@ setupIO(PLArenaPool *arena, bltestIO *input, PRFileDesc *file,
     SECItem *in;
     unsigned char *tok;
     unsigned int i, j;
+    PRBool needToFreeFile = PR_FALSE;
 
     if (file && (numBytes == 0 || file == PR_STDIN)) {
         /* grabbing data from a file */
@@ -924,6 +925,7 @@ setupIO(PLArenaPool *arena, bltestIO *input, PRFileDesc *file,
         if (rv != SECSuccess)
             return SECFailure;
         in = &fileData;
+        needToFreeFile = PR_TRUE;
     } else if (str) {
         /* grabbing data from command line */
         fileData.data = (unsigned char *)str;
@@ -957,10 +959,7 @@ setupIO(PLArenaPool *arena, bltestIO *input, PRFileDesc *file,
                 --in->len;
             if (in->data[in->len - 1] == '\r')
                 --in->len;
-            SECITEM_CopyItem(arena, &input->buf, in);
+            rv = SECITEM_CopyItem(arena, &input->buf, in);
-            if (rv != SECSuccess) {
-                return SECFailure;
-            }
             break;
         case bltestHexSpaceDelim:
             SECITEM_AllocItem(arena, &input->buf, in->len / 5);
@@ -986,7 +985,7 @@ setupIO(PLArenaPool *arena, bltestIO *input, PRFileDesc *file,
             break;
     }
 
-    if (file)
+    if (needToFreeFile)
         SECITEM_FreeItem(&fileData, PR_FALSE);
     return rv;
 }

security/nss/cmd/certutil/certext.c

@@ -980,8 +980,6 @@ AddNameConstraints(void *extHandle)
             GEN_BREAK(SECFailure);
         }
 
-        (void)SEC_ASN1EncodeInteger(arena, &current->min, 0);
-
         if (!GetGeneralName(arena, &current->name, PR_TRUE)) {
             GEN_BREAK(SECFailure);
         }

security/nss/cmd/certutil/certutil.c

@@ -1002,9 +1002,12 @@ ListModules(void)
 
     /* look at each slot*/
     for (le = list->head; le; le = le->next) {
+        char *token_uri = PK11_GetTokenURI(le->slot);
         printf("\n");
         printf("    slot: %s\n", PK11_GetSlotName(le->slot));
         printf("   token: %s\n", PK11_GetTokenName(le->slot));
+        printf("     uri: %s\n", token_uri);
+        PORT_Free(token_uri);
     }
     PK11_FreeSlotList(list);
 

security/nss/cmd/certutil/keystuff.c

@@ -17,14 +17,6 @@
 #include <conio.h>
 #endif
 
-#if defined(__sun) && !defined(SVR4)
-extern int fclose(FILE *);
-extern int fprintf(FILE *, char *, ...);
-extern int isatty(int);
-extern char *sys_errlist[];
-#define strerror(errno) sys_errlist[errno]
-#endif
-
 #include "nspr.h"
 #include "prtypes.h"
 #include "prtime.h"
@@ -52,9 +44,10 @@ static int
 UpdateRNG(void)
 {
     char randbuf[RAND_BUF_SIZE];
-    int fd, count;
+    int fd;
     int c;
     int rv = 0;
+    size_t count;
 #ifdef XP_UNIX
     cc_t orig_cc_min;
     cc_t orig_cc_time;

security/nss/cmd/crlutil/crlutil.c

@@ -66,8 +66,11 @@ FindCRL(CERTCertDBHandle *certHandle, char *name, int type)
             return ((CERTSignedCrl *)NULL);
         }
     } else {
-        SECITEM_CopyItem(NULL, &derName, &cert->derSubject);
+        SECStatus rv = SECITEM_CopyItem(NULL, &derName, &cert->derSubject);
         CERT_DestroyCertificate(cert);
+        if (rv != SECSuccess) {
+            return ((CERTSignedCrl *)NULL);
+        }
     }
 
     crl = SEC_FindCrlByName(certHandle, &derName, type);

security/nss/cmd/crmftest/testcrmf.c

@@ -1261,11 +1261,13 @@ DoChallengeResponse(SECKEYPrivateKey *privKey,
             return 908;
         }
         keyID = PK11_MakeIDFromPubKey(publicValue);
+        SECITEM_FreeItem(publicValue, PR_TRUE);
         if (keyID == NULL) {
             printf("Could not make the keyID from the public value\n");
             return 909;
         }
         foundPrivKey = PK11_FindKeyByKeyID(privKey->pkcs11Slot, keyID, &pwdata);
+        SECITEM_FreeItem(keyID, PR_TRUE);
         if (foundPrivKey == NULL) {
             printf("Could not find the private key corresponding to the public"
                    " value.\n");

security/nss/cmd/ecperf/ecperf.c

@@ -9,7 +9,6 @@
 #include "basicutil.h"
 #include "pkcs11.h"
 #include "nspr.h"
-#include "secutil.h"
 #include <stdio.h>
 
 #define __PASTE(x, y) x##y
@@ -27,70 +26,6 @@
 
 #include "pkcs11f.h"
 
-/* mapping between ECCurveName enum and pointers to ECCurveParams */
-static SECOidTag ecCurve_oid_map[] = {
-    SEC_OID_UNKNOWN,                /* ECCurve_noName */
-    SEC_OID_ANSIX962_EC_PRIME192V1, /* ECCurve_NIST_P192 */
-    SEC_OID_SECG_EC_SECP224R1,      /* ECCurve_NIST_P224 */
-    SEC_OID_ANSIX962_EC_PRIME256V1, /* ECCurve_NIST_P256 */
-    SEC_OID_SECG_EC_SECP384R1,      /* ECCurve_NIST_P384 */
-    SEC_OID_SECG_EC_SECP521R1,      /* ECCurve_NIST_P521 */
-    SEC_OID_SECG_EC_SECT163K1,      /* ECCurve_NIST_K163 */
-    SEC_OID_SECG_EC_SECT163R1,      /* ECCurve_NIST_B163 */
-    SEC_OID_SECG_EC_SECT233K1,      /* ECCurve_NIST_K233 */
-    SEC_OID_SECG_EC_SECT233R1,      /* ECCurve_NIST_B233 */
-    SEC_OID_SECG_EC_SECT283K1,      /* ECCurve_NIST_K283 */
-    SEC_OID_SECG_EC_SECT283R1,      /* ECCurve_NIST_B283 */
-    SEC_OID_SECG_EC_SECT409K1,      /* ECCurve_NIST_K409 */
-    SEC_OID_SECG_EC_SECT409R1,      /* ECCurve_NIST_B409 */
-    SEC_OID_SECG_EC_SECT571K1,      /* ECCurve_NIST_K571 */
-    SEC_OID_SECG_EC_SECT571R1,      /* ECCurve_NIST_B571 */
-    SEC_OID_ANSIX962_EC_PRIME192V2,
-    SEC_OID_ANSIX962_EC_PRIME192V3,
-    SEC_OID_ANSIX962_EC_PRIME239V1,
-    SEC_OID_ANSIX962_EC_PRIME239V2,
-    SEC_OID_ANSIX962_EC_PRIME239V3,
-    SEC_OID_ANSIX962_EC_C2PNB163V1,
-    SEC_OID_ANSIX962_EC_C2PNB163V2,
-    SEC_OID_ANSIX962_EC_C2PNB163V3,
-    SEC_OID_ANSIX962_EC_C2PNB176V1,
-    SEC_OID_ANSIX962_EC_C2TNB191V1,
-    SEC_OID_ANSIX962_EC_C2TNB191V2,
-    SEC_OID_ANSIX962_EC_C2TNB191V3,
-    SEC_OID_ANSIX962_EC_C2PNB208W1,
-    SEC_OID_ANSIX962_EC_C2TNB239V1,
-    SEC_OID_ANSIX962_EC_C2TNB239V2,
-    SEC_OID_ANSIX962_EC_C2TNB239V3,
-    SEC_OID_ANSIX962_EC_C2PNB272W1,
-    SEC_OID_ANSIX962_EC_C2PNB304W1,
-    SEC_OID_ANSIX962_EC_C2TNB359V1,
-    SEC_OID_ANSIX962_EC_C2PNB368W1,
-    SEC_OID_ANSIX962_EC_C2TNB431R1,
-    SEC_OID_SECG_EC_SECP112R1,
-    SEC_OID_SECG_EC_SECP112R2,
-    SEC_OID_SECG_EC_SECP128R1,
-    SEC_OID_SECG_EC_SECP128R2,
-    SEC_OID_SECG_EC_SECP160K1,
-    SEC_OID_SECG_EC_SECP160R1,
-    SEC_OID_SECG_EC_SECP160R2,
-    SEC_OID_SECG_EC_SECP192K1,
-    SEC_OID_SECG_EC_SECP224K1,
-    SEC_OID_SECG_EC_SECP256K1,
-    SEC_OID_SECG_EC_SECT113R1,
-    SEC_OID_SECG_EC_SECT113R2,
-    SEC_OID_SECG_EC_SECT131R1,
-    SEC_OID_SECG_EC_SECT131R2,
-    SEC_OID_SECG_EC_SECT163R1,
-    SEC_OID_SECG_EC_SECT193R1,
-    SEC_OID_SECG_EC_SECT193R2,
-    SEC_OID_SECG_EC_SECT239K1,
-    SEC_OID_UNKNOWN, /* ECCurve_WTLS_1 */
-    SEC_OID_UNKNOWN, /* ECCurve_WTLS_8 */
-    SEC_OID_UNKNOWN, /* ECCurve_WTLS_9 */
-    SEC_OID_CURVE25519,
-    SEC_OID_UNKNOWN /* ECCurve_pastLastCurve */
-};
-
 typedef SECStatus (*op_func)(void *, void *, void *);
 typedef SECStatus (*pk11_op_func)(CK_SESSION_HANDLE, void *, void *, void *);
 
@@ -106,6 +41,8 @@ typedef struct ThreadDataStr {
     int isSign;
 } ThreadData;
 
+typedef SECItem SECKEYECParams;
+
 void
 PKCS11Thread(void *data)
 {
@@ -373,30 +310,6 @@ PKCS11_Verify(CK_SESSION_HANDLE session, CK_OBJECT_HANDLE *hKey,
     return SECSuccess;
 }
 
-static SECStatus
-ecName2params(ECCurveName curve, SECKEYECParams *params)
-{
-    SECOidData *oidData = NULL;
-
-    if ((curve < ECCurve_noName) || (curve > ECCurve_pastLastCurve) ||
-        ((oidData = SECOID_FindOIDByTag(ecCurve_oid_map[curve])) == NULL)) {
-        PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);
-        return SECFailure;
-    }
-
-    SECITEM_AllocItem(NULL, params, (2 + oidData->oid.len));
-    /*
-     * params->data needs to contain the ASN encoding of an object ID (OID)
-     * representing the named curve. The actual OID is in
-     * oidData->oid.data so we simply prepend 0x06 and OID length
-     */
-    params->data[0] = SEC_ASN1_OBJECT_ID;
-    params->data[1] = oidData->oid.len;
-    memcpy(params->data + 2, oidData->oid.data, oidData->oid.len);
-
-    return SECSuccess;
-}
-
 /* Performs basic tests of elliptic curve cryptography over prime fields.
  * If tests fail, then it prints an error message, aborts, and returns an
  * error code. Otherwise, returns 0. */
@@ -422,7 +335,7 @@ ectest_curve_pkcs11(ECCurveName curve, int iterations, int numThreads)
 
     ecParams.data = NULL;
     ecParams.len = 0;
-    rv = ecName2params(curve, &ecParams);
+    rv = SECU_ecName2params(curve, &ecParams);
     if (rv != SECSuccess) {
         goto cleanup;
     }
@@ -541,9 +454,9 @@ ectest_curve_freebl(ECCurveName curve, int iterations, int numThreads,
     unsigned char sigData[256];
     unsigned char digestData[20];
     double signRate, deriveRate = 0;
-    char genenc[3 + 2 * 2 * MAX_ECKEY_LEN];
     SECStatus rv = SECFailure;
     PLArenaPool *arena;
+    SECItem ecEncodedParams = { siBuffer, NULL, 0 };
 
     arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
     if (!arena) {
@@ -555,28 +468,11 @@ ectest_curve_freebl(ECCurveName curve, int iterations, int numThreads,
         return SECFailure;
     }
 
-    ecParams.name = curve;
+    rv = SECU_ecName2params(curve, &ecEncodedParams);
-    ecParams.type = ec_params_named;
+    if (rv != SECSuccess) {
-    ecParams.curveOID.data = NULL;
+        goto cleanup;
-    ecParams.curveOID.len = 0;
+    }
-    ecParams.curve.seed.data = NULL;
+    EC_FillParams(arena, &ecEncodedParams, &ecParams);
-    ecParams.curve.seed.len = 0;
-    ecParams.DEREncoding.data = NULL;
-    ecParams.DEREncoding.len = 0;
-
-    ecParams.fieldID.size = ecCurve_map[curve]->size;
-    ecParams.fieldID.type = fieldType;
-    SECU_HexString2SECItem(arena, &ecParams.fieldID.u.prime, ecCurve_map[curve]->irr);
-    SECU_HexString2SECItem(arena, &ecParams.curve.a, ecCurve_map[curve]->curvea);
-    SECU_HexString2SECItem(arena, &ecParams.curve.b, ecCurve_map[curve]->curveb);
-    genenc[0] = '0';
-    genenc[1] = '4';
-    genenc[2] = '\0';
-    strcat(genenc, ecCurve_map[curve]->genx);
-    strcat(genenc, ecCurve_map[curve]->geny);
-    SECU_HexString2SECItem(arena, &ecParams.base, genenc);
-    SECU_HexString2SECItem(arena, &ecParams.order, ecCurve_map[curve]->order);
-    ecParams.cofactor = ecCurve_map[curve]->cofactor;
 
     PORT_Memset(digestData, 0xa5, sizeof(digestData));
     digest.data = digestData;
@@ -586,7 +482,7 @@ ectest_curve_freebl(ECCurveName curve, int iterations, int numThreads,
 
     rv = EC_NewKey(&ecParams, &ecPriv);
     if (rv != SECSuccess) {
-        return SECFailure;
+        goto cleanup;
     }
     ecPub.ecParams = ecParams;
     ecPub.publicValue = ecPriv->publicValue;
@@ -617,8 +513,11 @@ ectest_curve_freebl(ECCurveName curve, int iterations, int numThreads,
     }
 
 cleanup:
+    SECITEM_FreeItem(&ecEncodedParams, PR_FALSE);
     PORT_FreeArena(arena, PR_FALSE);
-    PORT_FreeArena(ecPriv->ecParams.arena, PR_FALSE);
+    if (ecPriv) {
+        PORT_FreeArena(ecPriv->ecParams.arena, PR_FALSE);
+    }
     return rv;
 }
 

security/nss/cmd/fbectest/fbectest.c

@@ -9,7 +9,6 @@
 #include "basicutil.h"
 #include "secder.h"
 #include "secitem.h"
-#include "secutil.h"
 #include "nspr.h"
 #include <stdio.h>
 
@@ -89,26 +88,19 @@ ectest_ecdh_kat(ECDH_KAT *kat)
     SECItem answer = { siBuffer, NULL, 0 };
     SECItem answer2 = { siBuffer, NULL, 0 };
     SECItem derived = { siBuffer, NULL, 0 };
-    char genenc[3 + 2 * 2 * MAX_ECKEY_LEN];
+    SECItem ecEncodedParams = { siBuffer, NULL, 0 };
     int i;
 
-    rv = init_params(&ecParams, curve, &arena, kat->fieldType);
+    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
-    if (rv != SECSuccess) {
+    if (!arena) {
-        return rv;
+        return SECFailure;
     }
 
-    SECU_HexString2SECItem(arena, &ecParams.fieldID.u.prime, ecCurve_map[curve]->irr);
+    rv = SECU_ecName2params(curve, &ecEncodedParams);
-    SECU_HexString2SECItem(arena, &ecParams.curve.a, ecCurve_map[curve]->curvea);
+    if (rv != SECSuccess) {
-    SECU_HexString2SECItem(arena, &ecParams.curve.b, ecCurve_map[curve]->curveb);
+        goto cleanup;
-    genenc[0] = '0';
+    }
-    genenc[1] = '4';
+    EC_FillParams(arena, &ecEncodedParams, &ecParams);
-    genenc[2] = '\0';
-    PORT_Assert(PR_ARRAY_SIZE(genenc) >= PORT_Strlen(ecCurve_map[curve]->genx));
-    PORT_Assert(PR_ARRAY_SIZE(genenc) >= PORT_Strlen(ecCurve_map[curve]->geny));
-    strcat(genenc, ecCurve_map[curve]->genx);
-    strcat(genenc, ecCurve_map[curve]->geny);
-    SECU_HexString2SECItem(arena, &ecParams.base, genenc);
-    SECU_HexString2SECItem(arena, &ecParams.order, ecCurve_map[curve]->order);
 
     if (kat->our_pubhex) {
         SECU_HexString2SECItem(arena, &answer, kat->our_pubhex);
@@ -162,6 +154,7 @@ ectest_ecdh_kat(ECDH_KAT *kat)
     }
 
 cleanup:
+    SECITEM_FreeItem(&ecEncodedParams, PR_FALSE);
     PORT_FreeArena(arena, PR_FALSE);
     if (ecPriv) {
         PORT_FreeArena(ecPriv->ecParams.arena, PR_FALSE);

security/nss/cmd/lib/basicutil.c

@@ -25,7 +25,6 @@
 #endif
 
 #include "secoid.h"
-#include "sslt.h"
 
 extern long DER_GetInteger(const SECItem *src);
 
@@ -733,97 +732,135 @@ SECU_SECItemHexStringToBinary(SECItem *srcdest)
     return SECSuccess;
 }
 
-SSLNamedGroup
+SECItem *
-groupNameToNamedGroup(char *name)
+SECU_HexString2SECItem(PLArenaPool *arena, SECItem *item, const char *str)
 {
-    if (PL_strlen(name) == 4) {
+    int i = 0;
-        if (!strncmp(name, "P256", 4)) {
+    int byteval = 0;
-            return ssl_grp_ec_secp256r1;
+    int tmp = PORT_Strlen(str);
-        }
+
-        if (!strncmp(name, "P384", 4)) {
+    PORT_Assert(arena);
-            return ssl_grp_ec_secp384r1;
+    PORT_Assert(item);
-        }
+
-        if (!strncmp(name, "P521", 4)) {
+    if ((tmp % 2) != 0) {
-            return ssl_grp_ec_secp521r1;
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
-        }
+        return NULL;
-    }
-    if (PL_strlen(name) == 6) {
-        if (!strncmp(name, "x25519", 6)) {
-            return ssl_grp_ec_curve25519;
-        }
-        if (!strncmp(name, "FF2048", 6)) {
-            return ssl_grp_ffdhe_2048;
-        }
-        if (!strncmp(name, "FF3072", 6)) {
-            return ssl_grp_ffdhe_3072;
-        }
-        if (!strncmp(name, "FF4096", 6)) {
-            return ssl_grp_ffdhe_4096;
-        }
-        if (!strncmp(name, "FF6144", 6)) {
-            return ssl_grp_ffdhe_6144;
-        }
-        if (!strncmp(name, "FF8192", 6)) {
-            return ssl_grp_ffdhe_8192;
-        }
     }
 
-    return ssl_grp_none;
+    item = SECITEM_AllocItem(arena, item, tmp / 2);
+    if (item == NULL) {
+        return NULL;
+    }
+
+    while (str[i]) {
+        if ((str[i] >= '0') && (str[i] <= '9')) {
+            tmp = str[i] - '0';
+        } else if ((str[i] >= 'a') && (str[i] <= 'f')) {
+            tmp = str[i] - 'a' + 10;
+        } else if ((str[i] >= 'A') && (str[i] <= 'F')) {
+            tmp = str[i] - 'A' + 10;
+        } else {
+            /* item is in arena and gets freed by the caller */
+            return NULL;
+        }
+
+        byteval = byteval * 16 + tmp;
+        if ((i % 2) != 0) {
+            item->data[i / 2] = byteval;
+            byteval = 0;
+        }
+        i++;
+    }
+
+    return item;
 }
 
+/* mapping between ECCurveName enum and SECOidTags */
+static SECOidTag ecCurve_oid_map[] = {
+    SEC_OID_UNKNOWN,                /* ECCurve_noName */
+    SEC_OID_ANSIX962_EC_PRIME192V1, /* ECCurve_NIST_P192 */
+    SEC_OID_SECG_EC_SECP224R1,      /* ECCurve_NIST_P224 */
+    SEC_OID_ANSIX962_EC_PRIME256V1, /* ECCurve_NIST_P256 */
+    SEC_OID_SECG_EC_SECP384R1,      /* ECCurve_NIST_P384 */
+    SEC_OID_SECG_EC_SECP521R1,      /* ECCurve_NIST_P521 */
+    SEC_OID_SECG_EC_SECT163K1,      /* ECCurve_NIST_K163 */
+    SEC_OID_SECG_EC_SECT163R1,      /* ECCurve_NIST_B163 */
+    SEC_OID_SECG_EC_SECT233K1,      /* ECCurve_NIST_K233 */
+    SEC_OID_SECG_EC_SECT233R1,      /* ECCurve_NIST_B233 */
+    SEC_OID_SECG_EC_SECT283K1,      /* ECCurve_NIST_K283 */
+    SEC_OID_SECG_EC_SECT283R1,      /* ECCurve_NIST_B283 */
+    SEC_OID_SECG_EC_SECT409K1,      /* ECCurve_NIST_K409 */
+    SEC_OID_SECG_EC_SECT409R1,      /* ECCurve_NIST_B409 */
+    SEC_OID_SECG_EC_SECT571K1,      /* ECCurve_NIST_K571 */
+    SEC_OID_SECG_EC_SECT571R1,      /* ECCurve_NIST_B571 */
+    SEC_OID_ANSIX962_EC_PRIME192V2,
+    SEC_OID_ANSIX962_EC_PRIME192V3,
+    SEC_OID_ANSIX962_EC_PRIME239V1,
+    SEC_OID_ANSIX962_EC_PRIME239V2,
+    SEC_OID_ANSIX962_EC_PRIME239V3,
+    SEC_OID_ANSIX962_EC_C2PNB163V1,
+    SEC_OID_ANSIX962_EC_C2PNB163V2,
+    SEC_OID_ANSIX962_EC_C2PNB163V3,
+    SEC_OID_ANSIX962_EC_C2PNB176V1,
+    SEC_OID_ANSIX962_EC_C2TNB191V1,
+    SEC_OID_ANSIX962_EC_C2TNB191V2,
+    SEC_OID_ANSIX962_EC_C2TNB191V3,
+    SEC_OID_ANSIX962_EC_C2PNB208W1,
+    SEC_OID_ANSIX962_EC_C2TNB239V1,
+    SEC_OID_ANSIX962_EC_C2TNB239V2,
+    SEC_OID_ANSIX962_EC_C2TNB239V3,
+    SEC_OID_ANSIX962_EC_C2PNB272W1,
+    SEC_OID_ANSIX962_EC_C2PNB304W1,
+    SEC_OID_ANSIX962_EC_C2TNB359V1,
+    SEC_OID_ANSIX962_EC_C2PNB368W1,
+    SEC_OID_ANSIX962_EC_C2TNB431R1,
+    SEC_OID_SECG_EC_SECP112R1,
+    SEC_OID_SECG_EC_SECP112R2,
+    SEC_OID_SECG_EC_SECP128R1,
+    SEC_OID_SECG_EC_SECP128R2,
+    SEC_OID_SECG_EC_SECP160K1,
+    SEC_OID_SECG_EC_SECP160R1,
+    SEC_OID_SECG_EC_SECP160R2,
+    SEC_OID_SECG_EC_SECP192K1,
+    SEC_OID_SECG_EC_SECP224K1,
+    SEC_OID_SECG_EC_SECP256K1,
+    SEC_OID_SECG_EC_SECT113R1,
+    SEC_OID_SECG_EC_SECT113R2,
+    SEC_OID_SECG_EC_SECT131R1,
+    SEC_OID_SECG_EC_SECT131R2,
+    SEC_OID_SECG_EC_SECT163R1,
+    SEC_OID_SECG_EC_SECT193R1,
+    SEC_OID_SECG_EC_SECT193R2,
+    SEC_OID_SECG_EC_SECT239K1,
+    SEC_OID_UNKNOWN, /* ECCurve_WTLS_1 */
+    SEC_OID_UNKNOWN, /* ECCurve_WTLS_8 */
+    SEC_OID_UNKNOWN, /* ECCurve_WTLS_9 */
+    SEC_OID_CURVE25519,
+    SEC_OID_UNKNOWN /* ECCurve_pastLastCurve */
+};
+
 SECStatus
-parseGroupList(const char *arg, SSLNamedGroup **enabledGroups,
+SECU_ecName2params(ECCurveName curve, SECItem *params)
-               unsigned int *enabledGroupsCount)
 {
-    SSLNamedGroup *groups;
+    SECOidData *oidData = NULL;
-    char *str;
-    char *p;
-    unsigned int numValues = 0;
-    unsigned int count = 0;
 
-    /* Count the number of groups. */
+    if ((curve < ECCurve_noName) || (curve > ECCurve_pastLastCurve) ||
-    str = PORT_Strdup(arg);
+        ((oidData = SECOID_FindOIDByTag(ecCurve_oid_map[curve])) == NULL)) {
-    if (!str) {
+        PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);
-        return SECFailure;
-    }
-    p = strtok(str, ",");
-    while (p) {
-        ++numValues;
-        p = strtok(NULL, ",");
-    }
-    PORT_Free(str);
-    str = NULL;
-    groups = PORT_ZNewArray(SSLNamedGroup, numValues);
-    if (!groups) {
-        goto done;
-    }
-
-    /* Get group names. */
-    str = PORT_Strdup(arg);
-    if (!str) {
-        goto done;
-    }
-    p = strtok(str, ",");
-    while (p) {
-        SSLNamedGroup group = groupNameToNamedGroup(p);
-        if (group == ssl_grp_none) {
-            count = 0;
-            goto done;
-        }
-        groups[count++] = group;
-        p = strtok(NULL, ",");
-    }
-
-done:
-    if (str) {
-        PORT_Free(str);
-    }
-    if (!count) {
-        PORT_Free(groups);
         return SECFailure;
     }
 
-    *enabledGroupsCount = count;
+    if (SECITEM_AllocItem(NULL, params, (2 + oidData->oid.len)) == NULL) {
-    *enabledGroups = groups;
+        return SECFailure;
+    }
+    /*
+     * params->data needs to contain the ASN encoding of an object ID (OID)
+     * representing the named curve. The actual OID is in
+     * oidData->oid.data so we simply prepend 0x06 and OID length
+     */
+    params->data[0] = SEC_ASN1_OBJECT_ID;
+    params->data[1] = oidData->oid.len;
+    memcpy(params->data + 2, oidData->oid.data, oidData->oid.len);
+
     return SECSuccess;
 }

security/nss/cmd/lib/basicutil.h

@@ -13,7 +13,7 @@
 #include "base64.h"
 #include "secasn1.h"
 #include "secder.h"
-#include "sslt.h"
+#include "ecl-exp.h"
 #include <stdio.h>
 
 #ifdef SECUTIL_NEW
@@ -81,6 +81,14 @@ SECU_SECItemToHex(const SECItem *item, char *dst);
 SECStatus
 SECU_SECItemHexStringToBinary(SECItem *srcdest);
 
+/*
+** Read a hex string into a SecItem.
+*/
+extern SECItem *SECU_HexString2SECItem(PLArenaPool *arena, SECItem *item,
+                                       const char *str);
+
+extern SECStatus SECU_ecName2params(ECCurveName curve, SECItem *params);
+
 /*
  *
  *  Utilities for parsing security tools command lines
@@ -113,10 +121,6 @@ SECU_ParseCommandLine(int argc, char **argv, char *progName,
 char *
 SECU_GetOptionArg(const secuCommand *cmd, int optionNum);
 
-SECStatus parseGroupList(const char *arg, SSLNamedGroup **enabledGroups,
-                         unsigned int *enabledGroupsCount);
-SSLNamedGroup groupNameToNamedGroup(char *name);
-
 /*
  *
  *  Error messaging

security/nss/cmd/lib/secutil.c

@@ -32,7 +32,7 @@
 #include "certt.h"
 #include "certdb.h"
 
-/* #include "secmod.h" */
+#include "secmod.h"
 #include "pk11func.h"
 #include "secoid.h"
 
@@ -3229,6 +3229,10 @@ SEC_PrintCertificateAndTrust(CERTCertificate *cert,
     SECStatus rv;
     SECItem data;
     CERTCertTrust certTrust;
+    PK11SlotList *slotList;
+    PRBool falseAttributeFound = PR_FALSE;
+    PRBool trueAttributeFound = PR_FALSE;
+    const char *moz_policy_ca_info = NULL;
 
     data.data = cert->derCert.data;
     data.len = cert->derCert.len;
@@ -3238,6 +3242,35 @@ SEC_PrintCertificateAndTrust(CERTCertificate *cert,
     if (rv) {
         return (SECFailure);
     }
+
+    slotList = PK11_GetAllSlotsForCert(cert, NULL);
+    if (slotList) {
+        PK11SlotListElement *se = PK11_GetFirstSafe(slotList);
+        for (; se; se = PK11_GetNextSafe(slotList, se, PR_FALSE)) {
+            CK_OBJECT_HANDLE handle = PK11_FindCertInSlot(se->slot, cert, NULL);
+            if (handle != CK_INVALID_HANDLE) {
+                PORT_SetError(0);
+                if (PK11_HasAttributeSet(se->slot, handle,
+                                         CKA_NSS_MOZILLA_CA_POLICY, PR_FALSE)) {
+                    trueAttributeFound = PR_TRUE;
+                } else if (!PORT_GetError()) {
+                    falseAttributeFound = PR_TRUE;
+                }
+            }
+        }
+        PK11_FreeSlotList(slotList);
+    }
+
+    if (trueAttributeFound) {
+        moz_policy_ca_info = "true (attribute present)";
+    } else if (falseAttributeFound) {
+        moz_policy_ca_info = "false (attribute present)";
+    } else {
+        moz_policy_ca_info = "false (attribute missing)";
+    }
+    SECU_Indent(stdout, 1);
+    printf("Mozilla-CA-Policy: %s\n", moz_policy_ca_info);
+
     if (trust) {
         SECU_PrintTrustFlags(stdout, trust,
                              "Certificate Trust Flags", 1);
@@ -3833,45 +3866,97 @@ SECU_ParseSSLVersionRangeString(const char *input,
     return SECSuccess;
 }
 
-SECItem *
+SSLNamedGroup
-SECU_HexString2SECItem(PLArenaPool *arena, SECItem *item, const char *str)
+groupNameToNamedGroup(char *name)
 {
-    int i = 0;
+    if (PL_strlen(name) == 4) {
-    int byteval = 0;
+        if (!strncmp(name, "P256", 4)) {
-    int tmp = PORT_Strlen(str);
+            return ssl_grp_ec_secp256r1;
-
-    PORT_Assert(arena);
-    PORT_Assert(item);
-
-    if ((tmp % 2) != 0) {
-        PORT_SetError(SEC_ERROR_INVALID_ARGS);
-        return NULL;
-    }
-
-    item = SECITEM_AllocItem(arena, item, tmp / 2);
-    if (item == NULL) {
-        return NULL;
-    }
-
-    while (str[i]) {
-        if ((str[i] >= '0') && (str[i] <= '9')) {
-            tmp = str[i] - '0';
-        } else if ((str[i] >= 'a') && (str[i] <= 'f')) {
-            tmp = str[i] - 'a' + 10;
-        } else if ((str[i] >= 'A') && (str[i] <= 'F')) {
-            tmp = str[i] - 'A' + 10;
-        } else {
-            /* item is in arena and gets freed by the caller */
-            return NULL;
         }
-
+        if (!strncmp(name, "P384", 4)) {
-        byteval = byteval * 16 + tmp;
+            return ssl_grp_ec_secp384r1;
-        if ((i % 2) != 0) {
+        }
-            item->data[i / 2] = byteval;
+        if (!strncmp(name, "P521", 4)) {
-            byteval = 0;
+            return ssl_grp_ec_secp521r1;
+        }
+    }
+    if (PL_strlen(name) == 6) {
+        if (!strncmp(name, "x25519", 6)) {
+            return ssl_grp_ec_curve25519;
+        }
+        if (!strncmp(name, "FF2048", 6)) {
+            return ssl_grp_ffdhe_2048;
+        }
+        if (!strncmp(name, "FF3072", 6)) {
+            return ssl_grp_ffdhe_3072;
+        }
+        if (!strncmp(name, "FF4096", 6)) {
+            return ssl_grp_ffdhe_4096;
+        }
+        if (!strncmp(name, "FF6144", 6)) {
+            return ssl_grp_ffdhe_6144;
+        }
+        if (!strncmp(name, "FF8192", 6)) {
+            return ssl_grp_ffdhe_8192;
         }
-        i++;
     }
 
-    return item;
+    return ssl_grp_none;
+}
+
+SECStatus
+parseGroupList(const char *arg, SSLNamedGroup **enabledGroups,
+               unsigned int *enabledGroupsCount)
+{
+    SSLNamedGroup *groups;
+    char *str;
+    char *p;
+    unsigned int numValues = 0;
+    unsigned int count = 0;
+
+    /* Count the number of groups. */
+    str = PORT_Strdup(arg);
+    if (!str) {
+        return SECFailure;
+    }
+    p = strtok(str, ",");
+    while (p) {
+        ++numValues;
+        p = strtok(NULL, ",");
+    }
+    PORT_Free(str);
+    str = NULL;
+    groups = PORT_ZNewArray(SSLNamedGroup, numValues);
+    if (!groups) {
+        goto done;
+    }
+
+    /* Get group names. */
+    str = PORT_Strdup(arg);
+    if (!str) {
+        goto done;
+    }
+    p = strtok(str, ",");
+    while (p) {
+        SSLNamedGroup group = groupNameToNamedGroup(p);
+        if (group == ssl_grp_none) {
+            count = 0;
+            goto done;
+        }
+        groups[count++] = group;
+        p = strtok(NULL, ",");
+    }
+
+done:
+    if (str) {
+        PORT_Free(str);
+    }
+    if (!count) {
+        PORT_Free(groups);
+        return SECFailure;
+    }
+
+    *enabledGroupsCount = count;
+    *enabledGroups = groups;
+    return SECSuccess;
 }

security/nss/cmd/lib/secutil.h

@@ -18,6 +18,7 @@
 #include "basicutil.h"
 #include "sslerr.h"
 #include "sslt.h"
+#include "blapi.h"
 
 #define SEC_CT_PRIVATE_KEY "private-key"
 #define SEC_CT_PUBLIC_KEY "public-key"
@@ -402,11 +403,10 @@ SECStatus
 SECU_ParseSSLVersionRangeString(const char *input,
                                 const SSLVersionRange defaultVersionRange,
                                 SSLVersionRange *vrange);
-/*
+
-** Read a hex string into a SecItem.
+SECStatus parseGroupList(const char *arg, SSLNamedGroup **enabledGroups,
-*/
+                         unsigned int *enabledGroupsCount);
-extern SECItem *SECU_HexString2SECItem(PLArenaPool *arena, SECItem *item,
+SSLNamedGroup groupNameToNamedGroup(char *name);
-                                       const char *str);
 
 /*
  *

security/nss/cmd/lowhashtest/manifest.mn

@@ -22,3 +22,4 @@ CSRCS = \
 	lowhashtest.c \
 	$(NULL)
 
+USE_STATIC_LIBS = 1

security/nss/cmd/modutil/pk11.c

@@ -397,6 +397,7 @@ static void
 printModule(SECMODModule *module, int *count)
 {
     int slotCount = module->loaded ? module->slotCount : 0;
+    char *modUri;
     int i;
 
     if ((*count)++) {
@@ -408,6 +409,11 @@ printModule(SECMODModule *module, int *count)
         PR_fprintf(PR_STDOUT, "\tlibrary name: %s\n", module->dllName);
     }
 
+    modUri = PK11_GetModuleURI(module);
+    if (modUri) {
+        PR_fprintf(PR_STDOUT, "\t   uri: %s\n", modUri);
+        PORT_Free(modUri);
+    }
     if (slotCount == 0) {
         PR_fprintf(PR_STDOUT,
                    "\t slots: There are no slots attached to this module\n");
@@ -425,10 +431,12 @@ printModule(SECMODModule *module, int *count)
     /* Print slot and token names */
     for (i = 0; i < slotCount; i++) {
         PK11SlotInfo *slot = module->slots[i];
-
+        char *tokenUri = PK11_GetTokenURI(slot);
         PR_fprintf(PR_STDOUT, "\n");
         PR_fprintf(PR_STDOUT, "\t slot: %s\n", PK11_GetSlotName(slot));
         PR_fprintf(PR_STDOUT, "\ttoken: %s\n", PK11_GetTokenName(slot));
+        PR_fprintf(PR_STDOUT, "\t  uri: %s\n", tokenUri);
+        PORT_Free(tokenUri);
     }
     return;
 }
@@ -494,7 +502,7 @@ static char *disableReasonStr[] = {
     "could not verify token",
     "token not present"
 };
-static int numDisableReasonStr =
+static size_t numDisableReasonStr =
     sizeof(disableReasonStr) / sizeof(disableReasonStr[0]);
 
 /***********************************************************************
@@ -513,7 +521,7 @@ ListModule(char *moduleName)
     CK_SLOT_INFO slotinfo;
     CK_TOKEN_INFO tokeninfo;
     char *ciphers, *mechanisms;
-    PK11DisableReasons reason;
+    size_t reasonIdx;
     Error rv = SUCCESS;
 
     if (!moduleName) {
@@ -604,10 +612,10 @@ ListModule(char *moduleName)
         PR_fprintf(PR_STDOUT, PAD "Firmware Version: %d.%d\n",
                    slotinfo.firmwareVersion.major, slotinfo.firmwareVersion.minor);
         if (PK11_IsDisabled(slot)) {
-            reason = PK11_GetDisabledReason(slot);
+            reasonIdx = PK11_GetDisabledReason(slot);
-            if (reason < numDisableReasonStr) {
+            if (reasonIdx < numDisableReasonStr) {
                 PR_fprintf(PR_STDOUT, PAD "Status: DISABLED (%s)\n",
-                           disableReasonStr[reason]);
+                           disableReasonStr[reasonIdx]);
             } else {
                 PR_fprintf(PR_STDOUT, PAD "Status: DISABLED\n");
             }

security/nss/cmd/mpitests/mpitests.gyp

@@ -14,7 +14,16 @@
         'mpi-test.c',
       ],
       'dependencies': [
-        '<(DEPTH)/lib/freebl/freebl.gyp:<(freebl_name)',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3',
+        '<(DEPTH)/lib/nss/nss.gyp:nss_static',
+        '<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap_static',
+        '<(DEPTH)/lib/cryptohi/cryptohi.gyp:cryptohi',
+        '<(DEPTH)/lib/certhigh/certhigh.gyp:certhi',
+        '<(DEPTH)/lib/certdb/certdb.gyp:certdb',
+        '<(DEPTH)/lib/base/base.gyp:nssb',
+        '<(DEPTH)/lib/dev/dev.gyp:nssdev',
+        '<(DEPTH)/lib/pki/pki.gyp:nsspki',
       ]
     }
   ],
@@ -22,7 +31,18 @@
     'include_dirs': [
       '<(DEPTH)/lib/freebl/mpi',
       '<(DEPTH)/lib/util',
-    ]
+    ],
+    # This uses test builds and has to set defines for MPI.
+    'conditions': [
+      [ 'target_arch=="ia32"', {
+        'defines': [
+          'MP_USE_UINT_DIGIT',
+          'MP_ASSEMBLY_MULTIPLY',
+          'MP_ASSEMBLY_SQUARE',
+          'MP_ASSEMBLY_DIV_2DX1D',
+        ],
+      }],
+    ],
   },
   'variables': {
     'module': 'nss'

security/nss/cmd/pk12util/pk12util.c

@@ -615,11 +615,7 @@ P12U_ExportPKCS12Object(char *nn, char *outfile, PK11SlotInfo *inSlot,
     }
 
     if (certlist) {
-        CERTCertificate *cert = NULL;
+        CERTCertificate *cert = CERT_LIST_HEAD(certlist)->cert;
-        node = CERT_LIST_HEAD(certlist);
-        if (node) {
-            cert = node->cert;
-        }
         if (cert) {
             slot = cert->slot; /* use the slot from the first matching
                 certificate to create the context . This is for keygen */
@@ -861,6 +857,9 @@ p12u_EnableAllCiphers()
     SEC_PKCS12EnableCipher(PKCS12_RC2_CBC_128, 1);
     SEC_PKCS12EnableCipher(PKCS12_DES_56, 1);
     SEC_PKCS12EnableCipher(PKCS12_DES_EDE3_168, 1);
+    SEC_PKCS12EnableCipher(PKCS12_AES_CBC_128, 1);
+    SEC_PKCS12EnableCipher(PKCS12_AES_CBC_192, 1);
+    SEC_PKCS12EnableCipher(PKCS12_AES_CBC_256, 1);
     SEC_PKCS12SetPreferredCipher(PKCS12_DES_EDE3_168, 1);
 }
 
@@ -1059,7 +1058,7 @@ main(int argc, char **argv)
             certCipher = PKCS12U_MapCipherFromString(cipherString, certKeyLen);
             /* If the user requested a cipher and we didn't find it, then
 	     * don't just silently not encrypt. */
-            if (cipher == SEC_OID_UNKNOWN) {
+            if (certCipher == SEC_OID_UNKNOWN) {
                 PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
                 SECU_PrintError(progName, "Algorithm: \"%s\"", cipherString);
                 pk12uErrno = PK12UERR_INVALIDALGORITHM;

security/nss/cmd/platlibs.gypi

@@ -32,9 +32,8 @@
           '<(DEPTH)/lib/dev/dev.gyp:nssdev',
           '<(DEPTH)/lib/base/base.gyp:nssb',
           '<(DEPTH)/lib/freebl/freebl.gyp:freebl',
-          '<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap',
-          '<(DEPTH)/lib/certhigh/certhigh.gyp:certhi',
           '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3',
+          '<(DEPTH)/lib/libpkix/libpkix.gyp:libpkix',
         ],
         'conditions': [
           [ 'disable_dbm==0', {
@@ -43,21 +42,6 @@
               '<(DEPTH)/lib/softoken/legacydb/legacydb.gyp:nssdbm',
             ],
           }],
-          [ 'disable_libpkix==0', {
-            'dependencies': [
-              '<(DEPTH)/lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
-              '<(DEPTH)/lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
-              '<(DEPTH)/lib/libpkix/pkix/params/params.gyp:pkixparams',
-              '<(DEPTH)/lib/libpkix/pkix/results/results.gyp:pkixresults',
-              '<(DEPTH)/lib/libpkix/pkix/top/top.gyp:pkixtop',
-              '<(DEPTH)/lib/libpkix/pkix/util/util.gyp:pkixutil',
-              '<(DEPTH)/lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
-              '<(DEPTH)/lib/libpkix/pkix/store/store.gyp:pkixstore',
-              '<(DEPTH)/lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
-              '<(DEPTH)/lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
-              '<(DEPTH)/lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule'
-            ],
-          }],
         ]},{ # !use_static_libs
           'conditions': [
             ['moz_fold_libs==0', {

security/nss/cmd/platlibs.mk

@@ -32,6 +32,12 @@ else
 DBMLIB = $(DIST)/lib/$(LIB_PREFIX)dbm.$(LIB_SUFFIX) 
 endif
 
+ifeq ($(NSS_BUILD_UTIL_ONLY),1)
+SECTOOL_LIB = $(NULL)
+else
+SECTOOL_LIB = $(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX)
+endif
+
 ifdef USE_STATIC_LIBS
 
 DEFINES += -DNSS_USE_STATIC_LIBS
@@ -70,20 +76,10 @@ endif
 endif
 
 NSS_LIBS_1=
-SECTOOL_LIB=
 NSS_LIBS_2=
 NSS_LIBS_3=
 NSS_LIBS_4=
 
-ifneq ($(NSS_BUILD_UTIL_ONLY),1)
-SECTOOL_LIB = \
-	$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
-	$(NULL)
-else
-SECTOOL_LIB = \
-	$(NULL)
-endif
-
 ifneq ($(NSS_BUILD_SOFTOKEN_ONLY),1)
 ifeq ($(OS_ARCH), WINNT)
 # breakdown for windows
@@ -121,9 +117,6 @@ NSS_LIBS_1 = \
 	$(DIST)/lib/$(LIB_PREFIX)ssl.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)nss.$(LIB_SUFFIX) \
 	$(NULL)
-SECTOOL_LIB = \
-	$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
-	$(NULL)
 NSS_LIBS_2 = \
 	$(DIST)/lib/$(LIB_PREFIX)pkcs12.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)pkcs7.$(LIB_SUFFIX) \
@@ -201,7 +194,7 @@ ifeq ($(OS_ARCH), WINNT)
 
 # $(PROGRAM) has explicit dependencies on $(EXTRA_LIBS)
 EXTRA_LIBS += \
-	$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
+	$(SECTOOL_LIB) \
 	$(NSSUTIL_LIB_DIR)/$(IMPORT_LIB_PREFIX)nssutil3$(IMPORT_LIB_SUFFIX) \
 	$(DIST)/lib/$(IMPORT_LIB_PREFIX)smime3$(IMPORT_LIB_SUFFIX) \
 	$(DIST)/lib/$(IMPORT_LIB_PREFIX)ssl3$(IMPORT_LIB_SUFFIX) \
@@ -220,7 +213,7 @@ else
 
 # $(PROGRAM) has explicit dependencies on $(EXTRA_LIBS)
 EXTRA_LIBS += \
-	$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
+	$(SECTOOL_LIB) \
 	$(NULL)
 
 ifeq ($(OS_ARCH), AIX) 
@@ -231,9 +224,6 @@ endif
 # $(EXTRA_SHARED_LIBS) come before $(OS_LIBS), except on AIX.
 EXTRA_SHARED_LIBS += \
 	-L$(DIST)/lib \
-	-lssl3 \
-	-lsmime3 \
-	-lnss3 \
 	-L$(NSSUTIL_LIB_DIR) \
 	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
@@ -241,6 +231,14 @@ EXTRA_SHARED_LIBS += \
 	-lplds4 \
 	-lnspr4 \
 	$(NULL)
+ifndef NSS_BUILD_UTIL_ONLY
+ifndef NSS_BUILD_SOFTOKEN_ONLY
+EXTRA_SHARED_LIBS += \
+	-lssl3 \
+	-lsmime3 \
+	-lnss3
+endif
+endif
 endif
 
 ifdef SOFTOKEN_LIB_DIR

security/nss/cmd/selfserv/selfserv.c

@@ -159,7 +159,7 @@ static void
 PrintUsageHeader(const char *progName)
 {
     fprintf(stderr,
-            "Usage: %s -n rsa_nickname -p port [-BDENRbjlmrsuvx] [-w password]\n"
+            "Usage: %s -n rsa_nickname -p port [-BDENRZbjlmrsuvx] [-w password]\n"
             "         [-t threads] [-i pid_file] [-c ciphers] [-Y] [-d dbdir] [-g numblocks]\n"
             "         [-f password_file] [-L [seconds]] [-M maxProcs] [-P dbprefix]\n"
             "         [-V [min-version]:[max-version]] [-a sni_name]\n"
@@ -169,7 +169,8 @@ PrintUsageHeader(const char *progName)
             " [-e ec_nickname]"
 #endif /* NSS_DISABLE_ECC */
             "\n"
-            "         -U [0|1] -H [0|1|2] -W [0|1]\n",
+            "         -U [0|1] -H [0|1|2] -W [0|1]\n"
+            "\n",
             progName);
 }
 
@@ -219,7 +220,7 @@ PrintParameterUsage()
         "-A <ca> Nickname of a CA used to sign a stapled cert status\n"
         "-U override default ECDHE ephemeral key reuse, 0: refresh, 1: reuse\n"
         "-H override default DHE server support, 0: disable, 1: enable, "
-        " 2: require DH named groups\n"
+        "   2: require DH named groups [RFC7919]\n"
         "-W override default DHE server weak parameters support, 0: disable, 1: enable\n"
         "-c Restrict ciphers\n"
         "-Y prints cipher values allowed for parameter -c and exits\n"
@@ -227,7 +228,8 @@ PrintParameterUsage()
         "-Q enables ALPN for HTTP/1.1 [RFC7301]\n"
         "-I comma separated list of enabled groups for TLS key exchange.\n"
         "   The following values are valid:\n"
-        "   P256, P384, P521, x25519, FF2048, FF3072, FF4096, FF6144, FF8192\n",
+        "   P256, P384, P521, x25519, FF2048, FF3072, FF4096, FF6144, FF8192\n"
+        "-Z enable 0-RTT (for TLS 1.3; also use -u)\n",
         stderr);
 }
 
@@ -2305,7 +2307,9 @@ main(int argc, char **argv)
                 if (SECU_ParseSSLVersionRangeString(optstate->value,
                                                     enabledVersions, &enabledVersions) !=
                     SECSuccess) {
+                    fprintf(stderr, "Bad version specified.\n");
                     Usage(progName);
+                    exit(1);
                 }
                 break;
 

security/nss/cmd/smimetools/cmsutil.c

@@ -84,7 +84,7 @@ Usage(char *progName)
             "               where id can be a certificate nickname or email address\n"
             " -S            create a CMS signed data message\n"
             "  -G           include a signing time attribute\n"
-            "  -H hash      use hash (default:SHA1)\n"
+            "  -H hash      use hash (default:SHA256)\n"
             "  -N nick      use certificate named \"nick\" for signing\n"
             "  -P           include a SMIMECapabilities attribute\n"
             "  -T           do not include content in CMS message\n"
@@ -1097,7 +1097,7 @@ main(int argc, char **argv)
     signOptions.signingTime = PR_FALSE;
     signOptions.smimeProfile = PR_FALSE;
     signOptions.encryptionKeyPreferenceNick = NULL;
-    signOptions.hashAlgTag = SEC_OID_SHA1;
+    signOptions.hashAlgTag = SEC_OID_SHA256;
     envelopeOptions.recipients = NULL;
     encryptOptions.recipients = NULL;
     encryptOptions.envmsg = NULL;

security/nss/cmd/smimetools/smime

@@ -199,8 +199,8 @@ sub signentity($$)
     # construct a new multipart/signed MIME entity consisting of the original content and
     # the signature
     #
-    # (we assume that cmsutil generates a SHA1 digest)
+    # (we assume that cmsutil generates a SHA256 digest)
-    $out .= "Content-Type: multipart/signed; protocol=\"application/pkcs7-signature\"; micalg=sha1; boundary=\"${boundary}\"\n";
+    $out .= "Content-Type: multipart/signed; protocol=\"application/pkcs7-signature\"; micalg=sha256; boundary=\"${boundary}\"\n";
     $out .= "\n";		# end of entity header
     $out .= "This is a cryptographically signed message in MIME format.\n"; # explanatory comment
     $out .= "\n--${boundary}\n";

security/nss/cmd/strsclnt/strsclnt.c

@@ -1350,6 +1350,7 @@ main(int argc, char **argv)
                 if (SECU_ParseSSLVersionRangeString(optstate->value,
                                                     enabledVersions, &enabledVersions) !=
                     SECSuccess) {
+                    fprintf(stderr, "Bad version specified.\n");
                     Usage(progName);
                 }
                 break;

security/nss/cmd/symkeyutil/symkeyutil.c

@@ -233,6 +233,9 @@ BufToHex(SECItem *outbuf)
     unsigned int i;
 
     string = PORT_Alloc(len);
+    if (!string) {
+        return NULL;
+    }
 
     ptr = string;
     for (i = 0; i < outbuf->len; i++) {

security/nss/cmd/tstclnt/tstclnt.c

@@ -169,20 +169,6 @@ printSecurityInfo(PRFileDesc *fd)
     }
 }
 
-void
-handshakeCallback(PRFileDesc *fd, void *client_data)
-{
-    const char *secondHandshakeName = (char *)client_data;
-    if (secondHandshakeName) {
-        SSL_SetURL(fd, secondHandshakeName);
-    }
-    printSecurityInfo(fd);
-    if (renegotiationsDone < renegotiationsToDo) {
-        SSL_ReHandshake(fd, (renegotiationsToDo < 2));
-        ++renegotiationsDone;
-    }
-}
-
 static void
 PrintUsageHeader(const char *progName)
 {
@@ -192,7 +178,8 @@ PrintUsageHeader(const char *progName)
             "[-n nickname] [-Bafosvx] [-c ciphers] [-Y] [-Z]\n"
             "[-V [min-version]:[max-version]] [-K] [-T] [-U]\n"
             "[-r N] [-w passwd] [-W pwfile] [-q [-t seconds]] [-I groups]\n"
-            "[-A requestfile] [-L totalconnections]",
+            "[-A requestfile] [-L totalconnections]\n"
+            "\n",
             progName);
 }
 
@@ -256,9 +243,7 @@ PrintParameterUsage(void)
     fprintf(stderr, "%-20s Enforce using an IPv6 destination address\n", "-6");
     fprintf(stderr, "%-20s (Options -4 and -6 cannot be combined.)\n", "");
     fprintf(stderr, "%-20s Enable the extended master secret extension [RFC7627]\n", "-G");
-    fprintf(stderr, "%-20s Require the use of FFDHE supported groups "
+    fprintf(stderr, "%-20s Require the use of FFDHE supported groups [RFC7919]\n", "-H");
-                    "[I-D.ietf-tls-negotiated-ff-dhe]\n",
-            "-H");
     fprintf(stderr, "%-20s Read from a file instead of stdin\n", "-A");
     fprintf(stderr, "%-20s Allow 0-RTT data (TLS 1.3 only)\n", "-Z");
     fprintf(stderr, "%-20s Disconnect and reconnect up to N times total\n", "-L");
@@ -889,6 +874,10 @@ restartHandshakeAfterServerCertIfNeeded(PRFileDesc *fd,
 
     if (SSL_AuthCertificateComplete(fd, error) != SECSuccess) {
         rv = SECFailure;
+    } else {
+        /* restore the original error code, which could be reset by
+         * SSL_AuthCertificateComplete */
+        PORT_SetError(error);
     }
 
     return rv;
@@ -923,13 +912,19 @@ PRUint16 portno = 443;
 int override = 0;
 char *requestString = NULL;
 PRInt32 requestStringLen = 0;
+PRBool requestSent = PR_FALSE;
 PRBool enableZeroRtt = PR_FALSE;
 
 static int
-writeBytesToServer(PRFileDesc *s, PRPollDesc *pollset, const char *buf, int nb)
+writeBytesToServer(PRFileDesc *s, const char *buf, int nb)
 {
     SECStatus rv;
     const char *bufp = buf;
+    PRPollDesc pollDesc;
+
+    pollDesc.in_flags = PR_POLL_WRITE | PR_POLL_EXCEPT;
+    pollDesc.out_flags = 0;
+    pollDesc.fd = s;
 
     FPRINTF(stderr, "%s: Writing %d bytes to server\n",
             progName, nb);
@@ -956,12 +951,12 @@ writeBytesToServer(PRFileDesc *s, PRPollDesc *pollset, const char *buf, int nb)
             return EXIT_CODE_HANDSHAKE_FAILED;
         }
 
-        pollset[SSOCK_FD].in_flags = PR_POLL_WRITE | PR_POLL_EXCEPT;
+        pollDesc.in_flags = PR_POLL_WRITE | PR_POLL_EXCEPT;
-        pollset[SSOCK_FD].out_flags = 0;
+        pollDesc.out_flags = 0;
         FPRINTF(stderr,
                 "%s: about to call PR_Poll on writable socket !\n",
                 progName);
-        cc = PR_Poll(pollset, 1, PR_INTERVAL_NO_TIMEOUT);
+        cc = PR_Poll(&pollDesc, 1, PR_INTERVAL_NO_TIMEOUT);
         if (cc < 0) {
             SECU_PrintError(progName,
                             "PR_Poll failed");
@@ -975,6 +970,36 @@ writeBytesToServer(PRFileDesc *s, PRPollDesc *pollset, const char *buf, int nb)
     return 0;
 }
 
+void
+handshakeCallback(PRFileDesc *fd, void *client_data)
+{
+    const char *secondHandshakeName = (char *)client_data;
+    if (secondHandshakeName) {
+        SSL_SetURL(fd, secondHandshakeName);
+    }
+    printSecurityInfo(fd);
+    if (renegotiationsDone < renegotiationsToDo) {
+        SSL_ReHandshake(fd, (renegotiationsToDo < 2));
+        ++renegotiationsDone;
+    }
+    if (requestString && requestSent) {
+        /* This data was sent in 0-RTT. */
+        SSLChannelInfo info;
+        SECStatus rv;
+
+        rv = SSL_GetChannelInfo(fd, &info, sizeof(info));
+        if (rv != SECSuccess)
+            return;
+
+        if (!info.earlyDataAccepted) {
+            FPRINTF(stderr, "Early data rejected. Re-sending\n");
+            writeBytesToServer(fd, requestString, requestStringLen);
+        }
+    }
+}
+
+#define REQUEST_WAITING (requestString && !requestSent)
+
 static int
 run_client(void)
 {
@@ -988,7 +1013,8 @@ run_client(void)
     PRFileDesc *std_out;
     PRPollDesc pollset[2];
     PRBool wrStarted = PR_FALSE;
-    char *requestStringInt = requestString;
+
+    requestSent = PR_FALSE;
 
     /* Create socket */
     s = PR_OpenTCPSocket(addr.raw.family);
@@ -1245,7 +1271,7 @@ run_client(void)
     pollset[SSOCK_FD].in_flags = PR_POLL_EXCEPT |
                                  (clientSpeaksFirst ? 0 : PR_POLL_READ);
     pollset[STDIN_FD].fd = PR_GetSpecialFD(PR_StandardInput);
-    if (!requestStringInt) {
+    if (!REQUEST_WAITING) {
         pollset[STDIN_FD].in_flags = PR_POLL_READ;
         npds = 2;
     } else {
@@ -1295,7 +1321,7 @@ run_client(void)
     */
     FPRINTF(stderr, "%s: ready...\n", progName);
     while ((pollset[SSOCK_FD].in_flags | pollset[STDIN_FD].in_flags) ||
-           requestStringInt) {
+           REQUEST_WAITING) {
         char buf[4000]; /* buffer for stdin */
         int nb;         /* num bytes read from stdin. */
 
@@ -1333,13 +1359,12 @@ run_client(void)
                     "%s: PR_Poll returned 0x%02x for socket out_flags.\n",
                     progName, pollset[SSOCK_FD].out_flags);
         }
-        if (requestStringInt) {
+        if (REQUEST_WAITING) {
-            error = writeBytesToServer(s, pollset,
+            error = writeBytesToServer(s, requestString, requestStringLen);
-                                       requestStringInt, requestStringLen);
             if (error) {
                 goto done;
             }
-            requestStringInt = NULL;
+            requestSent = PR_TRUE;
             pollset[SSOCK_FD].in_flags = PR_POLL_READ;
         }
         if (pollset[STDIN_FD].out_flags & PR_POLL_READ) {
@@ -1356,7 +1381,7 @@ run_client(void)
                 /* EOF on stdin, stop polling stdin for read. */
                 pollset[STDIN_FD].in_flags = 0;
             } else {
-                error = writeBytesToServer(s, pollset, buf, nb);
+                error = writeBytesToServer(s, buf, nb);
                 if (error) {
                     goto done;
                 }
@@ -1487,7 +1512,7 @@ main(int argc, char **argv)
     /* XXX: 'B' was used in the past but removed in 3.28,
      *      please leave some time before resuing it. */
     optstate = PL_CreateOptState(argc, argv,
-                                 "46A:CDFGHI:KL:M:OR:STUV:WYZa:bc:d:fgh:m:n:op:qr:st:uvw:z");
+                                 "46A:CDFGHI:KL:M:OR:STUV:W:YZa:bc:d:fgh:m:n:op:qr:st:uvw:z");
     while ((optstatus = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
         switch (optstate->option) {
             case '?':
@@ -1588,6 +1613,7 @@ main(int argc, char **argv)
                 if (SECU_ParseSSLVersionRangeString(optstate->value,
                                                     enabledVersions, &enabledVersions) !=
                     SECSuccess) {
+                    fprintf(stderr, "Bad version specified.\n");
                     Usage(progName);
                 }
                 break;

security/nss/coreconf/Darwin.mk

@@ -145,6 +145,3 @@ ifeq (3,$(SYS_SQLITE3_VERSION_MAJOR))
         NSS_USE_SYSTEM_SQLITE = 1
     endif
 endif
-
-include $(CORE_DEPTH)/coreconf/sanitizers.mk
-DARWIN_SDK_SHLIBFLAGS += $(SANITIZER_LDFLAGS)

security/nss/coreconf/Linux.mk

@@ -106,16 +106,6 @@ ifneq ($(OS_TARGET),Android)
 LIBC_TAG		= _glibc
 endif
 
-ifeq ($(OS_RELEASE),2.0)
-	OS_REL_CFLAGS	+= -DLINUX2_0
-	MKSHLIB		= $(CC) -shared -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so) $(RPATH)
-	ifdef MAPFILE
-		MKSHLIB += -Wl,--version-script,$(MAPFILE)
-	endif
-	PROCESS_MAP_FILE = grep -v ';-' $< | \
-         sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
-endif
-
 ifdef BUILD_OPT
 ifeq (11,$(ALLOW_OPT_CODE_SIZE)$(OPT_CODE_SIZE))
 	OPTIMIZER = -Os
@@ -139,15 +129,16 @@ ifeq ($(USE_PTHREADS),1)
 OS_PTHREAD = -lpthread 
 endif
 
-OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR
+ifeq ($(KERNEL),Linux)
+	OS_CFLAGS	+= -DLINUX -Dlinux
+endif
 OS_LIBS			= $(OS_PTHREAD) -ldl -lc
 
 ifdef USE_PTHREADS
 	DEFINES		+= -D_REENTRANT
 endif
 
-ARCH			= linux
-
 DSO_CFLAGS		= -fPIC
 DSO_LDOPTS		= -shared $(ARCHFLAG) -Wl,--gc-sections
 # The linker on Red Hat Linux 7.2 and RHEL 2.1 (GNU ld version 2.11.90.0.8)
@@ -156,10 +147,8 @@ DSO_LDOPTS		= -shared $(ARCHFLAG) -Wl,--gc-sections
 # Also, -z defs conflicts with Address Sanitizer, which emits relocations
 # against the libsanitizer runtime built into the main executable.
 ZDEFS_FLAG		= -Wl,-z,defs
-ifneq ($(USE_ASAN),1)
 DSO_LDOPTS		+= $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG))
-endif
+LDFLAGS			+= $(ARCHFLAG) -z noexecstack
-LDFLAGS			+= $(ARCHFLAG)
 
 # On Maemo, we need to use the -rpath-link flag for even the standard system
 # library directories.
@@ -167,7 +156,6 @@ ifdef _SBOX_DIR
 LDFLAGS			+= -Wl,-rpath-link,/usr/lib:/lib
 endif
 
-# INCLUDES += -I/usr/include -Y/usr/include/linux
 G++INCLUDES		= -I/usr/include/g++
 
 #
@@ -202,7 +190,6 @@ RPATH = -Wl,-rpath,'$$ORIGIN:/opt/sun/private/lib'
 endif
 endif
 
-OS_REL_CFLAGS   += -DLINUX2_1
 MKSHLIB         = $(CC) $(DSO_LDOPTS) -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so) $(RPATH)
 
 ifdef MAPFILE
@@ -220,5 +207,3 @@ OS_CFLAGS += --coverage
 LDFLAGS += --coverage
 DSO_LDOPTS += --coverage
 endif
-
-include $(CORE_DEPTH)/coreconf/sanitizers.mk

security/nss/coreconf/arch.mk

@@ -12,7 +12,7 @@
 # OS_TARGET	User defined, or set to OS_ARCH
 # CPU_ARCH  	(from unmame -m or -p, ONLY on WINNT)
 # OS_CONFIG	OS_TARGET + OS_RELEASE
-# OBJDIR_TAG    (uses ASAN_TAG, GCOV_TAG, 64BIT_TAG)
+# OBJDIR_TAG    (uses GCOV_TAG, 64BIT_TAG)
 # OBJDIR_NAME
 #######################################################################
 
@@ -115,6 +115,20 @@ ifeq ($(OS_ARCH),Linux)
     ifneq ($(words $(OS_RELEASE)),1)
 	OS_RELEASE := $(word 1,$(OS_RELEASE)).$(word 2,$(OS_RELEASE))
     endif
+    KERNEL = Linux
+endif
+
+# Since all uses of OS_ARCH that follow affect only userland, we can
+# merge other Glibc systems with Linux here.
+ifeq ($(OS_ARCH),GNU)
+    OS_ARCH = Linux
+    OS_RELEASE = 2.6
+    KERNEL = GNU
+endif
+ifeq ($(OS_ARCH),GNU_kFreeBSD)
+    OS_ARCH = Linux
+    OS_RELEASE = 2.6
+    KERNEL = FreeBSD
 endif
 
 #
@@ -254,11 +268,6 @@ OS_CONFIG = $(OS_TARGET)$(OS_RELEASE)
 # to distinguish between debug and release builds.
 #
 
-ifeq ($(USE_ASAN), 1)
-    ASAN_TAG = _ASAN
-else
-    ASAN_TAG =
-endif
 ifeq ($(USE_GCOV), 1)
     GCOV_TAG = _GCOV
 else
@@ -269,7 +278,7 @@ ifeq ($(USE_64), 1)
 else
     64BIT_TAG =
 endif
-OBJDIR_TAG_BASE=$(ASAN_TAG)$(GCOV_TAG)$(64BIT_TAG)
+OBJDIR_TAG_BASE=$(GCOV_TAG)$(64BIT_TAG)
 
 ifdef BUILD_OPT
     OBJDIR_TAG = $(OBJDIR_TAG_BASE)_OPT

security/nss/coreconf/check_cc_clang.py

@@ -6,15 +6,16 @@ import sys
 
 def main():
     if sys.platform == 'win32':
-        print 0
+        print(0)
     else:
         cc = os.environ.get('CC', 'cc')
         try:
-            cc_is_clang = 'clang' in subprocess.check_output([cc, '--version'])
+            cc_is_clang = 'clang' in subprocess.check_output(
+              [cc, '--version'], universal_newlines=True)
         except OSError:
             # We probably just don't have CC/cc.
             cc_is_clang = False
-        print int(cc_is_clang)
+        print(int(cc_is_clang))
 
 if __name__ == '__main__':
     main()

security/nss/coreconf/config.gypi

@@ -24,39 +24,44 @@
           # building on.
           'target_arch%': '<(host_arch)',
         }],
+        ['OS=="linux"', {
+          # FIPS-140 LOWHASH
+          'freebl_name': 'freeblpriv3',
+        }, {
+          'freebl_name': 'freebl3',
+        }],
+        ['OS=="mac"', {
+          'use_system_sqlite%': 1,
+        },{
+          'use_system_sqlite%': 0,
+        }],
+        ['OS=="mac" or OS=="win"', {
+          'cc_use_gnu_ld%': 0,
+        }, {
+          'cc_use_gnu_ld%': 1,
+        }],
         ['OS=="win"', {
           'use_system_zlib%': 0,
-          'nspr_libs%': ['nspr4.lib', 'plc4.lib', 'plds4.lib'],
+          'nspr_libs%': ['libnspr4.lib', 'libplc4.lib', 'libplds4.lib'],
           'zlib_libs%': [],
           #TODO
           'moz_debug_flags%': '',
           'dll_prefix': '',
           'dll_suffix': 'dll',
         }, {
-          'nspr_libs%': ['-lplds4', '-lplc4', '-lnspr4'],
           'use_system_zlib%': 1,
-        }],
+          'nspr_libs%': ['-lplds4', '-lplc4', '-lnspr4'],
-        ['OS=="linux" or OS=="android"', {
           'zlib_libs%': ['-lz'],
-          'moz_debug_flags%': '-gdwarf-2',
-          'optimize_flags%': '-O2',
           'dll_prefix': 'lib',
-          'dll_suffix': 'so',
+          'conditions': [
-        }],
+            ['OS=="mac"', {
-        ['OS=="linux"', {
+              'moz_debug_flags%': '-gdwarf-2 -gfull',
-          'freebl_name': 'freeblpriv3',
+              'dll_suffix': 'dylib',
-        }, {
+            }, {
-          'freebl_name': 'freebl3',
+              'moz_debug_flags%': '-gdwarf-2',
-        }],
+              'dll_suffix': 'so',
-        ['OS=="mac"', {
+            }],
-          'zlib_libs%': ['-lz'],
+          ],
-          'use_system_sqlite%': 1,
-          'moz_debug_flags%': '-gdwarf-2 -gfull',
-          'optimize_flags%': '-O2',
-          'dll_prefix': 'lib',
-          'dll_suffix': 'dylib',
-        }, {
-          'use_system_sqlite%': 0,
         }],
         ['"<(GENERATOR)"=="ninja"', {
           'cc_is_clang%': '<!(<(python) <(DEPTH)/coreconf/check_cc_clang.py)',
@@ -81,6 +86,7 @@
     'dll_suffix': '<(dll_suffix)',
     'freebl_name': '<(freebl_name)',
     'cc_is_clang%': '<(cc_is_clang)',
+    'cc_use_gnu_ld%': '<(cc_use_gnu_ld)',
     # Some defaults
     'disable_tests%': 0,
     'disable_chachapoly%': 0,
@@ -91,16 +97,18 @@
     'moz_fold_libs%': 0,
     'moz_folded_library_name%': '',
     'ssl_enable_zlib%': 1,
-    'use_asan%': 0,
+    'sanitizer_flags%': 0,
-    'use_ubsan%': 0,
-    'use_msan%': 0,
-    'use_sancov%': 0,
     'test_build%': 0,
+    'no_zdefs%': 0,
     'fuzz%': 0,
+    'fuzz_tls%': 0,
+    'fuzz_oss%': 0,
     'sign_libs%': 1,
     'use_pprof%': 0,
+    'ct_verif%': 0,
     'nss_public_dist_dir%': '<(nss_dist_dir)/public',
     'nss_private_dist_dir%': '<(nss_dist_dir)/private',
+    'only_dev_random%': 1,
   },
   'target_defaults': {
     # Settings specific to targets should go here.
@@ -108,6 +116,8 @@
     'variables': {
       'mapfile%': '',
       'test_build%': 0,
+      'debug_optimization_level%': '0',
+      'release_optimization_level%': '2',
     },
     'standalone_static_library': 0,
     'include_dirs': [
@@ -115,13 +125,68 @@
       '<(nss_dist_dir)/private/<(module)',
     ],
     'conditions': [
-      [ 'OS=="linux"', {
+      [ 'OS!="android" and OS!="mac" and OS!="win"', {
         'libraries': [
           '-lpthread',
+        ],
+      }],
+      [ 'OS=="linux"', {
+        'libraries': [
           '-ldl',
           '-lc',
         ],
       }],
+      [ 'fuzz==1', {
+        'variables': {
+          'debug_optimization_level%': '1',
+        },
+      }],
+      [ 'target_arch=="ia32" or target_arch=="x64"', {
+        'defines': [
+          'NSS_X86_OR_X64',
+        ],
+        # For Windows.
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'PreprocessorDefinitions': [
+              'NSS_X86_OR_X64',
+            ],
+          },
+        },
+      }],
+      [ 'target_arch=="ia32"', {
+        'defines': [
+          'NSS_X86',
+        ],
+        # For Windows.
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'PreprocessorDefinitions': [
+              'NSS_X86',
+            ],
+          },
+        },
+      }],
+      [ 'target_arch=="arm64" or target_arch=="aarch64"', {
+        'defines': [
+          'NSS_USE_64',
+        ],
+      }],
+      [ 'target_arch=="x64"', {
+        'defines': [
+          'NSS_X64',
+          'NSS_USE_64',
+        ],
+        # For Windows.
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'PreprocessorDefinitions': [
+              'NSS_X64',
+              'NSS_USE_64',
+            ],
+          },
+        },
+      }],
     ],
     'target_conditions': [
       # If we want to properly export a static library, and copy it to lib,
@@ -135,7 +200,7 @@
         'product_dir': '<(nss_dist_obj_dir)/lib'
       }],
       # mapfile handling
-      [ 'test_build==0 and mapfile!=""', {
+      [ 'mapfile!=""', {
         # Work around a gyp bug. Fixed upstream but not in Ubuntu packages:
         # https://chromium.googlesource.com/external/gyp/+/b85ad3e578da830377dbc1843aa4fbc5af17a192%5E%21/
         'sources': [
@@ -148,12 +213,12 @@
           ],
         },
         'conditions': [
-          [ 'OS=="linux" or OS=="android"', {
+          [ 'cc_use_gnu_ld==1', {
             'ldflags': [
               '-Wl,--version-script,<(INTERMEDIATE_DIR)/out.>(mapfile)',
             ],
           }],
-          [ 'OS=="win"', {
+          [ 'cc_use_gnu_ld!=1 and OS=="win"', {
             # On Windows, .def files are used directly as sources.
             'sources': [
               '>(mapfile)',
@@ -195,10 +260,16 @@
       # Shared library specific settings.
       [ '_type=="shared_library"', {
         'conditions': [
-          [ 'OS=="linux" or OS=="android"', {
+          [ 'cc_use_gnu_ld==1', {
             'ldflags': [
               '-Wl,--gc-sections',
-              '-Wl,-z,defs',
+            ],
+            'conditions': [
+              ['no_zdefs==0', {
+                'ldflags': [
+                  '-Wl,-z,defs',
+                ],
+              }],
             ],
           }],
         ],
@@ -251,10 +322,36 @@
               'LINUX2_1',
               'LINUX',
               'linux',
+            ],
+          }],
+          [ 'OS=="dragonfly" or OS=="freebsd"', {
+            'defines': [
+              'FREEBSD',
+            ],
+          }],
+          [ 'OS=="netbsd"', {
+            'defines': [
+              'NETBSD',
+            ],
+          }],
+          [ 'OS=="openbsd"', {
+            'defines': [
+              'OPENBSD',
+            ],
+          }],
+          ['OS=="mac" or OS=="dragonfly" or OS=="freebsd" or OS=="netbsd" or OS=="openbsd"', {
+            'defines': [
+              'HAVE_BSD_FLOCK',
+            ],
+          }],
+          [ 'OS!="win"', {
+            'defines': [
               'HAVE_STRERROR',
               'XP_UNIX',
               '_REENTRANT',
             ],
+          }],
+          [ 'OS!="mac" and OS!="win"', {
             'cflags': [
               '-fPIC',
               '-pipe',
@@ -264,6 +361,9 @@
             'cflags_cc': [
               '-std=c++0x',
             ],
+            'ldflags': [
+              '-z', 'noexecstack',
+            ],
             'conditions': [
               [ 'target_arch=="ia32"', {
                 'cflags': ['-m32'],
@@ -273,89 +373,57 @@
                 'cflags': ['-m64'],
                 'ldflags': ['-m64'],
               }],
-              [ 'use_pprof==1' , {
+            ],
+          }],
+          [ 'use_pprof==1 and OS!="android" and OS!="win"', {
+            'conditions': [
+              [ 'OS=="mac"', {
+                'xcode_settings': {
+                  'OTHER_LDFLAGS': [ '-lprofiler' ],
+                },
+              }, {
                 'ldflags': [ '-lprofiler' ],
               }],
+              [ 'OS!="linux"', {
+                'library_dirs': [
+                  '/usr/local/lib/',
+                ],
+              }],
             ],
           }],
-          [ 'disable_werror==0 and (OS=="linux" or OS=="mac")', {
+          [ 'disable_werror==0 and OS!="android" and OS!="win"', {
             'cflags': [
               '<!@(<(python) <(DEPTH)/coreconf/werror.py)',
             ],
+            'xcode_settings': {
+              'OTHER_CFLAGS': [
+                '<!@(<(python) <(DEPTH)/coreconf/werror.py)',
+              ],
+            },
           }],
-          [ 'fuzz==1', {
+          [ 'fuzz_tls==1', {
             'cflags': [
               '-Wno-unused-function',
-            ]
+              '-Wno-unused-variable',
-          }],
+            ],
-          [ 'use_asan==1 or use_ubsan==1', {
-            'cflags': ['-O1'],
             'xcode_settings': {
-              'GCC_OPTIMIZATION_LEVEL': '1', # -O1
+              'OTHER_CFLAGS': [
-            }
+                '-Wno-unused-function',
-          }],
+                '-Wno-unused-variable',
-          [ 'use_asan==1', {
+              ],
-            'variables': {
-              'asan_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py asan)',
-              'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
             },
-            'cflags': ['<@(asan_flags)'],
+          }],
-            'ldflags': ['<@(asan_flags)'],
+          [ 'sanitizer_flags!=0', {
-            'ldflags!': ['<@(no_ldflags)'],
+            'cflags': ['<@(sanitizer_flags)'],
+            'ldflags': ['<@(sanitizer_flags)'],
             'xcode_settings': {
-              'OTHER_CFLAGS': ['<@(asan_flags)'],
+              'OTHER_CFLAGS': ['<@(sanitizer_flags)'],
-              'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
               # We want to pass -fsanitize=... to our final link call,
               # but not to libtool. OTHER_LDFLAGS is passed to both.
               # To trick GYP into doing what we want, we'll piggyback on
               # LIBRARY_SEARCH_PATHS, producing "-L/usr/lib -fsanitize=...".
               # The -L/usr/lib is redundant but innocuous: it's a default path.
-              'LIBRARY_SEARCH_PATHS': ['/usr/lib <(asan_flags)'],
+              'LIBRARY_SEARCH_PATHS': ['/usr/lib <(sanitizer_flags)'],
-            },
-          }],
-          [ 'use_ubsan==1', {
-            'variables': {
-              'ubsan_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ubsan)',
-              'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
-            },
-            'cflags': ['<@(ubsan_flags)'],
-            'ldflags': ['<@(ubsan_flags)'],
-            'ldflags!': ['<@(no_ldflags)'],
-            'xcode_settings': {
-              'OTHER_CFLAGS': ['<@(ubsan_flags)'],
-              'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
-              # See comment above.
-              'LIBRARY_SEARCH_PATHS': ['/usr/lib <(ubsan_flags)'],
-            },
-          }],
-          [ 'use_msan==1', {
-            'variables': {
-              'msan_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py msan)',
-              'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
-            },
-            'cflags': ['<@(msan_flags)'],
-            'ldflags': ['<@(msan_flags)'],
-            'ldflags!': ['<@(no_ldflags)'],
-            'xcode_settings': {
-              'OTHER_CFLAGS': ['<@(msan_flags)'],
-              'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
-              # See comment above.
-              'LIBRARY_SEARCH_PATHS': ['/usr/lib <(msan_flags)'],
-            },
-          }],
-          [ 'use_sancov!=0', {
-            'variables': {
-              'sancov_flags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py sancov <(use_sancov))',
-              'no_ldflags': '<!(<(python) <(DEPTH)/coreconf/sanitizers.py ld)',
-            },
-            'cflags': ['<@(sancov_flags)'],
-            'ldflags': ['<@(sancov_flags)'],
-            'ldflags!': ['<@(no_ldflags)'],
-            'xcode_settings': {
-              'OTHER_CFLAGS': ['<@(sancov_flags)'],
-              'OTHER_LDFLAGS!': ['<@(no_ldflags)'],
-              # See comment above.
-              'LIBRARY_SEARCH_PATHS': ['/usr/lib <(sancov_flags)'],
             },
           }],
           [ 'OS=="android" and mozilla_client==0', {
@@ -368,9 +436,6 @@
           [ 'OS=="mac"', {
             'defines': [
               'DARWIN',
-              'HAVE_STRERROR',
-              'HAVE_BSD_FLOCK',
-              'XP_UNIX',
             ],
             'conditions': [
               [ 'target_arch=="ia32"', {
@@ -415,9 +480,9 @@
                     'PreprocessorDefinitions': [
                       'WIN32',
                     ],
+                    'AdditionalOptions': [ '/EHsc' ],
                   },
                 },
-
               }],
               [ 'target_arch=="x64"', {
                 'msvs_configuration_platform': 'x64',
@@ -430,6 +495,7 @@
                       'WIN64',
                       '_AMD64_',
                     ],
+                    'AdditionalOptions': [ '/EHsc' ],
                   },
                 },
               }],
@@ -451,7 +517,7 @@
       'Debug': {
         'inherit_from': ['Common'],
         'conditions': [
-          [ 'OS=="linux" or OS=="android"', {
+          [ 'OS!="mac" and OS!="win"', {
             'cflags': [
               '-g',
               '<(moz_debug_flags)',
@@ -460,14 +526,15 @@
         ],
         #TODO: DEBUG_$USER
         'defines': ['DEBUG'],
+        'cflags': [ '-O<(debug_optimization_level)' ],
         'xcode_settings': {
           'COPY_PHASE_STRIP': 'NO',
-          'GCC_OPTIMIZATION_LEVEL': '0',
+          'GCC_OPTIMIZATION_LEVEL': '<(debug_optimization_level)',
           'GCC_GENERATE_DEBUGGING_SYMBOLS': 'YES',
         },
         'msvs_settings': {
           'VCCLCompilerTool': {
-            'Optimization': '0',
+            'Optimization': '<(debug_optimization_level)',
             'BasicRuntimeChecks': '3',
             'RuntimeLibrary': '2', # /MD
           },
@@ -482,16 +549,15 @@
       # Common settings for release should go here.
       'Release': {
         'inherit_from': ['Common'],
-        'defines': [
+        'defines': ['NDEBUG'],
-          'NDEBUG',
+        'cflags': [ '-O<(release_optimization_level)' ],
-        ],
         'xcode_settings': {
           'DEAD_CODE_STRIPPING': 'YES',  # -Wl,-dead_strip
-          'GCC_OPTIMIZATION_LEVEL': '2', # -O2
+          'GCC_OPTIMIZATION_LEVEL': '<(release_optimization_level)',
         },
         'msvs_settings': {
           'VCCLCompilerTool': {
-            'Optimization': '2', # /Os
+            'Optimization': '<(release_optimization_level)',
             'RuntimeLibrary': '2', # /MD
           },
           'VCLinkerTool': {
@@ -516,9 +582,9 @@
     },
   },
   'conditions': [
-    [ 'OS=="linux" or OS=="android"', {
+    [ 'cc_use_gnu_ld==1', {
       'variables': {
-        'process_map_file': ['/bin/sh', '-c', '/bin/grep -v ";-" >(mapfile) | sed -e "s,;+,," -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,;," > >@(_outputs)'],
+        'process_map_file': ['/bin/sh', '-c', '/usr/bin/env grep -v ";-" >(mapfile) | sed -e "s,;+,," -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,;," > >@(_outputs)'],
       },
     }],
     [ 'OS=="mac"', {

security/nss/coreconf/coreconf.dep

@@ -10,3 +10,4 @@
  */
 
 #error "Do not include this header file."
+

security/nss/coreconf/detect_host_arch.py

@@ -14,7 +14,7 @@ def main():
     if host_arch in ('amd64', 'x86_64'):
         host_arch = 'x64'
     elif fnmatch.fnmatch(host_arch, 'i?86') or host_arch == 'i86pc':
-        host_arch = 'x64'
+        host_arch = 'ia32'
     elif host_arch.startswith('arm'):
         host_arch = 'arm'
     elif host_arch.startswith('mips'):

security/nss/coreconf/fuzz.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# This file is used by build.sh to setup fuzzing.
+
+set +e
+
+# Default to clang if CC is not set.
+if [ -z "$CC" ]; then
+    command -v clang &> /dev/null 2>&1
+    if [ $? != 0 ]; then
+        echo "Fuzzing requires clang!"
+        exit 1
+    fi
+    export CC=clang
+    export CCC=clang++
+    export CXX=clang++
+fi
+
+gyp_params+=(-Dtest_build=1 -Dfuzz=1 -Dsign_libs=0)
+
+# Add debug symbols even for opt builds.
+nspr_params+=(--enable-debug-symbols)
+
+if [ "$fuzz_oss" = 1 ]; then
+  gyp_params+=(-Dno_zdefs=1 -Dfuzz_oss=1)
+else
+  enable_sanitizer asan
+  # Ubsan doesn't build on 32-bit at the moment. Disable it.
+  if [ "$build_64" = 1 ]; then
+    enable_ubsan
+  fi
+  enable_sancov
+fi
+
+if [ "$fuzz_tls" = 1 ]; then
+  gyp_params+=(-Dfuzz_tls=1)
+fi
+
+if [ ! -f "/usr/lib/libFuzzingEngine.a" ]; then
+  echo "Cloning libFuzzer files ..."
+  run_verbose "$cwd"/fuzz/config/clone_libfuzzer.sh
+fi

security/nss/coreconf/nspr.sh

@@ -1,48 +1,59 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # This script builds NSPR for NSS.
 #
 # This build system is still under development.  It does not yet support all
 # the features or platforms that the regular NSPR build supports.
 
 # variables
-nspr_opt=()
 nspr_cflags=
 nspr_cxxflags=
 nspr_ldflags=
 
-nspr_sanitizer()
+# Try to avoid bmake on OS X and BSD systems
+if hash gmake 2>/dev/null; then
+    make() { command gmake "$@"; }
+fi
+
+nspr_set_flags()
 {
-    nspr_cflags="$nspr_cflags $(python $cwd/coreconf/sanitizers.py $1 $2)"
+    nspr_cflags="$CFLAGS $@"
-    nspr_cxxflags="$nspr_cxxflags $(python $cwd/coreconf/sanitizers.py $1 $2)"
+    nspr_cxxflags="$CXXFLAGS $@"
-    nspr_ldflags="$nspr_ldflags $(python $cwd/coreconf/sanitizers.py $1 $2)"
+    nspr_ldflags="$LDFLAGS $@"
 }
 
-verbose()
+nspr_build()
 {
-    CFLAGS=$nspr_cflags CXXFLAGS=$nspr_cxxflags LDFLAGS=$nspr_ldflags \
+    local nspr_dir="$cwd"/../nspr/$target
-      CC=$CC CXX=$CCC ../configure "${nspr_opt[@]}" --prefix="$obj_dir"
+    mkdir -p "$nspr_dir"
-    make -C "$cwd/../nspr/$target"
-    make -C "$cwd/../nspr/$target" install
-}
 
-silent()
+    # These NSPR options are directory-specific, so they don't need to be
-{
+    # included in nspr_opt and changing them doesn't force a rebuild of NSPR.
-    echo "[1/3] configure NSPR ..."
+    extra_params=(--prefix="$dist_dir"/$target)
-    CFLAGS=$nspr_cflags CXXFLAGS=$nspr_cxxflags LDFLAGS=$nspr_ldflags \
+    if [ "$opt_build" = 1 ]; then
-      CC=$CC CXX=$CCC ../configure "${nspr_opt[@]}" --prefix="$obj_dir" 1> /dev/null
+        extra_params+=(--disable-debug --enable-optimize)
-    echo "[2/3] make NSPR ..."
-    make -C "$cwd/../nspr/$target" 1> /dev/null
-    echo "[3/3] install NSPR ..."
-    make -C "$cwd/../nspr/$target" install 1> /dev/null
-}
-
-build_nspr()
-{
-    mkdir -p "$cwd/../nspr/$target"
-    cd "$cwd/../nspr/$target"
-    if [ "$1" == 1 ]; then
-        verbose
-    else
-        silent
     fi
+
+    echo "NSPR [1/3] configure ..."
+    pushd "$nspr_dir" >/dev/null
+    CFLAGS="$nspr_cflags" CXXFLAGS="$nspr_cxxflags" \
+          LDFLAGS="$nspr_ldflags" CC="$CC" CXX="$CCC" \
+          run_verbose ../configure "${extra_params[@]}" "$@"
+    popd >/dev/null
+    echo "NSPR [2/3] make ..."
+    run_verbose make -C "$nspr_dir"
+    echo "NSPR [3/3] install ..."
+    run_verbose make -C "$nspr_dir" install
+}
+
+nspr_clean()
+{
+    rm -rf "$cwd"/../nspr/$target
+}
+
+set_nspr_path()
+{
+    local include=$(echo "$1" | cut -d: -f1)
+    local lib=$(echo "$1" | cut -d: -f2)
+    gyp_params+=(-Dnspr_include_dir="$include")
+    gyp_params+=(-Dnspr_lib_dir="$lib")
 }

security/nss/coreconf/precommit.clang-format.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# This is a pre-commit hook for use with either mercurial or git.
+#
+# Install this by running the script with an argument of "install".
+#
+# All that does is add the following lines to .hg/hgrc:
+#
+# [hook]
+# pretxncommit.clang-format = [ ! -x ./coreconf/precommit.clang-format.sh ] || ./coreconf/precommit.clang-format.sh
+#
+# Or installs a symlink to .git/hooks/precommit:
+# $ ln -s ../../coreconf/precommit.clang-format.sh .git/hooks/pre-commit
+
+hash clang-format || exit 1
+[ "$(hg root 2>/dev/null)" = "$PWD" ] && hg=1 || hg=0
+[ "$(git rev-parse --show-toplevel 2>/dev/null)" = "$PWD" ] && git=1 || git=0
+
+if [ "$1" = "install" ]; then
+    if [ "$hg" -eq 1 ]; then
+        hgrc="$(hg root)"/.hg/hgrc
+        if ! grep -q '^pretxncommit.clang-format' "$hgrc"; then
+            echo '[hooks]' >> "$hgrc"
+            echo 'pretxncommit.clang-format = [ ! -x ./coreconf/precommit.clang-format.sh ] || ./coreconf/precommit.clang-format.sh' >> "$hgrc"
+            echo "Installed mercurial pretxncommit hook"
+            exit
+        fi
+    fi
+    if [ "$git" -eq 1 ]; then
+        hook="$(git rev-parse --show-toplevel)"/.git/hooks/pre-commit
+        if [ ! -e "$hook" ]; then
+            ln -s ../../coreconf/precommit.clang-format.sh "$hook"
+            echo "Installed git pre-commit hook"
+            exit
+        fi
+    fi
+    echo "Hook already installed, or not in NSS repo"
+    exit 2
+fi
+
+err=0
+files=()
+if [ "$hg" -eq 1 ]; then
+    files=($(hg status -m -a --rev tip^:tip | cut -f 2 -d ' ' -))
+fi
+if [ "$git" -eq 1 ]; then
+    files=($(git status --porcelain | sed '/^[MACU]/{s/..//;p;};/^R/{s/^.* -> //;p;};d'))
+fi
+tmp=$(mktemp)
+trap 'rm -f "$tmp"' ERR EXIT
+for f in "${files[@]}"; do
+    ext="${f##*.}"
+    if [ "$ext" = "c" -o "$ext" = "h" -o "$ext" = "cc" ]; then
+        [ "$hg" -eq 1 ] && hg cat -r tip "$f" > "$tmp"
+        [ "$git" -eq 1 ] && git show :"$f" > "$tmp"
+        if ! cat "$tmp" | clang-format -assume-filename="$f" | \
+            diff -q "$tmp" - >/dev/null; then
+            [ "$err" -eq 0 ] && echo "Formatting errors found in:" 1>&2
+            echo "  $f" 1>&2
+            err=1
+        fi
+    fi
+done
+exit "$err"

security/nss/coreconf/sanitizers.mk

@@ -1,35 +0,0 @@
-# Address Sanitizer support; include this in OS-specific .mk files
-# *after* defining the variables that are appended to here.
-
-ifeq ($(USE_ASAN), 1)
-SANITIZER_FLAGS_COMMON = -fsanitize=address
-
-ifeq ($(USE_UBSAN), 1)
-SANITIZER_FLAGS_COMMON += -fsanitize=undefined -fno-sanitize-recover=undefined
-endif
-
-ifeq ($(FUZZ), 1)
-SANITIZER_FLAGS_COMMON += -fsanitize-coverage=edge
-endif
-
-SANITIZER_FLAGS_COMMON += $(EXTRA_SANITIZER_FLAGS)
-SANITIZER_CFLAGS = $(SANITIZER_FLAGS_COMMON)
-SANITIZER_LDFLAGS = $(SANITIZER_FLAGS_COMMON)
-OS_CFLAGS += $(SANITIZER_CFLAGS)
-LDFLAGS += $(SANITIZER_LDFLAGS)
-
-# ASan needs frame pointers to save stack traces for allocation/free sites.
-# (Warning: some platforms, like ARM Linux in Thumb mode, don't have useful
-# frame pointers even with this option.)
-SANITIZER_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
-
-ifdef BUILD_OPT
-# You probably want to be able to get debug info for failures, even with an
-# optimized build.
-OPTIMIZER += -g
-else
-# Try maintaining reasonable performance, ASan and UBSan slow things down.
-OPTIMIZER += -O1
-endif
-
-endif

security/nss/coreconf/sanitizers.py

@@ -5,14 +5,16 @@ import sys
 
 def main():
     if len(sys.argv) < 2:
-        raise Exception('Specify either "ld", asan", "msan", "sancov" or "ubsan" as argument.')
+        raise Exception('Specify either "asan", "msan", "sancov" or "ubsan" as argument.')
 
     sanitizer = sys.argv[1]
     if sanitizer == "ubsan":
-        print('-fsanitize=undefined -fno-sanitize-recover=undefined ', end='')
+        if len(sys.argv) < 3:
+            raise Exception('ubsan requires another argument.')
+        print('-fsanitize='+sys.argv[2]+' -fno-sanitize-recover=undefined ', end='')
         return
     if sanitizer == "asan":
-        print('-fsanitize=address ', end='')
+        print('-fsanitize=address -fsanitize-address-use-after-scope ', end='')
         print('-fno-omit-frame-pointer -fno-optimize-sibling-calls ', end='')
         return
     if sanitizer == "msan":
@@ -25,12 +27,7 @@ def main():
         print('-fsanitize-coverage='+sys.argv[2]+' ', end='')
         return
 
-    # We have to remove this from the ld flags when building asan.
+    raise Exception('Specify either "asan", "msan", "sancov" or "ubsan" as argument.')
-    if sanitizer == "ld":
-        print('-Wl,-z,defs ', end='')
-        return
-
-    raise Exception('Specify either "ld", asan", "msan", "sancov" or "ubsan" as argument.')
 
 if __name__ == '__main__':
     main()

security/nss/coreconf/sanitizers.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# This file is used by build.sh to setup sanitizers.
+
+sanitizer_flags=""
+sanitizers=()
+
+# This tracks what sanitizers are enabled so they don't get enabled twice.  This
+# means that doing things that enable the same sanitizer twice (such as enabling
+# both --asan and --fuzz) is order-dependent: only the first is used.
+enable_sanitizer()
+{
+    local san="$1"
+    for i in "${sanitizers[@]}"; do
+        [ "$san" = "$i" ] && return
+    done
+    sanitizers+=("$san")
+
+    if [ -z "$sanitizer_flags" ]; then
+        gyp_params+=(-Dno_zdefs=1)
+    fi
+
+    local cflags=$(python $cwd/coreconf/sanitizers.py "$@")
+    sanitizer_flags="$sanitizer_flags $cflags"
+}
+
+enable_sancov()
+{
+    local clang_version=$($CC --version | grep -oE '([0-9]{1,}\.)+[0-9]{1,}')
+    if [[ ${clang_version:0:1} -lt 4 && ${clang_version:0:1} -eq 3 && ${clang_version:2:1} -lt 9 ]]; then
+        echo "Need at least clang-3.9 (better 4.0) for sancov." 1>&2
+        exit 1
+    fi
+
+    local sancov
+    if [ -n "$1" ]; then
+        sancov="$1"
+    elif [ "${clang_version:0:3}" = "3.9" ]; then
+        sancov=edge,indirect-calls,8bit-counters
+    else
+        sancov=trace-pc-guard,trace-cmp
+    fi
+    enable_sanitizer sancov "$sancov"
+}
+
+enable_ubsan()
+{
+    local ubsan
+    if [ -n "$1" ]; then
+        ubsan="$1"
+    else
+        ubsan=bool,signed-integer-overflow,shift,vptr
+    fi
+    enable_sanitizer ubsan "$ubsan"
+}
+
+# Not strictly a sanitizer, but the pattern fits
+scanbuild=()
+enable_scanbuild()
+{
+    [ "${#scanbuild[@]}" -gt 0 ] && return
+
+    scanbuild=(scan-build)
+    if [ -n "$1" ]; then
+        scanbuild+=(-o "$1")
+    fi
+    # pass on CC and CCC to scanbuild
+    if [ -n "$CC" ]; then
+        scanbuild+=(--use-cc="$CC")
+    fi
+    if [ -n "$CCC" ]; then
+        scanbuild+=(--use-c++="$CCC")
+    fi
+}
+
+run_scanbuild()
+{
+    "${scanbuild[@]}" "$@"
+}

security/nss/coreconf/werror.py

@@ -7,7 +7,8 @@ def main():
     cc = os.environ.get('CC', 'cc')
     sink = open(os.devnull, 'wb')
     try:
-        cc_is_clang = 'clang' in subprocess.check_output([cc, '--version'], stderr=sink)
+        cc_is_clang = 'clang' in subprocess.check_output(
+          [cc, '--version'], universal_newlines=True, stderr=sink)
     except OSError:
         # We probably just don't have CC/cc.
         return
@@ -25,6 +26,7 @@ def main():
             try:
                 v = subprocess.check_output([cc, '-dumpversion'], stderr=sink)
                 v = v.strip(' \r\n').split('.')
+                v = list(map(int, v))
                 if v[0] < 4 or (v[0] == 4 and v[1] < 8):
                     # gcc 4.8 minimum
                     return False