Update net/third_party/nss to NSS 3.15.4.

Update net/third_party/nss to NSS 3.15.4.

Notable changes:

1. Reorder the cipher suites offered in ClientHello.
https://bugzilla.mozilla.org/show_bug.cgi?id=936828
https://bugzilla.mozilla.org/show_bug.cgi?id=946147

2. Store a random value in the gmt_unix_time field of ClientHello and
ServerHello.
https://bugzilla.mozilla.org/show_bug.cgi?id=937976

3. Handle >= 2048-bit DSA certificates.
https://bugzilla.mozilla.org/show_bug.cgi?id=925591

4. Session ticket renewal bug fixes.
https://bugzilla.mozilla.org/show_bug.cgi?id=930857
https://bugzilla.mozilla.org/show_bug.cgi?id=930874

The following patches are removed.

1. Patches that are no longer necessary because we require NSS 3.14.3:
versionskew.patch
ecpointform.patch
cbc.patch

2. Patches that have been committed in NSS upstream:
renegoscsv.patch
peercertchain.patch	
peercertchain2.patch
negotiatedextension.patch
sslsock_903565.patch	
aesgcm.patch
tls12backuphash.patch	
tls12backuphash2.patch
ciphersuiteversion.patch
resumeclienthelloversion.patch
canfalsestart.patch
nullcipher_934016.patch

3. Miscellaneous:
channelid2.patch: merged with channelid.patch.
disableticketrenewal.patch: bug fixed in the NSS upstream.

R=agl@chromium.org,rsleevi@chromium.org
BUG=331625
TEST=none

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=243395

[wtc, 2014-01-04 17:15:45]

Adam, Ryan: I checked the changes from NSS 3.15.4 very carefully, so you can
skim through the changes to net/third_party/nss/ssl and review README.chromium
and applypatches.sh more carefully.

[wtc, 2014-01-04 22:54:20]

https://codereview.chromium.org/111853013/diff/680001/net/third_party/nss/ssl...
File net/third_party/nss/ssl/sslenum.c (right):

https://codereview.chromium.org/111853013/diff/680001/net/third_party/nss/ssl...
net/third_party/nss/ssl/sslenum.c:47: * the third one.

This paragraph was written without the two CHACHA20 cipher suites that we added.
Ideally our chacha20poly1305.patch should update this paragraph to refer to the
first six cipher suites instead of the first four.

[agl, 2014-01-06 18:19:27]

LGTM

https://codereview.chromium.org/111853013/diff/680001/net/third_party/nss/ssl...
File net/third_party/nss/ssl/ssl3con.c (left):

https://codereview.chromium.org/111853013/diff/680001/net/third_party/nss/ssl...
net/third_party/nss/ssl/ssl3con.c:2509: /* This is a bodge to allow this code to
be compiled against older NSS headers
Is this no longer needed then? Even for Linux builds on other distributions?

https://codereview.chromium.org/111853013/diff/680001/net/third_party/nss/ssl...
File net/third_party/nss/ssl/ssl3con.c (right):

https://codereview.chromium.org/111853013/diff/680001/net/third_party/nss/ssl...
net/third_party/nss/ssl/ssl3con.c:5296: if (sid->u.ssl3.lock) {
PR_RWLock_Unlock(sid->u.ssl3.lock); }
seems like these could have been a "goto loser", but not worth diverging from
upstream over.

[wtc, 2014-01-06 23:22:58]

I updated the comment in sslenum.c for the two CHACHA20 cipher suites in patch
set 6.

https://codereview.chromium.org/111853013/diff/680001/net/third_party/nss/ssl...
File net/third_party/nss/ssl/ssl3con.c (left):

https://codereview.chromium.org/111853013/diff/680001/net/third_party/nss/ssl...
net/third_party/nss/ssl/ssl3con.c:2509: /* This is a bodge to allow this code to
be compiled against older NSS headers

On 2014/01/06 18:19:28, agl wrote:
> Is this no longer needed then? Even for Linux builds on other distributions?

Correct. These types were added in NSS 3.14.3, and Chromium requires NSS 3.14.3
now.

https://codereview.chromium.org/111853013/diff/680001/net/third_party/nss/ssl...
File net/third_party/nss/ssl/ssl3con.c (right):

https://codereview.chromium.org/111853013/diff/680001/net/third_party/nss/ssl...
net/third_party/nss/ssl/ssl3con.c:5296: if (sid->u.ssl3.lock) {
PR_RWLock_Unlock(sid->u.ssl3.lock); }

On 2014/01/06 18:19:28, agl wrote:
> seems like these could have been a "goto loser", but not worth diverging from
> upstream over.

I also suggested that while reviewing the upstream patch. In the end we decided
that since we will soon check in another fix that makes sid->u.ssl3.lock
unnecessary, it's better to do it this way so that we can simply remove these
lines at that time.

[commit-bot: I haz the power, 2014-01-07 15:47:33]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/wtc@chromium.org/111853013/790001

[commit-bot: I haz the power, 2014-01-07 18:14:43]

Retried try job too often on win_rel for step(s) browser_tests
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=win_rel&nu...

[commit-bot: I haz the power, 2014-01-07 18:22:40]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/wtc@chromium.org/111853013/790001

[commit-bot: I haz the power, 2014-01-07 21:52:30]

Change committed as 243395