Backout revision 36f75c2863a1, bug 1258375
authorKai Engert <kaie@kuix.de>
Mon, 11 Apr 2016 17:00:39 +0200
changeset 292612 8341dd949e3d896a47a82161867d88f34d8676a0
parent 292611 4a645a9f6e22ebcbb8d28d1cce515d86842c98d3
child 292613 962fe71a51611dd24e8a025d3a7e533c8a6c1953
push id30164
push userkwierso@gmail.com
push dateMon, 11 Apr 2016 23:02:30 +0000
treeherdermozilla-central@21bf1af375c1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1258375
milestone48.0a1
backs out36f75c2863a151b6642d68cc4b94493fabb1531e
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backout revision 36f75c2863a1, bug 1258375
b2g/installer/package-manifest.in
browser/installer/package-manifest.in
config/external/nss/Makefile.in
config/external/nss/nss.symbols
security/nss/Makefile
security/nss/TAG-INFO
security/nss/automation/buildbot-slave/build.sh
security/nss/circle.yml
security/nss/cmd/bltest/blapitest.c
security/nss/cmd/certutil/certutil.c
security/nss/cmd/fipstest/aes.sh
security/nss/cmd/fipstest/aesgcm.sh
security/nss/cmd/fipstest/dsa.sh
security/nss/cmd/fipstest/ecdsa.sh
security/nss/cmd/fipstest/fipstest.c
security/nss/cmd/fipstest/hmac.sh
security/nss/cmd/fipstest/rng.sh
security/nss/cmd/fipstest/rsa.sh
security/nss/cmd/fipstest/runtest.sh
security/nss/cmd/fipstest/sha.sh
security/nss/cmd/fipstest/tdea.sh
security/nss/cmd/fipstest/tls.sh
security/nss/cmd/fipstest/validate.sh
security/nss/cmd/fipstest/validate1.sh
security/nss/cmd/lib/secutil.c
security/nss/cmd/lib/secutil.h
security/nss/cmd/listsuites/listsuites.c
security/nss/cmd/modutil/install-ds.h
security/nss/cmd/pk1sign/pk1sign.c
security/nss/cmd/selfserv/selfserv.c
security/nss/cmd/strsclnt/strsclnt.c
security/nss/cmd/tstclnt/tstclnt.c
security/nss/cmd/vfyserv/vfyserv.c
security/nss/cmd/vfyserv/vfyserv.h
security/nss/cmd/vfyserv/vfyutil.c
security/nss/coreconf/Darwin.mk
security/nss/coreconf/FreeBSD.mk
security/nss/coreconf/Linux.mk
security/nss/coreconf/NetBSD.mk
security/nss/coreconf/OpenBSD.mk
security/nss/coreconf/Werror.mk
security/nss/coreconf/arch.mk
security/nss/coreconf/config.mk
security/nss/coreconf/coreconf.dep
security/nss/coreconf/sanitizers.mk
security/nss/external_tests/manifest.mn
security/nss/external_tests/ssl_gtest/libssl_internals.c
security/nss/external_tests/ssl_gtest/libssl_internals.h
security/nss/external_tests/ssl_gtest/manifest.mn
security/nss/external_tests/ssl_gtest/ssl_extension_unittest.cc
security/nss/external_tests/ssl_gtest/ssl_loopback_unittest.cc
security/nss/external_tests/ssl_gtest/ssl_v2_client_hello_unittest.cc
security/nss/external_tests/ssl_gtest/test_io.cc
security/nss/external_tests/ssl_gtest/tls_agent.cc
security/nss/external_tests/ssl_gtest/tls_agent.h
security/nss/external_tests/ssl_gtest/tls_connect.cc
security/nss/external_tests/ssl_gtest/tls_connect.h
security/nss/external_tests/ssl_gtest/tls_filter.cc
security/nss/external_tests/ssl_gtest/tls_filter.h
security/nss/external_tests/ssl_gtest/tls_parser.h
security/nss/external_tests/util_gtest/Makefile
security/nss/external_tests/util_gtest/manifest.mn
security/nss/external_tests/util_gtest/util_gtest.cc
security/nss/external_tests/util_gtest/util_utf8_unittest.cc
security/nss/lib/certdb/alg1485.c
security/nss/lib/certdb/certdb.c
security/nss/lib/certdb/certv3.c
security/nss/lib/certdb/certxutl.c
security/nss/lib/certdb/secname.c
security/nss/lib/certdb/xbsconst.c
security/nss/lib/crmf/servget.c
security/nss/lib/dbm/src/hash.c
security/nss/lib/freebl/Makefile
security/nss/lib/freebl/blapii.h
security/nss/lib/freebl/blname.c
security/nss/lib/freebl/ctr.c
security/nss/lib/freebl/ctr.h
security/nss/lib/freebl/cts.c
security/nss/lib/freebl/dh.c
security/nss/lib/freebl/drbg.c
security/nss/lib/freebl/ec.c
security/nss/lib/freebl/ecl/ecp_fpinc.c
security/nss/lib/freebl/fipsfreebl.c
security/nss/lib/freebl/freebl_hash_vector.def
security/nss/lib/freebl/gcm.c
security/nss/lib/freebl/ldvector.c
security/nss/lib/freebl/loader.c
security/nss/lib/freebl/loader.h
security/nss/lib/freebl/lowhash_vector.c
security/nss/lib/freebl/manifest.mn
security/nss/lib/freebl/mpi/mpi.c
security/nss/lib/freebl/mpi/mpi.h
security/nss/lib/freebl/mpi/mpmontg.c
security/nss/lib/freebl/mpi/mpprime.c
security/nss/lib/freebl/mpi/target.mk
security/nss/lib/freebl/nsslowhash.c
security/nss/lib/freebl/pqg.c
security/nss/lib/freebl/rijndael.c
security/nss/lib/freebl/rijndael.h
security/nss/lib/freebl/rsa.c
security/nss/lib/freebl/shvfy.c
security/nss/lib/freebl/stubs.c
security/nss/lib/freebl/stubs.h
security/nss/lib/jar/jar-ds.c
security/nss/lib/jar/jar-ds.h
security/nss/lib/jar/jar.c
security/nss/lib/jar/jar.h
security/nss/lib/jar/jarfile.c
security/nss/lib/jar/jarfile.h
security/nss/lib/jar/jarint.c
security/nss/lib/jar/jarint.h
security/nss/lib/jar/jarnav.c
security/nss/lib/jar/jarsign.c
security/nss/lib/jar/jarver.c
security/nss/lib/jar/jzconf.h
security/nss/lib/jar/jzlib.h
security/nss/lib/nss/nss.h
security/nss/lib/pk11wrap/pk11obj.c
security/nss/lib/pkcs7/certread.c
security/nss/lib/pkcs7/p7local.c
security/nss/lib/smime/cmsencode.c
security/nss/lib/smime/cmsrecinfo.c
security/nss/lib/softoken/Makefile
security/nss/lib/softoken/fipstest.c
security/nss/lib/softoken/fipstokn.c
security/nss/lib/softoken/legacydb/lgdb.h
security/nss/lib/softoken/legacydb/lgfips.c
security/nss/lib/softoken/legacydb/lginit.c
security/nss/lib/softoken/legacydb/manifest.mn
security/nss/lib/softoken/legacydb/pcertdb.c
security/nss/lib/softoken/lgglue.c
security/nss/lib/softoken/lgglue.h
security/nss/lib/softoken/pkcs11.c
security/nss/lib/softoken/pkcs11c.c
security/nss/lib/softoken/pkcs11i.h
security/nss/lib/softoken/sdb.c
security/nss/lib/softoken/sdb.h
security/nss/lib/softoken/sftkdb.c
security/nss/lib/softoken/softkver.h
security/nss/lib/softoken/softoken.h
security/nss/lib/ssl/SSLerrs.h
security/nss/lib/ssl/derive.c
security/nss/lib/ssl/dtlscon.c
security/nss/lib/ssl/manifest.mn
security/nss/lib/ssl/notes.txt
security/nss/lib/ssl/ssl.h
security/nss/lib/ssl/ssl3con.c
security/nss/lib/ssl/ssl3ext.c
security/nss/lib/ssl/ssl3gthr.c
security/nss/lib/ssl/ssl3prot.h
security/nss/lib/ssl/sslauth.c
security/nss/lib/ssl/sslcon.c
security/nss/lib/ssl/sslenum.c
security/nss/lib/ssl/sslerr.h
security/nss/lib/ssl/sslgathr.c
security/nss/lib/ssl/sslimpl.h
security/nss/lib/ssl/sslinfo.c
security/nss/lib/ssl/sslnonce.c
security/nss/lib/ssl/sslproto.h
security/nss/lib/ssl/sslsecur.c
security/nss/lib/ssl/sslsnce.c
security/nss/lib/ssl/sslsock.c
security/nss/lib/ssl/sslt.h
security/nss/lib/ssl/ssltrace.c
security/nss/lib/ssl/tls13con.c
security/nss/lib/ssl/tls13con.h
security/nss/lib/ssl/tls13hkdf.c
security/nss/lib/util/Makefile
security/nss/lib/util/ciferfam.h
security/nss/lib/util/nssutil.def
security/nss/lib/util/nssutil.h
security/nss/lib/util/pkcs11t.h
security/nss/lib/util/secoid.c
security/nss/lib/util/secoidt.h
security/nss/lib/util/secport.c
security/nss/lib/util/secport.h
security/nss/lib/util/utf8.c
security/nss/lib/util/utilpars.c
security/nss/lib/util/verref.h
security/nss/tests/all.sh
security/nss/tests/common/Makefile
security/nss/tests/common/init.sh
security/nss/tests/iopr/server_scr/cipher.list
security/nss/tests/pkcs11/netscape/suites/Makefile
security/nss/tests/pkcs11/netscape/suites/config.mk
security/nss/tests/pkcs11/netscape/suites/manifest.mn
security/nss/tests/pkcs11/netscape/suites/security/Makefile
security/nss/tests/pkcs11/netscape/suites/security/config.mk
security/nss/tests/pkcs11/netscape/suites/security/manifest.mn
security/nss/tests/pkcs11/netscape/suites/security/pkcs11/Makefile
security/nss/tests/pkcs11/netscape/suites/security/pkcs11/config.mk
security/nss/tests/pkcs11/netscape/suites/security/pkcs11/manifest.mn
security/nss/tests/pkcs11/netscape/suites/security/pkcs11/pk11test.c
security/nss/tests/pkcs11/netscape/suites/security/pkcs11/pk11test.h
security/nss/tests/pkcs11/netscape/suites/security/pkcs11/pk11test.htp
security/nss/tests/pkcs11/netscape/suites/security/pkcs11/pkcs11.h
security/nss/tests/pkcs11/netscape/suites/security/pkcs11/pkcs11.reg
security/nss/tests/pkcs11/netscape/suites/security/pkcs11/pkcs11.rep
security/nss/tests/pkcs11/netscape/suites/security/pkcs11/rules.mk
security/nss/tests/pkcs11/netscape/suites/security/ssl/Makefile
security/nss/tests/pkcs11/netscape/suites/security/ssl/README
security/nss/tests/pkcs11/netscape/suites/security/ssl/config.mk
security/nss/tests/pkcs11/netscape/suites/security/ssl/manifest.mn
security/nss/tests/pkcs11/netscape/suites/security/ssl/ssl.reg
security/nss/tests/pkcs11/netscape/suites/security/ssl/sslc.c
security/nss/tests/pkcs11/netscape/suites/security/ssl/sslc.h
security/nss/tests/pkcs11/netscape/suites/security/ssl/ssls.c
security/nss/tests/pkcs11/netscape/suites/security/ssl/ssls.h
security/nss/tests/pkcs11/netscape/suites/security/ssl/sslt.c
security/nss/tests/pkcs11/netscape/suites/security/ssl/sslt.h
security/nss/tests/pkcs11/netscape/suites/security/ssl/sslt.htp
security/nss/tests/pkcs11/netscape/suites/security/ssl/sslt.rep
security/nss/tests/pkcs11/netscape/trivial/.cvsignore
security/nss/tests/pkcs11/netscape/trivial/Makefile.in
security/nss/tests/pkcs11/netscape/trivial/README.txt
security/nss/tests/pkcs11/netscape/trivial/acconfig.h
security/nss/tests/pkcs11/netscape/trivial/config.h.in
security/nss/tests/pkcs11/netscape/trivial/configure
security/nss/tests/pkcs11/netscape/trivial/configure.in
security/nss/tests/pkcs11/netscape/trivial/install-sh
security/nss/tests/pkcs11/netscape/trivial/trivial.c
security/nss/tests/ssl/ssl.sh
security/nss/tests/ssl/sslcov.txt
security/nss/tests/ssl/sslstress.txt
security/nss/tests/util_gtests/util_gtests.sh
toolkit/mozapps/installer/packager.py
--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -806,21 +806,17 @@
 @RESPATH@/components/pippki.xpt
 @BINPATH@/@DLL_PREFIX@nss3@DLL_SUFFIX@
 #ifndef MOZ_FOLD_LIBS
 @BINPATH@/@DLL_PREFIX@nssutil3@DLL_SUFFIX@
 @BINPATH@/@DLL_PREFIX@smime3@DLL_SUFFIX@
 @BINPATH@/@DLL_PREFIX@ssl3@DLL_SUFFIX@
 #endif
 @BINPATH@/@DLL_PREFIX@softokn3@DLL_SUFFIX@
-#if defined(XP_LINUX) && !defined(ANDROID)
-@BINPATH@/@DLL_PREFIX@freeblpriv3@DLL_SUFFIX@
-#else
 @BINPATH@/@DLL_PREFIX@freebl3@DLL_SUFFIX@
-#endif
 #ifndef CROSS_COMPILE
 @BINPATH@/@DLL_PREFIX@freebl3.chk
 @BINPATH@/@DLL_PREFIX@softokn3.chk
 #endif
 #ifndef NSS_DISABLE_DBM
 @BINPATH@/@DLL_PREFIX@nssdbm3@DLL_SUFFIX@
 #ifndef CROSS_COMPILE
 @BINPATH@/@DLL_PREFIX@nssdbm3.chk
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -746,21 +746,17 @@
 @RESPATH@/components/dom_smil.xpt
 
 ; [Personal Security Manager]
 ;
 ; NSS libraries are signed in the staging directory,
 ; meaning their .chk files are created there directly.
 ;
 #ifndef MOZ_SYSTEM_NSS
-#if defined(XP_LINUX) && !defined(ANDROID)
-@BINPATH@/@DLL_PREFIX@freeblpriv3@DLL_SUFFIX@
-#else
 @BINPATH@/@DLL_PREFIX@freebl3@DLL_SUFFIX@
-#endif
 @BINPATH@/@DLL_PREFIX@nss3@DLL_SUFFIX@
 @BINPATH@/@DLL_PREFIX@nssckbi@DLL_SUFFIX@
 #ifndef NSS_DISABLE_DBM
 @BINPATH@/@DLL_PREFIX@nssdbm3@DLL_SUFFIX@
 #endif
 #ifndef MOZ_FOLD_LIBS
 @BINPATH@/@DLL_PREFIX@nssutil3@DLL_SUFFIX@
 @BINPATH@/@DLL_PREFIX@smime3@DLL_SUFFIX@
--- a/config/external/nss/Makefile.in
+++ b/config/external/nss/Makefile.in
@@ -63,28 +63,19 @@ HAVE_FREEBL_LIBS_64 = 1
 else
 HAVE_FREEBL_LIBS =
 HAVE_FREEBL_LIBS_32FPU = 1
 HAVE_FREEBL_LIBS_32INT64 = 1
 endif
 endif
 endif
 
-ifeq ($(OS_TARGET),Linux)
-HAVE_FREEBL_LIBS = 
-HAVE_FREEBL_LIBS_PRIV = 1
-FREEBL_LOWHASH_FLAG = FREEBL_LOWHASH=1
-endif
-
 ifdef HAVE_FREEBL_LIBS
 NSS_EXTRA_DLLS += freebl3
 endif
-ifdef HAVE_FREEBL_LIBS_PRIV
-NSS_EXTRA_DLLS += freeblpriv3
-endif
 ifdef HAVE_FREEBL_LIBS_32INT32
 NSS_EXTRA_DLLS += freebl_32int_3
 endif
 ifdef HAVE_FREEBL_LIBS_32FPU
 NSS_EXTRA_DLLS += freebl_32fpu_3
 endif
 ifdef HAVE_FREEBL_LIBS_32INT64
 NSS_EXTRA_DLLS += freebl_32int64_3
@@ -233,17 +224,20 @@ endif
 
 ifneq (,$(NSS_EXTRA_LDFLAGS))
 DEFAULT_GMAKE_FLAGS += \
 	LDFLAGS='$(LDFLAGS) $(NSS_EXTRA_LDFLAGS)' \
 	DSO_LDOPTS='$(DSO_LDOPTS) $(LDFLAGS) $(NSS_EXTRA_LDFLAGS)' \
 	$(NULL)
 endif
 
-DEFAULT_GMAKE_FLAGS += FREEBL_NO_DEPEND=0 $(FREEBL_LOWHASH_FLAG)
+DEFAULT_GMAKE_FLAGS += FREEBL_NO_DEPEND=0
+ifeq ($(OS_TARGET),Linux)
+DEFAULT_GMAKE_FLAGS += FREEBL_LOWHASH=1
+endif
 
 ifdef MOZ_NO_WLZDEFS
 DEFAULT_GMAKE_FLAGS += ZDEFS_FLAG=
 endif
 ifdef MOZ_CFLAGS_NSS
 DEFAULT_GMAKE_FLAGS += XCFLAGS='$(filter-out -W%,$(CFLAGS))'
 DEFAULT_GMAKE_FLAGS += DARWIN_DYLIB_VERSIONS='-compatibility_version 1 -current_version 1 $(LDFLAGS)'
 endif
--- a/config/external/nss/nss.symbols
+++ b/config/external/nss/nss.symbols
@@ -447,24 +447,22 @@ PORT_ArenaAlloc_Util
 PORT_ArenaGrow_Util
 PORT_ArenaMark_Util
 PORT_ArenaRelease_Util
 PORT_ArenaStrdup
 PORT_ArenaStrdup_Util
 PORT_ArenaUnmark_Util
 PORT_ArenaZAlloc
 PORT_ArenaZAlloc_Util
-PORT_DestroyCheapArena
 PORT_Free
 PORT_FreeArena
 PORT_FreeArena_Util
 PORT_Free_Util
 PORT_GetError
 PORT_GetError_Util
-PORT_InitCheapArena
 PORT_NewArena
 PORT_NewArena_Util
 PORT_Realloc_Util
 PORT_RegExpSearch
 PORT_SetError
 PORT_SetError_Util
 PORT_SetUCS2_ASCIIConversionFunction
 PORT_SetUCS2_ASCIIConversionFunction_Util
--- a/security/nss/Makefile
+++ b/security/nss/Makefile
@@ -78,26 +78,17 @@ NSPR_CONFIGURE_OPTS += --enable-win32-ta
 endif
 ifdef USE_DEBUG_RTL
 NSPR_CONFIGURE_OPTS += --enable-debug-rtl
 endif
 ifdef USE_STATIC_RTL
 NSPR_CONFIGURE_OPTS += --enable-static-rtl
 endif
 ifdef NS_USE_GCC
-NSPR_CONFIGURE_ENV = CC=gcc CXX=g++
-endif
-
-ifdef SANITIZER_CFLAGS
-ifdef BUILD_OPT
-NSPR_CONFIGURE_OPTS += --enable-debug-symbols
-endif
-NSPR_CONFIGURE_ENV += CFLAGS='$(SANITIZER_CFLAGS)' \
-                      CXXFLAGS='$(SANITIZER_CFLAGS)' \
-                      LDFLAGS='$(SANITIZER_LDFLAGS)'
+NSPR_COMPILERS = CC=gcc CXX=g++
 endif
 
 #
 # Some pwd commands on Windows (for example, the pwd
 # command in Cygwin) return a pathname that begins
 # with a (forward) slash.  When such a pathname is
 # passed to Windows build tools (for example, cl), it
 # is mistaken as a command-line option.  If that is the case,
@@ -114,17 +105,17 @@ ifeq ($(USEABSPATH),"YES")
 NSPR_PREFIX = $(shell pwd)/../dist/$(OBJDIR_NAME)
 else
 NSPR_PREFIX = $$(topsrcdir)/../dist/$(OBJDIR_NAME)
 endif
 
 $(NSPR_CONFIG_STATUS): $(NSPR_CONFIGURE)
 	mkdir -p $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME)
 	cd $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME) ; \
-	$(NSPR_CONFIGURE_ENV) sh ../configure \
+	$(NSPR_COMPILERS) sh ../configure \
 	$(NSPR_CONFIGURE_OPTS) \
 	--with-dist-prefix='$(NSPR_PREFIX)' \
 	--with-dist-includedir='$(NSPR_PREFIX)/include'
 
 build_nspr: $(NSPR_CONFIG_STATUS)
 	$(MAKE) -C $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME)
 
 clobber_nspr: $(NSPR_CONFIG_STATUS)
--- a/security/nss/TAG-INFO
+++ b/security/nss/TAG-INFO
@@ -1,1 +1,1 @@
-NSS_3_24_BETA5
+NSS_3_23_RTM
--- a/security/nss/automation/buildbot-slave/build.sh
+++ b/security/nss/automation/buildbot-slave/build.sh
@@ -283,29 +283,24 @@ prepare()
 {
     rm -rf ${OUTPUTDIR}.oldest >/dev/null 2>&1
     mv ${OUTPUTDIR}.older ${OUTPUTDIR}.oldest >/dev/null 2>&1
     mv ${OUTPUTDIR}.old ${OUTPUTDIR}.older >/dev/null 2>&1
     mv ${OUTPUTDIR}.last ${OUTPUTDIR}.old >/dev/null 2>&1
     mv ${OUTPUTDIR} ${OUTPUTDIR}.last >/dev/null 2>&1
     mkdir -p ${OUTPUTDIR}
 
-    cd ${HGDIR}/nss
-
     if [ -z "${NSS_DISABLE_ECC}" -a -n "${NSS_ECC_MORE_THAN_SUITE_B}" ]; then
+        cd ${HGDIR}/nss
         ECF="lib/freebl/ecl/ecl-curve.h"
 	print_log "hg revert -r NSS_3_11_1_RTM ${ECF}"
         hg revert -r NSS_3_11_1_RTM security/nss/${ECF}
         cp -f security/nss/${ECF} ${ECF}
     fi
 
-    if [ -n "${FEWER_STRESS_ITERATIONS}" ]; then
-        sed -i 's/-c_1000_/-c_500_/g' tests/ssl/sslstress.txt
-    fi
-
     return 0
 }
 
 move_results()
 {
     cd ${HGDIR}
     if [ -n "${TEST_NSS}" ]; then
 	mv -f tests_results ${OUTPUTDIR}
--- a/security/nss/circle.yml
+++ b/security/nss/circle.yml
@@ -1,18 +1,18 @@
 checkout:
     post:
         - cd ..; hg clone https://hg.mozilla.org/projects/nspr
 
 test:
     override:
         - make nss_build_all
-        - cd tests; NSS_TESTS="ssl_gtests pk11_gtests der_gtests util_gtests" NSS_CYCLES=standard ./all.sh
+        - cd tests; NSS_TESTS="ssl_gtests pk11_gtests der_gtests" NSS_CYCLES=standard ./all.sh
         - BUILD_OPT=1 make nss_build_all
-        - cd tests; BUILD_OPT=1 NSS_TESTS="ssl_gtests pk11_gtests der_gtests util_gtests" NSS_CYCLES=standard ./all.sh
+        - cd tests; BUILD_OPT=1 NSS_TESTS="ssl_gtests pk11_gtests der_gtests" NSS_CYCLES=standard ./all.sh
 
 machine:
     environment:
         { USE_64: 1,
           NSS_ENABLE_TLS_1_3: 1,
         }
     hosts:
 
--- a/security/nss/cmd/bltest/blapitest.c
+++ b/security/nss/cmd/bltest/blapitest.c
@@ -3744,17 +3744,17 @@ int main(int argc, char **argv)
 	rv = blapi_selftest(modesToTest, numModesToTest, inoff, outoff,
 	                    encrypt, decrypt);
 	PORT_Free(cipherInfo);
 	return rv == SECSuccess ? 0 : 1;
     }
 
     /* Do FIPS self-test */
     if (bltest.commands[cmd_FIPS].activated) {
-	CK_RV ckrv = sftk_FIPSEntryOK();
+	CK_RV ckrv = sftk_fipsPowerUpSelfTest();
 	fprintf(stdout, "CK_RV: %ld.\n", ckrv);
         PORT_Free(cipherInfo);
         if (ckrv == CKR_OK)
             return SECSuccess;
         return SECFailure;
     }
 
     /*
--- a/security/nss/cmd/certutil/certutil.c
+++ b/security/nss/cmd/certutil/certutil.c
@@ -436,16 +436,17 @@ outputCertOrExtension(CERTCertificate *t
 		found = PR_TRUE;
 		numBytes = PR_Write(outfile, extension->value.data,
 				    extension->value.len);
 		rv = SECSuccess;
 		if (numBytes != (PRInt32) extension->value.len) {
 		    SECU_PrintSystemError(progName, "error writing extension");
 		    rv = SECFailure;
 		}
+		rv = SECSuccess;
 		break;
 	    }
 	}
 	if (!found) {
 	    SECU_PrintSystemError(progName, "extension not found");
 	    rv = SECFailure;
 	}
     } else {
--- a/security/nss/cmd/fipstest/aes.sh
+++ b/security/nss/cmd/fipstest/aes.sh
@@ -1,29 +1,22 @@
 #!/bin/sh
-# 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
+
 #
 # A Bourne shell script for running the NIST AES Algorithm Validation Suite
 #
 # Before you run the script, set your PATH, LD_LIBRARY_PATH, ... environment
 # variables appropriately so that the fipstest command and the NSPR and NSS
 # shared libraries/DLLs are on the search path.  Then run this script in the
 # directory where the REQUEST (.req) files reside.  The script generates the
 # RESPONSE (.rsp) files in the same directory.
 
-BASEDIR=${1-.}
-TESTDIR=${BASEDIR}/AES
-COMMAND=${2-run}
-REQDIR=${TESTDIR}/req
-RSPDIR=${TESTDIR}/resp
-
 cbc_kat_requests="
 CBCGFSbox128.req
 CBCGFSbox192.req
 CBCGFSbox256.req
 CBCKeySbox128.req
 CBCKeySbox192.req
 CBCKeySbox256.req
 CBCVarKey128.req
@@ -68,45 +61,38 @@ ECBMCT256.req
 "
 
 ecb_mmt_requests="
 ECBMMT128.req
 ECBMMT192.req
 ECBMMT256.req
 "
 
-if [ ${COMMAND} = "verify" ]; then
-    for request in $cbc_kat_requests $cbc_mct_requests $cbc_mmt_requests $ecb_kat_requests $ecb_mct_requests $ecb_mmt_requests; do
-	sh ./validate1.sh ${TESTDIR} $request
-    done
-    exit 0
-fi
-
+for request in $ecb_kat_requests; do
+    response=`echo $request | sed -e "s/req/rsp/"`
+    echo $request $response
+    fipstest aes kat ecb $request > $response
+done
+for request in $ecb_mmt_requests; do
+    response=`echo $request | sed -e "s/req/rsp/"`
+    echo $request $response
+    fipstest aes mmt ecb $request > $response
+done
+for request in $ecb_mct_requests; do
+    response=`echo $request | sed -e "s/req/rsp/"`
+    echo $request $response
+    fipstest aes mct ecb $request > $response
+done
 for request in $cbc_kat_requests; do
     response=`echo $request | sed -e "s/req/rsp/"`
     echo $request $response
-    fipstest aes kat cbc ${REQDIR}/$request > ${RSPDIR}/$response
+    fipstest aes kat cbc $request > $response
+done
+for request in $cbc_mmt_requests; do
+    response=`echo $request | sed -e "s/req/rsp/"`
+    echo $request $response
+    fipstest aes mmt cbc $request > $response
 done
 for request in $cbc_mct_requests; do
     response=`echo $request | sed -e "s/req/rsp/"`
     echo $request $response
-    fipstest aes mct cbc ${REQDIR}/$request > ${RSPDIR}/$response
-done
-for request in $cbc_mmt_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest aes mmt cbc ${REQDIR}/$request > ${RSPDIR}/$response
+    fipstest aes mct cbc $request > $response
 done
-for request in $ecb_kat_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest aes kat ecb ${REQDIR}/$request > ${RSPDIR}/$response
-done
-for request in $ecb_mct_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest aes mct ecb ${REQDIR}/$request > ${RSPDIR}/$response
-done
-for request in $ecb_mmt_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest aes mmt ecb ${REQDIR}/$request > ${RSPDIR}/$response
-done
deleted file mode 100644
--- a/security/nss/cmd/fipstest/aesgcm.sh
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/bin/sh
-# 
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# A Bourne shell script for running the NIST AES Algorithm Validation Suite
-#
-# Before you run the script, set your PATH, LD_LIBRARY_PATH, ... environment
-# variables appropriately so that the fipstest command and the NSPR and NSS
-# shared libraries/DLLs are on the search path.  Then run this script in the
-# directory where the REQUEST (.req) files reside.  The script generates the
-# RESPONSE (.rsp) files in the same directory.
-
-BASEDIR=${1-.}
-TESTDIR=${BASEDIR}/AES_GCM
-COMMAND=${2-run}
-REQDIR=${TESTDIR}/req
-RSPDIR=${TESTDIR}/resp
-
-gcm_decrypt_requests="
-gcmDecrypt128.req
-gcmDecrypt192.req
-gcmDecrypt256.req
-"
-
-gcm_encrypt_extiv_requests="
-gcmEncryptExtIV128.req
-gcmEncryptExtIV192.req
-gcmEncryptExtIV256.req
-"
-gcm_encrypt_intiv_requests="
-"
-
-#gcm_encrypt_intiv_requests="
-#gcmEncryptIntIV128.req
-#gcmEncryptIntIV192.req
-#gcmEncryptIntIV256.req
-#"
-
-if [ ${COMMAND} = "verify" ]; then
-    for request in $gcm_decrypt_requests $gcm_encrypt_extiv_requests; do
-	sh ./validate1.sh ${TESTDIR} $request ' ' '-e /Reason:/d'
-    done
-    for request in $gcm_encrypt_intiv_requests; do
-	name=`basename $request .req`
-    	echo ">>>>>  $name"
-        fipstest aes gcm decrypt ${RSPDIR}/$name.rsp | grep FAIL
-    done
-    exit 0
-fi
-
-for request in $gcm_decrypt_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest aes gcm decrypt ${REQDIR}/$request > ${RSPDIR}/$response
-done
-for request in $gcm_encrypt_intiv_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest aes gcm encrypt_intiv ${REQDIR}/$request > ${RSPDIR}/$response
-done
-for request in $gcm_encrypt_extiv_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest aes gcm encrypt_extiv ${REQDIR}/$request > ${RSPDIR}/$response
-done
--- a/security/nss/cmd/fipstest/dsa.sh
+++ b/security/nss/cmd/fipstest/dsa.sh
@@ -1,71 +1,38 @@
 #!/bin/sh
-# 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 #
 # A Bourne shell script for running the NIST DSA Validation System
 #
 # Before you run the script, set your PATH, LD_LIBRARY_PATH, ... environment
 # variables appropriately so that the fipstest command and the NSPR and NSS
 # shared libraries/DLLs are on the search path.  Then run this script in the
 # directory where the REQUEST (.req) files reside.  The script generates the
 # RESPONSE (.rsp) files in the same directory.
-BASEDIR=${1-.}
-TESTDIR=${BASEDIR}/DSA2
-COMMAND=${2-run}
-REQDIR=${TESTDIR}/req
-RSPDIR=${TESTDIR}/resp
-
-
-#
-# several of the DSA tests do use known answer tests to verify the result.
-# in those cases, feed generated tests back into the fipstest tool and
-# see if we can verify those value. NOTE: th PQGVer and SigVer tests verify
-# the dsa pqgver and dsa sigver functions, so we know they can detect errors
-# in those PQGGen and SigGen. Only the KeyPair verify is potentially circular.
-#
-if [ ${COMMAND} = "verify" ]; then
-# verify generated keys
-    name=KeyPair
-    echo ">>>>>  $name"
-    fipstest dsa keyver ${RSPDIR}/$name.rsp | grep ^Result.=.F
-# verify generated pqg values
-    name=PQGGen
-    echo ">>>>>  $name"
-    fipstest dsa pqgver ${RSPDIR}/$name.rsp | grep ^Result.=.F
-# verify PQGVer with known answer
-#    sh ./validate1.sh ${TESTDIR} PQGVer.req ' ' '-e /^Result.=.F/s;.(.*);; -e /^Result.=.P/s;.(.*);;'
-# verify signatures
-    name=SigGen
-    echo ">>>>>  $name"
-    fipstest dsa sigver ${RSPDIR}/$name.rsp | grep ^Result.=.F
-# verify SigVer with known answer
-    sh ./validate1.sh ${TESTDIR} SigVer.req ' ' '-e /^X.=/d -e /^Result.=.F/s;.(.*);;'
-    exit 0
-fi
 
 request=KeyPair.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest dsa keypair ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest dsa keypair $request > $response
 
 request=PQGGen.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest dsa pqggen ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest dsa pqggen $request > $response
 
-request=PQGVer1863.req
+request=PQGVer.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest dsa pqgver ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest dsa pqgver $request > $response
 
 request=SigGen.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest dsa siggen ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest dsa siggen $request > $response
 
 request=SigVer.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest dsa sigver ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest dsa sigver $request > $response
--- a/security/nss/cmd/fipstest/ecdsa.sh
+++ b/security/nss/cmd/fipstest/ecdsa.sh
@@ -1,60 +1,33 @@
 #!/bin/sh
-# 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 #
 # A Bourne shell script for running the NIST ECDSA Validation System
 #
 # Before you run the script, set your PATH, LD_LIBRARY_PATH, ... environment
 # variables appropriately so that the fipstest command and the NSPR and NSS
 # shared libraries/DLLs are on the search path.  Then run this script in the
 # directory where the REQUEST (.req) files reside.  The script generates the
 # RESPONSE (.rsp) files in the same directory.
-BASEDIR=${1-.}
-TESTDIR=${BASEDIR}/ECDSA2
-COMMAND=${2-run}
-REQDIR=${TESTDIR}/req
-RSPDIR=${TESTDIR}/resp
-
-#
-# several of the ECDSA tests do not use known answer tests to verify the result.
-# In those cases, feed generated tests back into the fipstest tool and
-# see if we can verify those value. NOTE:  PQGVer and SigVer tests verify
-# the dsa pqgver and dsa sigver functions, so we know they can detect errors
-# in those PQGGen and SigGen. Only the KeyPair verify is potentially circular.
-#
-if [ ${COMMAND} = "verify" ]; then
-# verify generated keys
-    name=KeyPair
-    echo ">>>>>  $name"
-    fipstest ecdsa keyver ${RSPDIR}/$name.rsp | grep ^Result.=.F
-    sh ./validate1.sh ${TESTDIR} PKV.req ' ' '-e /^X.=/d -e /^Result.=.F/s;.(.*);; -e /^Result.=.P/s;.(.*);;'
-# verify signatures
-    name=SigGen
-    echo ">>>>>  $name"
-    fipstest ecdsa sigver ${RSPDIR}/$name.rsp | grep ^Result.=.F
-# verify SigVer with known answer
-    sh ./validate1.sh ${TESTDIR} SigVer.req ' ' '-e /^X.=/d -e /^Result.=.F/s;.(.*);; -e /^Result.=.P/s;.(.*);;'
-    exit 0
-fi
 
 request=KeyPair.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest ecdsa keypair ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest ecdsa keypair $request > $response
 
 request=PKV.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest ecdsa pkv ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest ecdsa pkv $request > $response
 
 request=SigGen.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest ecdsa siggen ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest ecdsa siggen $request > $response
 
 request=SigVer.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest ecdsa sigver ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest ecdsa sigver $request > $response
--- a/security/nss/cmd/fipstest/fipstest.c
+++ b/security/nss/cmd/fipstest/fipstest.c
@@ -3363,34 +3363,16 @@ drbg(char *reqfn)
                 }
             }
             memset(predictedreturn_bytes, 0 , return_bytes_len);
 
             continue;
         }
     }
 loser:
-    if (predictedreturn_bytes) {
-        PORT_Free(predictedreturn_bytes);
-    }
-    if (return_bytes) {
-        PORT_Free(return_bytes);
-    }
-    if (additionalInput) {
-        PORT_Free(additionalInput);
-    }
-    if (personalizationString) {
-        PORT_Free(personalizationString);
-    }
-    if (nonce) {
-        PORT_Free(nonce);
-    }
-    if (entropyInput) {
-        PORT_Free(entropyInput);
-    }
     fclose(rngreq);
 }
 
 /*
  * Perform the RNG Variable Seed Test (VST) for the RNG algorithm
  * "DSA - Generation of X", used both as specified and as a generic
  * purpose RNG.  The presence of "Q = ..." in the REQUEST file
  * indicates we are using the algorithm as specified.
@@ -5145,17 +5127,17 @@ rsa_keypair_test(char *reqfn)
                          * or to the output RESPONSE file.
                          * 800 to hold (384 public key (x2 for HEX) + 1'\n'
                          */
     unsigned char buf2[400];   /* can't need more then 1/2 buf length */
     FILE *rsareq;     /* input stream from the REQUEST file */
     FILE *rsaresp;    /* output stream to the RESPONSE file */
     int count;
     int i;
-    int keySize = 1;   /* key size in bits*/
+    int keySize;   /* key size in bits*/
     int len = 0;       /* key size in bytes */
     int len2 = 0;      /* key size in bytes/2 (prime size) */
     SECItem e;
     unsigned char default_e[] = { 0x1, 0x0, 0x1 };
 
     e.data = default_e;
     e.len = sizeof (default_e);
 
--- a/security/nss/cmd/fipstest/hmac.sh
+++ b/security/nss/cmd/fipstest/hmac.sh
@@ -1,36 +1,24 @@
 #!/bin/sh
-# 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 #
 # A Bourne shell script for running the NIST HMAC Algorithm Validation Suite
 #
 # Before you run the script, set your PATH, LD_LIBRARY_PATH, ... environment
 # variables appropriately so that the fipstest command and the NSPR and NSS
 # shared libraries/DLLs are on the search path.  Then run this script in the
 # directory where the REQUEST (.req) files reside.  The script generates the
 # RESPONSE (.rsp) files in the same directory.
-
-BASEDIR=${1-.}
-TESTDIR=${BASEDIR}/HMAC
-COMMAND=${2-run}
-REQDIR=${TESTDIR}/req
-RSPDIR=${TESTDIR}/resp
                                
 hmac_requests="
 HMAC.req
 "
 
-if [ ${COMMAND} = "verify" ]; then
-    for request in $hmac_requests; do
-	sh ./validate1.sh ${TESTDIR} $request
-    done
-    exit 0
-fi
 for request in $hmac_requests; do
     response=`echo $request | sed -e "s/req/rsp/"`
     echo $request $response
-    fipstest hmac ${REQDIR}/$request > ${RSPDIR}/$response
+    fipstest hmac $request > $response
 done
 
--- a/security/nss/cmd/fipstest/rng.sh
+++ b/security/nss/cmd/fipstest/rng.sh
@@ -1,34 +1,23 @@
 #!/bin/sh
-# 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 #
 # A Bourne shell script for running the NIST RNG Validation Suite
 #
 # Before you run the script, set your PATH, LD_LIBRARY_PATH, ... environment
 # variables appropriately so that the fipstest command and the NSPR and NSS
 # shared libraries/DLLs are on the search path.  Then run this script in the
 # directory where the REQUEST (.req) files reside.  The script generates the
 # RESPONSE (.rsp) files in the same directory.
-BASEDIR=${1-.}
-TESTDIR=${BASEDIR}/DRBG800-90A
-COMMAND=${2-run}
-REQDIR=${TESTDIR}/req
-RSPDIR=${TESTDIR}/resp
 
 drbg_requests="
-Hash_DRBG.req
+SHA256_DRBG.req
 "
 
-if [ ${COMMAND} = "verify" ]; then
-    for request in $drbg_requests; do
-	sh ./validate1.sh ${TESTDIR} $request
-    done
-    exit 0
-fi
 for request in $drbg_requests; do
     response=`echo $request | sed -e "s/req/rsp/"`
     echo $request $response
-    fipstest drbg ${REQDIR}/$request > ${RSPDIR}/$response
+    fipstest drbg $request > $response
 done
--- a/security/nss/cmd/fipstest/rsa.sh
+++ b/security/nss/cmd/fipstest/rsa.sh
@@ -1,50 +1,24 @@
 #!/bin/sh
-# 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 #
 # A Bourne shell script for running the NIST RSA Validation System
 #
 # Before you run the script, set your PATH, LD_LIBRARY_PATH, ... environment
 # variables appropriately so that the fipstest command and the NSPR and NSS
 # shared libraries/DLLs are on the search path.  Then run this script in the
 # directory where the REQUEST (.req) files reside.  The script generates the
 # RESPONSE (.rsp) files in the same directory.
-BASEDIR=${1-.}
-TESTDIR=${BASEDIR}/RSA2
-COMMAND=${2-run}
-REQDIR=${TESTDIR}/req
-RSPDIR=${TESTDIR}/resp
+
 
-if [ ${COMMAND} = "verify" ]; then
-#verify the signatures. The fax file does not have any known answers, so
-#use our own verify function.
-    name=SigGen15_186-3
-    echo ">>>>>  $name"
-    fipstest rsa sigver ${RSPDIR}/$name.rsp | grep ^Result.=.F
-#    fipstest rsa sigver ${REQDIR}/SigVer15_186-3.req | grep ^Result.=.F
-#The Fax file has the private exponent and the salt value, remove it
-#also remove the false reason
-    sh ./validate1.sh ${TESTDIR} SigVer15_186-3.req ' ' '-e /^SaltVal/d -e/^d.=/d -e /^p.=/d -e /^q.=/d -e /^EM.with/d -e /^Result.=.F/s;.(.*);;'
-#
-# currently don't have a way to verify the RSA keygen
-#
-    exit 0
-fi
-
-request=SigGen15_186-3.req
+request=SigGen15.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest rsa siggen ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest rsa siggen $request > $response
 
-request=SigVer15_186-3.req
+request=SigVer15.req
 response=`echo $request | sed -e "s/req/rsp/"`
 echo $request $response
-fipstest rsa sigver ${REQDIR}/$request > ${RSPDIR}/$response
-
-#request=KeyGen_186-3.req
-request=KeyGen_RandomProbablyPrime3_3.req
-response=`echo $request | sed -e "s/req/rsp/"`
-echo $request $response
-fipstest rsa keypair ${REQDIR}/$request > ${RSPDIR}/$response
+fipstest rsa sigver $request > $response
deleted file mode 100644
--- a/security/nss/cmd/fipstest/runtest.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/sh
-# 
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-TESTDIR=${1-.}
-COMMAND=${2-run}
-TESTS="aes aesgcm dsa ecdsa hmac tls rng rsa sha tdea"
-if [ ${NSS_ENABLE_ECC}x = 1x ]; then
-   TESTS=${TESTS} ecdsa
-fi
-for i in $TESTS
-do
-    echo "********************Running $i tests"
-    sh ./${i}.sh ${TESTDIR} ${COMMAND}
-done
--- a/security/nss/cmd/fipstest/sha.sh
+++ b/security/nss/cmd/fipstest/sha.sh
@@ -1,66 +1,50 @@
 #!/bin/sh
-# 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 #
 # A Bourne shell script for running the NIST SHA Algorithm Validation Suite
 #
 # Before you run the script, set your PATH, LD_LIBRARY_PATH, ... environment
 # variables appropriately so that the fipstest command and the NSPR and NSS
 # shared libraries/DLLs are on the search path.  Then run this script in the
 # directory where the REQUEST (.req) files reside.  The script generates the
 # RESPONSE (.rsp) files in the same directory.
-BASEDIR=${1-.}
-TESTDIR=${BASEDIR}/SHA
-COMMAND=${2-run}
-REQDIR=${TESTDIR}/req
-RSPDIR=${TESTDIR}/resp
                                
 sha_ShortMsg_requests="
 SHA1ShortMsg.req
-SHA224ShortMsg.req
 SHA256ShortMsg.req
 SHA384ShortMsg.req
 SHA512ShortMsg.req
 "
 
 sha_LongMsg_requests="
 SHA1LongMsg.req
-SHA224LongMsg.req
 SHA256LongMsg.req
 SHA384LongMsg.req
 SHA512LongMsg.req
 "
 
 sha_Monte_requests="
 SHA1Monte.req
-SHA224Monte.req
 SHA256Monte.req
 SHA384Monte.req
 SHA512Monte.req
 "
-
-if [ ${COMMAND} = "verify" ]; then
-    for request in $sha_ShortMsg_requests $sha_LongMsg_requests $sha_Monte_requests; do
-	sh ./validate1.sh ${TESTDIR} $request
-    done
-    exit 0
-fi
-
 for request in $sha_ShortMsg_requests; do
     response=`echo $request | sed -e "s/req/rsp/"`
     echo $request $response
-    fipstest sha ${REQDIR}/$request > ${RSPDIR}/$response
+    fipstest sha $request > $response
 done
 for request in $sha_LongMsg_requests; do
     response=`echo $request | sed -e "s/req/rsp/"`
     echo $request $response
-    fipstest sha ${REQDIR}/$request > ${RSPDIR}/$response
+    fipstest sha $request > $response
 done
 for request in $sha_Monte_requests; do
     response=`echo $request | sed -e "s/req/rsp/"`
     echo $request $response
-    fipstest sha ${REQDIR}/$request > ${RSPDIR}/$response
+    fipstest sha $request > $response
 done
 
--- a/security/nss/cmd/fipstest/tdea.sh
+++ b/security/nss/cmd/fipstest/tdea.sh
@@ -1,28 +1,22 @@
 #!/bin/sh
-# 
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
 #
 # A Bourne shell script for running the NIST tdea Algorithm Validation Suite
 #
 # Before you run the script, set your PATH, LD_LIBRARY_PATH, ... environment
 # variables appropriately so that the fipstest command and the NSPR and NSS
 # shared libraries/DLLs are on the search path.  Then run this script in the
 # directory where the REQUEST (.req) files reside.  The script generates the
 # RESPONSE (.rsp) files in the same directory.
 
-BASEDIR=${1-.}
-TESTDIR=${BASEDIR}/TDES
-COMMAND=${2-run}
-REQDIR=${TESTDIR}/req
-RSPDIR=${TESTDIR}/resp
-
 #CBC_Known_Answer_tests
 #Initial Permutation KAT  
 #Permutation Operation KAT 
 #Subsitution Table KAT    
 #Variable Key KAT         
 #Variable PlainText KAT   
 cbc_kat_requests="
 TCBCinvperm.req   
@@ -60,47 +54,38 @@ TECBMonte3.req
 "
 
 ecb_mmt_requests="
 TECBMMT1.req
 TECBMMT2.req
 TECBMMT3.req
 "
 
-
-if [ ${COMMAND} = "verify" ]; then
-    for request in $cbc_kat_requests $cbc_monte_requests $cbc_mmt_requests $ecb_kat_requests $ecb_monte_requests $ecb_mmt_requests
-    do
-	sh ./validate1.sh ${TESTDIR} $request "-e /^NumKeys/d"
-    done
-    exit 0
-fi
-
-for request in $cbc_kat_requests; do
+for request in $ecb_mmt_requests; do
     response=`echo $request | sed -e "s/req/rsp/"`
     echo $request $response
-    fipstest tdea kat cbc ${REQDIR}/$request > ${RSPDIR}/$response
+    fipstest tdea mmt ecb $request > $response
+done
+for request in $ecb_kat_requests; do
+    response=`echo $request | sed -e "s/req/rsp/"`
+    echo $request $response
+    fipstest tdea kat ecb $request > $response
+done
+for request in $ecb_monte_requests; do
+    response=`echo $request | sed -e "s/req/rsp/"`
+    echo $request $response
+    fipstest tdea mct ecb $request > $response
 done
 for request in $cbc_mmt_requests; do
     response=`echo $request | sed -e "s/req/rsp/"`
     echo $request $response
-    fipstest tdea mmt cbc ${REQDIR}/$request > ${RSPDIR}/$response
+    fipstest tdea mmt cbc $request > $response
+done
+for request in $cbc_kat_requests; do
+    response=`echo $request | sed -e "s/req/rsp/"`
+    echo $request $response
+    fipstest tdea kat cbc $request > $response
 done
 for request in $cbc_monte_requests; do
     response=`echo $request | sed -e "s/req/rsp/"`
     echo $request $response
-    fipstest tdea mct cbc ${REQDIR}/$request > ${RSPDIR}/$response
-done
-for request in $ecb_kat_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest tdea kat ecb ${REQDIR}/$request > ${RSPDIR}/$response
+    fipstest tdea mct cbc $request > $response
 done
-for request in $ecb_mmt_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest tdea mmt ecb ${REQDIR}/$request > ${RSPDIR}/$response
-done
-for request in $ecb_monte_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest tdea mct ecb ${REQDIR}/$request > ${RSPDIR}/$response
-done
deleted file mode 100644
--- a/security/nss/cmd/fipstest/tls.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-#!/bin/sh
-# 
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# A Bourne shell script for running the NIST RNG Validation Suite
-#
-# Before you run the script, set your PATH, LD_LIBRARY_PATH, ... environment
-# variables appropriately so that the fipstest command and the NSPR and NSS
-# shared libraries/DLLs are on the search path.  Then run this script in the
-# directory where the REQUEST (.req) files reside.  The script generates the
-# RESPONSE (.rsp) files in the same directory.
-BASEDIR=${1-.}
-TESTDIR=${BASEDIR}/KDF135
-COMMAND=${2-run}
-REQDIR=${TESTDIR}/req
-RSPDIR=${TESTDIR}/resp
-
-drbg_requests="
-tls.req
-"
-
-if [ ${COMMAND} = "verify" ]; then
-    for request in $drbg_requests; do
-	sh ./validate1.sh ${TESTDIR} $request
-    done
-    exit 0
-fi
-for request in $drbg_requests; do
-    response=`echo $request | sed -e "s/req/rsp/"`
-    echo $request $response
-    fipstest tls ${REQDIR}/$request > ${RSPDIR}/$response
-done
deleted file mode 100644
--- a/security/nss/cmd/fipstest/validate.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/sh
-# 
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-sh ./runtest.sh ${1-.} verify
deleted file mode 100644
--- a/security/nss/cmd/fipstest/validate1.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/sh
-# 
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-# Validate1.sh is a helper shell script that each of the base test shell 
-# scripts call to help validate that the generated response (response) 
-# matches the known answer response (fax). Sometimes (depending on the 
-# individual tests) there are extraneous output in either or both response 
-# and fax files. These allow the caller to pass in additional sed commands 
-# to clear out those extraneous outputs before we compare the two files.
-# The sed line always clears out Windows line endings, replaces tabs with 
-# spaces, and removed comments.
-#
-TESTDIR=${1-.}
-request=${2}
-extraneous_response=${3}
-extraneous_fax=${4}
-name=`basename $request .req`
-echo ">>>>>  $name"
-sed -e 's;
;;g' -e 's;	; ;g' -e '/^#/d' $extraneous_response ${TESTDIR}/resp/${name}.rsp > /tmp/y1
-# if we didn't generate any output, flag that as an error 
-size=`sum /tmp/y1 | awk '{ print $NF }'`
-if [ $size -eq 0 ]; then
-   echo "${TESTDIR}/resp/${name}.rsp: empty"
-   exit 1;
-fi
-sed -e 's;
;;g' -e 's;	; ;g' -e '/^#/d' $extraneous_fax ${TESTDIR}/fax/${name}.fax > /tmp/y2
-diff -i -w -B /tmp/y1 /tmp/y2
--- a/security/nss/cmd/lib/secutil.c
+++ b/security/nss/cmd/lib/secutil.c
@@ -3692,16 +3692,20 @@ SECU_FindCertByNicknameOrFilename(CERTCe
 static SECStatus
 SECU_GetSSLVersionFromName(const char *buf, size_t bufLen, PRUint16 *version)
 {
     if (!buf || !version) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
 
+    if (!PL_strncasecmp(buf, "ssl2", bufLen)) {
+        *version = SSL_LIBRARY_VERSION_2;
+        return SECSuccess;
+    }
     if (!PL_strncasecmp(buf, "ssl3", bufLen)) {
         *version = SSL_LIBRARY_VERSION_3_0;
         return SECSuccess;
     }
     if (!PL_strncasecmp(buf, "tls1.0", bufLen)) {
         *version = SSL_LIBRARY_VERSION_TLS_1_0;
         return SECSuccess;
     }
@@ -3721,76 +3725,84 @@ SECU_GetSSLVersionFromName(const char *b
 
     PORT_SetError(SEC_ERROR_INVALID_ARGS);
     return SECFailure;
 }
 
 SECStatus
 SECU_ParseSSLVersionRangeString(const char *input,
                                 const SSLVersionRange defaultVersionRange,
-                                SSLVersionRange *vrange)
+                                const PRBool defaultEnableSSL2,
+                                SSLVersionRange *vrange, PRBool *enableSSL2)
 {
     const char *colonPos;
     size_t colonIndex;
     const char *maxStr;
 
-    if (!input || !vrange) {
-        PORT_SetError(SEC_ERROR_INVALID_ARGS);
-        return SECFailure;
-    }
-
-    // We don't support SSL2 any longer.
-    if (defaultVersionRange.min < SSL_LIBRARY_VERSION_3_0 ||
-        defaultVersionRange.max < SSL_LIBRARY_VERSION_3_0) {
+    if (!input || !vrange || !enableSSL2) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
 
     if (!strcmp(input, ":")) {
         /* special value, use default */
+        *enableSSL2 = defaultEnableSSL2;
         *vrange = defaultVersionRange;
         return SECSuccess;
     }
 
     colonPos = strchr(input, ':');
     if (!colonPos) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return SECFailure;
     }
 
     colonIndex = colonPos - input;
     maxStr = colonPos + 1;
 
     if (!colonIndex) {
         /* colon was first character, min version is empty */
+        *enableSSL2 = defaultEnableSSL2;
         vrange->min = defaultVersionRange.min;
     } else {
         PRUint16 version;
         /* colonIndex is equivalent to the length of the min version substring */
         if (SECU_GetSSLVersionFromName(input, colonIndex, &version) != SECSuccess) {
             PORT_SetError(SEC_ERROR_INVALID_ARGS);
             return SECFailure;
         }
 
-        vrange->min = version;
+        if (version == SSL_LIBRARY_VERSION_2) {
+            *enableSSL2 = PR_TRUE;
+            vrange->min = defaultVersionRange.min;
+        } else {
+            *enableSSL2 = PR_FALSE;
+            vrange->min = version;
+        }
     }
 
     if (!*maxStr) {
         vrange->max = defaultVersionRange.max;
     } else {
         PRUint16 version;
         /* if max version is empty, then maxStr points to the string terminator */
         if (SECU_GetSSLVersionFromName(maxStr, strlen(maxStr), &version)
                 != SECSuccess) {
             PORT_SetError(SEC_ERROR_INVALID_ARGS);
             return SECFailure;
         }
 
-        vrange->max = version;
-    }
-
-    if (vrange->min > vrange->max) {
-        PORT_SetError(SEC_ERROR_INVALID_ARGS);
-        return SECFailure;
+        if (version == SSL_LIBRARY_VERSION_2) {
+            /* consistency checking, require that min allows enableSSL2, too */
+            if (!*enableSSL2) {
+                PORT_SetError(SEC_ERROR_INVALID_ARGS);
+                return SECFailure;
+            }
+            /* we use 0 because SSL_LIBRARY_VERSION_NONE is private: */
+            vrange->min = 0;
+            vrange->max = 0;
+        } else {
+            vrange->max = version;
+        }
     }
 
     return SECSuccess;
 }
--- a/security/nss/cmd/lib/secutil.h
+++ b/security/nss/cmd/lib/secutil.h
@@ -393,25 +393,31 @@ SECU_SECItemHexStringToBinary(SECItem* s
  * Both min and max values are optional.
  * The following syntax is used to specify the enabled protocol versions:
  * A string with only a max value is expected as ":{max}",
  * and all implemented versions less than or equal to max will be enabled.
  * A string with only a min value is expected as "{min}:",
  * and all implemented versions greater than or equal to min will be enabled.
  * A string consisting of a colon only means "all versions enabled".
  *
+ * Because output parameter type SSLVersionRange doesn't allow to set
+ * version 2 values, we use a separate boolean output parameter
+ * to return whether SSL 2 is enabled.
+ *
  * In order to avoid a link dependency from libsectool to libssl,
  * the caller must provide the desired default values for the min/max values,
- * by providing defaultVersionRange (which can be obtained from libssl by
- * calling SSL_VersionRangeGetSupported).
+ * by providing defaultEnableSSL2 and defaultVersionRange
+ * (which can be obtained from libssl by calling SSL_VersionRangeGetSupported).
  */
 SECStatus
 SECU_ParseSSLVersionRangeString(const char *input,
                                 const SSLVersionRange defaultVersionRange,
-                                SSLVersionRange *vrange);
+                                const PRBool defaultEnableSSL2,
+                                SSLVersionRange *vrange,
+                                PRBool *enableSSL2);
 
 /*
  *
  *  Error messaging
  *
  */
 
 void printflags(char *trusts, unsigned int flags);
--- a/security/nss/cmd/listsuites/listsuites.c
+++ b/security/nss/cmd/listsuites/listsuites.c
@@ -49,14 +49,15 @@ int main(int argc, char **argv)
 	}
 	fprintf(stdout, 
 		"%s:\n" /* up to 37 spaces  */
 		"  0x%04hx %-5s %-5s %-8s %3hd %-6s %-8s %-4s %-8s %-11s\n",
 		info.cipherSuiteName, info.cipherSuite, 
 		info.keaTypeName, info.authAlgorithmName, info.symCipherName, 
 		info.effectiveKeyBits, info.macAlgorithmName, 
 		enabled           ? "Enabled"     : "Disabled",
-		info.isFIPS       ? "FIPS"        : "",
+		info.isFIPS       ? "FIPS" : 
+		  (SSL_IS_SSL2_CIPHER(info.cipherSuite) ? "SSL2" : ""),
 		info.isExportable ? "Export"      : "Domestic",
 		info.nonStandard  ? "nonStandard" : "");
     }
     return errCount;
 }
--- a/security/nss/cmd/modutil/install-ds.h
+++ b/security/nss/cmd/modutil/install-ds.h
@@ -238,17 +238,17 @@ struct Pk11Install_Info_str {
 	int numPlatforms;
 	Pk11Install_PlatformName *forwardCompatible;
 	int numForwardCompatible;
 };
 
 Pk11Install_Info*
 Pk11Install_Info_new();
 void
-Pk11Install_Info_init(Pk11Install_Info* _this);
+Pk11Install_Info_init();
 void
 Pk11Install_Info_delete(Pk11Install_Info* _this);
 /*// Returns NULL for success, error message if parse error.*/
 char* 
 Pk11Install_Info_Generate(Pk11Install_Info* _this, 
                           const Pk11Install_ValueList *list);
 	/*// Returns NULL if there is no matching platform*/
 Pk11Install_Platform* 
--- a/security/nss/cmd/pk1sign/pk1sign.c
+++ b/security/nss/cmd/pk1sign/pk1sign.c
@@ -72,124 +72,104 @@ static int
 ExportPublicKey(FILE *outFile, CERTCertificate *cert)
 {
     char *data;
     SECKEYPublicKey *publicKey;
     SECItem *item;
 
     if (!cert)
         return -1;
-
+    
     publicKey = CERT_ExtractPublicKey(cert);
     if (!publicKey)
         return -1;
 
     item = SECKEY_EncodeDERSubjectPublicKeyInfo(publicKey);
     SECKEY_DestroyPublicKey(publicKey);
     if (!item)
         return -1;
-
+    
     data = PL_Base64Encode((const char*)item->data, item->len, NULL);
     SECITEM_FreeItem(item, PR_TRUE);
     if (!data)
         return -1;
-
+    
     fputs("pubkey:\n", outFile);
     fputs(data, outFile);
     fputs("\n", outFile);
     PR_Free(data);
-
+    
     return 0;
 }
 
 static int
 SignFile(FILE *outFile, PRFileDesc *inFile, CERTCertificate *cert)
 {
     SECItem data2sign;
     SECStatus rv;
+    char *data;
+    SECKEYPrivateKey *privKey;
     SECOidTag algID;
+    PLArenaPool *arena;
     CERTSignedData sd;
-    SECKEYPrivateKey *privKey = NULL;
-    char *data = NULL;
-    PLArenaPool *arena = NULL;
-    SECItem *result = NULL;
-    int returnValue = 0;
+    SECItem *result;
 
-    if (outFile == NULL || inFile == NULL || cert == NULL) {
+    if (outFile == NULL || inFile == NULL || cert == NULL)
         return -1;
-    }
 
     /* suck the file in */
     if (SECU_ReadDERFromFile(&data2sign, inFile, PR_FALSE,
-                             PR_FALSE) != SECSuccess) {
+                             PR_FALSE) != SECSuccess)
         return -1;
-    }
 
-    privKey = NULL;
+    privKey = NULL;    
     privKey = PK11_FindKeyByAnyCert(cert, NULL);
-    if (!privKey) {
-        returnValue = -1;
-        goto loser;
-    }
 
     algID = SEC_GetSignatureAlgorithmOidTag(privKey->keyType, SEC_OID_SHA1);
-    if (algID == SEC_OID_UNKNOWN) {
-        returnValue = -1;
-        goto loser;
-    }
-
+    if (algID == SEC_OID_UNKNOWN)
+        return -1;
+    
     arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
-
+    
     PORT_Memset(&sd, 0, sizeof(CERTSignedData));
-
+    
     rv = SEC_SignData(&(sd.signature), data2sign.data, data2sign.len, privKey, algID);
     if (rv != SECSuccess) {
         fprintf (stderr, "Could not sign.\n");
-        returnValue = -1;
-        goto loser;
+        return -1;
     }
     sd.signature.len = sd.signature.len << 3;
-
+    
     rv = SECOID_SetAlgorithmID(arena, &sd.signatureAlgorithm, algID, 0);
     if (rv != SECSuccess) {
         fprintf (stderr, "Could not set alg id.\n");
-        returnValue = -1;
-        goto loser;
+        return -1;
     }
 
     result = SEC_ASN1EncodeItem(arena, NULL, &sd, CERTSignatureDataTemplate);
     SECITEM_FreeItem(&(sd.signature), PR_FALSE);
-
+    
     if (!result) {
         fprintf (stderr, "Could not encode.\n");
-        returnValue = -1;
-        goto loser;
+        return -1;
     }
 
     data = PL_Base64Encode((const char*)result->data, result->len, NULL);
-    if (!data){
-        returnValue = -1;
-        goto loser;
-    }
-
+    if (!data)
+        return -1;
+    
     fputs("signature:\n", outFile);
     fputs(data, outFile);
     fputs("\n", outFile);
     ExportPublicKey(outFile, cert);
-
-loser:
-    if (privKey) {
-        SECKEY_DestroyPrivateKey(privKey);
-    }
-    if (data) {
-        PORT_Free(data);
-    }
+    
+    SECKEY_DestroyPrivateKey(privKey);
     PORT_FreeArena(arena, PR_FALSE);
-
-    return returnValue;
+    
+    return 0;
 }
 
 int
 main(int argc, char **argv)
 {
     char *progName;
     FILE *outFile;
     PRFileDesc *inFile;
--- a/security/nss/cmd/selfserv/selfserv.c
+++ b/security/nss/cmd/selfserv/selfserv.c
@@ -89,16 +89,26 @@ static enum ocspStaplingModeEnum {
     osm_random,    /* use a random response for each connection */
     osm_ocsp       /* retrieve ocsp status from external ocsp server,
 		      use empty status if server is unavailable */
 } ocspStaplingMode = osm_disabled;
 typedef enum ocspStaplingModeEnum ocspStaplingModeType;
 static char *ocspStaplingCA = NULL;
 static SECItemArray *certStatus[kt_kea_size] = { NULL };
 
+const int ssl2CipherSuites[] = {
+    SSL_EN_RC4_128_WITH_MD5,			/* A */
+    SSL_EN_RC4_128_EXPORT40_WITH_MD5,		/* B */
+    SSL_EN_RC2_128_CBC_WITH_MD5,		/* C */
+    SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5,	/* D */
+    SSL_EN_DES_64_CBC_WITH_MD5,			/* E */
+    SSL_EN_DES_192_EDE3_CBC_WITH_MD5,		/* F */
+    0
+};
+
 const int ssl3CipherSuites[] = {
     -1, /* SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA* a */
     -1, /* SSL_FORTEZZA_DMS_WITH_RC4_128_SHA	 * b */
     TLS_RSA_WITH_RC4_128_MD5,			/* c */
     TLS_RSA_WITH_3DES_EDE_CBC_SHA,		/* d */
     TLS_RSA_WITH_DES_CBC_SHA,			/* e */
     TLS_RSA_EXPORT_WITH_RC4_40_MD5,		/* f */
     TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,		/* g */
@@ -163,17 +173,17 @@ PrintUsageHeader(const char *progName)
 }
 
 static void
 PrintParameterUsage()
 {
     fputs(
 "-V [min]:[max] restricts the set of enabled SSL/TLS protocol versions.\n"
 "   All versions are enabled by default.\n"
-"   Possible values for min/max: ssl3 tls1.0 tls1.1 tls1.2\n"
+"   Possible values for min/max: ssl2 ssl3 tls1.0 tls1.1 tls1.2\n"
 "   Example: \"-V ssl3:\" enables SSL 3 and newer.\n"
 "-B bypasses the PKCS11 layer for SSL encryption and MACing\n"
 "-q checks for bypassability\n"
 "-D means disable Nagle delays in TCP\n"
 "-E means disable export ciphersuites and SSL step down key gen\n"
 "-R means disable detection of rollback from TLS to SSL3\n"
 "-a configure server for SNI.\n"
 "-k expected name negotiated on server sockets\n"
@@ -227,16 +237,23 @@ Usage(const char *progName)
 }
 
 static void
 PrintCipherUsage(const char *progName)
 {
     PrintUsageHeader(progName);
     fputs(
 "-c ciphers   Letter(s) chosen from the following list\n"
+"A    SSL2 RC4 128 WITH MD5\n"
+"B    SSL2 RC4 128 EXPORT40 WITH MD5\n"
+"C    SSL2 RC2 128 CBC WITH MD5\n"
+"D    SSL2 RC2 128 CBC EXPORT40 WITH MD5\n"
+"E    SSL2 DES 64 CBC WITH MD5\n"
+"F    SSL2 DES 192 EDE3 CBC WITH MD5\n"
+"\n"
 "c    SSL3 RSA WITH RC4 128 MD5\n"
 "d    SSL3 RSA WITH 3DES EDE CBC SHA\n"
 "e    SSL3 RSA WITH DES CBC SHA\n"
 "f    SSL3 RSA EXPORT WITH RC4 40 MD5\n"
 "g    SSL3 RSA EXPORT WITH RC2 CBC 40 MD5\n"
 "i    SSL3 RSA WITH NULL MD5\n"
 "j    SSL3 RSA FIPS WITH 3DES EDE CBC SHA\n"
 "k    SSL3 RSA FIPS WITH DES CBC SHA\n"
@@ -806,16 +823,17 @@ logger(void *arg)
 
 
 /**************************************************************************
 ** End   thread management routines.
 **************************************************************************/
 
 PRBool useModelSocket  = PR_FALSE;
 static SSLVersionRange enabledVersions;
+PRBool enableSSL2      = PR_TRUE;
 PRBool disableRollBack = PR_FALSE;
 PRBool NoReuse         = PR_FALSE;
 PRBool hasSidCache     = PR_FALSE;
 PRBool disableStepDown = PR_FALSE;
 PRBool bypassPKCS11    = PR_FALSE;
 PRBool disableLocking  = PR_FALSE;
 PRBool testbypass      = PR_FALSE;
 PRBool enableSessionTickets = PR_FALSE;
@@ -1842,26 +1860,32 @@ server_main(
     } else {
 	model_sock = listen_sock = SSL_ImportFD(NULL, listen_sock);
 	if (listen_sock == NULL) {
 	    errExit("SSL_ImportFD");
 	}
     }
 
     /* do SSL configuration. */
-    rv = SSL_OptionSet(model_sock, SSL_SECURITY, enabledVersions.min != 0);
+    rv = SSL_OptionSet(model_sock, SSL_SECURITY, 
+                       enableSSL2 || enabledVersions.min != 0);
     if (rv < 0) {
 	errExit("SSL_OptionSet SSL_SECURITY");
     }
 
     rv = SSL_VersionRangeSet(model_sock, &enabledVersions);
     if (rv != SECSuccess) {
 	errExit("error setting SSL/TLS version range ");
     }
 
+    rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL2, enableSSL2);
+    if (rv != SECSuccess) {
+       errExit("error enabling SSLv2 ");
+    }
+
     rv = SSL_OptionSet(model_sock, SSL_ROLLBACK_DETECTION, !disableRollBack);
     if (rv != SECSuccess) {
 	errExit("error enabling RollBack detection ");
     }
     if (disableStepDown) {
 	rv = SSL_OptionSet(model_sock, SSL_NO_STEP_DOWN, PR_TRUE);
 	if (rv != SECSuccess) {
 	    errExit("error disabling SSL StepDown ");
@@ -2253,17 +2277,18 @@ main(int argc, char **argv)
 		fprintf(stderr, "Run '%s -h' for usage information.\n", progName);
 		exit(53);
 	    }
 	    break;
 
 	case 'U': configureReuseECDHE = (PORT_Atoi(optstate->value) != 0); break;
 
         case 'V': if (SECU_ParseSSLVersionRangeString(optstate->value,
-                          enabledVersions, &enabledVersions) != SECSuccess) {
+                          enabledVersions, enableSSL2,
+                          &enabledVersions, &enableSSL2) != SECSuccess) {
                       Usage(progName);
                   }
                   break;
 
 	case 'W': configureWeakDHE = (PORT_Atoi(optstate->value) != 0); break;
 
         case 'Y': PrintCipherUsage(progName); exit(0); break;
         
@@ -2514,52 +2539,54 @@ main(int argc, char **argv)
 	if (disableStepDown) {
 	    rv = disableExportSSLCiphers();
 	    if (rv != SECSuccess) {
 		errExit("error disabling export ciphersuites ");
 	    }
     	}
     }
 
-    /* all SSL3 cipher suites are enabled by default. */
+    /* all the SSL2 and SSL3 cipher suites are enabled by default. */
     if (cipherString) {
     	char *cstringSaved = cipherString;
     	int ndx;
 
 	/* disable all the ciphers, then enable the ones we want. */
 	disableAllSSLCiphers();
 
 	while (0 != (ndx = *cipherString++)) {
-            int cipher = 0;
+	    int  cipher;
 
 	    if (ndx == ':') {
 		int ctmp;
 
+		cipher = 0;
 		HEXCHAR_TO_INT(*cipherString, ctmp)
 		cipher |= (ctmp << 12);
 		cipherString++;
 		HEXCHAR_TO_INT(*cipherString, ctmp)
 		cipher |= (ctmp << 8);
 		cipherString++;
 		HEXCHAR_TO_INT(*cipherString, ctmp)
 		cipher |= (ctmp << 4);
 		cipherString++;
 		HEXCHAR_TO_INT(*cipherString, ctmp)
 		cipher |= ctmp;
 		cipherString++;
 	    } else {
+		const int *cptr;
+
 		if (! isalpha(ndx)) {
 		    fprintf(stderr, 
 			    "Non-alphabetic char in cipher string (-c arg).\n");
 		    exit(9);
 		}
-                ndx = tolower(ndx) - 'a';
-                if (ndx < PR_ARRAY_SIZE(ssl3CipherSuites)) {
-                    cipher = ssl3CipherSuites[ndx];
-                }
+		cptr = islower(ndx) ? ssl3CipherSuites : ssl2CipherSuites;
+		for (ndx &= 0x1f; (cipher = *cptr++) != 0 && --ndx > 0; ) 
+		    /* do nothing */;
 	    }
 	    if (cipher > 0) {
 		SECStatus status;
 		status = SSL_CipherPrefSetDefault(cipher, SSL_ALLOWED);
 		if (status != SECSuccess) 
 		    SECU_PrintError(progName, "SSL_CipherPrefSet()");
 	    } else {
 		fprintf(stderr, 
--- a/security/nss/cmd/strsclnt/strsclnt.c
+++ b/security/nss/cmd/strsclnt/strsclnt.c
@@ -41,16 +41,26 @@
 #endif
 
 #define RD_BUF_SIZE (60 * 1024)
 
 /* Include these cipher suite arrays to re-use tstclnt's 
  * cipher selection code.
  */
 
+int ssl2CipherSuites[] = {
+    SSL_EN_RC4_128_WITH_MD5,                    /* A */
+    SSL_EN_RC4_128_EXPORT40_WITH_MD5,           /* B */
+    SSL_EN_RC2_128_CBC_WITH_MD5,                /* C */
+    SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5,       /* D */
+    SSL_EN_DES_64_CBC_WITH_MD5,                 /* E */
+    SSL_EN_DES_192_EDE3_CBC_WITH_MD5,           /* F */
+    0
+};
+
 int ssl3CipherSuites[] = {
     -1, /* SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA* a */
     -1, /* SSL_FORTEZZA_DMS_WITH_RC4_128_SHA     * b */
     TLS_RSA_WITH_RC4_128_MD5,                   /* c */
     TLS_RSA_WITH_3DES_EDE_CBC_SHA,              /* d */
     TLS_RSA_WITH_DES_CBC_SHA,                   /* e */
     TLS_RSA_EXPORT_WITH_RC4_40_MD5,             /* f */
     TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,         /* g */
@@ -107,16 +117,17 @@ static int active_threads = 8; /* number
                                ** connect */
 static PRInt32 numUsed;
 /* end of variables protected by threadLock */
 
 static SSL3Statistics * ssl3stats;
 
 static int failed_already = 0;
 static SSLVersionRange enabledVersions;
+static PRBool enableSSL2      = PR_TRUE;
 static PRBool bypassPKCS11    = PR_FALSE;
 static PRBool disableLocking  = PR_FALSE;
 static PRBool ignoreErrors    = PR_FALSE;
 static PRBool enableSessionTickets = PR_FALSE;
 static PRBool enableCompression    = PR_FALSE;
 static PRBool enableFalseStart     = PR_FALSE;
 static PRBool enableCertStatus     = PR_FALSE;
 
@@ -147,17 +158,17 @@ Usage(const char *progName)
         "          2 -o's mean skip server certificate validation altogether.\n"
 	"       -D means no TCP delays\n"
 	"       -q means quit when server gone (timeout rather than retry forever)\n"
 	"       -s means disable SSL socket locking\n"
 	"       -N means no session reuse\n"
 	"       -P means do a specified percentage of full handshakes (0-100)\n"
         "       -V [min]:[max] restricts the set of enabled SSL/TLS protocols versions.\n"
         "          All versions are enabled by default.\n"
-        "          Possible values for min/max: ssl3 tls1.0 tls1.1 tls1.2\n"
+        "          Possible values for min/max: ssl2 ssl3 tls1.0 tls1.1 tls1.2\n"
         "          Example: \"-V ssl3:\" enables SSL 3 and newer.\n"
         "       -U means enable throttling up threads\n"
 	"       -B bypasses the PKCS11 layer for SSL encryption and MACing\n"
 	"       -T enable the cert_status extension (OCSP stapling)\n"
 	"       -u enable TLS Session Ticket extension\n"
 	"       -z enable compression\n"
 	"       -g enable false start\n",
 	progName);
@@ -322,17 +333,17 @@ printSecurityInfo(PRFileDesc *fd)
 }
 
 /**************************************************************************
 ** Begin thread management routines and data.
 **************************************************************************/
 
 #define MAX_THREADS 128
 
-typedef SECStatus startFn(void *a, void *b, int c);
+typedef int startFn(void *a, void *b, int c);
 
 
 static PRInt32     numConnected;
 static int         max_threads;    /* peak threads allowed */
 
 typedef struct perThreadStr {
     void *	a;
     void *	b;
@@ -542,17 +553,17 @@ lockedVars_AddToCount(lockedVars * lv, i
     rv = lv->count += addend;
     if (rv <= 0) {
 	PR_NotifyCondVar(lv->condVar);
     }
     PR_Unlock(lv->lock);
     return rv;
 }
 
-SECStatus
+int
 do_writes(
     void *       a,
     void *       b,
     int          c)
 {
     PRFileDesc *	ssl_sock	= (PRFileDesc *)a;
     lockedVars *	lv 		= (lockedVars *)b;
     unsigned int sent = 0;
@@ -703,29 +714,29 @@ myHandshakeCallback(PRFileDesc *socket, 
     PR_ATOMIC_SET(&lastFullHandshakePeerID, (PRInt32)((char *)arg - (char *)NULL));
 }
 
 #endif
 
 /* one copy of this function is launched in a separate thread for each
 ** connection to be made.
 */
-SECStatus
+int
 do_connects(
     void *	a,
     void *	b,
     int         tid)
 {
     PRNetAddr  *        addr		= (PRNetAddr *)  a;
     PRFileDesc *        model_sock	= (PRFileDesc *) b;
     PRFileDesc *        ssl_sock	= 0;
     PRFileDesc *        tcp_sock	= 0;
     PRStatus	        prStatus;
     PRUint32            sleepInterval	= 50; /* milliseconds */
-    SECStatus           rv 		= SECSuccess;
+    int                 rv 		= SECSuccess;
     PRSocketOptionData  opt;
 
 retry:
 
     tcp_sock = PR_OpenTCPSocket(addr->raw.family);
     if (tcp_sock == NULL) {
 	errExit("PR_OpenTCPSocket");
     }
@@ -779,16 +790,17 @@ retry:
 	            "strsclnt: Client timed out waiting for connection to server.\n");
                 exit(1);
             }
 	    PR_Sleep(PR_MillisecondsToInterval(sleepInterval));
 	    sleepInterval <<= 1;
 	    goto retry;
 	}
 	errWarn("PR_Connect");
+	rv = SECFailure;
 	goto done;
     } else {
         if (ThrottleUp) {
             PRTime now = PR_Now();
             PR_Lock(threadLock);
             lastConnectSuccess = PR_MAX(now, lastConnectSuccess);
             PR_Unlock(threadLock);
         }
@@ -849,17 +861,17 @@ retry:
     PR_ATOMIC_DECREMENT(&numConnected);
 
 done:
     if (ssl_sock) {
 	PR_Close(ssl_sock);
     } else if (tcp_sock) {
 	PR_Close(tcp_sock);
     }
-    return rv;
+    return SECSuccess;
 }
 
 
 typedef struct {
     PRLock* lock;
     char* nickname;
     CERTCertificate* cert;
     SECKEYPrivateKey* key;
@@ -1080,17 +1092,17 @@ client_main(
 	    SECU_PrintError(progName, "error looking up host address");
 	    return;
 	}
     }
 
     /* all suites except RSA_NULL_MD5 are enabled by Domestic Policy */
     NSS_SetDomesticPolicy();
 
-    /* all SSL3 cipher suites are enabled by default. */
+    /* all the SSL2 and SSL3 cipher suites are enabled by default. */
     if (cipherString) {
         int ndx;
 
         /* disable all the ciphers, then enable the ones we want. */
         disableAllSSLCiphers();
 
         while (0 != (ndx = *cipherString)) {
 	    const char * startCipher = cipherString++;
@@ -1108,20 +1120,21 @@ client_main(
 		if (cipher <= 0) {
 		    fprintf(stderr, "strsclnt: Invalid cipher value: %-5.5s\n",
 		                    startCipher);
 		    failed_already = 1;
 		    return;
 		}
 	    } else {
 		if (isalpha(ndx)) {
-                    ndx = tolower(ndx) - 'a';
-                    if (ndx < PR_ARRAY_SIZE(ssl3CipherSuites)) {
-                        cipher = ssl3CipherSuites[ndx];
-                    }
+		    const int *cptr;
+
+		    cptr = islower(ndx) ? ssl3CipherSuites : ssl2CipherSuites;
+		    for (ndx &= 0x1f; (cipher = *cptr++) != 0 && --ndx > 0; ) 
+			/* do nothing */;
 		}
 	    	if (cipher <= 0) {
 		    fprintf(stderr, "strsclnt: Invalid cipher letter: %c\n", 
 		                    *startCipher);
 		    failed_already = 1;
 		    return;
 		}
 	    }
@@ -1145,26 +1158,37 @@ client_main(
 
     model_sock = SSL_ImportFD(NULL, model_sock);
     if (model_sock == NULL) {
 	errExit("SSL_ImportFD");
     }
 
     /* do SSL configuration. */
 
-    rv = SSL_OptionSet(model_sock, SSL_SECURITY, enabledVersions.min != 0);
+    rv = SSL_OptionSet(model_sock, SSL_SECURITY,
+                       enableSSL2 || enabledVersions.min != 0);
     if (rv < 0) {
 	errExit("SSL_OptionSet SSL_SECURITY");
     }
 
     rv = SSL_VersionRangeSet(model_sock, &enabledVersions);
     if (rv != SECSuccess) {
         errExit("error setting SSL/TLS version range ");
     }
 
+    rv = SSL_OptionSet(model_sock, SSL_ENABLE_SSL2, enableSSL2);
+    if (rv != SECSuccess) {
+       errExit("error enabling SSLv2 ");
+    }
+
+    rv = SSL_OptionSet(model_sock, SSL_V2_COMPATIBLE_HELLO, enableSSL2);
+    if (rv != SECSuccess) {
+        errExit("error enabling SSLv2 compatible hellos ");
+    }
+
     if (bigBuf.data) { /* doing FDX */
 	rv = SSL_OptionSet(model_sock, SSL_ENABLE_FDX, 1);
 	if (rv < 0) {
 	    errExit("SSL_OptionSet SSL_ENABLE_FDX");
 	}
     }
 
     if (NoReuse) {
@@ -1233,26 +1257,26 @@ client_main(
 
     remaining_connections = total_connections = connections;
     total_connections_modulo_100 = total_connections % 100;
     total_connections_rounded_down_to_hundreds =
         total_connections - total_connections_modulo_100;
 
     if (!NoReuse) {
         remaining_connections = 1;
-	launch_thread(do_connects, &addr, model_sock, 0);
+	rv = launch_thread(do_connects, &addr, model_sock, 0);
 	/* wait for the first connection to terminate, then launch the rest. */
 	reap_threads();
         remaining_connections = total_connections - 1 ;
     }
     if (remaining_connections > 0) {
         active_threads  = PR_MIN(active_threads, remaining_connections);
 	/* Start up the threads */
 	for (i=0;i<active_threads;i++) {
-	    launch_thread(do_connects, &addr, model_sock, i);
+	    rv = launch_thread(do_connects, &addr, model_sock, i);
 	}
 	reap_threads();
     }
     destroy_thread_data();
 
     PR_Close(model_sock);
 }
 
@@ -1339,17 +1363,18 @@ main(int argc, char **argv)
         
 	case 'P': fullhs = PORT_Atoi(optstate->value); break;
 
 	case 'T': enableCertStatus = PR_TRUE; break;
 
 	case 'U': ThrottleUp = PR_TRUE; break;
         
         case 'V': if (SECU_ParseSSLVersionRangeString(optstate->value,
-                          enabledVersions, &enabledVersions) != SECSuccess) {
+                          enabledVersions, enableSSL2,
+                          &enabledVersions, &enableSSL2) != SECSuccess) {
                       Usage(progName);
                   }
                   break;
 
 	case 'a': sniHostName = PL_strdup(optstate->value); break;
 
 	case 'c': connections = PORT_Atoi(optstate->value); break;
 
@@ -1480,39 +1505,55 @@ main(int argc, char **argv)
     }
     if (sniHostName) {
         PL_strfree(sniHostName);
     }
 
     PL_strfree(hostName);
 
     /* some final stats. */
-    printf(
-    "strsclnt: %ld cache hits; %ld cache misses, %ld cache not reusable\n"
-    "          %ld stateless resumes\n",
-        ssl3stats->hsh_sid_cache_hits,
-        ssl3stats->hsh_sid_cache_misses,
-        ssl3stats->hsh_sid_cache_not_ok,
-        ssl3stats->hsh_sid_stateless_resumes);
+    if (ssl3stats->hsh_sid_cache_hits +
+	ssl3stats->hsh_sid_cache_misses +
+	ssl3stats->hsh_sid_cache_not_ok +
+	ssl3stats->hsh_sid_stateless_resumes == 0) {
+	/* presumably we were testing SSL2. */
+	printf("strsclnt: SSL2 - %d server certificates tested.\n",
+               certsTested);
+    } else {
+	printf(
+	"strsclnt: %ld cache hits; %ld cache misses, %ld cache not reusable\n"
+	"          %ld stateless resumes\n",
+	    ssl3stats->hsh_sid_cache_hits, 
+	    ssl3stats->hsh_sid_cache_misses,
+	    ssl3stats->hsh_sid_cache_not_ok,
+	    ssl3stats->hsh_sid_stateless_resumes);
+    }
 
     if (!NoReuse) {
 	if (enableSessionTickets)
 	    exitVal = (ssl3stats->hsh_sid_stateless_resumes == 0);
 	else
 	    exitVal = (ssl3stats->hsh_sid_cache_misses > 1) ||
 		      (ssl3stats->hsh_sid_stateless_resumes != 0);
 	if (!exitVal)
 	    exitVal = (ssl3stats->hsh_sid_cache_not_ok != 0) ||
 		      (certsTested > 1);
     } else {
 	printf("strsclnt: NoReuse - %d server certificates tested.\n",
                certsTested);
-        exitVal = (ssl3stats->hsh_sid_cache_misses != connections) ||
-            (ssl3stats->hsh_sid_stateless_resumes != 0) ||
-            (certsTested != connections);
+        if (ssl3stats->hsh_sid_cache_hits +
+            ssl3stats->hsh_sid_cache_misses +
+            ssl3stats->hsh_sid_cache_not_ok +
+            ssl3stats->hsh_sid_stateless_resumes > 0) {
+            exitVal = (ssl3stats->hsh_sid_cache_misses != connections) ||
+                (ssl3stats->hsh_sid_stateless_resumes != 0) ||
+                (certsTested != connections);
+        } else {                /* ssl2 connections */
+            exitVal = (certsTested != connections);
+        }
     }
 
     exitVal = ( exitVal || failed_already );
     SSL_ClearSessionCache();
     if (NSS_Shutdown() != SECSuccess) {
         printf("strsclnt: NSS_Shutdown() failed.\n");
         exit(1);
     }
--- a/security/nss/cmd/tstclnt/tstclnt.c
+++ b/security/nss/cmd/tstclnt/tstclnt.c
@@ -51,16 +51,26 @@
 
 #define EXIT_CODE_SIDECHANNELTEST_GOOD 0
 #define EXIT_CODE_SIDECHANNELTEST_BADCERT 1
 #define EXIT_CODE_SIDECHANNELTEST_NODATA 2
 #define EXIT_CODE_SIDECHANNELTEST_REVOKED 3
 
 PRIntervalTime maxInterval    = PR_INTERVAL_NO_TIMEOUT;
 
+int ssl2CipherSuites[] = {
+    SSL_EN_RC4_128_WITH_MD5,			/* A */
+    SSL_EN_RC4_128_EXPORT40_WITH_MD5,		/* B */
+    SSL_EN_RC2_128_CBC_WITH_MD5,		/* C */
+    SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5,	/* D */
+    SSL_EN_DES_64_CBC_WITH_MD5,			/* E */
+    SSL_EN_DES_192_EDE3_CBC_WITH_MD5,		/* F */
+    0
+};
+
 int ssl3CipherSuites[] = {
     -1, /* SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA* a */
     -1, /* SSL_FORTEZZA_DMS_WITH_RC4_128_SHA,	 * b */
     TLS_RSA_WITH_RC4_128_MD5,			/* c */
     TLS_RSA_WITH_3DES_EDE_CBC_SHA,		/* d */
     TLS_RSA_WITH_DES_CBC_SHA,			/* e */
     TLS_RSA_EXPORT_WITH_RC4_40_MD5,		/* f */
     TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,		/* g */
@@ -204,24 +214,24 @@ static void PrintParameterUsage(void)
     fprintf(stderr, "%-20s (use -C three times to include PEM format certificate dumps)\n", "");
     fprintf(stderr, "%-20s Nickname of key and cert for client auth\n", 
                     "-n nickname");
     fprintf(stderr, 
             "%-20s Bypass PKCS11 layer for SSL encryption and MACing.\n", "-B");
     fprintf(stderr, 
             "%-20s Restricts the set of enabled SSL/TLS protocols versions.\n"
             "%-20s All versions are enabled by default.\n"
-            "%-20s Possible values for min/max: ssl3 tls1.0 tls1.1 tls1.2\n"
+            "%-20s Possible values for min/max: ssl2 ssl3 tls1.0 tls1.1 tls1.2\n"
             "%-20s Example: \"-V ssl3:\" enables SSL 3 and newer.\n",
             "-V [min]:[max]", "", "", "");
     fprintf(stderr, "%-20s Send TLS_FALLBACK_SCSV\n", "-K");
     fprintf(stderr, "%-20s Prints only payload data. Skips HTTP header.\n", "-S");
     fprintf(stderr, "%-20s Client speaks first. \n", "-f");
     fprintf(stderr, "%-20s Use synchronous certificate validation "
-                    "(currently required for TLS 1.3)\n", "-O");
+                    "(required for SSL2)\n", "-O");
     fprintf(stderr, "%-20s Override bad server cert. Make it OK.\n", "-o");
     fprintf(stderr, "%-20s Disable SSL socket locking.\n", "-s");
     fprintf(stderr, "%-20s Verbose progress reporting.\n", "-v");
     fprintf(stderr, "%-20s Use export policy.\n", "-x");
     fprintf(stderr, "%-20s Ping the server and then exit.\n", "-q");
     fprintf(stderr, "%-20s Timeout for server ping (default: no timeout).\n", "-t seconds");
     fprintf(stderr, "%-20s Renegotiate N times (resuming session if N>1).\n", "-r N");
     fprintf(stderr, "%-20s Enable the session ticket extension.\n", "-u");
@@ -258,16 +268,23 @@ static void Usage(const char *progName)
 }
 
 static void PrintCipherUsage(const char *progName)
 {
     PrintUsageHeader(progName);
     fprintf(stderr, "%-20s Letter(s) chosen from the following list\n", 
                     "-c ciphers");
     fprintf(stderr, 
+"A    SSL2 RC4 128 WITH MD5\n"
+"B    SSL2 RC4 128 EXPORT40 WITH MD5\n"
+"C    SSL2 RC2 128 CBC WITH MD5\n"
+"D    SSL2 RC2 128 CBC EXPORT40 WITH MD5\n"
+"E    SSL2 DES 64 CBC WITH MD5\n"
+"F    SSL2 DES 192 EDE3 CBC WITH MD5\n"
+"\n"
 "c    SSL3 RSA WITH RC4 128 MD5\n"
 "d    SSL3 RSA WITH 3DES EDE CBC SHA\n"
 "e    SSL3 RSA WITH DES CBC SHA\n"
 "f    SSL3 RSA EXPORT WITH RC4 40 MD5\n"
 "g    SSL3 RSA EXPORT WITH RC2 CBC 40 MD5\n"
 "i    SSL3 RSA WITH NULL MD5\n"
 "j    SSL3 RSA FIPS WITH 3DES EDE CBC SHA\n"
 "k    SSL3 RSA FIPS WITH DES CBC SHA\n"
@@ -898,16 +915,17 @@ int main(int argc, char **argv)
     char *             tmp;
     int                multiplier = 0;
     SECStatus          rv;
     PRStatus           status;
     PRInt32            filesReady;
     int                npds;
     int                override = 0;
     SSLVersionRange    enabledVersions;
+    PRBool             enableSSL2 = PR_TRUE;
     int                bypassPKCS11 = 0;
     int                disableLocking = 0;
     int                useExportPolicy = 0;
     int                enableSessionTickets = 0;
     int                enableCompression = 0;
     int                enableFalseStart = 0;
     int                enableCertStatus = 0;
     int                enableSignedCertTimestamps = 0;
@@ -1012,17 +1030,18 @@ int main(int argc, char **argv)
 
           case 'S': skipProtoHeader = PR_TRUE;                 break;
 
           case 'T': enableCertStatus = 1;               break;
 
           case 'U': enableSignedCertTimestamps = 1;               break;
 
           case 'V': if (SECU_ParseSSLVersionRangeString(optstate->value,
-                            enabledVersions, &enabledVersions) != SECSuccess) {
+                            enabledVersions, enableSSL2,
+                            &enabledVersions, &enableSSL2) != SECSuccess) {
                         Usage(progName);
                     }
                     break;
 
           case 'Y': PrintCipherUsage(progName); exit(0); break;
 
           case 'a': if (!hs1SniHostName) {
                         hs1SniHostName = PORT_Strdup(optstate->value);
@@ -1226,17 +1245,17 @@ int main(int argc, char **argv)
     }
 
     /* set the policy bits true for all the cipher suites. */
     if (useExportPolicy)
         NSS_SetExportPolicy();
     else
         NSS_SetDomesticPolicy();
 
-    /* all SSL3 cipher suites are enabled by default. */
+    /* all the SSL2 and SSL3 cipher suites are enabled by default. */
     if (cipherString) {
         /* disable all the ciphers, then enable the ones we want. */
         disableAllSSLCiphers();
     }
 
     /* Create socket */
     s = PR_OpenTCPSocket(addr.raw.family);
     if (s == NULL) {
@@ -1265,46 +1284,48 @@ int main(int argc, char **argv)
     }
 
     rv = SSL_OptionSet(s, SSL_HANDSHAKE_AS_CLIENT, 1);
     if (rv != SECSuccess) {
 	SECU_PrintError(progName, "error enabling client handshake");
 	return 1;
     }
 
-    /* all SSL3 cipher suites are enabled by default. */
+    /* all the SSL2 and SSL3 cipher suites are enabled by default. */
     if (cipherString) {
     	char *cstringSaved = cipherString;
     	int ndx;
 
 	while (0 != (ndx = *cipherString++)) {
-            int cipher = 0;
+	    int  cipher;
 
 	    if (ndx == ':') {
 		int ctmp = 0;
 
+		cipher = 0;
 		HEXCHAR_TO_INT(*cipherString, ctmp)
 		cipher |= (ctmp << 12);
 		cipherString++;
 		HEXCHAR_TO_INT(*cipherString, ctmp)
 		cipher |= (ctmp << 8);
 		cipherString++;
 		HEXCHAR_TO_INT(*cipherString, ctmp)
 		cipher |= (ctmp << 4);
 		cipherString++;
 		HEXCHAR_TO_INT(*cipherString, ctmp)
 		cipher |= ctmp;
 		cipherString++;
 	    } else {
+		const int *cptr;
+
 		if (! isalpha(ndx))
 		    Usage(progName);
-                ndx = tolower(ndx) - 'a';
-                if (ndx < PR_ARRAY_SIZE(ssl3CipherSuites)) {
-                    cipher = ssl3CipherSuites[ndx];
-                }
+		cptr = islower(ndx) ? ssl3CipherSuites : ssl2CipherSuites;
+		for (ndx &= 0x1f; (cipher = *cptr++) != 0 && --ndx > 0; ) 
+		    /* do nothing */;
 	    }
 	    if (cipher > 0) {
 		SECStatus status;
 		status = SSL_CipherPrefSet(s, cipher, SSL_ALLOWED);
 		if (status != SECSuccess) 
 		    SECU_PrintError(progName, "SSL_CipherPrefSet()");
 	    } else {
 		Usage(progName);
@@ -1314,16 +1335,28 @@ int main(int argc, char **argv)
     }
 
     rv = SSL_VersionRangeSet(s, &enabledVersions);
     if (rv != SECSuccess) {
         SECU_PrintError(progName, "error setting SSL/TLS version range ");
         return 1;
     }
 
+    rv = SSL_OptionSet(s, SSL_ENABLE_SSL2, enableSSL2);
+    if (rv != SECSuccess) {
+       SECU_PrintError(progName, "error enabling SSLv2 ");
+       return 1;
+    }
+
+    rv = SSL_OptionSet(s, SSL_V2_COMPATIBLE_HELLO, enableSSL2);
+    if (rv != SECSuccess) {
+        SECU_PrintError(progName, "error enabling SSLv2 compatible hellos ");
+        return 1;
+    }
+
     /* enable PKCS11 bypass */
     rv = SSL_OptionSet(s, SSL_BYPASS_PKCS11, bypassPKCS11);
     if (rv != SECSuccess) {
 	SECU_PrintError(progName, "error enabling PKCS11 bypass");
 	return 1;
     }
 
     /* disable SSL socket locking */
@@ -1575,22 +1608,16 @@ int main(int argc, char **argv)
 		    }
 
 		    pollset[SSOCK_FD].in_flags = PR_POLL_WRITE | PR_POLL_EXCEPT;
 		    pollset[SSOCK_FD].out_flags = 0;
 		    FPRINTF(stderr,
 		            "%s: about to call PR_Poll on writable socket !\n", 
 			    progName);
 		    cc = PR_Poll(pollset, 1, PR_INTERVAL_NO_TIMEOUT);
-                    if (cc < 0) {
-                        SECU_PrintError(progName, 
-                                        "PR_Poll failed");
-                        error = 1;
-                        goto done;
-                    }
 		    FPRINTF(stderr,
 		            "%s: PR_Poll returned with writable socket !\n", 
 			    progName);
 		} while (1);
 		pollset[SSOCK_FD].in_flags  = PR_POLL_READ;
 	    }
 	}
 
--- a/security/nss/cmd/vfyserv/vfyserv.c
+++ b/security/nss/cmd/vfyserv/vfyserv.c
@@ -36,18 +36,18 @@
 #include "nss.h"
 #include "secutil.h"
 #include "ocsp.h"
 
 #include "vfyserv.h"
 
 #define RD_BUF_SIZE (60 * 1024)
 
+extern int ssl2CipherSuites[];
 extern int ssl3CipherSuites[];
-extern int numSSL3CipherSuites;
 
 GlobalThreadMgr threadMGR;
 char *certNickname = NULL;
 char *hostName = NULL;
 secuPWData  pwdata          = { PW_NONE, 0 };
 unsigned short port = 0;
 PRBool dumpChain;
 
@@ -502,40 +502,41 @@ main(int argc, char **argv)
 	/* all the SSL2 and SSL3 cipher suites are enabled by default. */
 	if (cipherString) {
 	    int ndx;
 
 	    /* disable all the ciphers, then enable the ones we want. */
 	    disableAllSSLCiphers();
 
 	    while (0 != (ndx = *cipherString++)) {
-                int cipher = 0;
+		int  cipher;
 
 		if (ndx == ':') {
 		    int ctmp = 0;
 
+		    cipher = 0;
 		    HEXCHAR_TO_INT(*cipherString, ctmp)
 		    cipher |= (ctmp << 12);
 		    cipherString++;
 		    HEXCHAR_TO_INT(*cipherString, ctmp)
 		    cipher |= (ctmp << 8);
 		    cipherString++;
 		    HEXCHAR_TO_INT(*cipherString, ctmp)
 		    cipher |= (ctmp << 4);
 		    cipherString++;
 		    HEXCHAR_TO_INT(*cipherString, ctmp)
 		    cipher |= ctmp;
 		    cipherString++;
 		} else {
+		    const int *cptr;
 		    if (! isalpha(ndx))
 			Usage(progName);
-                    ndx = tolower(ndx) - 'a';
-                    if (ndx < numSSL3CipherSuites) {
-                        cipher = ssl3CipherSuites[ndx];
-                    }
+		    cptr = islower(ndx) ? ssl3CipherSuites : ssl2CipherSuites;
+		    for (ndx &= 0x1f; (cipher = *cptr++) != 0 && --ndx > 0; )
+			/* do nothing */;
 		}
 		if (cipher > 0) {
 		    SSL_CipherPrefSetDefault(cipher, PR_TRUE);
 		} else {
 		    Usage(progName);
 		}
 	    }
 	}
--- a/security/nss/cmd/vfyserv/vfyserv.h
+++ b/security/nss/cmd/vfyserv/vfyserv.h
@@ -33,16 +33,17 @@
 #include "sslerror.h"
 */
 
 #define BUFFER_SIZE 10240
 
 /* Declare SSL cipher suites. */
 
 extern int cipherSuites[];
+extern int ssl2CipherSuites[];
 extern int ssl3CipherSuites[];
 
 /* Data buffer read from a socket. */
 typedef struct DataBufferStr {
 	char data[BUFFER_SIZE];
 	int  index;
 	int  remaining;
 	int  dataStart;
--- a/security/nss/cmd/vfyserv/vfyutil.c
+++ b/security/nss/cmd/vfyserv/vfyutil.c
@@ -9,16 +9,26 @@
 #include "secutil.h"
 
 
 extern PRBool dumpChain;
 extern void dumpCertChain(CERTCertificate *, SECCertUsage);
 
 /* Declare SSL cipher suites. */
 
+int ssl2CipherSuites[] = {
+    SSL_EN_RC4_128_WITH_MD5,              /* A */
+    SSL_EN_RC4_128_EXPORT40_WITH_MD5,     /* B */
+    SSL_EN_RC2_128_CBC_WITH_MD5,          /* C */
+    SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, /* D */
+    SSL_EN_DES_64_CBC_WITH_MD5,           /* E */
+    SSL_EN_DES_192_EDE3_CBC_WITH_MD5,     /* F */
+    0
+};
+
 int ssl3CipherSuites[] = {
     -1, /* SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA* a */
     -1, /* SSL_FORTEZZA_DMS_WITH_RC4_128_SHA,	 * b */
     TLS_RSA_WITH_RC4_128_MD5,			/* c */
     TLS_RSA_WITH_3DES_EDE_CBC_SHA,		/* d */
     TLS_RSA_WITH_DES_CBC_SHA,			/* e */
     TLS_RSA_EXPORT_WITH_RC4_40_MD5,		/* f */
     TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,		/* g */
@@ -38,17 +48,16 @@ int ssl3CipherSuites[] = {
     TLS_DHE_RSA_WITH_AES_128_CBC_SHA,       	/* u */
     TLS_RSA_WITH_AES_128_CBC_SHA,     	    	/* v */
     TLS_DHE_DSS_WITH_AES_256_CBC_SHA, 	    	/* w */
     TLS_DHE_RSA_WITH_AES_256_CBC_SHA,       	/* x */
     TLS_RSA_WITH_AES_256_CBC_SHA,     	    	/* y */
     TLS_RSA_WITH_NULL_SHA,			/* z */
     0
 };
-int numSSL3CipherSuites = PR_ARRAY_SIZE(ssl3CipherSuites);
 
 /**************************************************************************
 ** 
 ** SSL callback routines.
 **
 **************************************************************************/
 
 /* Function: char * myPasswd()
--- a/security/nss/coreconf/Darwin.mk
+++ b/security/nss/coreconf/Darwin.mk
@@ -16,31 +16,28 @@ ifndef CPU_ARCH
 # When cross-compiling, CPU_ARCH should already be defined as the target
 # architecture, set to powerpc or i386.
 CPU_ARCH	:= $(shell uname -p)
 endif
 
 ifeq (,$(filter-out i%86,$(CPU_ARCH)))
 ifdef USE_64
 CC              += -arch x86_64
-CCC             += -arch x86_64
 override CPU_ARCH	= x86_64
 else
 OS_REL_CFLAGS	= -Di386
 CC              += -arch i386
-CCC             += -arch i386
 override CPU_ARCH	= x86
 endif
 else
 ifeq (arm,$(CPU_ARCH))
 # Nothing set for arm currently.
 else
 OS_REL_CFLAGS	= -Dppc
 CC              += -arch ppc
-CCC             += -arch ppc
 endif
 endif
 
 ifneq (,$(MACOS_SDK_DIR))
     GCC_VERSION_FULL := $(shell $(CC) -dumpversion)
     GCC_VERSION_MAJOR := $(shell echo $(GCC_VERSION_FULL) | awk -F. '{ print $$1 }')
     GCC_VERSION_MINOR := $(shell echo $(GCC_VERSION_FULL) | awk -F. '{ print $$2 }')
     GCC_VERSION = $(GCC_VERSION_MAJOR).$(GCC_VERSION_MINOR)
@@ -134,11 +131,8 @@ SYS_SQLITE3_VERSION_MINOR := $(shell ech
 
 ifeq (3,$(SYS_SQLITE3_VERSION_MAJOR))
     ifeq (,$(filter-out 0 1 2 3 4,$(SYS_SQLITE3_VERSION_MINOR)))
         # sqlite <= 3.4.x is too old, it doesn't provide sqlite3_file_control
     else
         NSS_USE_SYSTEM_SQLITE = 1
     endif
 endif
-
-include $(CORE_DEPTH)/coreconf/sanitizers.mk
-DARWIN_SDK_SHLIBFLAGS += $(SANITIZER_LDFLAGS)
--- a/security/nss/coreconf/FreeBSD.mk
+++ b/security/nss/coreconf/FreeBSD.mk
@@ -16,17 +16,17 @@ CPU_ARCH		= x86
 endif
 ifeq ($(CPU_ARCH),pc98)
 CPU_ARCH		= x86
 endif
 ifeq ($(CPU_ARCH),amd64)
 CPU_ARCH		= x86_64
 endif
 
-OS_CFLAGS		= $(DSO_CFLAGS) -Wall -Wno-switch -DFREEBSD -DHAVE_STRERROR -DHAVE_BSD_FLOCK
+OS_CFLAGS		= $(DSO_CFLAGS) -ansi -Wall -Wno-switch -DFREEBSD -DHAVE_STRERROR -DHAVE_BSD_FLOCK
 
 DSO_CFLAGS		= -fPIC
 DSO_LDOPTS		= -shared -Wl,-soname -Wl,$(notdir $@)
 
 #
 # The default implementation strategy for FreeBSD is pthreads.
 #
 ifndef CLASSIC_NSPR
--- a/security/nss/coreconf/Linux.mk
+++ b/security/nss/coreconf/Linux.mk
@@ -148,22 +148,18 @@ endif
 
 ARCH			= linux
 
 DSO_CFLAGS		= -fPIC
 DSO_LDOPTS		= -shared $(ARCHFLAG) -Wl,--gc-sections
 # The linker on Red Hat Linux 7.2 and RHEL 2.1 (GNU ld version 2.11.90.0.8)
 # incorrectly reports undefined references in the libraries we link with, so
 # we don't use -z defs there.
-# Also, -z defs conflicts with Address Sanitizer, which emits relocations
-# against the libsanitizer runtime built into the main executable.
 ZDEFS_FLAG		= -Wl,-z,defs
-ifneq ($(USE_ASAN),1)
 DSO_LDOPTS		+= $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG))
-endif
 LDFLAGS			+= $(ARCHFLAG)
 
 # On Maemo, we need to use the -rpath-link flag for even the standard system
 # library directories.
 ifdef _SBOX_DIR
 LDFLAGS			+= -Wl,-rpath-link,/usr/lib:/lib
 endif
 
@@ -209,10 +205,8 @@ ifdef MAPFILE
 	MKSHLIB += -Wl,--version-script,$(MAPFILE)
 endif
 PROCESS_MAP_FILE = grep -v ';-' $< | \
         sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
 
 ifeq ($(OS_RELEASE),2.4)
 DEFINES += -DNO_FORK_CHECK
 endif
-
-include $(CORE_DEPTH)/coreconf/sanitizers.mk
--- a/security/nss/coreconf/NetBSD.mk
+++ b/security/nss/coreconf/NetBSD.mk
@@ -21,17 +21,17 @@ OBJECT_FMT		:= $(shell if echo __ELF__ |
 endif
 
 ifeq ($(OBJECT_FMT),ELF)
 DLL_SUFFIX		= so
 else
 DLL_SUFFIX		= so.1.0
 endif
 
-OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DNETBSD -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -ansi -Wall -Wno-switch -pipe -DNETBSD -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
 
 OS_LIBS			= -lcompat
 
 ARCH			= netbsd
 
 DSO_CFLAGS		= -fPIC -DPIC
 DSO_LDOPTS		= -shared
 ifeq ($(OBJECT_FMT),ELF)
--- a/security/nss/coreconf/OpenBSD.mk
+++ b/security/nss/coreconf/OpenBSD.mk
@@ -21,17 +21,17 @@ ifndef CLASSIC_NSPR
 USE_PTHREADS		= 1
 DEFINES			+= -pthread
 OS_LIBS			+= -pthread
 DSO_LDOPTS		+= -pthread
 endif
 
 DLL_SUFFIX		= so.1.0
 
-OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DOPENBSD
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -ansi -Wall -Wno-switch -pipe -DOPENBSD
 
 OS_LIBS			= 
 
 ARCH			= openbsd
 
 DSO_CFLAGS		= -fPIC -DPIC
 DSO_LDOPTS		= -shared -fPIC -Wl,-soname,lib$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
 
--- a/security/nss/coreconf/Werror.mk
+++ b/security/nss/coreconf/Werror.mk
@@ -1,28 +1,15 @@
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # This sets WARNING_CFLAGS for gcc-like compilers.
 
-ifndef CC_IS_CLANG
-  CC_IS_CLANG := $(and $(findstring clang, $(shell $(CC) --version 2>&1)), 1)
-  # Export CC_IS_CLANG to save a shell invocation when recursing.
-  export CC_IS_CLANG
-endif
-
-ifdef CC_IS_CLANG
-  # Clang claims GCC 4.2.1 compatibility, see GCC_VERSION
-  CC_IS_GCC = 1
-  # Export CC_IS_GCC to save a shell invocation when recursing.
-  export CC_IS_GCC
-endif
-
 ifndef CC_IS_GCC
   CC_IS_GCC := $(shell $(CC) -x c -E -Wall -Werror /dev/null >/dev/null 2>&1 && echo 1)
   # Export CC_IS_GCC to save a shell invocation when recursing.
   export CC_IS_GCC
 endif
 
 ifndef CC_NAME
   ifeq (1,$(CC_IS_GCC))
@@ -46,17 +33,17 @@ ifndef WARNING_CFLAGS
   ifneq (1,$(CC_IS_GCC))
     WARNING_CFLAGS = $(NULL)
   else
     # This tests to see if enabling the warning is possible before
     # setting an option to disable it.
     disable_warning = $(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -Wno-$(1))
 
     WARNING_CFLAGS = -Wall
-    ifdef CC_IS_CLANG
+    ifeq ($(CC_NAME),clang)
       # -Qunused-arguments : clang objects to arguments that it doesn't understand
       #    and fixing this would require rearchitecture
       WARNING_CFLAGS += -Qunused-arguments
       # -Wno-parentheses-equality : because clang warns about macro expansions
       WARNING_CFLAGS += $(call disable_warning,parentheses-equality)
       ifdef BUILD_OPT
         # clang is unable to handle glib's expansion of strcmp and similar for optimized
         # builds, so ignore the resulting errors.
@@ -70,20 +57,20 @@ ifndef WARNING_CFLAGS
       ifeq ($(OS_TARGET),Android)
         # Android lollipop generates the following warning:
         # error: call to 'sprintf' declared with attribute warning:
         #   sprintf is often misused; please use snprintf [-Werror]
         # So, just suppress -Werror entirely on Android
         NSS_ENABLE_WERROR = 0
         $(warning OS_TARGET is Android, disabling -Werror)
       else
-        ifdef CC_IS_CLANG
+        ifeq ($(CC_NAME),clang)
           # Clang reports its version as an older gcc, but it's OK
           NSS_ENABLE_WERROR = 1
-        else
+        else ifeq ($(CC_NAME),gcc)
           ifneq (,$(filter 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
             NSS_ENABLE_WERROR = 1
           endif
           ifeq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
             NSS_ENABLE_WERROR = 1
           endif
         endif
         ifndef NSS_ENABLE_WERROR
--- a/security/nss/coreconf/arch.mk
+++ b/security/nss/coreconf/arch.mk
@@ -8,17 +8,16 @@
 # defines these symbols:
 # 64BIT_TAG
 # OS_ARCH	(from uname -r)
 # OS_TEST	(from uname -m)
 # OS_RELEASE	(from uname -v and/or -r)
 # OS_TARGET	User defined, or set to OS_ARCH
 # CPU_ARCH  	(from unmame -m or -p, ONLY on WINNT)
 # OS_CONFIG	OS_TARGET + OS_RELEASE
-# ASAN_TAG
 # OBJDIR_TAG
 # OBJDIR_NAME
 #######################################################################
 
 #
 # Macros for getting the OS architecture
 #
 
@@ -253,37 +252,27 @@ endif
 
 #
 # This variable is used to get OS_CONFIG.mk.
 #
 
 OS_CONFIG = $(OS_TARGET)$(OS_RELEASE)
 
 #
-# Set Address Sanitizer prefix.
-#
-
-ifeq ($(USE_ASAN), 1)
-    ASAN_TAG = _ASAN
-else
-    ASAN_TAG =
-endif
-
-#
 # OBJDIR_TAG depends on the predefined variable BUILD_OPT,
 # to distinguish between debug and release builds.
 #
 
 ifdef BUILD_OPT
-    OBJDIR_TAG = $(64BIT_TAG)$(ASAN_TAG)_OPT
+    OBJDIR_TAG = $(64BIT_TAG)_OPT
 else
     ifdef BUILD_IDG
-	OBJDIR_TAG = $(64BIT_TAG)$(ASAN_TAG)_IDG
+	OBJDIR_TAG = $(64BIT_TAG)_IDG
     else
-	OBJDIR_TAG = $(64BIT_TAG)$(ASAN_TAG)_DBG
+	OBJDIR_TAG = $(64BIT_TAG)_DBG
     endif
 endif
 
 #
 # The following flags are defined in the individual $(OS_CONFIG).mk
 # files.
 #
 # CPU_TAG is defined if the CPU is not the most common CPU.
--- a/security/nss/coreconf/config.mk
+++ b/security/nss/coreconf/config.mk
@@ -169,27 +169,16 @@ endif
 ifdef NSS_DISABLE_CHACHAPOLY
 DEFINES += -DNSS_DISABLE_CHACHAPOLY
 endif
 
 ifdef NSS_PKIX_NO_LDAP
 DEFINES += -DNSS_PKIX_NO_LDAP
 endif
 
-# FIPS support requires startup tests to be executed at load time of shared modules.
-# For performance reasons, these tests are disabled by default.
-# When compiling binaries that must support FIPS mode, 
-# you should define NSS_FORCE_FIPS
-#
-# NSS_NO_INIT_SUPPORT is always defined on platforms that don't support
-# executing the startup tests at library load time.
-ifndef NSS_FORCE_FIPS
-DEFINES += -DNSS_NO_INIT_SUPPORT
-endif
-
 # Avoid building object leak test code for optimized library
 ifndef BUILD_OPT
 ifdef PKIX_OBJECT_LEAK_TEST
 DEFINES += -DPKIX_OBJECT_LEAK_TEST
 endif
 endif
 
 # This allows all library and tools code to use the util function
--- a/security/nss/coreconf/coreconf.dep
+++ b/security/nss/coreconf/coreconf.dep
@@ -5,8 +5,9 @@
 
 /*
  * A dummy header file that is a dependency for all the object files.
  * Used to force a full recompilation of NSS in Mozilla's Tinderbox
  * depend builds.  See comments in rules.mk.
  */
 
 #error "Do not include this header file."
+
deleted file mode 100644
--- a/security/nss/coreconf/sanitizers.mk
+++ /dev/null
@@ -1,19 +0,0 @@
-# Address Sanitizer support; include this in OS-specific .mk files
-# *after* defining the variables that are appended to here.
-
-ifeq ($(USE_ASAN), 1)
-SANITIZER_FLAGS_COMMON = -fsanitize=address $(EXTRA_SANITIZER_FLAGS)
-SANITIZER_CFLAGS = $(SANITIZER_FLAGS_COMMON)
-SANITIZER_LDFLAGS = $(SANITIZER_FLAGS_COMMON)
-OS_CFLAGS += $(SANITIZER_CFLAGS)
-LDFLAGS += $(SANITIZER_LDFLAGS)
-
-# ASan needs frame pointers to save stack traces for allocation/free sites.
-# (Warning: some platforms, like ARM Linux in Thumb mode, don't have useful
-# frame pointers even with this option.)
-SANITIZER_CFLAGS += -fno-omit-frame-pointer
-
-# You probably want to be able to get debug info for failures, even with an
-# optimized build.
-OPTIMIZER += -g
-endif
--- a/security/nss/external_tests/manifest.mn
+++ b/security/nss/external_tests/manifest.mn
@@ -3,12 +3,11 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 CORE_DEPTH = ..
 DEPTH      = ..
 
 DIRS = \
 	google_test \
         der_gtest \
-	util_gtest \
         pk11_gtest \
         ssl_gtest \
 	$(NULL)
--- a/security/nss/external_tests/ssl_gtest/libssl_internals.c
+++ b/security/nss/external_tests/ssl_gtest/libssl_internals.c
@@ -2,25 +2,25 @@
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /* This file contains functions for frobbing the internals of libssl */
 #include "libssl_internals.h"
 
-#include "nss.h"
 #include "seccomon.h"
 #include "ssl.h"
 #include "sslimpl.h"
 
 SECStatus
 SSLInt_IncrementClientHandshakeVersion(PRFileDesc *fd)
 {
-    sslSocket *ss = ssl_FindSocket(fd);
+    sslSocket *ss = (sslSocket *)fd->secret;
+
     if (!ss) {
         return SECFailure;
     }
 
     ++ss->clientHelloVersion;
 
     return SECSuccess;
 }
@@ -40,90 +40,8 @@ SSLInt_DetermineKEABits(PRUint16 serverK
     minKeaBits = 192U;
 #else
     // P-256 is the smallest supported curve.
     minKeaBits = 256U;
 #endif
 
     return PR_MAX(SSL_RSASTRENGTH_TO_ECSTRENGTH(serverKeyBits), minKeaBits);
 }
-
-/* Use this function to update the ClientRandom of a client's handshake state
- * after replacing its ClientHello message. We for example need to do this
- * when replacing an SSLv3 ClientHello with its SSLv2 equivalent. */
-SECStatus
-SSLInt_UpdateSSLv2ClientRandom(PRFileDesc *fd, uint8_t *rnd, size_t rnd_len,
-                               uint8_t *msg, size_t msg_len)
-{
-    sslSocket *ss = ssl_FindSocket(fd);
-    if (!ss) {
-        return SECFailure;
-    }
-
-    SECStatus rv = ssl3_InitState(ss);
-    if (rv != SECSuccess) {
-        return rv;
-    }
-
-    rv = ssl3_RestartHandshakeHashes(ss);
-    if (rv != SECSuccess) {
-        return rv;
-    }
-
-    // Zero the client_random struct.
-    PORT_Memset(&ss->ssl3.hs.client_random, 0, SSL3_RANDOM_LENGTH);
-
-    // Copy over the challenge bytes.
-    size_t offset = SSL3_RANDOM_LENGTH - rnd_len;
-    PORT_Memcpy(&ss->ssl3.hs.client_random.rand[offset], rnd, rnd_len);
-
-    // Rehash the SSLv2 client hello message.
-    return ssl3_UpdateHandshakeHashes(ss, msg, msg_len);
-}
-
-PRBool
-SSLInt_ExtensionNegotiated(PRFileDesc *fd, PRUint16 ext)
-{
-    sslSocket *ss = ssl_FindSocket(fd);
-    return (PRBool)(ss && ssl3_ExtensionNegotiated(ss, ext));
-}
-
-void
-SSLInt_ClearSessionTicketKey()
-{
-  ssl3_SessionTicketShutdown(NULL, NULL);
-  NSS_UnregisterShutdown(ssl3_SessionTicketShutdown, NULL);
-}
-
-PRInt32 SSLInt_CountTls13CipherSpecs(PRFileDesc *fd)
-{
-  PRCList *cur_p;
-  PRInt32 ct = 0;
-
-  sslSocket *ss = ssl_FindSocket(fd);
-  if (!ss) {
-    return -1;
-  }
-
-  for (cur_p = PR_NEXT_LINK(&ss->ssl3.hs.cipherSpecs);
-       cur_p != &ss->ssl3.hs.cipherSpecs;
-       cur_p = PR_NEXT_LINK(cur_p)) {
-    ++ct;
-  }
-  return ct;
-}
-
-/* Force a timer expiry by backdating when the timer was started.
- * We could set the remaining time to 0 but then backoff would not
- * work properly if we decide to test it. */
-void SSLInt_ForceTimerExpiry(PRFileDesc *fd)
-{
-  sslSocket *ss = ssl_FindSocket(fd);
-  if (!ss) {
-    return;
-  }
-
-  if (!ss->ssl3.hs.rtTimerCb)
-    return;
-
-  ss->ssl3.hs.rtTimerStarted = PR_IntervalNow() -
-      PR_MillisecondsToInterval(ss->ssl3.hs.rtTimeoutMs + 1);
-}
--- a/security/nss/external_tests/ssl_gtest/libssl_internals.h
+++ b/security/nss/external_tests/ssl_gtest/libssl_internals.h
@@ -2,31 +2,20 @@
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef libssl_internals_h_
 #define libssl_internals_h_
 
-#include <stdint.h>
-
 #include "prio.h"
 #include "seccomon.h"
 #include "sslt.h"
 
 SECStatus SSLInt_IncrementClientHandshakeVersion(PRFileDesc *fd);
 
 PRUint32 SSLInt_DetermineKEABits(PRUint16 serverKeyBits,
                                  SSLAuthType authAlgorithm);
 
-SECStatus SSLInt_UpdateSSLv2ClientRandom(PRFileDesc *fd,
-                                         uint8_t *rnd, size_t rnd_len,
-                                         uint8_t *msg, size_t msg_len);
-
-PRBool SSLInt_ExtensionNegotiated(PRFileDesc *fd, PRUint16 ext);
-void SSLInt_ClearSessionTicketKey();
-PRInt32 SSLInt_CountTls13CipherSpecs(PRFileDesc *fd);
-void SSLInt_ForceTimerExpiry(PRFileDesc *fd);
-
 #endif
 
 
--- a/security/nss/external_tests/ssl_gtest/manifest.mn
+++ b/security/nss/external_tests/ssl_gtest/manifest.mn
@@ -7,17 +7,16 @@ DEPTH      = ../..
 MODULE = nss
 
 # These sources have access to libssl internals
 CSRCS = \
       libssl_internals.c \
       $(NULL)
 
 CPPSRCS = \
-      ssl_v2_client_hello_unittest.cc \
       ssl_agent_unittest.cc \
       ssl_loopback_unittest.cc \
       ssl_extension_unittest.cc \
       ssl_skip_unittest.cc \
       ssl_gtest.cc \
       test_io.cc \
       tls_agent.cc \
       tls_connect.cc \
--- a/security/nss/external_tests/ssl_gtest/ssl_extension_unittest.cc
+++ b/security/nss/external_tests/ssl_gtest/ssl_extension_unittest.cc
@@ -10,16 +10,148 @@
 #include <memory>
 
 #include "tls_parser.h"
 #include "tls_filter.h"
 #include "tls_connect.h"
 
 namespace nss_test {
 
+class TlsExtensionFilter : public TlsHandshakeFilter {
+ protected:
+  virtual PacketFilter::Action FilterHandshake(
+      const HandshakeHeader& header,
+      const DataBuffer& input, DataBuffer* output) {
+    if (header.handshake_type() == kTlsHandshakeClientHello) {
+      TlsParser parser(input);
+      if (!FindClientHelloExtensions(&parser, header)) {
+        return KEEP;
+      }
+      return FilterExtensions(&parser, input, output);
+    }
+    if (header.handshake_type() == kTlsHandshakeServerHello) {
+      TlsParser parser(input);
+      if (!FindServerHelloExtensions(&parser, header.version())) {
+        return KEEP;
+      }
+      return FilterExtensions(&parser, input, output);
+    }
+    return KEEP;
+  }
+
+  virtual PacketFilter::Action FilterExtension(uint16_t extension_type,
+                                               const DataBuffer& input,
+                                               DataBuffer* output) = 0;
+
+ public:
+  static bool FindClientHelloExtensions(TlsParser* parser, const Versioned& header) {
+    if (!parser->Skip(2 + 32)) { // version + random
+      return false;
+    }
+    if (!parser->SkipVariable(1)) { // session ID
+      return false;
+    }
+    if (header.is_dtls() && !parser->SkipVariable(1)) { // DTLS cookie
+      return false;
+    }
+    if (!parser->SkipVariable(2)) { // cipher suites
+      return false;
+    }
+    if (!parser->SkipVariable(1)) { // compression methods
+      return false;
+    }
+    return true;
+  }
+
+  static bool FindServerHelloExtensions(TlsParser* parser, uint16_t version) {
+    if (!parser->Skip(2 + 32)) { // version + random
+      return false;
+    }
+    if (!parser->SkipVariable(1)) { // session ID
+      return false;
+    }
+    if (!parser->Skip(2)) { // cipher suite
+      return false;
+    }
+    if (NormalizeTlsVersion(version) <= SSL_LIBRARY_VERSION_TLS_1_2) {
+      if (!parser->Skip(1)) { // compression method
+        return false;
+      }
+    }
+    return true;
+  }
+
+ private:
+  PacketFilter::Action FilterExtensions(TlsParser* parser,
+                                        const DataBuffer& input,
+                                        DataBuffer* output) {
+    size_t length_offset = parser->consumed();
+    uint32_t all_extensions;
+    if (!parser->Read(&all_extensions, 2)) {
+      return KEEP; // no extensions, odd but OK
+    }
+    if (all_extensions != parser->remaining()) {
+      return KEEP; // malformed
+    }
+
+    bool changed = false;
+
+    // Write out the start of the message.
+    output->Allocate(input.len());
+    size_t offset = output->Write(0, input.data(), parser->consumed());
+
+    while (parser->remaining()) {
+      uint32_t extension_type;
+      if (!parser->Read(&extension_type, 2)) {
+        return KEEP; // malformed
+      }
+
+      DataBuffer extension;
+      if (!parser->ReadVariable(&extension, 2)) {
+        return KEEP; // malformed
+      }
+
+      DataBuffer filtered;
+      PacketFilter::Action action = FilterExtension(extension_type, extension,
+                                                    &filtered);
+      if (action == DROP) {
+        changed = true;
+        std::cerr << "extension drop: " << extension << std::endl;
+        continue;
+      }
+
+      const DataBuffer* source = &extension;
+      if (action == CHANGE) {
+        EXPECT_GT(0x10000U, filtered.len());
+        changed = true;
+        std::cerr << "extension old: " << extension << std::endl;
+        std::cerr << "extension new: " << filtered << std::endl;
+        source = &filtered;
+      }
+
+      // Write out extension.
+      offset = output->Write(offset, extension_type, 2);
+      offset = output->Write(offset, source->len(), 2);
+      offset = output->Write(offset, *source);
+    }
+    output->Truncate(offset);
+
+    if (changed) {
+      size_t newlen = output->len() - length_offset - 2;
+      EXPECT_GT(0x10000U, newlen);
+      if (newlen >= 0x10000) {
+        return KEEP; // bad: size increased too much
+      }
+      output->Write(length_offset, newlen, 2);
+      return CHANGE;
+    }
+    return KEEP;
+  }
+};
+
 class TlsExtensionTruncator : public TlsExtensionFilter {
  public:
   TlsExtensionTruncator(uint16_t extension, size_t length)
       : extension_(extension), length_(length) {}
   virtual PacketFilter::Action FilterExtension(
       uint16_t extension_type, const DataBuffer& input, DataBuffer* output) {
     if (extension_type != extension_) {
       return KEEP;
@@ -117,16 +249,36 @@ class TlsExtensionInjector : public TlsH
     return CHANGE;
   }
 
  private:
   const uint16_t extension_;
   const DataBuffer data_;
 };
 
+class TlsExtensionCapture : public TlsExtensionFilter {
+ public:
+  TlsExtensionCapture(uint16_t ext)
+      : extension_(ext), data_() {}
+
+  virtual PacketFilter::Action FilterExtension(
+      uint16_t extension_type, const DataBuffer& input, DataBuffer* output) {
+    if (extension_type == extension_) {
+      data_.Assign(input);
+    }
+    return KEEP;
+  }
+
+  const DataBuffer& extension() const { return data_; }
+
+ private:
+  const uint16_t extension_;
+  DataBuffer data_;
+};
+
 class TlsExtensionTestBase : public TlsConnectTestBase {
  protected:
   TlsExtensionTestBase(Mode mode, uint16_t version)
     : TlsConnectTestBase(mode, version) {}
 
   void ClientHelloErrorTest(PacketFilter* filter,
                             uint8_t alert = kTlsAlertDecodeError) {
     auto alert_recorder = new TlsAlertRecorder();
@@ -166,30 +318,21 @@ class TlsExtensionTestDtls
   : public TlsExtensionTestBase,
     public ::testing::WithParamInterface<uint16_t> {
  public:
   TlsExtensionTestDtls() : TlsExtensionTestBase(DGRAM, GetParam()) {}
 };
 
 class TlsExtensionTest12Plus
   : public TlsExtensionTestBase,
-    public ::testing::WithParamInterface<std::tuple<std::string, uint16_t>> {
+    public ::testing::WithParamInterface<std::string> {
  public:
   TlsExtensionTest12Plus()
-    : TlsExtensionTestBase(TlsConnectTestBase::ToMode((std::get<0>(GetParam()))),
-                           std::get<1>(GetParam())) {}
-};
-
-class TlsExtensionTest12
-  : public TlsExtensionTestBase,
-    public ::testing::WithParamInterface<std::tuple<std::string, uint16_t>> {
- public:
-  TlsExtensionTest12()
-    : TlsExtensionTestBase(TlsConnectTestBase::ToMode((std::get<0>(GetParam()))),
-                           std::get<1>(GetParam())) {}
+    : TlsExtensionTestBase(TlsConnectTestBase::ToMode(GetParam()),
+                           SSL_LIBRARY_VERSION_TLS_1_2) {}
 };
 
 class TlsExtensionTest13
   : public TlsExtensionTestBase,
     public ::testing::WithParamInterface<std::string> {
  public:
   TlsExtensionTest13()
     : TlsExtensionTestBase(TlsConnectTestBase::ToMode(GetParam()),
@@ -200,25 +343,16 @@ class TlsExtensionTestGeneric
   : public TlsExtensionTestBase,
     public ::testing::WithParamInterface<std::tuple<std::string, uint16_t>> {
  public:
   TlsExtensionTestGeneric()
     : TlsExtensionTestBase(TlsConnectTestBase::ToMode((std::get<0>(GetParam()))),
                            std::get<1>(GetParam())) {}
 };
 
-class TlsExtensionTestPre13
-  : public TlsExtensionTestBase,
-    public ::testing::WithParamInterface<std::tuple<std::string, uint16_t>> {
- public:
-  TlsExtensionTestPre13()
-    : TlsExtensionTestBase(TlsConnectTestBase::ToMode((std::get<0>(GetParam()))),
-                           std::get<1>(GetParam())) {}
-};
-
 TEST_P(TlsExtensionTestGeneric, DamageSniLength) {
   ClientHelloErrorTest(new TlsExtensionDamager(ssl_server_name_xtn, 1));
 }
 
 TEST_P(TlsExtensionTestGeneric, DamageSniHostLength) {
   ClientHelloErrorTest(new TlsExtensionDamager(ssl_server_name_xtn, 4));
 }
 
@@ -292,54 +426,52 @@ TEST_P(TlsExtensionTestGeneric, AlpnMism
   const uint8_t client_alpn[] = { 0x01, 0x61 };
   client_->EnableAlpn(client_alpn, sizeof(client_alpn));
   const uint8_t server_alpn[] = { 0x02, 0x61, 0x62 };
   server_->EnableAlpn(server_alpn, sizeof(server_alpn));
 
   ClientHelloErrorTest(nullptr, kTlsAlertNoApplicationProtocol);
 }
 
-// Many of these tests fail in TLS 1.3 because the extension is encrypted, which
-// prevents modification of the value from the ServerHello.
-TEST_P(TlsExtensionTestPre13, AlpnReturnedEmptyList) {
+TEST_P(TlsExtensionTestGeneric, AlpnReturnedEmptyList) {
   EnableAlpn();
   const uint8_t val[] = { 0x00, 0x00 };
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(new TlsExtensionReplacer(ssl_app_layer_protocol_xtn, extension));
 }
 
-TEST_P(TlsExtensionTestPre13, AlpnReturnedEmptyName) {
+TEST_P(TlsExtensionTestGeneric, AlpnReturnedEmptyName) {
   EnableAlpn();
   const uint8_t val[] = { 0x00, 0x01, 0x00 };
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(new TlsExtensionReplacer(ssl_app_layer_protocol_xtn, extension));
 }
 
-TEST_P(TlsExtensionTestPre13, AlpnReturnedListTrailingData) {
+TEST_P(TlsExtensionTestGeneric, AlpnReturnedListTrailingData) {
   EnableAlpn();
   const uint8_t val[] = { 0x00, 0x02, 0x01, 0x61, 0x00 };
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(new TlsExtensionReplacer(ssl_app_layer_protocol_xtn, extension));
 }
 
-TEST_P(TlsExtensionTestPre13, AlpnReturnedExtraEntry) {
+TEST_P(TlsExtensionTestGeneric, AlpnReturnedExtraEntry) {
   EnableAlpn();
   const uint8_t val[] = { 0x00, 0x04, 0x01, 0x61, 0x01, 0x62 };
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(new TlsExtensionReplacer(ssl_app_layer_protocol_xtn, extension));
 }
 
-TEST_P(TlsExtensionTestPre13, AlpnReturnedBadListLength) {
+TEST_P(TlsExtensionTestGeneric, AlpnReturnedBadListLength) {
   EnableAlpn();
   const uint8_t val[] = { 0x00, 0x99, 0x01, 0x61, 0x00 };
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(new TlsExtensionReplacer(ssl_app_layer_protocol_xtn, extension));
 }
 
-TEST_P(TlsExtensionTestPre13, AlpnReturnedBadNameLength) {
+TEST_P(TlsExtensionTestGeneric, AlpnReturnedBadNameLength) {
   EnableAlpn();
   const uint8_t val[] = { 0x00, 0x02, 0x99, 0x61 };
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(new TlsExtensionReplacer(ssl_app_layer_protocol_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestDtls, SrtpShort) {
   EnableSrtp();
@@ -412,61 +544,59 @@ TEST_P(TlsExtensionTestGeneric, Supporte
 
 TEST_P(TlsExtensionTestGeneric, SupportedCurvesTrailingData) {
   const uint8_t val[] = { 0x00, 0x02, 0x00, 0x00, 0x00 };
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(new TlsExtensionReplacer(ssl_elliptic_curves_xtn,
                                                 extension));
 }
 
-TEST_P(TlsExtensionTestPre13, SupportedPointsEmpty) {
+TEST_P(TlsExtensionTestGeneric, SupportedPointsEmpty) {
   const uint8_t val[] = { 0x00 };
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(new TlsExtensionReplacer(ssl_ec_point_formats_xtn,
                                                 extension));
 }
 
-TEST_P(TlsExtensionTestPre13, SupportedPointsBadLength) {
+TEST_P(TlsExtensionTestGeneric, SupportedPointsBadLength) {
   const uint8_t val[] = { 0x99, 0x00, 0x00 };
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(new TlsExtensionReplacer(ssl_ec_point_formats_xtn,
                                                 extension));
 }
 
-TEST_P(TlsExtensionTestPre13, SupportedPointsTrailingData) {
+TEST_P(TlsExtensionTestGeneric, SupportedPointsTrailingData) {
   const uint8_t val[] = { 0x01, 0x00, 0x00 };
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(new TlsExtensionReplacer(ssl_ec_point_formats_xtn,
                                                 extension));
 }
 
-TEST_P(TlsExtensionTestPre13, RenegotiationInfoBadLength) {
+TEST_P(TlsExtensionTestGeneric, RenegotiationInfoBadLength) {
   const uint8_t val[] = { 0x99 };
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(new TlsExtensionReplacer(ssl_renegotiation_info_xtn,
                                                 extension));
 }
 
-TEST_P(TlsExtensionTestPre13, RenegotiationInfoMismatch) {
+TEST_P(TlsExtensionTestGeneric, RenegotiationInfoMismatch) {
   const uint8_t val[] = { 0x01, 0x00 };
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(new TlsExtensionReplacer(ssl_renegotiation_info_xtn,
                                                 extension));
 }
 
 // The extension has to contain a length.
-TEST_P(TlsExtensionTestPre13, RenegotiationInfoExtensionEmpty) {
+TEST_P(TlsExtensionTestGeneric, RenegotiationInfoExtensionEmpty) {
   DataBuffer extension;
   ClientHelloErrorTest(new TlsExtensionReplacer(ssl_renegotiation_info_xtn,
                                                 extension));
 }
 
-// This only works on TLS 1.2, since it relies on static RSA; otherwise libssl
-// picks the wrong cipher suite.
-TEST_P(TlsExtensionTest12, SignatureAlgorithmConfiguration) {
+TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmConfiguration) {
   const SSLSignatureAndHashAlg algorithms[] = {
     {ssl_hash_sha512, ssl_sign_rsa},
     {ssl_hash_sha384, ssl_sign_ecdsa}
   };
 
   TlsExtensionCapture *capture =
     new TlsExtensionCapture(ssl_signature_algorithms_xtn);
   client_->SetSignatureAlgorithms(algorithms, PR_ARRAY_SIZE(algorithms));
@@ -484,17 +614,16 @@ TEST_P(TlsExtensionTest12, SignatureAlgo
     EXPECT_EQ(algorithms[i].hashAlg, static_cast<SSLHashType>(v));
     EXPECT_TRUE(ext.Read(cursor++, 1, &v));
     EXPECT_EQ(algorithms[i].sigAlg, static_cast<SSLSignType>(v));
   }
 }
 
 /*
  * Tests for Certificate Transparency (RFC 6962)
- * These don't work with TLS 1.3: see bug 1252745.
  */
 
 // Helper class - stores signed certificate timestamps as provided
 // by the relevant callbacks on the client.
 class SignedCertificateTimestampsExtractor {
  public:
   SignedCertificateTimestampsExtractor(TlsAgent& client) {
     client.SetAuthCertificateCallback(
@@ -513,30 +642,30 @@ class SignedCertificateTimestampsExtract
         const SECItem *scts = SSL_PeerSignedCertTimestamps(agent.ssl_fd());
         ASSERT_TRUE(scts);
         handshake_timestamps_.reset(new DataBuffer(scts->data, scts->len));
       }
     );
   }
 
   void assertTimestamps(const DataBuffer& timestamps) {
-    EXPECT_TRUE(auth_timestamps_);
-    EXPECT_EQ(timestamps, *auth_timestamps_);
+    ASSERT_TRUE(auth_timestamps_);
+    ASSERT_EQ(timestamps, *auth_timestamps_);
 
-    EXPECT_TRUE(handshake_timestamps_);
-    EXPECT_EQ(timestamps, *handshake_timestamps_);
+    ASSERT_TRUE(handshake_timestamps_);
+    ASSERT_EQ(timestamps, *handshake_timestamps_);
   }
 
  private:
   std::unique_ptr<DataBuffer> auth_timestamps_;
   std::unique_ptr<DataBuffer> handshake_timestamps_;
 };
 
 // Test timestamps extraction during a successful handshake.
-TEST_P(TlsExtensionTestPre13, SignedCertificateTimestampsHandshake) {
+TEST_P(TlsExtensionTestGeneric, SignedCertificateTimestampsHandshake) {
   uint8_t val[] = { 0x01, 0x23, 0x45, 0x67, 0x89 };
   const SECItem si_timestamps = { siBuffer, val, sizeof(val) };
   const DataBuffer timestamps(val, sizeof(val));
 
   server_->StartConnect();
   ASSERT_EQ(SECSuccess,
     SSL_SetSignedCertTimestamps(server_->ssl_fd(),
       &si_timestamps, server_->kea()));
@@ -549,48 +678,48 @@ TEST_P(TlsExtensionTestPre13, SignedCert
   SignedCertificateTimestampsExtractor timestamps_extractor(*client_);
   Handshake();
   CheckConnected();
   timestamps_extractor.assertTimestamps(timestamps);
 }
 
 // Test SSL_PeerSignedCertTimestamps returning zero-length SECItem
 // when the client / the server / both have not enabled the feature.
-TEST_P(TlsExtensionTestPre13, SignedCertificateTimestampsInactiveClient) {
+TEST_P(TlsExtensionTestGeneric, SignedCertificateTimestampsInactiveClient) {
   uint8_t val[] = { 0x01, 0x23, 0x45, 0x67, 0x89 };
   const SECItem si_timestamps = { siBuffer, val, sizeof(val) };
 
   server_->StartConnect();
   ASSERT_EQ(SECSuccess,
     SSL_SetSignedCertTimestamps(server_->ssl_fd(),
       &si_timestamps, server_->kea()));
 
   client_->StartConnect();
 
   SignedCertificateTimestampsExtractor timestamps_extractor(*client_);
   Handshake();
   CheckConnected();
   timestamps_extractor.assertTimestamps(DataBuffer());
 }
 
-TEST_P(TlsExtensionTestPre13, SignedCertificateTimestampsInactiveServer) {
+TEST_P(TlsExtensionTestGeneric, SignedCertificateTimestampsInactiveServer) {
   server_->StartConnect();
 
   client_->StartConnect();
   ASSERT_EQ(SECSuccess,
     SSL_OptionSet(client_->ssl_fd(),
       SSL_ENABLE_SIGNED_CERT_TIMESTAMPS, PR_TRUE));
 
   SignedCertificateTimestampsExtractor timestamps_extractor(*client_);
   Handshake();
   CheckConnected();
   timestamps_extractor.assertTimestamps(DataBuffer());
 }
 
-TEST_P(TlsExtensionTestPre13, SignedCertificateTimestampsInactiveBoth) {
+TEST_P(TlsExtensionTestGeneric, SignedCertificateTimestampsInactiveBoth) {
   server_->StartConnect();
   client_->StartConnect();
 
   SignedCertificateTimestampsExtractor timestamps_extractor(*client_);
   Handshake();
   CheckConnected();
   timestamps_extractor.assertTimestamps(DataBuffer());
 }
@@ -598,39 +727,26 @@ TEST_P(TlsExtensionTestPre13, SignedCert
 
 // Temporary test to verify that we choke on an empty ClientKeyShare.
 // This test will fail when we implement HelloRetryRequest.
 TEST_P(TlsExtensionTest13, EmptyClientKeyShare) {
   ClientHelloErrorTest(new TlsExtensionTruncator(ssl_tls13_key_share_xtn, 2),
                        kTlsAlertHandshakeFailure);
 }
 
-INSTANTIATE_TEST_CASE_P(ExtensionStream, TlsExtensionTestGeneric,
+INSTANTIATE_TEST_CASE_P(ExtensionTls10, TlsExtensionTestGeneric,
                         ::testing::Combine(
                           TlsConnectTestBase::kTlsModesStream,
-                          TlsConnectTestBase::kTlsVAll));
-INSTANTIATE_TEST_CASE_P(ExtensionDatagram, TlsExtensionTestGeneric,
-                        ::testing::Combine(
-                          TlsConnectTestBase::kTlsModesAll,
-                          TlsConnectTestBase::kTlsV11Plus));
-INSTANTIATE_TEST_CASE_P(ExtensionDatagramOnly, TlsExtensionTestDtls,
-                        TlsConnectTestBase::kTlsV11Plus);
-
-INSTANTIATE_TEST_CASE_P(ExtensionTls12Plus, TlsExtensionTest12Plus,
-                        ::testing::Combine(
-                          TlsConnectTestBase::kTlsModesAll,
-                          TlsConnectTestBase::kTlsV12Plus));
-
-INSTANTIATE_TEST_CASE_P(ExtensionPre13Stream, TlsExtensionTestPre13,
-                        ::testing::Combine(
-                          TlsConnectTestBase::kTlsModesStream,
-                          TlsConnectTestBase::kTlsV10To12));
-INSTANTIATE_TEST_CASE_P(ExtensionPre13Datagram, TlsExtensionTestPre13,
+                          TlsConnectTestBase::kTlsV10));
+INSTANTIATE_TEST_CASE_P(ExtensionVariants, TlsExtensionTestGeneric,
                         ::testing::Combine(
                           TlsConnectTestBase::kTlsModesAll,
                           TlsConnectTestBase::kTlsV11V12));
-
+INSTANTIATE_TEST_CASE_P(ExtensionTls12Plus, TlsExtensionTest12Plus,
+                        TlsConnectTestBase::kTlsModesAll);
 #ifdef NSS_ENABLE_TLS_1_3
 INSTANTIATE_TEST_CASE_P(ExtensionTls13, TlsExtensionTest13,
-                        TlsConnectTestBase::kTlsModesAll);
+                        TlsConnectTestBase::kTlsModesStream);
 #endif
+INSTANTIATE_TEST_CASE_P(ExtensionDgram, TlsExtensionTestDtls,
+                        TlsConnectTestBase::kTlsV11V12);
 
 }  // namespace nspr_test
--- a/security/nss/external_tests/ssl_gtest/ssl_loopback_unittest.cc
+++ b/security/nss/external_tests/ssl_gtest/ssl_loopback_unittest.cc
@@ -141,143 +141,122 @@ TEST_P(TlsConnectGeneric, Connect) {
 
 TEST_P(TlsConnectGeneric, ConnectEcdsa) {
   SetExpectedVersion(std::get<1>(GetParam()));
   ResetEcdsa();
   Connect();
   CheckKeys(ssl_kea_ecdh, ssl_auth_ecdsa);
 }
 
-TEST_P(TlsConnectGenericPre13, ConnectFalseStart) {
+TEST_P(TlsConnectGeneric, ConnectFalseStart) {
   client_->EnableFalseStart();
   Connect();
   SendReceive();
 }
 
-TEST_P(TlsConnectGenericPre13, ConnectResumed) {
+TEST_P(TlsConnectGeneric, ConnectResumed) {
   ConfigureSessionCache(RESUME_SESSIONID, RESUME_SESSIONID);
   Connect();
 
   ResetRsa();
   ExpectResumption(RESUME_SESSIONID);
   Connect();
 }
 
 TEST_P(TlsConnectGeneric, ConnectClientCacheDisabled) {
   ConfigureSessionCache(RESUME_NONE, RESUME_SESSIONID);
   Connect();
-  SendReceive();
-
   ResetRsa();
   ExpectResumption(RESUME_NONE);
   Connect();
-  SendReceive();
 }
 
 TEST_P(TlsConnectGeneric, ConnectServerCacheDisabled) {
   ConfigureSessionCache(RESUME_SESSIONID, RESUME_NONE);
   Connect();
-  SendReceive();
-
   ResetRsa();
   ExpectResumption(RESUME_NONE);
   Connect();
-  SendReceive();
 }
 
 TEST_P(TlsConnectGeneric, ConnectSessionCacheDisabled) {
   ConfigureSessionCache(RESUME_NONE, RESUME_NONE);
   Connect();
-  SendReceive();
-
   ResetRsa();
   ExpectResumption(RESUME_NONE);
   Connect();
-  SendReceive();
 }
 
 TEST_P(TlsConnectGeneric, ConnectResumeSupportBoth) {
   // This prefers tickets.
   ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
   Connect();
-  SendReceive();
 
   ResetRsa();
   ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
   ExpectResumption(RESUME_TICKET);
   Connect();
-  SendReceive();
 }
 
 TEST_P(TlsConnectGeneric, ConnectResumeClientTicketServerBoth) {
   // This causes no resumption because the client needs the
   // session cache to resume even with tickets.
   ConfigureSessionCache(RESUME_TICKET, RESUME_BOTH);
   Connect();
-  SendReceive();
 
   ResetRsa();
   ConfigureSessionCache(RESUME_TICKET, RESUME_BOTH);
   ExpectResumption(RESUME_NONE);
   Connect();
-  SendReceive();
 }
 
 TEST_P(TlsConnectGeneric, ConnectResumeClientBothTicketServerTicket) {
   // This causes a ticket resumption.
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   Connect();
-  SendReceive();
 
   ResetRsa();
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   ExpectResumption(RESUME_TICKET);
   Connect();
-  SendReceive();
 }
 
-TEST_P(TlsConnectGenericPre13, ConnectResumeClientServerTicketOnly) {
+TEST_P(TlsConnectGeneric, ConnectClientServerTicketOnly) {
   // This causes no resumption because the client needs the
   // session cache to resume even with tickets.
   ConfigureSessionCache(RESUME_TICKET, RESUME_TICKET);
   Connect();
-  SendReceive();
 
   ResetRsa();
   ConfigureSessionCache(RESUME_TICKET, RESUME_TICKET);
   ExpectResumption(RESUME_NONE);
   Connect();
-  SendReceive();
 }
 
-TEST_P(TlsConnectGenericPre13, ConnectResumeClientBothServerNone) {
+TEST_P(TlsConnectGeneric, ConnectClientBothServerNone) {
   ConfigureSessionCache(RESUME_BOTH, RESUME_NONE);
   Connect();
-  SendReceive();
 
   ResetRsa();
   ConfigureSessionCache(RESUME_BOTH, RESUME_NONE);
   ExpectResumption(RESUME_NONE);
   Connect();
-  SendReceive();
 }
 
-TEST_P(TlsConnectGenericPre13, ConnectResumeClientNoneServerBoth) {
+TEST_P(TlsConnectGeneric, ConnectClientNoneServerBoth) {
   ConfigureSessionCache(RESUME_NONE, RESUME_BOTH);
   Connect();
-  SendReceive();
 
   ResetRsa();
   ConfigureSessionCache(RESUME_NONE, RESUME_BOTH);
   ExpectResumption(RESUME_NONE);
   Connect();
-  SendReceive();
 }
 
-TEST_P(TlsConnectGenericPre13, ConnectResumeWithHigherVersion) {
+TEST_P(TlsConnectGeneric, ResumeWithHigherVersion) {
   EnsureTlsSetup();
   SetExpectedVersion(SSL_LIBRARY_VERSION_TLS_1_1);
   ConfigureSessionCache(RESUME_SESSIONID, RESUME_SESSIONID);
   client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
                            SSL_LIBRARY_VERSION_TLS_1_1);
   server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
                            SSL_LIBRARY_VERSION_TLS_1_1);
   Connect();
@@ -288,48 +267,42 @@ TEST_P(TlsConnectGenericPre13, ConnectRe
   client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
                            SSL_LIBRARY_VERSION_TLS_1_2);
   server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
                            SSL_LIBRARY_VERSION_TLS_1_2);
   ExpectResumption(RESUME_NONE);
   Connect();
 }
 
-TEST_P(TlsConnectGeneric, ConnectResumeClientBothTicketServerTicketForget) {
-  // This causes a ticket resumption.
-  ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
+TEST_P(TlsConnectGeneric, ClientAuth) {
+  client_->SetupClientAuth();
+  server_->RequestClientAuth(true);
   Connect();
-  SendReceive();
-
-  ResetRsa();
-  ClearServerCache();
-  ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
-  ExpectResumption(RESUME_NONE);
-  Connect();
-  SendReceive();
+  CheckKeys(ssl_kea_ecdh, ssl_auth_rsa);
 }
 
-TEST_P(TlsConnectGeneric, ClientAuth) {
+// Temporary copy for TLS 1.3 because 1.3 is stream only.
+TEST_P(TlsConnectStream, ClientAuth) {
   client_->SetupClientAuth();
   server_->RequestClientAuth(true);
   Connect();
   CheckKeys(ssl_kea_ecdh, ssl_auth_rsa);
 }
 
 // In TLS 1.3, the client sends its cert rejection on the
 // second flight, and since it has already received the
 // server's Finished, it transitions to complete and
 // then gets an alert from the server. The test harness
 // doesn't handle this right yet.
 TEST_P(TlsConnectStream, DISABLED_ClientAuthRequiredRejected) {
   server_->RequestClientAuth(true);
   ConnectExpectFail();
 }
 
-TEST_P(TlsConnectGeneric, ClientAuthRequestedRejected) {
+TEST_P(TlsConnectStream, ClientAuthRequestedRejected) {
   server_->RequestClientAuth(false);
   Connect();
   CheckKeys(ssl_kea_ecdh, ssl_auth_rsa);
 }
 
 
 TEST_P(TlsConnectGeneric, ClientAuthEcdsa) {
   ResetEcdsa();
@@ -384,27 +357,27 @@ TEST_P(TlsConnectGeneric, SignatureAlgor
                                   PR_ARRAY_SIZE(SignatureEcdsaSha384));
   ResetEcdsa();
   Connect();
 }
 
 // There is no need for overlap on signatures; since we don't actually use the
 // signatures for static RSA, this should still connect successfully.
 // This should also work in TLS 1.0 and 1.1 where the algorithms aren't used.
-TEST_P(TlsConnectGenericPre13, SignatureAlgorithmNoOverlapStaticRsa) {
+TEST_P(TlsConnectGeneric, SignatureAlgorithmNoOverlapStaticRsa) {
   client_->SetSignatureAlgorithms(SignatureRsaSha384,
                                   PR_ARRAY_SIZE(SignatureRsaSha384));
   server_->SetSignatureAlgorithms(SignatureRsaSha256,
                                   PR_ARRAY_SIZE(SignatureRsaSha256));
   DisableDheAndEcdheCiphers();
   Connect();
   CheckKeys(ssl_kea_rsa, ssl_auth_rsa);
 }
 
-TEST_P(TlsConnectGenericPre13, ConnectStaticRSA) {
+TEST_P(TlsConnectStreamPre13, ConnectStaticRSA) {
   DisableDheAndEcdheCiphers();
   Connect();
   CheckKeys(ssl_kea_rsa, ssl_auth_rsa);
 }
 
 // Signature algorithms governs both verification and generation of signatures.
 // With ECDSA, we need to at least have a common signature algorithm configured.
 TEST_P(TlsConnectTls12, SignatureAlgorithmNoOverlapEcdsa) {
@@ -437,87 +410,28 @@ TEST_P(TlsConnectTls12, RequestClientAut
 
 TEST_P(TlsConnectGeneric, ConnectAlpn) {
   EnableAlpn();
   Connect();
   client_->CheckAlpn(SSL_NEXT_PROTO_SELECTED, "a");
   server_->CheckAlpn(SSL_NEXT_PROTO_NEGOTIATED, "a");
 }
 
+// Temporary copy to test Alpn with TLS 1.3.
+TEST_P(TlsConnectStream, ConnectAlpn) {
+  EnableAlpn();
+  Connect();
+  client_->CheckAlpn(SSL_NEXT_PROTO_SELECTED, "a");
+  server_->CheckAlpn(SSL_NEXT_PROTO_NEGOTIATED, "a");
+}
+
 TEST_P(TlsConnectDatagram, ConnectSrtp) {
   EnableSrtp();
   Connect();
   CheckSrtp();
-  SendReceive();
-}
-
-// This class selectively drops complete writes.  This relies on the fact that
-// writes in libssl are on record boundaries.
-class SelectiveDropFilter : public PacketFilter, public PollTarget {
- public:
-  SelectiveDropFilter(uint32_t pattern)
-      : pattern_(pattern),
-        counter_(0) {}
-
- protected:
-  virtual Action Filter(const DataBuffer& input, DataBuffer* output) override {
-    if (counter_ >= 32) {
-      return KEEP;
-    }
-    return ((1 << counter_++) & pattern_) ? DROP : KEEP;
-  }
-
- private:
-  const uint32_t pattern_;
-  uint8_t counter_;
-};
-
-TEST_P(TlsConnectDatagram, DropClientFirstFlightOnce) {
-  client_->SetPacketFilter(new SelectiveDropFilter(0x1));
-  Connect();
-  SendReceive();
-}
-
-TEST_P(TlsConnectDatagram, DropServerFirstFlightOnce) {
-  server_->SetPacketFilter(new SelectiveDropFilter(0x1));
-  Connect();
-  SendReceive();
-}
-
-// This drops the first transmission from both the client and server of all
-// flights that they send.  Note: In DTLS 1.3, the shorter handshake means that
-// this will also drop some application data, so we can't call SendReceive().
-TEST_P(TlsConnectDatagram, DropAllFirstTransmissions) {
-  client_->SetPacketFilter(new SelectiveDropFilter(0x15));
-  server_->SetPacketFilter(new SelectiveDropFilter(0x5));
-  Connect();
-}
-
-// This drops the server's first flight three times.
-TEST_P(TlsConnectDatagram, DropServerFirstFlightThrice) {
-  server_->SetPacketFilter(new SelectiveDropFilter(0x7));
-  Connect();
-}
-
-// This drops the client's second flight once
-TEST_P(TlsConnectDatagram, DropClientSecondFlightOnce) {
-  client_->SetPacketFilter(new SelectiveDropFilter(0x2));
-  Connect();
-}
-
-// This drops the client's second flight three times.
-TEST_P(TlsConnectDatagram, DropClientSecondFlightThrice) {
-  client_->SetPacketFilter(new SelectiveDropFilter(0xe));
-  Connect();
-}
-
-// This drops the server's second flight three times.
-TEST_P(TlsConnectDatagram, DropServerSecondFlightThrice) {
-  server_->SetPacketFilter(new SelectiveDropFilter(0xe));
-  Connect();
 }
 
 // 1.3 is disabled in the next few tests because we don't
 // presently support resumption in 1.3.
 TEST_P(TlsConnectStreamPre13, ConnectAndClientRenegotiate) {
   Connect();
   server_->PrepareForRenegotiate();
   client_->StartRenegotiate();
@@ -528,18 +442,17 @@ TEST_P(TlsConnectStreamPre13, ConnectAnd
 TEST_P(TlsConnectStreamPre13, ConnectAndServerRenegotiate) {
   Connect();
   client_->PrepareForRenegotiate();
   server_->StartRenegotiate();
   Handshake();
   CheckConnected();
 }
 
-// TODO implement DHE for 1.3
-TEST_P(TlsConnectGenericPre13, ConnectDhe) {
+TEST_P(TlsConnectStreamPre13, ConnectDhe) {
   DisableEcdheCiphers();
   Connect();
   CheckKeys(ssl_kea_dh, ssl_auth_rsa);
 }
 
 // Test that a totally bogus EPMS is handled correctly.
 // This test is stream so we can catch the bad_record_mac alert.
 TEST_P(TlsConnectStreamPre13, ConnectStaticRSABogusCKE) {
@@ -568,31 +481,30 @@ TEST_P(TlsConnectStreamPre13, ConnectSta
   ConnectExpectFail();
   EXPECT_EQ(kTlsAlertFatal, alert_recorder->level());
   EXPECT_EQ(kTlsAlertBadRecordMac, alert_recorder->description());
 }
 
 // Test that a PMS with a bogus version number is ignored when
 // rollback detection is disabled. This is a positive control for
 // ConnectStaticRSABogusPMSVersionDetect.
-TEST_P(TlsConnectGenericPre13, ConnectStaticRSABogusPMSVersionIgnore) {
+TEST_P(TlsConnectGeneric, ConnectStaticRSABogusPMSVersionIgnore) {
   DisableDheAndEcdheCiphers();
   client_->SetPacketFilter(new TlsInspectorClientHelloVersionChanger(
       server_));
   server_->DisableRollbackDetection();
   Connect();
 }
 
-TEST_P(TlsConnectGeneric, ConnectEcdhe) {
+TEST_P(TlsConnectStream, ConnectEcdhe) {
   Connect();
   CheckKeys(ssl_kea_ecdh, ssl_auth_rsa);
 }
 
-// Prior to TLS 1.3, we were not fully ephemeral; though 1.3 fixes that
-TEST_P(TlsConnectGenericPre13, ConnectEcdheTwiceReuseKey) {
+TEST_P(TlsConnectStreamPre13, ConnectEcdheTwiceReuseKey) {
   TlsInspectorRecordHandshakeMessage* i1 =
       new TlsInspectorRecordHandshakeMessage(kTlsHandshakeServerKeyExchange);
   server_->SetPacketFilter(i1);
   Connect();
   CheckKeys(ssl_kea_ecdh, ssl_auth_rsa);
   TlsServerKeyExchangeEcdhe dhe1;
   EXPECT_TRUE(dhe1.Parse(i1->buffer()));
 
@@ -609,18 +521,17 @@ TEST_P(TlsConnectGenericPre13, ConnectEc
   EXPECT_TRUE(dhe2.Parse(i2->buffer()));
 
   // Make sure they are the same.
   EXPECT_EQ(dhe1.public_key_.len(), dhe2.public_key_.len());
   EXPECT_TRUE(!memcmp(dhe1.public_key_.data(), dhe2.public_key_.data(),
                       dhe1.public_key_.len()));
 }
 
-// This test parses the ServerKeyExchange, which isn't in 1.3
-TEST_P(TlsConnectGenericPre13, ConnectEcdheTwiceNewKey) {
+TEST_P(TlsConnectStreamPre13, ConnectEcdheTwiceNewKey) {
   server_->EnsureTlsSetup();
   SECStatus rv =
       SSL_OptionSet(server_->ssl_fd(), SSL_REUSE_SERVER_ECDHE_KEY, PR_FALSE);
   EXPECT_EQ(SECSuccess, rv);
   TlsInspectorRecordHandshakeMessage* i1 =
       new TlsInspectorRecordHandshakeMessage(kTlsHandshakeServerKeyExchange);
   server_->SetPacketFilter(i1);
   Connect();
@@ -700,26 +611,27 @@ TEST_P(TlsConnectStream, ShortRead) {
   // Read the first tranche.
   WAIT_(client_->received_bytes() == 1024, 2000);
   ASSERT_EQ(1024U, client_->received_bytes());
   // The second tranche should now immediately be available.
   client_->ReadBytes();
   ASSERT_EQ(1200U, client_->received_bytes());
 }
 
-TEST_P(TlsConnectGenericPre13, ConnectExtendedMasterSecret) {
+TEST_P(TlsConnectGeneric, ConnectExtendedMasterSecret) {
   EnableExtendedMasterSecret();
   Connect();
   ResetRsa();
   ExpectResumption(RESUME_SESSIONID);
   EnableExtendedMasterSecret();
   Connect();
 }
 
-TEST_P(TlsConnectGenericPre13, ConnectExtendedMasterSecretStaticRSA) {
+
+TEST_P(TlsConnectGeneric, ConnectExtendedMasterSecretStaticRSA) {
   DisableDheAndEcdheCiphers();
   EnableExtendedMasterSecret();
   Connect();
 }
 
 // This test is stream so we can catch the bad_record_mac alert.
 TEST_P(TlsConnectStreamPre13, ConnectExtendedMasterSecretStaticRSABogusCKE) {
   DisableDheAndEcdheCiphers();
@@ -754,17 +666,17 @@ TEST_P(TlsConnectStreamPre13, ConnectExt
   DisableDheAndEcdheCiphers();
   EnableExtendedMasterSecret();
   client_->SetPacketFilter(new TlsInspectorClientHelloVersionChanger(
       server_));
   server_->DisableRollbackDetection();
   Connect();
 }
 
-TEST_P(TlsConnectGenericPre13, ConnectExtendedMasterSecretECDHE) {
+TEST_P(TlsConnectGeneric, ConnectExtendedMasterSecretECDHE) {
   EnableExtendedMasterSecret();
   Connect();
 
   ResetRsa();
   EnableExtendedMasterSecret();
   ExpectResumption(RESUME_SESSIONID);
   Connect();
 }
@@ -817,52 +729,56 @@ TEST_P(TlsConnectGenericPre13,
   Connect();
 
   ResetRsa();
   EnableExtendedMasterSecret();
   ExpectResumption(RESUME_NONE);
   Connect();
 }
 
-TEST_P(TlsConnectGeneric, ConnectWithCompressionMaybe)
+TEST_P(TlsConnectStream, ConnectWithCompressionMaybe)
 {
   EnsureTlsSetup();
   client_->EnableCompression();
   server_->EnableCompression();
   Connect();
-  EXPECT_EQ(client_->version() < SSL_LIBRARY_VERSION_TLS_1_3 &&
-            mode_ != DGRAM, client_->is_compressed());
+  EXPECT_EQ(client_->version() < SSL_LIBRARY_VERSION_TLS_1_3, client_->is_compressed());
   SendReceive();
 }
 
 
+TEST_P(TlsConnectStream, ConnectSendReceive) {
+  Connect();
+  SendReceive();
+}
+
 TEST_P(TlsConnectStream, ServerNegotiateTls10) {
   uint16_t minver, maxver;
   client_->GetVersionRange(&minver, &maxver);
   client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_0,
                            maxver);
   server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_0,
                            SSL_LIBRARY_VERSION_TLS_1_0);
   Connect();
 }
 
-TEST_P(TlsConnectGeneric, ServerNegotiateTls11) {
+TEST_P(TlsConnectStream, ServerNegotiateTls11) {
   if (version_ < SSL_LIBRARY_VERSION_TLS_1_1)
     return;
 
   uint16_t minver, maxver;
   client_->GetVersionRange(&minver, &maxver);
   client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
                            maxver);
   server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
                            SSL_LIBRARY_VERSION_TLS_1_1);
   Connect();
 }
 
-TEST_P(TlsConnectGeneric, ServerNegotiateTls12) {
+TEST_P(TlsConnectStream, ServerNegotiateTls12) {
   if (version_ < SSL_LIBRARY_VERSION_TLS_1_2)
     return;
 
   uint16_t minver, maxver;
   client_->GetVersionRange(&minver, &maxver);
   client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
                            maxver);
   server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
@@ -938,75 +854,16 @@ TEST_F(TlsConnectTest, TestFallbackFromT
   client_->SetDowngradeCheckVersion(SSL_LIBRARY_VERSION_TLS_1_3);
   client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
                            SSL_LIBRARY_VERSION_TLS_1_2);
   server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
                            SSL_LIBRARY_VERSION_TLS_1_3);
   ConnectExpectFail();
   ASSERT_EQ(SSL_ERROR_RX_MALFORMED_SERVER_HELLO, client_->error_code());
 }
-
-// Test that two TLS resumptions work and produce the same ticket.
-// This will change after bug 1257047 is fixed.
-TEST_F(TlsConnectTest, TestTls13ResumptionTwice) {
-  ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
-  client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
-                           SSL_LIBRARY_VERSION_TLS_1_3);
-  server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
-                           SSL_LIBRARY_VERSION_TLS_1_3);
-  Connect();
-  SendReceive(); // Need to read so that we absorb the session ticket.
-  CheckKeys(ssl_kea_ecdh, ssl_auth_rsa);
-
-  ResetRsa();
-  ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
-  TlsExtensionCapture *c1 =
-      new TlsExtensionCapture(kTlsExtensionPreSharedKey);
-  client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
-                           SSL_LIBRARY_VERSION_TLS_1_3);
-  server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
-                           SSL_LIBRARY_VERSION_TLS_1_3);
-  ExpectResumption(RESUME_TICKET);
-  Connect();
-  SendReceive();
-  CheckKeys(ssl_kea_ecdh, ssl_auth_rsa);
-  DataBuffer psk1(c1->extension());
-  ASSERT_GE(psk1.len(), 0UL);
-
-  ResetRsa();
-  ClearStats();
-  ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
-  TlsExtensionCapture *c2 =
-      new TlsExtensionCapture(kTlsExtensionPreSharedKey);
-  client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
-                           SSL_LIBRARY_VERSION_TLS_1_3);
-  server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
-                           SSL_LIBRARY_VERSION_TLS_1_3);
-  ExpectResumption(RESUME_TICKET);
-  Connect();
-  SendReceive();
-  CheckKeys(ssl_kea_ecdh, ssl_auth_rsa);
-  DataBuffer psk2(c2->extension());
-  ASSERT_GE(psk2.len(), 0UL);
-
-  // TODO(ekr@rtfm.com): This will change when we fix bug 1257047.
-  ASSERT_EQ(psk1, psk2);
-}
-
-TEST_P(TlsConnectDatagram, TestDtlsHolddownExpiry) {
-  Connect();
-  std::cerr << "Expiring holddown timer\n";
-  SSLInt_ForceTimerExpiry(client_->ssl_fd());
-  SSLInt_ForceTimerExpiry(server_->ssl_fd());
-  SendReceive();
-  if (version_ >= SSL_LIBRARY_VERSION_TLS_1_3) {
-    EXPECT_EQ(1, SSLInt_CountTls13CipherSpecs(client_->ssl_fd()));
-  }
-}
-
 #endif
 
 class BeforeFinished : public TlsRecordFilter {
  private:
   enum HandshakeState {
     BEFORE_CCS,
     AFTER_CCS,
     DONE
@@ -1072,31 +929,32 @@ class BeforeFinished : public TlsRecordF
 
   TlsAgent* client_;
   TlsAgent* server_;
   VoidFunction before_ccs_;
   VoidFunction before_finished_;
   HandshakeState state_;
 };
 
-TEST_P(TlsConnectGenericPre13, ClientWriteBetweenCCSAndFinishedWithFalseStart) {
+// TODO Pre13
+TEST_P(TlsConnectGeneric, ClientWriteBetweenCCSAndFinishedWithFalseStart) {
   client_->EnableFalseStart();
   server_->SetPacketFilter(new BeforeFinished(client_, server_, [this]() {
         EXPECT_TRUE(client_->can_falsestart_hook_called());
       }, [this]() {
         // Write something, which used to fail: bug 1235366.
         client_->SendData(10);
       }));
 
   Connect();
   server_->SendData(10);
   Receive(10);
 }
 
-TEST_P(TlsConnectGenericPre13, AuthCompleteBeforeFinishedWithFalseStart) {
+TEST_P(TlsConnectGeneric, AuthCompleteBeforeFinishedWithFalseStart) {
   client_->EnableFalseStart();
   client_->SetAuthCertificateCallback(
       [](TlsAgent&, PRBool, PRBool) -> SECStatus {
         return SECWouldBlock;
       });
   server_->SetPacketFilter(new BeforeFinished(client_, server_, []() {
         // Do nothing before CCS
       }, [this]() {
@@ -1107,48 +965,43 @@ TEST_P(TlsConnectGenericPre13, AuthCompl
         client_->SendData(10);
       }));
 
   Connect();
   server_->SendData(10);
   Receive(10);
 }
 
-INSTANTIATE_TEST_CASE_P(GenericStream, TlsConnectGeneric,
+INSTANTIATE_TEST_CASE_P(VariantsStream10, TlsConnectGeneric,
                         ::testing::Combine(
                           TlsConnectTestBase::kTlsModesStream,
-                          TlsConnectTestBase::kTlsVAll));
-INSTANTIATE_TEST_CASE_P(GenericDatagram, TlsConnectGeneric,
+                          TlsConnectTestBase::kTlsV10));
+INSTANTIATE_TEST_CASE_P(VariantsAll, TlsConnectGeneric,
                         ::testing::Combine(
-                          TlsConnectTestBase::kTlsModesDatagram,
-                          TlsConnectTestBase::kTlsV11Plus));
-
-INSTANTIATE_TEST_CASE_P(StreamOnly, TlsConnectStream,
-                        TlsConnectTestBase::kTlsVAll);
-INSTANTIATE_TEST_CASE_P(DatagramOnly, TlsConnectDatagram,
-                        TlsConnectTestBase::kTlsV11Plus);
-
-INSTANTIATE_TEST_CASE_P(ChaCha20, TlsChaCha20Poly1305Test,
+                          TlsConnectTestBase::kTlsModesAll,
+                          TlsConnectTestBase::kTlsV11V12));
+INSTANTIATE_TEST_CASE_P(VersionsDatagram, TlsConnectDatagram,
+                        TlsConnectTestBase::kTlsV11V12);
+INSTANTIATE_TEST_CASE_P(Variants12, TlsConnectTls12,
                         TlsConnectTestBase::kTlsModesAll);
-
+INSTANTIATE_TEST_CASE_P(Variants12, TlsChaCha20Poly1305Test,
+                        TlsConnectTestBase::kTlsModesAll);
 INSTANTIATE_TEST_CASE_P(Pre12Stream, TlsConnectPre12,
                         ::testing::Combine(
                           TlsConnectTestBase::kTlsModesStream,
-                          TlsConnectTestBase::kTlsV10V11));
-INSTANTIATE_TEST_CASE_P(Pre12Datagram, TlsConnectPre12,
+                          TlsConnectTestBase::kTlsV10));
+INSTANTIATE_TEST_CASE_P(Pre12All, TlsConnectPre12,
                         ::testing::Combine(
-                          TlsConnectTestBase::kTlsModesDatagram,
+                          TlsConnectTestBase::kTlsModesAll,
                           TlsConnectTestBase::kTlsV11));
-
-INSTANTIATE_TEST_CASE_P(Version12Only, TlsConnectTls12,
-                        TlsConnectTestBase::kTlsModesAll);
-
-INSTANTIATE_TEST_CASE_P(Pre13Stream, TlsConnectGenericPre13,
-                        ::testing::Combine(
-                          TlsConnectTestBase::kTlsModesStream,
-                          TlsConnectTestBase::kTlsV10To12));
-INSTANTIATE_TEST_CASE_P(Pre13Datagram, TlsConnectGenericPre13,
-                        ::testing::Combine(
-                             TlsConnectTestBase::kTlsModesDatagram,
-                             TlsConnectTestBase::kTlsV11V12));
-INSTANTIATE_TEST_CASE_P(Pre13StreamOnly, TlsConnectStreamPre13,
-                        TlsConnectTestBase::kTlsV10To12);
+INSTANTIATE_TEST_CASE_P(VersionsStream10, TlsConnectStream,
+                        TlsConnectTestBase::kTlsV10);
+INSTANTIATE_TEST_CASE_P(VersionsStream, TlsConnectStream,
+                        TlsConnectTestBase::kTlsV11V12);
+INSTANTIATE_TEST_CASE_P(VersionsStream10Pre13, TlsConnectStreamPre13,
+                        TlsConnectTestBase::kTlsV10);
+INSTANTIATE_TEST_CASE_P(VersionsStreamPre13, TlsConnectStreamPre13,
+                        TlsConnectTestBase::kTlsV11V12);
+#ifdef NSS_ENABLE_TLS_1_3
+INSTANTIATE_TEST_CASE_P(VersionsStream13, TlsConnectStream,
+                        TlsConnectTestBase::kTlsV13);
+#endif
 }  // namespace nspr_test
deleted file mode 100644
--- a/security/nss/external_tests/ssl_gtest/ssl_v2_client_hello_unittest.cc
+++ /dev/null
@@ -1,406 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "ssl.h"
-#include "sslerr.h"
-#include "sslproto.h"
-#include "pk11pub.h"
-
-extern "C" {
-// This is not something that should make you happy.
-#include "libssl_internals.h"
-}
-
-#include "tls_filter.h"
-#include "tls_connect.h"
-#include "gtest_utils.h"
-
-namespace nss_test {
-
-// Replaces the client hello with an SSLv2 version once.
-class SSLv2ClientHelloFilter : public PacketFilter
-{
-  public:
-    SSLv2ClientHelloFilter(TlsAgent* client, uint16_t version)
-        : replaced_(false), client_(client), version_(version), pad_len_(0),
-          reported_pad_len_(0), client_random_len_(16), ciphers_(0),
-          send_escape_(false)
-    { }
-
-    void
-    SetVersion(uint16_t version)
-    {
-        version_ = version;
-    }
-
-    void
-    SetCipherSuites(const std::vector<uint16_t>& ciphers)
-    {
-        ciphers_ = ciphers;
-    }
-
-    // Set a padding length and announce it correctly.
-    void
-    SetPadding(uint8_t pad_len)
-    {
-        SetPadding(pad_len, pad_len);
-    }
-
-    // Set a padding length and allow to lie about its length.
-    void
-    SetPadding(uint8_t pad_len, uint8_t reported_pad_len)
-    {
-        pad_len_ = pad_len;
-        reported_pad_len_ = reported_pad_len;
-    }
-
-    void
-    SetClientRandomLength(uint16_t client_random_len)
-    {
-        client_random_len_ = client_random_len;
-    }
-
-    void
-    SetSendEscape(bool send_escape)
-    {
-        send_escape_ = send_escape;
-    }
-
-  protected:
-    virtual PacketFilter::Action
-    Filter(const DataBuffer& input, DataBuffer* output)
-    {
-        if (replaced_) {
-            return KEEP;
-        }
-
-        // Replace only the very first packet.
-        replaced_ = true;
-
-        // The SSLv2 client hello size.
-        size_t packet_len = SSL_HL_CLIENT_HELLO_HBYTES + (ciphers_.size() * 3) +
-                            client_random_len_ + pad_len_;
-
-        size_t idx = 0;
-        *output = input;
-        output->Allocate(packet_len);
-        output->Truncate(packet_len);
-
-        // Write record length.
-        if (pad_len_ > 0) {
-            size_t masked_len = 0x3fff & packet_len;
-            if (send_escape_) {
-                masked_len |= 0x4000;
-            }
-
-            idx = output->Write(idx, masked_len, 2);
-            idx = output->Write(idx, reported_pad_len_, 1);
-        } else {
-            PR_ASSERT(!send_escape_);
-            idx = output->Write(idx, 0x8000 | packet_len, 2);
-        }
-
-        // Remember header length.
-        size_t hdr_len = idx;
-
-        // Write client hello.
-        idx = output->Write(idx, SSL_MT_CLIENT_HELLO, 1);
-        idx = output->Write(idx, version_, 2);
-
-        // Cipher list length.
-        idx = output->Write(idx, (ciphers_.size() * 3), 2);
-
-        // Session ID length.
-        idx = output->Write(idx, static_cast<uint32_t>(0), 2);
-
-        // ClientRandom length.
-        idx = output->Write(idx, client_random_len_, 2);
-
-        // Cipher suites.
-        for (auto cipher : ciphers_) {
-            idx = output->Write(idx, static_cast<uint32_t>(cipher), 3);
-        }
-
-        // Challenge.
-        std::vector<uint8_t> challenge(client_random_len_);
-        PK11_GenerateRandom(challenge.data(), challenge.size());
-        idx = output->Write(idx, challenge.data(), challenge.size());
-
-        // Add padding if any.
-        if (pad_len_ > 0) {
-            std::vector<uint8_t> pad(pad_len_);
-            idx = output->Write(idx, pad.data(), pad.size());
-        }
-
-        // Update the client random so that the handshake succeeds.
-        SECStatus rv = SSLInt_UpdateSSLv2ClientRandom(client_->ssl_fd(),
-                                                      challenge.data(),
-                                                      challenge.size(),
-                                                      output->data() + hdr_len,
-                                                      output->len() - hdr_len);
-        EXPECT_EQ(SECSuccess, rv);
-
-        return CHANGE;
-    }
-
-  private:
-    bool replaced_;
-    TlsAgent* client_;
-    uint16_t version_;
-    uint8_t pad_len_;
-    uint8_t reported_pad_len_;
-    uint16_t client_random_len_;
-    std::vector<uint16_t> ciphers_;
-    bool send_escape_;
-};
-
-class SSLv2ClientHelloTestF : public TlsConnectTestBase
-{
-  public:
-    SSLv2ClientHelloTestF()
-      : TlsConnectTestBase(STREAM, 0), filter_(nullptr)
-    { }
-
-    SSLv2ClientHelloTestF(Mode mode, uint16_t version)
-      : TlsConnectTestBase(mode, version), filter_(nullptr)
-    { }
-
-    void
-    SetUp()
-    {
-        TlsConnectTestBase::SetUp();
-        filter_ = new SSLv2ClientHelloFilter(client_, version_);
-        client_->SetPacketFilter(filter_);
-    }
-
-    void
-    RequireSafeRenegotiation()
-    {
-        server_->EnsureTlsSetup();
-        SECStatus rv =
-            SSL_OptionSet(server_->ssl_fd(), SSL_REQUIRE_SAFE_NEGOTIATION, PR_TRUE);
-        EXPECT_EQ(rv, SECSuccess);
-    }
-
-    void
-    SetExpectedVersion(uint16_t version)
-    {
-        TlsConnectTestBase::SetExpectedVersion(version);
-        filter_->SetVersion(version);
-    }
-
-    void
-    SetAvailableCipherSuite(uint16_t cipher)
-    {
-        filter_->SetCipherSuites(std::vector<uint16_t>(1, cipher));
-    }
-
-    void
-    SetAvailableCipherSuites(const std::vector<uint16_t>& ciphers)
-    {
-        filter_->SetCipherSuites(ciphers);
-    }
-
-    void
-    SetPadding(uint8_t pad_len)
-    {
-        filter_->SetPadding(pad_len);
-    }
-
-    void
-    SetPadding(uint8_t pad_len, uint8_t reported_pad_len)
-    {
-        filter_->SetPadding(pad_len, reported_pad_len);
-    }
-
-    void
-    SetClientRandomLength(uint16_t client_random_len)
-    {
-        filter_->SetClientRandomLength(client_random_len);
-    }
-
-    void
-    SetSendEscape(bool send_escape)
-    {
-        filter_->SetSendEscape(send_escape);
-    }
-
-
-  private:
-    SSLv2ClientHelloFilter* filter_;
-};
-
-// Parameterized version of SSLv2ClientHelloTestF we can
-// use with TEST_P to test multiple TLS versions easily.
-class SSLv2ClientHelloTest : public SSLv2ClientHelloTestF,
-                             public ::testing::WithParamInterface<uint16_t>
-{
-  public:
-    SSLv2ClientHelloTest()
-      : SSLv2ClientHelloTestF(STREAM, GetParam())
-    { }
-};
-
-// Test negotiating TLS 1.0 - 1.2.
-TEST_P(SSLv2ClientHelloTest, Connect) {
-  SetAvailableCipherSuite(TLS_DHE_RSA_WITH_AES_128_CBC_SHA);
-  Connect();
-}
-
-// Test negotiating TLS 1.3.
-#ifdef NSS_ENABLE_TLS_1_3
-TEST_F(SSLv2ClientHelloTestF, Connect13) {
-  SetExpectedVersion(SSL_LIBRARY_VERSION_TLS_1_3);
-  client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_3,
-                           SSL_LIBRARY_VERSION_TLS_1_3);
-  server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_3,
-                           SSL_LIBRARY_VERSION_TLS_1_3);
-
-  std::vector<uint16_t> cipher_suites =
-    { TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 };
-  SetAvailableCipherSuites(cipher_suites);
-
-  ConnectExpectFail();
-  EXPECT_EQ(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, server_->error_code());
-}
-#endif
-
-// Test negotiating an EC suite.
-TEST_P(SSLv2ClientHelloTest, NegotiateECSuite) {
-  SetAvailableCipherSuite(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA);
-  Connect();
-}
-
-// Test negotiating TLS 1.0 - 1.2 with a padded client hello.
-TEST_P(SSLv2ClientHelloTest, AddPadding) {
-  SetAvailableCipherSuite(TLS_DHE_RSA_WITH_AES_128_CBC_SHA);
-  SetPadding(255);
-  Connect();
-}
-
-// Test that sending a security escape fails the handshake.
-TEST_P(SSLv2ClientHelloTest, SendSecurityEscape) {
-  SetAvailableCipherSuite(TLS_DHE_RSA_WITH_AES_128_CBC_SHA);
-
-  // Send a security escape.
-  SetSendEscape(true);
-
-  // Set a big padding so that the server fails instead of timing out.
-  SetPadding(255);
-
-  ConnectExpectFail();
-}
-
-// Invalid SSLv2 client hello padding must fail the handshake.
-TEST_P(SSLv2ClientHelloTest, AddErroneousPadding) {
-  SetAvailableCipherSuite(TLS_DHE_RSA_WITH_AES_128_CBC_SHA);
-
-  // Append 5 bytes of padding but say it's only 4.
-  SetPadding(5, 4);
-
-  ConnectExpectFail();
-  EXPECT_EQ(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, server_->error_code());
-}
-
-// Invalid SSLv2 client hello padding must fail the handshake.
-TEST_P(SSLv2ClientHelloTest, AddErroneousPadding2) {
-  SetAvailableCipherSuite(TLS_DHE_RSA_WITH_AES_128_CBC_SHA);
-
-  // Append 5 bytes of padding but say it's 6.
-  SetPadding(5, 6);
-
-  ConnectExpectFail();
-  EXPECT_EQ(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, server_->error_code());
-}
-
-// Wrong amount of bytes for the ClientRandom must fail the handshake.
-TEST_P(SSLv2ClientHelloTest, SmallClientRandom) {
-  SetAvailableCipherSuite(TLS_DHE_RSA_WITH_AES_128_CBC_SHA);
-
-  // Send a ClientRandom that's too small.
-  SetClientRandomLength(15);
-
-  ConnectExpectFail();
-  EXPECT_EQ(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, server_->error_code());
-}
-
-// Test sending the maximum accepted number of ClientRandom bytes.
-TEST_P(SSLv2ClientHelloTest, MaxClientRandom) {
-  SetAvailableCipherSuite(TLS_DHE_RSA_WITH_AES_128_CBC_SHA);
-  SetClientRandomLength(32);
-  Connect();
-}
-
-// Wrong amount of bytes for the ClientRandom must fail the handshake.
-TEST_P(SSLv2ClientHelloTest, BigClientRandom) {
-  SetAvailableCipherSuite(TLS_DHE_RSA_WITH_AES_128_CBC_SHA);
-
-  // Send a ClientRandom that's too big.
-  SetClientRandomLength(33);
-
-  ConnectExpectFail();
-  EXPECT_EQ(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO, server_->error_code());
-}
-
-// Connection must fail if we require safe renegotiation but the client doesn't
-// include TLS_EMPTY_RENEGOTIATION_INFO_SCSV in the list of cipher suites.
-TEST_P(SSLv2ClientHelloTest, RequireSafeRenegotiation) {
-  RequireSafeRenegotiation();
-  SetAvailableCipherSuite(TLS_DHE_RSA_WITH_AES_128_CBC_SHA);
-  ConnectExpectFail();
-  EXPECT_EQ(SSL_ERROR_UNSAFE_NEGOTIATION, server_->error_code());
-}
-
-// Connection must succeed when requiring safe renegotiation and the client
-// includes TLS_EMPTY_RENEGOTIATION_INFO_SCSV in the list of cipher suites.
-TEST_P(SSLv2ClientHelloTest, RequireSafeRenegotiationWithSCSV) {
-  RequireSafeRenegotiation();
-  std::vector<uint16_t> cipher_suites =
-    { TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV };
-  SetAvailableCipherSuites(cipher_suites);
-  Connect();
-}
-
-// Connect to the server with TLS 1.1, signalling that this is a fallback from
-// a higher version. As the server doesn't support anything higher than TLS 1.1
-// it must accept the connection.
-TEST_F(SSLv2ClientHelloTestF, FallbackSCSV) {
-  SetExpectedVersion(SSL_LIBRARY_VERSION_TLS_1_1);
-  client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
-                           SSL_LIBRARY_VERSION_TLS_1_1);
-  server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
-                           SSL_LIBRARY_VERSION_TLS_1_1);
-
-  std::vector<uint16_t> cipher_suites =
-    { TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_FALLBACK_SCSV };
-  SetAvailableCipherSuites(cipher_suites);
-  Connect();
-}
-
-// Connect to the server with TLS 1.1, signalling that this is a fallback from
-// a higher version. As the server supports TLS 1.2 though it must reject the
-// connection due to a possible downgrade attack.
-TEST_F(SSLv2ClientHelloTestF, InappropriateFallbackSCSV) {
-  SetExpectedVersion(SSL_LIBRARY_VERSION_TLS_1_1);
-  client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
-                           SSL_LIBRARY_VERSION_TLS_1_1);
-  server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
-                           SSL_LIBRARY_VERSION_TLS_1_2);
-
-  std::vector<uint16_t> cipher_suites =
-    { TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_FALLBACK_SCSV };
-  SetAvailableCipherSuites(cipher_suites);
-
-  ConnectExpectFail();
-  EXPECT_EQ(SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT, server_->error_code());
-}
-
-INSTANTIATE_TEST_CASE_P(VersionsStream10Pre13, SSLv2ClientHelloTest,
-                        TlsConnectTestBase::kTlsV10);
-INSTANTIATE_TEST_CASE_P(VersionsStreamPre13, SSLv2ClientHelloTest,
-                        TlsConnectTestBase::kTlsV11V12);
-
-}  // namespace nss_test
--- a/security/nss/external_tests/ssl_gtest/test_io.cc
+++ b/security/nss/external_tests/ssl_gtest/test_io.cc
@@ -438,18 +438,17 @@ void Poller::Cancel(Event event, DummyPr
 void Poller::SetTimer(uint32_t timer_ms, PollTarget *target, PollCallback cb,
                       Timer **timer) {
   Timer *t = new Timer(PR_Now() + timer_ms * 1000, target, cb);
   timers_.push(t);
   if (timer) *timer = t;
 }
 
 bool Poller::Poll() {
-  std::cerr << "Poll() waiters = " << waiters_.size()
-            << " timers = " << timers_.size() << std::endl;
+  std::cerr << "Poll() waiters = " << waiters_.size() << std::endl;
   PRIntervalTime timeout = PR_INTERVAL_NO_TIMEOUT;
   PRTime now = PR_Now();
   bool fired = false;
 
   // Figure out the timer for the select.
   if (!timers_.empty()) {
     Timer *first_timer = timers_.top();
     if (now >= first_timer->deadline_) {
--- a/security/nss/external_tests/ssl_gtest/tls_agent.cc
+++ b/security/nss/external_tests/ssl_gtest/tls_agent.cc
@@ -31,17 +31,16 @@ TlsAgent::TlsAgent(const std::string& na
     mode_(mode),
     kea_(kea),
     server_key_bits_(0),
     pr_fd_(nullptr),
     adapter_(nullptr),
     ssl_fd_(nullptr),
     role_(role),
     state_(STATE_INIT),
-    timer_handle_(nullptr),
     falsestart_enabled_(false),
     expected_version_(0),
     expected_cipher_suite_(0),
     expect_resumption_(false),
     can_falsestart_hook_called_(false),
     sni_hook_called_(false),
     auth_certificate_hook_called_(false),
     handshake_callback_called_(false),
@@ -59,19 +58,16 @@ TlsAgent::TlsAgent(const std::string& na
                                             &vrange_);
   EXPECT_EQ(SECSuccess, rv);
 }
 
 TlsAgent::~TlsAgent() {
   if (adapter_) {
     Poller::Instance()->Cancel(READABLE_EVENT, adapter_);
   }
-  if (timer_handle_) {
-    timer_handle_->Cancel();
-  }
 
   if (pr_fd_) {
     PR_Close(pr_fd_);
   }
 
   if (ssl_fd_) {
     PR_Close(ssl_fd_);
   }
@@ -413,21 +409,19 @@ void TlsAgent::CheckPreliminaryInfo() {
 // Check that all the expected callbacks have been called.
 void TlsAgent::CheckCallbacks() const {
   // If false start happens, the handshake is reported as being complete at the
   // point that false start happens.
   if (expect_resumption_ || !falsestart_enabled_) {
     EXPECT_TRUE(handshake_callback_called_);
   }
 
-  // These callbacks shouldn't fire if we are resuming, except on TLS 1.3.
+  // These callbacks shouldn't fire if we are resuming.
   if (role_ == SERVER) {
-    PRBool have_sni = SSLInt_ExtensionNegotiated(ssl_fd_, ssl_server_name_xtn);
-    EXPECT_EQ(((!expect_resumption_ && have_sni) ||
-               expected_version_ >= SSL_LIBRARY_VERSION_TLS_1_3), sni_hook_called_);
+    EXPECT_EQ(!expect_resumption_, sni_hook_called_);
   } else {
     EXPECT_EQ(!expect_resumption_, auth_certificate_hook_called_);
     // Note that this isn't unconditionally called, even with false start on.
     // But the callback is only skipped if a cipher that is ridiculously weak
     // (80 bits) is chosen.  Don't test that: plan to remove bad ciphers.
     EXPECT_EQ(falsestart_enabled_ && !expect_resumption_,
               can_falsestart_hook_called_);
   }
@@ -446,20 +440,16 @@ void TlsAgent::Connected() {
   // that the final values are correct.
   EXPECT_EQ(expected_version_, info_.protocolVersion);
   EXPECT_EQ(expected_cipher_suite_, info_.cipherSuite);
 
   rv = SSL_GetCipherSuiteInfo(info_.cipherSuite, &csinfo_, sizeof(csinfo_));
   EXPECT_EQ(SECSuccess, rv);
   EXPECT_EQ(sizeof(csinfo_), csinfo_.length);
 
-  if (expected_version_ >= SSL_LIBRARY_VERSION_TLS_1_3) {
-    PRInt32 cipherSuites = SSLInt_CountTls13CipherSpecs(ssl_fd_);
-    EXPECT_EQ(((mode_ == DGRAM) && (role_ == CLIENT)) ? 2 : 1, cipherSuites);
-  }
   SetState(STATE_CONNECTED);
 }
 
 void TlsAgent::EnableExtendedMasterSecret() {
   ASSERT_TRUE(EnsureTlsSetup());
 
   SECStatus rv = SSL_OptionSet(ssl_fd_,
                                SSL_ENABLE_EXTENDED_MASTER_SECRET,
@@ -496,47 +486,36 @@ void TlsAgent::EnableCompression() {
 void TlsAgent::SetDowngradeCheckVersion(uint16_t version) {
   ASSERT_TRUE(EnsureTlsSetup());
 
   SECStatus rv = SSL_SetDowngradeCheckVersion(ssl_fd_, version);
   ASSERT_EQ(SECSuccess, rv);
 }
 
 void TlsAgent::Handshake() {
-  LOG("Handshake");
   SECStatus rv = SSL_ForceHandshake(ssl_fd_);
   if (rv == SECSuccess) {
     Connected();
 
     Poller::Instance()->Wait(READABLE_EVENT, adapter_, this,
                              &TlsAgent::ReadableCallback);
     return;
   }
 
   int32_t err = PR_GetError();
   switch (err) {
     case PR_WOULD_BLOCK_ERROR:
       LOG("Would have blocked");
-      if (mode_ == DGRAM) {
-        if (timer_handle_) {
-          timer_handle_->Cancel();
-        }
-
-        PRIntervalTime timeout;
-        rv = DTLS_GetHandshakeTimeout(ssl_fd_, &timeout);
-        if (rv == SECSuccess) {
-          Poller::Instance()->SetTimer(timeout, this,
-                                       &TlsAgent::ReadableCallback,
-                                       &timer_handle_);
-        }
-      }
+      // TODO(ekr@rtfm.com): set DTLS timeouts
       Poller::Instance()->Wait(READABLE_EVENT, adapter_, this,
                                &TlsAgent::ReadableCallback);
       return;
+      break;
 
+      // TODO(ekr@rtfm.com): needs special case for DTLS
     case SSL_ERROR_RX_MALFORMED_HANDSHAKE:
     default:
       if (IS_SSL_ERROR(err)) {
         LOG("Handshake failed with SSL error " << (err - SSL_ERROR_BASE)
             << ": " << PORT_ErrorToString(err));
       } else {
         LOG("Handshake failed with error " << err
             << ": " << PORT_ErrorToString(err));
--- a/security/nss/external_tests/ssl_gtest/tls_agent.h
+++ b/security/nss/external_tests/ssl_gtest/tls_agent.h
@@ -107,18 +107,16 @@ class TlsAgent : public PollTarget {
   void ReadBytes();
   void ResetSentBytes(); // Hack to test drops.
   void EnableExtendedMasterSecret();
   void CheckExtendedMasterSecret(bool expected);
   void DisableRollbackDetection();
   void EnableCompression();
   void SetDowngradeCheckVersion(uint16_t version);
 
-  const std::string& name() const { return name_; }
-
   Role role() const { return role_; }
 
   State state() const { return state_; }
 
   SSLKEAType kea() const { return kea_; }
 
   const char* state_str() const { return state_str(state()); }
 
@@ -207,22 +205,20 @@ class TlsAgent : public PollTarget {
 
   static SECStatus GetClientAuthDataHook(void* self, PRFileDesc* fd,
                                          CERTDistNames* caNames,
                                          CERTCertificate** cert,
                                          SECKEYPrivateKey** privKey);
 
   static void ReadableCallback(PollTarget* self, Event event) {
     TlsAgent* agent = static_cast<TlsAgent*>(self);
-    if (event == TIMER_EVENT) {
-      agent->timer_handle_ = nullptr;
-    }
     agent->ReadableCallback_int();
   }
 
+
   void ReadableCallback_int() {
     LOG("Readable");
     switch (state_) {
       case STATE_CONNECTING:
         Handshake();
         break;
       case STATE_CONNECTED:
         ReadBytes();
@@ -233,18 +229,17 @@ class TlsAgent : public PollTarget {
   }
 
   static PRInt32 SniHook(PRFileDesc *fd, const SECItem *srvNameArr,
                          PRUint32 srvNameArrSize,
                          void *arg) {
     TlsAgent* agent = reinterpret_cast<TlsAgent*>(arg);
     agent->CheckPreliminaryInfo();
     agent->sni_hook_called_ = true;
-    EXPECT_EQ(1UL, srvNameArrSize);
-    return 0; // First configuration.
+    return SSL_SNI_CURRENT_CONFIG_IS_USED;
   }
 
   static SECStatus CanFalseStartCallback(PRFileDesc *fd, void *arg,
                                          PRBool *canFalseStart) {
     TlsAgent* agent = reinterpret_cast<TlsAgent*>(arg);
     agent->CheckPreliminaryInfo();
     EXPECT_TRUE(agent->falsestart_enabled_);
     EXPECT_FALSE(agent->can_falsestart_hook_called_);
@@ -269,17 +264,16 @@ class TlsAgent : public PollTarget {
   Mode mode_;
   SSLKEAType kea_;
   uint16_t server_key_bits_;
   PRFileDesc* pr_fd_;
   DummyPrSocket* adapter_;
   PRFileDesc* ssl_fd_;
   Role role_;
   State state_;
-  Poller::Timer *timer_handle_;
   bool falsestart_enabled_;
   uint16_t expected_version_;
   uint16_t expected_cipher_suite_;
   bool expect_resumption_;
   bool expect_client_auth_;
   bool can_falsestart_hook_called_;
   bool sni_hook_called_;
   bool auth_certificate_hook_called_;
--- a/security/nss/external_tests/ssl_gtest/tls_connect.cc
+++ b/security/nss/external_tests/ssl_gtest/tls_connect.cc
@@ -1,93 +1,48 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "tls_connect.h"
-extern "C" {
-#include "libssl_internals.h"
-}
 
 #include <iostream>
 
 #include "sslproto.h"
 #include "gtest_utils.h"
 
 extern std::string g_working_dir_path;
 
 namespace nss_test {
 
 static const std::string kTlsModesStreamArr[] = {"TLS"};
 ::testing::internal::ParamGenerator<std::string>
   TlsConnectTestBase::kTlsModesStream = ::testing::ValuesIn(kTlsModesStreamArr);
-static const std::string kTlsModesDatagramArr[] = {"DTLS"};
-::testing::internal::ParamGenerator<std::string>
-TlsConnectTestBase::kTlsModesDatagram =
-      ::testing::ValuesIn(kTlsModesDatagramArr);
 static const std::string kTlsModesAllArr[] = {"TLS", "DTLS"};
 ::testing::internal::ParamGenerator<std::string>
   TlsConnectTestBase::kTlsModesAll = ::testing::ValuesIn(kTlsModesAllArr);
-
 static const uint16_t kTlsV10Arr[] = {SSL_LIBRARY_VERSION_TLS_1_0};
 ::testing::internal::ParamGenerator<uint16_t>
   TlsConnectTestBase::kTlsV10 = ::testing::ValuesIn(kTlsV10Arr);
 static const uint16_t kTlsV11Arr[] = {SSL_LIBRARY_VERSION_TLS_1_1};
 ::testing::internal::ParamGenerator<uint16_t>
   TlsConnectTestBase::kTlsV11 = ::testing::ValuesIn(kTlsV11Arr);
-static const uint16_t kTlsV10V11Arr[] = {SSL_LIBRARY_VERSION_TLS_1_0,
-                                         SSL_LIBRARY_VERSION_TLS_1_1};
-::testing::internal::ParamGenerator<uint16_t>
-  TlsConnectTestBase::kTlsV10V11 = ::testing::ValuesIn(kTlsV10V11Arr);
-static const uint16_t kTlsV10To12Arr[] = {SSL_LIBRARY_VERSION_TLS_1_0,
-                                         SSL_LIBRARY_VERSION_TLS_1_1,
-                                         SSL_LIBRARY_VERSION_TLS_1_2};
-::testing::internal::ParamGenerator<uint16_t>
-  TlsConnectTestBase::kTlsV10To12 = ::testing::ValuesIn(kTlsV10To12Arr);
 static const uint16_t kTlsV11V12Arr[] = {SSL_LIBRARY_VERSION_TLS_1_1,
                                          SSL_LIBRARY_VERSION_TLS_1_2};
 ::testing::internal::ParamGenerator<uint16_t>
   TlsConnectTestBase::kTlsV11V12 = ::testing::ValuesIn(kTlsV11V12Arr);
-
-static const uint16_t kTlsV11PlusArr[] = {
-#ifdef NSS_ENABLE_TLS_1_3
-  SSL_LIBRARY_VERSION_TLS_1_3,
-#endif
-  SSL_LIBRARY_VERSION_TLS_1_2,
-  SSL_LIBRARY_VERSION_TLS_1_1
-};
-::testing::internal::ParamGenerator<uint16_t>
-  TlsConnectTestBase::kTlsV11Plus = ::testing::ValuesIn(kTlsV11PlusArr);
-static const uint16_t kTlsV12PlusArr[] = {
-#ifdef NSS_ENABLE_TLS_1_3
-  SSL_LIBRARY_VERSION_TLS_1_3,
-#endif
-  SSL_LIBRARY_VERSION_TLS_1_2
-};
+// TODO: add TLS 1.3
+static const uint16_t kTlsV12PlusArr[] = {SSL_LIBRARY_VERSION_TLS_1_2};
 ::testing::internal::ParamGenerator<uint16_t>
   TlsConnectTestBase::kTlsV12Plus = ::testing::ValuesIn(kTlsV12PlusArr);
-#ifdef NSS_ENABLE_TLS_1_3
-static const uint16_t kTlsV13Arr[] = {
-  SSL_LIBRARY_VERSION_TLS_1_3
-};
+static const uint16_t kTlsV13Arr[] = {SSL_LIBRARY_VERSION_TLS_1_3};
 ::testing::internal::ParamGenerator<uint16_t>
   TlsConnectTestBase::kTlsV13 = ::testing::ValuesIn(kTlsV13Arr);
-#endif
-static const uint16_t kTlsVAllArr[] = {
-#ifdef NSS_ENABLE_TLS_1_3
-  SSL_LIBRARY_VERSION_TLS_1_3,
-#endif
-  SSL_LIBRARY_VERSION_TLS_1_2,
-  SSL_LIBRARY_VERSION_TLS_1_1,
-  SSL_LIBRARY_VERSION_TLS_1_0
-};
-::testing::internal::ParamGenerator<uint16_t>
-  TlsConnectTestBase::kTlsVAll = ::testing::ValuesIn(kTlsVAllArr);
 
 static std::string VersionString(uint16_t version) {
   switch(version) {
   case 0:
     return "(no version)";
   case SSL_LIBRARY_VERSION_TLS_1_0:
     return "1.0";
   case SSL_LIBRARY_VERSION_TLS_1_1:
@@ -106,53 +61,38 @@ static std::string VersionString(uint16_
 TlsConnectTestBase::TlsConnectTestBase(Mode mode, uint16_t version)
       : mode_(mode),
         client_(new TlsAgent("client", TlsAgent::CLIENT, mode_, ssl_kea_rsa)),
         server_(new TlsAgent("server", TlsAgent::SERVER, mode_, ssl_kea_rsa)),
         version_(version),
         expected_resumption_mode_(RESUME_NONE),
         session_ids_(),
         expect_extended_master_secret_(false) {
-  std::string v;
-  if (mode_ == DGRAM && version_ == SSL_LIBRARY_VERSION_TLS_1_1) {
-    v = "1.0";
-  } else {
-    v = VersionString(version_);
-  }
-  std::cerr << "Version: " << mode_ << " " << v << std::endl;
+  std::cerr << "Version: " << mode_ << " " << VersionString(version_) << std::endl;
 }
 
 TlsConnectTestBase::~TlsConnectTestBase() {
 }
 
-void TlsConnectTestBase::ClearStats() {
+void TlsConnectTestBase::SetUp() {
+  // Configure a fresh session cache.
+  SSL_ConfigServerSessionIDCache(1024, 0, 0, g_working_dir_path.c_str());
+
   // Clear statistics.
   SSL3Statistics* stats = SSL_GetStatistics();
   memset(stats, 0, sizeof(*stats));
-}
 
-void TlsConnectTestBase::ClearServerCache() {
-  SSL_ShutdownServerSessionIDCache();
-  SSLInt_ClearSessionTicketKey();
-  SSL_ConfigServerSessionIDCache(1024, 0, 0, g_working_dir_path.c_str());
-}
-
-void TlsConnectTestBase::SetUp() {
-  SSL_ConfigServerSessionIDCache(1024, 0, 0, g_working_dir_path.c_str());
-  SSLInt_ClearSessionTicketKey();
-  ClearStats();
   Init();
 }
 
 void TlsConnectTestBase::TearDown() {
   delete client_;
   delete server_;
 
   SSL_ClearSessionCache();
-  SSLInt_ClearSessionTicketKey();
   SSL_ShutdownServerSessionIDCache();
 }
 
 void TlsConnectTestBase::Init() {
   EXPECT_TRUE(client_->Init());
   EXPECT_TRUE(server_->Init());
 
   client_->SetPeer(server_);
@@ -305,21 +245,18 @@ void TlsConnectTestBase::CheckResumption
 
   SSL3Statistics* stats = SSL_GetStatistics();
   EXPECT_EQ(resume_ct, stats->hch_sid_cache_hits);
   EXPECT_EQ(resume_ct, stats->hsh_sid_cache_hits);
 
   EXPECT_EQ(stateless_ct, stats->hch_sid_stateless_resumes);
   EXPECT_EQ(stateless_ct, stats->hsh_sid_stateless_resumes);
 
-  if (resume_ct &&
-      client_->version() < SSL_LIBRARY_VERSION_TLS_1_3) {
+  if (resume_ct) {
     // Check that the last two session ids match.
-    // TLS 1.3 doesn't do session id-based resumption. It's all
-    // tickets.
     EXPECT_EQ(2U, session_ids_.size());
     EXPECT_EQ(session_ids_[session_ids_.size()-1],
               session_ids_[session_ids_.size()-2]);
   }
 }
 
 void TlsConnectTestBase::EnableAlpn() {
   // A simple value of "a", "b".  Note that the preferred value of "a" is placed
--- a/security/nss/external_tests/ssl_gtest/tls_connect.h
+++ b/security/nss/external_tests/ssl_gtest/tls_connect.h
@@ -17,44 +17,35 @@
 #include "gtest/gtest.h"
 
 namespace nss_test {
 
 // A generic TLS connection test base.
 class TlsConnectTestBase : public ::testing::Test {
  public:
   static ::testing::internal::ParamGenerator<std::string> kTlsModesStream;
-  static ::testing::internal::ParamGenerator<std::string> kTlsModesDatagram;
   static ::testing::internal::ParamGenerator<std::string> kTlsModesAll;
   static ::testing::internal::ParamGenerator<uint16_t> kTlsV10;
   static ::testing::internal::ParamGenerator<uint16_t> kTlsV11;
-  static ::testing::internal::ParamGenerator<uint16_t> kTlsV10V11;
   static ::testing::internal::ParamGenerator<uint16_t> kTlsV11V12;
-  static ::testing::internal::ParamGenerator<uint16_t> kTlsV10To12;
+  static ::testing::internal::ParamGenerator<uint16_t> kTlsV12Plus;
   static ::testing::internal::ParamGenerator<uint16_t> kTlsV13;
-  static ::testing::internal::ParamGenerator<uint16_t> kTlsV11Plus;
-  static ::testing::internal::ParamGenerator<uint16_t> kTlsV12Plus;
-  static ::testing::internal::ParamGenerator<uint16_t> kTlsVAll;
 
   static inline Mode ToMode(const std::string& str) {
     return str == "TLS" ? STREAM : DGRAM;
   }
 
   TlsConnectTestBase(Mode mode, uint16_t version);
   virtual ~TlsConnectTestBase();
 
   void SetUp();
   void TearDown();
 
   // Initialize client and server.
   void Init();
-  // Clear the statistics.
-  void ClearStats();
-  // Clear the server session cache.
-  void ClearServerCache();
   // Re-initialize client and server with the default RSA cert.
   void ResetRsa();
   // Re-initialize client and server with an ECDSA cert on the server
   // and some ECDHE suites.
   void ResetEcdsa();
   // Make sure TLS is configured for a connection.
   void EnsureTlsSetup();
 
--- a/security/nss/external_tests/ssl_gtest/tls_filter.cc
+++ b/security/nss/external_tests/ssl_gtest/tls_filter.cc
@@ -1,16 +1,15 @@
 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "tls_filter.h"
-#include "sslproto.h"
 
 #include <iostream>
 #include "gtest_utils.h"
 
 namespace nss_test {
 
 PacketFilter::Action TlsRecordFilter::Filter(const DataBuffer& input, DataBuffer* output) {
   bool changed = false;
@@ -267,141 +266,9 @@ PacketFilter::Action ChainedPacketFilter
     if (action == CHANGE) {
       in = *output;
       changed = true;
     }
   }
   return changed ? CHANGE : KEEP;
 }
 
-PacketFilter::Action TlsExtensionFilter::FilterHandshake(
-    const HandshakeHeader& header,
-    const DataBuffer& input, DataBuffer* output) {
-  if (header.handshake_type() == kTlsHandshakeClientHello) {
-    TlsParser parser(input);
-    if (!FindClientHelloExtensions(&parser, header)) {
-      return KEEP;
-    }
-    return FilterExtensions(&parser, input, output);
-  }
-  if (header.handshake_type() == kTlsHandshakeServerHello) {
-    TlsParser parser(input);
-    if (!FindServerHelloExtensions(&parser, header.version())) {
-      return KEEP;
-    }
-    return FilterExtensions(&parser, input, output);
-  }
-  return KEEP;
-}
-
-bool TlsExtensionFilter::FindClientHelloExtensions(TlsParser* parser,
-                                                   const Versioned& header) {
-  if (!parser->Skip(2 + 32)) { // version + random
-    return false;
-  }
-  if (!parser->SkipVariable(1)) { // session ID
-    return false;
-  }
-  if (header.is_dtls() && !parser->SkipVariable(1)) { // DTLS cookie
-    return false;
-  }
-  if (!parser->SkipVariable(2)) { // cipher suites
-    return false;
-  }
-  if (!parser->SkipVariable(1)) { // compression methods
-    return false;
-  }
-  return true;
-}
-
-bool TlsExtensionFilter::FindServerHelloExtensions(TlsParser* parser,
-                                                   uint16_t version) {
-  if (!parser->Skip(2 + 32)) { // version + random
-    return false;
-  }
-  if (!parser->SkipVariable(1)) { // session ID
-    return false;
-  }
-  if (!parser->Skip(2)) { // cipher suite
-    return false;
-  }
-  if (NormalizeTlsVersion(version) <= SSL_LIBRARY_VERSION_TLS_1_2) {
-    if (!parser->Skip(1)) { // compression method
-      return false;
-    }
-  }
-  return true;
-}
-
-PacketFilter::Action TlsExtensionFilter::FilterExtensions(
-    TlsParser* parser, const DataBuffer& input, DataBuffer* output) {
-  size_t length_offset = parser->consumed();
-  uint32_t all_extensions;
-  if (!parser->Read(&all_extensions, 2)) {
-    return KEEP; // no extensions, odd but OK
-  }
-  if (all_extensions != parser->remaining()) {
-    return KEEP; // malformed
-  }
-
-  bool changed = false;
-
-  // Write out the start of the message.
-  output->Allocate(input.len());
-  size_t offset = output->Write(0, input.data(), parser->consumed());
-
-  while (parser->remaining()) {
-    uint32_t extension_type;
-    if (!parser->Read(&extension_type, 2)) {
-      return KEEP; // malformed
-    }
-
-    DataBuffer extension;
-    if (!parser->ReadVariable(&extension, 2)) {
-      return KEEP; // malformed
-    }
-
-    DataBuffer filtered;
-    PacketFilter::Action action = FilterExtension(extension_type, extension,
-                                                  &filtered);
-    if (action == DROP) {
-      changed = true;
-      std::cerr << "extension drop: " << extension << std::endl;
-      continue;
-    }
-
-    const DataBuffer* source = &extension;
-    if (action == CHANGE) {
-      EXPECT_GT(0x10000U, filtered.len());
-      changed = true;
-      std::cerr << "extension old: " << extension << std::endl;
-      std::cerr << "extension new: " << filtered << std::endl;
-      source = &filtered;
-    }
-
-    // Write out extension.
-    offset = output->Write(offset, extension_type, 2);
-    offset = output->Write(offset, source->len(), 2);
-    offset = output->Write(offset, *source);
-  }
-  output->Truncate(offset);
-
-  if (changed) {
-    size_t newlen = output->len() - length_offset - 2;
-    EXPECT_GT(0x10000U, newlen);
-    if (newlen >= 0x10000) {
-      return KEEP; // bad: size increased too much
-    }
-    output->Write(length_offset, newlen, 2);
-    return CHANGE;
-  }
-  return KEEP;
-}
-
-PacketFilter::Action TlsExtensionCapture::FilterExtension(
-    uint16_t extension_type, const DataBuffer& input, DataBuffer* output) {
-  if (extension_type == extension_) {
-    data_.Assign(input);
-  }
-  return KEEP;
-}
-
 }  // namespace nss_test
--- a/security/nss/external_tests/ssl_gtest/tls_filter.h
+++ b/security/nss/external_tests/ssl_gtest/tls_filter.h
@@ -176,46 +176,11 @@ class ChainedPacketFilter : public Packe
   void Add(PacketFilter* filter) {
     filters_.push_back(filter);
   }
 
  private:
   std::vector<PacketFilter*> filters_;
 };
 
-class TlsExtensionFilter : public TlsHandshakeFilter {
- protected:
-  virtual PacketFilter::Action FilterHandshake(
-      const HandshakeHeader& header,
-      const DataBuffer& input, DataBuffer* output);
-
-  virtual PacketFilter::Action FilterExtension(uint16_t extension_type,
-                                               const DataBuffer& input,
-                                               DataBuffer* output) = 0;
-
- public:
-  static bool FindClientHelloExtensions(TlsParser* parser,
-                                        const Versioned& header);
-  static bool FindServerHelloExtensions(TlsParser* parser, uint16_t version);
-
- private:
-  PacketFilter::Action FilterExtensions(TlsParser* parser,
-                                        const DataBuffer& input,
-                                        DataBuffer* output);
-};
-
-class TlsExtensionCapture : public TlsExtensionFilter {
- public:
-  TlsExtensionCapture(uint16_t ext)
-      : extension_(ext), data_() {}
-
-  virtual PacketFilter::Action FilterExtension(
-      uint16_t extension_type, const DataBuffer& input, DataBuffer* output);
-  const DataBuffer& extension() const { return data_; }
-
- private:
-  const uint16_t extension_;
-  DataBuffer data_;
-};
-
 }  // namespace nss_test
 
 #endif
--- a/security/nss/external_tests/ssl_gtest/tls_parser.h
+++ b/security/nss/external_tests/ssl_gtest/tls_parser.h
@@ -37,18 +37,16 @@ const uint8_t kTlsAlertFatal = 2;
 const uint8_t kTlsAlertUnexpectedMessage = 10;
 const uint8_t kTlsAlertBadRecordMac = 20;
 const uint8_t kTlsAlertHandshakeFailure = 40;
 const uint8_t kTlsAlertIllegalParameter = 47;
 const uint8_t kTlsAlertDecodeError = 50;
 const uint8_t kTlsAlertUnsupportedExtension = 110;
 const uint8_t kTlsAlertNoApplicationProtocol = 120;
 
-const uint8_t kTlsExtensionPreSharedKey = 41;
-
 const uint8_t kTlsFakeChangeCipherSpec[] = {
     kTlsChangeCipherSpecType,        // Type
     0xfe,                     0xff,  // Version
     0x00,                     0x00, 0x00, 0x00,
     0x00,                     0x00, 0x00, 0x10,  // Fictitious sequence #
     0x00,                     0x01,              // Length
     0x01                                         // Value
 };
deleted file mode 100644
--- a/security/nss/external_tests/util_gtest/Makefile
+++ /dev/null
@@ -1,45 +0,0 @@
-#! gmake
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-#######################################################################
-# (1) Include initial platform-independent assignments (MANDATORY).   #
-#######################################################################
-
-include manifest.mn
-
-#######################################################################
-# (2) Include "global" configuration information. (OPTIONAL)          #
-#######################################################################
-
-include $(CORE_DEPTH)/coreconf/config.mk
-
-#######################################################################
-# (3) Include "component" configuration information. (OPTIONAL)       #
-#######################################################################
-
-
-#######################################################################
-# (4) Include "local" platform-dependent assignments (OPTIONAL).      #
-#######################################################################
-
-include ../common/gtest.mk
-
-CFLAGS += -I$(CORE_DEPTH)/lib/util
-
-#######################################################################
-# (5) Execute "global" rules. (OPTIONAL)                              #
-#######################################################################
-
-include $(CORE_DEPTH)/coreconf/rules.mk
-
-#######################################################################
-# (6) Execute "component" rules. (OPTIONAL)                           #
-#######################################################################
-
-
-#######################################################################
-# (7) Execute "local" rules. (OPTIONAL).                              #
-#######################################################################
deleted file mode 100644
--- a/security/nss/external_tests/util_gtest/manifest.mn
+++ /dev/null
@@ -1,25 +0,0 @@
-# -*- makefile -*-
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-CORE_DEPTH = ../..
-DEPTH      = ../..
-MODULE = nss
-
-CPPSRCS = \
-	util_gtest.cc \
-	util_utf8_unittest.cc \
-	$(NULL)
-
-INCLUDES += \
-	-I$(CORE_DEPTH)/external_tests/google_test/gtest/include \
-	-I$(CORE_DEPTH)/external_tests/common \
-	$(NULL)
-
-REQUIRES = nspr gtest
-
-PROGRAM = util_gtest
-EXTRA_LIBS = \
-	$(DIST)/lib/$(LIB_PREFIX)gtest.$(LIB_SUFFIX) \
-	$(DIST)/lib/$(LIB_PREFIX)nssutil.$(LIB_SUFFIX) \
-	$(NULL)
deleted file mode 100644
--- a/security/nss/external_tests/util_gtest/util_gtest.cc
+++ /dev/null
@@ -1,9 +0,0 @@
-#define GTEST_HAS_RTTI 0
-#include "gtest/gtest.h"
-
-int main(int argc, char **argv) {
-  // Start the tests
-  ::testing::InitGoogleTest(&argc, argv);
-
-  return RUN_ALL_TESTS();
-}
deleted file mode 100644
--- a/security/nss/external_tests/util_gtest/util_utf8_unittest.cc
+++ /dev/null
@@ -1,1057 +0,0 @@
-// -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
-// vim: set ts=2 et sw=2 tw=80:
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this file,
-// You can obtain one at http://mozilla.org/MPL/2.0/.
-
-#include "secport.h"
-
-#include "gtest/gtest.h"
-#include "prnetdb.h"
-
-#include <stdint.h>
-#include <string>
-#include <string.h>
-
-namespace nss_test {
-
-// Structures to represent test cases.  These are small enough that
-// passing by value isn't a problem.
-
-struct Ucs4Case {
-  PRUint32 c;
-  const char *utf8;
-};
-
-struct Ucs2Case {
-  PRUint16 c;
-  const char *utf8;
-};
-
-struct Utf16Case {
-  PRUint32 c;
-  PRUint16 w[2];
-};
-
-struct Utf16BadCase {
-  PRUint16 w[3];
-};
-
-// Test classes for parameterized tests:
-
-class Ucs4Test : public ::testing::TestWithParam<Ucs4Case> {
-};
-
-class Ucs2Test : public ::testing::TestWithParam<Ucs2Case> {
-};
-
-class Utf16Test : public ::testing::TestWithParam<Utf16Case> {
-};
-
-class BadUtf8Test : public ::testing::TestWithParam<const char *> {
-};
-
-class BadUtf16Test : public ::testing::TestWithParam<Utf16BadCase> {
-};
-
-class Iso88591Test : public ::testing::TestWithParam<Ucs2Case> {
-};
-
-// Tests of sec_port_ucs4_utf8_conversion_function, by itself, on
-// valid inputs:
-
-TEST_P(Ucs4Test, ToUtf8) {
-  const Ucs4Case testCase = GetParam();
-  PRUint32 nc = PR_htonl(testCase.c);
-  unsigned char utf8[8] = {0};
-  unsigned int len = 0;
-
-  PRBool result = sec_port_ucs4_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)&nc, sizeof(nc), utf8, sizeof(utf8), &len);
-
-  ASSERT_TRUE(result);
-  ASSERT_LT(len, sizeof(utf8));
-  EXPECT_EQ(std::string(testCase.utf8), std::string((char *)utf8, len));
-  EXPECT_EQ('\0', utf8[len]);
-}
-
-TEST_P(Ucs4Test, FromUtf8) {
-  const Ucs4Case testCase = GetParam();
-  PRUint32 nc;
-  unsigned int len = 0;
-
-  PRBool result = sec_port_ucs4_utf8_conversion_function(PR_TRUE,
-    (unsigned char *)testCase.utf8, strlen(testCase.utf8),
-    (unsigned char *)&nc, sizeof(nc), &len);
-
-  ASSERT_TRUE(result);
-  ASSERT_EQ(sizeof(nc), len);
-  EXPECT_EQ(testCase.c, PR_ntohl(nc));
-}
-
-TEST_P(Ucs4Test, DestTooSmall) {
-  const Ucs4Case testCase = GetParam();
-  PRUint32 nc = PR_htonl(testCase.c);
-  unsigned char utf8[8];
-  unsigned char *utf8end = utf8 + sizeof(utf8);
-  unsigned int len = strlen(testCase.utf8) - 1;
-
-  ASSERT_LE(len, sizeof(utf8));
-
-  PRBool result = sec_port_ucs4_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)&nc, sizeof(nc), utf8end - len, len, &len);
-
-  ASSERT_FALSE(result);
-  ASSERT_EQ(strlen(testCase.utf8), len);
-}
-
-// Tests of sec_port_ucs2_utf8_conversion_function, by itself, on
-// valid inputs:
-
-TEST_P(Ucs2Test, ToUtf8) {
-  const Ucs2Case testCase = GetParam();
-  PRUint16 nc = PR_htons(testCase.c);
-  unsigned char utf8[8] = {0};
-  unsigned int len = 0;
-
-  PRBool result = sec_port_ucs2_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)&nc, sizeof(nc), utf8, sizeof(utf8), &len);
-
-  ASSERT_TRUE(result);
-  ASSERT_LT(len, sizeof(utf8));
-  EXPECT_EQ(std::string(testCase.utf8), std::string((char *)utf8, len));
-  EXPECT_EQ('\0', utf8[len]);
-}
-
-TEST_P(Ucs2Test, FromUtf8) {
-  const Ucs2Case testCase = GetParam();
-  PRUint16 nc;
-  unsigned int len = 0;
-
-  PRBool result = sec_port_ucs2_utf8_conversion_function(PR_TRUE,
-    (unsigned char *)testCase.utf8, strlen(testCase.utf8),
-    (unsigned char *)&nc, sizeof(nc), &len);
-
-  ASSERT_EQ(PR_TRUE, result);
-  ASSERT_EQ(sizeof(nc), len);
-  EXPECT_EQ(testCase.c, PR_ntohs(nc));
-}
-
-TEST_P(Ucs2Test, DestTooSmall) {
-  const Ucs2Case testCase = GetParam();
-  PRUint16 nc = PR_htons(testCase.c);
-  unsigned char utf8[8];
-  unsigned char *utf8end = utf8 + sizeof(utf8);
-  unsigned int len = strlen(testCase.utf8) - 1;
-
-  ASSERT_LE(len, sizeof(utf8));
-
-  PRBool result = sec_port_ucs2_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)&nc, sizeof(nc), utf8end - len, len, &len);
-
-  ASSERT_EQ(result, PR_FALSE);
-  ASSERT_EQ(strlen(testCase.utf8), len);
-}
-
-// Tests using UTF-16 and UCS-4 conversion together:
-
-TEST_P(Utf16Test, From16To32) {
-  const Utf16Case testCase = GetParam();
-  PRUint16 from[2] = { PR_htons(testCase.w[0]), PR_htons(testCase.w[1]) };
-  PRUint32 to;
-  unsigned char utf8[8];
-  unsigned int len = 0;
-
-  PRBool result = sec_port_ucs2_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)&from, sizeof(from), utf8, sizeof(utf8), &len);
-
-  ASSERT_EQ(PR_TRUE, result);
-
-  result = sec_port_ucs4_utf8_conversion_function(PR_TRUE,
-    utf8, len, (unsigned char *)&to, sizeof(to), &len);
-
-  ASSERT_EQ(PR_TRUE, result);
-  ASSERT_EQ(sizeof(to), len);
-  EXPECT_EQ(testCase.c, PR_ntohl(to));
-}
-
-TEST_P(Utf16Test, From32To16) {
-  const Utf16Case testCase = GetParam();
-  PRUint32 from = PR_htonl(testCase.c);
-  unsigned char utf8[8];
-  unsigned int len = 0;
-
-  PRBool result = sec_port_ucs4_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)&from, sizeof(from), utf8, sizeof(utf8), &len);
-
-  ASSERT_EQ(PR_TRUE, result);
-  const std::string utf8copy((char *)utf8, len);
-  PRUint16 to[2];
-
-  result = sec_port_ucs2_utf8_conversion_function(PR_TRUE,
-    utf8, len, (unsigned char *)&to, sizeof(to), &len);
-
-  ASSERT_EQ(PR_TRUE, result);
-  ASSERT_EQ(sizeof(to), len);
-  EXPECT_EQ(testCase.w[0], PR_ntohs(to[0]));
-  EXPECT_EQ(testCase.w[1], PR_ntohs(to[1]));
-}
-
-TEST_P(Utf16Test, SameUtf8) {
-  const Utf16Case testCase = GetParam();
-  PRUint32 from32 = PR_htonl(testCase.c);
-  unsigned char utf8from32[8];
-  unsigned int lenFrom32 = 0;
-
-  PRBool result = sec_port_ucs4_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)&from32, sizeof(from32), utf8from32, sizeof(utf8from32),
-    &lenFrom32);
-
-  ASSERT_TRUE(result);
-  ASSERT_LE(lenFrom32, sizeof(utf8from32));
-
-  PRUint16 from16[2] = { PR_htons(testCase.w[0]), PR_htons(testCase.w[1]) };
-  unsigned char utf8from16[8];
-  unsigned int lenFrom16 = 0;
-
-  result = sec_port_ucs2_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)&from16, sizeof(from16), utf8from16, sizeof(utf8from16),
-    &lenFrom16);
-
-  ASSERT_TRUE(result);
-  ASSERT_LE(lenFrom16, sizeof(utf8from16));
-
-  EXPECT_EQ(std::string((char *)utf8from32, lenFrom32),
-            std::string((char *)utf8from16, lenFrom16));
-}
-
-// Tests of invalid UTF-8 input:
-
-TEST_P(BadUtf8Test, HasNoUcs2) {
-  const char *const utf8 = GetParam();
-  unsigned char destBuf[30];
-  unsigned int len = 0;
-
-  PRBool result = sec_port_ucs2_utf8_conversion_function(PR_TRUE,
-    (unsigned char *)utf8, strlen(utf8), destBuf, sizeof(destBuf), &len);
-
-  EXPECT_FALSE(result);
-}
-
-TEST_P(BadUtf8Test, HasNoUcs4) {
-  const char *const utf8 = GetParam();
-  unsigned char destBuf[30];
-  unsigned int len = 0;
-
-  PRBool result = sec_port_ucs4_utf8_conversion_function(PR_TRUE,
-    (unsigned char *)utf8, strlen(utf8), destBuf, sizeof(destBuf), &len);
-
-  EXPECT_FALSE(result);
-}
-
-// Tests of invalid UTF-16 input:
-
-TEST_P(BadUtf16Test, HasNoUtf8) {
-  const Utf16BadCase testCase = GetParam();
-  Utf16BadCase srcBuf;
-  unsigned int len;
-  static const size_t maxLen = PR_ARRAY_SIZE(srcBuf.w);
-
-  size_t srcLen = 0;
-  while (testCase.w[srcLen] != 0) {
-    srcBuf.w[srcLen] = PR_htons(testCase.w[srcLen]);
-    srcLen++;
-    ASSERT_LT(srcLen, maxLen);
-  }
-
-  unsigned char destBuf[18];
-  PRBool result = sec_port_ucs2_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)srcBuf.w, srcLen * sizeof(PRUint16),
-    destBuf, sizeof(destBuf), &len);
-
-  EXPECT_FALSE(result);
-}
-
-// Tests of sec_port_iso88591_utf8_conversion_function on valid inputs:
-
-TEST_P(Iso88591Test, ToUtf8) {
-  const Ucs2Case testCase = GetParam();
-  unsigned char iso88591 = testCase.c;
-  unsigned char utf8[3] = {0};
-  unsigned int len = 0;
-
-  ASSERT_EQ(testCase.c, (PRUint16)iso88591);
-
-  PRBool result = sec_port_iso88591_utf8_conversion_function(&iso88591,
-    1, utf8, sizeof(utf8), &len);
-
-  ASSERT_TRUE(result);
-  ASSERT_LT(len, sizeof(utf8));
-  EXPECT_EQ(std::string(testCase.utf8), std::string((char *)utf8, len));
-  EXPECT_EQ(0U, utf8[len]);
-}
-
-// Tests for the various representations of NUL (which the above
-// NUL-terminated test cases omitted):
-
-TEST(Utf8Zeroes, From32To8) {
-  unsigned int len;
-  PRUint32 from = 0;
-  unsigned char to;
-
-  PRBool result = sec_port_ucs4_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)&from, sizeof(from), &to, sizeof(to), &len);
-
-  ASSERT_TRUE(result);
-  ASSERT_EQ(sizeof(to), len);
-  EXPECT_EQ(0U, to);
-}
-
-TEST(Utf8Zeroes, From16To8) {
-  unsigned int len;
-  PRUint16 from = 0;
-  unsigned char to;
-
-  PRBool result = sec_port_ucs2_utf8_conversion_function(PR_FALSE,
-    (unsigned char *)&from, sizeof(from), &to, sizeof(to), &len);
-
-  ASSERT_TRUE(result);
-  ASSERT_EQ(sizeof(to), len);
-  EXPECT_EQ(0U, to);
-}
-
-TEST(Utf8Zeroes, From8To32) {
-  unsigned int len;
-  unsigned char from = 0;
-  PRUint32 to;
-
-  PRBool result = sec_port_ucs4_utf8_conversion_function(PR_TRUE,
-    &from, sizeof(from), (unsigned char *)&to, sizeof(to), &len);
-
-  ASSERT_TRUE(result);
-  ASSERT_EQ(sizeof(to), len);
-  EXPECT_EQ(0U, to);
-}
-
-TEST(Utf8Zeroes, From8To16) {
-  unsigned int len;
-  unsigned char from = 0;
-  PRUint16 to;
-
-  PRBool result = sec_port_ucs2_utf8_conversion_function(PR_TRUE,
-    &from, sizeof(from), (unsigned char *)&to, sizeof(to), &len);
-
-  ASSERT_TRUE(result);
-  ASSERT_EQ(sizeof(to), len);
-  EXPECT_EQ(0U, to);
-}
-
-// UCS-4 <-> UTF-8 cases
-
-const Ucs4Case kUcs4Cases[] = {
-  { 0x00000001, "\x01" },
-  { 0x00000002, "\x02" },
-  { 0x00000003, "\x03" },
-  { 0x00000004, "\x04" },
-  { 0x00000007, "\x07" },
-  { 0x00000008, "\x08" },
-  { 0x0000000F, "\x0F" },
-  { 0x00000010, "\x10" },
-  { 0x0000001F, "\x1F" },
-  { 0x00000020, "\x20" },
-  { 0x0000003F, "\x3F" },
-  { 0x00000040, "\x40" },
-  { 0x0000007F, "\x7F" },
-
-  { 0x00000080, "\xC2\x80" },
-  { 0x00000081, "\xC2\x81" },
-  { 0x00000082, "\xC2\x82" },
-  { 0x00000084, "\xC2\x84" },
-  { 0x00000088, "\xC2\x88" },
-  { 0x00000090, "\xC2\x90" },
-  { 0x000000A0, "\xC2\xA0" },
-  { 0x000000C0, "\xC3\x80" },
-  { 0x000000FF, "\xC3\xBF" },
-  { 0x00000100, "\xC4\x80" },
-  { 0x00000101, "\xC4\x81" },
-  { 0x00000102, "\xC4\x82" },
-  { 0x00000104, "\xC4\x84" },
-  { 0x00000108, "\xC4\x88" },
-  { 0x00000110, "\xC4\x90" },
-  { 0x00000120, "\xC4\xA0" },
-  { 0x00000140, "\xC5\x80" },
-  { 0x00000180, "\xC6\x80" },
-  { 0x000001FF, "\xC7\xBF" },
-  { 0x00000200, "\xC8\x80" },
-  { 0x00000201, "\xC8\x81" },
-  { 0x00000202, "\xC8\x82" },
-  { 0x00000204, "\xC8\x84" },
-  { 0x00000208, "\xC8\x88" },
-  { 0x00000210, "\xC8\x90" },
-  { 0x00000220, "\xC8\xA0" },
-  { 0x00000240, "\xC9\x80" },
-  { 0x00000280, "\xCA\x80" },
-  { 0x00000300, "\xCC\x80" },
-  { 0x000003FF, "\xCF\xBF" },
-  { 0x00000400, "\xD0\x80" },
-  { 0x00000401, "\xD0\x81" },
-  { 0x00000402, "\xD0\x82" },
-  { 0x00000404, "\xD0\x84" },
-  { 0x00000408, "\xD0\x88" },
-  { 0x00000410, "\xD0\x90" },
-  { 0x00000420, "\xD0\xA0" },
-  { 0x00000440, "\xD1\x80" },
-  { 0x00000480, "\xD2\x80" },
-  { 0x00000500, "\xD4\x80" },
-  { 0x00000600, "\xD8\x80" },
-  { 0x000007FF, "\xDF\xBF" },
-
-  { 0x00000800, "\xE0\xA0\x80" },
-  { 0x00000801, "\xE0\xA0\x81" },
-  { 0x00000802, "\xE0\xA0\x82" },
-  { 0x00000804, "\xE0\xA0\x84" },
-  { 0x00000808, "\xE0\xA0\x88" },
-  { 0x00000810, "\xE0\xA0\x90" },
-  { 0x00000820, "\xE0\xA0\xA0" },
-  { 0x00000840, "\xE0\xA1\x80" },
-  { 0x00000880, "\xE0\xA2\x80" },
-  { 0x00000900, "\xE0\xA4\x80" },
-  { 0x00000A00, "\xE0\xA8\x80" },
-  { 0x00000C00, "\xE0\xB0\x80" },
-  { 0x00000FFF, "\xE0\xBF\xBF" },
-  { 0x00001000, "\xE1\x80\x80" },
-  { 0x00001001, "\xE1\x80\x81" },
-  { 0x00001002, "\xE1\x80\x82" },
-  { 0x00001004, "\xE1\x80\x84" },
-  { 0x00001008, "\xE1\x80\x88" },
-  { 0x00001010, "\xE1\x80\x90" },
-  { 0x00001020, "\xE1\x80\xA0" },
-  { 0x00001040, "\xE1\x81\x80" },
-  { 0x00001080, "\xE1\x82\x80" },
-  { 0x00001100, "\xE1\x84\x80" },
-  { 0x00001200, "\xE1\x88\x80" },
-  { 0x00001400, "\xE1\x90\x80" },
-  { 0x00001800, "\xE1\xA0\x80" },
-  { 0x00001FFF, "\xE1\xBF\xBF" },
-  { 0x00002000, "\xE2\x80\x80" },
-  { 0x00002001, "\xE2\x80\x81" },
-  { 0x00002002, "\xE2\x80\x82" },
-  { 0x00002004, "\xE2\x80\x84" },
-  { 0x00002008, "\xE2\x80\x88" },
-  { 0x00002010, "\xE2\x80\x90" },
-  { 0x00002020, "\xE2\x80\xA0" },
-  { 0x00002040, "\xE2\x81\x80" },
-  { 0x00002080, "\xE2\x82\x80" },
-  { 0x00002100, "\xE2\x84\x80" },
-  { 0x00002200, "\xE2\x88\x80" },
-  { 0x00002400, "\xE2\x90\x80" },
-  { 0x00002800, "\xE2\xA0\x80" },
-  { 0x00003000, "\xE3\x80\x80" },
-  { 0x00003FFF, "\xE3\xBF\xBF" },
-  { 0x00004000, "\xE4\x80\x80" },
-  { 0x00004001, "\xE4\x80\x81" },
-  { 0x00004002, "\xE4\x80\x82" },
-  { 0x00004004, "\xE4\x80\x84" },
-  { 0x00004008, "\xE4\x80\x88" },
-  { 0x00004010, "\xE4\x80\x90" },
-  { 0x00004020, "\xE4\x80\xA0" },
-  { 0x00004040, "\xE4\x81\x80" },
-  { 0x00004080, "\xE4\x82\x80" },
-  { 0x00004100, "\xE4\x84\x80" },
-  { 0x00004200, "\xE4\x88\x80" },
-  { 0x00004400, "\xE4\x90\x80" },
-  { 0x00004800, "\xE4\xA0\x80" },
-  { 0x00005000, "\xE5\x80\x80" },
-  { 0x00006000, "\xE6\x80\x80" },
-  { 0x00007FFF, "\xE7\xBF\xBF" },
-  { 0x00008000, "\xE8\x80\x80" },
-  { 0x00008001, "\xE8\x80\x81" },
-  { 0x00008002, "\xE8\x80\x82" },
-  { 0x00008004, "\xE8\x80\x84" },
-  { 0x00008008, "\xE8\x80\x88" },
-  { 0x00008010, "\xE8\x80\x90" },
-  { 0x00008020, "\xE8\x80\xA0" },
-  { 0x00008040, "\xE8\x81\x80" },
-  { 0x00008080, "\xE8\x82\x80" },
-  { 0x00008100, "\xE8\x84\x80" },
-  { 0x00008200, "\xE8\x88\x80" },
-  { 0x00008400, "\xE8\x90\x80" },
-  { 0x00008800, "\xE8\xA0\x80" },
-  { 0x00009000, "\xE9\x80\x80" },
-  { 0x0000A000, "\xEA\x80\x80" },
-  { 0x0000C000, "\xEC\x80\x80" },
-  { 0x0000FFFF, "\xEF\xBF\xBF" },
-
-  { 0x00010000, "\xF0\x90\x80\x80" },
-  { 0x00010001, "\xF0\x90\x80\x81" },
-  { 0x00010002, "\xF0\x90\x80\x82" },
-  { 0x00010004, "\xF0\x90\x80\x84" },
-  { 0x00010008, "\xF0\x90\x80\x88" },
-  { 0x00010010, "\xF0\x90\x80\x90" },
-  { 0x00010020, "\xF0\x90\x80\xA0" },
-  { 0x00010040, "\xF0\x90\x81\x80" },
-  { 0x00010080, "\xF0\x90\x82\x80" },
-  { 0x00010100, "\xF0\x90\x84\x80" },
-  { 0x00010200, "\xF0\x90\x88\x80" },
-  { 0x00010400, "\xF0\x90\x90\x80" },
-  { 0x00010800, "\xF0\x90\xA0\x80" },
-  { 0x00011000, "\xF0\x91\x80\x80" },
-  { 0x00012000, "\xF0\x92\x80\x80" },
-  { 0x00014000, "\xF0\x94\x80\x80" },
-  { 0x00018000, "\xF0\x98\x80\x80" },
-  { 0x0001FFFF, "\xF0\x9F\xBF\xBF" },
-  { 0x00020000, "\xF0\xA0\x80\x80" },
-  { 0x00020001, "\xF0\xA0\x80\x81" },
-  { 0x00020002, "\xF0\xA0\x80\x82" },
-  { 0x00020004, "\xF0\xA0\x80\x84" },
-  { 0x00020008, "\xF0\xA0\x80\x88" },
-  { 0x00020010, "\xF0\xA0\x80\x90" },
-  { 0x00020020, "\xF0\xA0\x80\xA0" },
-  { 0x00020040, "\xF0\xA0\x81\x80" },
-  { 0x00020080, "\xF0\xA0\x82\x80" },
-  { 0x00020100, "\xF0\xA0\x84\x80" },
-  { 0x00020200, "\xF0\xA0\x88\x80" },
-  { 0x00020400, "\xF0\xA0\x90\x80" },
-  { 0x00020800, "\xF0\xA0\xA0\x80" },
-  { 0x00021000, "\xF0\xA1\x80\x80" },
-  { 0x00022000, "\xF0\xA2\x80\x80" },
-  { 0x00024000, "\xF0\xA4\x80\x80" },
-  { 0x00028000, "\xF0\xA8\x80\x80" },
-  { 0x00030000, "\xF0\xB0\x80\x80" },
-  { 0x0003FFFF, "\xF0\xBF\xBF\xBF" },
-  { 0x00040000, "\xF1\x80\x80\x80" },
-  { 0x00040001, "\xF1\x80\x80\x81" },
-  { 0x00040002, "\xF1\x80\x80\x82" },
-  { 0x00040004, "\xF1\x80\x80\x84" },
-  { 0x00040008, "\xF1\x80\x80\x88" },
-  { 0x00040010, "\xF1\x80\x80\x90" },
-  { 0x00040020, "\xF1\x80\x80\xA0" },
-  { 0x00040040, "\xF1\x80\x81\x80" },
-  { 0x00040080, "\xF1\x80\x82\x80" },
-  { 0x00040100, "\xF1\x80\x84\x80" },
-  { 0x00040200, "\xF1\x80\x88\x80" },
-  { 0x00040400, "\xF1\x80\x90\x80" },
-  { 0x00040800, "\xF1\x80\xA0\x80" },
-  { 0x00041000, "\xF1\x81\x80\x80" },
-  { 0x00042000, "\xF1\x82\x80\x80" },
-  { 0x00044000, "\xF1\x84\x80\x80" },
-  { 0x00048000, "\xF1\x88\x80\x80" },
-  { 0x00050000, "\xF1\x90\x80\x80" },
-  { 0x00060000, "\xF1\xA0\x80\x80" },
-  { 0x0007FFFF, "\xF1\xBF\xBF\xBF" },
-  { 0x00080000, "\xF2\x80\x80\x80" },
-  { 0x00080001, "\xF2\x80\x80\x81" },
-  { 0x00080002, "\xF2\x80\x80\x82" },
-  { 0x00080004, "\xF2\x80\x80\x84" },
-  { 0x00080008, "\xF2\x80\x80\x88" },
-  { 0x00080010, "\xF2\x80\x80\x90" },
-  { 0x00080020, "\xF2\x80\x80\xA0" },
-  { 0x00080040, "\xF2\x80\x81\x80" },
-  { 0x00080080, "\xF2\x80\x82\x80" },
-  { 0x00080100, "\xF2\x80\x84\x80" },
-  { 0x00080200, "\xF2\x80\x88\x80" },
-  { 0x00080400, "\xF2\x80\x90\x80" },
-  { 0x00080800, "\xF2\x80\xA0\x80" },
-  { 0x00081000, "\xF2\x81\x80\x80" },
-  { 0x00082000, "\xF2\x82\x80\x80" },
-  { 0x00084000, "\xF2\x84\x80\x80" },
-  { 0x00088000, "\xF2\x88\x80\x80" },
-  { 0x00090000, "\xF2\x90\x80\x80" },
-  { 0x000A0000, "\xF2\xA0\x80\x80" },
-  { 0x000C0000, "\xF3\x80\x80\x80" },
-  { 0x000FFFFF, "\xF3\xBF\xBF\xBF" },
-  { 0x00100000, "\xF4\x80\x80\x80" },
-  { 0x00100001, "\xF4\x80\x80\x81" },
-  { 0x00100002, "\xF4\x80\x80\x82" },
-  { 0x00100004, "\xF4\x80\x80\x84" },
-  { 0x00100008, "\xF4\x80\x80\x88" },
-  { 0x00100010, "\xF4\x80\x80\x90" },
-  { 0x00100020, "\xF4\x80\x80\xA0" },
-  { 0x00100040, "\xF4\x80\x81\x80" },
-  { 0x00100080, "\xF4\x80\x82\x80" },
-  { 0x00100100, "\xF4\x80\x84\x80" },
-  { 0x00100200, "\xF4\x80\x88\x80" },
-  { 0x00100400, "\xF4\x80\x90\x80" },
-  { 0x00100800, "\xF4\x80\xA0\x80" },
-  { 0x00101000, "\xF4\x81\x80\x80" },
-  { 0x00102000, "\xF4\x82\x80\x80" },
-  { 0x00104000, "\xF4\x84\x80\x80" },
-  { 0x00108000, "\xF4\x88\x80\x80" },
-  { 0x0010FFFF, "\xF4\x8F\xBF\xBF" },
-};
-
-// UCS-2 <-> UTF-8 cases (divided into ISO-8859-1 vs. not).
-
-const Ucs2Case kIso88591Cases[] = {
-  { 0x0001, "\x01" },
-  { 0x0002, "\x02" },
-  { 0x0003, "\x03" },
-  { 0x0004, "\x04" },
-  { 0x0007, "\x07" },
-  { 0x0008, "\x08" },
-  { 0x000F, "\x0F" },
-  { 0x0010, "\x10" },
-  { 0x001F, "\x1F" },
-  { 0x0020, "\x20" },
-  { 0x003F, "\x3F" },
-  { 0x0040, "\x40" },
-  { 0x007F, "\x7F" },
-
-  { 0x0080, "\xC2\x80" },
-  { 0x0081, "\xC2\x81" },
-  { 0x0082, "\xC2\x82" },
-  { 0x0084, "\xC2\x84" },
-  { 0x0088, "\xC2\x88" },
-  { 0x0090, "\xC2\x90" },
-  { 0x00A0, "\xC2\xA0" },
-  { 0x00C0, "\xC3\x80" },
-  { 0x00FF, "\xC3\xBF" },
-};
-
-const Ucs2Case kUcs2Cases[] = {
-  { 0x0100, "\xC4\x80" },
-  { 0x0101, "\xC4\x81" },
-  { 0x0102, "\xC4\x82" },
-  { 0x0104, "\xC4\x84" },
-  { 0x0108, "\xC4\x88" },
-  { 0x0110, "\xC4\x90" },
-  { 0x0120, "\xC4\xA0" },
-  { 0x0140, "\xC5\x80" },
-  { 0x0180, "\xC6\x80" },
-  { 0x01FF, "\xC7\xBF" },
-  { 0x0200, "\xC8\x80" },
-  { 0x0201, "\xC8\x81" },
-  { 0x0202, "\xC8\x82" },
-  { 0x0204, "\xC8\x84" },
-  { 0x0208, "\xC8\x88" },
-  { 0x0210, "\xC8\x90" },
-  { 0x0220, "\xC8\xA0" },
-  { 0x0240, "\xC9\x80" },
-  { 0x0280, "\xCA\x80" },
-  { 0x0300, "\xCC\x80" },
-  { 0x03FF, "\xCF\xBF" },
-  { 0x0400, "\xD0\x80" },
-  { 0x0401, "\xD0\x81" },
-  { 0x0402, "\xD0\x82" },
-  { 0x0404, "\xD0\x84" },
-  { 0x0408, "\xD0\x88" },
-  { 0x0410, "\xD0\x90" },
-  { 0x0420, "\xD0\xA0" },
-  { 0x0440, "\xD1\x80" },
-  { 0x0480, "\xD2\x80" },
-  { 0x0500, "\xD4\x80" },
-  { 0x0600, "\xD8\x80" },
-  { 0x07FF, "\xDF\xBF" },
-
-  { 0x0800, "\xE0\xA0\x80" },
-  { 0x0801, "\xE0\xA0\x81" },
-  { 0x0802, "\xE0\xA0\x82" },
-  { 0x0804, "\xE0\xA0\x84" },
-  { 0x0808, "\xE0\xA0\x88" },
-  { 0x0810, "\xE0\xA0\x90" },
-  { 0x0820, "\xE0\xA0\xA0" },
-  { 0x0840, "\xE0\xA1\x80" },
-  { 0x0880, "\xE0\xA2\x80" },
-  { 0x0900, "\xE0\xA4\x80" },
-  { 0x0A00, "\xE0\xA8\x80" },
-  { 0x0C00, "\xE0\xB0\x80" },
-  { 0x0FFF, "\xE0\xBF\xBF" },
-  { 0x1000, "\xE1\x80\x80" },
-  { 0x1001, "\xE1\x80\x81" },
-  { 0x1002, "\xE1\x80\x82" },
-  { 0x1004, "\xE1\x80\x84" },
-  { 0x1008, "\xE1\x80\x88" },
-  { 0x1010, "\xE1\x80\x90" },
-  { 0x1020, "\xE1\x80\xA0" },
-  { 0x1040, "\xE1\x81\x80" },
-  { 0x1080, "\xE1\x82\x80" },
-  { 0x1100, "\xE1\x84\x80" },
-  { 0x1200, "\xE1\x88\x80" },
-  { 0x1400, "\xE1\x90\x80" },
-  { 0x1800, "\xE1\xA0\x80" },
-  { 0x1FFF, "\xE1\xBF\xBF" },
-  { 0x2000, "\xE2\x80\x80" },
-  { 0x2001, "\xE2\x80\x81" },
-  { 0x2002, "\xE2\x80\x82" },
-  { 0x2004, "\xE2\x80\x84" },
-  { 0x2008, "\xE2\x80\x88" },
-  { 0x2010, "\xE2\x80\x90" },
-  { 0x2020, "\xE2\x80\xA0" },
-  { 0x2040, "\xE2\x81\x80" },
-  { 0x2080, "\xE2\x82\x80" },
-  { 0x2100, "\xE2\x84\x80" },
-  { 0x2200, "\xE2\x88\x80" },
-  { 0x2400, "\xE2\x90\x80" },
-  { 0x2800, "\xE2\xA0\x80" },
-  { 0x3000, "\xE3\x80\x80" },
-  { 0x3FFF, "\xE3\xBF\xBF" },
-  { 0x4000, "\xE4\x80\x80" },
-  { 0x4001, "\xE4\x80\x81" },
-  { 0x4002, "\xE4\x80\x82" },
-  { 0x4004, "\xE4\x80\x84" },
-  { 0x4008, "\xE4\x80\x88" },
-  { 0x4010, "\xE4\x80\x90" },
-  { 0x4020, "\xE4\x80\xA0" },
-  { 0x4040, "\xE4\x81\x80" },
-  { 0x4080, "\xE4\x82\x80" },
-  { 0x4100, "\xE4\x84\x80" },
-  { 0x4200, "\xE4\x88\x80" },
-  { 0x4400, "\xE4\x90\x80" },
-  { 0x4800, "\xE4\xA0\x80" },
-  { 0x5000, "\xE5\x80\x80" },
-  { 0x6000, "\xE6\x80\x80" },
-  { 0x7FFF, "\xE7\xBF\xBF" },
-  { 0x8000, "\xE8\x80\x80" },
-  { 0x8001, "\xE8\x80\x81" },
-  { 0x8002, "\xE8\x80\x82" },
-  { 0x8004, "\xE8\x80\x84" },
-  { 0x8008, "\xE8\x80\x88" },
-  { 0x8010, "\xE8\x80\x90" },
-  { 0x8020, "\xE8\x80\xA0" },
-  { 0x8040, "\xE8\x81\x80" },
-  { 0x8080, "\xE8\x82\x80" },
-  { 0x8100, "\xE8\x84\x80" },
-  { 0x8200, "\xE8\x88\x80" },
-  { 0x8400, "\xE8\x90\x80" },
-  { 0x8800, "\xE8\xA0\x80" },
-  { 0x9000, "\xE9\x80\x80" },
-  { 0xA000, "\xEA\x80\x80" },
-  { 0xC000, "\xEC\x80\x80" },
-  { 0xFB01, "\xEF\xAC\x81" },
-  { 0xFFFF, "\xEF\xBF\xBF" }
-};
-
-// UTF-16 <-> UCS-4 cases
-
-const Utf16Case kUtf16Cases[] = {
-  { 0x00010000, { 0xD800, 0xDC00 } },
-  { 0x00010001, { 0xD800, 0xDC01 } },
-  { 0x00010002, { 0xD800, 0xDC02 } },
-  { 0x00010003, { 0xD800, 0xDC03 } },
-  { 0x00010004, { 0xD800, 0xDC04 } },
-  { 0x00010007, { 0xD800, 0xDC07 } },
-  { 0x00010008, { 0xD800, 0xDC08 } },
-  { 0x0001000F, { 0xD800, 0xDC0F } },
-  { 0x00010010, { 0xD800, 0xDC10 } },
-  { 0x0001001F, { 0xD800, 0xDC1F } },
-  { 0x00010020, { 0xD800, 0xDC20 } },
-  { 0x0001003F, { 0xD800, 0xDC3F } },
-  { 0x00010040, { 0xD800, 0xDC40 } },
-  { 0x0001007F, { 0xD800, 0xDC7F } },
-  { 0x00010080, { 0xD800, 0xDC80 } },
-  { 0x00010081, { 0xD800, 0xDC81 } },
-  { 0x00010082, { 0xD800, 0xDC82 } },
-  { 0x00010084, { 0xD800, 0xDC84 } },
-  { 0x00010088, { 0xD800, 0xDC88 } },
-  { 0x00010090, { 0xD800, 0xDC90 } },
-  { 0x000100A0, { 0xD800, 0xDCA0 } },
-  { 0x000100C0, { 0xD800, 0xDCC0 } },
-  { 0x000100FF, { 0xD800, 0xDCFF } },
-  { 0x00010100, { 0xD800, 0xDD00 } },
-  { 0x00010101, { 0xD800, 0xDD01 } },
-  { 0x00010102, { 0xD800, 0xDD02 } },
-  { 0x00010104, { 0xD800, 0xDD04 } },
-  { 0x00010108, { 0xD800, 0xDD08 } },
-  { 0x00010110, { 0xD800, 0xDD10 } },
-  { 0x00010120, { 0xD800, 0xDD20 } },
-  { 0x00010140, { 0xD800, 0xDD40 } },
-  { 0x00010180, { 0xD800, 0xDD80 } },
-  { 0x000101FF, { 0xD800, 0xDDFF } },
-  { 0x00010200, { 0xD800, 0xDE00 } },
-  { 0x00010201, { 0xD800, 0xDE01 } },
-  { 0x00010202, { 0xD800, 0xDE02 } },
-  { 0x00010204, { 0xD800, 0xDE04 } },
-  { 0x00010208, { 0xD800, 0xDE08 } },
-  { 0x00010210, { 0xD800, 0xDE10 } },
-  { 0x00010220, { 0xD800, 0xDE20 } },
-  { 0x00010240, { 0xD800, 0xDE40 } },
-  { 0x00010280, { 0xD800, 0xDE80 } },
-  { 0x00010300, { 0xD800, 0xDF00 } },
-  { 0x000103FF, { 0xD800, 0xDFFF } },
-  { 0x00010400, { 0xD801, 0xDC00 } },
-  { 0x00010401, { 0xD801, 0xDC01 } },
-  { 0x00010402, { 0xD801, 0xDC02 } },
-  { 0x00010404, { 0xD801, 0xDC04 } },
-  { 0x00010408, { 0xD801, 0xDC08 } },
-  { 0x00010410, { 0xD801, 0xDC10 } },
-  { 0x00010420, { 0xD801, 0xDC20 } },
-  { 0x00010440, { 0xD801, 0xDC40 } },
-  { 0x00010480, { 0xD801, 0xDC80 } },
-  { 0x00010500, { 0xD801, 0xDD00 } },
-  { 0x00010600, { 0xD801, 0xDE00 } },
-  { 0x000107FF, { 0xD801, 0xDFFF } },
-  { 0x00010800, { 0xD802, 0xDC00 } },
-  { 0x00010801, { 0xD802, 0xDC01 } },
-  { 0x00010802, { 0xD802, 0xDC02 } },
-  { 0x00010804, { 0xD802, 0xDC04 } },
-  { 0x00010808, { 0xD802, 0xDC08 } },
-  { 0x00010810, { 0xD802, 0xDC10 } },
-  { 0x00010820, { 0xD802, 0xDC20 } },
-  { 0x00010840, { 0xD802, 0xDC40 } },
-  { 0x00010880, { 0xD802, 0xDC80 } },
-  { 0x00010900, { 0xD802, 0xDD00 } },
-  { 0x00010A00, { 0xD802, 0xDE00 } },
-  { 0x00010C00, { 0xD803, 0xDC00 } },
-  { 0x00010FFF, { 0xD803, 0xDFFF } },
-  { 0x00011000, { 0xD804, 0xDC00 } },
-  { 0x00011001, { 0xD804, 0xDC01 } },
-  { 0x00011002, { 0xD804, 0xDC02 } },
-  { 0x00011004, { 0xD804, 0xDC04 } },
-  { 0x00011008, { 0xD804, 0xDC08 } },
-  { 0x00011010, { 0xD804, 0xDC10 } },
-  { 0x00011020, { 0xD804, 0xDC20 } },
-  { 0x00011040, { 0xD804, 0xDC40 } },
-  { 0x00011080, { 0xD804, 0xDC80 } },
-  { 0x00011100, { 0xD804, 0xDD00 } },
-  { 0x00011200, { 0xD804, 0xDE00 } },
-  { 0x00011400, { 0xD805, 0xDC00 } },
-  { 0x00011800, { 0xD806, 0xDC00 } },
-  { 0x00011FFF, { 0xD807, 0xDFFF } },
-  { 0x00012000, { 0xD808, 0xDC00 } },
-  { 0x00012001, { 0xD808, 0xDC01 } },
-  { 0x00012002, { 0xD808, 0xDC02 } },
-  { 0x00012004, { 0xD808, 0xDC04 } },
-  { 0x00012008, { 0xD808, 0xDC08 } },
-  { 0x00012010, { 0xD808, 0xDC10 } },
-  { 0x00012020, { 0xD808, 0xDC20 } },
-  { 0x00012040, { 0xD808, 0xDC40 } },
-  { 0x00012080, { 0xD808, 0xDC80 } },
-  { 0x00012100, { 0xD808, 0xDD00 } },
-  { 0x00012200, { 0xD808, 0xDE00 } },
-  { 0x00012400, { 0xD809, 0xDC00 } },
-  { 0x00012800, { 0xD80A, 0xDC00 } },
-  { 0x00013000, { 0xD80C, 0xDC00 } },
-  { 0x00013FFF, { 0xD80F, 0xDFFF } },
-  { 0x00014000, { 0xD810, 0xDC00 } },
-  { 0x00014001, { 0xD810, 0xDC01 } },
-  { 0x00014002, { 0xD810, 0xDC02 } },
-  { 0x00014004, { 0xD810, 0xDC04 } },
-  { 0x00014008, { 0xD810, 0xDC08 } },
-  { 0x00014010, { 0xD810, 0xDC10 } },
-  { 0x00014020, { 0xD810, 0xDC20 } },
-  { 0x00014040, { 0xD810, 0xDC40 } },
-  { 0x00014080, { 0xD810, 0xDC80 } },
-  { 0x00014100, { 0xD810, 0xDD00 } },
-  { 0x00014200, { 0xD810, 0xDE00 } },
-  { 0x00014400, { 0xD811, 0xDC00 } },
-  { 0x00014800, { 0xD812, 0xDC00 } },
-  { 0x00015000, { 0xD814, 0xDC00 } },
-  { 0x00016000, { 0xD818, 0xDC00 } },
-  { 0x00017FFF, { 0xD81F, 0xDFFF } },
-  { 0x00018000, { 0xD820, 0xDC00 } },
-  { 0x00018001, { 0xD820, 0xDC01 } },
-  { 0x00018002, { 0xD820, 0xDC02 } },
-  { 0x00018004, { 0xD820, 0xDC04 } },
-  { 0x00018008, { 0xD820, 0xDC08 } },
-  { 0x00018010, { 0xD820, 0xDC10 } },
-  { 0x00018020, { 0xD820, 0xDC20 } },
-  { 0x00018040, { 0xD820, 0xDC40 } },
-  { 0x00018080, { 0xD820, 0xDC80 } },
-  { 0x00018100, { 0xD820, 0xDD00 } },
-  { 0x00018200, { 0xD820, 0xDE00 } },
-  { 0x00018400, { 0xD821, 0xDC00 } },
-  { 0x00018800, { 0xD822, 0xDC00 } },
-  { 0x00019000, { 0xD824, 0xDC00 } },
-  { 0x0001A000, { 0xD828, 0xDC00 } },
-  { 0x0001C000, { 0xD830, 0xDC00 } },
-  { 0x0001FFFF, { 0xD83F, 0xDFFF } },
-  { 0x00020000, { 0xD840, 0xDC00 } },
-  { 0x00020001, { 0xD840, 0xDC01 } },
-  { 0x00020002, { 0xD840, 0xDC02 } },
-  { 0x00020004, { 0xD840, 0xDC04 } },
-  { 0x00020008, { 0xD840, 0xDC08 } },
-  { 0x00020010, { 0xD840, 0xDC10 } },
-  { 0x00020020, { 0xD840, 0xDC20 } },
-  { 0x00020040, { 0xD840, 0xDC40 } },
-  { 0x00020080, { 0xD840, 0xDC80 } },
-  { 0x00020100, { 0xD840, 0xDD00 } },
-  { 0x00020200, { 0xD840, 0xDE00 } },
-  { 0x00020400, { 0xD841, 0xDC00 } },
-  { 0x00020800, { 0xD842, 0xDC00 } },
-  { 0x00021000, { 0xD844, 0xDC00 } },
-  { 0x00022000, { 0xD848, 0xDC00 } },
-  { 0x00024000, { 0xD850, 0xDC00 } },
-  { 0x00028000, { 0xD860, 0xDC00 } },
-  { 0x0002FFFF, { 0xD87F, 0xDFFF } },
-  { 0x00030000, { 0xD880, 0xDC00 } },
-  { 0x00030001, { 0xD880, 0xDC01 } },
-  { 0x00030002, { 0xD880, 0xDC02 } },
-  { 0x00030004, { 0xD880, 0xDC04 } },
-  { 0x00030008, { 0xD880, 0xDC08 } },
-  { 0x00030010, { 0xD880, 0xDC10 } },
-  { 0x00030020, { 0xD880, 0xDC20 } },
-  { 0x00030040, { 0xD880, 0xDC40 } },
-  { 0x00030080, { 0xD880, 0xDC80 } },
-  { 0x00030100, { 0xD880, 0xDD00 } },
-  { 0x00030200, { 0xD880, 0xDE00 } },
-  { 0x00030400, { 0xD881, 0xDC00 } },
-  { 0x00030800, { 0xD882, 0xDC00 } },
-  { 0x00031000, { 0xD884, 0xDC00 } },
-  { 0x00032000, { 0xD888, 0xDC00 } },
-  { 0x00034000, { 0xD890, 0xDC00 } },
-  { 0x00038000, { 0xD8A0, 0xDC00 } },
-  { 0x0003FFFF, { 0xD8BF, 0xDFFF } },
-  { 0x00040000, { 0xD8C0, 0xDC00 } },
-  { 0x00040001, { 0xD8C0, 0xDC01 } },
-  { 0x00040002, { 0xD8C0, 0xDC02 } },
-  { 0x00040004, { 0xD8C0, 0xDC04 } },
-  { 0x00040008, { 0xD8C0, 0xDC08 } },
-  { 0x00040010, { 0xD8C0, 0xDC10 } },
-  { 0x00040020, { 0xD8C0, 0xDC20 } },
-  { 0x00040040, { 0xD8C0, 0xDC40 } },
-  { 0x00040080, { 0xD8C0, 0xDC80 } },
-  { 0x00040100, { 0xD8C0, 0xDD00 } },
-  { 0x00040200, { 0xD8C0, 0xDE00 } },
-  { 0x00040400, { 0xD8C1, 0xDC00 } },
-  { 0x00040800, { 0xD8C2, 0xDC00 } },
-  { 0x00041000, { 0xD8C4, 0xDC00 } },
-  { 0x00042000, { 0xD8C8, 0xDC00 } },
-  { 0x00044000, { 0xD8D0, 0xDC00 } },
-  { 0x00048000, { 0xD8E0, 0xDC00 } },
-  { 0x0004FFFF, { 0xD8FF, 0xDFFF } },
-  { 0x00050000, { 0xD900, 0xDC00 } },
-  { 0x00050001, { 0xD900, 0xDC01 } },
-  { 0x00050002, { 0xD900, 0xDC02 } },
-  { 0x00050004, { 0xD900, 0xDC04 } },
-  { 0x00050008, { 0xD900, 0xDC08 } },
-  { 0x00050010, { 0xD900, 0xDC10 } },
-  { 0x00050020, { 0xD900, 0xDC20 } },
-  { 0x00050040, { 0xD900, 0xDC40 } },
-  { 0x00050080, { 0xD900, 0xDC80 } },
-  { 0x00050100, { 0xD900, 0xDD00 } },
-  { 0x00050200, { 0xD900, 0xDE00 } },
-  { 0x00050400, { 0xD901, 0xDC00 } },
-  { 0x00050800, { 0xD902, 0xDC00 } },
-  { 0x00051000, { 0xD904, 0xDC00 } },
-  { 0x00052000, { 0xD908, 0xDC00 } },
-  { 0x00054000, { 0xD910, 0xDC00 } },
-  { 0x00058000, { 0xD920, 0xDC00 } },
-  { 0x00060000, { 0xD940, 0xDC00 } },
-  { 0x00070000, { 0xD980, 0xDC00 } },
-  { 0x0007FFFF, { 0xD9BF, 0xDFFF } },
-  { 0x00080000, { 0xD9C0, 0xDC00 } },
-  { 0x00080001, { 0xD9C0, 0xDC01 } },
-  { 0x00080002, { 0xD9C0, 0xDC02 } },
-  { 0x00080004, { 0xD9C0, 0xDC04 } },
-  { 0x00080008, { 0xD9C0, 0xDC08 } },
-  { 0x00080010, { 0xD9C0, 0xDC10 } },
-  { 0x00080020, { 0xD9C0, 0xDC20 } },
-  { 0x00080040, { 0xD9C0, 0xDC40 } },
-  { 0x00080080, { 0xD9C0, 0xDC80 } },
-  { 0x00080100, { 0xD9C0, 0xDD00 } },
-  { 0x00080200, { 0xD9C0, 0xDE00 } },
-  { 0x00080400, { 0xD9C1, 0xDC00 } },
-  { 0x00080800, { 0xD9C2, 0xDC00 } },
-  { 0x00081000, { 0xD9C4, 0xDC00 } },
-  { 0x00082000, { 0xD9C8, 0xDC00 } },
-  { 0x00084000, { 0xD9D0, 0xDC00 } },
-  { 0x00088000, { 0xD9E0, 0xDC00 } },
-  { 0x0008FFFF, { 0xD9FF, 0xDFFF } },
-  { 0x00090000, { 0xDA00, 0xDC00 } },
-  { 0x00090001, { 0xDA00, 0xDC01 } },
-  { 0x00090002, { 0xDA00, 0xDC02 } },
-  { 0x00090004, { 0xDA00, 0xDC04 } },
-  { 0x00090008, { 0xDA00, 0xDC08 } },
-  { 0x00090010, { 0xDA00, 0xDC10 } },
-  { 0x00090020, { 0xDA00, 0xDC20 } },
-  { 0x00090040, { 0xDA00, 0xDC40 } },
-  { 0x00090080, { 0xDA00, 0xDC80 } },
-  { 0x00090100, { 0xDA00, 0xDD00 } },
-  { 0x00090200, { 0xDA00, 0xDE00 } },
-  { 0x00090400, { 0xDA01, 0xDC00 } },
-  { 0x00090800, { 0xDA02, 0xDC00 } },
-  { 0x00091000, { 0xDA04, 0xDC00 } },
-  { 0x00092000, { 0xDA08, 0xDC00 } },
-  { 0x00094000, { 0xDA10, 0xDC00 } },
-  { 0x00098000, { 0xDA20, 0xDC00 } },
-  { 0x000A0000, { 0xDA40, 0xDC00 } },
-  { 0x000B0000, { 0xDA80, 0xDC00 } },
-  { 0x000C0000, { 0xDAC0, 0xDC00 } },
-  { 0x000D0000, { 0xDB00, 0xDC00 } },
-  { 0x000FFFFF, { 0xDBBF, 0xDFFF } },
-  { 0x0010FFFF, { 0xDBFF, 0xDFFF } }
-
-};
-
-// Invalid UTF-8 sequences
-
-const char * const kUtf8BadCases[] = {
-  "\xC0\x80",
-  "\xC1\xBF",
-  "\xE0\x80\x80",
-  "\xE0\x9F\xBF",
-  "\xF0\x80\x80\x80",
-  "\xF0\x8F\xBF\xBF",
-  "\xF4\x90\x80\x80",
-  "\xF7\xBF\xBF\xBF",
-  "\xF8\x80\x80\x80\x80",
-  "\xF8\x88\x80\x80\x80",
-  "\xF8\x92\x80\x80\x80",
-  "\xF8\x9F\xBF\xBF\xBF",
-  "\xF8\xA0\x80\x80\x80",
-  "\xF8\xA8\x80\x80\x80",
-  "\xF8\xB0\x80\x80\x80",
-  "\xF8\xBF\xBF\xBF\xBF",
-  "\xF9\x80\x80\x80\x88",
-  "\xF9\x84\x80\x80\x80",
-  "\xF9\xBF\xBF\xBF\xBF",
-  "\xFA\x80\x80\x80\x80",
-  "\xFA\x90\x80\x80\x80",
-  "\xFB\xBF\xBF\xBF\xBF",
-  "\xFC\x84\x80\x80\x80\x81",
-  "\xFC\x85\x80\x80\x80\x80",
-  "\xFC\x86\x80\x80\x80\x80",
-  "\xFC\x87\xBF\xBF\xBF\xBF",
-  "\xFC\x88\xA0\x80\x80\x80",
-  "\xFC\x89\x80\x80\x80\x80",
-  "\xFC\x8A\x80\x80\x80\x80",
-  "\xFC\x90\x80\x80\x80\x82",
-  "\xFD\x80\x80\x80\x80\x80",
-  "\xFD\xBF\xBF\xBF\xBF\xBF",
-  "\x80",
-  "\xC3",
-  "\xC3\xC3\x80",
-  "\xED\xA0\x80",
-  "\xED\xBF\x80",
-  "\xED\xBF\xBF",
-  "\xED\xA0\x80\xE0\xBF\xBF",
-};
-
-// Invalid UTF-16 sequences (0-terminated)
-
-const Utf16BadCase kUtf16BadCases[] = {
-  // Leading surrogate not followed by trailing surrogate:
-  {{ 0xD800, 0, 0 }},
-  {{ 0xD800, 0x41, 0 }},
-  {{ 0xD800, 0xfe, 0 }},
-  {{ 0xD800, 0x3bb, 0 }},
-  {{ 0xD800, 0xD800, 0 }},
-  {{ 0xD800, 0xFEFF, 0 }},
-  {{ 0xD800, 0xFFFD, 0 }},
-};
-
-// Parameterized test instantiations:
-
-INSTANTIATE_TEST_CASE_P(Ucs4TestCases, Ucs4Test,
-                        ::testing::ValuesIn(kUcs4Cases));
-
-INSTANTIATE_TEST_CASE_P(Iso88591TestCases, Ucs2Test,
-                        ::testing::ValuesIn(kIso88591Cases));
-
-INSTANTIATE_TEST_CASE_P(Ucs2TestCases, Ucs2Test,
-                        ::testing::ValuesIn(kUcs2Cases));
-
-INSTANTIATE_TEST_CASE_P(Utf16TestCases, Utf16Test,
-                        ::testing::ValuesIn(kUtf16Cases));
-
-INSTANTIATE_TEST_CASE_P(BadUtf8TestCases, BadUtf8Test,
-                        ::testing::ValuesIn(kUtf8BadCases));
-
-INSTANTIATE_TEST_CASE_P(BadUtf16TestCases, BadUtf16Test,
-                        ::testing::ValuesIn(kUtf16BadCases));
-
-INSTANTIATE_TEST_CASE_P(Iso88591TestCases, Iso88591Test,
-                        ::testing::ValuesIn(kIso88591Cases));;
-
-
-} // namespace nss_test
--- a/security/nss/lib/certdb/alg1485.c
+++ b/security/nss/lib/certdb/alg1485.c
@@ -1393,61 +1393,60 @@ appendItemToBuf(char* dest, SECItem* src
 ** This function is intended to be internal to NSS.
 */
 char*
 cert_GetCertificateEmailAddresses(CERTCertificate* cert)
 {
     char* rawEmailAddr = NULL;
     char* addrBuf = NULL;
     char* pBuf = NULL;
-    PORTCheapArenaPool tmpArena;
+    PLArenaPool* tmpArena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
     PRUint32 maxLen = 0;
     PRInt32 finalLen = 0;
     SECStatus rv;
     SECItem subAltName;
 
-    PORT_InitCheapArena(&tmpArena, DER_DEFAULT_CHUNKSIZE);
+    if (!tmpArena)
+        return addrBuf;
 
     subAltName.data = NULL;
     maxLen = cert->derCert.len;
     PORT_Assert(maxLen);
     if (!maxLen)
         maxLen = 2000; /* a guess, should never happen */
 
-    pBuf = addrBuf = (char*)PORT_ArenaZAlloc(&tmpArena.arena, maxLen + 1);
+    pBuf = addrBuf = (char*)PORT_ArenaZAlloc(tmpArena, maxLen + 1);
     if (!addrBuf)
         goto loser;
 
-    rawEmailAddr = CERT_GetNameElement(&tmpArena.arena, &cert->subject,
-                                       SEC_OID_PKCS9_EMAIL_ADDRESS);
+    rawEmailAddr =
+        CERT_GetNameElement(tmpArena, &cert->subject, SEC_OID_PKCS9_EMAIL_ADDRESS);
     pBuf = appendStringToBuf(pBuf, rawEmailAddr, &maxLen);
 
-    rawEmailAddr = CERT_GetNameElement(&tmpArena.arena, &cert->subject,
-                                       SEC_OID_RFC1274_MAIL);
+    rawEmailAddr =
+        CERT_GetNameElement(tmpArena, &cert->subject, SEC_OID_RFC1274_MAIL);
     pBuf = appendStringToBuf(pBuf, rawEmailAddr, &maxLen);
 
     rv = CERT_FindCertExtension(cert, SEC_OID_X509_SUBJECT_ALT_NAME, &subAltName);
     if (rv == SECSuccess && subAltName.data) {
         CERTGeneralName* nameList = NULL;
 
-        if (!!(nameList = CERT_DecodeAltNameExtension(&tmpArena.arena, &subAltName))) {
+        if (!!(nameList = CERT_DecodeAltNameExtension(tmpArena, &subAltName))) {
             CERTGeneralName* current = nameList;
             do {
                 if (current->type == certDirectoryName) {
                     rawEmailAddr =
-                        CERT_GetNameElement(&tmpArena.arena,
-                                            &current->name.directoryName,
+                        CERT_GetNameElement(tmpArena, &current->name.directoryName,
                                             SEC_OID_PKCS9_EMAIL_ADDRESS);
                     pBuf =
                         appendStringToBuf(pBuf, rawEmailAddr, &maxLen);
 
                     rawEmailAddr =
-                        CERT_GetNameElement(&tmpArena.arena,
-                                            &current->name.directoryName,
-                                            SEC_OID_RFC1274_MAIL);
+                        CERT_GetNameElement(
+                            tmpArena, &current->name.directoryName, SEC_OID_RFC1274_MAIL);
                     pBuf =
                         appendStringToBuf(pBuf, rawEmailAddr, &maxLen);
                 } else if (current->type == certRFC822Name) {
                     pBuf =
                         appendItemToBuf(pBuf, &current->name.other, &maxLen);
                 }
                 current = CERT_GetNextGeneralName(current);
             } while (current != nameList);
@@ -1460,17 +1459,18 @@ cert_GetCertificateEmailAddresses(CERTCe
     pBuf = NULL;
     if (finalLen > 1) {
         pBuf = PORT_ArenaAlloc(cert->arena, finalLen);
         if (pBuf) {
             PORT_Memcpy(pBuf, addrBuf, finalLen);
         }
     }
 loser:
-    PORT_DestroyCheapArena(&tmpArena);
+    if (tmpArena)
+        PORT_FreeArena(tmpArena, PR_FALSE);
 
     return pBuf;
 }
 
 /* returns pointer to storage in cert's arena.  Storage remains valid
 ** as long as cert's reference count doesn't go to zero.
 ** Caller should strdup or otherwise copy.
 */
--- a/security/nss/lib/certdb/certdb.c
+++ b/security/nss/lib/certdb/certdb.c
@@ -252,89 +252,99 @@ loser:
     PORT_FreeArena(arena, PR_FALSE);
     return (SECFailure);
 }
 
 SECStatus
 CERT_IssuerNameFromDERCert(SECItem *derCert, SECItem *derName)
 {
     int rv;
-    PORTCheapArenaPool tmpArena;
+    PLArenaPool *arena;
     CERTSignedData sd;
     void *tmpptr;
 
-    PORT_InitCheapArena(&tmpArena, DER_DEFAULT_CHUNKSIZE);
+    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+
+    if (!arena) {
+        return (SECFailure);
+    }
 
     PORT_Memset(&sd, 0, sizeof(CERTSignedData));
-    rv = SEC_QuickDERDecodeItem(&tmpArena.arena, &sd, CERT_SignedDataTemplate,
-                                derCert);
+    rv = SEC_QuickDERDecodeItem(arena, &sd, CERT_SignedDataTemplate, derCert);
+
     if (rv) {
         goto loser;
     }
 
     PORT_Memset(derName, 0, sizeof(SECItem));
-    rv = SEC_QuickDERDecodeItem(&tmpArena.arena, derName,
-                                SEC_CertIssuerTemplate, &sd.data);
+    rv = SEC_QuickDERDecodeItem(arena, derName, SEC_CertIssuerTemplate,
+                                &sd.data);
+
     if (rv) {
         goto loser;
     }
 
     tmpptr = derName->data;
     derName->data = (unsigned char *)PORT_Alloc(derName->len);
     if (derName->data == NULL) {
         goto loser;
     }
 
     PORT_Memcpy(derName->data, tmpptr, derName->len);
 
-    PORT_DestroyCheapArena(&tmpArena);
+    PORT_FreeArena(arena, PR_FALSE);
     return (SECSuccess);
 
 loser:
-    PORT_DestroyCheapArena(&tmpArena);
+    PORT_FreeArena(arena, PR_FALSE);
     return (SECFailure);
 }
 
 SECStatus
 CERT_SerialNumberFromDERCert(SECItem *derCert, SECItem *derName)
 {
     int rv;
-    PORTCheapArenaPool tmpArena;
+    PLArenaPool *arena;
     CERTSignedData sd;
     void *tmpptr;
 
-    PORT_InitCheapArena(&tmpArena, DER_DEFAULT_CHUNKSIZE);
+    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+
+    if (!arena) {
+        return (SECFailure);
+    }
 
     PORT_Memset(&sd, 0, sizeof(CERTSignedData));
-    rv = SEC_QuickDERDecodeItem(&tmpArena.arena, &sd, CERT_SignedDataTemplate,
-                                derCert);
+    rv = SEC_QuickDERDecodeItem(arena, &sd, CERT_SignedDataTemplate, derCert);
+
     if (rv) {
         goto loser;
     }
 
     PORT_Memset(derName, 0, sizeof(SECItem));
-    rv = SEC_QuickDERDecodeItem(&tmpArena.arena, derName,
-                                SEC_CertSerialNumberTemplate, &sd.data);
+    rv = SEC_QuickDERDecodeItem(arena, derName, SEC_CertSerialNumberTemplate,
+                                &sd.data);
+
     if (rv) {
         goto loser;
     }
 
     tmpptr = derName->data;
     derName->data = (unsigned char *)PORT_Alloc(derName->len);
     if (derName->data == NULL) {
         goto loser;
     }
 
     PORT_Memcpy(derName->data, tmpptr, derName->len);
 
-    PORT_DestroyCheapArena(&tmpArena);
+    PORT_FreeArena(arena, PR_FALSE);
     return (SECSuccess);
 
 loser:
-    PORT_DestroyCheapArena(&tmpArena);
+    PORT_FreeArena(arena, PR_FALSE);
     return (SECFailure);
 }
 
 /*
  * Generate a database key, based on serial number and issuer, from a
  * DER certificate.
  */
 SECStatus
@@ -2057,37 +2067,46 @@ cert_ComputeTrustOverrides(CERTCertifica
  * flags, Netscape Cert Type Extension, and KeyUsage Extension.
  */
 PRBool
 CERT_IsCACert(CERTCertificate *cert, unsigned int *rettype)
 {
     unsigned int cType = cert->nsCertType;
     PRBool ret = PR_FALSE;
 
-    /*
-     * Check if the constraints are available and it's a CA, OR if it's
-     * a X.509 v1 Root CA.
-     */
-    CERTBasicConstraints constraints;
-    if ((CERT_FindBasicConstraintExten(cert, &constraints) == SECSuccess &&
-        constraints.isCA) ||
-        (cert->isRoot && cert_Version(cert) < SEC_CERTIFICATE_VERSION_3))
+    if (cType & (NS_CERT_TYPE_SSL_CA | NS_CERT_TYPE_EMAIL_CA |
+                 NS_CERT_TYPE_OBJECT_SIGNING_CA)) {
+        ret = PR_TRUE;
+    } else {
+        SECStatus rv;
+        CERTBasicConstraints constraints;
+
+        rv = CERT_FindBasicConstraintExten(cert, &constraints);
+        if (rv == SECSuccess && constraints.isCA) {
+            ret = PR_TRUE;
+            cType |= (NS_CERT_TYPE_SSL_CA | NS_CERT_TYPE_EMAIL_CA);
+        }
+    }
+
+    /* finally check if it's an X.509 v1 root CA */
+    if (!ret &&
+        (cert->isRoot && cert_Version(cert) < SEC_CERTIFICATE_VERSION_3)) {
+        ret = PR_TRUE;
         cType |= (NS_CERT_TYPE_SSL_CA | NS_CERT_TYPE_EMAIL_CA);
-
-    /*
-     * Apply trust overrides, if any.
-     */
+    }
+    /* Now apply trust overrides, if any */
     cType = cert_ComputeTrustOverrides(cert, cType);
     ret = (cType & (NS_CERT_TYPE_SSL_CA | NS_CERT_TYPE_EMAIL_CA |
-                    NS_CERT_TYPE_OBJECT_SIGNING_CA)) ? PR_TRUE : PR_FALSE;
-
-    if (rettype) {
+                    NS_CERT_TYPE_OBJECT_SIGNING_CA))
+              ? PR_TRUE
+              : PR_FALSE;
+
+    if (rettype != NULL) {
         *rettype = cType;
     }
-
     return ret;
 }
 
 PRBool
 CERT_IsCADERCert(SECItem *derCert, unsigned int *type)
 {
     CERTCertificate *cert;
     PRBool isCA;
--- a/security/nss/lib/certdb/certv3.c
+++ b/security/nss/lib/certdb/certv3.c
@@ -124,25 +124,28 @@ CERT_FindSubjectKeyIDExtension(CERTCerti
 
     SECStatus rv;
     SECItem encodedValue = { siBuffer, NULL, 0 };
     SECItem decodedValue = { siBuffer, NULL, 0 };
 
     rv = cert_FindExtension(cert->extensions, SEC_OID_X509_SUBJECT_KEY_ID,
                             &encodedValue);
     if (rv == SECSuccess) {
-        PORTCheapArenaPool tmpArena;
-        PORT_InitCheapArena(&tmpArena, DER_DEFAULT_CHUNKSIZE);
-        rv = SEC_QuickDERDecodeItem(&tmpArena.arena, &decodedValue,
-                                    SEC_ASN1_GET(SEC_OctetStringTemplate),
-                                    &encodedValue);
-        if (rv == SECSuccess) {
-            rv = SECITEM_CopyItem(NULL, retItem, &decodedValue);
+        PLArenaPool *tmpArena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+        if (tmpArena) {
+            rv = SEC_QuickDERDecodeItem(tmpArena, &decodedValue,
+                                        SEC_ASN1_GET(SEC_OctetStringTemplate),
+                                        &encodedValue);
+            if (rv == SECSuccess) {
+                rv = SECITEM_CopyItem(NULL, retItem, &decodedValue);
+            }
+            PORT_FreeArena(tmpArena, PR_FALSE);
+        } else {
+            rv = SECFailure;
         }
-        PORT_DestroyCheapArena(&tmpArena);
     }
     SECITEM_FreeItem(&encodedValue, PR_FALSE);
     return rv;
 }
 
 SECStatus
 CERT_FindBasicConstraintExten(CERTCertificate *cert,
                               CERTBasicConstraints *value)
--- a/security/nss/lib/certdb/certxutl.c
+++ b/security/nss/lib/certdb/certxutl.c
@@ -389,31 +389,34 @@ CERT_MergeExtensions(void *exthandle, CE
  * get the value of the Netscape Certificate Type Extension
  */
 SECStatus
 CERT_FindBitStringExtension(CERTCertExtension **extensions, int tag,
                             SECItem *retItem)
 {
     SECItem wrapperItem, tmpItem = { siBuffer, 0 };
     SECStatus rv;
-    PORTCheapArenaPool tmpArena;
+    PLArenaPool *arena = NULL;
 
     wrapperItem.data = NULL;
     tmpItem.data = NULL;
 
-    PORT_InitCheapArena(&tmpArena, DER_DEFAULT_CHUNKSIZE);
+    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+
+    if (!arena) {
+        return (SECFailure);
+    }
 
     rv = cert_FindExtension(extensions, tag, &wrapperItem);
     if (rv != SECSuccess) {
         goto loser;
     }
 
-    rv = SEC_QuickDERDecodeItem(&tmpArena.arena, &tmpItem,
-                                SEC_ASN1_GET(SEC_BitStringTemplate),
-                                &wrapperItem);
+    rv = SEC_QuickDERDecodeItem(
+        arena, &tmpItem, SEC_ASN1_GET(SEC_BitStringTemplate), &wrapperItem);
 
     if (rv != SECSuccess) {
         goto loser;
     }
 
     retItem->data = (unsigned char *)PORT_Alloc((tmpItem.len + 7) >> 3);
     if (retItem->data == NULL) {
         goto loser;
@@ -424,17 +427,19 @@ CERT_FindBitStringExtension(CERTCertExte
 
     rv = SECSuccess;
     goto done;
 
 loser:
     rv = SECFailure;
 
 done:
-    PORT_DestroyCheapArena(&tmpArena);
+    if (arena) {
+        PORT_FreeArena(arena, PR_FALSE);
+    }
 
     if (wrapperItem.data) {
         PORT_Free(wrapperItem.data);
     }
 
     return (rv);
 }
 
--- a/security/nss/lib/certdb/secname.c
+++ b/security/nss/lib/certdb/secname.c
@@ -603,17 +603,17 @@ CERT_CompareName(const CERTName *a, cons
 /* Moved from certhtml.c */
 SECItem *
 CERT_DecodeAVAValue(const SECItem *derAVAValue)
 {
     SECItem *retItem;
     const SEC_ASN1Template *theTemplate = NULL;
     enum { conv_none, conv_ucs4, conv_ucs2, conv_iso88591 } convert = conv_none;
     SECItem avaValue = { siBuffer, 0 };
-    PORTCheapArenaPool tmpArena;
+    PLArenaPool *newarena = NULL;
 
     if (!derAVAValue || !derAVAValue->len || !derAVAValue->data) {
         PORT_SetError(SEC_ERROR_INVALID_ARGS);
         return NULL;
     }
 
     switch (derAVAValue->data[0]) {
         case SEC_ASN1_UNIVERSAL_STRING:
@@ -643,63 +643,66 @@ CERT_DecodeAVAValue(const SECItem *derAV
             theTemplate = SEC_ASN1_GET(SEC_UTF8StringTemplate);
             break;
         default:
             PORT_SetError(SEC_ERROR_INVALID_AVA);
             return NULL;
     }
 
     PORT_Memset(&avaValue, 0, sizeof(SECItem));
-    PORT_InitCheapArena(&tmpArena, DER_DEFAULT_CHUNKSIZE);
-    if (SEC_QuickDERDecodeItem(&tmpArena.arena, &avaValue, theTemplate,
-                               derAVAValue) != SECSuccess) {
-        PORT_DestroyCheapArena(&tmpArena);
+    newarena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+    if (!newarena) {
+        return NULL;
+    }
+    if (SEC_QuickDERDecodeItem(newarena, &avaValue, theTemplate, derAVAValue) !=
+        SECSuccess) {
+        PORT_FreeArena(newarena, PR_FALSE);
         return NULL;
     }
 
     if (convert != conv_none) {
         unsigned int utf8ValLen = avaValue.len * 3;
         unsigned char *utf8Val =
-            (unsigned char *)PORT_ArenaZAlloc(&tmpArena.arena, utf8ValLen);
+            (unsigned char *)PORT_ArenaZAlloc(newarena, utf8ValLen);
 
         switch (convert) {
             case conv_ucs4:
                 if (avaValue.len % 4 != 0 ||
                     !PORT_UCS4_UTF8Conversion(PR_FALSE, avaValue.data,
                                               avaValue.len, utf8Val, utf8ValLen,
                                               &utf8ValLen)) {
-                    PORT_DestroyCheapArena(&tmpArena);
+                    PORT_FreeArena(newarena, PR_FALSE);
                     PORT_SetError(SEC_ERROR_INVALID_AVA);
                     return NULL;
                 }
                 break;
             case conv_ucs2:
                 if (avaValue.len % 2 != 0 ||
                     !PORT_UCS2_UTF8Conversion(PR_FALSE, avaValue.data,
                                               avaValue.len, utf8Val, utf8ValLen,
                                               &utf8ValLen)) {
-                    PORT_DestroyCheapArena(&tmpArena);
+                    PORT_FreeArena(newarena, PR_FALSE);
                     PORT_SetError(SEC_ERROR_INVALID_AVA);
                     return NULL;
                 }
                 break;
             case conv_iso88591:
                 if (!PORT_ISO88591_UTF8Conversion(avaValue.data, avaValue.len,
                                                   utf8Val, utf8ValLen,
                                                   &utf8ValLen)) {
-                    PORT_DestroyCheapArena(&tmpArena);
+                    PORT_FreeArena(newarena, PR_FALSE);
                     PORT_SetError(SEC_ERROR_INVALID_AVA);
                     return NULL;
                 }
                 break;
             case conv_none:
                 PORT_Assert(0); /* not reached */
                 break;
         }
 
         avaValue.data = utf8Val;
         avaValue.len = utf8ValLen;
     }
 
     retItem = SECITEM_DupItem(&avaValue);
-    PORT_DestroyCheapArena(&tmpArena);
+    PORT_FreeArena(newarena, PR_FALSE);
     return retItem;
 }
--- a/security/nss/lib/certdb/xbsconst.c
+++ b/security/nss/lib/certdb/xbsconst.c
@@ -88,30 +88,34 @@ CERT_EncodeBasicConstraintValue(PLArenaP
     return (rv);
 }
 
 SECStatus
 CERT_DecodeBasicConstraintValue(CERTBasicConstraints *value,
                                 const SECItem *encodedValue)
 {
     EncodedContext decodeContext;
-    PORTCheapArenaPool tmpArena;
+    PLArenaPool *our_pool;
     SECStatus rv = SECSuccess;
 
     do {
         PORT_Memset(&decodeContext, 0, sizeof(decodeContext));
         /* initialize the value just in case we got "0x30 00", or when the
            pathLenConstraint is omitted.
          */
         decodeContext.isCA.data = &hexFalse;
         decodeContext.isCA.len = 1;
 
-        PORT_InitCheapArena(&tmpArena, SEC_ASN1_DEFAULT_ARENA_SIZE);
+        our_pool = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
+        if (our_pool == NULL) {
+            PORT_SetError(SEC_ERROR_NO_MEMORY);
+            GEN_BREAK(SECFailure);
+        }
 
-        rv = SEC_QuickDERDecodeItem(&tmpArena.arena, &decodeContext,
+        rv = SEC_QuickDERDecodeItem(our_pool, &decodeContext,
                                     CERTBasicConstraintsTemplate, encodedValue);
         if (rv == SECFailure)
             break;
 
         value->isCA = decodeContext.isCA.data
                           ? (PRBool)(decodeContext.isCA.data[0] != 0)
                           : PR_FALSE;
         if (decodeContext.pathLenConstraint.data == NULL) {
@@ -131,13 +135,13 @@ CERT_DecodeBasicConstraintValue(CERTBasi
             value->pathLenConstraint = len;
         } else {
             /* here we get an error where the subject is not a CA, but
                the pathLenConstraint is set */
             PORT_SetError(SEC_ERROR_BAD_DER);
             GEN_BREAK(SECFailure);
             break;
         }
+
     } while (0);
-
-    PORT_DestroyCheapArena(&tmpArena);
+    PORT_FreeArena(our_pool, PR_FALSE);
     return (rv);
 }
--- a/security/nss/lib/crmf/servget.c
+++ b/security/nss/lib/crmf/servget.c
@@ -350,19 +350,16 @@ crmf_copy_poposigningkey(PLArenaPool *po
     SECStatus rv;
 
     /* We don't support use of the POPOSigningKeyInput, so we'll only
      * store away the DER encoding.
      */
     if (inPopoSignKey->derInput.data != NULL) {
         rv = SECITEM_CopyItem(poolp, &destPopoSignKey->derInput,
                               &inPopoSignKey->derInput);
-        if (rv != SECSuccess) {
-            goto loser;
-        }
     }
     destPopoSignKey->algorithmIdentifier = (poolp == NULL) ? PORT_ZNew(SECAlgorithmID)
                                                            : PORT_ArenaZNew(poolp, SECAlgorithmID);
 
     if (destPopoSignKey->algorithmIdentifier == NULL) {
         goto loser;
     }
     rv = SECOID_CopyAlgorithmID(poolp, destPopoSignKey->algorithmIdentifier,
--- a/security/nss/lib/dbm/src/hash.c
+++ b/security/nss/lib/dbm/src/hash.c
@@ -1015,17 +1015,17 @@ extern int
         if (new_segnum >= hashp->DSIZE) {
             /* Reallocate directory */
             dirsize = hashp->DSIZE * sizeof(SEGMENT *);
             if (!hash_realloc(&hashp->dir, dirsize, dirsize << 1))
                 return (-1);
             hashp->DSIZE = dirsize << 1;
         }
         if ((hashp->dir[new_segnum] =
-                 (SEGMENT)calloc((size_t)hashp->SGSIZE, sizeof(BUFHEAD *))) == NULL)
+                 (SEGMENT)calloc((size_t)hashp->SGSIZE, sizeof(SEGMENT))) == NULL)
             return (-1);
         hashp->exsegs++;
         hashp->nsegs++;
     }
     /*
      * If the split point is increasing (MAX_BUCKET's log base 2
      * * increases), we need to copy the current contents of the spare
      * split bucket to the next bucket.
@@ -1086,23 +1086,23 @@ static int
 alloc_segs(
     HTAB *hashp,
     int nsegs)
 {
     register int i;
     register SEGMENT store;
 
     if ((hashp->dir =
-             (SEGMENT *)calloc((size_t)hashp->DSIZE, sizeof(SEGMENT))) == NULL) {
+             (SEGMENT *)calloc((size_t)hashp->DSIZE, sizeof(SEGMENT *))) == NULL) {
         errno = ENOMEM;
         return (-1);
     }
     /* Allocate segments */
     if ((store =
-             (SEGMENT)calloc((size_t)nsegs << hashp->SSHIFT, sizeof(BUFHEAD *))) == NULL) {
+             (SEGMENT)calloc((size_t)nsegs << hashp->SSHIFT, sizeof(SEGMENT))) == NULL) {
         errno = ENOMEM;
         return (-1);
     }
     for (i = 0; i < nsegs; i++, hashp->nsegs++)
         hashp->dir[i] = &store[i << hashp->SSHIFT];
     return (0);
 }
 
--- a/security/nss/lib/freebl/Makefile
+++ b/security/nss/lib/freebl/Makefile
@@ -41,34 +41,23 @@ ifdef USE_ABI32_FPU
 endif
 
 ifeq ($(FREEBL_NO_DEPEND),1)
 	DEFINES += -DFREEBL_NO_DEPEND
 	STUBS_SRCS = stubs.c
 endif
 
 ifeq ($(FREEBL_LOWHASH),1)
-	DEFINES += -DFREEBL_LOWHASH
 	LOWHASH_SRCS = nsslowhash.c
 	LOWHASH_EXPORTS = nsslowhash.h
-	MAPFILE_SOURCE = freebl_hash_vector.def
-	NEED_STUB_BUILD = 1
+	MAPFILE_SOURCE = freebl_hash.def
 else
 	MAPFILE_SOURCE = freebl.def
 endif
 
-ifdef USE_STUB_BUILD
-	CSRCS           = lowhash_vector.c
-	SIMPLE_OBJS     = $(CSRCS:.c=$(OBJ_SUFFIX))
-	OBJS            = $(addprefix $(OBJDIR)/$(PROG_PREFIX), $(SIMPLE_OBJS))
-	ALL_TRASH :=    $(TARGETS) $(OBJS) $(OBJDIR) LOGS TAGS $(GARBAGE) \
-                $(NOSUCHFILE) so_locations
-	MAPFILE_SOURCE = freebl_hash.def
-endif
-
 # FREEBL_USE_PRELINK
 #
 # Most modern version of Linux support a speed optimization scheme where an
 # application called prelink modifies programs and shared libraries to quickly
 # load if they fit into an already designed address space. In short, prelink
 # scans the list of programs and libraries on your system, assigns them a
 # predefined space in the the address space, then provides the fixups to the
 # library.
@@ -93,20 +82,16 @@ endif
 # library itself, which can have imbedded spaces or special characters).
 #
 ifdef FREEBL_USE_PRELINK
 	DEFINES += -DFREEBL_USE_PRELINK
 ifdef LINUX
 	DEFINES += -D__GNU_SOURCE=1
 endif
 endif
-ifdef NSS_NO_INIT_SUPPORT
-    DEFINES += -DNSS_NO_INIT_SUPPORT
-endif
-
 ifdef FREEBL_PRELINK_COMMAND
 	DEFINES +=-DFREEBL_PRELINK_COMMAND=\"$(FREEBL_PRELINK_COMMAND)\"
 endif
 # NSS_X86 means the target is a 32-bits x86 CPU architecture
 # NSS_X64 means the target is a 64-bits 64 CPU architecture
 # NSS_X86_OR_X64 means the target is either x86 or x64
 ifeq (,$(filter-out i386 x386 x86 x86_64,$(CPU_ARCH)))
         DEFINES += -DNSS_X86_OR_X64
@@ -122,17 +107,17 @@ ifeq ($(OS_TARGET),OSF1)
     MPI_SRCS += mpvalpha.c
 endif
 
 ifeq (OS2,$(OS_TARGET))
     ASFILES  = mpi_x86_os2.s
     DEFINES += -DMP_ASSEMBLY_MULTIPLY -DMP_ASSEMBLY_SQUARE 
     DEFINES += -DMP_ASSEMBLY_DIV_2DX1D
     DEFINES += -DMP_USE_UINT_DIGIT -DMP_NO_MP_WORD
-    DEFINES += -DMP_IS_LITTLE_ENDIAN
+    DEFINES += -DMP_CHAR_STORE_SLOW -DMP_IS_LITTLE_ENDIAN
 endif
 
 ifeq (,$(filter-out WINNT WIN95,$(OS_TARGET)))
 ifndef USE_64
 # 32-bit Windows
 ifdef NS_USE_GCC
 # Ideally, we want to use assembler
 #     ASFILES  = mpi_x86.s
@@ -158,17 +143,17 @@ else
 	EXTRA_SRCS += intel-gcm-wrap.c
 	ifeq ($(CLANG_CL),1)
 	    INTEL_GCM_CLANG_CL = 1
 	endif
     endif
 endif
 else
     # -DMP_NO_MP_WORD
-    DEFINES += -DMP_IS_LITTLE_ENDIAN
+    DEFINES += -DMP_CHAR_STORE_SLOW -DMP_IS_LITTLE_ENDIAN
 ifdef NS_USE_GCC
 # Ideally, we should use amd64 assembly code, but it's not yet mingw-w64
 # compatible.
 else
 # MSVC
     ifdef BUILD_OPT
 	OPTIMIZER += -Ox  # maximum optimization for freebl
     endif
@@ -213,44 +198,39 @@ endif
 endif # Darwin
 
 ifeq ($(OS_TARGET),Linux)
 ifeq ($(CPU_ARCH),x86_64)
     ASFILES  = arcfour-amd64-gas.s mpi_amd64_gas.s
     ASFLAGS += -fPIC -Wa,--noexecstack
     DEFINES += -DNSS_BEVAND_ARCFOUR -DMPI_AMD64 -DMP_ASSEMBLY_MULTIPLY
     DEFINES += -DNSS_USE_COMBA
-    DEFINES += -DMP_IS_LITTLE_ENDIAN
+    DEFINES += -DMP_CHAR_STORE_SLOW -DMP_IS_LITTLE_ENDIAN
 #   DEFINES += -DMPI_AMD64_ADD
     # comment the next four lines to turn off Intel HW acceleration.
     DEFINES += -DUSE_HW_AES -DINTEL_GCM
     ASFILES += intel-aes.s intel-gcm.s
     EXTRA_SRCS += intel-gcm-wrap.c
     INTEL_GCM = 1
     MPI_SRCS += mpi_amd64.c mp_comba.c
 endif
 ifeq ($(CPU_ARCH),x86)
     ASFILES  = mpi_x86.s
     DEFINES += -DMP_ASSEMBLY_MULTIPLY -DMP_ASSEMBLY_SQUARE 
     DEFINES += -DMP_ASSEMBLY_DIV_2DX1D -DMP_USE_UINT_DIGIT
-    DEFINES += -DMP_IS_LITTLE_ENDIAN
+    DEFINES += -DMP_CHAR_STORE_SLOW -DMP_IS_LITTLE_ENDIAN
     # The floating point ECC code doesn't work on Linux x86 (bug 311432).
     #ECL_USE_FP = 1
 endif
 ifeq ($(CPU_ARCH),arm)
     DEFINES += -DMP_ASSEMBLY_MULTIPLY -DMP_ASSEMBLY_SQUARE 
     DEFINES += -DMP_USE_UINT_DIGIT
     DEFINES += -DSHA_NO_LONG_LONG # avoid 64-bit arithmetic in SHA512
     MPI_SRCS += mpi_arm.c
 endif
-ifeq ($(CPU_ARCH),ppc)
-ifdef USE_64
-    DEFINES += -DNSS_NO_INIT_SUPPORT
-endif # USE_64
-endif # ppc
 endif # Linux
 
 ifeq ($(OS_TARGET),AIX)
     DEFINES += -DMP_USE_UINT_DIGIT
     ifndef USE_64
 	DEFINES += -DMP_NO_DIV_WORD -DMP_NO_ADD_WORD -DMP_NO_SUB_WORD
     endif
 endif # AIX
@@ -469,17 +449,17 @@ else
  	    ASFILES += mp_comba_amd64_sun.s mpcpucache_amd64.s
 	    ASFLAGS += -xarch=generic64 -K PIC
             SOL_CFLAGS += -xprefetch=no
 	    SHA_SRCS =
  	    MPCPU_SRCS =
 	    # Intel acceleration for GCM does not build currently with Studio
 	endif
 	DEFINES += -DNSS_BEVAND_ARCFOUR -DMPI_AMD64 -DMP_ASSEMBLY_MULTIPLY
-	DEFINES += -DNSS_USE_COMBA -DMP_IS_LITTLE_ENDIAN
+	DEFINES += -DNSS_USE_COMBA -DMP_CHAR_STORE_SLOW -DMP_IS_LITTLE_ENDIAN
 	# comment the next two lines to turn off Intel HW acceleration
 	DEFINES += -DUSE_HW_AES
 	ASFILES += intel-aes.s
 	MPI_SRCS += mpi_amd64.c
     else
 	# Solaris x86
 	DEFINES += -DMP_USE_UINT_DIGIT
 	DEFINES += -DMP_ASSEMBLY_MULTIPLY -DMP_ASSEMBLY_SQUARE 
@@ -499,17 +479,17 @@ ifndef NSS_DISABLE_ECC
 	DEFINES  += -DECL_USE_FP
 	ECL_SRCS += ecp_fp160.c ecp_fp192.c ecp_fp224.c ecp_fp.c
 	ECL_HDRS += ecp_fp.h
     endif
 endif
 
 # poly1305-donna-x64-sse2-incremental-source.c requires __int128 support
 # in GCC 4.6.0.
-ifdef CC_IS_CLANG
+ifeq ($(CC_NAME),clang)
     HAVE_INT128_SUPPORT = 1
 else ifeq (1,$(CC_IS_GCC))
     ifneq (,$(filter 4.6 4.7 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
         HAVE_INT128_SUPPORT = 1
     endif
     ifeq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
         HAVE_INT128_SUPPORT = 1
     endif
@@ -613,27 +593,16 @@ ALL_TRASH += $(SINGLE_SHLIB_DIR)
 
 release_md libs:: $(SINGLE_SHLIB_DIR)
 	$(MAKE) FREEBL_CHILD_BUILD=1 \
  OBJDIR=$(SINGLE_SHLIB_DIR) $@
 ######################## common stuff #########################
 
 endif
 
-ifdef NEED_STUB_BUILD
-SINGLE_SHLIB_DIR = $(OBJDIR)/$(OS_TARGET)_SINGLE_SHLIB
-ALL_TRASH += $(SINGLE_SHLIB_DIR) 
-$(SINGLE_SHLIB_DIR):
-	-mkdir $(SINGLE_SHLIB_DIR)
-
-release_md libs:: $(SINGLE_SHLIB_DIR)
-	$(MAKE) FREEBL_CHILD_BUILD=1 USE_STUB_BUILD=1 \
- OBJDIR=$(SINGLE_SHLIB_DIR) $@
-endif
-
 # multiple shared libraries
 
 ######################## ABI32_FPU stuff #########################
 ifdef HAVE_ABI32_FPU
 ABI32_FPU_DIR = $(OBJDIR)/$(OS_TARGET)_ABI32_FPU
 ALL_TRASH += $(ABI32_FPU_DIR) 
 
 $(ABI32_FPU_DIR):
@@ -723,18 +692,18 @@ ifdef INTEL_GCM
 #
 $(OBJDIR)/$(PROG_PREFIX)intel-gcm-wrap$(OBJ_SUFFIX): CFLAGS += -mssse3
 
 # The integrated assembler in Clang 3.2 does not support % in the
 # expression of a .set directive. intel-gcm.s uses .set to give
 # symbolic names to registers, for example,
 #     .set  Htbl, %rdi
 # So we can't use Clang's integrated assembler with intel-gcm.s.
-ifdef CC_IS_CLANG
-$(OBJDIR)/$(PROG_PREFIX)intel-gcm$(OBJ_SUFFIX): CFLAGS += -no-integrated-as
+ifneq (,$(findstring clang,$(shell $(AS) --version)))
+$(OBJDIR)/$(PROG_PREFIX)intel-gcm$(OBJ_SUFFIX): ASFLAGS += -no-integrated-as
 endif
 endif
 
 ifdef INTEL_GCM_CLANG_CL
 #
 # clang-cl needs -mssse3
 #
 $(OBJDIR)/$(PROG_PREFIX)intel-gcm-wrap$(OBJ_SUFFIX): CFLAGS += -mssse3
--- a/security/nss/lib/freebl/blapii.h
+++ b/security/nss/lib/freebl/blapii.h
@@ -16,19 +16,16 @@
 typedef SECStatus (*freeblCipherFunc)(void *cx, unsigned char *output,
                           unsigned int *outputLen, unsigned int maxOutputLen,
                           const unsigned char *input, unsigned int inputLen,
 			  unsigned int blocksize);
 typedef void (*freeblDestroyFunc)(void *cx, PRBool freeit);
 
 SEC_BEGIN_PROTOS
 
-SECStatus BL_FIPSEntryOK(PRBool freeblOnly);
-PRBool BL_POSTRan(PRBool freeblOnly);
-
 #if defined(XP_UNIX) && !defined(NO_FORK_CHECK)
 
 extern PRBool bl_parentForkedAfterC_Initialize;
 
 #define SKIP_AFTER_FORK(x) if (!bl_parentForkedAfterC_Initialize) x
 
 #else
 
deleted file mode 100644
--- a/security/nss/lib/freebl/blname.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- *  * blname.c - determine the freebl library name.
- *   *
- *    * This Source Code Form is subject to the terms of the Mozilla Public
- *     * License, v. 2.0. If a copy of the MPL was not distributed with this
- *      * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#if defined(FREEBL_LOWHASH)
-static const char* default_name =
-    SHLIB_PREFIX"freeblpriv"SHLIB_VERSION"."SHLIB_SUFFIX;
-#else
-static const char* default_name =
-    SHLIB_PREFIX"freebl"SHLIB_VERSION"."SHLIB_SUFFIX;
-#endif
-
-/* getLibName() returns the name of the library to load. */
-
-#if defined(SOLARIS) && defined(__sparc)
-#include <stddef.h>
-#include <strings.h>
-#include <sys/systeminfo.h>
-
-
-#if defined(NSS_USE_64)
-
-const static char fpu_hybrid_shared_lib[] = "libfreebl_64fpu_3.so";
-const static char int_hybrid_shared_lib[] = "libfreebl_64int_3.so";
-const static char non_hybrid_shared_lib[] = "libfreebl_64fpu_3.so";
-
-const static char int_hybrid_isa[] = "sparcv9";
-const static char fpu_hybrid_isa[] = "sparcv9+vis";
-
-#else
-
-const static char fpu_hybrid_shared_lib[] = "libfreebl_32fpu_3.so";
-const static char int_hybrid_shared_lib[] = "libfreebl_32int64_3.so";
-/* This was for SPARC V8, now obsolete. */
-const static char *const non_hybrid_shared_lib = NULL;
-
-const static char int_hybrid_isa[] = "sparcv8plus";
-const static char fpu_hybrid_isa[] = "sparcv8plus+vis";
-
-#endif
-
-static const char *
-getLibName(void)
-{
-    char * found_int_hybrid;
-    char * found_fpu_hybrid;
-    long buflen;
-    char buf[256];
-
-    buflen = sysinfo(SI_ISALIST, buf, sizeof buf);
-    if (buflen <= 0) 
-	return NULL;
-    /* sysinfo output is always supposed to be NUL terminated, but ... */
-    if (buflen < sizeof buf) 
-    	buf[buflen] = '\0';
-    else
-    	buf[(sizeof buf) - 1] = '\0';
-    /* The ISA list is a space separated string of names of ISAs and
-     * ISA extensions, in order of decreasing performance.
-     * There are two different ISAs with which NSS's crypto code can be
-     * accelerated. If both are in the list, we take the first one.
-     * If one is in the list, we use it, and if neither then we use
-     * the base unaccelerated code.
-     */
-    found_int_hybrid = strstr(buf, int_hybrid_isa);
-    found_fpu_hybrid = strstr(buf, fpu_hybrid_isa);
-    if (found_fpu_hybrid && 
-	(!found_int_hybrid ||
-	 (found_int_hybrid - found_fpu_hybrid) >= 0)) {
-	return fpu_hybrid_shared_lib;
-    }
-    if (found_int_hybrid) {
-	return int_hybrid_shared_lib;
-    }
-    return non_hybrid_shared_lib;
-}
-
-#elif defined(HPUX) && !defined(NSS_USE_64) && !defined(__ia64)
-#include <unistd.h>
-
-/* This code tests to see if we're running on a PA2.x CPU.
-** It returns true (1) if so, and false (0) otherwise.
-*/
-static const char *
-getLibName(void)
-{
-    long cpu = sysconf(_SC_CPU_VERSION);
-    return (cpu == CPU_PA_RISC2_0) 
-		? "libfreebl_32fpu_3.sl"
-	        : "libfreebl_32int_3.sl" ;
-}
-#else
-/* default case, for platforms/ABIs that have only one freebl shared lib. */
-static const char * getLibName(void) { return default_name; }
-#endif
--- a/security/nss/lib/freebl/ctr.c
+++ b/security/nss/lib/freebl/ctr.c
@@ -25,31 +25,26 @@ CTR_InitContext(CTRContext *ctr, void *c
 
     if (ctrParams->ulCounterBits == 0 ||
 	ctrParams->ulCounterBits > blocksize * PR_BITS_PER_BYTE) {
 	PORT_SetError(SEC_ERROR_INVALID_ARGS);
 	return SECFailure;
     }
 
     /* Invariant: 0 < ctr->bufPtr <= blocksize */
-    ctr->checkWrap = PR_FALSE;
     ctr->bufPtr = blocksize; /* no unused data in the buffer */
     ctr->cipher = cipher;
     ctr->context = context;
     ctr->counterBits = ctrParams->ulCounterBits;
     if (blocksize > sizeof(ctr->counter) ||
 	blocksize > sizeof(ctrParams->cb)) {
 	PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
 	return SECFailure;
     }
     PORT_Memcpy(ctr->counter, ctrParams->cb, blocksize);
-    if (ctr->counterBits < 64) {
-	PORT_Memcpy(ctr->counterFirst, ctr->counter, blocksize);
-	ctr->checkWrap = PR_TRUE;
-    }
     return SECSuccess;
 }
 
 CTRContext *
 CTR_CreateContext(void *context, freeblCipherFunc cipher,
 		  const unsigned char *param, unsigned int blocksize)
 {
     CTRContext *ctr;
@@ -147,43 +142,31 @@ CTR_Update(CTRContext *ctr, unsigned cha
 	}
 	PORT_Assert(ctr->bufPtr == blocksize);
     }
 
     while (inlen >= blocksize) {
 	rv = (*ctr->cipher)(ctr->context, ctr->buffer, &tmp, blocksize,
 			ctr->counter, blocksize, blocksize);
 	ctr_GetNextCtr(ctr->counter, ctr->counterBits, blocksize);
-	if (ctr->checkWrap) {
-	    if (PORT_Memcmp(ctr->counter, ctr->counterFirst, blocksize) == 0) {
-		PORT_SetError(SEC_ERROR_INVALID_ARGS);
-		return SECFailure;
-	    }
-	}
 	if (rv != SECSuccess) {
 	    return SECFailure;
 	}
 	ctr_xor(outbuf, inbuf, ctr->buffer, blocksize);
 	outbuf += blocksize;
 	inbuf += blocksize;
 	*outlen += blocksize;
 	inlen -= blocksize;
     }
     if (inlen == 0) {
 	return SECSuccess;
     }
     rv = (*ctr->cipher)(ctr->context, ctr->buffer, &tmp, blocksize,
 			ctr->counter, blocksize, blocksize);
     ctr_GetNextCtr(ctr->counter, ctr->counterBits, blocksize);
-    if (ctr->checkWrap) {
-	if (PORT_Memcmp(ctr->counter, ctr->counterFirst, blocksize) == 0) {
-	    PORT_SetError(SEC_ERROR_INVALID_ARGS);
-	    return SECFailure;
-	}
-    }
     if (rv != SECSuccess) {
 	return SECFailure;
     }
     ctr_xor(outbuf, inbuf, ctr->buffer, inlen);
     ctr->bufPtr = inlen;
     *outlen += inlen;
     return SECSuccess;
 }
--- a/security/nss/lib/freebl/ctr.h
+++ b/security/nss/lib/freebl/ctr.h
@@ -9,18 +9,16 @@
 
 /* This structure is defined in this header because both ctr.c and gcm.c
  * need it. */
 struct CTRContextStr {
    freeblCipherFunc cipher;
    void *context;
    unsigned char counter[MAX_BLOCK_SIZE];
    unsigned char buffer[MAX_BLOCK_SIZE];
-   unsigned char counterFirst[MAX_BLOCK_SIZE];  /* counter overlfow value */
-   PRBool checkWrap;				/*check for counter overflow*/
    unsigned long counterBits;
    unsigned int bufPtr;
 };
 
 typedef struct CTRContextStr CTRContext;
 
 SECStatus CTR_InitContext(CTRContext *ctr, void *context,
 			freeblCipherFunc cipher, const unsigned char *param,
--- a/security/nss/lib/freebl/cts.c
+++ b/security/nss/lib/freebl/cts.c
@@ -92,17 +92,16 @@ CTS_EncryptUpdate(CTSContext *cts, unsig
 		unsigned int *outlen, unsigned int maxout,
 		const unsigned char *inbuf, unsigned int inlen,
 		unsigned int blocksize)
 {
     unsigned char lastBlock[MAX_BLOCK_SIZE];
     unsigned int tmp;
     int fullblocks;
     int written;
-    unsigned char *saveout = outbuf;
     SECStatus rv;
 
     if (inlen < blocksize) {
 	PORT_SetError(SEC_ERROR_INPUT_LEN);
 	return SECFailure;
     }
 
     if (maxout < inlen) {
@@ -137,18 +136,16 @@ CTS_EncryptUpdate(CTSContext *cts, unsig
      * below */
     PORT_Memcpy(lastBlock, inbuf, inlen);
     PORT_Memset(lastBlock + inlen, 0, blocksize - inlen);
     rv = (*cts->cipher)(cts->context, outbuf, &tmp, maxout, lastBlock,
 			blocksize, blocksize);
     PORT_Memset(lastBlock, 0, blocksize);
     if (rv == SECSuccess) {
 	*outlen = written + blocksize;
-    } else {
-	PORT_Memset(saveout, 0, written+blocksize);
     }
     return rv;
 }
 
 
 #define XOR_BLOCK(x,y,count) for(i=0; i < count; i++) x[i] = x[i] ^ y[i]
 
 /*
@@ -182,17 +179,16 @@ CTS_DecryptUpdate(CTSContext *cts, unsig
 		unsigned int blocksize)
 {
     unsigned char *Pn;
     unsigned char Cn_2[MAX_BLOCK_SIZE]; /* block Cn-2 */
     unsigned char Cn_1[MAX_BLOCK_SIZE]; /* block Cn-1 */
     unsigned char Cn[MAX_BLOCK_SIZE];   /* block Cn   */
     unsigned char lastBlock[MAX_BLOCK_SIZE];
     const unsigned char *tmp;
-    unsigned char *saveout = outbuf;
     unsigned int tmpLen;
     unsigned int fullblocks, pad;
     unsigned int i;
     SECStatus rv;
 
     if (inlen < blocksize) {
 	PORT_SetError(SEC_ERROR_INPUT_LEN);
 	return SECFailure;
@@ -279,18 +275,16 @@ CTS_DecryptUpdate(CTSContext *cts, unsig
     /* copy Cn-1* into last buf to recover Cn-1 */
     PORT_Memcpy(lastBlock, Cn_1, inlen);
     /* note: because Cn and Cn-1 were out of order, our pointer to Pn also
      * points to where Pn-1 needs to reside. From here on out read Pn in
      * the code as really Pn-1. */
     rv = (*cts->cipher)(cts->context, Pn, &tmpLen, blocksize, lastBlock,
 	 blocksize, blocksize);
     if (rv != SECSuccess) {
-	PORT_Memset(lastBlock, 0, blocksize);
-	PORT_Memset(saveout, 0, *outlen);
 	return SECFailure;
     }
     /* make up for the out of order CBC decryption */
     XOR_BLOCK(Pn, Cn_2, blocksize);
     XOR_BLOCK(Pn, Cn, blocksize);
     /* reset iv to Cn  */
     PORT_Memcpy(cts->iv, Cn, blocksize);
     /* This makes Cn the last block for the next decrypt operation, which
--- a/security/nss/lib/freebl/dh.c
+++ b/security/nss/lib/freebl/dh.c
@@ -168,38 +168,36 @@ DH_NewKey(DHParams *params, DHPrivateKey
     CHECK_SEC_OK( SECITEM_CopyItem(arena, &key->prime, &params->prime) );
     SECITEM_TO_MPINT(key->prime, &p);
     /* Set private key's g */
     CHECK_SEC_OK( SECITEM_CopyItem(arena, &key->base, &params->base) );
     SECITEM_TO_MPINT(key->base, &g);
     /* Generate private key xa */
     SECITEM_AllocItem(arena, &key->privateValue,
                       dh_GetSecretKeyLen(params->prime.len));
-    CHECK_SEC_OK(RNG_GenerateGlobalRandomBytes(key->privateValue.data, 
-                                  key->privateValue.len));
+    RNG_GenerateGlobalRandomBytes(key->privateValue.data, 
+                                  key->privateValue.len);
     SECITEM_TO_MPINT( key->privateValue, &xa );
     /* xa < p */
     CHECK_MPI_OK( mp_mod(&xa, &p, &xa) );
     /* Compute public key Ya = g ** xa mod p */
     CHECK_MPI_OK( mp_exptmod(&g, &xa, &p, &Ya) );
     MPINT_TO_SECITEM(&Ya, &key->publicValue, key->arena);
     *privKey = key;
 cleanup:
     mp_clear(&g);
     mp_clear(&xa);
     mp_clear(&p);
     mp_clear(&Ya);
     if (err) {
 	MP_TO_SEC_ERROR(err);
 	rv = SECFailure;
     }
-    if (rv) {
-	*privKey = NULL;
+    if (rv)
 	PORT_FreeArena(arena, PR_TRUE);
-    }
     return rv;
 }
 
 SECStatus 
 DH_Derive(SECItem *publicValue, 
           SECItem *prime, 
           SECItem *privateValue, 
           SECItem *derivedSecret, 
@@ -269,37 +267,30 @@ DH_Derive(SECItem *publicValue,
     if (mp_cmp_d(&ZZ, 1) == 0 ||
         mp_cmp(&ZZ, &psub1) == 0) {
         err = MP_BADARG;
         goto cleanup;
     }
 
     /* allocate a buffer which can hold the entire derived secret. */
     secret = PORT_Alloc(len);
-    if (secret == NULL) {
-	err = MP_MEM;
-	goto cleanup;
-    }
     /* grab the derived secret */
     err = mp_to_unsigned_octets(&ZZ, secret, len);
     if (err >= 0) err = MP_OKAY;
     /* 
     ** if outBytes is 0 take all of the bytes from the derived secret.
     ** if outBytes is not 0 take exactly outBytes from the derived secret, zero
     ** pad at the beginning if necessary, and truncate beginning bytes 
     ** if necessary.
     */
     if (outBytes > 0)
 	nb = outBytes;
     else
 	nb = len;
-    if (SECITEM_AllocItem(NULL, derivedSecret, nb)  == NULL) {
-	err = MP_MEM;
-	goto cleanup;
-    }
+    SECITEM_AllocItem(NULL, derivedSecret, nb);
     if (len < nb) {
 	unsigned int offset = nb - len;
 	memset(derivedSecret->data, 0, offset);
 	memcpy(derivedSecret->data + offset, secret, len);
     } else {
 	memcpy(derivedSecret->data, secret + len - nb, nb);
     }
 cleanup:
@@ -364,29 +355,21 @@ KEA_Derive(SECItem *prime,
     CHECK_MPI_OK( mp_exptmod(&Y, &r, &p, &t) );
     /* u = DH(R, x, p) = R ** x mod p */
     CHECK_MPI_OK( mp_exptmod(&R, &x, &p, &u) );
     /* w = (t + u) mod p */
     CHECK_MPI_OK( mp_addmod(&t, &u, &p, &w) );
     /* allocate a buffer for the full derived secret */
     len = mp_unsigned_octet_size(&w);
     secret = PORT_Alloc(len);
-    if (secret == NULL) {
-	err = MP_MEM;
-	goto cleanup;
-    }
     /* grab the secret */
     err = mp_to_unsigned_octets(&w, secret, len);
     if (err > 0) err = MP_OKAY;
     /* allocate output buffer */
-    if (SECITEM_AllocItem(NULL, derivedSecret, KEA_DERIVED_SECRET_LEN)
-								  == NULL) {
-	err = MP_MEM;
-	goto cleanup;
-    }
+    SECITEM_AllocItem(NULL, derivedSecret, KEA_DERIVED_SECRET_LEN);
     memset(derivedSecret->data, 0, derivedSecret->len);
     /* copy in the 128 lsb of the secret */
     if (len >= KEA_DERIVED_SECRET_LEN) {
 	memcpy(derivedSecret->data, secret + (len - KEA_DERIVED_SECRET_LEN),
 	       KEA_DERIVED_SECRET_LEN);
     } else {
 	offset = KEA_DERIVED_SECRET_LEN - len;
 	memcpy(derivedSecret->data + offset, secret, len);
@@ -399,18 +382,16 @@ cleanup:
     mp_clear(&x);
     mp_clear(&t);
     mp_clear(&u);
     mp_clear(&w);
     if (secret)
 	PORT_ZFree(secret, len);
     if (err) {
 	MP_TO_SEC_ERROR(err);
-	if (derivedSecret->data) 
-	    PORT_ZFree(derivedSecret->data, derivedSecret->len);
 	return SECFailure;
     }
     return SECSuccess;
 }
 
 PRBool 
 KEA_Verify(SECItem *Y, SECItem *prime, SECItem *subPrime)
 {
--- a/security/nss/lib/freebl/drbg.c
+++ b/security/nss/lib/freebl/drbg.c
@@ -71,17 +71,17 @@ struct RNGContextStr {
      * immediately after V_type to avoid extra copies. To accomplish this
      * in a way that compiliers can't perturb, we declare V_type and V
      * as a V_Data array and reference them by macros */
     PRUint8  V_Data[PRNG_SEEDLEN+1]; /* internal state variables */
 #define  V_type  V_Data[0]
 #define  V(rng)       (((rng)->V_Data)+1)
 #define  VSize(rng)   ((sizeof (rng)->V_Data) -1)
     PRUint8  C[PRNG_SEEDLEN];        /* internal state variables */
-    PRUint8  lastOutput[SHA256_LENGTH];     /* for continuous rng checking */
+    PRUint8  oldV[PRNG_SEEDLEN];     /* for continuous rng checking */
     /* If we get calls for the PRNG to return less than the length of our
      * hash, we extend the request for a full hash (since we'll be doing
      * the full hash anyway). Future requests for random numbers are fulfilled
      * from the remainder of the bytes we generated. Requests for bytes longer
      * than the hash size are fulfilled directly from the HashGen function
      * of the random number generator. */
     PRUint8  reseed_counter[RESEED_BYTE+1]; /* number of requests since the 
 					     * last reseed. Need only be
@@ -281,47 +281,34 @@ prng_reseed_test(RNGContext *rng, const 
  *
  * This function is specified in NIST SP 800-90 section 10.1.1.4, Hashgen
  */
 static void
 prng_Hashgen(RNGContext *rng, PRUint8 *returned_bytes, 
 	     unsigned int no_of_returned_bytes)
 {
     PRUint8 data[VSize(rng)];
-    PRUint8 thisHash[SHA256_LENGTH];
-    PRUint8 *lastHash = rng->lastOutput;
 
     PORT_Memcpy(data, V(rng), VSize(rng));
     while (no_of_returned_bytes) {
 	SHA256Context ctx;
 	unsigned int len;
 	unsigned int carry;
 
  	SHA256_Begin(&ctx);
  	SHA256_Update(&ctx, data, sizeof data);
-	SHA256_End(&ctx, thisHash, &len, SHA256_LENGTH);
-	if (PORT_Memcmp(lastHash, thisHash, len) == 0) {
-	    rng->isValid = PR_FALSE;
-	    break;
-	}
-	if (no_of_returned_bytes < SHA256_LENGTH) {
-	    len = no_of_returned_bytes;
-	}
-	PORT_Memcpy(returned_bytes, thisHash, len);
-	lastHash = returned_bytes;
+	SHA256_End(&ctx, returned_bytes, &len, no_of_returned_bytes);
 	returned_bytes += len;
 	no_of_returned_bytes -= len;
 	/* The carry parameter is a bool (increment or not). 
 	 * This increments data if no_of_returned_bytes is not zero */
         carry = no_of_returned_bytes;
 	PRNG_ADD_CARRY_ONLY(data, (sizeof data)- 1, carry);
     }
-    PORT_Memcpy(rng->lastOutput, thisHash, SHA256_LENGTH);
     PORT_Memset(data, 0, sizeof data); 
-    PORT_Memset(thisHash, 0, sizeof thisHash); 
 }
 
 /* 
  * Generates new random bytes and advances the internal prng state.	
  * additional bytes are only used in algorithm testing.
  * 
  * This function is specified in NIST SP 800-90 section 10.1.1.4
  */
@@ -355,42 +342,38 @@ prng_generateNewBytes(RNGContext *rng,
  	SHA256_Update(&ctx, additional_input, additional_input_len);
 	SHA256_End(&ctx, w, NULL, sizeof w);
 	PRNG_ADD_BITS_AND_CARRY(V(rng), VSize(rng), w, sizeof w, carry)
 	PORT_Memset(w, 0, sizeof w);
 #undef w 
     }
 
     if (no_of_returned_bytes == SHA256_LENGTH) {
-	/* short_cut to hashbuf and a couple of copies and clears */
+	/* short_cut to hashbuf and save a copy and a clear */
 	SHA256_HashBuf(returned_bytes, V(rng), VSize(rng) );
-	/* continuous rng check */
-	if (memcmp(rng->lastOutput, returned_bytes, SHA256_LENGTH) == 0) {
-	    rng->isValid = PR_FALSE;
-	}
-	PORT_Memcpy(rng->lastOutput, returned_bytes, sizeof rng->lastOutput);
     } else {
     	prng_Hashgen(rng, returned_bytes, no_of_returned_bytes);
     }
     /* advance our internal state... */
     rng->V_type = prngGenerateByteType;
     SHA256_HashBuf(H, rng->V_Data, sizeof rng->V_Data);
     PRNG_ADD_BITS_AND_CARRY(V(rng), VSize(rng), H, sizeof H, carry)
     PRNG_ADD_BITS(V(rng), VSize(rng), rng->C, sizeof rng->C, carry);
     PRNG_ADD_BITS_AND_CARRY(V(rng), VSize(rng), rng->reseed_counter, 
 					sizeof rng->reseed_counter, carry)
     carry = 1;
     PRNG_ADD_CARRY_ONLY(rng->reseed_counter,(sizeof rng->reseed_counter)-1, carry);
 
-    /* if the prng failed, don't return any output, signal softoken */
-    if (!rng->isValid) {
-	PORT_Memset(returned_bytes, 0,  no_of_returned_bytes);
+    /* continuous rng check */
+    if (memcmp(V(rng), rng->oldV, sizeof rng->oldV) == 0) {
+	rng->isValid = PR_FALSE;
 	PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
 	return SECFailure;
     }
+    PORT_Memcpy(rng->oldV, V(rng), sizeof rng->oldV);
     return SECSuccess;
 }
 
 /* Use NSPR to prevent RNG_RNGInit from being called from separate
  * threads, creating a race condition.
  */
 static const PRCallOnceType pristineCallOnce;
 static PRCallOnceType coRNGInit;
--- a/security/nss/lib/freebl/ec.c
+++ b/security/nss/lib/freebl/ec.c
@@ -56,26 +56,26 @@ ec_points_mul(const ECParams *params, co
     char mpstr[256];
 
     printf("ec_points_mul: params [len=%d]:", params->DEREncoding.len);
     for (i = 0; i < params->DEREncoding.len; i++) 
 	    printf("%02x:", params->DEREncoding.data[i]);
     printf("\n");
 
 	if (k1 != NULL) {
-		mp_tohex((mp_int*)k1, mpstr);
+		mp_tohex(k1, mpstr);
 		printf("ec_points_mul: scalar k1: %s\n", mpstr);
-		mp_todecimal((mp_int*)k1, mpstr);
+		mp_todecimal(k1, mpstr);
 		printf("ec_points_mul: scalar k1: %s (dec)\n", mpstr);
 	}
 
 	if (k2 != NULL) {
-		mp_tohex((mp_int*)k2, mpstr);
+		mp_tohex(k2, mpstr);
 		printf("ec_points_mul: scalar k2: %s\n", mpstr);
-		mp_todecimal((mp_int*)k2, mpstr);
+		mp_todecimal(k2, mpstr);
 		printf("ec_points_mul: scalar k2: %s (dec)\n", mpstr);
 	}
 
 	if (pointP != NULL) {
 		printf("ec_points_mul: pointP [len=%d]:", pointP->len);
 		for (i = 0; i < pointP->len; i++) 
 			printf("%02x:", pointP->data[i]);
 		printf("\n");
@@ -371,17 +371,17 @@ cleanup:
     mp_clear(&privKeyVal);
     mp_clear(&order_1);
     mp_clear(&one);
     if (err < MP_OKAY) {
 	MP_TO_SEC_ERROR(err);
 	rv = SECFailure;
     }
     if (rv != SECSuccess && privKeyBytes) {
-	PORT_ZFree(privKeyBytes,2*len);
+	PORT_Free(privKeyBytes);
 	privKeyBytes = NULL;
     }
     return privKeyBytes;
 }
 #endif /* NSS_DISABLE_ECC */
 
 /* Generates a new EC key pair. The private key is a random value and
  * the public key is the result of performing a scalar point multiplication
@@ -1070,17 +1070,17 @@ cleanup:
     mp_clear(&s_);
     mp_clear(&c);
     mp_clear(&u1);
     mp_clear(&u2);
     mp_clear(&x1);
     mp_clear(&v);
     mp_clear(&n);
 
-    if (pointC.data) SECITEM_ZfreeItem(&pointC, PR_FALSE);
+    if (pointC.data) SECITEM_FreeItem(&pointC, PR_FALSE);
     if (err) {
 	MP_TO_SEC_ERROR(err);
 	rv = SECFailure;
     }
 
 #if EC_DEBUG
     printf("ECDSA verification %s\n",
 	(rv == SECSuccess) ? "succeeded" : "failed");
--- a/security/nss/lib/freebl/ecl/ecp_fpinc.c
+++ b/security/nss/lib/freebl/ecl/ecp_fpinc.c
@@ -1,19 +1,19 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /* This source file is meant to be included by other source files
  * (ecp_fp###.c, where ### is one of 160, 192, 224) and should not
  * constitute an independent compilation unit. It requires the following
- * preprocessor definitions be made:
- * ECFP_BSIZE - the number of bits in the field's prime
+ * preprocessor definitions be made: ECFP_BSIZE - the number of bits in
+ * the field's prime 
  * ECFP_NUMDOUBLES - the number of doubles to store one
- * multi-precision integer in floating point */
+ * multi-precision integer in floating point 
 
 /* Adds a prefix to a given token to give a unique token name. Prefixes
  * with "ecfp" + ECFP_BSIZE + "_". e.g. if ECFP_BSIZE = 160, then
  * PREFIX(hello) = ecfp160_hello This optimization allows static function
  * linking and compiler loop unrolling without code duplication. */
 #ifndef PREFIX
 #define PREFIX(b) PREFIX1(ECFP_BSIZE, b)
 #define PREFIX1(bsize, b) PREFIX2(bsize, b)
deleted file mode 100644
--- a/security/nss/lib/freebl/fipsfreebl.c
+++ /dev/null
@@ -1,1774 +0,0 @@
-/*
- * PKCS #11 FIPS Power-Up Self Test.
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-/* $Id: fipstest.c,v 1.31 2012/06/28 17:55:06 rrelyea%redhat.com Exp $ */
-
-#ifdef FREEBL_NO_DEPEND
-#include "stubs.h"
-#endif
-
-#include "blapi.h"
-#include "seccomon.h"   /* Required for RSA and DSA. */
-#include "secerr.h"
-#include "prtypes.h"
-
-#ifdef NSS_ENABLE_ECC
-#include "ec.h"         /* Required for ECDSA */
-#endif
-
-/*
- * different platforms have different ways of calling and initial entry point
- * when the dll/.so is loaded. Most platforms support either a posix pragma
- * or the GCC attribute. Some platforms suppor a pre-defined name, and some
- * platforms have a link line way of invoking this function.
- */
-
-/* The pragma */
-#if defined(USE_INIT_PRAGMA)
-#pragma init(bl_startup_tests)
-#endif
-
-
-/* GCC Attribute */
-#if defined(__GNUC__) && !defined(NSS_NO_INIT_SUPPORT)
-#define INIT_FUNCTION __attribute__((constructor))
-#else
-#define INIT_FUNCTION
-#endif
-
-static void INIT_FUNCTION bl_startup_tests(void);
-
-
-/* Windows pre-defined entry */
-#if defined(XP_WIN) && !defined(NSS_NO_INIT_SUPPORT)
-#include <windows.h>
-
-BOOL WINAPI DllMain(
-    HINSTANCE hinstDLL,  // handle to DLL module
-    DWORD fdwReason,     // reason for calling function
-    LPVOID lpReserved )  // reserved
-{
-    // Perform actions based on the reason for calling.
-    switch( fdwReason ) 
-    { 
-        case DLL_PROCESS_ATTACH:
-         // Initialize once for each new process.
-         // Return FALSE to fail DLL load.
-	bl_startup_tests();
-            break;
-
-        case DLL_THREAD_ATTACH:
-         // Do thread-specific initialization.
-            break;
-
-        case DLL_THREAD_DETACH:
-         // Do thread-specific cleanup.
-            break;
-
-        case DLL_PROCESS_DETACH:
-         // Perform any necessary cleanup.
-            break;
-    }
-    return TRUE;  // Successful DLL_PROCESS_ATTACH.
-}
-#endif
-
-/* insert other platform dependent init entry points here, or modify
- * the linker line */
-
-
-/* FIPS preprocessor directives for RC2-ECB and RC2-CBC.        */
-#define FIPS_RC2_KEY_LENGTH                      5  /*  40-bits */
-#define FIPS_RC2_ENCRYPT_LENGTH                  8  /*  64-bits */
-#define FIPS_RC2_DECRYPT_LENGTH                  8  /*  64-bits */
-
-
-/* FIPS preprocessor directives for RC4.                        */
-#define FIPS_RC4_KEY_LENGTH                      5  /*  40-bits */
-#define FIPS_RC4_ENCRYPT_LENGTH                  8  /*  64-bits */
-#define FIPS_RC4_DECRYPT_LENGTH                  8  /*  64-bits */
-
-
-/* FIPS preprocessor directives for DES-ECB and DES-CBC.        */
-#define FIPS_DES_ENCRYPT_LENGTH                  8  /*  64-bits */
-#define FIPS_DES_DECRYPT_LENGTH                  8  /*  64-bits */
-
-
-/* FIPS preprocessor directives for DES3-CBC and DES3-ECB.      */
-#define FIPS_DES3_ENCRYPT_LENGTH                 8  /*  64-bits */
-#define FIPS_DES3_DECRYPT_LENGTH                 8  /*  64-bits */
-
-
-/* FIPS preprocessor directives for AES-ECB and AES-CBC.        */
-#define FIPS_AES_BLOCK_SIZE                     16  /* 128-bits */
-#define FIPS_AES_ENCRYPT_LENGTH                 16  /* 128-bits */
-#define FIPS_AES_DECRYPT_LENGTH                 16  /* 128-bits */
-#define FIPS_AES_128_KEY_SIZE                   16  /* 128-bits */
-#define FIPS_AES_192_KEY_SIZE                   24  /* 192-bits */
-#define FIPS_AES_256_KEY_SIZE                   32  /* 256-bits */
-
-
-/* FIPS preprocessor directives for message digests             */
-#define FIPS_KNOWN_HASH_MESSAGE_LENGTH          64  /* 512-bits */
-
-
-/* FIPS preprocessor directives for RSA.                         */
-#define FIPS_RSA_TYPE                           siBuffer
-#define FIPS_RSA_PUBLIC_EXPONENT_LENGTH           3 /*   24-bits */
-#define FIPS_RSA_PRIVATE_VERSION_LENGTH           1 /*    8-bits */
-#define FIPS_RSA_MESSAGE_LENGTH                 256 /* 2048-bits */
-#define FIPS_RSA_COEFFICIENT_LENGTH             128 /* 1024-bits */
-#define FIPS_RSA_PRIME0_LENGTH                  128 /* 1024-bits */
-#define FIPS_RSA_PRIME1_LENGTH                  128 /* 1024-bits */
-#define FIPS_RSA_EXPONENT0_LENGTH               128 /* 1024-bits */
-#define FIPS_RSA_EXPONENT1_LENGTH               128 /* 1024-bits */
-#define FIPS_RSA_PRIVATE_EXPONENT_LENGTH        256 /* 2048-bits */
-#define FIPS_RSA_ENCRYPT_LENGTH                 256 /* 2048-bits */
-#define FIPS_RSA_DECRYPT_LENGTH                 256 /* 2048-bits */
-#define FIPS_RSA_SIGNATURE_LENGTH               256 /* 2048-bits */
-#define FIPS_RSA_MODULUS_LENGTH                 256 /* 2048-bits */
-
-
-/* FIPS preprocessor directives for DSA.                        */
-#define FIPS_DSA_TYPE                           siBuffer
-#define FIPS_DSA_DIGEST_LENGTH                  20 /*  160-bits */
-#define FIPS_DSA_SUBPRIME_LENGTH                20 /*  160-bits */
-#define FIPS_DSA_SIGNATURE_LENGTH               40 /*  320-bits */
-#define FIPS_DSA_PRIME_LENGTH                  128 /* 1024-bits */
-#define FIPS_DSA_BASE_LENGTH                   128 /* 1024-bits */
-
-/* FIPS preprocessor directives for RNG.                        */
-#define FIPS_RNG_XKEY_LENGTH                    32  /* 256-bits */
-
-static SECStatus
-freebl_fips_DES3_PowerUpSelfTest( void )
-{
-    /* DES3 Known Key (56-bits). */
-    static const PRUint8 des3_known_key[] = { "ANSI Triple-DES Key Data" };
-
-    /* DES3-CBC Known Initialization Vector (64-bits). */
-    static const PRUint8 des3_cbc_known_initialization_vector[] = { "Security" };
-
-    /* DES3 Known Plaintext (64-bits). */
-    static const PRUint8 des3_ecb_known_plaintext[] = { "Netscape" };
-    static const PRUint8 des3_cbc_known_plaintext[] = { "Netscape" };
-
-    /* DES3 Known Ciphertext (64-bits). */
-    static const PRUint8 des3_ecb_known_ciphertext[] = {
-			   0x55,0x8e,0xad,0x3c,0xee,0x49,0x69,0xbe};
-    static const PRUint8 des3_cbc_known_ciphertext[] = {
-			   0x43,0xdc,0x6a,0xc1,0xaf,0xa6,0x32,0xf5};
-
-    /* DES3 variables. */
-    PRUint8        des3_computed_ciphertext[FIPS_DES3_ENCRYPT_LENGTH];
-    PRUint8        des3_computed_plaintext[FIPS_DES3_DECRYPT_LENGTH];
-    DESContext *   des3_context;
-    unsigned int   des3_bytes_encrypted;
-    unsigned int   des3_bytes_decrypted;
-    SECStatus      des3_status;
-
-
-    /*******************************************************/
-    /* DES3-ECB Single-Round Known Answer Encryption Test. */
-    /*******************************************************/
-
-    des3_context = DES_CreateContext( des3_known_key, NULL,
-                                     NSS_DES_EDE3, PR_TRUE );
-
-    if( des3_context == NULL ) {
-        PORT_SetError( SEC_ERROR_NO_MEMORY ); 
-        return( SECFailure );
-    }
-
-    des3_status = DES_Encrypt( des3_context, des3_computed_ciphertext,
-                               &des3_bytes_encrypted, FIPS_DES3_ENCRYPT_LENGTH,
-                               des3_ecb_known_plaintext,
-                               FIPS_DES3_DECRYPT_LENGTH );
-
-    DES_DestroyContext( des3_context, PR_TRUE );
-
-    if( ( des3_status != SECSuccess ) ||
-        ( des3_bytes_encrypted != FIPS_DES3_ENCRYPT_LENGTH ) ||
-        ( PORT_Memcmp( des3_computed_ciphertext, des3_ecb_known_ciphertext,
-                       FIPS_DES3_ENCRYPT_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-
-    /*******************************************************/
-    /* DES3-ECB Single-Round Known Answer Decryption Test. */
-    /*******************************************************/
-
-    des3_context = DES_CreateContext( des3_known_key, NULL,
-                                     NSS_DES_EDE3, PR_FALSE );
-
-    if( des3_context == NULL ) {
-        PORT_SetError( SEC_ERROR_NO_MEMORY ); 
-        return( SECFailure );
-    }
-
-    des3_status = DES_Decrypt( des3_context, des3_computed_plaintext,
-                               &des3_bytes_decrypted, FIPS_DES3_DECRYPT_LENGTH,
-                               des3_ecb_known_ciphertext,
-                               FIPS_DES3_ENCRYPT_LENGTH );
-
-    DES_DestroyContext( des3_context, PR_TRUE );
-
-    if( ( des3_status != SECSuccess ) ||
-        ( des3_bytes_decrypted != FIPS_DES3_DECRYPT_LENGTH ) ||
-        ( PORT_Memcmp( des3_computed_plaintext, des3_ecb_known_plaintext,
-                       FIPS_DES3_DECRYPT_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-
-    /*******************************************************/
-    /* DES3-CBC Single-Round Known Answer Encryption Test. */
-    /*******************************************************/
-
-    des3_context = DES_CreateContext( des3_known_key,
-                                      des3_cbc_known_initialization_vector,
-                                      NSS_DES_EDE3_CBC, PR_TRUE );
-
-    if( des3_context == NULL ) {
-        PORT_SetError( SEC_ERROR_NO_MEMORY ); 
-        return( SECFailure );
-    }
-
-    des3_status = DES_Encrypt( des3_context, des3_computed_ciphertext,
-                               &des3_bytes_encrypted, FIPS_DES3_ENCRYPT_LENGTH,
-                               des3_cbc_known_plaintext,
-                               FIPS_DES3_DECRYPT_LENGTH );
-
-    DES_DestroyContext( des3_context, PR_TRUE );
-
-    if( ( des3_status != SECSuccess ) ||
-        ( des3_bytes_encrypted != FIPS_DES3_ENCRYPT_LENGTH ) ||
-        ( PORT_Memcmp( des3_computed_ciphertext, des3_cbc_known_ciphertext,
-                       FIPS_DES3_ENCRYPT_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-
-    /*******************************************************/
-    /* DES3-CBC Single-Round Known Answer Decryption Test. */
-    /*******************************************************/
-
-    des3_context = DES_CreateContext( des3_known_key,
-                                      des3_cbc_known_initialization_vector,
-                                      NSS_DES_EDE3_CBC, PR_FALSE );
-
-    if( des3_context == NULL ) {
-        PORT_SetError( SEC_ERROR_NO_MEMORY ); 
-        return( SECFailure );
-    }
-
-    des3_status = DES_Decrypt( des3_context, des3_computed_plaintext,
-                               &des3_bytes_decrypted, FIPS_DES3_DECRYPT_LENGTH,
-                               des3_cbc_known_ciphertext,
-                               FIPS_DES3_ENCRYPT_LENGTH );
-
-    DES_DestroyContext( des3_context, PR_TRUE );
-
-    if( ( des3_status != SECSuccess ) ||
-        ( des3_bytes_decrypted != FIPS_DES3_DECRYPT_LENGTH ) ||
-        ( PORT_Memcmp( des3_computed_plaintext, des3_cbc_known_plaintext,
-                       FIPS_DES3_DECRYPT_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    return( SECSuccess );
-}
-
-
-/* AES self-test for 128-bit, 192-bit, or 256-bit key sizes*/
-static SECStatus
-freebl_fips_AES_PowerUpSelfTest( int aes_key_size )
-{
-    /* AES Known Key (up to 256-bits). */
-    static const PRUint8 aes_known_key[] = 
-        { "AES-128 RIJNDAELLEADNJIR 821-SEA" };
-
-    /* AES-CBC Known Initialization Vector (128-bits). */
-    static const PRUint8 aes_cbc_known_initialization_vector[] = 
-        { "SecurityytiruceS" };
-
-    /* AES Known Plaintext (128-bits). (blocksize is 128-bits) */
-    static const PRUint8 aes_known_plaintext[] = { "NetscapeepacsteN" };
-
-    /* AES Known Ciphertext (128-bit key). */
-    static const PRUint8 aes_ecb128_known_ciphertext[] = {
-        0x3c,0xa5,0x96,0xf3,0x34,0x6a,0x96,0xc1,
-        0x03,0x88,0x16,0x7b,0x20,0xbf,0x35,0x47 };
-
-    static const PRUint8 aes_cbc128_known_ciphertext[]  = {
-        0xcf,0x15,0x1d,0x4f,0x96,0xe4,0x4f,0x63,
-        0x15,0x54,0x14,0x1d,0x4e,0xd8,0xd5,0xea };
-
-    /* AES Known Ciphertext (192-bit key). */
-    static const PRUint8 aes_ecb192_known_ciphertext[] = { 
-        0xa0,0x18,0x62,0xed,0x88,0x19,0xcb,0x62,
-        0x88,0x1d,0x4d,0xfe,0x84,0x02,0x89,0x0e };
-
-    static const PRUint8 aes_cbc192_known_ciphertext[]  = { 
-        0x83,0xf7,0xa4,0x76,0xd1,0x6f,0x07,0xbe,
-        0x07,0xbc,0x43,0x2f,0x6d,0xad,0x29,0xe1 };
-
-    /* AES Known Ciphertext (256-bit key). */
-    static const PRUint8 aes_ecb256_known_ciphertext[] = { 
-        0xdb,0xa6,0x52,0x01,0x8a,0x70,0xae,0x66,
-        0x3a,0x99,0xd8,0x95,0x7f,0xfb,0x01,0x67 };
-    
-    static const PRUint8 aes_cbc256_known_ciphertext[]  = { 
-        0x37,0xea,0x07,0x06,0x31,0x1c,0x59,0x27,
-        0xc5,0xc5,0x68,0x71,0x6e,0x34,0x40,0x16 };
-
-    const PRUint8 *aes_ecb_known_ciphertext =
-        ( aes_key_size == FIPS_AES_128_KEY_SIZE) ? aes_ecb128_known_ciphertext :
-        ( aes_key_size == FIPS_AES_192_KEY_SIZE) ? aes_ecb192_known_ciphertext :
-                                aes_ecb256_known_ciphertext;
-
-    const PRUint8 *aes_cbc_known_ciphertext =
-        ( aes_key_size == FIPS_AES_128_KEY_SIZE) ? aes_cbc128_known_ciphertext :
-        ( aes_key_size == FIPS_AES_192_KEY_SIZE) ? aes_cbc192_known_ciphertext :
-                                aes_cbc256_known_ciphertext;
-
-    /* AES variables. */
-    PRUint8        aes_computed_ciphertext[FIPS_AES_ENCRYPT_LENGTH];
-    PRUint8        aes_computed_plaintext[FIPS_AES_DECRYPT_LENGTH];
-    AESContext *   aes_context;
-    unsigned int   aes_bytes_encrypted;
-    unsigned int   aes_bytes_decrypted;
-    SECStatus      aes_status;
-
-    /*check if aes_key_size is 128, 192, or 256 bits */
-    if ((aes_key_size != FIPS_AES_128_KEY_SIZE) && 
-        (aes_key_size != FIPS_AES_192_KEY_SIZE) && 
-        (aes_key_size != FIPS_AES_256_KEY_SIZE))  {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    /******************************************************/
-    /* AES-ECB Single-Round Known Answer Encryption Test: */
-    /******************************************************/
-
-    aes_context = AES_CreateContext( aes_known_key, NULL, NSS_AES, PR_TRUE,
-                                     aes_key_size, FIPS_AES_BLOCK_SIZE );
-
-    if( aes_context == NULL ) {
-        PORT_SetError( SEC_ERROR_NO_MEMORY ); 
-        return( SECFailure );
-    }
-
-    aes_status = AES_Encrypt( aes_context, aes_computed_ciphertext,
-                              &aes_bytes_encrypted, FIPS_AES_ENCRYPT_LENGTH,
-                              aes_known_plaintext,
-                              FIPS_AES_DECRYPT_LENGTH );
-    
-    AES_DestroyContext( aes_context, PR_TRUE );
-
-    if( ( aes_status != SECSuccess ) ||
-        ( aes_bytes_encrypted != FIPS_AES_ENCRYPT_LENGTH ) ||
-        ( PORT_Memcmp( aes_computed_ciphertext, aes_ecb_known_ciphertext,
-                       FIPS_AES_ENCRYPT_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-
-    /******************************************************/
-    /* AES-ECB Single-Round Known Answer Decryption Test: */
-    /******************************************************/
-
-    aes_context = AES_CreateContext( aes_known_key, NULL, NSS_AES, PR_FALSE,
-                                     aes_key_size, FIPS_AES_BLOCK_SIZE );
-
-    if( aes_context == NULL ) {
-        PORT_SetError( SEC_ERROR_NO_MEMORY ); 
-        return( SECFailure );
-    }
-
-    aes_status = AES_Decrypt( aes_context, aes_computed_plaintext,
-                              &aes_bytes_decrypted, FIPS_AES_DECRYPT_LENGTH,
-                              aes_ecb_known_ciphertext,
-                              FIPS_AES_ENCRYPT_LENGTH );
-
-    AES_DestroyContext( aes_context, PR_TRUE );
-
-    if( ( aes_status != SECSuccess ) ||         
-        ( aes_bytes_decrypted != FIPS_AES_DECRYPT_LENGTH ) ||
-        ( PORT_Memcmp( aes_computed_plaintext, aes_known_plaintext,
-                       FIPS_AES_DECRYPT_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-
-    /******************************************************/
-    /* AES-CBC Single-Round Known Answer Encryption Test. */
-    /******************************************************/
-
-    aes_context = AES_CreateContext( aes_known_key,
-                                     aes_cbc_known_initialization_vector,
-                                     NSS_AES_CBC, PR_TRUE, aes_key_size, 
-                                     FIPS_AES_BLOCK_SIZE );
-
-    if( aes_context == NULL ) {
-        PORT_SetError( SEC_ERROR_NO_MEMORY ); 
-        return( SECFailure );
-    }
-
-    aes_status = AES_Encrypt( aes_context, aes_computed_ciphertext,
-                              &aes_bytes_encrypted, FIPS_AES_ENCRYPT_LENGTH,
-                              aes_known_plaintext,
-                              FIPS_AES_DECRYPT_LENGTH );
-
-    AES_DestroyContext( aes_context, PR_TRUE );
-
-    if( ( aes_status != SECSuccess ) ||
-        ( aes_bytes_encrypted != FIPS_AES_ENCRYPT_LENGTH ) ||
-        ( PORT_Memcmp( aes_computed_ciphertext, aes_cbc_known_ciphertext,
-                       FIPS_AES_ENCRYPT_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-
-    /******************************************************/
-    /* AES-CBC Single-Round Known Answer Decryption Test. */
-    /******************************************************/
-
-    aes_context = AES_CreateContext( aes_known_key,
-                                     aes_cbc_known_initialization_vector,
-                                     NSS_AES_CBC, PR_FALSE, aes_key_size, 
-                                     FIPS_AES_BLOCK_SIZE );
-
-    if( aes_context == NULL ) {
-        PORT_SetError( SEC_ERROR_NO_MEMORY ); 
-        return( SECFailure );
-    }
-
-    aes_status = AES_Decrypt( aes_context, aes_computed_plaintext,
-                              &aes_bytes_decrypted, FIPS_AES_DECRYPT_LENGTH,
-                              aes_cbc_known_ciphertext,
-                              FIPS_AES_ENCRYPT_LENGTH );
-
-    AES_DestroyContext( aes_context, PR_TRUE );
-
-    if( ( aes_status != SECSuccess ) ||
-        ( aes_bytes_decrypted != FIPS_AES_DECRYPT_LENGTH ) ||
-        ( PORT_Memcmp( aes_computed_plaintext, aes_known_plaintext,
-                       FIPS_AES_DECRYPT_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    return( SECSuccess );
-}
-
-/* Known Hash Message (512-bits).  Used for all hashes (incl. SHA-N [N>1]). */
-static const PRUint8 known_hash_message[] = {
-  "The test message for the MD2, MD5, and SHA-1 hashing algorithms." };
-
-/****************************************************/
-/* Single Round HMAC SHA-X test                     */
-/****************************************************/
-static SECStatus
-freebl_fips_HMAC(unsigned char *hmac_computed,
-               const PRUint8 *secret_key,
-               unsigned int secret_key_length,
-               const PRUint8 *message,
-               unsigned int message_length,
-               HASH_HashType hashAlg )
-{
-    SECStatus hmac_status = SECFailure;
-    HMACContext *cx = NULL;
-    SECHashObject *hashObj = NULL;
-    unsigned int bytes_hashed = 0;
-
-    hashObj = (SECHashObject *) HASH_GetRawHashObject(hashAlg);
- 
-    if (!hashObj) 
-        return( SECFailure );
-
-    cx = HMAC_Create(hashObj, secret_key, 
-                     secret_key_length, 
-                     PR_TRUE);  /* PR_TRUE for in FIPS mode */
-
-    if (cx == NULL) 
-        return( SECFailure );
-
-    HMAC_Begin(cx);
-    HMAC_Update(cx, message, message_length);
-    hmac_status = HMAC_Finish(cx, hmac_computed, &bytes_hashed, 
-                              hashObj->length);
-
-    HMAC_Destroy(cx, PR_TRUE);
-
-    return( hmac_status );
-}
-
-static SECStatus
-freebl_fips_HMAC_PowerUpSelfTest( void )
-{
-    static const PRUint8 HMAC_known_secret_key[] = {
-                         "Firefox and ThunderBird are awesome!"};
-
-    static const PRUint8 HMAC_known_secret_key_length 
-                         = sizeof HMAC_known_secret_key;
-
-    /* known SHA1 hmac (20 bytes) */
-    static const PRUint8 known_SHA1_hmac[] = {
-        0xd5, 0x85, 0xf6, 0x5b, 0x39, 0xfa, 0xb9, 0x05, 
-        0x3b, 0x57, 0x1d, 0x61, 0xe7, 0xb8, 0x84, 0x1e, 
-        0x5d, 0x0e, 0x1e, 0x11};
-
-    /* known SHA224 hmac (28 bytes) */
-    static const PRUint8 known_SHA224_hmac[] = {
-        0x1c, 0xc3, 0x06, 0x8e, 0xce, 0x37, 0x68, 0xfb, 
-        0x1a, 0x82, 0x4a, 0xbe, 0x2b, 0x00, 0x51, 0xf8,
-        0x9d, 0xb6, 0xe0, 0x90, 0x0d, 0x00, 0xc9, 0x64,
-        0x9a, 0xb8, 0x98, 0x4e};
-
-    /* known SHA256 hmac (32 bytes) */
-    static const PRUint8 known_SHA256_hmac[] = {
-        0x05, 0x75, 0x9a, 0x9e, 0x70, 0x5e, 0xe7, 0x44, 
-        0xe2, 0x46, 0x4b, 0x92, 0x22, 0x14, 0x22, 0xe0, 
-        0x1b, 0x92, 0x8a, 0x0c, 0xfe, 0xf5, 0x49, 0xe9, 
-        0xa7, 0x1b, 0x56, 0x7d, 0x1d, 0x29, 0x40, 0x48};        
-
-    /* known SHA384 hmac (48 bytes) */
-    static const PRUint8 known_SHA384_hmac[] = {
-        0xcd, 0x56, 0x14, 0xec, 0x05, 0x53, 0x06, 0x2b,
-        0x7e, 0x9c, 0x8a, 0x18, 0x5e, 0xea, 0xf3, 0x91,
-        0x33, 0xfb, 0x64, 0xf6, 0xe3, 0x9f, 0x89, 0x0b,
-        0xaf, 0xbe, 0x83, 0x4d, 0x3f, 0x3c, 0x43, 0x4d,
-        0x4a, 0x0c, 0x56, 0x98, 0xf8, 0xca, 0xb4, 0xaa,
-        0x9a, 0xf4, 0x0a, 0xaf, 0x4f, 0x69, 0xca, 0x87};
-
-    /* known SHA512 hmac (64 bytes) */
-    static const PRUint8 known_SHA512_hmac[] = {
-        0xf6, 0x0e, 0x97, 0x12, 0x00, 0x67, 0x6e, 0xb9,
-        0x0c, 0xb2, 0x63, 0xf0, 0x60, 0xac, 0x75, 0x62,
-        0x70, 0x95, 0x2a, 0x52, 0x22, 0xee, 0xdd, 0xd2,
-        0x71, 0xb1, 0xe8, 0x26, 0x33, 0xd3, 0x13, 0x27,
-        0xcb, 0xff, 0x44, 0xef, 0x87, 0x97, 0x16, 0xfb,
-        0xd3, 0x0b, 0x48, 0xbe, 0x12, 0x4e, 0xda, 0xb1,
-        0x89, 0x90, 0xfb, 0x06, 0x0c, 0xbe, 0xe5, 0xc4,
-        0xff, 0x24, 0x37, 0x3d, 0xc7, 0xe4, 0xe4, 0x37};
-
-    SECStatus    hmac_status;
-    PRUint8      hmac_computed[HASH_LENGTH_MAX]; 
-
-    /***************************************************/
-    /* HMAC SHA-1 Single-Round Known Answer HMAC Test. */
-    /***************************************************/
-
-    hmac_status = freebl_fips_HMAC(hmac_computed, 
-                                 HMAC_known_secret_key,
-                                 HMAC_known_secret_key_length,
-                                 known_hash_message,
-                                 FIPS_KNOWN_HASH_MESSAGE_LENGTH,
-                                 HASH_AlgSHA1); 
-
-    if( ( hmac_status != SECSuccess ) || 
-        ( PORT_Memcmp( hmac_computed, known_SHA1_hmac,
-                       SHA1_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    /***************************************************/
-    /* HMAC SHA-224 Single-Round Known Answer Test.    */
-    /***************************************************/
-
-    hmac_status = freebl_fips_HMAC(hmac_computed, 
-                                 HMAC_known_secret_key,
-                                 HMAC_known_secret_key_length,
-                                 known_hash_message,
-                                 FIPS_KNOWN_HASH_MESSAGE_LENGTH,
-                                 HASH_AlgSHA224);
-
-    if( ( hmac_status != SECSuccess ) || 
-        ( PORT_Memcmp( hmac_computed, known_SHA224_hmac,
-                       SHA224_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    /***************************************************/
-    /* HMAC SHA-256 Single-Round Known Answer Test.    */
-    /***************************************************/
-
-    hmac_status = freebl_fips_HMAC(hmac_computed, 
-                                 HMAC_known_secret_key,
-                                 HMAC_known_secret_key_length,
-                                 known_hash_message,
-                                 FIPS_KNOWN_HASH_MESSAGE_LENGTH,
-                                 HASH_AlgSHA256); 
-
-    if( ( hmac_status != SECSuccess ) || 
-        ( PORT_Memcmp( hmac_computed, known_SHA256_hmac,
-                       SHA256_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    /***************************************************/
-    /* HMAC SHA-384 Single-Round Known Answer Test.    */
-    /***************************************************/
-
-    hmac_status = freebl_fips_HMAC(hmac_computed,
-                                 HMAC_known_secret_key,
-                                 HMAC_known_secret_key_length,
-                                 known_hash_message,
-                                 FIPS_KNOWN_HASH_MESSAGE_LENGTH,
-                                 HASH_AlgSHA384);
-
-    if( ( hmac_status != SECSuccess ) ||
-        ( PORT_Memcmp( hmac_computed, known_SHA384_hmac,
-                       SHA384_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    /***************************************************/
-    /* HMAC SHA-512 Single-Round Known Answer Test.    */
-    /***************************************************/
-
-    hmac_status = freebl_fips_HMAC(hmac_computed,
-                                 HMAC_known_secret_key,
-                                 HMAC_known_secret_key_length,
-                                 known_hash_message,
-                                 FIPS_KNOWN_HASH_MESSAGE_LENGTH,
-                                 HASH_AlgSHA512);
-
-    if( ( hmac_status != SECSuccess ) ||
-        ( PORT_Memcmp( hmac_computed, known_SHA512_hmac,
-                       SHA512_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    return( SECSuccess );
-}
-
-static SECStatus
-freebl_fips_SHA_PowerUpSelfTest( void )
-{
-    /* SHA-1 Known Digest Message (160-bits). */
-    static const PRUint8 sha1_known_digest[] = {
-			       0x0a,0x6d,0x07,0xba,0x1e,0xbd,0x8a,0x1b,
-			       0x72,0xf6,0xc7,0x22,0xf1,0x27,0x9f,0xf0,
-			       0xe0,0x68,0x47,0x7a};
-
-    /* SHA-224 Known Digest Message (224-bits). */
-    static const PRUint8 sha224_known_digest[] = {
-        0x89,0x5e,0x7f,0xfd,0x0e,0xd8,0x35,0x6f,
-        0x64,0x6d,0xf2,0xde,0x5e,0xed,0xa6,0x7f, 
-        0x29,0xd1,0x12,0x73,0x42,0x84,0x95,0x4f, 
-        0x8e,0x08,0xe5,0xcb};
-
-    /* SHA-256 Known Digest Message (256-bits). */
-    static const PRUint8 sha256_known_digest[] = {
-        0x38,0xa9,0xc1,0xf0,0x35,0xf6,0x5d,0x61,
-        0x11,0xd4,0x0b,0xdc,0xce,0x35,0x14,0x8d,
-        0xf2,0xdd,0xaf,0xaf,0xcf,0xb7,0x87,0xe9,
-        0x96,0xa5,0xd2,0x83,0x62,0x46,0x56,0x79};
- 
-    /* SHA-384 Known Digest Message (384-bits). */
-    static const PRUint8 sha384_known_digest[] = {
-        0x11,0xfe,0x1c,0x00,0x89,0x48,0xde,0xb3,
-        0x99,0xee,0x1c,0x18,0xb4,0x10,0xfb,0xfe,
-        0xe3,0xa8,0x2c,0xf3,0x04,0xb0,0x2f,0xc8,
-        0xa3,0xc4,0x5e,0xea,0x7e,0x60,0x48,0x7b,
-        0xce,0x2c,0x62,0xf7,0xbc,0xa7,0xe8,0xa3,
-        0xcf,0x24,0xce,0x9c,0xe2,0x8b,0x09,0x72};
-
-    /* SHA-512 Known Digest Message (512-bits). */
-    static const PRUint8 sha512_known_digest[] = {
-        0xc8,0xb3,0x27,0xf9,0x0b,0x24,0xc8,0xbf,
-        0x4c,0xba,0x33,0x54,0xf2,0x31,0xbf,0xdb,
-        0xab,0xfd,0xb3,0x15,0xd7,0xfa,0x48,0x99,
-        0x07,0x60,0x0f,0x57,0x41,0x1a,0xdd,0x28,
-        0x12,0x55,0x25,0xac,0xba,0x3a,0x99,0x12,
-        0x2c,0x7a,0x8f,0x75,0x3a,0xe1,0x06,0x6f,
-        0x30,0x31,0xc9,0x33,0xc6,0x1b,0x90,0x1a,
-        0x6c,0x98,0x9a,0x87,0xd0,0xb2,0xf8,0x07};
-
-    /* SHA-X variables. */
-    PRUint8        sha_computed_digest[HASH_LENGTH_MAX];
-    SECStatus      sha_status;
-
-    /*************************************************/
-    /* SHA-1 Single-Round Known Answer Hashing Test. */
-    /*************************************************/
-
-    sha_status = SHA1_HashBuf( sha_computed_digest, known_hash_message,
-                                FIPS_KNOWN_HASH_MESSAGE_LENGTH );
- 
-    if( ( sha_status != SECSuccess ) ||
-        ( PORT_Memcmp( sha_computed_digest, sha1_known_digest,
-                       SHA1_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    /***************************************************/
-    /* SHA-224 Single-Round Known Answer Hashing Test. */
-    /***************************************************/
-
-    sha_status = SHA224_HashBuf( sha_computed_digest, known_hash_message,
-                                FIPS_KNOWN_HASH_MESSAGE_LENGTH );
-
-    if( ( sha_status != SECSuccess ) ||
-        ( PORT_Memcmp( sha_computed_digest, sha224_known_digest,
-                       SHA224_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    /***************************************************/
-    /* SHA-256 Single-Round Known Answer Hashing Test. */
-    /***************************************************/
-
-    sha_status = SHA256_HashBuf( sha_computed_digest, known_hash_message,
-                                FIPS_KNOWN_HASH_MESSAGE_LENGTH );
-
-    if( ( sha_status != SECSuccess ) ||
-        ( PORT_Memcmp( sha_computed_digest, sha256_known_digest,
-                       SHA256_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    /***************************************************/
-    /* SHA-384 Single-Round Known Answer Hashing Test. */
-    /***************************************************/
-
-    sha_status = SHA384_HashBuf( sha_computed_digest, known_hash_message,
-                                FIPS_KNOWN_HASH_MESSAGE_LENGTH );
-
-    if( ( sha_status != SECSuccess ) ||
-        ( PORT_Memcmp( sha_computed_digest, sha384_known_digest,
-                       SHA384_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    /***************************************************/
-    /* SHA-512 Single-Round Known Answer Hashing Test. */
-    /***************************************************/
-
-    sha_status = SHA512_HashBuf( sha_computed_digest, known_hash_message,
-                                FIPS_KNOWN_HASH_MESSAGE_LENGTH );
-
-    if( ( sha_status != SECSuccess ) ||
-        ( PORT_Memcmp( sha_computed_digest, sha512_known_digest,
-                       SHA512_LENGTH ) != 0 ) ) {
-        PORT_SetError( SEC_ERROR_LIBRARY_FAILURE );
-        return( SECFailure );
-    }
-
-    return( SECSuccess );
-}
-
-
-static SECStatus
-freebl_fips_RSA_PowerUpSelfTest( void )
-{
-    /* RSA Known Modulus used in both Public/Private Key Values (2048-bits). */
-    static const PRUint8 rsa_modulus[FIPS_RSA_MODULUS_LENGTH] = {
-                            0xb8, 0x15, 0x00, 0x33, 0xda, 0x0c, 0x9d, 0xa5,
-                            0x14, 0x8c, 0xde, 0x1f, 0x23, 0x07, 0x54, 0xe2,
-                            0xc6, 0xb9, 0x51, 0x04, 0xc9, 0x65, 0x24, 0x6e,
-                            0x0a, 0x46, 0x34, 0x5c, 0x37, 0x86, 0x6b, 0x88,
-                            0x24, 0x27, 0xac, 0xa5, 0x02, 0x79, 0xfb, 0xed,
-                            0x75, 0xc5, 0x3f, 0x6e, 0xdf, 0x05, 0x5f, 0x0f,
-                            0x20, 0x70, 0xa0, 0x5b, 0x85, 0xdb, 0xac, 0xb9,
-                            0x5f, 0x02, 0xc2, 0x64, 0x1e, 0x84, 0x5b, 0x3e,
-                            0xad, 0xbf, 0xf6, 0x2e, 0x51, 0xd6, 0xad, 0xf7,
-                            0xa7, 0x86, 0x75, 0x86, 0xec, 0xa7, 0xe1, 0xf7,
-                            0x08, 0xbf, 0xdc, 0x56, 0xb1, 0x3b, 0xca, 0xd8,
-                            0xfc, 0x51, 0xdf, 0x9a, 0x2a, 0x37, 0x06, 0xf2,
-                            0xd1, 0x6b, 0x9a, 0x5e, 0x2a, 0xe5, 0x20, 0x57,
-                            0x35, 0x9f, 0x1f, 0x98, 0xcf, 0x40, 0xc7, 0xd6,
-                            0x98, 0xdb, 0xde, 0xf5, 0x64, 0x53, 0xf7, 0x9d,
-                            0x45, 0xf3, 0xd6, 0x78, 0xb9, 0xe3, 0xa3, 0x20,
-                            0xcd, 0x79, 0x43, 0x35, 0xef, 0xd7, 0xfb, 0xb9,
-                            0x80, 0x88, 0x27, 0x2f, 0x63, 0xa8, 0x67, 0x3d,
-                            0x4a, 0xfa, 0x06, 0xc6, 0xd2, 0x86, 0x0b, 0xa7,
-                            0x28, 0xfd, 0xe0, 0x1e, 0x93, 0x4b, 0x17, 0x2e,
-                            0xb0, 0x11, 0x6f, 0xc6, 0x2b, 0x98, 0x0f, 0x15,
-                            0xe3, 0x87, 0x16, 0x7a, 0x7c, 0x67, 0x3e, 0x12,
-                            0x2b, 0xf8, 0xbe, 0x48, 0xc1, 0x97, 0x47, 0xf4,
-                            0x1f, 0x81, 0x80, 0x12, 0x28, 0xe4, 0x7b, 0x1e,
-                            0xb7, 0x00, 0xa4, 0xde, 0xaa, 0xfb, 0x0f, 0x77,
-                            0x84, 0xa3, 0xd6, 0xb2, 0x03, 0x48, 0xdd, 0x53,
-                            0x8b, 0x46, 0x41, 0x28, 0x52, 0xc4, 0x53, 0xf0,
-                            0x1c, 0x95, 0xd9, 0x36, 0xe0, 0x0f, 0x26, 0x46,
-                            0x9c, 0x61, 0x0e, 0x80, 0xca, 0x86, 0xaf, 0x39,
-                            0x95, 0xe5, 0x60, 0x43, 0x61, 0x3e, 0x2b, 0xb4,
-                            0xe8, 0xbd, 0x8d, 0x77, 0x62, 0xf5, 0x32, 0x43,
-                            0x2f, 0x4b, 0x65, 0x82, 0x14, 0xdd, 0x29, 0x5b};
-
-    /* RSA Known Public Key Values (24-bits). */
-    static const PRUint8 rsa_public_exponent[FIPS_RSA_PUBLIC_EXPONENT_LENGTH] 
-                                                       = { 0x01, 0x00, 0x01 };
-    /* RSA Known Private Key Values (version                 is    8-bits), */
-    /*                              (private exponent        is 2048-bits), */
-    /*                              (private prime0          is 1024-bits), */
-    /*                              (private prime1          is 1024-bits), */
-    /*                              (private prime exponent0 is 1024-bits), */
-    /*                              (private prime exponent1 is 1024-bits), */
-    /*                          and (private coefficient     is 1024-bits). */
-    static const PRUint8 rsa_version[] = { 0x00 };
-
-    static const PRUint8 rsa_private_exponent[FIPS_RSA_PRIVATE_EXPONENT_LENGTH]
-                         = {0x29, 0x08, 0x05, 0x53, 0x89, 0x76, 0xe6, 0x6c,
-                            0xb5, 0x77, 0xf0, 0xca, 0xdf, 0xf3, 0xf2, 0x67,
-                            0xda, 0x03, 0xd4, 0x9b, 0x4c, 0x88, 0xce, 0xe5,
-                            0xf8, 0x44, 0x4d, 0xc7, 0x80, 0x58, 0xe5, 0xff,
-                            0x22, 0x8f, 0xf5, 0x5b, 0x92, 0x81, 0xbe, 0x35,
-                            0xdf, 0xda, 0x67, 0x99, 0x3e, 0xfc, 0xe3, 0x83,
-                            0x6b, 0xa7, 0xaf, 0x16, 0xb7, 0x6f, 0x8f, 0xc0,
-                            0x81, 0xfd, 0x0b, 0x77, 0x65, 0x95, 0xfb, 0x00,
-                            0xad, 0x99, 0xec, 0x35, 0xc6, 0xe8, 0x23, 0x3e,
-                            0xe0, 0x88, 0x88, 0x09, 0xdb, 0x16, 0x50, 0xb7,
-                            0xcf, 0xab, 0x74, 0x61, 0x9e, 0x7f, 0xc5, 0x67,
-                            0x38, 0x56, 0xc7, 0x90, 0x85, 0x78, 0x5e, 0x84,
-                            0x21, 0x49, 0xea, 0xce, 0xb2, 0xa0, 0xff, 0xe4,
-                            0x70, 0x7f, 0x57, 0x7b, 0xa8, 0x36, 0xb8, 0x54,
-                            0x8d, 0x1d, 0xf5, 0x44, 0x9d, 0x68, 0x59, 0xf9,
-                            0x24, 0x6e, 0x85, 0x8f, 0xc3, 0x5f, 0x8a, 0x2c,
-                            0x94, 0xb7, 0xbc, 0x0e, 0xa5, 0xef, 0x93, 0x06,
-                            0x38, 0xcd, 0x07, 0x0c, 0xae, 0xb8, 0x44, 0x1a,