5 files changed, 28 insertions, 122 deletions

diff --git a/security/nss/Makefile b/security/nss/Makefile
index 90c1342d7696..aa8ab6679948 100644
--- a/security/nss/Makefile
+++ b/security/nss/Makefile
@@ -2,7 +2,7 @@
 # $FreeBSD$
 
 PORTNAME=	nss
-PORTVERSION=	3.23
+PORTVERSION=	3.24
 #DISTVERSIONSUFFIX=	-with-ckbi-1.98
 CATEGORIES=	security
 MASTER_SITES=	MOZILLA/security/${PORTNAME}/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
diff --git a/security/nss/distinfo b/security/nss/distinfo
index 40feb66bddd7..a95107db1928 100644
--- a/security/nss/distinfo
+++ b/security/nss/distinfo
@@ -1,2 +1,2 @@
-SHA256 (nss-3.23.tar.gz) = 94b383e31c9671e9dfcca81084a8a813817e8f05a57f54533509b318d26e11cf
-SIZE (nss-3.23.tar.gz) = 7467001
+SHA256 (nss-3.24.tar.gz) = 2f0841492f91cca473b73dec6cab9cf765a485e032d48d2e8ae7261e54c419ed
+SIZE (nss-3.24.tar.gz) = 7307782
diff --git a/security/nss/files/patch-bug1250891 b/security/nss/files/patch-bug1250891
deleted file mode 100644
index 1582d2bb5320..000000000000
--- a/security/nss/files/patch-bug1250891
+++ /dev/null
@@ -1,100 +0,0 @@
-diff --git a/coreconf/FreeBSD.mk b/coreconf/FreeBSD.mk
---- coreconf/FreeBSD.mk
-+++ coreconf/FreeBSD.mk
-@@ -21,7 +21,7 @@ ifeq ($(CPU_ARCH),amd64)
- CPU_ARCH		= x86_64
- endif
- 
--OS_CFLAGS		= $(DSO_CFLAGS) -ansi -Wall -Wno-switch -DFREEBSD -DHAVE_STRERROR -DHAVE_BSD_FLOCK
-+OS_CFLAGS		= $(DSO_CFLAGS) -Wall -Wno-switch -DFREEBSD -DHAVE_STRERROR -DHAVE_BSD_FLOCK
- 
- DSO_CFLAGS		= -fPIC
- DSO_LDOPTS		= -shared -Wl,-soname -Wl,$(notdir $@)
-diff --git a/coreconf/NetBSD.mk b/coreconf/NetBSD.mk
---- coreconf/NetBSD.mk
-+++ coreconf/NetBSD.mk
-@@ -26,7 +26,7 @@ else
- DLL_SUFFIX		= so.1.0
- endif
- 
--OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -ansi -Wall -Wno-switch -pipe -DNETBSD -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
-+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DNETBSD -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
- 
- OS_LIBS			= -lcompat
- 
-diff --git a/coreconf/OpenBSD.mk b/coreconf/OpenBSD.mk
---- coreconf/OpenBSD.mk
-+++ coreconf/OpenBSD.mk
-@@ -26,7 +26,7 @@ endif
- 
- DLL_SUFFIX		= so.1.0
- 
--OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -ansi -Wall -Wno-switch -pipe -DOPENBSD
-+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DOPENBSD
- 
- OS_LIBS			= 
- 
-diff --git a/coreconf/Werror.mk b/coreconf/Werror.mk
---- coreconf/Werror.mk
-+++ coreconf/Werror.mk
-@@ -5,6 +5,15 @@
- 
- # This sets WARNING_CFLAGS for gcc-like compilers.
- 
-+ifndef CC_IS_CLANG
-+  CC_IS_CLANG := $(and $(findstring clang, $(shell $(CC) --version 2>&1)), 1)
-+  # Clang claims GCC 4.2.1 compatibility, see GCC_VERSION
-+  CC_IS_GCC = 1
-+  # Export CC_IS_CLANG and CC_IS_GCC to save a shell invocation when recursing.
-+  export CC_IS_CLANG
-+  export CC_IS_GCC
-+endif
-+
- ifndef CC_IS_GCC
-   CC_IS_GCC := $(shell $(CC) -x c -E -Wall -Werror /dev/null >/dev/null 2>&1 && echo 1)
-   # Export CC_IS_GCC to save a shell invocation when recursing.
-@@ -38,7 +44,7 @@ ifndef WARNING_CFLAGS
-     disable_warning = $(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -Wno-$(1))
- 
-     WARNING_CFLAGS = -Wall
--    ifeq ($(CC_NAME),clang)
-+    ifdef CC_IS_CLANG
-       # -Qunused-arguments : clang objects to arguments that it doesn't understand
-       #    and fixing this would require rearchitecture
-       WARNING_CFLAGS += -Qunused-arguments
-@@ -62,10 +68,10 @@ ifndef WARNING_CFLAGS
-         NSS_ENABLE_WERROR = 0
-         $(warning OS_TARGET is Android, disabling -Werror)
-       else
--        ifeq ($(CC_NAME),clang)
-+        ifdef CC_IS_CLANG
-           # Clang reports its version as an older gcc, but it's OK
-           NSS_ENABLE_WERROR = 1
--        else ifeq ($(CC_NAME),gcc)
-+        else ifdef CC_IS_GCC
-           ifneq (,$(filter 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
-             NSS_ENABLE_WERROR = 1
-           endif
-diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile
---- lib/freebl/Makefile
-+++ lib/freebl/Makefile
-@@ -484,7 +484,7 @@ endif
- 
- # poly1305-donna-x64-sse2-incremental-source.c requires __int128 support
- # in GCC 4.6.0.
--ifeq ($(CC_NAME),clang)
-+ifdef CC_IS_CLANG
-     HAVE_INT128_SUPPORT = 1
- else ifeq (1,$(CC_IS_GCC))
-     ifneq (,$(filter 4.6 4.7 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
-@@ -697,8 +697,8 @@ ifdef INTEL_GCM
- # symbolic names to registers, for example,
- #     .set  Htbl, %rdi
- # So we can't use Clang's integrated assembler with intel-gcm.s.
--ifneq (,$(findstring clang,$(shell $(AS) --version)))
--$(OBJDIR)/$(PROG_PREFIX)intel-gcm$(OBJ_SUFFIX): ASFLAGS += -no-integrated-as
-+ifdef CC_IS_CLANG
-+$(OBJDIR)/$(PROG_PREFIX)intel-gcm$(OBJ_SUFFIX): CFLAGS += -no-integrated-as
- endif
- endif
- 
diff --git a/security/nss/files/patch-const b/security/nss/files/patch-const
index de5fae9f6601..ccefa75c7825 100644
--- a/security/nss/files/patch-const
+++ b/security/nss/files/patch-const
@@ -18,25 +18,27 @@
 +FipsMode(const char *arg)
  {
      char *internal_name;
-@@ -62,14 +62,16 @@
- 		SECMOD_GetInternalModule()->commonName);
- 	    if(SECMOD_DeleteInternalModule(internal_name) != SECSuccess) {
--		PR_fprintf(PR_STDERR, "%s\n", SECU_Strerror(PORT_GetError()));
-+		PR_fprintf(PR_STDERR, "FipsMode(true): %s (%s)\n", SECU_Strerror(PORT_GetError()), internal_name);
- 		PR_smprintf_free(internal_name);
- 		PR_fprintf(PR_STDERR, errStrings[FIPS_SWITCH_FAILED_ERR]);
- 		return FIPS_SWITCH_FAILED_ERR;
- 	    }
--	    PR_smprintf_free(internal_name);
- 	    if (!PK11_IsFIPS()) {
-+		PR_fprintf(PR_STDERR, "FipsMode(true): in module %s", internal_name);
-+	        PR_smprintf_free(internal_name);
- 		PR_fprintf(PR_STDERR, errStrings[FIPS_SWITCH_FAILED_ERR]);
- 		return FIPS_SWITCH_FAILED_ERR;
- 	    }
-+	    PR_smprintf_free(internal_name);
- 	    PR_fprintf(PR_STDOUT, msgStrings[FIPS_ENABLED_MSG]);
- 	} else {
+@@ -25,16 +25,18 @@ FipsMode(char *arg)
+             internal_name = PR_smprintf("%s",
+                                         SECMOD_GetInternalModule()->commonName);
+             if (SECMOD_DeleteInternalModule(internal_name) != SECSuccess) {
+-                PR_fprintf(PR_STDERR, "%s\n", SECU_Strerror(PORT_GetError()));
++                PR_fprintf(PR_STDERR, "FipsMode(true): %s (%s)\n", SECU_Strerror(PORT_GetError()), internal_name);
+                 PR_smprintf_free(internal_name);
+                 PR_fprintf(PR_STDERR, errStrings[FIPS_SWITCH_FAILED_ERR]);
+                 return FIPS_SWITCH_FAILED_ERR;
+             }
+-            PR_smprintf_free(internal_name);
+             if (!PK11_IsFIPS()) {
++                PR_fprintf(PR_STDERR, "FipsMode(true): in module %s", internal_name);
++                PR_smprintf_free(internal_name);
+                 PR_fprintf(PR_STDERR, errStrings[FIPS_SWITCH_FAILED_ERR]);
+                 return FIPS_SWITCH_FAILED_ERR;
+             }
++            PR_smprintf_free(internal_name);
+             PR_fprintf(PR_STDOUT, msgStrings[FIPS_ENABLED_MSG]);
+         } else {
+             PR_fprintf(PR_STDERR, errStrings[FIPS_ALREADY_ON_ERR]);
 @@ -112,5 +114,5 @@
   */
  Error
diff --git a/security/nss/pkg-plist b/security/nss/pkg-plist
index 74d9b3e388e9..dacf1c3c2593 100644
--- a/security/nss/pkg-plist
+++ b/security/nss/pkg-plist
@@ -47,6 +47,8 @@ include/nss/nss/key.h
 include/nss/nss/keyhi.h
 include/nss/nss/keyt.h
 include/nss/nss/keythi.h
+include/nss/nss/lowkeyi.h
+include/nss/nss/lowkeyti.h
 include/nss/nss/nss.h
 include/nss/nss/nssb64.h
 include/nss/nss/nssb64t.h
@@ -122,6 +124,8 @@ include/nss/nss/utilrename.h
 lib/nss/libcrmf.a
 lib/nss/libfreebl3.so
 lib/nss/libfreebl3.so.1
+lib/nss/libfreeblpriv3.so
+lib/nss/libfreeblpriv3.so.1
 lib/nss/libnss3.so
 lib/nss/libnss3.so.1
 lib/nss/libnssckbi.so