Uprev NSS (in libssl) to NSS 3.21

net/third_party/nss/README.chromium

 Name: Network Security Services (NSS)
 URL: http://www.mozilla.org/projects/security/pki/nss/
-Version: 3.19 RTM
+Version: 3.21 RTM
 Security Critical: Yes
 License: MPL 2
 License File: NOT_SHIPPED
 
 This directory includes a copy of NSS's libssl from the hg repo at:
   https://hg.mozilla.org/projects/nss
 
 The same module appears in crypto/third_party/nss (and third_party/nss on some
 platforms), so we don't repeat the license file here.
 
-The snapshot was updated to the hg tag: NSS_3_19_RTM
+The snapshot was updated to the hg tag: NSS_3_21_RTM
 
 Patches:
 
   * Cache the peer's intermediate CA certificates in session ID, so that
     they're available when we resume a session.
     patches/cachecerts.patch
     https://bugzilla.mozilla.org/show_bug.cgi?id=731478
 
   * Add support for client auth with native crypto APIs on Mac and Windows.
     patches/clientauth.patch
     ssl/sslplatf.c

[davidben, 2015/12/11 22:40:58]

We can drop this now, by the way.

 
   * Add a function to export whether the last handshake on a socket resumed a
     previous session.
     patches/didhandshakeresume.patch
     https://bugzilla.mozilla.org/show_bug.cgi?id=731798
 
   * Add function to retrieve TLS client cert types requested by server.
     https://bugzilla.mozilla.org/show_bug.cgi?id=51413
     patches/getrequestedclientcerttypes.patch
 
@@ skipping 57 matching lines @@
     patches/nssrwlock.patch
     https://bugzilla.mozilla.org/show_bug.cgi?id=957812
 
   * Add a comment explaining why signature_algorithms extension should be at
     the end of the extension list. This works around a bug in WebSphere
     Application Server 7.0, which is intolerant to the final extension having
     zero length. This also ensures that the padding extension has non-zero
     length.
     patches/reorderextensions.patch
 
-  * Make the build metadata deterministic
-    patches/removebuildmetadata.patch
-
-  * Fix locking bug in ssl3_HandleHelloRequest when rejecting a renegotiation.
-    patches/norenegotiatelock.patch
-    https://bugzilla.mozilla.org/show_bug.cgi?id=1162521
-
-  * Increase the minimum DH group size to 1024
-    patches/dh1024.patch
-
 Apply the patches to NSS by running the patches/applypatches.sh script.  Read
 the comments at the top of patches/applypatches.sh for instructions.
 
 The ssl/bodge directory contains files taken from the NSS repo that we required
 for building libssl outside of its usual build environment.