Update NSS to NSS_3_15_1_BETA2.

nss/lib/libpkix/pkix/top/pkix_build.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * pkix_build.c
  *
  * Top level buildChain function
  *
  */
 
@@ skipping 1003 matching lines @@
         PKIX_Boolean chainRevalidationStage,
         void *plContext)
 {
         PKIX_List *checkers = NULL;
         PKIX_List *initialPolicies = NULL;
         PKIX_List *reversedCertChain = NULL;
         PKIX_List *buildCheckedCritExtOIDsList = NULL;
         PKIX_ProcessingParams *procParams = NULL;
         PKIX_PL_Cert *trustedCert = NULL;
         PKIX_PL_PublicKey *trustedPubKey = NULL;
+        PKIX_PL_CertNameConstraints *trustedNC = NULL;
         PKIX_CertChainChecker *sigChecker = NULL;
         PKIX_CertChainChecker *policyChecker = NULL;
         PKIX_CertChainChecker *userChecker = NULL;
+        PKIX_CertChainChecker *nameConstraintsChecker = NULL;
         PKIX_CertChainChecker *checker = NULL;
         PKIX_CertSelector *certSelector = NULL;
         PKIX_List *userCheckerExtOIDs = NULL;
         PKIX_PL_OID *oid = NULL;
         PKIX_Boolean supportForwardChecking = PKIX_FALSE;
         PKIX_Boolean policyQualifiersRejected = PKIX_FALSE;
         PKIX_Boolean initialPolicyMappingInhibit = PKIX_FALSE;
         PKIX_Boolean initialAnyPolicyInhibit = PKIX_FALSE;
         PKIX_Boolean initialExplicitPolicy = PKIX_FALSE;
         PKIX_UInt32 numChainCerts;
@@ skipping 148 matching lines @@
                                 (PKIX_PL_Object *)userChecker,
                                 plContext),
                                 PKIX_LISTAPPENDITEMFAILED);
                         }
 
                         PKIX_DECREF(userCheckerExtOIDs);
                         PKIX_DECREF(userChecker);
                 }
         }
 
-        /* Inabling post chain building signature check on the certs. */
+        /* Enabling post chain building signature check on the certs. */
         PKIX_CHECK(PKIX_TrustAnchor_GetTrustedCert
                    (anchor, &trustedCert, plContext),
                    PKIX_TRUSTANCHORGETTRUSTEDCERTFAILED);
         
         PKIX_CHECK(PKIX_PL_Cert_GetSubjectPublicKey
                    (trustedCert, &trustedPubKey, plContext),
                    PKIX_CERTGETSUBJECTPUBLICKEYFAILED);
         
         PKIX_CHECK(pkix_SignatureChecker_Initialize
                    (trustedPubKey,
                     numChainCerts,
                     &sigChecker,
                     plContext),
                    PKIX_SIGNATURECHECKERINITIALIZEFAILED);
         
         PKIX_CHECK(PKIX_List_AppendItem
                    (checkers,
                     (PKIX_PL_Object *)sigChecker,
                     plContext),
                    PKIX_LISTAPPENDITEMFAILED);
 
+        /* Enabling post chain building name constraints check on the certs. */
+        PKIX_CHECK(PKIX_TrustAnchor_GetNameConstraints
+                  (anchor, &trustedNC, plContext),
+                  PKIX_TRUSTANCHORGETNAMECONSTRAINTSFAILED);
+
+        PKIX_CHECK(pkix_NameConstraintsChecker_Initialize
+                  (trustedNC, numChainCerts, &nameConstraintsChecker,
+                   plContext),
+                  PKIX_NAMECONSTRAINTSCHECKERINITIALIZEFAILED);
+
+        PKIX_CHECK(PKIX_List_AppendItem
+                  (checkers,
+                   (PKIX_PL_Object *)nameConstraintsChecker,
+                   plContext),
+                  PKIX_LISTAPPENDITEMFAILED);
+
+
         PKIX_DECREF(state->reversedCertChain);
         PKIX_INCREF(reversedCertChain);
         state->reversedCertChain = reversedCertChain;
         PKIX_DECREF(state->checkedCritExtOIDs);
         PKIX_INCREF(buildCheckedCritExtOIDsList);
         state->checkedCritExtOIDs = buildCheckedCritExtOIDsList;
         PKIX_DECREF(state->checkerChain);
         state->checkerChain = checkers;
         checkers = NULL;
         state->certCheckedIndex = 0;
         state->checkerIndex = 0;
         state->revChecking = PKIX_FALSE;
 
 
 cleanup:
 
         PKIX_DECREF(oid);
         PKIX_DECREF(reversedCertChain);
         PKIX_DECREF(buildCheckedCritExtOIDsList);
         PKIX_DECREF(checker);
         PKIX_DECREF(checkers);
         PKIX_DECREF(initialPolicies);
         PKIX_DECREF(trustedCert);
         PKIX_DECREF(trustedPubKey);
         PKIX_DECREF(certSelector);
         PKIX_DECREF(sigChecker);
+        PKIX_DECREF(trustedNC);
+        PKIX_DECREF(nameConstraintsChecker);
         PKIX_DECREF(policyChecker);
         PKIX_DECREF(userChecker);
         PKIX_DECREF(userCheckerExtOIDs);
 
         PKIX_RETURN(BUILD);
 }
 
 /*
  * FUNCTION: pkix_Build_ValidateEntireChain
  * DESCRIPTION:
@@ skipping 2573 matching lines @@
                 *pBuildResult = buildResult;
                 buildResult = NULL;
         }
 
 cleanup:
         PKIX_DECREF(buildResult);
         PKIX_DECREF(state);
 
         PKIX_RETURN(BUILD);
 }