Update NSS to NSS 3.13.5 (from NSS 3.13.3).

Update NSS to NSS 3.13.5 (from NSS 3.13.3).

R=rsleevi@chromium.org
BUG=132885
TEST=none
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=142261

[wtc, 2012-06-14 22:30:02]

Use the following Bugzilla query for the bugs fixed in NSS 3.13.4 and 3.13.5.

https://bugzilla.mozilla.org/buglist.cgi?order=Importance;resolution=FIXED;cl...

Sorry about the big CL...

[Ryan Sleevi, 2012-06-14 22:54:10]

lgtm

https://chromiumcodereview.appspot.com/10540165/diff/1/nss/mozilla/security/n...
File nss/mozilla/security/nss/lib/certhigh/certvfy.c (right):

https://chromiumcodereview.appspot.com/10540165/diff/1/nss/mozilla/security/n...
nss/mozilla/security/nss/lib/certhigh/certvfy.c:543:
SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED) {
It's weird that this wasn't done as
} else if (PORT_GetError() == ... ) {
  LOG_ERROR_OR_EXIT(...)
} else {
  PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
  LOG_ERROR_OR_EXIT(...)
}

(or even a switch, fwiw).

Just to keep symmetric with line 538 rather than going another layer of nesting.

https://chromiumcodereview.appspot.com/10540165/diff/1/nss/mozilla/security/n...
File nss/mozilla/security/nss/lib/util/SECerrs.h (right):

https://chromiumcodereview.appspot.com/10540165/diff/1/nss/mozilla/security/n...
nss/mozilla/security/nss/lib/util/SECerrs.h:578: "The certificate was signed
using a signature algorithm that is disabled because it is not secure.")
too late nit: is not secure -> disabled by policy?

[wtc, 2012-06-14 23:16:16]

Thank you for the review.

https://chromiumcodereview.appspot.com/10540165/diff/1/nss/mozilla/security/n...
File nss/mozilla/security/nss/lib/certhigh/certvfy.c (right):

https://chromiumcodereview.appspot.com/10540165/diff/1/nss/mozilla/security/n...
nss/mozilla/security/nss/lib/certhigh/certvfy.c:543:
SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED) {

On 2012/06/14 22:54:11, Ryan Sleevi wrote:
> It's weird that this wasn't done as
> } else if (PORT_GetError() == ... ) {
>   LOG_ERROR_OR_EXIT(...)
> } else {
>   PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
>   LOG_ERROR_OR_EXIT(...)
> }
> 
> (or even a switch, fwiw).
> 
> Just to keep symmetric with line 538 rather than going another layer of
nesting.

I guess I wanted to avoid duplicating LOG_ERROR_OR_EXIT.

https://chromiumcodereview.appspot.com/10540165/diff/1/nss/mozilla/security/n...
File nss/mozilla/security/nss/lib/util/SECerrs.h (right):

https://chromiumcodereview.appspot.com/10540165/diff/1/nss/mozilla/security/n...
nss/mozilla/security/nss/lib/util/SECerrs.h:578: "The certificate was signed
using a signature algorithm that is disabled because it is not secure.")

On 2012/06/14 22:54:11, Ryan Sleevi wrote:
> too late nit: is not secure -> disabled by policy?

I originally named this error code SEC_ERROR_ALGORITHM_DISABLED_BY_POLICY
because the algorithm is disabled by a NSS_SetAlgorithmPolicy
call.  So the original error message may well have been what
you suggested.

During code review, Brian Smith noted that "policy" could be
misinterpreted as Windows group policy and suggested the
current wording.