Update to NSS 3.12.7 and NSPR 4.8.6....

Update to NSS 3.12.7 and NSPR 4.8.6.

Remove two NSPR patches because they were checked in
to the NSPR upstream.

Remove the mozilla/security/nss/lib/pki1 directory.
It's been removed in the upstream.

R=agl
BUG=none
TEST=no build errors or test failures.

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=55513

[wtc, 2010-08-09 22:57:59]

It's impractical to review all the changes.  You just need
to review the changes to:
  README.chromium
  nss.gyp
  patches
  scripts

[agl, 2010-08-09 23:22:10]

LGTM.

(Does this include the EDH minimum? I suspect not since it should probably be in
libssl, but I didn't see it in the libssl changes when I looked today.)

[wtc, 2010-08-10 00:24:30]

http://codereview.chromium.org/3135002/diff/1/42
File nss/mozilla/security/nss/lib/cryptohi/seckey.c (right):

http://codereview.chromium.org/3135002/diff/1/42#newcode232
nss/mozilla/security/nss/lib/cryptohi/seckey.c:232: if (!param ||
!param->base.data || !param->prime.data ||
This is a DH key size check.  Without the DH key size check
in ssl3_HandleServerKeyExchange in libssl, we will get here
and still reject the 256-bit DH domain parameters that the
server suggested.

In my testing with Firefox, the test here alone is enough
to cause SSL handshake to fail.  It's just that the error
code SEC_ERROR_INVALID_ARGS is less informative than
SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH.

To find the check in ssl3_HandleServerKeyExchange, search
for "< 512" in ssl3con.c.