Use dlsym(RTLD_DEFAULT) instead of dlsym(dlopen(NULL)) in aesgcmchromium.patch.

net/third_party/nss/patches/aesgcmchromium.patch

 diff -pu a/nss/lib/ssl/ssl3con.c b/nss/lib/ssl/ssl3con.c
 --- a/nss/lib/ssl/ssl3con.c     2014-01-17 18:04:43.127747463 -0800
 +++ b/nss/lib/ssl/ssl3con.c     2014-01-17 18:06:21.919386088 -0800
+@@ -8,6 +8,7 @@
+ 
+ /* TODO(ekr): Implement HelloVerifyRequest on server side. OK for now. */
+ 
++#define _GNU_SOURCE 1
+ #include "cert.h"
+ #include "ssl.h"
+ #include "cryptohi.h"  /* for DSAU_ stuff */
 @@ -44,6 +44,9 @@

[Ryan Sleevi, 2015/03/02 21:15:14]

+44,9 -> +45,9

[ppi, 2015/03/03 10:17:02]

Done.

  #ifdef NSS_ENABLE_ZLIB
  #include "zlib.h"
  #endif
 +#ifdef LINUX
 +#include <dlfcn.h>
 +#endif
  
  #ifndef PK11_SETATTRS
  #define PK11_SETATTRS(x,id,v,l) (x)->type = (id); \
 @@ -1842,6 +1845,69 @@ ssl3_BuildRecordPseudoHeader(unsigned ch

[Ryan Sleevi, 2015/03/02 21:15:15]

+1845,69 -> +1846,63

(Since you deleted 6 lines, and +1 for the context offset in the new file)

[ppi, 2015/03/03 10:17:02]

Done.

      return 13;
  }
  
 +typedef SECStatus (*PK11CryptFcn)(
 +    PK11SymKey *symKey, CK_MECHANISM_TYPE mechanism, SECItem *param,
 +    unsigned char *out, unsigned int *outLen, unsigned int maxLen,
 +    const unsigned char *in, unsigned int inLen);
 +
 +static PK11CryptFcn pk11_encrypt = NULL;
 +static PK11CryptFcn pk11_decrypt = NULL;
 +
 +static PRCallOnceType resolvePK11CryptOnce;
 +
 +static PRStatus
 +ssl3_ResolvePK11CryptFunctions(void)
 +{
 +#ifdef LINUX
 +    /* On Linux we use the system NSS libraries. Look up the PK11_Encrypt and
 +     * PK11_Decrypt functions at run time. */
-+    void *handle = dlopen(NULL, RTLD_LAZY);
-+    if (!handle) {
-+       PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
-+       return PR_FAILURE;
-+    }
-+    pk11_encrypt = (PK11CryptFcn)dlsym(handle, "PK11_Encrypt");
-+    pk11_decrypt = (PK11CryptFcn)dlsym(handle, "PK11_Decrypt");
-+    dlclose(handle);
++    pk11_encrypt = (PK11CryptFcn)dlsym(RTLD_DEFAULT, "PK11_Encrypt");
++    pk11_decrypt = (PK11CryptFcn)dlsym(RTLD_DEFAULT, "PK11_Decrypt");
 +    return PR_SUCCESS;
 +#else
 +    /* On other platforms we use our own copy of NSS. PK11_Encrypt and
 +     * PK11_Decrypt are known to be available. */
 +    pk11_encrypt = PK11_Encrypt;
 +    pk11_decrypt = PK11_Decrypt;
 +    return PR_SUCCESS;
 +#endif
 +}
 +
@@ skipping 22 matching lines @@
 +                                             PR_FALSE);
 +           PORT_Assert(rv == SECSuccess); /* else is coding error */
 +       }
 +    }
 +    return SECSuccess;
 +}
 +
  static SECStatus
  ssl3_AESGCM(ssl3KeyMaterial *keys,
             PRBool doDecrypt,
 @@ -1893,10 +1959,10 @@ ssl3_AESGCM(ssl3KeyMaterial *keys,

[Ryan Sleevi, 2015/03/02 21:15:15]

+1959,10 -> +1960,10

[ppi, 2015/03/03 10:17:02]

Done.

      gcmParams.ulTagBits = tagSize * 8;
  
      if (doDecrypt) {
 -       rv = PK11_Decrypt(keys->write_key, CKM_AES_GCM, &param, out, &uOutLen,
 +       rv = pk11_decrypt(keys->write_key, CKM_AES_GCM, &param, out, &uOutLen,
                           maxout, in, inlen);
      } else {
 -       rv = PK11_Encrypt(keys->write_key, CKM_AES_GCM, &param, out, &uOutLen,
 +       rv = pk11_encrypt(keys->write_key, CKM_AES_GCM, &param, out, &uOutLen,
                           maxout, in, inlen);
      }
      *outlen += (int) uOutLen;
 @@ -5103,6 +5169,10 @@ ssl3_SendClientHello(sslSocket *ss, PRBo

[Ryan Sleevi, 2015/03/02 21:15:15]

+5169,10 -> +5170,10

[ppi, 2015/03/03 10:17:02]

Done.

         ssl3_DisableNonDTLSSuites(ss);
      }
  
 +    if (!ssl3_HasGCMSupport()) {
 +       ssl3_DisableGCMSuites(ss);
 +    }
 +
      /* how many suites are permitted by policy and user preference? */
      num_suites = count_cipher_suites(ss, ss->ssl3.policy, PR_TRUE);
      if (!num_suites) {
 @@ -8080,6 +8150,10 @@ ssl3_HandleClientHello(sslSocket *ss, SS

[Ryan Sleevi, 2015/03/02 21:15:15]

+8150,10 -> +8151,10

[ppi, 2015/03/03 10:17:02]

Done.

         ssl3_DisableNonDTLSSuites(ss);
      }
  
 +    if (!ssl3_HasGCMSupport()) {
 +       ssl3_DisableGCMSuites(ss);
 +    }
 +
  #ifdef PARANOID
      /* Look for a matching cipher suite. */
      j = ssl3_config_match_init(ss);