Update NSS to 3.36.4-RTM

1 files changed, 24 insertions, 12 deletions

diff --git a/security/nss/gtests/ssl_gtest/tls_connect.cc b/security/nss/gtests/ssl_gtest/tls_connect.cc
index 0af5123e9..8567b392f 100644
--- a/security/nss/gtests/ssl_gtest/tls_connect.cc
+++ b/security/nss/gtests/ssl_gtest/tls_connect.cc
@@ -197,7 +197,6 @@ void TlsConnectTestBase::SetUp() {
   SSL_ConfigServerSessionIDCache(1024, 0, 0, g_working_dir_path.c_str());
   SSLInt_ClearSelfEncryptKey();
   SSLInt_SetTicketLifetime(30);
-  SSLInt_SetMaxEarlyDataSize(1024);
   SSL_SetupAntiReplay(1 * PR_USEC_PER_SEC, 1, 3);
   ClearStats();
   Init();
@@ -230,7 +229,9 @@ void TlsConnectTestBase::Reset() {
 
 void TlsConnectTestBase::Reset(const std::string& server_name,
                                const std::string& client_name) {
+  auto token = client_->GetResumptionToken();
   client_.reset(new TlsAgent(client_name, TlsAgent::CLIENT, variant_));
+  client_->SetResumptionToken(token);
   server_.reset(new TlsAgent(server_name, TlsAgent::SERVER, variant_));
   if (skip_version_checks_) {
     client_->SkipVersionChecks();
@@ -290,6 +291,7 @@ void TlsConnectTestBase::EnableExtendedMasterSecret() {
 void TlsConnectTestBase::Connect() {
   server_->StartConnect(server_model_ ? server_model_->ssl_fd() : nullptr);
   client_->StartConnect(client_model_ ? client_model_->ssl_fd() : nullptr);
+  client_->MaybeSetResumptionToken();
   Handshake();
   CheckConnected();
 }
@@ -402,13 +404,13 @@ void TlsConnectTestBase::CheckKeys(SSLKEAType kea_type,
       break;
     case ssl_auth_rsa_sign:
       if (version_ >= SSL_LIBRARY_VERSION_TLS_1_2) {
-        scheme = ssl_sig_rsa_pss_sha256;
+        scheme = ssl_sig_rsa_pss_rsae_sha256;
       } else {
         scheme = ssl_sig_rsa_pkcs1_sha256;
       }
       break;
     case ssl_auth_rsa_pss:
-      scheme = ssl_sig_rsa_pss_sha256;
+      scheme = ssl_sig_rsa_pss_rsae_sha256;
       break;
     case ssl_auth_ecdsa:
       scheme = ssl_sig_ecdsa_secp256r1_sha256;
@@ -670,7 +672,8 @@ void TlsConnectTestBase::ZeroRttSendReceive(
     EXPECT_EQ(k0RttDataLen, rv);
   } else {
     EXPECT_EQ(SECFailure, rv);
-    EXPECT_EQ(PR_WOULD_BLOCK_ERROR, PORT_GetError());
+    EXPECT_EQ(PR_WOULD_BLOCK_ERROR, PORT_GetError())
+        << "Unexpected error: " << PORT_ErrorToName(PORT_GetError());
   }
 
   // Do a second read. this should fail.
@@ -754,20 +757,29 @@ TlsConnectTls12Plus::TlsConnectTls12Plus()
 TlsConnectTls13::TlsConnectTls13()
     : TlsConnectTestBase(GetParam(), SSL_LIBRARY_VERSION_TLS_1_3) {}
 
+TlsConnectGenericResumption::TlsConnectGenericResumption()
+    : TlsConnectTestBase(std::get<0>(GetParam()), std::get<1>(GetParam())),
+      external_cache_(std::get<2>(GetParam())) {}
+
+TlsConnectTls13ResumptionToken::TlsConnectTls13ResumptionToken()
+    : TlsConnectTestBase(GetParam(), SSL_LIBRARY_VERSION_TLS_1_3) {}
+
+TlsConnectGenericResumptionToken::TlsConnectGenericResumptionToken()
+    : TlsConnectTestBase(std::get<0>(GetParam()), std::get<1>(GetParam())) {}
+
 void TlsKeyExchangeTest::EnsureKeyShareSetup() {
   EnsureTlsSetup();
   groups_capture_ =
-      std::make_shared<TlsExtensionCapture>(ssl_supported_groups_xtn);
+      std::make_shared<TlsExtensionCapture>(client_, ssl_supported_groups_xtn);
   shares_capture_ =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
-  shares_capture2_ =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn, true);
+      std::make_shared<TlsExtensionCapture>(client_, ssl_tls13_key_share_xtn);
+  shares_capture2_ = std::make_shared<TlsExtensionCapture>(
+      client_, ssl_tls13_key_share_xtn, true);
   std::vector<std::shared_ptr<PacketFilter>> captures = {
       groups_capture_, shares_capture_, shares_capture2_};
-  client_->SetPacketFilter(std::make_shared<ChainedPacketFilter>(captures));
-  capture_hrr_ = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeHelloRetryRequest);
-  server_->SetPacketFilter(capture_hrr_);
+  client_->SetFilter(std::make_shared<ChainedPacketFilter>(captures));
+  capture_hrr_ = MakeTlsFilter<TlsHandshakeRecorder>(
+      server_, kTlsHandshakeHelloRetryRequest);
 }
 
 void TlsKeyExchangeTest::ConfigNamedGroups(