Update NSS to 3.38

- Added HACL*Poly1305 32-bit (INRIA/Microsoft)
- Updated to final TLS 1.3 draft version (28)
- Removed TLS 1.3 prerelease draft limit check
- Removed NPN code
- Enabled dev/urandom-only RNG on Linux with NSS_SEED_ONLY_DEV_URANDOM for non-standard environments
- Fixed several bugs with TLS 1.3 negotiation
- Updated internal certificate store
- Added support for the TLS Record Size Limit Extension.
- Fixed CVE-2018-0495
- Various security fixes in the ASN.1 code.

security/nss/lib/pk11wrap/pk11akey.c

@@ -804,12 +804,30 @@ PK11_MakePrivKey(PK11SlotInfo *slot, KeyType keyType,
     /* don't know? look it up */
     if (keyType == nullKey) {
         CK_KEY_TYPE pk11Type = CKK_RSA;
+        SECItem info;
 
         pk11Type = PK11_ReadULongAttribute(slot, privID, CKA_KEY_TYPE);
         isTemp = (PRBool)!PK11_HasAttributeSet(slot, privID, CKA_TOKEN, PR_FALSE);
         switch (pk11Type) {
             case CKK_RSA:
                 keyType = rsaKey;
+                /* determine RSA key type from the CKA_PUBLIC_KEY_INFO if present */
+                rv = PK11_ReadAttribute(slot, privID, CKA_PUBLIC_KEY_INFO, NULL, &info);
+                if (rv == SECSuccess) {
+                    CERTSubjectPublicKeyInfo *spki;
+
+                    spki = SECKEY_DecodeDERSubjectPublicKeyInfo(&info);
+                    if (spki) {
+                        SECOidTag tag;
+
+                        tag = SECOID_GetAlgorithmTag(&spki->algorithm);
+                        if (tag == SEC_OID_PKCS1_RSA_PSS_SIGNATURE)
+                            keyType = rsaPssKey;
+                        SECKEY_DestroySubjectPublicKeyInfo(spki);
+                    }
+                    SECITEM_FreeItem(&info, PR_FALSE);
+                }
+
                 break;
             case CKK_DSA:
                 keyType = dsaKey;

security/nss/lib/pk11wrap/pk11pars.c

@@ -547,16 +547,16 @@ secmod_applyCryptoPolicy(const char *policyString,
         for (i = 0; i < PR_ARRAY_SIZE(algOptList); i++) {
             const oidValDef *algOpt = &algOptList[i];
             unsigned name_size = algOpt->name_size;
-            PRBool newValue = PR_FALSE;
+            PRBool newOption = PR_FALSE;
 
             if ((length >= name_size) && (cipher[name_size] == '/')) {
-                newValue = PR_TRUE;
+                newOption = PR_TRUE;
             }
-            if ((newValue || algOpt->name_size == length) &&
+            if ((newOption || algOpt->name_size == length) &&
                 PORT_Strncasecmp(algOpt->name, cipher, name_size) == 0) {
                 PRUint32 value = algOpt->val;
                 PRUint32 enable, disable;
-                if (newValue) {
+                if (newOption) {
                     value = secmod_parsePolicyValue(&cipher[name_size] + 1,
                                                     length - name_size - 1);
                 }