bump nss to 3.27

Notable changes in NSS 3.24:
* Add a shared library (libfreeblpriv3) on Linux platforms that define FREEBL_LOWHASH

Change-Id: If99ee77bea40796cc56944724291a83068ff8198
Reviewed-on: https://gerrit.libreoffice.org/27304
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

10 files changed, 106 insertions, 42 deletions

diff --git a/external/nss/ExternalPackage_nss.mk b/external/nss/ExternalPackage_nss.mk
index 20cd7561b517..6d568b7edfee 100644
--- a/external/nss/ExternalPackage_nss.mk
+++ b/external/nss/ExternalPackage_nss.mk
@@ -58,5 +58,10 @@ $(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
 		dist/out/lib/libsqlite3.so \
 ))
 endif
+ifeq ($(OS),LINUX)
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		dist/out/lib/libfreeblpriv3.so \
+))
+endif
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/nss/UnpackedTarball_nss.mk b/external/nss/UnpackedTarball_nss.mk
index e47b2419625e..a0ac57173fd1 100644
--- a/external/nss/UnpackedTarball_nss.mk
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -25,6 +25,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
 		external/nss/nss.mingw.patch.3) \
     external/nss/ubsan.patch.0 \
     external/nss/clang-cl.patch.0 \
+    external/nss/nss.windowbuild.patch.0 \
     $(if $(filter IOS,$(OS)), \
         external/nss/nss-chromium-nss-static.patch \
         external/nss/nss-more-static.patch \
diff --git a/external/nss/clang-cl.patch.0 b/external/nss/clang-cl.patch.0
index a76050d211eb..98786d49971c 100644
--- a/external/nss/clang-cl.patch.0
+++ b/external/nss/clang-cl.patch.0
@@ -63,9 +63,9 @@
  #define CERTDB_VALID_PEER CERTDB_TERMINAL_RECORD
 --- nss/lib/util/pkcs11n.h
 +++ nss/lib/util/pkcs11n.h
-@@ -390,7 +390,7 @@
+@@ -426,7 +426,7 @@
  /* keep the old value for compatibility reasons*/
- #define CKT_NSS_MUST_VERIFY ((__CKT_NSS_MUST_VERIFY)(CKT_NSS +4))
+ #define CKT_NSS_MUST_VERIFY ((__CKT_NSS_MUST_VERIFY)(CKT_NSS + 4))
  #else
 -#ifdef _WIN32
 +#if defined _WIN32 && !defined __clang__
diff --git a/external/nss/nss-winXP-sdk.patch.1 b/external/nss/nss-winXP-sdk.patch.1
index 2c8189215083..5273e71705b6 100644
--- a/external/nss/nss-winXP-sdk.patch.1
+++ b/external/nss/nss-winXP-sdk.patch.1
@@ -1,9 +1,12 @@
 diff -ur nss.org/nss/coreconf/config.mk nss/nss/coreconf/config.mk
 --- nss.org/nss/coreconf/config.mk	2016-03-15 14:52:19.706093300 +0100
 +++ nss/nss/coreconf/config.mk	2016-03-15 14:56:51.549914800 +0100
-@@ -188,3 +188,5 @@
+@@ -203,6 +203,8 @@
  
  # Hide old, deprecated, TLS cipher suite names when building NSS
  DEFINES += -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES
 +# build with 7.1A SDK for winXP compatibility
 +DEFINES += -D_USING_V110_SDK71_
+ 
+ # Mozilla's mozilla/modules/zlib/src/zconf.h adds the MOZ_Z_ prefix to zlib
+ # exported symbols, which causes problem when NSS is built as part of Mozilla.
diff --git a/external/nss/nss.nowerror.patch b/external/nss/nss.nowerror.patch
index ca5f17ccbf66..ff81a9b33539 100644
--- a/external/nss/nss.nowerror.patch
+++ b/external/nss/nss.nowerror.patch
@@ -1,14 +1,12 @@
 diff -ur nss.org/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk
 --- a/nss.org/nss/coreconf/WIN32.mk	2016-04-13 11:33:09.322294523 +0200
 +++ b/nss/nss/coreconf/WIN32.mk	2016-04-13 11:33:27.744323969 +0200
-@@ -126,9 +126,9 @@
-     OS_CFLAGS += -W3 -nologo -D_CRT_SECURE_NO_WARNINGS \
- 		 -D_CRT_NONSTDC_NO_WARNINGS
+@@ -127,7 +127,7 @@
+                       -D_CRT_NONSTDC_NO_WARNINGS
      OS_DLLFLAGS += -nologo -DLL -SUBSYSTEM:WINDOWS
      ifndef NSS_ENABLE_WERROR
 -        NSS_ENABLE_WERROR = 1
 +        NSS_ENABLE_WERROR = 0
      endif
      ifeq ($(NSS_ENABLE_WERROR),1)
-         OS_CFLAGS += -WX
-     endif
+         WARNING_CFLAGS += -WX
diff --git a/external/nss/nss.patch b/external/nss/nss.patch
index 548363578789..771ebf59baed 100644
--- a/external/nss/nss.patch
+++ b/external/nss/nss.patch
@@ -110,16 +110,16 @@ diff -ru a/nss/coreconf/Linux.mk b/nss/coreconf/Linux.mk
  RANLIB			= ranlib
  
  DEFAULT_COMPILER = gcc
-@@ -145,7 +148,7 @@
- # incorrectly reports undefined references in the libraries we link with, so
- # we don't use -z defs there.
+@@ -157,7 +160,7 @@
+ # against the libsanitizer runtime built into the main executable.
  ZDEFS_FLAG		= -Wl,-z,defs
+ ifneq ($(USE_ASAN),1)
 -DSO_LDOPTS		+= $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG))
-+DSO_LDOPTS		+= $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG)) -Wl,-z,origin '-Wl,-rpath,$$ORIGIN'
++DSO_LDOPTS             += $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG)) -Wl,-z,origin '-Wl,-rpath,$$ORIGIN'
+ endif
  LDFLAGS			+= $(ARCHFLAG)
  
- # On Maemo, we need to use the -rpath-link flag for even the standard system
-@@ -176,8 +179,13 @@
+@@ -189,8 +192,13 @@
  endif
  endif
  
@@ -175,13 +175,13 @@ diff -ru a/nss/Makefile b/nss/Makefile
 diff -ru nss.orig/nss/coreconf/Werror.mk nss/nss/coreconf/Werror.mk
 --- a/nss.orig/nss/coreconf/Werror.mk	2016-02-12 15:36:18.000000000 +0100
 +++ b/nss/nss/coreconf/Werror.mk	2016-02-23 23:58:15.119584046 +0100
-@@ -60,7 +60,8 @@
-   endif #ndef NSS_ENABLE_WERROR
+@@ -94,7 +94,8 @@
+     endif #ndef NSS_ENABLE_WERROR
  
-   ifeq ($(NSS_ENABLE_WERROR),1)
--    WARNING_CFLAGS += -Werror
+     ifeq ($(NSS_ENABLE_WERROR),1)
+-      WARNING_CFLAGS += -Werror
 +# We do not treat warnings as errors.
 +#    WARNING_CFLAGS += -Werror
-   else
-     # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions.
-     # Use this to disable use of that #pragma and the warnings it suppresses.
+     else
+       # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions.
+       # Use this to disable use of that #pragma and the warnings it suppresses.
diff --git a/external/nss/nss.windowbuild.patch.0 b/external/nss/nss.windowbuild.patch.0
new file mode 100644
index 000000000000..04b13a7bea27
--- /dev/null
+++ b/external/nss/nss.windowbuild.patch.0
@@ -0,0 +1,55 @@
+--- ./nss/external_tests/ssl_gtest/tls_connect.cc
++++ ./nss/external_tests/ssl_gtest/tls_connect.cc
+@@ -375,6 +375,12 @@
+   }
+ }
+ 
++// A simple value of "a", "b".  Note that the preferred value of "a" is placed
++// at the end, because the NSS API follows the now defunct NPN specification,
++// which places the preferred (and default) entry at the end of the list.
++// NSS will move this final entry to the front when used with ALPN.
++const uint8_t alpn_dummy_val_[4] = { 0x01, 0x62, 0x01, 0x61 };
++
+ void TlsConnectTestBase::EnableAlpn() {
+   client_->EnableAlpn(alpn_dummy_val_, sizeof(alpn_dummy_val_));
+   server_->EnableAlpn(alpn_dummy_val_, sizeof(alpn_dummy_val_));
+--- ./nss/external_tests/ssl_gtest/tls_connect.h
++++ ./nss/external_tests/ssl_gtest/tls_connect.h
+@@ -113,12 +113,6 @@
+   SessionResumptionMode expected_resumption_mode_;
+   std::vector<std::vector<uint8_t>> session_ids_;
+ 
+-  // A simple value of "a", "b".  Note that the preferred value of "a" is placed
+-  // at the end, because the NSS API follows the now defunct NPN specification,
+-  // which places the preferred (and default) entry at the end of the list.
+-  // NSS will move this final entry to the front when used with ALPN.
+-  const uint8_t alpn_dummy_val_[4] = {0x01, 0x62, 0x01, 0x61};
+-
+  private:
+   void CheckResumption(SessionResumptionMode expected);
+   void CheckExtendedMasterSecret();
+--- ./nss/external_tests/ssl_gtest/ssl_loopback_unittest.cc
++++ ./nss/external_tests/ssl_gtest/ssl_loopback_unittest.cc
+@@ -51,6 +51,12 @@
+   CheckAlpn("a");
+ }
+ 
++// A simple value of "a", "b".  Note that the preferred value of "a" is placed
++// at the end, because the NSS API follows the now defunct NPN specification,
++// which places the preferred (and default) entry at the end of the list.
++// NSS will move this final entry to the front when used with ALPN.
++const uint8_t alpn_dummy_val_[4] = { 0x01, 0x62, 0x01, 0x61 };
++
+ TEST_P(TlsConnectGeneric, ConnectAlpnClone) {
+   EnsureModelSockets();
+   client_model_->EnableAlpn(alpn_dummy_val_, sizeof(alpn_dummy_val_));
+--- ./nss/external_tests/ssl_gtest/databuffer.h
++++ ./nss/external_tests/ssl_gtest/databuffer.h
+@@ -10,6 +10,7 @@
+ #include <algorithm>
+ #include <cassert>
+ #include <cstring>
++#include <cstdint>
+ #include <iomanip>
+ #include <iostream>
+ #if defined(WIN32) || defined(WIN64)
diff --git a/external/nss/nss.windows.patch b/external/nss/nss.windows.patch
index 9464bb1ce090..9dbeaa946520 100644
--- a/external/nss/nss.windows.patch
+++ b/external/nss/nss.windows.patch
@@ -11,12 +11,12 @@
  $(OBJDIR)/%.$(OBJ_SUFFIX): %.cpp
 --- a/a/nss/coreconf/rules.mk	2008-12-03 00:24:39.000000000 +0100
 +++ b/b/nss/coreconf/rules.mk	2009-11-27 13:36:22.662753328 +0100
-@@ -411,7 +411,7 @@
+@@ -386,7 +386,7 @@
  endif
  
  # The quotes allow absolute paths to contain spaces.
--core_abspath = "$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(1)),$(1),$(PWD)/$(1)))"
-+core_abspath = "$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(shell cygpath -m $(1))),$(1),$(shell cygpath -m $(PWD)/$(1))))"
+-core_abspath = '$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(1)),$(1),$(PWD)/$(1)))'
++core_abspath = '$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(shell cygpath -m $(1))),$(1),$(shell cygpath -m $(PWD)/$(1))))'
  
  $(OBJDIR)/$(PROG_PREFIX)%$(OBJ_SUFFIX): %.c
  	@$(MAKE_OBJDIR)
diff --git a/external/nss/nss_macosx.patch b/external/nss/nss_macosx.patch
index 40d02c955160..dfbad1a36f32 100644
--- a/external/nss/nss_macosx.patch
+++ b/external/nss/nss_macosx.patch
@@ -13,7 +13,7 @@ diff -ru a/nspr/configure b/nspr/configure
 diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
 --- a/a/nss/coreconf/Darwin.mk	2014-09-29 16:50:22.992304799 +0100
 +++ b/b/nss/coreconf/Darwin.mk	2014-09-29 16:51:59.214931953 +0100
-@@ -7,8 +7,12 @@
+@@ -8,8 +8,12 @@
  
  DEFAULT_COMPILER = gcc
  
@@ -28,23 +28,25 @@ diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
  RANLIB		= ranlib
  
  ifndef CPU_ARCH
-@@ -19,11 +23,15 @@
+@@ -20,13 +24,17 @@
  
  ifeq (,$(filter-out i%86,$(CPU_ARCH)))
  ifdef USE_64
 +ifeq (,$(findstring -arch ,$(CC)))
  CC              += -arch x86_64
+ CCC             += -arch x86_64
 +endif
  override CPU_ARCH	= x86_64
  else
  OS_REL_CFLAGS	= -Di386
 +ifeq (,$(findstring -arch ,$(CC)))
  CC              += -arch i386
+ CCC             += -arch i386
 +endif
  override CPU_ARCH	= x86
  endif
  else
-@@ -31,12 +39,16 @@
+@@ -40,12 +48,16 @@
  endif
  
  ifneq (,$(MACOS_SDK_DIR))
@@ -62,7 +64,7 @@ diff -ru a/nss/coreconf/Darwin.mk b/nss/coreconf/Darwin.mk
          # GCC <= 3
          DARWIN_SDK_FRAMEWORKS = -F$(MACOS_SDK_DIR)/System/Library/Frameworks
          ifneq (,$(shell find $(MACOS_SDK_DIR)/Library/Frameworks -maxdepth 0))
-@@ -104,7 +115,7 @@
+@@ -108,7 +120,7 @@
  # May override this with different compatibility and current version numbers.
  DARWIN_DYLIB_VERSIONS = -compatibility_version 1 -current_version 1
  # May override this with -bundle to create a loadable module.
diff --git a/external/nss/ubsan.patch.0 b/external/nss/ubsan.patch.0
index 1cdf694f4345..1254afd0c4ad 100644
--- a/external/nss/ubsan.patch.0
+++ b/external/nss/ubsan.patch.0
@@ -11,30 +11,30 @@
          /* pick the newest CRL */
 --- nss/lib/softoken/legacydb/pk11db.c
 +++ nss/lib/softoken/legacydb/pk11db.c
-@@ -58,7 +58,7 @@
+@@ -65,7 +65,7 @@
      unsigned char isModuleDBOnly;
      unsigned char isCritical;
      unsigned char reserved[4];
--    unsigned char names[6];	/* enough space for the length fields */
-+    unsigned char names[1];	/* +5: enough space for the length fields */
+-    unsigned char names[6]; /* enough space for the length fields */
++    unsigned char names[1]; /* +5: enough space for the length fields */
  };
  
  struct lgdbSlotDataStr {
-@@ -139,7 +139,7 @@
- 	goto loser;
+@@ -148,7 +148,7 @@
+         goto loser;
      }
  
 -    dataLen = sizeof(lgdbData) + len + len2 + len3 + sizeof(unsigned short) +
 +    dataLen = sizeof(lgdbData)+5 + len + len2 + len3 + sizeof(unsigned short) +
- 				 count*sizeof(lgdbSlotData);
+               count * sizeof(lgdbSlotData);
  
-     data->data = (unsigned char *) PORT_ZAlloc(dataLen);
-@@ -319,7 +319,7 @@
+     data->data = (unsigned char *)PORT_ZAlloc(dataLen);
+@@ -327,7 +327,7 @@
      }
      if ((encoded->major == LGDB_DB_EXT1_VERSION_MAJOR) &&
- 	(encoded->minor >= LGDB_DB_EXT1_VERSION_MINOR)) {
--	CHECK_SIZE( sizeof(lgdbData));
-+	CHECK_SIZE( sizeof(lgdbData)+5);
- 	trustOrder     = LGDB_GETLONG(encoded->trustOrder);
- 	cipherOrder    = LGDB_GETLONG(encoded->cipherOrder);
- 	isModuleDB     = (encoded->isModuleDB != 0) ? PR_TRUE: PR_FALSE;
+         (encoded->minor >= LGDB_DB_EXT1_VERSION_MINOR)) {
+-        CHECK_SIZE(sizeof(lgdbData));
++        CHECK_SIZE(sizeof(lgdbData)+5);
+         trustOrder = LGDB_GETLONG(encoded->trustOrder);
+         cipherOrder = LGDB_GETLONG(encoded->cipherOrder);
+         isModuleDB = (encoded->isModuleDB != 0) ? PR_TRUE : PR_FALSE;