bug 1295937 - sync to NSS with gyp file support draft
authorTed Mielczarek <ted@mielczarek.org>
Fri, 07 Oct 2016 12:00:53 -0400
changeset 422211 64aae4259b306c48088fbd446a38f988f6343195
parent 422210 4f7073ee8125af43d1ae61333e28db6c2ca4bafd
child 422212 1d355123ef4835c82f5ee5d456b8ce26c26a9e13
push id31708
push userbmo:ted@mielczarek.org
push dateFri, 07 Oct 2016 16:02:55 +0000
bugs1295937
milestone52.0a1
bug 1295937 - sync to NSS with gyp file support MozReview-Commit-ID: G5uUtQ1Eil2
security/nss/TAG-INFO
security/nss/automation/taskcluster/docker-arm/Dockerfile
security/nss/automation/taskcluster/docker-arm/bin/checkout.sh
security/nss/automation/taskcluster/docker-arm/bin/uname.sh
security/nss/automation/taskcluster/graph/src/extend.js
security/nss/cmd/addbuiltin/addbuiltin.gyp
security/nss/cmd/atob/atob.gyp
security/nss/cmd/bltest/blapitest.c
security/nss/cmd/bltest/bltest.gyp
security/nss/cmd/bltest/pkcs1_vectors.h
security/nss/cmd/btoa/btoa.gyp
security/nss/cmd/certcgi/certcgi.gyp
security/nss/cmd/certutil/certutil.gyp
security/nss/cmd/chktest/chktest.gyp
security/nss/cmd/crlutil/crlutil.gyp
security/nss/cmd/crmftest/crmftest.gyp
security/nss/cmd/dbtest/dbtest.gyp
security/nss/cmd/derdump/derdump.gyp
security/nss/cmd/digest/digest.gyp
security/nss/cmd/ecperf/ecperf.gyp
security/nss/cmd/ectest/ectest.gyp
security/nss/cmd/fipstest/fipstest.gyp
security/nss/cmd/httpserv/httpserv.gyp
security/nss/cmd/lib/exports.gyp
security/nss/cmd/lib/lib.gyp
security/nss/cmd/listsuites/listsuites.gyp
security/nss/cmd/lowhashtest/lowhashtest.gyp
security/nss/cmd/makepqg/makepqg.gyp
security/nss/cmd/modutil/modutil.gyp
security/nss/cmd/multinit/multinit.gyp
security/nss/cmd/ocspclnt/ocspclnt.gyp
security/nss/cmd/ocspresp/ocspresp.gyp
security/nss/cmd/oidcalc/oidcalc.gyp
security/nss/cmd/p7content/p7content.gyp
security/nss/cmd/p7env/p7env.gyp
security/nss/cmd/p7sign/p7sign.gyp
security/nss/cmd/p7verify/p7verify.gyp
security/nss/cmd/pk11gcmtest/pk11gcmtest.gyp
security/nss/cmd/pk11mode/pk11mode.gyp
security/nss/cmd/pk12util/pk12util.gyp
security/nss/cmd/pk1sign/pk1sign.gyp
security/nss/cmd/pkix-errcodes/pkix-errcodes.gyp
security/nss/cmd/platlibs.gypi
security/nss/cmd/pp/pp.gyp
security/nss/cmd/pwdecrypt/pwdecrypt.gyp
security/nss/cmd/rsaperf/rsaperf.gyp
security/nss/cmd/sdrtest/sdrtest.gyp
security/nss/cmd/selfserv/selfserv.c
security/nss/cmd/selfserv/selfserv.gyp
security/nss/cmd/shlibsign/mangle/mangle.gyp
security/nss/cmd/shlibsign/shlibsign.gyp
security/nss/cmd/signtool/signtool.gyp
security/nss/cmd/signver/signver.gyp
security/nss/cmd/smimetools/smimetools.gyp
security/nss/cmd/ssltap/ssltap.gyp
security/nss/cmd/strsclnt/strsclnt.gyp
security/nss/cmd/symkeyutil/symkeyutil.gyp
security/nss/cmd/tests/tests.gyp
security/nss/cmd/tstclnt/tstclnt.gyp
security/nss/cmd/vfychain/vfychain.gyp
security/nss/cmd/vfyserv/vfyserv.gyp
security/nss/coreconf/config.gypi
security/nss/coreconf/detect_host_arch.py
security/nss/coreconf/empty.c
security/nss/coreconf/nsinstall/nsinstall.gyp
security/nss/coreconf/nspr_include_dir.py
security/nss/coreconf/nspr_lib_dir.py
security/nss/coreconf/pkg_config.py
security/nss/exports.gyp
security/nss/external_tests/common/common.gyp
security/nss/external_tests/common/gtest.gypi
security/nss/external_tests/der_gtest/der_gtest.gyp
security/nss/external_tests/google_test/google_test.gyp
security/nss/external_tests/pk11_gtest/pk11_gtest.gyp
security/nss/external_tests/ssl_gtest/ssl_gtest.gyp
security/nss/external_tests/util_gtest/util_gtest.gyp
security/nss/lib/base/base.gyp
security/nss/lib/base/exports.gyp
security/nss/lib/certdb/certdb.gyp
security/nss/lib/certdb/exports.gyp
security/nss/lib/certhigh/certhigh.gyp
security/nss/lib/certhigh/exports.gyp
security/nss/lib/ckfw/builtins/Makefile
security/nss/lib/ckfw/builtins/builtins.gyp
security/nss/lib/ckfw/builtins/certdata.perl
security/nss/lib/ckfw/builtins/exports.gyp
security/nss/lib/ckfw/ckfw.gyp
security/nss/lib/ckfw/exports.gyp
security/nss/lib/crmf/crmf.gyp
security/nss/lib/crmf/exports.gyp
security/nss/lib/cryptohi/cryptohi.gyp
security/nss/lib/cryptohi/exports.gyp
security/nss/lib/dbm/include/exports.gyp
security/nss/lib/dbm/include/include.gyp
security/nss/lib/dbm/src/src.gyp
security/nss/lib/dev/dev.gyp
security/nss/lib/dev/exports.gyp
security/nss/lib/freebl/exports.gyp
security/nss/lib/freebl/freebl.gyp
security/nss/lib/freebl/mpi/README
security/nss/lib/freebl/mpi/mpi-test.c
security/nss/lib/freebl/mpi/mpi.c
security/nss/lib/freebl/mpi/mpi.h
security/nss/lib/freebl/mpi/tests/mptest-3.c
security/nss/lib/freebl/rsa.c
security/nss/lib/jar/exports.gyp
security/nss/lib/jar/jar.gyp
security/nss/lib/libpkix/include/exports.gyp
security/nss/lib/libpkix/include/include.gyp
security/nss/lib/libpkix/pkix/certsel/certsel.gyp
security/nss/lib/libpkix/pkix/certsel/exports.gyp
security/nss/lib/libpkix/pkix/checker/checker.gyp
security/nss/lib/libpkix/pkix/checker/exports.gyp
security/nss/lib/libpkix/pkix/crlsel/crlsel.gyp
security/nss/lib/libpkix/pkix/crlsel/exports.gyp
security/nss/lib/libpkix/pkix/params/exports.gyp
security/nss/lib/libpkix/pkix/params/params.gyp
security/nss/lib/libpkix/pkix/results/exports.gyp
security/nss/lib/libpkix/pkix/results/results.gyp
security/nss/lib/libpkix/pkix/store/exports.gyp
security/nss/lib/libpkix/pkix/store/store.gyp
security/nss/lib/libpkix/pkix/top/exports.gyp
security/nss/lib/libpkix/pkix/top/top.gyp
security/nss/lib/libpkix/pkix/util/exports.gyp
security/nss/lib/libpkix/pkix/util/util.gyp
security/nss/lib/libpkix/pkix_pl_nss/module/exports.gyp
security/nss/lib/libpkix/pkix_pl_nss/module/module.gyp
security/nss/lib/libpkix/pkix_pl_nss/pki/exports.gyp
security/nss/lib/libpkix/pkix_pl_nss/pki/pki.gyp
security/nss/lib/libpkix/pkix_pl_nss/system/exports.gyp
security/nss/lib/libpkix/pkix_pl_nss/system/system.gyp
security/nss/lib/nss/exports.gyp
security/nss/lib/nss/nss.gyp
security/nss/lib/pk11wrap/exports.gyp
security/nss/lib/pk11wrap/pk11wrap.gyp
security/nss/lib/pkcs12/exports.gyp
security/nss/lib/pkcs12/pkcs12.gyp
security/nss/lib/pkcs7/exports.gyp
security/nss/lib/pkcs7/pkcs7.gyp
security/nss/lib/pki/exports.gyp
security/nss/lib/pki/pki.gyp
security/nss/lib/smime/exports.gyp
security/nss/lib/smime/smime.gyp
security/nss/lib/softoken/exports.gyp
security/nss/lib/softoken/legacydb/legacydb.gyp
security/nss/lib/softoken/softoken.gyp
security/nss/lib/sqlite/exports.gyp
security/nss/lib/sqlite/sqlite.gyp
security/nss/lib/ssl/exports.gyp
security/nss/lib/ssl/ssl.gyp
security/nss/lib/ssl/sslimpl.h
security/nss/lib/ssl/tls13con.c
security/nss/lib/sysinit/sysinit.gyp
security/nss/lib/util/exports.gyp
security/nss/lib/util/util.gyp
security/nss/lib/zlib/exports.gyp
security/nss/lib/zlib/zlib.gyp
security/nss/nss.gyp
security/nss/tests/cipher/cipher.txt
security/nss/tests/ssl/ssl.sh
--- a/security/nss/TAG-INFO
+++ b/security/nss/TAG-INFO
@@ -1,1 +1,1 @@
-233a44e96b22
+nss-gyp
--- a/security/nss/automation/taskcluster/docker-arm/Dockerfile
+++ b/security/nss/automation/taskcluster/docker-arm/Dockerfile
@@ -1,10 +1,10 @@
 FROM armv7/armhf-ubuntu:16.04
-MAINTAINER Franziskus Kiefer <franziskuskiefer@gmail.com>
+MAINTAINER Tim Taubert <ttaubert@mozilla.com>
 
 RUN useradd -d /home/worker -s /bin/bash -m worker
 WORKDIR /home/worker
 
 # Add build and test scripts.
 ADD bin /home/worker/bin
 RUN chmod +x /home/worker/bin/*
 
--- a/security/nss/automation/taskcluster/docker-arm/bin/checkout.sh
+++ b/security/nss/automation/taskcluster/docker-arm/bin/checkout.sh
@@ -1,18 +1,13 @@
 #!/usr/bin/env bash
 
 set -v -e -x
 
 if [ $(id -u) = 0 ]; then
-    # set up fake uname
-    if [ ! -f /bin/uname-real ]; then
-        mv /bin/uname /bin/uname-real
-        ln -s /home/worker/bin/uname.sh /bin/uname
-    fi
     # Drop privileges by re-running this script.
     exec su worker $0
 fi
 
 # Default values for testing.
 REVISION=${NSS_HEAD_REVISION:-default}
 REPOSITORY=${NSS_HEAD_REPOSITORY:-https://hg.mozilla.org/projects/nss}
 
deleted file mode 100755
--- a/security/nss/automation/taskcluster/docker-arm/bin/uname.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-args=`getopt rmvs $*`
-set -- $args
-for i
-do
-  if [ "$i" == "-v" ]; then
-    /bin/uname-real -v
-  fi
-  if [ "$i" == "-r" ]; then
-    echo "4.4.16-v7+"
-  fi
-  if [ "$i" == "-m" ]; then
-    echo "armv7l"
-  fi
-  if [ "$i" == "-s" ]; then
-    echo "Linux"
-  fi
-done
\ No newline at end of file
--- a/security/nss/automation/taskcluster/graph/src/extend.js
+++ b/security/nss/automation/taskcluster/graph/src/extend.js
@@ -119,17 +119,17 @@ export default async function main() {
 
   await scheduleWindows("Windows 2012 64 (debug)", {
     collection: "debug"
   });
 
   await scheduleTools();
 
   await scheduleLinux("Linux 32 (ARM, debug)", {
-    image: "franziskus/nss-arm-ci",
+    image: "ttaubert/nss-rpi-ci:0.0.3",
     provisioner: "localprovisioner",
     collection: "arm-debug",
     workerType: "nss-rpi",
     platform: "linux32",
     maxRunTime: 7200,
     tier: 3
   });
 }
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/addbuiltin/addbuiltin.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'addbuiltin',
+      'type': 'executable',
+      'sources': [
+        'addbuiltin.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/atob/atob.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'atob',
+      'type': 'executable',
+      'sources': [
+        'atob.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
--- a/security/nss/cmd/bltest/blapitest.c
+++ b/security/nss/cmd/bltest/blapitest.c
@@ -16,18 +16,16 @@
 #include "basicutil.h"
 #include "plgetopt.h"
 #include "softoken.h"
 #include "nspr.h"
 #include "secport.h"
 #include "secoid.h"
 #include "nssutil.h"
 
-#include "pkcs1_vectors.h"
-
 #ifndef NSS_DISABLE_ECC
 #include "ecl-curve.h"
 SECStatus EC_DecodeParams(const SECItem *encodedParams,
                           ECParams **ecparams);
 SECStatus EC_CopyParams(PLArenaPool *arena, ECParams *dstParams,
                         const ECParams *srcParams);
 #endif
 
@@ -3407,74 +3405,28 @@ rsaPrivKeysAreEqual(RSAPrivateKey *src, 
         fprintf(stderr, "original key:\n");
         dump_rsakey(src);
         fprintf(stderr, "recreated key:\n");
         dump_rsakey(dest);
     }
     return areEqual;
 }
 
-static int
-doRSAPopulateTestKV()
-{
-    RSAPrivateKey tstKey = { 0 };
-    SECStatus rv;
-    int failed = 0;
-    int i;
-
-    tstKey.arena = NULL;
-
-    /* Test public exponent, private exponent, modulus cases from
-     * pkcs1v15sign-vectors.txt. Some are valid PKCS#1 keys but not valid RSA
-     * ones (de = 1 mod lcm(p − 1, q − 1))
-     */
-    for (i = 0; i < PR_ARRAY_SIZE(PKCS1_VECTORS); ++i) {
-        struct pkcs1_test_vector *v = &PKCS1_VECTORS[i];
-
-        rsaPrivKeyReset(&tstKey);
-        tstKey.privateExponent.data = v->d;
-        tstKey.privateExponent.len = v->d_len;
-        tstKey.publicExponent.data = v->e;
-        tstKey.publicExponent.len = v->e_len;
-        tstKey.modulus.data = v->n;
-        tstKey.modulus.len = v->n_len;
-
-        rv = RSA_PopulatePrivateKey(&tstKey);
-        if (rv != SECSuccess) {
-            fprintf(stderr, "RSA Populate failed: pkcs1v15sign-vector %d\n", i);
-            failed = 1;
-        } else if (memcmp(v->q, tstKey.prime1.data, v->q_len) ||
-                   tstKey.prime1.len != v->q_len) {
-            fprintf(stderr, "RSA Populate key mismatch: pkcs1v15sign-vector %d q\n", i);
-            failed = 1;
-        } else if (memcmp(v->p, tstKey.prime2.data, v->p_len) ||
-                   tstKey.prime1.len != v->p_len) {
-            fprintf(stderr, "RSA Populate key mismatch: pkcs1v15sign-vector %d p\n", i);
-            failed = 1;
-        } else {
-            fprintf(stderr, "RSA Populate success: pkcs1v15sign-vector %d p\n", i);
-        }
-    }
-
-    PORT_FreeArena(tstKey.arena, PR_TRUE);
-    return failed;
-}
-
 /*
  * Test the RSA populate command to see that it can really build
- * keys from its components.
+ * keys from it's components.
  */
 static int
 doRSAPopulateTest(unsigned int keySize, unsigned long exponent)
 {
     RSAPrivateKey *srcKey;
     RSAPrivateKey tstKey = { 0 };
     SECItem expitem = { 0, 0, 0 };
     SECStatus rv;
-    unsigned char pubExp[32];
+    unsigned char pubExp[4];
     int expLen = 0;
     int failed = 0;
     int i;
 
     for (i = 0; i < sizeof(unsigned long); i++) {
         int shift = (sizeof(unsigned long) - i - 1) * 8;
         if (expLen || (exponent && ((unsigned long)0xffL << shift))) {
             pubExp[expLen] = (unsigned char)((exponent >> shift) & 0xff);
@@ -3547,18 +3499,18 @@ doRSAPopulateTest(unsigned int keySize, 
     tstKey.publicExponent = srcKey->publicExponent;
     tstKey.prime2 = srcKey->prime2; /* use q in the prime2 position */
 
     rv = RSA_PopulatePrivateKey(&tstKey);
     if (rv != SECSuccess) {
         fprintf(stderr, "RSA Populate failed: pubExp privExp q\n");
         fprintf(stderr, " - not fatal\n");
         /* it's possible that we can't uniquely determine the original key
-         * from just the exponents and prime. Populate returns an error rather
-         * than return the wrong key. */
+     * from just the exponents and prime. Populate returns an error rather
+     * than return the wrong key. */
     } else if (!rsaPrivKeysAreEqual(&tstKey, srcKey)) {
         /* if we returned a key, it *must* be correct */
         fprintf(stderr, "RSA Populate key mismatch: pubExp privExp  q\n");
         rv = RSA_PrivateKeyCheck(&tstKey);
         failed = 1;
     }
 
     /* test the advanced case2, public exponent, private exponent, modulus */
@@ -3572,30 +3524,28 @@ doRSAPopulateTest(unsigned int keySize, 
     if (rv != SECSuccess) {
         fprintf(stderr, "RSA Populate failed: pubExp privExp mod\n");
         failed = 1;
     } else if (!rsaPrivKeysAreEqual(&tstKey, srcKey)) {
         fprintf(stderr, "RSA Populate key mismatch: pubExp privExp  mod\n");
         failed = 1;
     }
 
-    PORT_FreeArena(srcKey->arena, PR_TRUE);
     return failed ? -1 : 0;
 }
 
 /* bltest commands */
 enum {
     cmd_Decrypt = 0,
     cmd_Encrypt,
     cmd_FIPS,
     cmd_Hash,
     cmd_Nonce,
     cmd_Dump,
     cmd_RSAPopulate,
-    cmd_RSAPopulateKV,
     cmd_Sign,
     cmd_SelfTest,
     cmd_Verify
 };
 
 /* bltest options */
 enum {
     opt_B64 = 0,
@@ -3639,17 +3589,16 @@ static secuCommandFlag bltest_commands[]
     {
       { /* cmd_Decrypt */ 'D', PR_FALSE, 0, PR_FALSE },
       { /* cmd_Encrypt */ 'E', PR_FALSE, 0, PR_FALSE },
       { /* cmd_FIPS */ 'F', PR_FALSE, 0, PR_FALSE },
       { /* cmd_Hash */ 'H', PR_FALSE, 0, PR_FALSE },
       { /* cmd_Nonce */ 'N', PR_FALSE, 0, PR_FALSE },
       { /* cmd_Dump */ 'P', PR_FALSE, 0, PR_FALSE },
       { /* cmd_RSAPopulate */ 'R', PR_FALSE, 0, PR_FALSE },
-      { /* cmd_RSAPopulateKV */ 'K', PR_FALSE, 0, PR_FALSE },
       { /* cmd_Sign */ 'S', PR_FALSE, 0, PR_FALSE },
       { /* cmd_SelfTest */ 'T', PR_FALSE, 0, PR_FALSE },
       { /* cmd_Verify */ 'V', PR_FALSE, 0, PR_FALSE }
     };
 
 static secuCommandFlag bltest_options[] =
     {
       { /* opt_B64 */ 'a', PR_FALSE, 0, PR_FALSE },
@@ -3777,22 +3726,16 @@ main(int argc, char **argv)
 
     testdir = (bltest.options[opt_SelfTestDir].activated) ? strdup(bltest.options[opt_SelfTestDir].arg)
                                                           : ".";
 
     /*
      * Handle three simple cases first
      */
 
-    /* test the RSA_PopulatePrivateKey function with known vectors */
-    if (bltest.commands[cmd_RSAPopulateKV].activated) {
-        PORT_Free(cipherInfo);
-        return doRSAPopulateTestKV();
-    }
-
     /* test the RSA_PopulatePrivateKey function */
     if (bltest.commands[cmd_RSAPopulate].activated) {
         unsigned int keySize = 1024;
         unsigned long exponent = 65537;
         int rounds = 1;
         int ret = -1;
 
         if (bltest.options[opt_KeySize].activated) {
@@ -3810,17 +3753,16 @@ main(int argc, char **argv)
             ret = doRSAPopulateTest(keySize, exponent);
             if (ret != 0) {
                 break;
             }
         }
         if (ret != 0) {
             fprintf(stderr, "RSA Populate test round %d: FAILED\n", i);
         }
-        PORT_Free(cipherInfo);
         return ret;
     }
 
     /* Do BLAPI self-test */
     if (bltest.commands[cmd_SelfTest].activated) {
         PRBool encrypt = PR_TRUE, decrypt = PR_TRUE;
         /* user may specified a set of ciphers to test.  parse them. */
         bltestCipherMode modesToTest[NUMMODES];
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/bltest/bltest.gyp
@@ -0,0 +1,35 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'bltest',
+      'type': 'executable',
+      'sources': [
+        'blapitest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '../../nss/lib/softoken'
+    ],
+    'defines': [
+      'NSS_USE_STATIC_LIBS'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+    'use_static_libs': 1
+  }
+}
\ No newline at end of file
deleted file mode 100644
--- a/security/nss/cmd/bltest/pkcs1_vectors.h
+++ /dev/null
@@ -1,789 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/* Vectors from pkcs1v15sign-vectors.txt */
-
-struct pkcs1_test_vector {
-    unsigned char *n;
-    unsigned long n_len;
-    unsigned char *e;
-    unsigned long e_len;
-    unsigned char *d;
-    unsigned long d_len;
-    unsigned char *p;
-    unsigned long p_len;
-    unsigned char *q;
-    unsigned long q_len;
-};
-
-struct pkcs1_test_vector PKCS1_VECTORS[15] = {
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88,
-            0x5f, 0x2a, 0x4b, 0xbe, 0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac,
-
-            0x3c, 0x56, 0x8c, 0x8f, 0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02,
-
-            0x66, 0xc8, 0xc6, 0xa3, 0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1,
-            0x12, 0x31, 0x88, 0x44, 0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f,
-            0xee, 0x89, 0x6a, 0x10, 0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7,
-            0x34, 0xe4, 0x47, 0x27, 0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53,
-            0x26, 0x83, 0x10, 0x9c, 0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c,
-            0x31, 0xb4, 0xbd, 0x2f, 0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52,
-            0xce, 0xe3, 0x4f, 0x9e, 0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22,
-            0xad, 0x79, 0xc6, 0xdc, 0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3,
-            0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    },
-    {
-        (unsigned char[]){
-            0xa5, 0x6e, 0x4a, 0x0e, 0x70, 0x10, 0x17, 0x58, 0x9a, 0x51,
-            0x87, 0xdc, 0x7e, 0xa8, 0x41, 0xd1, 0x56, 0xf2, 0xec, 0x0e,
-            0x36, 0xad, 0x52, 0xa4, 0x4d, 0xfe, 0xb1, 0xe6, 0x1f, 0x7a,
-            0xd9, 0x91, 0xd8, 0xc5, 0x10, 0x56, 0xff, 0xed, 0xb1, 0x62,
-            0xb4, 0xc0, 0xf2, 0x83, 0xa1, 0x2a, 0x88, 0xa3, 0x94, 0xdf,
-            0xf5, 0x26, 0xab, 0x72, 0x91, 0xcb, 0xb3, 0x07, 0xce, 0xab,
-            0xfc, 0xe0, 0xb1, 0xdf, 0xd5, 0xcd, 0x95, 0x08, 0x09, 0x6d,
-            0x5b, 0x2b, 0x8b, 0x6d, 0xf5, 0xd6, 0x71, 0xef, 0x63, 0x77,
-            0xc0, 0x92, 0x1c, 0xb2, 0x3c, 0x27, 0x0a, 0x70, 0xe2, 0x59,
-            0x8e, 0x6f, 0xf8, 0x9d, 0x19, 0xf1, 0x05, 0xac, 0xc2, 0xd3,
-            0xf0, 0xcb, 0x35, 0xf2, 0x92, 0x80, 0xe1, 0x38, 0x6b, 0x6f,
-            0x64, 0xc4, 0xef, 0x22, 0xe1, 0xe1, 0xf2, 0x0d, 0x0c, 0xe8,
-            0xcf, 0xfb, 0x22, 0x49, 0xbd, 0x9a, 0x21, 0x37 },
-        128,
-        (unsigned char[]){ 0x01, 0x00, 0x01 }, 3,
-        (unsigned char[]){
-            0x33, 0xa5, 0x04, 0x2a, 0x90, 0xb2, 0x7d, 0x4f, 0x54, 0x51,
-            0xca, 0x9b, 0xbb, 0xd0, 0xb4, 0x47, 0x71, 0xa1, 0x01, 0xaf,
-            0x88, 0x43, 0x40, 0xae, 0xf9, 0x88, 0x5f, 0x2a, 0x4b, 0xbe,
-            0x92, 0xe8, 0x94, 0xa7, 0x24, 0xac, 0x3c, 0x56, 0x8c, 0x8f,
-            0x97, 0x85, 0x3a, 0xd0, 0x7c, 0x02, 0x66, 0xc8, 0xc6, 0xa3,
-            0xca, 0x09, 0x29, 0xf1, 0xe8, 0xf1, 0x12, 0x31, 0x88, 0x44,
-            0x29, 0xfc, 0x4d, 0x9a, 0xe5, 0x5f, 0xee, 0x89, 0x6a, 0x10,
-            0xce, 0x70, 0x7c, 0x3e, 0xd7, 0xe7, 0x34, 0xe4, 0x47, 0x27,
-            0xa3, 0x95, 0x74, 0x50, 0x1a, 0x53, 0x26, 0x83, 0x10, 0x9c,
-            0x2a, 0xba, 0xca, 0xba, 0x28, 0x3c, 0x31, 0xb4, 0xbd, 0x2f,
-            0x53, 0xc3, 0xee, 0x37, 0xe3, 0x52, 0xce, 0xe3, 0x4f, 0x9e,
-            0x50, 0x3b, 0xd8, 0x0c, 0x06, 0x22, 0xad, 0x79, 0xc6, 0xdc,
-            0xee, 0x88, 0x35, 0x47, 0xc6, 0xa3, 0xb3, 0x25 },
-        128,
-        (unsigned char[]){
-            0xb6, 0x9d, 0xca, 0x1c, 0xf7, 0xd4, 0xd7, 0xec, 0x81, 0xe7,
-            0x5b, 0x90, 0xfc, 0xca, 0x87, 0x4a, 0xbc, 0xde, 0x12, 0x3f,
-            0xd2, 0x70, 0x01, 0x80, 0xaa, 0x90, 0x47, 0x9b, 0x6e, 0x48,
-            0xde, 0x8d, 0x67, 0xed, 0x24, 0xf9, 0xf1, 0x9d, 0x85, 0xba,
-            0x27, 0x58, 0x74, 0xf5, 0x42, 0xcd, 0x20, 0xdc, 0x72, 0x3e,
-            0x69, 0x63, 0x36, 0x4a, 0x1f, 0x94, 0x25, 0x45, 0x2b, 0x26,
-            0x9a, 0x67, 0x99, 0xfd },
-        64,
-        (unsigned char[]){
-            0xe7, 0xe8, 0x94, 0x27, 0x20, 0xa8, 0x77, 0x51, 0x72, 0x73,
-            0xa3, 0x56, 0x05, 0x3e, 0xa2, 0xa1, 0xbc, 0x0c, 0x94, 0xaa,
-            0x72, 0xd5, 0x5c, 0x6e, 0x86, 0x29, 0x6b, 0x2d, 0xfc, 0x96,
-            0x79, 0x48, 0xc0, 0xa7, 0x2c, 0xbc, 0xcc, 0xa7, 0xea, 0xcb,
-            0x35, 0x70, 0x6e, 0x09, 0xa1, 0xdf, 0x55, 0xa1, 0x53, 0x5b,
-            0xd9, 0xb3, 0xcc, 0x34, 0x16, 0x0b, 0x3b, 0x6d, 0xcd, 0x3e,
-            0xda, 0x8e, 0x64, 0x43 },
-        64,
-    }
-};
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/btoa/btoa.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'btoa',
+      'type': 'executable',
+      'sources': [
+        'btoa.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/certcgi/certcgi.gyp
@@ -0,0 +1,33 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'certcgi',
+      'type': 'executable',
+      'sources': [
+        'certcgi.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20',
+      'NSS_USE_STATIC_LIBS'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+    'use_static_libs': 1
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/certutil/certutil.gyp
@@ -0,0 +1,32 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'certutil',
+      'type': 'executable',
+      'sources': [
+        'certext.c',
+        'certutil.c',
+        'keystuff.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/chktest/chktest.gyp
@@ -0,0 +1,32 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'chktest',
+      'type': 'executable',
+      'sources': [
+        'chktest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSS_USE_STATIC_LIBS'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+    'use_static_libs': 1
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/crlutil/crlutil.gyp
@@ -0,0 +1,32 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'crlutil',
+      'type': 'executable',
+      'sources': [
+        'crlgen.c',
+        'crlgen_lex.c',
+        'crlutil.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/crmftest/crmftest.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'crmftest',
+      'type': 'executable',
+      'sources': [
+        'testcrmf.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/crmf/crmf.gyp:crmf'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/dbtest/dbtest.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'dbtest',
+      'type': 'executable',
+      'sources': [
+        'dbtest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/derdump/derdump.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'derdump',
+      'type': 'executable',
+      'sources': [
+        'derdump.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/digest/digest.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'digest',
+      'type': 'executable',
+      'sources': [
+        'digest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/ecperf/ecperf.gyp
@@ -0,0 +1,35 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'ecperf',
+      'type': 'executable',
+      'sources': [
+        'ecperf.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '../../nss/lib/softoken'
+    ],
+    'defines': [
+      'NSS_USE_STATIC_LIBS'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+    'use_static_libs': 1
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/ectest/ectest.gyp
@@ -0,0 +1,34 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'ectest',
+      'type': 'executable',
+      'sources': [
+        'ectest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '../../nss/lib/softoken'
+    ],
+    'defines': [
+      'NSS_USE_STATIC_LIBS'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+    'use_static_libs': 1
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/fipstest/fipstest.gyp
@@ -0,0 +1,31 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'fipstest',
+      'type': 'executable',
+      'sources': [
+        'fipstest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSS_USE_STATIC_LIBS'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+    'use_static_libs': 1
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/httpserv/httpserv.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'httpserv',
+      'type': 'executable',
+      'sources': [
+        'httpserv.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/lib/exports.gyp
@@ -0,0 +1,27 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'cmd_lib_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'basicutil.h',
+            'pk11table.h',
+            'secutil.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/lib/lib.gyp
@@ -0,0 +1,35 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'sectool',
+      'type': 'static_library',
+      'sources': [
+        'basicutil.c',
+        'derprint.c',
+        'ffs.c',
+        'moreoids.c',
+        'pk11table.c',
+        'pppolicy.c',
+        'secpwd.c',
+        'secutil.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/listsuites/listsuites.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'listsuites',
+      'type': 'executable',
+      'sources': [
+        'listsuites.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/lowhashtest/lowhashtest.gyp
@@ -0,0 +1,32 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lowhashtest',
+      'type': 'executable',
+      'sources': [
+        'lowhashtest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/freebl/freebl.gyp:freebl3',
+        '<(DEPTH)/cmd/lib/lib.gyp:sectool'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '../../nss/lib/freebl'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/makepqg/makepqg.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'makepqg',
+      'type': 'executable',
+      'sources': [
+        'makepqg.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/modutil/modutil.gyp
@@ -0,0 +1,44 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'modutil',
+      'type': 'executable',
+      'sources': [
+        'install-ds.c',
+        'install.c',
+        'installparse.c',
+        'instsec.c',
+        'lex.Pk11Install_yy.c',
+        'modutil.c',
+        'pk11.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/lib/jar/jar.gyp:jar',
+        '<(DEPTH)/lib/zlib/zlib.gyp:nss_zlib'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '<(PRODUCT_DIR)/dist/nss/private',
+      '<(PRODUCT_DIR)/dist/dbm/private'
+    ],
+    'defines': [
+      'NSPR20',
+      'YY_NO_UNPUT',
+      'YY_NO_INPUT'
+    ]
+  },
+  'variables': {
+    'module': 'sectools'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/multinit/multinit.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'multinit',
+      'type': 'executable',
+      'sources': [
+        'multinit.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/ocspclnt/ocspclnt.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'ocspclnt',
+      'type': 'executable',
+      'sources': [
+        'ocspclnt.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/ocspresp/ocspresp.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'ocspresp',
+      'type': 'executable',
+      'sources': [
+        'ocspresp.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/oidcalc/oidcalc.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'oidcalc',
+      'type': 'executable',
+      'sources': [
+        'oidcalc.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/p7content/p7content.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'p7content',
+      'type': 'executable',
+      'sources': [
+        'p7content.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/p7env/p7env.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'p7env',
+      'type': 'executable',
+      'sources': [
+        'p7env.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/p7sign/p7sign.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'p7sign',
+      'type': 'executable',
+      'sources': [
+        'p7sign.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/p7verify/p7verify.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'p7verify',
+      'type': 'executable',
+      'sources': [
+        'p7verify.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/pk11gcmtest/pk11gcmtest.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pk11gcmtest',
+      'type': 'executable',
+      'sources': [
+        'pk11gcmtest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/pk11mode/pk11mode.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pk11mode',
+      'type': 'executable',
+      'sources': [
+        'pk11mode.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/pk12util/pk12util.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pk12util',
+      'type': 'executable',
+      'sources': [
+        'pk12util.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/pk1sign/pk1sign.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pk1sign',
+      'type': 'executable',
+      'sources': [
+        'pk1sign.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/pkix-errcodes/pkix-errcodes.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkix-errcodes',
+      'type': 'executable',
+      'sources': [
+        'pkix-errcodes.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/platlibs.gypi
@@ -0,0 +1,78 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'variables': {
+    'use_static_libs%': 0,
+  },
+  'target_defaults': {
+    'dependencies': [
+      '<(DEPTH)/cmd/lib/lib.gyp:sectool',
+    ],
+    'conditions': [
+      ['moz_fold_libs==0', {
+        'dependencies': [
+          '<(DEPTH)/lib/util/util.gyp:nssutil3',
+        ],
+      }],
+      ['<(use_static_libs)==1', {
+        'defines': ['NSS_USE_STATIC_LIBS'],
+        'dependencies': [
+          '<(DEPTH)/lib/smime/smime.gyp:smime',
+          '<(DEPTH)/lib/ssl/ssl.gyp:ssl',
+          '<(DEPTH)/lib/nss/nss.gyp:nss_static',
+          '<(DEPTH)/lib/pkcs12/pkcs12.gyp:pkcs12',
+          '<(DEPTH)/lib/pkcs7/pkcs7.gyp:pkcs7',
+          '<(DEPTH)/lib/certhigh/certhigh.gyp:certhi',
+          '<(DEPTH)/lib/cryptohi/cryptohi.gyp:cryptohi',
+          '<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap',
+          '<(DEPTH)/lib/softoken/softoken.gyp:softokn',
+          '<(DEPTH)/lib/certdb/certdb.gyp:certdb',
+          '<(DEPTH)/lib/pki/pki.gyp:nsspki',
+          '<(DEPTH)/lib/dev/dev.gyp:nssdev',
+          '<(DEPTH)/lib/base/base.gyp:nssb',
+          '<(DEPTH)/lib/freebl/freebl.gyp:freebl',
+          '<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap',
+          '<(DEPTH)/lib/certhigh/certhigh.gyp:certhi',
+          '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3',
+        ],
+        'conditions': [
+          [ 'disable_dbm==0', {
+            'dependencies': [
+              '<(DEPTH)/lib/dbm/src/src.gyp:dbm',
+              '<(DEPTH)/lib/softoken/legacydb/legacydb.gyp:nssdbm',
+            ],
+          }],
+          [ 'disable_libpkix==0', {
+            'dependencies': [
+              '<(DEPTH)/lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
+              '<(DEPTH)/lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
+              '<(DEPTH)/lib/libpkix/pkix/params/params.gyp:pkixparams',
+              '<(DEPTH)/lib/libpkix/pkix/results/results.gyp:pkixresults',
+              '<(DEPTH)/lib/libpkix/pkix/top/top.gyp:pkixtop',
+              '<(DEPTH)/lib/libpkix/pkix/util/util.gyp:pkixutil',
+              '<(DEPTH)/lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
+              '<(DEPTH)/lib/libpkix/pkix/store/store.gyp:pkixstore',
+              '<(DEPTH)/lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
+              '<(DEPTH)/lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
+              '<(DEPTH)/lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule'
+            ],
+          }],
+        ]},{ # !use_static_libs
+          'conditions': [
+            ['moz_fold_libs==0', {
+              'dependencies': [
+                '<(DEPTH)/lib/ssl/ssl.gyp:ssl3',
+                '<(DEPTH)/lib/smime/smime.gyp:smime3',
+                '<(DEPTH)/lib/nss/nss.gyp:nss3',
+              ],
+            }, {
+              'libraries': [
+                '<(moz_folded_library_name)',
+              ],
+            }]
+          ],
+        }],
+    ],
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/pp/pp.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pp',
+      'type': 'executable',
+      'sources': [
+        'pp.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/pwdecrypt/pwdecrypt.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pwdecrypt',
+      'type': 'executable',
+      'sources': [
+        'pwdecrypt.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/rsaperf/rsaperf.gyp
@@ -0,0 +1,36 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'rsaperf',
+      'type': 'executable',
+      'sources': [
+        'defkey.c',
+        'rsaperf.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '../../nss/lib/softoken'
+    ],
+    'defines': [
+      'NSS_USE_STATIC_LIBS'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+    'use_static_libs': 1
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/sdrtest/sdrtest.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'sdrtest',
+      'type': 'executable',
+      'sources': [
+        'sdrtest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
--- a/security/nss/cmd/selfserv/selfserv.c
+++ b/security/nss/cmd/selfserv/selfserv.c
@@ -56,19 +56,16 @@
 
 int NumSidCacheEntries = 1024;
 
 static int handle_connection(PRFileDesc *, PRFileDesc *, int);
 
 static const char envVarName[] = { SSL_ENV_VAR_NAME };
 static const char inheritableSockName[] = { "SELFSERV_LISTEN_SOCKET" };
 
-#define MAX_VIRT_SERVER_NAME_ARRAY_INDEX 10
-#define MAX_CERT_NICKNAME_ARRAY_INDEX 10
-
 #define DEFAULT_BULK_TEST 16384
 #define MAX_BULK_TEST 1048576 /* 1 MB */
 static PRBool testBulk;
 static PRUint32 testBulkSize = DEFAULT_BULK_TEST;
 static PRInt32 testBulkTotal;
 static char *testBulkBuf;
 static PRDescIdentity log_layer_id = PR_INVALID_IO_LAYER;
 static PRFileDesc *loggingFD;
@@ -90,17 +87,17 @@ static enum ocspStaplingModeEnum {
     osm_badsig,    /* supply a good status response with a bad signature */
     osm_corrupted, /* supply a corrupted data block as the status */
     osm_random,    /* use a random response for each connection */
     osm_ocsp       /* retrieve ocsp status from external ocsp server,
               use empty status if server is unavailable */
 } ocspStaplingMode = osm_disabled;
 typedef enum ocspStaplingModeEnum ocspStaplingModeType;
 static char *ocspStaplingCA = NULL;
-static SECItemArray *certStatus[MAX_CERT_NICKNAME_ARRAY_INDEX] = { NULL };
+static SECItemArray *certStatus[kt_kea_size] = { NULL };
 
 const int ssl3CipherSuites[] = {
     -1,                                /* SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA* a */
     -1,                                /* SSL_FORTEZZA_DMS_WITH_RC4_128_SHA     * b */
     TLS_RSA_WITH_RC4_128_MD5,          /* c */
     TLS_RSA_WITH_3DES_EDE_CBC_SHA,     /* d */
     TLS_RSA_WITH_DES_CBC_SHA,          /* e */
     -1,                                /* TLS_RSA_EXPORT_WITH_RC4_40_MD5        * f */
@@ -426,16 +423,18 @@ myBadCertHandler(void *arg, PRFileDesc *
     int err = PR_GetError();
     if (!MakeCertOK)
         fprintf(stderr,
                 "selfserv: -- SSL: Client Certificate Invalid, err %d.\n%s\n",
                 err, SECU_Strerror(err));
     return (MakeCertOK ? SECSuccess : SECFailure);
 }
 
+#define MAX_VIRT_SERVER_NAME_ARRAY_INDEX 10
+
 /* Simple SNI socket config function that does not use SSL_ReconfigFD.
  * Only uses one server name but verifies that the names match. */
 PRInt32
 mySSLSNISocketConfig(PRFileDesc *fd, const SECItem *sniNameArr,
                      PRUint32 sniNameArrSize, void *arg)
 {
     PRInt32 i = 0;
     const SECItem *current = sniNameArr;
@@ -800,19 +799,16 @@ PRBool enableCompression = PR_FALSE;
 PRBool failedToNegotiateName = PR_FALSE;
 PRBool enableExtendedMasterSecret = PR_FALSE;
 PRBool zeroRTT = PR_FALSE;
 PRBool enableALPN = PR_FALSE;
 
 static char *virtServerNameArray[MAX_VIRT_SERVER_NAME_ARRAY_INDEX];
 static int virtServerNameIndex = 1;
 
-static char *certNicknameArray[MAX_CERT_NICKNAME_ARRAY_INDEX];
-static int certNicknameIndex = 0;
-
 static const char stopCmd[] = { "GET /stop " };
 static const char getCmd[] = { "GET " };
 static const char EOFmsg[] = { "EOF\r\n\r\n\r\n" };
 static const char outHeader[] = {
     "HTTP/1.0 200 OK\r\n"
     "Server: Generic Web Server\r\n"
     "Date: Tue, 26 Aug 1997 22:10:05 GMT\r\n"
     "Content-type: text/plain\r\n"
@@ -1165,17 +1161,17 @@ makeSignedOCSPResponse(PLArenaPool *aren
     CERT_DestroyOCSPCertID(cid);
     cid = NULL;
 
     return result;
 }
 
 void
 setupCertStatus(PLArenaPool *arena, enum ocspStaplingModeEnum ocspStaplingMode,
-                CERTCertificate *cert, int index, secuPWData *pwdata)
+                CERTCertificate *cert, SSLKEAType kea, secuPWData *pwdata)
 {
     if (ocspStaplingMode == osm_random) {
         /* 6 different responses */
         int r = rand() % 6;
         switch (r) {
             case 0:
                 ocspStaplingMode = osm_good;
                 break;
@@ -1219,17 +1215,17 @@ setupCertStatus(PLArenaPool *arena, enum
             case osm_ocsp:
                 errExit("stapling mode \"ocsp\" not implemented");
                 break;
                 break;
             default:
                 break;
         }
         if (multiOcspResponses) {
-            certStatus[index] = multiOcspResponses;
+            certStatus[kea] = multiOcspResponses;
         }
     }
 }
 
 int
 handle_connection(
     PRFileDesc *tcp_sock,
     PRFileDesc *model_sock,
@@ -1250,16 +1246,17 @@ handle_connection(
     int numIOVs;
     PRSocketOptionData opt;
     PRIOVec iovs[16];
     char msgBuf[160];
     char buf[10240];
     char fileName[513];
     char proto[128];
     PRDescIdentity aboveLayer = PR_INVALID_IO_LAYER;
+    SSLKEAType kea;
 
     pBuf = buf;
     bufRem = sizeof buf;
 
     VLOG(("selfserv: handle_connection: starting"));
     opt.option = PR_SockOpt_Nonblocking;
     opt.value.non_blocking = PR_FALSE;
     PR_SetSocketOption(tcp_sock, &opt);
@@ -1276,16 +1273,22 @@ handle_connection(
         if (rv != SECSuccess) {
             errWarn("SSL_ResetHandshake");
             goto cleanup;
         }
     } else {
         ssl_sock = tcp_sock;
     }
 
+    for (kea = kt_rsa; kea < kt_kea_size; kea++) {
+        if (certStatus[kea] != NULL) {
+            SSL_SetStapledOCSPResponses(ssl_sock, certStatus[kea], kea);
+        }
+    }
+
     if (loggingLayer) {
         /* find the layer where our new layer is to be pushed */
         aboveLayer = PR_GetLayersIdentity(ssl_sock->lower);
         if (aboveLayer == PR_INVALID_IO_LAYER) {
             errExit("PRGetUniqueIdentity");
         }
         /* create the new layer - this is a very cheap operation */
         loggingFD = PR_CreateIOLayerStub(log_layer_id, &loggingMethods);
@@ -1812,19 +1815,19 @@ handshakeCallback(PRFileDesc *fd, void *
 void
 server_main(
     PRFileDesc *listen_sock,
     int requestCert,
     SECKEYPrivateKey **privKey,
     CERTCertificate **cert,
     const char *expectedHostNameVal)
 {
-    int i;
     PRFileDesc *model_sock = NULL;
     int rv;
+    SSLKEAType kea;
     SECStatus secStatus;
 
     if (useModelSocket) {
         model_sock = PR_NewTCPSocket();
         if (model_sock == NULL) {
             errExit("PR_NewTCPSocket on model socket");
         }
         model_sock = SSL_ImportFD(NULL, model_sock);
@@ -1911,27 +1914,22 @@ server_main(
         rv = SSL_OptionSet(model_sock, SSL_ENABLE_EXTENDED_MASTER_SECRET, PR_TRUE);
         if (rv != SECSuccess) {
             errExit("error enabling extended master secret ");
         }
     }
 
     /* This uses the legacy certificate API.  See mySSLSNISocketConfig() for the
      * new, prefered API. */
-    for (i = 0; i < certNicknameIndex; i++) {
-        if (cert[i] != NULL) {
-            const SSLExtraServerCertData ocspData = {
-                ssl_auth_null, NULL, certStatus[i], NULL
-            };
-
-            secStatus = SSL_ConfigServerCert(model_sock, cert[i],
-                                             privKey[i], &ocspData,
-                                             sizeof(ocspData));
+    for (kea = kt_rsa; kea < kt_kea_size; kea++) {
+        if (cert[kea] != NULL) {
+            secStatus = SSL_ConfigSecureServer(model_sock,
+                                               cert[kea], privKey[kea], kea);
             if (secStatus != SECSuccess)
-                errExit("SSL_ConfigServerCert");
+                errExit("SSL_ConfigSecureServer");
         }
     }
 
     if (bigBuf.data) { /* doing FDX */
         rv = SSL_OptionSet(model_sock, SSL_ENABLE_FDX, 1);
         if (rv < 0) {
             errExit("SSL_OptionSet SSL_ENABLE_FDX");
         }
@@ -2166,27 +2164,32 @@ enableOCSPStapling(const char *mode)
     }
     return SECFailure;
 }
 
 int
 main(int argc, char **argv)
 {
     char *progName = NULL;
+    char *nickName = NULL;
+#ifndef NSS_DISABLE_ECC
+    char *ecNickName = NULL;
+#endif
+    char *dsaNickName = NULL;
     const char *fileName = NULL;
     char *cipherString = NULL;
     const char *dir = ".";
     char *passwd = NULL;
     char *pwfile = NULL;
     const char *pidFile = NULL;
     char *tmp;
     char *envString;
     PRFileDesc *listen_sock;
-    CERTCertificate *cert[MAX_CERT_NICKNAME_ARRAY_INDEX] = { NULL };
-    SECKEYPrivateKey *privKey[MAX_CERT_NICKNAME_ARRAY_INDEX] = { NULL };
+    CERTCertificate *cert[kt_kea_size] = { NULL };
+    SECKEYPrivateKey *privKey[kt_kea_size] = { NULL };
     int optionsFound = 0;
     int maxProcs = 1;
     unsigned short port = 0;
     SECStatus rv;
     PRStatus prStatus;
     PRBool bindOnly = PR_FALSE;
     PRBool useLocalThreads = PR_FALSE;
     PLOptState *optstate;
@@ -2268,21 +2271,17 @@ main(int argc, char **argv)
                 NoReuse = PR_TRUE;
                 break;
 
             case 'R':
                 disableRollBack = PR_TRUE;
                 break;
 
             case 'S':
-                if (certNicknameIndex >= MAX_CERT_NICKNAME_ARRAY_INDEX) {
-                    Usage(progName);
-                    break;
-                }
-                certNicknameArray[certNicknameIndex++] = PORT_Strdup(optstate->value);
+                dsaNickName = PORT_Strdup(optstate->value);
                 break;
 
             case 'T':
                 if (enableOCSPStapling(optstate->value) != SECSuccess) {
                     fprintf(stderr, "Invalid OCSP stapling mode.\n");
                     fprintf(stderr, "Run '%s -h' for usage information.\n", progName);
                     exit(53);
                 }
@@ -2327,21 +2326,17 @@ main(int argc, char **argv)
                 break;
 
             case 'd':
                 dir = optstate->value;
                 break;
 
 #ifndef NSS_DISABLE_ECC
             case 'e':
-                if (certNicknameIndex >= MAX_CERT_NICKNAME_ARRAY_INDEX) {
-                    Usage(progName);
-                    break;
-                }
-                certNicknameArray[certNicknameIndex++] = PORT_Strdup(optstate->value);
+                ecNickName = PORT_Strdup(optstate->value);
                 break;
 #endif /* NSS_DISABLE_ECC */
 
             case 'f':
                 pwdata.source = PW_FROMFILE;
                 pwdata.data = pwfile = PORT_Strdup(optstate->value);
                 break;
 
@@ -2372,21 +2367,17 @@ main(int argc, char **argv)
                 useLocalThreads = PR_TRUE;
                 break;
 
             case 'm':
                 useModelSocket = PR_TRUE;
                 break;
 
             case 'n':
-                if (certNicknameIndex >= MAX_CERT_NICKNAME_ARRAY_INDEX) {
-                    Usage(progName);
-                    break;
-                }
-                certNicknameArray[certNicknameIndex++] = PORT_Strdup(optstate->value);
+                nickName = PORT_Strdup(optstate->value);
                 virtServerNameArray[0] = PORT_Strdup(optstate->value);
                 break;
 
             case 'P':
                 certPrefix = PORT_Strdup(optstate->value);
                 break;
 
             case 'o':
@@ -2485,18 +2476,24 @@ main(int argc, char **argv)
             exit(1);
         }
         if (listen_sock) {
             PR_Close(listen_sock);
         }
         exit(0);
     }
 
-    if (certNicknameIndex == 0) {
-        fprintf(stderr, "Must specify at least one certificate nickname using '-n' (RSA), '-S' (DSA), or 'e' (EC).\n");
+    if ((nickName == NULL) &&
+        (dsaNickName == NULL)
+#ifndef NSS_DISABLE_ECC
+        && (ecNickName == NULL)
+#endif
+            ) {
+
+        fprintf(stderr, "Required arg '-n' (rsa nickname) not supplied.\n");
         fprintf(stderr, "Run '%s -h' for usage information.\n", progName);
         exit(6);
     }
 
     if (port == 0) {
         fprintf(stderr, "Required argument 'port' must be non-zero value\n");
         exit(7);
     }
@@ -2641,33 +2638,66 @@ main(int argc, char **argv)
         }
         PORT_Free(cstringSaved);
     }
 
     certStatusArena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
     if (!certStatusArena)
         errExit("cannot allocate certStatusArena");
 
-    for (i = 0; i < certNicknameIndex; i++) {
-        cert[i] = PK11_FindCertFromNickname(certNicknameArray[i], &pwdata);
-        if (cert[i] == NULL) {
-            fprintf(stderr, "selfserv: Can't find certificate %s\n", certNicknameArray[i]);
+    if (nickName) {
+        cert[kt_rsa] = PK11_FindCertFromNickname(nickName, &pwdata);
+        if (cert[kt_rsa] == NULL) {
+            fprintf(stderr, "selfserv: Can't find certificate %s\n", nickName);
             exit(10);
         }
-        privKey[i] = PK11_FindKeyByAnyCert(cert[i], &pwdata);
-        if (privKey[i] == NULL) {
+        privKey[kt_rsa] = PK11_FindKeyByAnyCert(cert[kt_rsa], &pwdata);
+        if (privKey[kt_rsa] == NULL) {
             fprintf(stderr, "selfserv: Can't find Private Key for cert %s\n",
-                    certNicknameArray[i]);
+                    nickName);
             exit(11);
         }
-#ifdef NSS_DISABLE_ECC
-        if (privKey[i]->keyType != ecKey)
-#endif
-            setupCertStatus(certStatusArena, ocspStaplingMode, cert[i], i, &pwdata);
+        setupCertStatus(certStatusArena, ocspStaplingMode, cert[kt_rsa], kt_rsa,
+                        &pwdata);
     }
+    if (dsaNickName) {
+        /* Investigate if ssl_kea_dh should be changed to ssl_auth_dsa.
+         * See bug 102794.*/
+        cert[ssl_kea_dh] = PK11_FindCertFromNickname(dsaNickName, &pwdata);
+        if (cert[ssl_kea_dh] == NULL) {
+            fprintf(stderr, "selfserv: Can't find certificate %s\n", dsaNickName);
+            exit(12);
+        }
+        privKey[ssl_kea_dh] = PK11_FindKeyByAnyCert(cert[ssl_kea_dh], &pwdata);
+        if (privKey[ssl_kea_dh] == NULL) {
+            fprintf(stderr, "selfserv: Can't find Private Key for cert %s\n",
+                    dsaNickName);
+            exit(11);
+        }
+        setupCertStatus(certStatusArena, ocspStaplingMode, cert[ssl_kea_dh], ssl_kea_dh,
+                        &pwdata);
+    }
+#ifndef NSS_DISABLE_ECC
+    if (ecNickName) {
+        cert[kt_ecdh] = PK11_FindCertFromNickname(ecNickName, &pwdata);
+        if (cert[kt_ecdh] == NULL) {
+            fprintf(stderr, "selfserv: Can't find certificate %s\n",
+                    ecNickName);
+            exit(13);
+        }
+        privKey[kt_ecdh] = PK11_FindKeyByAnyCert(cert[kt_ecdh], &pwdata);
+        if (privKey[kt_ecdh] == NULL) {
+            fprintf(stderr, "selfserv: Can't find Private Key for cert %s\n",
+                    ecNickName);
+            exit(11);
+        }
+        setupCertStatus(certStatusArena, ocspStaplingMode, cert[kt_ecdh], kt_ecdh,
+                        &pwdata);
+    }
+#endif /* NSS_DISABLE_ECC */
 
     if (configureWeakDHE > 0) {
         fprintf(stderr, "selfserv: Creating dynamic weak DH parameters\n");
         rv = SSL_EnableWeakDHEPrimeGroup(NULL, PR_TRUE);
         if (rv != SECSuccess) {
             goto cleanup;
         }
         fprintf(stderr, "selfserv: Done creating dynamic weak DH parameters\n");
@@ -2704,45 +2734,55 @@ cleanup:
     }
     if (failedToNegotiateName) {
         fprintf(stderr, "selfserv: Failed properly negotiate server name\n");
         exit(1);
     }
 
     {
         int i;
-        for (i = 0; i < certNicknameIndex; i++) {
+        for (i = 0; i < kt_kea_size; i++) {
             if (cert[i]) {
                 CERT_DestroyCertificate(cert[i]);
             }
             if (privKey[i]) {
                 SECKEY_DestroyPrivateKey(privKey[i]);
             }
-            PORT_Free(certNicknameArray[i]);
         }
         for (i = 0; virtServerNameArray[i]; i++) {
             PORT_Free(virtServerNameArray[i]);
         }
     }
 
     if (debugCache) {
         nss_DumpCertificateCacheInfo();
     }
+    if (nickName) {
+        PORT_Free(nickName);
+    }
     if (expectedHostNameVal) {
         PORT_Free(expectedHostNameVal);
     }
     if (passwd) {
         PORT_Free(passwd);
     }
     if (pwfile) {
         PORT_Free(pwfile);
     }
     if (certPrefix && certPrefix != emptyString) {
         PORT_Free(certPrefix);
     }
+#ifndef NSS_DISABLE_ECC
+    if (ecNickName) {
+        PORT_Free(ecNickName);
+    }
+#endif
+    if (dsaNickName) {
+        PORT_Free(dsaNickName);
+    }
 
     if (hasSidCache) {
         SSL_ShutdownServerSessionIDCache();
     }
     if (certStatusArena) {
         PORT_FreeArena(certStatusArena, PR_FALSE);
     }
     if (NSS_Shutdown() != SECSuccess) {
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/selfserv/selfserv.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'selfserv',
+      'type': 'executable',
+      'sources': [
+        'selfserv.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/shlibsign/mangle/mangle.gyp
@@ -0,0 +1,31 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi',
+    '../../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'mangle',
+      'type': 'executable',
+      'sources': [
+        'mangle.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'SHLIB_SUFFIX=\"<(dll_suffix)\"',
+      'SHLIB_PREFIX=\"<(dll_prefix)\"'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+    'use_static_libs': 1
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/shlibsign/shlibsign.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'shlibsign',
+      'type': 'executable',
+      'sources': [
+        'shlibsign.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'SHLIB_SUFFIX=\"<(dll_suffix)\"',
+      'SHLIB_PREFIX=\"<(dll_prefix)\"'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/signtool/signtool.gyp
@@ -0,0 +1,33 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'signtool',
+      'type': 'executable',
+      'sources': [
+        'certgen.c',
+        'javascript.c',
+        'list.c',
+        'sign.c',
+        'signtool.c',
+        'util.c',
+        'verify.c',
+        'zip.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/jar/jar.gyp:jar',
+        '<(DEPTH)/lib/zlib/zlib.gyp:nss_zlib'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/signver/signver.gyp
@@ -0,0 +1,26 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'signver',
+      'type': 'executable',
+      'sources': [
+        'pk7print.c',
+        'signver.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/smimetools/smimetools.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'cmsutil',
+      'type': 'executable',
+      'sources': [
+        'cmsutil.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/ssltap/ssltap.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'ssltap',
+      'type': 'executable',
+      'sources': [
+        'ssltap.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/strsclnt/strsclnt.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'strsclnt',
+      'type': 'executable',
+      'sources': [
+        'strsclnt.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/symkeyutil/symkeyutil.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'symkeyutil',
+      'type': 'executable',
+      'sources': [
+        'symkeyutil.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSPR20'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/tests/tests.gyp
@@ -0,0 +1,91 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'baddbdir',
+      'type': 'executable',
+      'sources': [
+        'baddbdir.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    },
+    {
+      'target_name': 'conflict',
+      'type': 'executable',
+      'sources': [
+        'conflict.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    },
+    {
+      'target_name': 'dertimetest',
+      'type': 'executable',
+      'sources': [
+        'dertimetest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    },
+    {
+      'target_name': 'encodeinttest',
+      'type': 'executable',
+      'sources': [
+        'encodeinttest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    },
+    {
+      'target_name': 'nonspr10',
+      'type': 'executable',
+      'sources': [
+        'nonspr10.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    },
+    {
+      'target_name': 'remtest',
+      'type': 'executable',
+      'sources': [
+        'remtest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    },
+    {
+      'target_name': 'secmodtest',
+      'type': 'executable',
+      'sources': [
+        'secmodtest.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/tstclnt/tstclnt.gyp
@@ -0,0 +1,31 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'tstclnt',
+      'type': 'executable',
+      'sources': [
+        'tstclnt.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'DLL_PREFIX=\"<(dll_prefix)\"',
+      'DLL_SUFFIX=\"<(dll_suffix)\"'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/vfychain/vfychain.gyp
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'vfychain',
+      'type': 'executable',
+      'sources': [
+        'vfychain.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'DLL_PREFIX=\"<(dll_prefix)\"',
+      'DLL_SUFFIX=\"<(dll_suffix)\"'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/cmd/vfyserv/vfyserv.gyp
@@ -0,0 +1,32 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../../cmd/platlibs.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'vfyserv',
+      'type': 'executable',
+      'sources': [
+        'vfyserv.c',
+        'vfyutil.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'DLL_PREFIX=\"<(dll_prefix)\"',
+      'DLL_SUFFIX=\"<(dll_suffix)\"'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/coreconf/config.gypi
@@ -0,0 +1,405 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'variables': {
+    'module%': '',
+    'variables': {
+      'variables': {
+        'variables': {
+          'python%': 'python',
+        },
+        # chromium uses pymod_do_main, but gyp doesn't set a sensible
+        # Python sys.path (gyp_chromium does).
+        'python%': '<(python)',
+        'host_arch%': '<!(<(python) <(DEPTH)/coreconf/detect_host_arch.py)',
+      },
+      'python%': '<(python)',
+      'host_arch%': '<(host_arch)',
+      'conditions': [
+        ['OS=="android"', {
+          'target_arch%': 'arm',
+        }, {
+          # Default architecture we're building for is the architecture we're
+          # building on.
+          'target_arch%': '<(host_arch)',
+        }],
+        ['OS=="win"', {
+          'use_system_zlib%': 0,
+          'nspr_libs%': ['nspr4.lib', 'plc4.lib', 'plds4.lib'],
+          #XXX: gyp breaks if these are empty!
+          'nspr_lib_dir%': ' ',
+          'nspr_include_dir%': ' ',
+          'zlib_libs%': [],
+          #TODO
+          'moz_debug_flags%': '',
+          'dll_prefix': '',
+          'dll_suffix': 'dll',
+        }, {
+          # On non-windows, default to a system NSPR.
+          'nspr_libs%': ['-lplds4', '-lplc4', '-lnspr4'],
+          'nspr_lib_dir%': '<!(<(python) <(DEPTH)/coreconf/nspr_lib_dir.py)',
+          'nspr_include_dir%': '<!(<(python) <(DEPTH)/coreconf/nspr_include_dir.py)',
+          'use_system_zlib%': 1,
+        }],
+        ['OS=="linux" or OS=="android"', {
+          'zlib_libs%': ['<!@(<(python) <(DEPTH)/coreconf/pkg_config.py --libs zlib)'],
+          'moz_debug_flags%': '-gdwarf-2',
+          'optimize_flags%': '-O2',
+          'dll_prefix': 'lib',
+          'dll_suffix': 'so',
+        }],
+        ['OS=="mac"', {
+          'zlib_libs%': ['-lz'],
+          'use_system_sqlite%': 1,
+          'moz_debug_flags%': '-gdwarf-2 -gfull',
+          'optimize_flags%': '-O2',
+          'dll_prefix': 'lib',
+          'dll_suffix': 'dylib',
+        }, {
+          'use_system_sqlite%': 0,
+        }],
+      ],
+    },
+    # Copy conditionally-set variables out one scope.
+    'python%': '<(python)',
+    'host_arch%': '<(host_arch)',
+    'target_arch%': '<(target_arch)',
+    'use_system_zlib%': '<(use_system_zlib)',
+    'zlib_libs%': ['<@(zlib_libs)'],
+    'moz_debug_flags%': '<(moz_debug_flags)',
+    'nspr_libs%': ['<@(nspr_libs)'],
+    'nspr_lib_dir%': '<(nspr_lib_dir)',
+    'nspr_include_dir%': '<(nspr_include_dir)',
+    'use_system_sqlite%': '<(use_system_sqlite)',
+    'sqlite_libs%': ['-lsqlite3'],
+    'dll_prefix': '<(dll_prefix)',
+    'dll_suffix': '<(dll_suffix)',
+    #TODO: detect this, but how?
+    'cc_is_clang%': 0,
+    'disable_tests%': 0,
+    'disable_chachapoly%': 0,
+    'disable_dbm%': 0,
+    'disable_libpkix%': 0,
+    'ssl_enable_zlib%': 1,
+    'use_asan%': 0,
+    'mozilla_client%': 0,
+    'moz_fold_libs%': 0,
+    'moz_folded_library_name%': '',
+  },
+  'target_defaults': {
+    # Settings specific to targets should go here.
+    # This is mostly for linking to libraries.
+    'variables': {
+      'mapfile%': '',
+    },
+    'include_dirs': [
+      '<(nspr_include_dir)',
+      '<(PRODUCT_DIR)/dist/<(module)/private',
+    ],
+    'conditions': [
+      [ 'OS=="linux"', {
+        'libraries': [
+          '-lpthread',
+          '-ldl',
+          '-lc',
+        ],
+      }],
+    ],
+    'target_conditions': [
+      # mapfile handling
+      [ 'mapfile!=""', {
+        # Work around a gyp bug. Fixed upstream but not in Ubuntu packages:
+        # https://chromium.googlesource.com/external/gyp/+/b85ad3e578da830377dbc1843aa4fbc5af17a192%5E%21/
+        'sources': [
+          '<(DEPTH)/coreconf/empty.c',
+        ],
+        'xcode_settings': {
+          'OTHER_LDFLAGS': [
+            '-exported_symbols_list',
+            '<(INTERMEDIATE_DIR)/out.>(mapfile)',
+          ],
+        },
+        'conditions': [
+          [ 'OS=="linux" or OS=="android"', {
+            'ldflags': [
+              '-Wl,--version-script,<(INTERMEDIATE_DIR)/out.>(mapfile)',
+            ],
+          }],
+          [ 'OS=="win"', {
+            # On Windows, .def files are used directly as sources.
+            'sources': [
+              '>(mapfile)',
+            ],
+          }, {
+            # On other platforms, .def files need processing.
+            'sources': [
+              '<(INTERMEDIATE_DIR)/out.>(mapfile)',
+            ],
+            'actions': [{
+              'action_name': 'generate_mapfile',
+              'inputs': [
+                '>(mapfile)',
+              ],
+              'outputs': [
+                '<(INTERMEDIATE_DIR)/out.>(mapfile)',
+              ],
+              'action': ['<@(process_map_file)'],
+            }],
+          }]
+        ],
+      }],
+      [ '_type=="shared_library" or _type=="executable"', {
+        'libraries': [
+          '<@(nspr_libs)',
+        ],
+        'library_dirs': [
+          '<(nspr_lib_dir)',
+        ],
+      }],
+      # Shared library specific settings.
+      [ '_type=="shared_library"', {
+        'conditions': [
+          [ 'OS=="linux" or OS=="android"', {
+            'ldflags': [
+              '-Wl,--gc-sections',
+              '-Wl,-z,defs',
+            ],
+          }],
+        ],
+        'xcode_settings': {
+          'DYLIB_INSTALL_NAME_BASE': '@executable_path',
+          'DYLIB_COMPATIBILITY_VERSION': '1',
+          'DYLIB_CURRENT_VERSION': '1',
+          'OTHER_LDFLAGS': [
+            '-headerpad_max_install_names',
+          ],
+        },
+        'msvs_settings': {
+          'VCLinkerTool': {
+            'SubSystem': '2',
+          },
+        },
+      }],
+    ],
+    'default_configuration': 'Debug',
+    'configurations': {
+      # Common settings for Debug+Release should go here.
+      'Common_Base': {
+        'abstract': 1,
+        'defines': [
+          'NSS_NO_INIT_SUPPORT',
+          'USE_UTIL_DIRECTLY',
+          'NO_NSPR_10_SUPPORT',
+          'SSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES',
+        ],
+        'msvs_configuration_attributes': {
+          'OutputDirectory': '$(SolutionDir)$(ConfigurationName)',
+          'IntermediateDirectory': '$(OutDir)\\obj\\$(ProjectName)',
+        },
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'AdditionalIncludeDirectories': ['<(nspr_include_dir)'],
+          },
+        },
+        'xcode_settings': {
+          'CLANG_CXX_LANGUAGE_STANDARD': 'c++0x',
+          'OTHER_CFLAGS': [
+            '-fPIC',
+            '-fno-common',
+            '-pipe',
+          ],
+          # TODO:
+          # 'GCC_TREAT_WARNINGS_AS_ERRORS'
+          # 'WARNING_CFLAGS'
+        },
+        'conditions': [
+          ['OS=="linux" or OS=="android"', {
+            'defines': [
+              'LINUX2_1',
+              'LINUX',
+              'linux',
+              'HAVE_STRERROR',
+              'XP_UNIX',
+              '_REENTRANT',
+            ],
+            'cflags': [
+              '-fPIC',
+              '-pipe',
+              '-ffunction-sections',
+              '-fdata-sections',
+              '<(moz_debug_flags)',
+            ],
+            'cflags_cc': [
+              '-std=c++0x',
+            ],
+            'conditions': [
+
+              [ 'target_arch=="ia32"', {
+                'cflags': ['-m32'],
+                'ldflags': ['-m32'],
+              }],
+              [ 'target_arch=="x64"', {
+                'cflags': ['-m64'],
+                'ldflags': ['-m64'],
+              }],
+            ],
+          }],
+          [ 'OS=="android" and mozilla_client==0', {
+            'defines': [
+              'NO_SYSINFO',
+              'NO_FORK_CHECK',
+              'ANDROID',
+            ],
+          }],
+          [ 'OS=="mac"', {
+            'defines': [
+              'DARWIN',
+              'HAVE_STRERROR',
+              'HAVE_BSD_FLOCK',
+              'XP_UNIX',
+            ],
+            'conditions': [
+              [ 'target_arch=="ia32"', {
+                'xcode_settings': {
+                  'ARCHS': ['i386'],
+                },
+              }],
+              [ 'target_arch=="x64"', {
+                'xcode_settings': {
+                  'ARCHS': ['x86_64'],
+                },
+              }],
+            ],
+          }],
+          [ 'OS=="win"', {
+            'defines': [
+              '_WINDOWS',
+              'WIN95',
+              '_CRT_SECURE_NO_WARNINGS',
+              '_CRT_NONSTDC_NO_WARNINGS',
+            ],
+            'cflags': [
+              '-W3',
+            ],
+          }],
+          [ 'disable_dbm==1', {
+            'defines': [
+              'NSS_DISABLE_DBM',
+            ],
+          }],
+          [ 'disable_libpkix==1', {
+            'defines': [
+              'NSS_DISABLE_LIBPKIX',
+            ],
+          }],
+        ],
+      },
+      # Common settings for x86 should go here.
+      'x86_Base': {
+        'abstract': 1,
+        'msvs_settings': {
+          'VCLinkerTool': {
+            'MinimumRequiredVersion': '5.01',  # XP.
+            'TargetMachine': '1',
+          },
+          'VCCLCompilerTool': {
+            'PreprocessorDefinitions': [
+              'WIN32',
+            ],
+          },
+        },
+        'msvs_configuration_platform': 'Win32',
+      },
+      # Common settings for x86-64 should go here.
+      'x64_Base': {
+        'abstract': 1,
+        'msvs_configuration_platform': 'x64',
+        'msvs_settings': {
+          'VCLinkerTool': {
+            'TargetMachine': '17', # x86-64
+          },
+          'VCCLCompilerTool': {
+            'PreprocessorDefinitions': [
+              'WIN64',
+              '_AMD64_',
+            ],
+          },
+        },
+      },
+      # Common settings for debug should go here.
+      'Debug_Base': {
+        'abstract': 1,
+        #TODO: DEBUG_$USER
+        'defines': ['DEBUG'],
+        'xcode_settings': {
+          'COPY_PHASE_STRIP': 'NO',
+          'GCC_OPTIMIZATION_LEVEL': '0',
+        },
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'Optimization': '0',
+            'BasicRuntimeChecks': '3',
+            'RuntimeLibrary': '2', # /MD
+          },
+          'VCLinkerTool': {
+            'LinkIncremental': '1',
+          },
+          'VCResourceCompilerTool': {
+            'PreprocessorDefinitions': ['DEBUG'],
+          },
+        },
+      },
+      # Common settings for release should go here.n
+      'Release_Base': {
+        'abstract': 1,
+        'defines': [
+          'NDEBUG',
+        ],
+        'xcode_settings': {
+          'DEAD_CODE_STRIPPING': 'YES',  # -Wl,-dead_strip
+          'GCC_OPTIMIZATION_LEVEL': '2', # -O2
+        },
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'Optimization': '2', # /Os
+            'RuntimeLibrary': '2', # /MD
+          },
+          'VCLinkerTool': {
+            'LinkIncremental': '1',
+          },
+        },
+      },
+      #
+      # Concrete configurations
+      #
+      # These configurations shouldn't have anything in them, it should
+      # all be derived from the _Base configurations above.
+      'Debug': {
+        'inherit_from': ['Common_Base', 'x86_Base', 'Debug_Base'],
+      },
+      'Release': {
+        'inherit_from': ['Common_Base', 'x86_Base', 'Release_Base'],
+      },
+      # The gyp ninja backend requires these.
+      'Debug_x64': {
+        'inherit_from': ['Common_Base', 'x64_Base', 'Debug_Base'],
+      },
+      'Release_x64': {
+        'inherit_from': ['Common_Base', 'x64_Base', 'Release_Base'],
+      },
+    },
+  },
+  'conditions': [
+    [ 'OS=="linux" or OS=="android"', {
+      'variables': {
+        'process_map_file': ['/bin/sh', '-c', '/bin/grep -v ";-" >(mapfile) | sed -e "s,;+,," -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,;," > >@(_outputs)'],
+      },
+    }],
+    [ 'OS=="mac"', {
+      'variables': {
+        'process_map_file': ['/bin/sh', '-c', '/usr/bin/grep -v ";+" >(mapfile) | grep -v ";-" | sed -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,," -e "s,^,_," > >@(_outputs)'],
+      },
+    }],
+  ],
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/coreconf/detect_host_arch.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+"""Outputs host CPU architecture in format recognized by gyp."""
+import platform
+import re
+
+def HostArch():
+  """Returns the host architecture with a predictable string."""
+  host_arch = platform.machine().lower()
+  # Convert machine type to format recognized by gyp.
+  if re.match(r'i.86', host_arch) or host_arch == 'i86pc':
+    host_arch = 'ia32'
+  elif host_arch in ['x86_64', 'amd64']:
+    host_arch = 'x64'
+  elif host_arch.startswith('arm'):
+    host_arch = 'arm'
+  elif host_arch.startswith('mips'):
+    host_arch = 'mips'
+  # platform.machine is based on running kernel. It's possible to use 64-bit
+  # kernel with 32-bit userland, e.g. to give linker slightly more memory.
+  # Distinguish between different userland bitness by querying
+  # the python binary.
+  if host_arch == 'x64' and platform.architecture()[0] == '32bit':
+    host_arch = 'ia32'
+  return host_arch
+def DoMain(_):
+  """Hook to be called from gyp without starting a separate python
+  interpreter."""
+  return HostArch()
+if __name__ == '__main__':
+  print DoMain([])
new file mode 100644
--- /dev/null
+++ b/security/nss/coreconf/empty.c
@@ -0,0 +1,1 @@
+/* This file is intentionally empty */
new file mode 100644
--- /dev/null
+++ b/security/nss/coreconf/nsinstall/nsinstall.gyp
@@ -0,0 +1,21 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nsinstall',
+      'type': 'executable',
+      'sources': [
+        'nsinstall.c',
+        'pathsub.c'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'coreconf'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/coreconf/nspr_include_dir.py
@@ -0,0 +1,16 @@
+#!/usr/bin/env python
+
+import os
+import subprocess
+
+def main():
+    try:
+        out = subprocess.Popen(['pkg-config', '--cflags', 'nspr'], stdout=subprocess.PIPE, stderr=open(os.devnull, 'wb')).communicate()[0].strip()
+        if out.startswith('-I'):
+            print out[2:]
+    except OSError:
+        # pkg-config is probably not installed
+        pass
+
+if __name__ == '__main__':
+    main()
new file mode 100644
--- /dev/null
+++ b/security/nss/coreconf/nspr_lib_dir.py
@@ -0,0 +1,16 @@
+#!/usr/bin/env python
+
+import os
+import subprocess
+
+def main():
+    try:
+        out = subprocess.Popen(['pkg-config', '--libs', 'nspr'], stdout=subprocess.PIPE, stderr=open(os.devnull, 'wb')).communicate()[0].strip()
+        if out.startswith('-L'):
+            print out[2:]
+    except OSError:
+        # pkg-config is probably not installed
+        pass
+
+if __name__ == '__main__':
+    main()
new file mode 100644
--- /dev/null
+++ b/security/nss/coreconf/pkg_config.py
@@ -0,0 +1,15 @@
+#!/usr/bin/env python
+
+import os
+import subprocess
+import sys
+
+def main():
+    try:
+        subprocess.Popen(['pkg-config'] + sys.argv[1:], stderr=open(os.devnull, 'wb')).wait()
+    except OSError:
+        # pkg-config is probably not installed
+        pass
+
+if __name__ == '__main__':
+    main()
new file mode 100644
--- /dev/null
+++ b/security/nss/exports.gyp
@@ -0,0 +1,77 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    'coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nss_exports',
+      'type': 'none',
+      'direct_dependent_settings': {
+        'include_dirs': [
+          '<(PRODUCT_DIR)/dist/nss/public'
+        ]
+      },
+      'dependencies': [
+        'cmd/lib/exports.gyp:cmd_lib_exports',
+        'lib/base/exports.gyp:lib_base_exports',
+        'lib/certdb/exports.gyp:lib_certdb_exports',
+        'lib/certhigh/exports.gyp:lib_certhigh_exports',
+        'lib/ckfw/builtins/exports.gyp:lib_ckfw_builtins_exports',
+        'lib/ckfw/exports.gyp:lib_ckfw_exports',
+        'lib/crmf/exports.gyp:lib_crmf_exports',
+        'lib/cryptohi/exports.gyp:lib_cryptohi_exports',
+        'lib/dev/exports.gyp:lib_dev_exports',
+        'lib/freebl/exports.gyp:lib_freebl_exports',
+        'lib/jar/exports.gyp:lib_jar_exports',
+        'lib/nss/exports.gyp:lib_nss_exports',
+        'lib/pk11wrap/exports.gyp:lib_pk11wrap_exports',
+        'lib/pkcs12/exports.gyp:lib_pkcs12_exports',
+        'lib/pkcs7/exports.gyp:lib_pkcs7_exports',
+        'lib/pki/exports.gyp:lib_pki_exports',
+        'lib/smime/exports.gyp:lib_smime_exports',
+        'lib/softoken/exports.gyp:lib_softoken_exports',
+        'lib/sqlite/exports.gyp:lib_sqlite_exports',
+        'lib/ssl/exports.gyp:lib_ssl_exports',
+        'lib/util/exports.gyp:lib_util_exports',
+        'lib/zlib/exports.gyp:lib_zlib_exports'
+      ],
+      'conditions': [
+        [ 'disable_libpkix==0', {
+          'dependencies': [
+            'lib/libpkix/include/exports.gyp:lib_libpkix_include_exports',
+            'lib/libpkix/pkix/certsel/exports.gyp:lib_libpkix_pkix_certsel_exports',
+            'lib/libpkix/pkix/checker/exports.gyp:lib_libpkix_pkix_checker_exports',
+            'lib/libpkix/pkix/crlsel/exports.gyp:lib_libpkix_pkix_crlsel_exports',
+            'lib/libpkix/pkix/params/exports.gyp:lib_libpkix_pkix_params_exports',
+            'lib/libpkix/pkix/results/exports.gyp:lib_libpkix_pkix_results_exports',
+            'lib/libpkix/pkix/store/exports.gyp:lib_libpkix_pkix_store_exports',
+            'lib/libpkix/pkix/top/exports.gyp:lib_libpkix_pkix_top_exports',
+            'lib/libpkix/pkix/util/exports.gyp:lib_libpkix_pkix_util_exports',
+            'lib/libpkix/pkix_pl_nss/module/exports.gyp:lib_libpkix_pkix_pl_nss_module_exports',
+            'lib/libpkix/pkix_pl_nss/pki/exports.gyp:lib_libpkix_pkix_pl_nss_pki_exports',
+            'lib/libpkix/pkix_pl_nss/system/exports.gyp:lib_libpkix_pkix_pl_nss_system_exports',
+          ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'dbm_exports',
+      'type': 'none',
+      'conditions': [
+        ['disable_dbm==0', {
+          'direct_dependent_settings': {
+            'include_dirs': [
+              '<(PRODUCT_DIR)/dist/dbm/public'
+            ]
+          },
+          'dependencies': [
+            'lib/dbm/include/exports.gyp:lib_dbm_include_exports'
+          ],
+        }],
+      ],
+    }
+  ]
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/external_tests/common/common.gyp
@@ -0,0 +1,36 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    'gtest.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'gtests',
+      'type': 'executable',
+      'sources': [
+        'gtests.cc'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/nss/nss.gyp:nss3',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3',
+        '<(DEPTH)/lib/smime/smime.gyp:smime3',
+        '<(DEPTH)/lib/ssl/ssl.gyp:ssl3',
+        '<(DEPTH)/external_tests/google_test/google_test.gyp:gtest',
+        '<(DEPTH)/cmd/lib/lib.gyp:sectool'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '../../external_tests/google_test/gtest/include',
+      '../../external_tests/common'
+    ],
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/external_tests/common/gtest.gypi
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'target_defaults': {
+    'conditions': [
+      ['OS=="win"', {
+        'libraries': [
+          '-lws2_32',
+        ],
+      }],
+      ['OS=="android"', {
+        'libraries': [
+          '-lstdc++',
+        ],
+      }],
+    ],
+    'msvs_settings': {
+      'VCCLCompilerTool': {
+        'ExceptionHandling': 1,
+        'PreprocessorDefinitions': [
+          'NOMINMAX',
+        ],
+      },
+    },
+  },
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/external_tests/der_gtest/der_gtest.gyp
@@ -0,0 +1,38 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../common/gtest.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'der_gtest',
+      'type': 'executable',
+      'sources': [
+        'der_getint_unittest.cc',
+        '<(DEPTH)/external_tests/common/gtests.cc'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/nss/nss.gyp:nss3',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3',
+        '<(DEPTH)/lib/smime/smime.gyp:smime3',
+        '<(DEPTH)/lib/ssl/ssl.gyp:ssl3',
+        '<(DEPTH)/external_tests/google_test/google_test.gyp:gtest',
+        '<(DEPTH)/cmd/lib/lib.gyp:sectool'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '../../external_tests/google_test/gtest/include',
+      '../../external_tests/common'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/external_tests/google_test/google_test.gyp
@@ -0,0 +1,59 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../common/gtest.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'gtest',
+      'type': 'static_library',
+      'sources': [
+        'gtest/src/gtest-all.cc'
+      ],
+      'dependencies': [
+        '<(DEPTH)/lib/nss/nss.gyp:nss3',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3',
+        '<(DEPTH)/lib/smime/smime.gyp:smime3',
+        '<(DEPTH)/lib/ssl/ssl.gyp:ssl3',
+        '<(DEPTH)/cmd/lib/lib.gyp:sectool'
+      ]
+    },
+    {
+      'target_name': 'gtest1',
+      'type': 'shared_library',
+      'dependencies': [
+        'gtest'
+      ],
+      # Work around a gyp bug. Fixed upstream in gyp:
+      # https://chromium.googlesource.com/external/gyp/+/93cc6e2c23e4d5ebd179f388e67aa907d0dfd43d
+      'conditions': [
+        ['OS!="win"', {
+          'libraries': [
+            '-lstdc++',
+          ],
+        }],
+      ],
+      # For some reason when just linking static libraries into
+      # a DLL the link fails without this.
+      'msvs_settings': {
+        'VCLinkerTool': {
+          'AdditionalDependencies': [
+            '/DEFAULTLIB:MSVCRT',
+          ],
+        },
+      },
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      'gtest/include/',
+      'gtest'
+    ],
+  },
+  'variables': {
+    'module': 'gtest'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/external_tests/pk11_gtest/pk11_gtest.gyp
@@ -0,0 +1,42 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../common/gtest.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'pk11_gtest',
+      'type': 'executable',
+      'sources': [
+        'pk11_aeskeywrap_unittest.cc',
+        'pk11_chacha20poly1305_unittest.cc',
+        'pk11_pbkdf2_unittest.cc',
+        'pk11_prf_unittest.cc',
+        'pk11_rsapss_unittest.cc',
+        '<(DEPTH)/external_tests/common/gtests.cc'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/nss/nss.gyp:nss3',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3',
+        '<(DEPTH)/lib/smime/smime.gyp:smime3',
+        '<(DEPTH)/lib/ssl/ssl.gyp:ssl3',
+        '<(DEPTH)/external_tests/google_test/google_test.gyp:gtest',
+        '<(DEPTH)/cmd/lib/lib.gyp:sectool'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '../../external_tests/google_test/gtest/include',
+      '../../external_tests/common'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/external_tests/ssl_gtest/ssl_gtest.gyp
@@ -0,0 +1,101 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../common/gtest.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'ssl_gtest',
+      'type': 'executable',
+      'sources': [
+        'libssl_internals.c',
+        'ssl_agent_unittest.cc',
+        'ssl_auth_unittest.cc',
+        'ssl_ciphersuite_unittest.cc',
+        'ssl_dhe_unittest.cc',
+        'ssl_drop_unittest.cc',
+        'ssl_ems_unittest.cc',
+        'ssl_extension_unittest.cc',
+        'ssl_gtest.cc',
+        'ssl_loopback_unittest.cc',
+        'ssl_resumption_unittest.cc',
+        'ssl_skip_unittest.cc',
+        'ssl_staticrsa_unittest.cc',
+        'ssl_v2_client_hello_unittest.cc',
+        'ssl_version_unittest.cc',
+        'test_io.cc',
+        'tls_agent.cc',
+        'tls_connect.cc',
+        'tls_filter.cc',
+        'tls_hkdf_unittest.cc',
+        'tls_parser.cc'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3',
+        '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3',
+        '<(DEPTH)/external_tests/google_test/google_test.gyp:gtest',
+        '<(DEPTH)/lib/softoken/softoken.gyp:softokn',
+        '<(DEPTH)/lib/smime/smime.gyp:smime',
+        '<(DEPTH)/lib/ssl/ssl.gyp:ssl',
+        '<(DEPTH)/lib/nss/nss.gyp:nss_static',
+        '<(DEPTH)/cmd/lib/lib.gyp:sectool',
+        '<(DEPTH)/lib/pkcs12/pkcs12.gyp:pkcs12',
+        '<(DEPTH)/lib/pkcs7/pkcs7.gyp:pkcs7',
+        '<(DEPTH)/lib/certhigh/certhigh.gyp:certhi',
+        '<(DEPTH)/lib/cryptohi/cryptohi.gyp:cryptohi',
+        '<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap',
+        '<(DEPTH)/lib/softoken/softoken.gyp:softokn',
+        '<(DEPTH)/lib/certdb/certdb.gyp:certdb',
+        '<(DEPTH)/lib/pki/pki.gyp:nsspki',
+        '<(DEPTH)/lib/dev/dev.gyp:nssdev',
+        '<(DEPTH)/lib/base/base.gyp:nssb',
+        '<(DEPTH)/lib/freebl/freebl.gyp:freebl',
+        '<(DEPTH)/lib/nss/nss.gyp:nss_static',
+        '<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap',
+        '<(DEPTH)/lib/certhigh/certhigh.gyp:certhi',
+        '<(DEPTH)/lib/zlib/zlib.gyp:nss_zlib'
+      ],
+      'conditions': [
+        [ 'disable_dbm==0', {
+          'dependencies': [
+            '<(DEPTH)/lib/dbm/src/src.gyp:dbm',
+          ],
+        }],
+        [ 'disable_libpkix==0', {
+          'dependencies': [
+            '<(DEPTH)/lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
+            '<(DEPTH)/lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
+            '<(DEPTH)/lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
+            '<(DEPTH)/lib/libpkix/pkix/params/params.gyp:pkixparams',
+            '<(DEPTH)/lib/libpkix/pkix/results/results.gyp:pkixresults',
+            '<(DEPTH)/lib/libpkix/pkix/store/store.gyp:pkixstore',
+            '<(DEPTH)/lib/libpkix/pkix/top/top.gyp:pkixtop',
+            '<(DEPTH)/lib/libpkix/pkix/util/util.gyp:pkixutil',
+            '<(DEPTH)/lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
+            '<(DEPTH)/lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule',
+            '<(DEPTH)/lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
+          ],
+        }],
+      ],
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '../../external_tests/google_test/gtest/include',
+      '../../external_tests/common',
+      '../../lib/ssl'
+    ],
+    'defines': [
+      'NSS_USE_STATIC_LIBS'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+    'use_static_libs': 1
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/external_tests/util_gtest/util_gtest.gyp
@@ -0,0 +1,39 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi',
+    '../common/gtest.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'util_gtest',
+      'type': 'executable',
+      'sources': [
+        'util_utf8_unittest.cc',
+        '<(DEPTH)/external_tests/common/gtests.cc'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/nss/nss.gyp:nss3',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3',
+        '<(DEPTH)/lib/smime/smime.gyp:smime3',
+        '<(DEPTH)/lib/ssl/ssl.gyp:ssl3',
+        '<(DEPTH)/external_tests/google_test/google_test.gyp:gtest',
+        '<(DEPTH)/lib/util/util.gyp:nssutil',
+        '<(DEPTH)/cmd/lib/lib.gyp:sectool'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '../../external_tests/google_test/gtest/include',
+      '../../external_tests/common',
+      '../../lib/util'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/base/base.gyp
@@ -0,0 +1,32 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nssb',
+      'type': 'static_library',
+      'sources': [
+        'arena.c',
+        'error.c',
+        'errorval.c',
+        'hash.c',
+        'hashops.c',
+        'item.c',
+        'libc.c',
+        'list.c',
+        'tracker.c',
+        'utf8.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/base/exports.gyp
@@ -0,0 +1,33 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_base_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'nssbase.h',
+            'nssbaset.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'base.h',
+            'baset.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/certdb/certdb.gyp
@@ -0,0 +1,34 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'certdb',
+      'type': 'static_library',
+      'sources': [
+        'alg1485.c',
+        'certdb.c',
+        'certv3.c',
+        'certxutl.c',
+        'crl.c',
+        'genname.c',
+        'polcyxtn.c',
+        'secname.c',
+        'stanpcertdb.c',
+        'xauthkid.c',
+        'xbsconst.c',
+        'xconst.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/certdb/exports.gyp
@@ -0,0 +1,36 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_certdb_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'cert.h',
+            'certdb.h',
+            'certt.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'certi.h',
+            'certxutl.h',
+            'genname.h',
+            'xconst.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/certhigh/certhigh.gyp
@@ -0,0 +1,31 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'certhi',
+      'type': 'static_library',
+      'sources': [
+        'certhigh.c',
+        'certhtml.c',
+        'certreq.c',
+        'certvfy.c',
+        'certvfypkix.c',
+        'crlv2.c',
+        'ocsp.c',
+        'ocspsig.c',
+        'xcrldist.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/certhigh/exports.gyp
@@ -0,0 +1,33 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_certhigh_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'ocsp.h',
+            'ocspt.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'ocspi.h',
+            'ocspti.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
--- a/security/nss/lib/ckfw/builtins/Makefile
+++ b/security/nss/lib/ckfw/builtins/Makefile
@@ -46,9 +46,9 @@ include $(CORE_DEPTH)/coreconf/rules.mk
 
 # By default, use the unmodified certdata.txt.
 ifndef NSS_CERTDATA_TXT
 NSS_CERTDATA_TXT = certdata.txt
 endif
 
 $(OBJDIR)/certdata.c: $(NSS_CERTDATA_TXT) certdata.perl
 	@$(MAKE_OBJDIR)
-	$(PERL) certdata.perl < $(NSS_CERTDATA_TXT) > $@
+	$(PERL) certdata.perl $(NSS_CERTDATA_TXT) $@
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/ckfw/builtins/builtins.gyp
@@ -0,0 +1,61 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nssckbi',
+      'type': 'shared_library',
+      'sources': [
+        'anchor.c',
+        'bfind.c',
+        'binst.c',
+        'bobject.c',
+        'bsession.c',
+        'bslot.c',
+        'btoken.c',
+        'ckbiver.c',
+        'constants.c',
+        '<(INTERMEDIATE_DIR)/certdata.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/ckfw/ckfw.gyp:nssckfw',
+        '<(DEPTH)/lib/base/base.gyp:nssb'
+      ],
+      'actions': [
+        {
+          'msvs_cygwin_shell': 0,
+          'action': [
+            'perl',
+            'certdata.perl',
+            'certdata.txt',
+            '<@(_outputs)',
+          ],
+          'inputs': [
+            'certdata.perl',
+            'certdata.txt'
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/certdata.c'
+          ],
+          'action_name': 'generate_certdata_c'
+        }
+      ],
+      'variables': {
+        'mapfile': 'nssckbi.def'
+      }
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '.'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+  }
+}
--- a/security/nss/lib/ckfw/builtins/certdata.perl
+++ b/security/nss/lib/ckfw/builtins/certdata.perl
@@ -9,16 +9,23 @@ my %constants;
 my $count = 0;
 my $o;
 my @objects = ();
 my @objsize;
 
 $constants{CK_TRUE} = "static const CK_BBOOL ck_true = CK_TRUE;\n";
 $constants{CK_FALSE} = "static const CK_BBOOL ck_false = CK_FALSE;\n";
 
+open(STDIN, '<', $ARGV[0])
+  or die "Could not open input file '$ARGV[0]' $!";
+if( scalar @ARGV > 1 ) {
+  open(STDOUT, '>', $ARGV[1])
+    or die "Could not open output file '$ARGV[1]' $!";
+}
+
 while(<>) {
   my @fields = ();
   my $size;
 
   s/^((?:[^"#]+|"[^"]*")*)(\s*#.*$)/$1/;
   next if (/^\s*$/);
 
   # This was taken from the perl faq #4.
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/ckfw/builtins/exports.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_ckfw_builtins_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'nssckbi.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/ckfw/ckfw.gyp
@@ -0,0 +1,34 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nssckfw',
+      'type': 'static_library',
+      'sources': [
+        'crypto.c',
+        'find.c',
+        'hash.c',
+        'instance.c',
+        'mechanism.c',
+        'mutex.c',
+        'object.c',
+        'session.c',
+        'sessobj.c',
+        'slot.c',
+        'token.c',
+        'wrap.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/ckfw/exports.gyp
@@ -0,0 +1,44 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_ckfw_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'nssck.api',
+            'nssckepv.h',
+            'nssckft.h',
+            'nssckfw.h',
+            'nssckfwc.h',
+            'nssckfwt.h',
+            'nssckg.h',
+            'nssckmdt.h',
+            'nssckt.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'ck.h',
+            'ckfw.h',
+            'ckfwm.h',
+            'ckfwtm.h',
+            'ckmd.h',
+            'ckt.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/crmf/crmf.gyp
@@ -0,0 +1,39 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'crmf',
+      'type': 'static_library',
+      'sources': [
+        'asn1cmn.c',
+        'challcli.c',
+        'cmmfasn1.c',
+        'cmmfchal.c',
+        'cmmfrec.c',
+        'cmmfresp.c',
+        'crmfcont.c',
+        'crmfdec.c',
+        'crmfenc.c',
+        'crmfget.c',
+        'crmfpop.c',
+        'crmfreq.c',
+        'crmftmpl.c',
+        'encutil.c',
+        'respcli.c',
+        'respcmn.c',
+        'servget.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/crmf/exports.gyp
@@ -0,0 +1,37 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_crmf_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'cmmf.h',
+            'cmmft.h',
+            'crmf.h',
+            'crmft.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'cmmfi.h',
+            'cmmfit.h',
+            'crmfi.h',
+            'crmfit.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/cryptohi/cryptohi.gyp
@@ -0,0 +1,27 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'cryptohi',
+      'type': 'static_library',
+      'sources': [
+        'dsautil.c',
+        'sechash.c',
+        'seckey.c',
+        'secsign.c',
+        'secvfy.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/cryptohi/exports.gyp
@@ -0,0 +1,37 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'variables': {
+    'module': 'nss'
+  },
+  'targets': [
+    {
+      'target_name': 'lib_cryptohi_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'cryptohi.h',
+            'cryptoht.h',
+            'key.h',
+            'keyhi.h',
+            'keyt.h',
+            'keythi.h',
+            'sechash.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'keyi.h',
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/dbm/include/exports.gyp
@@ -0,0 +1,38 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_dbm_include_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'mcom_db.h',
+            'ncompat.h',
+            'winfile.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'extern.h',
+            'hash.h',
+            'hsearch.h',
+            'page.h',
+            'queue.h',
+            'search.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'dbm'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/dbm/include/include.gyp
@@ -0,0 +1,12 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi'
+  ],
+  'targets': [],
+  'variables': {
+    'module': 'dbm'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/dbm/src/src.gyp
@@ -0,0 +1,40 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'dbm',
+      'type': 'static_library',
+      'sources': [
+        'db.c',
+        'dirent.c',
+        'h_bigkey.c',
+        'h_func.c',
+        'h_log2.c',
+        'h_page.c',
+        'hash.c',
+        'hash_buf.c',
+        'mktemp.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'STDC_HEADERS',
+      'HAVE_STRERROR',
+      'HAVE_SNPRINTF',
+      'MEMMOVE',
+      '__DBINTERFACE_PRIVATE'
+    ]
+  },
+  'variables': {
+    'module': 'dbm'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/dev/dev.gyp
@@ -0,0 +1,26 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nssdev',
+      'type': 'static_library',
+      'sources': [
+        'ckhelper.c',
+        'devslot.c',
+        'devtoken.c',
+        'devutil.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/dev/exports.gyp
@@ -0,0 +1,31 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_dev_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'ckhelper.h',
+            'dev.h',
+            'devm.h',
+            'devt.h',
+            'devtm.h',
+            'nssdev.h',
+            'nssdevt.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/freebl/exports.gyp
@@ -0,0 +1,48 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_freebl_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'blapit.h',
+            'ecl/ecl-exp.h',
+            'shsign.h'
+          ],
+          'conditions': [
+            [ 'OS=="linux"', {
+              'files': [
+                'nsslowhash.h',
+              ],
+            }],
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'alghmac.h',
+            'blapi.h',
+            'chacha20poly1305.h',
+            'ec.h',
+            'ecl/ecl-curve.h',
+            'ecl/ecl.h',
+            'hmacct.h',
+            'secmpi.h',
+            'secrng.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/freebl/freebl.gyp
@@ -0,0 +1,393 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'intel-gcm-wrap_c_lib',
+      'type': 'static_library',
+      'sources': [
+        'intel-gcm-wrap.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ],
+      'cflags': [
+        '-mssse3'
+      ],
+      'cflags_mozilla': [
+        '-mssse3'
+      ]
+    },
+    {
+      'target_name': 'freebl',
+      'type': 'static_library',
+      'sources': [
+        'loader.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    },
+    {
+      'target_name': '<(freebl_name)',
+      'type': 'shared_library',
+      'sources': [
+        'aeskeywrap.c',
+        'alg2268.c',
+        'alghmac.c',
+        'arcfive.c',
+        'arcfour.c',
+        'camellia.c',
+        'chacha20poly1305.c',
+        'ctr.c',
+        'cts.c',
+        'des.c',
+        'desblapi.c',
+        'dh.c',
+        'drbg.c',
+        'dsa.c',
+        'ec.c',
+        'ecdecode.c',
+        'ecl/ec_naf.c',
+        'ecl/ecl.c',
+        'ecl/ecl_curve.c',
+        'ecl/ecl_gf.c',
+        'ecl/ecl_mult.c',
+        'ecl/ecp_25519.c',
+        'ecl/ecp_256.c',
+        'ecl/ecp_256_32.c',
+        'ecl/ecp_384.c',
+        'ecl/ecp_521.c',
+        'ecl/ecp_aff.c',
+        'ecl/ecp_jac.c',
+        'ecl/ecp_jm.c',
+        'ecl/ecp_mont.c',
+        'fipsfreebl.c',
+        'freeblver.c',
+        'gcm.c',
+        'hmacct.c',
+        'jpake.c',
+        'ldvector.c',
+        'md2.c',
+        'md5.c',
+        'mpi/mp_gf2m.c',
+        'mpi/mpcpucache.c',
+        'mpi/mpi.c',
+        'mpi/mplogic.c',
+        'mpi/mpmontg.c',
+        'mpi/mpprime.c',
+        'pqg.c',
+        'rawhash.c',
+        'rijndael.c',
+        'rsa.c',
+        'rsapkcs.c',
+        'seed.c',
+        'sha512.c',
+        'sha_fast.c',
+        'shvfy.c',
+        'sysrand.c',
+        'tlsprfalg.c'
+      ],
+      'conditions': [
+        [ 'OS=="linux"', {
+          'sources': [
+            'nsslowhash.c',
+            'stubs.c',
+          ],
+          'conditions': [
+            [ 'target_arch=="x64"', {
+              'sources': [
+                'arcfour-amd64-gas.s',
+                'intel-aes.s',
+                'intel-gcm.s',
+                'mpi/mpi_amd64.c',
+                'mpi/mpi_amd64_gas.s',
+                'mpi/mp_comba.c',
+              ],
+              'dependencies': [
+                'intel-gcm-wrap_c_lib',
+              ],
+              'conditions': [
+                [ 'cc_is_clang==1', {
+                  'cflags': [
+                    '-no-integrated-as',
+                  ],
+                  'cflags_mozilla': [
+                    '-no-integrated-as',
+                  ],
+                  'asflags_mozilla': [
+                    '-no-integrated-as',
+                  ],
+                }],
+              ],
+            }],
+            [ 'target_arch=="ia32"', {
+              'sources': [
+                'mpi/mpi_x86.s',
+              ],
+            }],
+            [ 'target_arch=="arm"', {
+              'sources': [
+                'mpi/mpi_arm.c',
+              ],
+            }],
+          ],
+        }, {
+          # not Linux
+          'conditions': [
+            [ 'moz_fold_libs==0', {
+              'dependencies': [
+                '../util/util.gyp:nssutil3',
+              ],
+            }, {
+              'libraries': [
+                '<(moz_folded_library_name)',
+              ],
+            }],
+          ],
+        }],
+        [ 'OS=="win"', {
+          'sources': [
+            #TODO: building with mingw should not need this.
+            'ecl/uint128.c',
+            #TODO: clang-cl needs -msse3 here
+            'intel-gcm-wrap.c',
+          ],
+          'libraries': [
+            'advapi32.lib',
+          ],
+          'conditions': [
+            [ 'target_arch=="x64"', {
+              'sources': [
+                'arcfour-amd64-masm.asm',
+                'mpi/mpi_amd64.c',
+                'mpi/mpi_amd64_masm.asm',
+                'mpi/mp_comba_amd64_masm.asm',
+                'intel-aes-x64-masm.asm',
+                'intel-gcm-x64-masm.asm',
+              ],
+            }, {
+              # not x64
+              'sources': [
+                'mpi/mpi_x86_asm.c',
+                'intel-aes-x86-masm.asm',
+                'intel-gcm-x86-masm.asm',
+              ],
+            }],
+          ],
+        }],
+        ['target_arch=="ia32" or target_arch=="x64"', {
+          'sources': [
+            # All intel architectures get the 64 bit version
+            'ecl/curve25519_64.c',
+          ],
+        }, {
+          'sources': [
+            # All non intel architectures get the generic 32 bit implementation (slow!)
+            'ecl/curve25519_32.c',
+          ],
+        }],
+        #TODO uint128.c
+        [ 'disable_chachapoly==0', {
+          'conditions': [
+            [ 'OS!="win" and target_arch=="x64"', {
+              'sources': [
+                'chacha20_vec.c',
+                'poly1305-donna-x64-sse2-incremental-source.c',
+              ],
+            }, {
+              # not x64
+              'sources': [
+                'chacha20.c',
+                'poly1305.c',
+              ],
+            }],
+          ],
+        }],
+        [ 'OS=="mac"', {
+          'conditions': [
+            [ 'target_arch=="ia32"', {
+              'sources': [
+                'mpi/mpi_sse2.s',
+              ],
+              'defines': [
+                'MP_USE_UINT_DIGIT',
+                'MP_ASSEMBLY_MULTIPLY',
+                'MP_ASSEMBLY_SQUARE',
+                'MP_ASSEMBLY_DIV_2DX1D',
+              ],
+            }],
+          ],
+        }],
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+      ],
+      'variables': {
+       'conditions': [
+         [ 'OS=="linux"', {
+           'mapfile': 'freebl_hash_vector.def',
+         }, {
+           'mapfile': 'freebl.def',
+         }],
+       ]
+      },
+      'ldflags': [
+        '-Wl,-Bsymbolic'
+      ]
+    },
+  ],
+  'conditions': [
+    [ 'OS=="linux"', {
+      # stub build
+      'targets': [
+        {
+          'target_name': 'freebl3',
+          'type': 'shared_library',
+          'sources': [
+            'lowhash_vector.c'
+          ],
+          'dependencies': [
+            '<(DEPTH)/exports.gyp:nss_exports'
+          ],
+          'variables': {
+            'mapfile': 'freebl_hash.def'
+          }
+        },
+      ],
+    }],
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      'mpi',
+      'ecl'
+    ],
+    'defines': [
+      'SHLIB_SUFFIX=\"<(dll_suffix)\"',
+      'SHLIB_PREFIX=\"<(dll_prefix)\"',
+      'SHLIB_VERSION=\"3\"',
+      'SOFTOKEN_SHLIB_VERSION=\"3\"',
+      'RIJNDAEL_INCLUDE_TABLES',
+      'MP_API_COMPATIBLE'
+    ],
+    'conditions': [
+      [ 'OS=="win"', {
+        'configurations': {
+          'x86_Base': {
+            'msvs_settings': {
+              'VCCLCompilerTool': {
+                #TODO: -Ox optimize flags
+                'PreprocessorDefinitions': [
+                  'NSS_X86_OR_X64',
+                  'NSS_X86',
+                  'MP_ASSEMBLY_MULTIPLY',
+                  'MP_ASSEMBLY_SQUARE',
+                  'MP_ASSEMBLY_DIV_2DX1D',
+                  'MP_USE_UINT_DIGIT',
+                  'MP_NO_MP_WORD',
+                  'USE_HW_AES',
+                  'INTEL_GCM',
+                ],
+              },
+            },
+          },
+          'x64_Base': {
+            'msvs_settings': {
+              'VCCLCompilerTool': {
+                #TODO: -Ox optimize flags
+                'PreprocessorDefinitions': [
+                  'NSS_USE_64',
+                  'NSS_X86_OR_X64',
+                  'NSS_X64',
+                  'MP_IS_LITTLE_ENDIAN',
+                  'NSS_BEVAND_ARCFOUR',
+                  'MPI_AMD64',
+                  'MP_ASSEMBLY_MULTIPLY',
+                  'NSS_USE_COMBA',
+                  'USE_HW_AES',
+                  'INTEL_GCM',
+                ],
+              },
+            },
+          },
+        },
+      }, {
+        'conditions': [
+          [ 'target_arch=="x64"', {
+            'defines': [
+              'NSS_USE_64',
+              'NSS_X86_OR_X64',
+              'NSS_X64',
+              # The Makefile does version-tests on GCC, but we're not doing that here.
+              'HAVE_INT128_SUPPORT',
+            ],
+          }, {
+            'sources': [
+              'ecl/uint128.c',
+            ],
+          }],
+          [ 'target_arch=="ia32"', {
+            'defines': [
+              'NSS_X86_OR_X64',
+              'NSS_X86',
+            ],
+          }],
+        ],
+      }],
+      [ 'OS=="linux"', {
+        'defines': [
+          'FREEBL_NO_DEPEND',
+          'FREEBL_LOWHASH',
+        ],
+        'conditions': [
+          [ 'target_arch=="x64"', {
+            'defines': [
+              'MP_IS_LITTLE_ENDIAN',
+              'NSS_BEVAND_ARCFOUR',
+              'MPI_AMD64',
+              'MP_ASSEMBLY_MULTIPLY',
+              'NSS_USE_COMBA',
+              'USE_HW_AES',
+              'INTEL_GCM',
+            ],
+          }],
+          [ 'target_arch=="ia32"', {
+            'defines': [
+              'MP_IS_LITTLE_ENDIAN',
+              'MP_ASSEMBLY_MULTIPLY',
+              'MP_ASSEMBLY_SQUARE',
+              'MP_ASSEMBLY_DIV_2DX1D',
+              'MP_USE_UINT_DIGIT',
+            ],
+          }],
+          [ 'target_arch=="arm"', {
+            'defines': [
+              'MP_ASSEMBLY_MULTIPLY',
+              'MP_ASSEMBLY_SQUARE',
+              'MP_USE_UINT_DIGIT',
+              'SHA_NO_LONG_LONG',
+            ],
+          }],
+        ],
+      }],
+      [ 'OS=="mac"', {
+      }],
+      [ 'OS=="win"', {
+      }],
+    ],
+  },
+  'variables': {
+    'module': 'nss',
+    'conditions': [
+      [ 'OS=="linux"', {
+        'freebl_name': 'freeblpriv3',
+      }, {
+        'freebl_name': 'freebl3',
+      }],
+    ],
+  }
+}
--- a/security/nss/lib/freebl/mpi/README
+++ b/security/nss/lib/freebl/mpi/README
@@ -229,16 +229,17 @@ basic arithmetic functions on full mp_in
 mp_add(a, b, c)         - computes c = a + b
 mp_sub(a, b, c)         - computes c = a - b
 mp_mul(a, b, c)         - computes c = a * b
 mp_sqr(a, b)            - computes b = a * a
 mp_div(a, b, q, r)      - computes q, r such that a = bq + r
 mp_div_2d(a, d, q, r)   - computes q = a / 2^d, r = a % 2^d
 mp_expt(a, b, c)        - computes c = a ** b
 mp_2expt(a, k)          - computes a = 2^k
+mp_sqrt(a, c)           - computes c = floor(sqrt(a))
 
 The mp_div_2d() function efficiently computes division by powers of
 two.  Either the q or r parameter may be NULL, in which case that
 portion of the computation will be discarded.
 
 The algorithms used for some of the computations here are described in
 the following files which are included with this distribution:
 
--- a/security/nss/lib/freebl/mpi/mpi-test.c
+++ b/security/nss/lib/freebl/mpi/mpi-test.c
@@ -1177,16 +1177,49 @@ test_2expt(void)
     }
 
     return 0;
 }
 
 /*------------------------------------------------------------------------*/
 
 int
+test_sqrt(void)
+{
+    mp_int a;
+    int res = 0;
+
+    mp_init(&a);
+    mp_read_radix(&a, mp9, 16);
+    mp_sqrt(&a, &a);
+    mp_toradix(&a, g_intbuf, 16);
+
+    if (strcmp(g_intbuf, t_mp9) != 0) {
+        reason("error: computed %s, expected %s\n", g_intbuf, t_mp9);
+        res = 1;
+        goto CLEANUP;
+    }
+
+    mp_read_radix(&a, mp15, 16);
+    mp_sqrt(&a, &a);
+    mp_toradix(&a, g_intbuf, 16);
+
+    if (strcmp(g_intbuf, t_mp15) != 0) {
+        reason("error: computed %s, expected %s\n", g_intbuf, t_mp15);
+        res = 1;
+    }
+
+CLEANUP:
+    mp_clear(&a);
+    return res;
+}
+
+/*------------------------------------------------------------------------*/
+
+int
 test_mod_d(void)
 {
     mp_int a;
     mp_digit r;
 
     mp_init(&a);
     mp_read_radix(&a, mp5, 16);
     IFOK(mp_mod_d(&a, md5, &r));
--- a/security/nss/lib/freebl/mpi/mpi.c
+++ b/security/nss/lib/freebl/mpi/mpi.c
@@ -1292,16 +1292,98 @@ mp_mod_d(const mp_int *a, mp_digit d, mp
         *c = rem;
 
     return MP_OKAY;
 
 } /* end mp_mod_d() */
 
 /* }}} */
 
+/* {{{ mp_sqrt(a, b) */
+
+/*
+  mp_sqrt(a, b)
+
+  Compute the integer square root of a, and store the result in b.
+  Uses an integer-arithmetic version of Newton's iterative linear
+  approximation technique to determine this value; the result has the
+  following two properties:
+
+     b^2 <= a
+     (b+1)^2 >= a
+
+  It is a range error to pass a negative value.
+ */
+mp_err
+mp_sqrt(const mp_int *a, mp_int *b)
+{
+    mp_int x, t;
+    mp_err res;
+    mp_size used;
+
+    ARGCHK(a != NULL && b != NULL, MP_BADARG);
+
+    /* Cannot take square root of a negative value */
+    if (SIGN(a) == NEG)
+        return MP_RANGE;
+
+    /* Special cases for zero and one, trivial     */
+    if (mp_cmp_d(a, 1) <= 0)
+        return mp_copy(a, b);
+
+    /* Initialize the temporaries we'll use below  */
+    if ((res = mp_init_size(&t, USED(a))) != MP_OKAY)
+        return res;
+
+    /* Compute an initial guess for the iteration as a itself */
+    if ((res = mp_init_copy(&x, a)) != MP_OKAY)
+        goto X;
+
+    used = MP_USED(&x);
+    if (used > 1) {
+        s_mp_rshd(&x, used / 2);
+    }
+
+    for (;;) {
+        /* t = (x * x) - a */
+        if ((res = mp_copy(&x, &t)) != MP_OKAY ||
+            (res = mp_sqr(&t, &t)) != MP_OKAY ||
+            (res = mp_sub(&t, a, &t)) != MP_OKAY)
+            goto CLEANUP;
+
+        /* t = t / 2x       */
+        s_mp_mul_2(&x);
+        if ((res = mp_div(&t, &x, &t, NULL)) != MP_OKAY)
+            goto CLEANUP;
+        s_mp_div_2(&x);
+
+        /* Terminate the loop, if the quotient is zero */
+        if (mp_cmp_z(&t) == MP_EQ)
+            break;
+
+        /* x = x - t       */
+        if ((res = mp_sub(&x, &t, &x)) != MP_OKAY)
+            goto CLEANUP;
+    }
+
+    /* Copy result to output parameter */
+    MP_CHECKOK(mp_sub_d(&x, 1, &x));
+    s_mp_exch(&x, b);
+
+CLEANUP:
+    mp_clear(&x);
+X:
+    mp_clear(&t);
+
+    return res;
+
+} /* end mp_sqrt() */
+
+/* }}} */
+
 /* }}} */
 
 /*------------------------------------------------------------------------*/
 /* {{{ Modular arithmetic */
 
 #if MP_MODARITH
 /* {{{ mp_addmod(a, b, m, c) */
 
--- a/security/nss/lib/freebl/mpi/mpi.h
+++ b/security/nss/lib/freebl/mpi/mpi.h
@@ -191,16 +191,17 @@ mp_err mp_mul(const mp_int *a, const mp_
 mp_err mp_sqr(const mp_int *a, mp_int *b);
 #else
 #define mp_sqr(a, b) mp_mul(a, a, b)
 #endif
 mp_err mp_div(const mp_int *a, const mp_int *b, mp_int *q, mp_int *r);
 mp_err mp_div_2d(const mp_int *a, mp_digit d, mp_int *q, mp_int *r);
 mp_err mp_expt(mp_int *a, mp_int *b, mp_int *c);
 mp_err mp_2expt(mp_int *a, mp_digit k);
+mp_err mp_sqrt(const mp_int *a, mp_int *b);
 
 /* Modular arithmetic      */
 #if MP_MODARITH
 mp_err mp_mod(const mp_int *a, const mp_int *m, mp_int *c);
 mp_err mp_mod_d(const mp_int *a, mp_digit d, mp_digit *c);
 mp_err mp_addmod(const mp_int *a, const mp_int *b, const mp_int *m, mp_int *c);
 mp_err mp_submod(const mp_int *a, const mp_int *b, const mp_int *m, mp_int *c);
 mp_err mp_mulmod(const mp_int *a, const mp_int *b, const mp_int *m, mp_int *c);
--- a/security/nss/lib/freebl/mpi/tests/mptest-3.c
+++ b/security/nss/lib/freebl/mpi/tests/mptest-3.c
@@ -12,16 +12,17 @@
 #include <string.h>
 #include <ctype.h>
 #include <limits.h>
 
 #include <time.h>
 
 #include "mpi.h"
 
+#define SQRT 1 /* define nonzero to get square-root test  */
 #define EXPT 0 /* define nonzero to get exponentiate test */
 
 int
 main(int argc, char *argv[])
 {
     int ix;
     mp_int a, b, c, d;
     mp_digit r;
@@ -91,15 +92,30 @@ main(int argc, char *argv[])
 
     ix = rand() % 256;
     printf("\nc = 2^%d\n", ix);
     mp_2expt(&c, ix);
     printf("c = ");
     mp_print(&c, stdout);
     fputc('\n', stdout);
 
+#if SQRT
+    printf("\nc = sqrt(a)\n");
+    if ((res = mp_sqrt(&a, &c)) != MP_OKAY) {
+        printf("mp_sqrt: %s\n", mp_strerror(res));
+    } else {
+        printf("c = ");
+        mp_print(&c, stdout);
+        fputc('\n', stdout);
+        mp_sqr(&c, &c);
+        printf("c^2 = ");
+        mp_print(&c, stdout);
+        fputc('\n', stdout);
+    }
+#endif
+
     mp_clear(&d);
     mp_clear(&c);
     mp_clear(&b);
     mp_clear(&a);
 
     return 0;
 }
--- a/security/nss/lib/freebl/rsa.c
+++ b/security/nss/lib/freebl/rsa.c
@@ -378,182 +378,91 @@ rsa_is_prime(mp_int *p)
     }
 
     /* If that passed, run some Miller-Rabin tests */
     res = mpp_pprime(p, 2);
     return res;
 }
 
 /*
- * Factorize a RSA modulus n into p and q by using the exponents e and d.
- *
- * In: e, d, n
- * Out: p, q
- *
- * See Handbook of Applied Cryptography, 8.2.2(i).
- *
- * The algorithm is probabilistic, it is run 64 times and each run has a 50%
- * chance of succeeding with a runtime of O(log(e*d)).
+ * Try to find the two primes based on 2 exponents plus either a prime
+ *   or a modulus.
  *
- * The returned p might be smaller than q.
- */
-static mp_err
-rsa_factorize_n_from_exponents(mp_int *e, mp_int *d, mp_int *p, mp_int *q,
-                               mp_int *n)
-{
-    /* lambda is the private modulus: e*d = 1 mod lambda */
-    /* so: e*d - 1 = k*lambda = t*2^s where t is odd */
-    mp_int klambda;
-    mp_int t, onetwentyeight;
-    unsigned long s = 0;
-    unsigned long i;
-
-    /* cand = a^(t * 2^i) mod n, next_cand = a^(t * 2^(i+1)) mod n */
-    mp_int a;
-    mp_int cand;
-    mp_int next_cand;
-
-    mp_int n_minus_one;
-    mp_err err = MP_OKAY;
-
-    MP_DIGITS(&klambda) = 0;
-    MP_DIGITS(&t) = 0;
-    MP_DIGITS(&a) = 0;
-    MP_DIGITS(&cand) = 0;
-    MP_DIGITS(&n_minus_one) = 0;
-    MP_DIGITS(&next_cand) = 0;
-    MP_DIGITS(&onetwentyeight) = 0;
-    CHECK_MPI_OK(mp_init(&klambda));
-    CHECK_MPI_OK(mp_init(&t));
-    CHECK_MPI_OK(mp_init(&a));
-    CHECK_MPI_OK(mp_init(&cand));
-    CHECK_MPI_OK(mp_init(&n_minus_one));
-    CHECK_MPI_OK(mp_init(&next_cand));
-    CHECK_MPI_OK(mp_init(&onetwentyeight));
-
-    mp_set_int(&onetwentyeight, 128);
-
-    /* calculate k*lambda = e*d - 1 */
-    CHECK_MPI_OK(mp_mul(e, d, &klambda));
-    CHECK_MPI_OK(mp_sub_d(&klambda, 1, &klambda));
-
-    /* factorize klambda into t*2^s */
-    CHECK_MPI_OK(mp_copy(&klambda, &t));
-    while (mpp_divis_d(&t, 2) == MP_YES) {
-        CHECK_MPI_OK(mp_div_2(&t, &t));
-        s += 1;
-    }
-
-    /* precompute n_minus_one = n - 1 */
-    CHECK_MPI_OK(mp_copy(n, &n_minus_one));
-    CHECK_MPI_OK(mp_sub_d(&n_minus_one, 1, &n_minus_one));
-
-    /* pick random bases a, each one has a 50% leading to a factorization */
-    CHECK_MPI_OK(mp_set_int(&a, 2));
-    /* The following is equivalent to for (a=2, a <= 128, a+=2) */
-    while (mp_cmp(&a, &onetwentyeight) <= 0) {
-        /* compute the base cand = a^(t * 2^0) [i = 0] */
-        CHECK_MPI_OK(mp_exptmod(&a, &t, n, &cand));
-
-        for (i = 0; i < s; i++) {
-            /* condition 1: skip the base if we hit a trivial factor of n */
-            if (mp_cmp(&cand, &n_minus_one) == 0 || mp_cmp_d(&cand, 1) == 0) {
-                break;
-            }
-
-            /* increase i in a^(t * 2^i) by squaring the number */
-            CHECK_MPI_OK(mp_exptmod_d(&cand, 2, n, &next_cand));
-
-            /* condition 2: a^(t * 2^(i+1)) = 1 mod n */
-            if (mp_cmp_d(&next_cand, 1) == 0) {
-                /* conditions verified, gcd(a^(t * 2^i) - 1, n) is a factor */
-                CHECK_MPI_OK(mp_sub_d(&cand, 1, &cand));
-                CHECK_MPI_OK(mp_gcd(&cand, n, p));
-                if (mp_cmp_d(p, 1) == 0) {
-                    CHECK_MPI_OK(mp_add_d(&cand, 1, &cand));
-                    break;
-                }
-                CHECK_MPI_OK(mp_div(n, p, q, NULL));
-                goto cleanup;
-            }
-            CHECK_MPI_OK(mp_copy(&next_cand, &cand));
-        }
-
-        CHECK_MPI_OK(mp_add_d(&a, 2, &a));
-    }
-
-    /* if we reach here it's likely (2^64 - 1 / 2^64) that d is wrong */
-    err = MP_RANGE;
-
-cleanup:
-    mp_clear(&klambda);
-    mp_clear(&t);
-    mp_clear(&a);
-    mp_clear(&cand);
-    mp_clear(&n_minus_one);
-    mp_clear(&next_cand);
-    mp_clear(&onetwentyeight);
-    return err;
-}
-
-/*
- * Try to find the two primes based on 2 exponents plus a prime.
- *
- * In: e, d and p.
+ * In: e, d and either p or n (depending on the setting of hasModulus).
  * Out: p,q.
  *
  * Step 1, Since d = e**-1 mod phi, we know that d*e == 1 mod phi, or
  *  d*e = 1+k*phi, or d*e-1 = k*phi. since d is less than phi and e is
  *  usually less than d, then k must be an integer between e-1 and 1
  *  (probably on the order of e).
- * Step 1a, We can divide k*phi by prime-1 and get k*(q-1). This will reduce
- *      the size of our division through the rest of the loop.
+ * Step 1a, If we were passed just a prime, we can divide k*phi by that
+ *      prime-1 and get k*(q-1). This will reduce the size of our division
+ *      through the rest of the loop.
  * Step 2, Loop through the values k=e-1 to 1 looking for k. k should be on
  *  the order or e, and e is typically small. This may take a while for
  *  a large random e. We are looking for a k that divides kphi
  *  evenly. Once we find a k that divides kphi evenly, we assume it
  *  is the true k. It's possible this k is not the 'true' k but has
  *  swapped factors of p-1 and/or q-1. Because of this, we
  *  tentatively continue Steps 3-6 inside this loop, and may return looking
  *  for another k on failure.
- * Step 3, Calculate our tentative phi=kphi/k. Note: real phi is (p-1)*(q-1).
- * Step 4a, kphi is k*(q-1), so phi is our tenative q-1. q = phi+1.
- *      If k is correct, q should be the right length and prime.
+ * Step 3, Calculate are tentative phi=kphi/k. Note: real phi is (p-1)*(q-1).
+ * Step 4a, if we have a prime, kphi is already k*(q-1), so phi is or tenative
+ *      q-1. q = phi+1. If k is correct, q should be the right length and
+ *      prime.
  * Step 4b, It's possible q-1 and k could have swapped factors. We now have a
  *  possible solution that meets our criteria. It may not be the only
  *      solution, however, so we keep looking. If we find more than one,
  *      we will fail since we cannot determine which is the correct
  *      solution, and returning the wrong modulus will compromise both
  *      moduli. If no other solution is found, we return the unique solution.
+ * Step 5a, If we have the modulus (n=pq), then use the following formula to
+ *  calculate  s=(p+q): , phi = (p-1)(q-1) = pq  -p-q +1 = n-s+1. so
+ *  s=n-phi+1.
+ * Step 5b, Use n=pq and s=p+q to solve for p and q as follows:
+ *  since q=s-p, then n=p*(s-p)= sp - p^2, rearranging p^2-s*p+n = 0.
+ *  from the quadratic equation we have p=1/2*(s+sqrt(s*s-4*n)) and
+ *  q=1/2*(s-sqrt(s*s-4*n)) if s*s-4*n is a perfect square, we are DONE.
+ *  If it is not, continue in our look looking for another k. NOTE: the
+ *  code actually distributes the 1/2 and results in the equations:
+ *  sqrt = sqrt(s/2*s/2-n), p=s/2+sqrt, q=s/2-sqrt. The algebra saves us
+ *  and extra divide by 2 and a multiply by 4.
  *
  * This will return p & q. q may be larger than p in the case that p was given
  * and it was the smaller prime.
  */
 static mp_err
-rsa_get_prime_from_exponents(mp_int *e, mp_int *d, mp_int *p, mp_int *q,
-                             mp_int *n, unsigned int keySizeInBits)
+rsa_get_primes_from_exponents(mp_int *e, mp_int *d, mp_int *p, mp_int *q,
+                              mp_int *n, PRBool hasModulus,
+                              unsigned int keySizeInBits)
 {
     mp_int kphi; /* k*phi */
     mp_int k;    /* current guess at 'k' */
     mp_int phi;  /* (p-1)(q-1) */
+    mp_int s;    /* p+q/2 (s/2 in the algebra) */
     mp_int r;    /* remainder */
-    mp_int tmp;  /* p-1 if p is given */
+    mp_int tmp;  /* p-1 if p is given, n+1 is modulus is given */
+    mp_int sqrt; /* sqrt(s/2*s/2-n) */
     mp_err err = MP_OKAY;
     unsigned int order_k;
 
     MP_DIGITS(&kphi) = 0;
     MP_DIGITS(&phi) = 0;
+    MP_DIGITS(&s) = 0;
     MP_DIGITS(&k) = 0;
     MP_DIGITS(&r) = 0;
     MP_DIGITS(&tmp) = 0;
+    MP_DIGITS(&sqrt) = 0;
     CHECK_MPI_OK(mp_init(&kphi));
     CHECK_MPI_OK(mp_init(&phi));
+    CHECK_MPI_OK(mp_init(&s));
     CHECK_MPI_OK(mp_init(&k));
     CHECK_MPI_OK(mp_init(&r));
     CHECK_MPI_OK(mp_init(&tmp));
+    CHECK_MPI_OK(mp_init(&sqrt));
 
     /* our algorithm looks for a factor k whose maximum size is dependent
      * on the size of our smallest exponent, which had better be the public
      * exponent (if it's the private, the key is vulnerable to a brute force
      * attack).
      *
      * since our factor search is linear, we need to limit the maximum
      * size of the public key. this should not be a problem normally, since
@@ -592,103 +501,161 @@ rsa_get_prime_from_exponents(mp_int *e, 
     if (mp_cmp(&k, e) >= 0) {
         /* also can't be bigger then e-1 */
         CHECK_MPI_OK(mp_sub_d(e, 1, &k));
     }
 
     /* calculate our temp value */
     /* This saves recalculating this value when the k guess is wrong, which
      * is reasonably frequent. */
-    /* tmp = p-1 (used to calculate q-1= phi/tmp) */
-    CHECK_MPI_OK(mp_sub_d(p, 1, &tmp));
-    CHECK_MPI_OK(mp_div(&kphi, &tmp, &kphi, &r));
-    if (mp_cmp_z(&r) != 0) {
-        /* p-1 doesn't divide kphi, some parameter wasn't correct */
-        err = MP_RANGE;
-        goto cleanup;
+    /* for the modulus case, tmp = n+1 (used to calculate p+q = tmp - phi) */
+    /* for the prime case, tmp = p-1 (used to calculate q-1= phi/tmp) */
+    if (hasModulus) {
+        CHECK_MPI_OK(mp_add_d(n, 1, &tmp));
+    } else {
+        CHECK_MPI_OK(mp_sub_d(p, 1, &tmp));
+        CHECK_MPI_OK(mp_div(&kphi, &tmp, &kphi, &r));
+        if (mp_cmp_z(&r) != 0) {
+            /* p-1 doesn't divide kphi, some parameter wasn't correct */
+            err = MP_RANGE;
+            goto cleanup;
+        }
+        mp_zero(q);
+        /* kphi is now k*(q-1) */
     }
-    mp_zero(q);
-    /* kphi is now k*(q-1) */
 
     /* rest of the for loop */
     for (; (err == MP_OKAY) && (mpl_significant_bits(&k) >= order_k);
          err = mp_sub_d(&k, 1, &k)) {
-        CHECK_MPI_OK(err);
         /* looking for k as a factor of kphi */
         CHECK_MPI_OK(mp_div(&kphi, &k, &phi, &r));
         if (mp_cmp_z(&r) != 0) {
             /* not a factor, try the next one */
             continue;
         }
         /* we have a possible phi, see if it works */
-        if ((unsigned)mpl_significant_bits(&phi) != keySizeInBits / 2) {
+        if (!hasModulus) {
+            if ((unsigned)mpl_significant_bits(&phi) != keySizeInBits / 2) {
+                /* phi is not the right size */
+                continue;
+            }
+            /* phi should be divisible by 2, since
+         * q is odd and phi=(q-1). */
+            if (mpp_divis_d(&phi, 2) == MP_NO) {
+                /* phi is not divisible by 4 */
+                continue;
+            }
+            /* we now have a candidate for the second prime */
+            CHECK_MPI_OK(mp_add_d(&phi, 1, &tmp));
+
+            /* check to make sure it is prime */
+            err = rsa_is_prime(&tmp);
+            if (err != MP_OKAY) {
+                if (err == MP_NO) {
+                    /* No, then we still have the wrong phi */
+                    continue;
+                }
+                goto cleanup;
+            }
+            /*
+             * It is possible that we have the wrong phi if
+             * k_guess*(q_guess-1) = k*(q-1) (k and q-1 have swapped factors).
+             * since our q_quess is prime, however. We have found a valid
+             * rsa key because:
+             *   q is the correct order of magnitude.
+             *   phi = (p-1)(q-1) where p and q are both primes.
+             *   e*d mod phi = 1.
+             * There is no way to know from the info given if this is the
+             * original key. We never want to return the wrong key because if
+             * two moduli with the same factor is known, then euclid's gcd
+             * algorithm can be used to find that factor. Even though the
+             * caller didn't pass the original modulus, it doesn't mean the
+             * modulus wasn't known or isn't available somewhere. So to be safe
+             * if we can't be sure we have the right q, we don't return any.
+             *
+             * So to make sure we continue looking for other valid q's. If none
+             * are found, then we can safely return this one, otherwise we just
+             * fail */
+            if (mp_cmp_z(q) != 0) {
+                /* this is the second valid q, don't return either,
+                 * just fail */
+                err = MP_RANGE;
+                break;
+            }
+            /* we only have one q so far, save it and if no others are found,
+             * it's safe to return it */
+            CHECK_MPI_OK(mp_copy(&tmp, q));
+            continue;
+        }
+        /* test our tentative phi */
+        /* phi should be the correct order */
+        if ((unsigned)mpl_significant_bits(&phi) != keySizeInBits) {
             /* phi is not the right size */
             continue;
         }
-        /* phi should be divisible by 2, since
-         * q is odd and phi=(q-1). */
-        if (mpp_divis_d(&phi, 2) == MP_NO) {
+        /* phi should be divisible by 4, since
+         * p and q are odd and phi=(p-1)(q-1). */
+        if (mpp_divis_d(&phi, 4) == MP_NO) {
             /* phi is not divisible by 4 */
             continue;
         }
-        /* we now have a candidate for the second prime */
-        CHECK_MPI_OK(mp_add_d(&phi, 1, &tmp));
+        /* n was given, calculate s/2=(p+q)/2 */
+        CHECK_MPI_OK(mp_sub(&tmp, &phi, &s));
+        CHECK_MPI_OK(mp_div_2(&s, &s));
 
-        /* check to make sure it is prime */
-        err = rsa_is_prime(&tmp);
-        if (err != MP_OKAY) {
-            if (err == MP_NO) {
-                /* No, then we still have the wrong phi */
+        /* calculate sqrt(s/2*s/2-n) */
+        CHECK_MPI_OK(mp_sqr(&s, &sqrt));
+        CHECK_MPI_OK(mp_sub(&sqrt, n, &r)); /* r as a tmp */
+        CHECK_MPI_OK(mp_sqrt(&r, &sqrt));
+        /* make sure it's a perfect square */
+        /* r is our original value we took the square root of */
+        /* q is the square of our tentative square root. They should be equal*/
+        CHECK_MPI_OK(mp_sqr(&sqrt, q)); /* q as a tmp */
+        if (mp_cmp(&r, q) != 0) {
+            /* sigh according to the doc, mp_sqrt could return sqrt-1 */
+            CHECK_MPI_OK(mp_add_d(&sqrt, 1, &sqrt));
+            CHECK_MPI_OK(mp_sqr(&sqrt, q));
+            if (mp_cmp(&r, q) != 0) {
+                /* s*s-n not a perfect square, this phi isn't valid, find another.*/
                 continue;
             }
-            goto cleanup;
         }
-        /*
-         * It is possible that we have the wrong phi if
-         * k_guess*(q_guess-1) = k*(q-1) (k and q-1 have swapped factors).
-         * since our q_quess is prime, however. We have found a valid
-         * rsa key because:
-         *   q is the correct order of magnitude.
-         *   phi = (p-1)(q-1) where p and q are both primes.
-         *   e*d mod phi = 1.
-         * There is no way to know from the info given if this is the
-         * original key. We never want to return the wrong key because if
-         * two moduli with the same factor is known, then euclid's gcd
-         * algorithm can be used to find that factor. Even though the
-         * caller didn't pass the original modulus, it doesn't mean the
-         * modulus wasn't known or isn't available somewhere. So to be safe
-         * if we can't be sure we have the right q, we don't return any.
-         *
-         * So to make sure we continue looking for other valid q's. If none
-         * are found, then we can safely return this one, otherwise we just
-         * fail */
-        if (mp_cmp_z(q) != 0) {
-            /* this is the second valid q, don't return either,
-             * just fail */
-            err = MP_RANGE;
-            break;
-        }
-        /* we only have one q so far, save it and if no others are found,
-         * it's safe to return it */
-        CHECK_MPI_OK(mp_copy(&tmp, q));
-        continue;
+
+        /* NOTE: In this case we know we have the one and only answer.
+         * "Why?", you ask. Because:
+         *    1) n is a composite of two large primes (or it wasn't a
+         *       valid RSA modulus).
+         *    2) If we know any number such that x^2-n is a perfect square
+         *       and x is not (n+1)/2, then we can calculate 2 non-trivial
+         *       factors of n.
+         *    3) Since we know that n has only 2 non-trivial prime factors,
+         *       we know the two factors we have are the only possible factors.
+         */
+
+        /* Now we are home free to calculate p and q */
+        /* p = s/2 + sqrt, q= s/2 - sqrt */
+        CHECK_MPI_OK(mp_add(&s, &sqrt, p));
+        CHECK_MPI_OK(mp_sub(&s, &sqrt, q));
+        break;
     }
     if ((unsigned)mpl_significant_bits(&k) < order_k) {
-        if (mp_cmp_z(q) == 0) {
+        if (hasModulus || (mp_cmp_z(q) == 0)) {
             /* If we get here, something was wrong with the parameters we
              * were given */
             err = MP_RANGE;
         }
     }
 cleanup:
     mp_clear(&kphi);
     mp_clear(&phi);
+    mp_clear(&s);
     mp_clear(&k);
     mp_clear(&r);
     mp_clear(&tmp);
+    mp_clear(&sqrt);
     return err;
 }
 
 /*
  * take a private key with only a few elements and fill out the missing pieces.
  *
  * All the entries will be overwritten with data allocated out of the arena
  * If no arena is supplied, one will be created.
@@ -708,33 +675,37 @@ cleanup:
  *
  * All parameters will be replaced in the key structure with new parameters
  * Allocated out of the arena. There is no attempt to free the old structures.
  * Prime1 will always be greater than prime2 (even if the caller supplies the
  * smaller prime as prime1 or the larger prime as prime2). The parameters are
  * not overwritten on failure.
  *
  *  How it works:
- *     We can generate all the parameters from one of the exponents, plus the
- *        two primes. (rsa_build_key_from_primes)
+ *     We can generate all the parameters from:
+ *        one of the exponents, plus the two primes. (rsa_build_key_from_primes) *
  *     If we are given one of the exponents and both primes, we are done.
  *     If we are given one of the exponents, the modulus and one prime, we
  *        caclulate the second prime by dividing the modulus by the given
- *        prime, giving us an exponent and 2 primes.
- *     If we are given 2 exponents and one of the primes we calculate
- *        k*phi = d*e-1, where k is an integer less than d which
+ *        prime, giving us and exponent and 2 primes.
+ *     If we are given 2 exponents and either the modulus or one of the primes
+ *        we calculate k*phi = d*e-1, where k is an integer less than d which
  *        divides d*e-1. We find factor k so we can isolate phi.
  *            phi = (p-1)(q-1)
- *        We can use phi to find the other prime as follows:
- *        q = (phi/(p-1)) + 1. We now have 2 primes and an exponent.
- *        (NOTE: if more then one prime meets this condition, the operation
- *        will fail. See comments elsewhere in this file about this).
- *        (rsa_get_prime_from_exponents)
- *     If we are given 2 exponents and the modulus we factor the modulus to
- *        get the 2 missing primes (rsa_factorize_n_from_exponents)
+ *       If one of the primes are given, we can use phi to find the other prime
+ *        as follows: q = (phi/(p-1)) + 1. We now have 2 primes and an
+ *        exponent. (NOTE: if more then one prime meets this condition, the
+ *        operation will fail. See comments elsewhere in this file about this).
+ *       If the modulus is given, then we can calculate the sum of the primes
+ *        as follows: s := (p+q), phi = (p-1)(q-1) = pq -p - q +1, pq = n ->
+ *        phi = n - s + 1, s = n - phi +1.  Now that we have s = p+q and n=pq,
+ *    we can solve our 2 equations and 2 unknowns as follows: q=s-p ->
+ *        n=p*(s-p)= sp -p^2 -> p^2-sp+n = 0. Using the quadratic to solve for
+ *        p, p=1/2*(s+ sqrt(s*s-4*n)) [q=1/2*(s-sqrt(s*s-4*n)]. We again have
+ *        2 primes and an exponent.
  *
  */
 SECStatus
 RSA_PopulatePrivateKey(RSAPrivateKey *key)
 {
     PLArenaPool *arena = NULL;
     PRBool needPublicExponent = PR_TRUE;
     PRBool needPrivateExponent = PR_TRUE;
@@ -826,23 +797,21 @@ RSA_PopulatePrivateKey(RSAPrivateKey *ke
         }
         prime_count++;
     }
 
     /* If we didn't have enough primes try to calculate the primes from
      * the exponents */
     if (prime_count < 2) {
         /* if we don't have at least 2 primes at this point, then we need both
-         * exponents and one prime or a modulus*/
+     * exponents and one prime or a modulus*/
         if (!needPublicExponent && !needPrivateExponent &&
-            (prime_count > 0)) {
-            CHECK_MPI_OK(rsa_get_prime_from_exponents(&e, &d, &p, &q, &n,
-                                                      keySizeInBits));
-        } else if (!needPublicExponent && !needPrivateExponent && hasModulus) {
-            CHECK_MPI_OK(rsa_factorize_n_from_exponents(&e, &d, &p, &q, &n));
+            ((prime_count > 0) || hasModulus)) {
+            CHECK_MPI_OK(rsa_get_primes_from_exponents(&e, &d, &p, &q,
+                                                       &n, hasModulus, keySizeInBits));
         } else {
             /* not enough given parameters to get both primes */
             err = MP_BADARG;
             goto cleanup;
         }
     }
 
     /* Assure p > q */
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/jar/exports.gyp
@@ -0,0 +1,27 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_jar_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'jar-ds.h',
+            'jar.h',
+            'jarfile.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/jar/jar.gyp
@@ -0,0 +1,76 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'jar',
+      'type': 'static_library',
+      'sources': [
+        'jar-ds.c',
+        'jar.c',
+        'jarfile.c',
+        'jarint.c',
+        'jarsign.c',
+        'jarver.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'MOZILLA_CLIENT=1',
+    ],
+    'conditions': [
+      [ 'OS=="win"', {
+        'configurations': {
+          'x86_Base': {
+            'msvs_settings': {
+              'VCCLCompilerTool': {
+                'PreprocessorDefinitions': [
+                  'NSS_X86_OR_X64',
+                  'NSS_X86',
+                ],
+              },
+            },
+          },
+          'x64_Base': {
+            'msvs_settings': {
+              'VCCLCompilerTool': {
+                'PreprocessorDefinitions': [
+                  'NSS_USE_64',
+                  'NSS_X86_OR_X64',
+                  'NSS_X64',
+                ],
+              },
+            },
+          },
+        },
+      }, {
+        'conditions': [
+          [ 'target_arch=="x64"', {
+            'defines': [
+              'NSS_USE_64',
+              'NSS_X86_OR_X64',
+              'NSS_X64',
+            ],
+          }],
+          [ 'target_arch=="ia32"', {
+            'defines': [
+              'NSS_X86_OR_X64',
+              'NSS_X86',
+            ],
+          }],
+        ],
+      }],
+    ],
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/include/exports.gyp
@@ -0,0 +1,38 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_include_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix.h',
+            'pkix_certsel.h',
+            'pkix_certstore.h',
+            'pkix_checker.h',
+            'pkix_crlsel.h',
+            'pkix_errorstrings.h',
+            'pkix_params.h',
+            'pkix_pl_pki.h',
+            'pkix_pl_system.h',
+            'pkix_results.h',
+            'pkix_revchecker.h',
+            'pkix_sample_modules.h',
+            'pkix_util.h',
+            'pkixt.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/include/include.gyp
@@ -0,0 +1,12 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi'
+  ],
+  'targets': [],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/certsel/certsel.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixcertsel',
+      'type': 'static_library',
+      'sources': [
+        'pkix_certselector.c',
+        'pkix_comcertselparams.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/certsel/exports.gyp
@@ -0,0 +1,26 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_certsel_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_certselector.h',
+            'pkix_comcertselparams.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/checker/checker.gyp
@@ -0,0 +1,35 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixchecker',
+      'type': 'static_library',
+      'sources': [
+        'pkix_basicconstraintschecker.c',
+        'pkix_certchainchecker.c',
+        'pkix_crlchecker.c',
+        'pkix_ekuchecker.c',
+        'pkix_expirationchecker.c',
+        'pkix_namechainingchecker.c',
+        'pkix_nameconstraintschecker.c',
+        'pkix_ocspchecker.c',
+        'pkix_policychecker.c',
+        'pkix_revocationchecker.c',
+        'pkix_revocationmethod.c',
+        'pkix_signaturechecker.c',
+        'pkix_targetcertchecker.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/checker/exports.gyp
@@ -0,0 +1,37 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_checker_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_basicconstraintschecker.h',
+            'pkix_certchainchecker.h',
+            'pkix_crlchecker.h',
+            'pkix_ekuchecker.h',
+            'pkix_expirationchecker.h',
+            'pkix_namechainingchecker.h',
+            'pkix_nameconstraintschecker.h',
+            'pkix_ocspchecker.h',
+            'pkix_policychecker.h',
+            'pkix_revocationchecker.h',
+            'pkix_revocationmethod.h',
+            'pkix_signaturechecker.h',
+            'pkix_targetcertchecker.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/crlsel/crlsel.gyp
@@ -0,0 +1,24 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixcrlsel',
+      'type': 'static_library',
+      'sources': [
+        'pkix_comcrlselparams.c',
+        'pkix_crlselector.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/crlsel/exports.gyp
@@ -0,0 +1,26 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_crlsel_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_comcrlselparams.h',
+            'pkix_crlselector.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/params/exports.gyp
@@ -0,0 +1,28 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_params_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_procparams.h',
+            'pkix_resourcelimits.h',
+            'pkix_trustanchor.h',
+            'pkix_valparams.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/params/params.gyp
@@ -0,0 +1,26 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixparams',
+      'type': 'static_library',
+      'sources': [
+        'pkix_procparams.c',
+        'pkix_resourcelimits.c',
+        'pkix_trustanchor.c',
+        'pkix_valparams.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/results/exports.gyp
@@ -0,0 +1,28 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_results_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_buildresult.h',
+            'pkix_policynode.h',
+            'pkix_valresult.h',
+            'pkix_verifynode.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/results/results.gyp
@@ -0,0 +1,26 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixresults',
+      'type': 'static_library',
+      'sources': [
+        'pkix_buildresult.c',
+        'pkix_policynode.c',
+        'pkix_valresult.c',
+        'pkix_verifynode.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/store/exports.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_store_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_store.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/store/store.gyp
@@ -0,0 +1,23 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixstore',
+      'type': 'static_library',
+      'sources': [
+        'pkix_store.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/top/exports.gyp
@@ -0,0 +1,27 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_top_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_build.h',
+            'pkix_lifecycle.h',
+            'pkix_validate.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/top/top.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixtop',
+      'type': 'static_library',
+      'sources': [
+        'pkix_build.c',
+        'pkix_lifecycle.c',
+        'pkix_validate.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/util/exports.gyp
@@ -0,0 +1,28 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_util_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_error.h',
+            'pkix_list.h',
+            'pkix_logger.h',
+            'pkix_tools.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix/util/util.gyp
@@ -0,0 +1,27 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixutil',
+      'type': 'static_library',
+      'sources': [
+        'pkix_error.c',
+        'pkix_errpaths.c',
+        'pkix_list.c',
+        'pkix_logger.c',
+        'pkix_tools.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix_pl_nss/module/exports.gyp
@@ -0,0 +1,36 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_pl_nss_module_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_pl_aiamgr.h',
+            'pkix_pl_colcertstore.h',
+            'pkix_pl_httpcertstore.h',
+            'pkix_pl_httpdefaultclient.h',
+            'pkix_pl_ldapcertstore.h',
+            'pkix_pl_ldapdefaultclient.h',
+            'pkix_pl_ldaprequest.h',
+            'pkix_pl_ldapresponse.h',
+            'pkix_pl_ldapt.h',
+            'pkix_pl_nsscontext.h',
+            'pkix_pl_pk11certstore.h',
+            'pkix_pl_socket.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix_pl_nss/module/module.gyp
@@ -0,0 +1,41 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixmodule',
+      'type': 'static_library',
+      'sources': [
+        'pkix_pl_aiamgr.c',
+        'pkix_pl_colcertstore.c',
+        'pkix_pl_httpcertstore.c',
+        'pkix_pl_httpdefaultclient.c',
+        'pkix_pl_ldapcertstore.c',
+        'pkix_pl_ldapdefaultclient.c',
+        'pkix_pl_ldaprequest.c',
+        'pkix_pl_ldapresponse.c',
+        'pkix_pl_ldaptemplates.c',
+        'pkix_pl_nsscontext.c',
+        'pkix_pl_pk11certstore.c',
+        'pkix_pl_socket.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'SHLIB_SUFFIX=\"<(dll_suffix)\"',
+      'SHLIB_PREFIX=\"<(dll_prefix)\"',
+      'SHLIB_VERSION=\"\"'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix_pl_nss/pki/exports.gyp
@@ -0,0 +1,41 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_pl_nss_pki_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_pl_basicconstraints.h',
+            'pkix_pl_cert.h',
+            'pkix_pl_certpolicyinfo.h',
+            'pkix_pl_certpolicymap.h',
+            'pkix_pl_certpolicyqualifier.h',
+            'pkix_pl_crl.h',
+            'pkix_pl_crldp.h',
+            'pkix_pl_crlentry.h',
+            'pkix_pl_date.h',
+            'pkix_pl_generalname.h',
+            'pkix_pl_infoaccess.h',
+            'pkix_pl_nameconstraints.h',
+            'pkix_pl_ocspcertid.h',
+            'pkix_pl_ocsprequest.h',
+            'pkix_pl_ocspresponse.h',
+            'pkix_pl_publickey.h',
+            'pkix_pl_x500name.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix_pl_nss/pki/pki.gyp
@@ -0,0 +1,39 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixpki',
+      'type': 'static_library',
+      'sources': [
+        'pkix_pl_basicconstraints.c',
+        'pkix_pl_cert.c',
+        'pkix_pl_certpolicyinfo.c',
+        'pkix_pl_certpolicymap.c',
+        'pkix_pl_certpolicyqualifier.c',
+        'pkix_pl_crl.c',
+        'pkix_pl_crldp.c',
+        'pkix_pl_crlentry.c',
+        'pkix_pl_date.c',
+        'pkix_pl_generalname.c',
+        'pkix_pl_infoaccess.c',
+        'pkix_pl_nameconstraints.c',
+        'pkix_pl_ocspcertid.c',
+        'pkix_pl_ocsprequest.c',
+        'pkix_pl_ocspresponse.c',
+        'pkix_pl_publickey.c',
+        'pkix_pl_x500name.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix_pl_nss/system/exports.gyp
@@ -0,0 +1,37 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_libpkix_pkix_pl_nss_system_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkix_pl_bigint.h',
+            'pkix_pl_bytearray.h',
+            'pkix_pl_common.h',
+            'pkix_pl_hashtable.h',
+            'pkix_pl_lifecycle.h',
+            'pkix_pl_mem.h',
+            'pkix_pl_monitorlock.h',
+            'pkix_pl_mutex.h',
+            'pkix_pl_object.h',
+            'pkix_pl_oid.h',
+            'pkix_pl_primhash.h',
+            'pkix_pl_rwlock.h',
+            'pkix_pl_string.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/libpkix/pkix_pl_nss/system/system.gyp
@@ -0,0 +1,36 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkixsystem',
+      'type': 'static_library',
+      'sources': [
+        'pkix_pl_bigint.c',
+        'pkix_pl_bytearray.c',
+        'pkix_pl_common.c',
+        'pkix_pl_error.c',
+        'pkix_pl_hashtable.c',
+        'pkix_pl_lifecycle.c',
+        'pkix_pl_mem.c',
+        'pkix_pl_monitorlock.c',
+        'pkix_pl_mutex.c',
+        'pkix_pl_object.c',
+        'pkix_pl_oid.c',
+        'pkix_pl_primhash.c',
+        'pkix_pl_rwlock.c',
+        'pkix_pl_string.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/nss/exports.gyp
@@ -0,0 +1,32 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_nss_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'nss.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'nssoptions.h',
+            'nssrenam.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/nss/nss.gyp
@@ -0,0 +1,83 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nss_static',
+      'type': 'static_library',
+      'sources': [
+        'nssinit.c',
+        'nssoptions.c',
+        'nssver.c',
+        'utilwrap.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+      ]
+    },
+    {
+      # This is here so Firefox can link this without having to
+      # repeat the list of dependencies.
+      'target_name': 'nss3_deps',
+      'type': 'none',
+      'dependencies': [
+        'nss_static',
+        '<(DEPTH)/lib/certhigh/certhigh.gyp:certhi',
+        '<(DEPTH)/lib/cryptohi/cryptohi.gyp:cryptohi',
+        '<(DEPTH)/lib/pk11wrap/pk11wrap.gyp:pk11wrap',
+        '<(DEPTH)/lib/certdb/certdb.gyp:certdb',
+        '<(DEPTH)/lib/pki/pki.gyp:nsspki',
+        '<(DEPTH)/lib/dev/dev.gyp:nssdev',
+        '<(DEPTH)/lib/base/base.gyp:nssb',
+      ],
+      'conditions': [
+        [ 'disable_libpkix==0', {
+          'dependencies': [
+            '<(DEPTH)/lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
+            '<(DEPTH)/lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
+            '<(DEPTH)/lib/libpkix/pkix/params/params.gyp:pkixparams',
+            '<(DEPTH)/lib/libpkix/pkix/results/results.gyp:pkixresults',
+            '<(DEPTH)/lib/libpkix/pkix/top/top.gyp:pkixtop',
+            '<(DEPTH)/lib/libpkix/pkix/util/util.gyp:pkixutil',
+            '<(DEPTH)/lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
+            '<(DEPTH)/lib/libpkix/pkix/store/store.gyp:pkixstore',
+            '<(DEPTH)/lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
+            '<(DEPTH)/lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
+            '<(DEPTH)/lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule'
+          ],
+          }],
+        ],
+    },
+    {
+      'target_name': 'nss3',
+      'type': 'shared_library',
+      'dependencies': [
+        'nss3_deps',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3',
+      ],
+      'variables': {
+        'mapfile': 'nss.def'
+      }
+    }
+  ],
+  'conditions': [
+    [ 'moz_fold_libs==1', {
+      'targets': [
+        {
+          'target_name': 'nss3_static',
+          'type': 'static_library',
+          'dependencies': [
+            'nss3_deps',
+          ],
+        }
+      ],
+    }],
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/pk11wrap/exports.gyp
@@ -0,0 +1,39 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_pk11wrap_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pk11func.h',
+            'pk11pqg.h',
+            'pk11priv.h',
+            'pk11pub.h',
+            'pk11sdr.h',
+            'secmod.h',
+            'secmodt.h',
+            'secpkcs5.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'dev3hack.h',
+            'secmodi.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/pk11wrap/pk11wrap.gyp
@@ -0,0 +1,51 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pk11wrap',
+      'type': 'static_library',
+      'sources': [
+        'dev3hack.c',
+        'pk11akey.c',
+        'pk11auth.c',
+        'pk11cert.c',
+        'pk11cxt.c',
+        'pk11err.c',
+        'pk11kea.c',
+        'pk11list.c',
+        'pk11load.c',
+        'pk11mech.c',
+        'pk11merge.c',
+        'pk11nobj.c',
+        'pk11obj.c',
+        'pk11pars.c',
+        'pk11pbe.c',
+        'pk11pk12.c',
+        'pk11pqg.c',
+        'pk11sdr.c',
+        'pk11skey.c',
+        'pk11slot.c',
+        'pk11util.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'SHLIB_SUFFIX=\"<(dll_suffix)\"',
+      'SHLIB_PREFIX=\"<(dll_prefix)\"',
+      'SHLIB_VERSION=\"3\"',
+      'SOFTOKEN_SHLIB_VERSION=\"3\"'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/pkcs12/exports.gyp
@@ -0,0 +1,29 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_pkcs12_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'p12.h',
+            'p12plcy.h',
+            'p12t.h',
+            'pkcs12.h',
+            'pkcs12t.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/pkcs12/pkcs12.gyp
@@ -0,0 +1,29 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkcs12',
+      'type': 'static_library',
+      'sources': [
+        'p12creat.c',
+        'p12d.c',
+        'p12dec.c',
+        'p12e.c',
+        'p12local.c',
+        'p12plcy.c',
+        'p12tmpl.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/pkcs7/exports.gyp
@@ -0,0 +1,33 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_pkcs7_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'pkcs7t.h',
+            'secmime.h',
+            'secpkcs7.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'p7local.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/pkcs7/pkcs7.gyp
@@ -0,0 +1,29 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'pkcs7',
+      'type': 'static_library',
+      'sources': [
+        'certread.c',
+        'p7common.c',
+        'p7create.c',
+        'p7decode.c',
+        'p7encode.c',
+        'p7local.c',
+        'secmime.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/pki/exports.gyp
@@ -0,0 +1,32 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_pki_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'nsspki.h',
+            'nsspkit.h',
+            'pki.h',
+            'pki3hack.h',
+            'pkim.h',
+            'pkistore.h',
+            'pkit.h',
+            'pkitm.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/pki/pki.gyp
@@ -0,0 +1,32 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nsspki',
+      'type': 'static_library',
+      'sources': [
+        'asymmkey.c',
+        'certdecode.c',
+        'certificate.c',
+        'cryptocontext.c',
+        'pki3hack.c',
+        'pkibase.c',
+        'pkistore.c',
+        'symmkey.c',
+        'tdcache.c',
+        'trustdomain.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/smime/exports.gyp
@@ -0,0 +1,34 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_smime_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'cms.h',
+            'cmsreclist.h',
+            'cmst.h',
+            'smime.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'cmslocal.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/smime/smime.gyp
@@ -0,0 +1,80 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'smime',
+      'type': 'static_library',
+      'sources': [
+        'cmsarray.c',
+        'cmsasn1.c',
+        'cmsattr.c',
+        'cmscinfo.c',
+        'cmscipher.c',
+        'cmsdecode.c',
+        'cmsdigdata.c',
+        'cmsdigest.c',
+        'cmsencdata.c',
+        'cmsencode.c',
+        'cmsenvdata.c',
+        'cmsmessage.c',
+        'cmspubkey.c',
+        'cmsrecinfo.c',
+        'cmsreclist.c',
+        'cmssigdata.c',
+        'cmssiginfo.c',
+        'cmsudf.c',
+        'cmsutil.c',
+        'smimemessage.c',
+        'smimeutil.c',
+        'smimever.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+      ]
+    },
+    {
+      # This is here so Firefox can link this without having to
+      # repeat the list of dependencies.
+      'target_name': 'smime3_deps',
+      'type': 'none',
+      'dependencies': [
+        'smime',
+        '<(DEPTH)/lib/pkcs12/pkcs12.gyp:pkcs12',
+        '<(DEPTH)/lib/pkcs7/pkcs7.gyp:pkcs7'
+      ],
+    },
+    {
+      'target_name': 'smime3',
+      'type': 'shared_library',
+      'dependencies': [
+        'smime3_deps',
+        '<(DEPTH)/lib/nss/nss.gyp:nss3',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3'
+      ],
+      'variables': {
+        'mapfile': 'smime.def'
+      }
+    }
+  ],
+  'conditions': [
+    [ 'moz_fold_libs==1', {
+      'targets': [
+        {
+          'target_name': 'smime3_static',
+          'type': 'static_library',
+          'dependencies': [
+            'smime3_deps',
+          ],
+        }
+      ],
+    }],
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/softoken/exports.gyp
@@ -0,0 +1,38 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_softoken_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'lowkeyi.h',
+            'lowkeyti.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'lgglue.h',
+            'pkcs11ni.h',
+            'sdb.h',
+            'sftkdbt.h',
+            'softkver.h',
+            'softoken.h',
+            'softoknt.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/softoken/legacydb/legacydb.gyp
@@ -0,0 +1,66 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nssdbm',
+      'type': 'static_library',
+      'sources': [
+        'dbmshim.c',
+        'keydb.c',
+        'lgattr.c',
+        'lgcreate.c',
+        'lgdestroy.c',
+        'lgfind.c',
+        'lgfips.c',
+        'lginit.c',
+        'lgutil.c',
+        'lowcert.c',
+        'lowkey.c',
+        'pcertdb.c',
+        'pk11db.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:dbm_exports',
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/freebl/freebl.gyp:freebl',
+        '<(DEPTH)/lib/dbm/src/src.gyp:dbm'
+      ]
+    },
+    {
+      'target_name': 'nssdbm3',
+      'type': 'shared_library',
+      'dependencies': [
+        'nssdbm'
+      ],
+      'conditions': [
+        [ 'moz_fold_libs==0', {
+          'dependencies': [
+            '<(DEPTH)/lib/util/util.gyp:nssutil3',
+          ],
+        }, {
+          'libraries': [
+            '<(moz_folded_library_name)',
+          ],
+        }],
+      ],
+      'variables': {
+        'mapfile': 'nssdbm.def'
+      }
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'SHLIB_SUFFIX=\"<(dll_suffix)\"',
+      'SHLIB_PREFIX=\"<(dll_prefix)\"',
+      'LG_LIB_NAME=\"libnssdbm3.so\"'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/softoken/softoken.gyp
@@ -0,0 +1,71 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'softokn',
+      'type': 'static_library',
+      'sources': [
+        'fipsaudt.c',
+        'fipstest.c',
+        'fipstokn.c',
+        'jpakesftk.c',
+        'lgglue.c',
+        'lowkey.c',
+        'lowpbe.c',
+        'padbuf.c',
+        'pkcs11.c',
+        'pkcs11c.c',
+        'pkcs11u.c',
+        'sdb.c',
+        'sftkdb.c',
+        'sftkhmac.c',
+        'sftkpars.c',
+        'sftkpwd.c',
+        'softkver.c',
+        'tlsprf.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/sqlite/sqlite.gyp:sqlite3',
+        '<(DEPTH)/lib/freebl/freebl.gyp:freebl',
+      ]
+    },
+    {
+      'target_name': 'softokn3',
+      'type': 'shared_library',
+      'dependencies': [
+        'softokn',
+      ],
+      'conditions': [
+        [ 'moz_fold_libs==0', {
+          'dependencies': [
+            '<(DEPTH)/lib/util/util.gyp:nssutil3',
+          ],
+        }, {
+          'libraries': [
+            '<(moz_folded_library_name)',
+          ],
+        }],
+      ],
+      'variables': {
+        'mapfile': 'softokn.def'
+      }
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'SHLIB_SUFFIX=\"<(dll_suffix)\"',
+      'SHLIB_PREFIX=\"<(dll_prefix)\"',
+      'SOFTOKEN_LIB_NAME=\"libsoftokn3.so\"',
+      'SHLIB_VERSION=\"3\"'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/sqlite/exports.gyp
@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_sqlite_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'sqlite3.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/sqlite/sqlite.gyp
@@ -0,0 +1,50 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'conditions': [
+    ['use_system_sqlite==1', {
+      'targets': [{
+        'target_name': 'sqlite3',
+        'type': 'none',
+        'link_settings': {
+          'libraries': ['<(sqlite_libs)'],
+        },
+      }],
+    }, {
+      'targets': [
+        {
+          'target_name': 'sqlite',
+          'type': 'static_library',
+          'sources': [
+            'sqlite3.c'
+          ],
+          'dependencies': [
+            '<(DEPTH)/exports.gyp:nss_exports'
+          ]
+        },
+        {
+          'target_name': 'sqlite3',
+          'type': 'shared_library',
+          'dependencies': [
+            'sqlite'
+          ],
+          'variables': {
+            'mapfile': 'sqlite.def'
+          }
+        }
+      ],
+      'target_defaults': {
+        'defines': [
+          'SQLITE_THREADSAFE=1'
+        ]
+      },
+      'variables': {
+        'module': 'nss'
+      }
+    }]
+  ],
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/ssl/exports.gyp
@@ -0,0 +1,29 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_ssl_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'preenc.h',
+            'ssl.h',
+            'sslerr.h',
+            'sslproto.h',
+            'sslt.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/ssl/ssl.gyp
@@ -0,0 +1,91 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'ssl',
+      'type': 'static_library',
+      'sources': [
+        'authcert.c',
+        'cmpcert.c',
+        'dtlscon.c',
+        'prelib.c',
+        'ssl3con.c',
+        'ssl3ecc.c',
+        'ssl3ext.c',
+        'ssl3gthr.c',
+        'sslauth.c',
+        'sslcert.c',
+        'sslcon.c',
+        'ssldef.c',
+        'sslenum.c',
+        'sslerr.c',
+        'sslerrstrs.c',
+        'sslgrp.c',
+        'sslinfo.c',
+        'sslinit.c',
+        'sslmutex.c',
+        'sslnonce.c',
+        'sslreveal.c',
+        'sslsecur.c',
+        'sslsnce.c',
+        'sslsock.c',
+        'ssltrace.c',
+        'sslver.c',
+        'tls13con.c',
+        'tls13hkdf.c',
+      ],
+      'conditions': [
+        [ 'OS=="win"', {
+          'sources': [
+            'win32err.c',
+          ],
+          'defines': [
+            'IN_LIBSSL',
+          ],
+        }, {
+          # Not Windows.
+          'sources': [
+            'unix_err.c'
+          ],
+        }],
+        [ 'ssl_enable_zlib==1', {
+          'dependencies': [
+            '<(DEPTH)/lib/zlib/zlib.gyp:nss_zlib'
+          ],
+          'defines': [
+            'NSS_SSL_ENABLE_ZLIB',
+          ],
+        }],
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/freebl/freebl.gyp:freebl',
+      ],
+    },
+    {
+      'target_name': 'ssl3',
+      'type': 'shared_library',
+      'dependencies': [
+        'ssl',
+        '<(DEPTH)/lib/nss/nss.gyp:nss3',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3',
+      ],
+      'variables': {
+        'mapfile': 'ssl.def'
+      }
+    }
+  ],
+  'target_defaults': {
+    'defines': [
+      'NSS_ALLOW_SSLKEYLOGFILE=1'
+    ]
+  },
+  'variables': {
+    'module': 'nss'
+  }
+}
--- a/security/nss/lib/ssl/sslimpl.h
+++ b/security/nss/lib/ssl/sslimpl.h
@@ -24,17 +24,16 @@
 #include "nssilock.h"
 #include "pkcs11t.h"
 #if defined(XP_UNIX) || defined(XP_BEOS)
 #include "unistd.h"
 #endif
 #include "nssrwlk.h"
 #include "prthread.h"
 #include "prclist.h"
-#include "private/pprthred.h"
 
 #include "sslt.h" /* for some formerly private types, now public */
 
 /* to make some of these old enums public without namespace pollution,
 ** it was necessary to prepend ssl_ to the names.
 ** These #defines preserve compatibility with the old code here in libssl.
 */
 typedef SSLMACAlgorithm SSL3MACAlgorithm;
@@ -94,16 +93,19 @@ extern int Debug;
 #ifdef DEBUG
 #define SSL_DBG(b) \
     if (ssl_debug) \
     ssl_Trace b
 #else
 #define SSL_DBG(b)
 #endif
 
+#include "private/pprthred.h" /* for PR_InMonitor() */
+#define ssl_InMonitor(m) PZ_InMonitor(m)
+
 #define LSB(x) ((unsigned char)((x)&0xff))
 #define MSB(x) ((unsigned char)(((unsigned)(x)) >> 8))
 
 /************************************************************************/
 
 typedef enum { SSLAppOpRead = 0,
                SSLAppOpWrite,
                SSLAppOpRDWR,
@@ -111,24 +113,27 @@ typedef enum { SSLAppOpRead = 0,
                SSLAppOpHeader
 } SSLAppOperation;
 
 #define SSL3_SESSIONID_BYTES 32
 
 #define SSL_MIN_CHALLENGE_BYTES 16
 #define SSL_MAX_CHALLENGE_BYTES 32
 
+#define SSL3_RSA_PMS_LENGTH 48
 #define SSL3_MASTER_SECRET_LENGTH 48
 
 /* number of wrap mechanisms potentially used to wrap master secrets. */
 #define SSL_NUM_WRAP_MECHS 16
 
 /* This makes the cert cache entry exactly 4k. */
 #define SSL_MAX_CACHED_CERT_LEN 4060
 
+#define NUM_MIXERS 9
+
 #ifndef BPB
 #define BPB 8 /* Bits Per Byte */
 #endif
 
 /* The default value from RFC 4347 is 1s, which is too slow. */
 #define DTLS_RETRANSMIT_INITIAL_MS 50
 /* The maximum time to wait between retransmissions. */
 #define DTLS_RETRANSMIT_MAX_MS 10000
@@ -331,16 +336,17 @@ typedef struct sslOptionsStr {
 } sslOptions;
 
 typedef enum { sslHandshakingUndetermined = 0,
                sslHandshakingAsClient,
                sslHandshakingAsServer
 } sslHandshakingType;
 
 #define SSL_LOCK_RANK_SPEC 255
+#define SSL_LOCK_RANK_GLOBAL NSS_RWLOCK_RANK_NONE
 
 /* These are the valid values for shutdownHow.
 ** These values are each 1 greater than the NSPR values, and the code
 ** depends on that relation to efficiently convert PR_SHUTDOWN values
 ** into ssl_SHUTDOWN values.  These values use one bit for read, and
 ** another bit for write, and can be used as bitmasks.
 */
 #define ssl_SHUTDOWN_NONE 0 /* NOT shutdown at all */
@@ -401,17 +407,19 @@ struct sslGatherStr {
 
     /* the start of the buffered DTLS record in dtlsPacket */
     unsigned int dtlsPacketOffset;
 };
 
 /* sslGather.state */
 #define GS_INIT 0
 #define GS_HEADER 1
-#define GS_DATA 2
+#define GS_MAC 2
+#define GS_DATA 3
+#define GS_PAD 4
 
 /*
 ** ssl3State and CipherSpec structs
 */
 
 /* The SSL bulk cipher definition */
 typedef enum {
     cipher_null,
@@ -436,32 +444,41 @@ typedef enum { type_stream,
 
 #define MAX_IV_LENGTH 24
 
 typedef PRUint64 sslSequenceNumber;
 typedef PRUint16 DTLSEpoch;
 
 typedef void (*DTLSTimerCb)(sslSocket *);
 
+/* 400 is large enough for MD5, SHA-1, and SHA-256.
+ * For SHA-384 support, increase it to 712. */
+#define MAX_MAC_CONTEXT_BYTES 712
+#define MAX_MAC_CONTEXT_LLONGS (MAX_MAC_CONTEXT_BYTES / 8)
+
+#define MAX_CIPHER_CONTEXT_BYTES 2080
+#define MAX_CIPHER_CONTEXT_LLONGS (MAX_CIPHER_CONTEXT_BYTES / 8)
+
 typedef struct {
     SSL3Opaque wrapped_master_secret[48];
     PRUint16 wrapped_master_secret_len;
     PRUint8 msIsWrapped;
     PRUint8 resumable;
     PRUint8 extendedMasterSecretUsed;
 } ssl3SidKeys; /* 52 bytes */
 
 typedef struct {
     PK11SymKey *write_key;
     PK11SymKey *write_mac_key;
     PK11Context *write_mac_context;
     SECItem write_key_item;
     SECItem write_iv_item;
     SECItem write_mac_key_item;
     SSL3Opaque write_iv[MAX_IV_LENGTH];
+    PRUint64 cipher_context[MAX_CIPHER_CONTEXT_LLONGS];
 } ssl3KeyMaterial;
 
 typedef SECStatus (*SSLCipher)(void *context,
                                unsigned char *out,
                                int *outlen,
                                int maxout,
                                const unsigned char *in,
                                int inlen);
@@ -523,16 +540,18 @@ typedef struct {
     void *decompressContext;
     PK11SymKey *master_secret;
     sslSequenceNumber write_seq_num;
     sslSequenceNumber read_seq_num;
     SSL3ProtocolVersion version;
     ssl3KeyMaterial client;
     ssl3KeyMaterial server;
     SECItem msItem;
+    unsigned char key_block[NUM_MIXERS * HASH_LENGTH_MAX];
+    unsigned char raw_master_secret[56];
     DTLSEpoch epoch;
     DTLSRecvdRecords recvdRecords;
 
     PRUint8 refCt;
     const char *phase;
 } ssl3CipherSpec;
 
 typedef enum { never_cached,
--- a/security/nss/lib/ssl/tls13con.c
+++ b/security/nss/lib/ssl/tls13con.c
@@ -180,17 +180,17 @@ tls13_HandshakeState(SSL3WaitState st)
     return "unknown";
 }
 #endif
 
 #define TLS13_WAIT_STATE_MASK 0x80
 
 #define TLS13_BASE_WAIT_STATE(ws) (ws & ~TLS13_WAIT_STATE_MASK)
 /* We don't mask idle_handshake because other parts of the code use it*/
-#define TLS13_WAIT_STATE(ws) (((ws == idle_handshake) || (ws == wait_server_hello)) ? ws : ws | TLS13_WAIT_STATE_MASK)
+#define TLS13_WAIT_STATE(ws) (ws == idle_handshake ? ws : ws | TLS13_WAIT_STATE_MASK)
 #define TLS13_CHECK_HS_STATE(ss, err, ...)                          \
     tls13_CheckHsState(ss, err, #err, __func__, __FILE__, __LINE__, \
                        __VA_ARGS__,                                 \
                        wait_invalid)
 void
 tls13_SetHsState(sslSocket *ss, SSL3WaitState ws,
                  const char *func, const char *file, int line)
 {
@@ -210,17 +210,17 @@ tls13_SetHsState(sslSocket *ss, SSL3Wait
 }
 
 static PRBool
 tls13_InHsStateV(sslSocket *ss, va_list ap)
 {
     SSL3WaitState ws;
 
     while ((ws = va_arg(ap, SSL3WaitState)) != wait_invalid) {
-        if (TLS13_WAIT_STATE(ws) == ss->ssl3.hs.ws) {
+        if (ws == TLS13_BASE_WAIT_STATE(ss->ssl3.hs.ws)) {
             return PR_TRUE;
         }
     }
     return PR_FALSE;
 }
 
 PRBool
 tls13_InHsState(sslSocket *ss, ...)
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/sysinit/sysinit.gyp
@@ -0,0 +1,31 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nsssysinit_static',
+      'type': 'static_library',
+      'sources': [
+        'nsssysinit.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/util/util.gyp:nssutil3'
+      ]
+    },
+    {
+      'target_name': 'nsssysinit',
+      'type': 'shared_library',
+      'dependencies': [
+        'nsssysinit_static'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/util/exports.gyp
@@ -0,0 +1,67 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_util_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'base64.h',
+            'ciferfam.h',
+            'eccutil.h',
+            'hasht.h',
+            'nssb64.h',
+            'nssb64t.h',
+            'nssilckt.h',
+            'nssilock.h',
+            'nsslocks.h',
+            'nssrwlk.h',
+            'nssrwlkt.h',
+            'nssutil.h',
+            'pkcs11.h',
+            'pkcs11f.h',
+            'pkcs11n.h',
+            'pkcs11p.h',
+            'pkcs11t.h',
+            'pkcs11u.h',
+            'pkcs1sig.h',
+            'portreg.h',
+            'secasn1.h',
+            'secasn1t.h',
+            'seccomon.h',
+            'secder.h',
+            'secdert.h',
+            'secdig.h',
+            'secdigt.h',
+            'secerr.h',
+            'secitem.h',
+            'secoid.h',
+            'secoidt.h',
+            'secport.h',
+            'utilmodt.h',
+            'utilpars.h',
+            'utilparst.h',
+            'utilrename.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/public'
+        },
+        {
+          'files': [
+            'templates.c',
+            'verref.h'
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/util/util.gyp
@@ -0,0 +1,59 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nssutil',
+      'type': 'static_library',
+      'sources': [
+        'derdec.c',
+        'derenc.c',
+        'dersubr.c',
+        'dertime.c',
+        'errstrs.c',
+        'nssb64d.c',
+        'nssb64e.c',
+        'nssilock.c',
+        'nssrwlk.c',
+        'oidstring.c',
+        'pkcs1sig.c',
+        'portreg.c',
+        'quickder.c',
+        'secalgid.c',
+        'secasn1d.c',
+        'secasn1e.c',
+        'secasn1u.c',
+        'secdig.c',
+        'secitem.c',
+        'secload.c',
+        'secoid.c',
+        'secport.c',
+        'sectime.c',
+        'templates.c',
+        'utf8.c',
+        'utilmod.c',
+        'utilpars.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    },
+    {
+      'target_name': 'nssutil3',
+      'type': 'shared_library',
+      'dependencies': [
+        'nssutil'
+      ],
+      'variables': {
+        'mapfile': 'nssutil.def'
+      }
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/zlib/exports.gyp
@@ -0,0 +1,33 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'variables': {
+    'module': 'nss',
+  },
+  'conditions': [
+    ['use_system_zlib==1', {
+      'targets': [{
+        'target_name': 'lib_zlib_exports',
+        'type': 'none',
+      }],
+    }, {
+      'targets': [{
+        'target_name': 'lib_zlib_exports',
+        'type': 'none',
+        'copies': [
+          {
+          'files': [
+            'zlib.h',
+            'zconf.h',
+          ],
+          'destination': '<(PRODUCT_DIR)/dist/<(module)/private'
+          }
+      ]
+    }],
+    }],
+  ],
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/lib/zlib/zlib.gyp
@@ -0,0 +1,49 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+ 'includes': [
+    "../../coreconf/config.gypi"
+  ],
+  'variables': {
+    'module': 'nss',
+  },
+  'conditions': [
+    ['use_system_zlib==1', {
+      'targets': [{
+        'target_name': 'nss_zlib',
+        'type': 'none',
+        'link_settings': {
+          'libraries': ['<@(zlib_libs)'],
+        },
+      }],
+    }, {
+      'targets': [{
+        'target_name': 'nss_zlib',
+        'type': 'static_library',
+        'sources': [
+          'adler32.c',
+          'compress.c',
+          'crc32.c',
+          'deflate.c',
+          'gzclose.c',
+          'gzlib.c',
+          'gzread.c',
+          'gzwrite.c',
+          'infback.c',
+          'inffast.c',
+          'inflate.c',
+          'inftrees.c',
+          'trees.c',
+          'uncompr.c',
+          'zutil.c',
+        ],
+        'defines': [
+          # Define verbose as -1 to turn off all zlib trace messages in
+          # debug builds.
+          'verbose=-1',
+        ],
+      }],
+    }]
+  ],
+}
new file mode 100644
--- /dev/null
+++ b/security/nss/nss.gyp
@@ -0,0 +1,201 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    'coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nss_libs',
+      'type': 'none',
+      'dependencies': [
+        'lib/ckfw/builtins/builtins.gyp:nssckbi',
+        'lib/freebl/freebl.gyp:freebl3',
+        'lib/softoken/softoken.gyp:softokn3',
+      ],
+      'conditions': [
+        [ 'moz_fold_libs==0', {
+          'dependencies': [
+            'lib/nss/nss.gyp:nss3',
+            'lib/smime/smime.gyp:smime3',
+            'lib/sqlite/sqlite.gyp:sqlite3',
+            'lib/ssl/ssl.gyp:ssl3',
+            'lib/util/util.gyp:nssutil3',
+          ],
+        }],
+        [ 'OS=="linux"', {
+          'dependencies': [
+            'lib/freebl/freebl.gyp:freeblpriv3',
+            'lib/sysinit/sysinit.gyp:nsssysinit',
+          ],
+        }],
+        [ 'disable_dbm==0', {
+          'dependencies': [
+            'lib/softoken/legacydb/legacydb.gyp:nssdbm3',
+          ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'nss_static_libs',
+      'type': 'none',
+      'dependencies': [
+        'cmd/lib/lib.gyp:sectool',
+        'lib/base/base.gyp:nssb',
+        'lib/certdb/certdb.gyp:certdb',
+        'lib/certhigh/certhigh.gyp:certhi',
+        'lib/ckfw/ckfw.gyp:nssckfw',
+        'lib/crmf/crmf.gyp:crmf',
+        'lib/cryptohi/cryptohi.gyp:cryptohi',
+        'lib/dev/dev.gyp:nssdev',
+        'lib/freebl/freebl.gyp:freebl',
+        'lib/jar/jar.gyp:jar',
+        'lib/nss/nss.gyp:nss_static',
+        'lib/pk11wrap/pk11wrap.gyp:pk11wrap',
+        'lib/pkcs12/pkcs12.gyp:pkcs12',
+        'lib/pkcs7/pkcs7.gyp:pkcs7',
+        'lib/pki/pki.gyp:nsspki',
+        'lib/smime/smime.gyp:smime',
+        'lib/softoken/softoken.gyp:softokn',
+        'lib/ssl/ssl.gyp:ssl',
+        'lib/util/util.gyp:nssutil'
+      ],
+      'conditions': [
+        [ 'OS=="linux"', {
+          'dependencies': [
+            'lib/sysinit/sysinit.gyp:nsssysinit_static',
+          ],
+        }],
+        [ 'disable_dbm==0', {
+          'dependencies': [
+            'lib/dbm/src/src.gyp:dbm',
+            'lib/softoken/legacydb/legacydb.gyp:nssdbm',
+          ],
+        }],
+        [ 'disable_libpkix==0', {
+          'dependencies': [
+            'lib/libpkix/pkix/certsel/certsel.gyp:pkixcertsel',
+            'lib/libpkix/pkix/checker/checker.gyp:pkixchecker',
+            'lib/libpkix/pkix/crlsel/crlsel.gyp:pkixcrlsel',
+            'lib/libpkix/pkix/params/params.gyp:pkixparams',
+            'lib/libpkix/pkix/results/results.gyp:pkixresults',
+            'lib/libpkix/pkix/store/store.gyp:pkixstore',
+            'lib/libpkix/pkix/top/top.gyp:pkixtop',
+            'lib/libpkix/pkix/util/util.gyp:pkixutil',
+            'lib/libpkix/pkix_pl_nss/module/module.gyp:pkixmodule',
+            'lib/libpkix/pkix_pl_nss/pki/pki.gyp:pkixpki',
+            'lib/libpkix/pkix_pl_nss/system/system.gyp:pkixsystem',
+          ],
+        }],
+        [ 'use_system_sqlite==0', {
+          'dependencies': [
+            'lib/sqlite/sqlite.gyp:sqlite',
+          ],
+        }],
+        [ 'moz_fold_libs==1', {
+          'dependencies': [
+            'lib/nss/nss.gyp:nss3_static',
+            'lib/smime/smime.gyp:smime3_static',
+          ],
+        }],
+      ],
+    },
+    {
+      'target_name': 'nss_cmds',
+      'type': 'none',
+      'dependencies': [
+        'cmd/certutil/certutil.gyp:certutil',
+        'cmd/modutil/modutil.gyp:modutil',
+        'cmd/pk12util/pk12util.gyp:pk12util',
+        'cmd/shlibsign/shlibsign.gyp:shlibsign',
+      ],
+      'conditions': [
+        [ 'mozilla_client==0', {
+          'dependencies': [
+            'cmd/crlutil/crlutil.gyp:crlutil',
+            'cmd/pwdecrypt/pwdecrypt.gyp:pwdecrypt',
+            'cmd/signtool/signtool.gyp:signtool',
+            'cmd/signver/signver.gyp:signver',
+            'cmd/smimetools/smimetools.gyp:cmsutil',
+            'cmd/ssltap/ssltap.gyp:ssltap',
+            'cmd/symkeyutil/symkeyutil.gyp:symkeyutil',
+          ],
+        }],
+      ],
+    },
+  ],
+  'conditions': [
+    [ 'disable_tests==0', {
+      'targets': [
+        {
+          'target_name': 'nss_tests',
+          'type': 'none',
+          'dependencies': [
+            'cmd/addbuiltin/addbuiltin.gyp:addbuiltin',
+            'cmd/atob/atob.gyp:atob',
+            'cmd/bltest/bltest.gyp:bltest',
+            'cmd/btoa/btoa.gyp:btoa',
+            'cmd/certcgi/certcgi.gyp:certcgi',
+            'cmd/chktest/chktest.gyp:chktest',
+            'cmd/crmftest/crmftest.gyp:crmftest',
+            'cmd/dbtest/dbtest.gyp:dbtest',
+            'cmd/derdump/derdump.gyp:derdump',
+            'cmd/digest/digest.gyp:digest',
+            'cmd/ecperf/ecperf.gyp:ecperf',
+            'cmd/ectest/ectest.gyp:ectest',
+            'cmd/fipstest/fipstest.gyp:fipstest',
+            'cmd/httpserv/httpserv.gyp:httpserv',
+            'cmd/listsuites/listsuites.gyp:listsuites',
+            'cmd/makepqg/makepqg.gyp:makepqg',
+            'cmd/multinit/multinit.gyp:multinit',
+            'cmd/ocspclnt/ocspclnt.gyp:ocspclnt',
+            'cmd/ocspresp/ocspresp.gyp:ocspresp',
+            'cmd/oidcalc/oidcalc.gyp:oidcalc',
+            'cmd/p7content/p7content.gyp:p7content',
+            'cmd/p7env/p7env.gyp:p7env',
+            'cmd/p7sign/p7sign.gyp:p7sign',
+            'cmd/p7verify/p7verify.gyp:p7verify',
+            'cmd/pk11gcmtest/pk11gcmtest.gyp:pk11gcmtest',
+            'cmd/pk11mode/pk11mode.gyp:pk11mode',
+            'cmd/pk1sign/pk1sign.gyp:pk1sign',
+            'cmd/pp/pp.gyp:pp',
+            'cmd/rsaperf/rsaperf.gyp:rsaperf',
+            'cmd/sdrtest/sdrtest.gyp:sdrtest',
+            'cmd/selfserv/selfserv.gyp:selfserv',
+            'cmd/shlibsign/mangle/mangle.gyp:mangle',
+            'cmd/strsclnt/strsclnt.gyp:strsclnt',
+            'cmd/tests/tests.gyp:baddbdir',
+            'cmd/tests/tests.gyp:conflict',
+            'cmd/tests/tests.gyp:dertimetest',
+            'cmd/tests/tests.gyp:encodeinttest',
+            'cmd/tests/tests.gyp:nonspr10',
+            'cmd/tests/tests.gyp:remtest',
+            'cmd/tests/tests.gyp:secmodtest',
+            'cmd/tstclnt/tstclnt.gyp:tstclnt',
+            'cmd/vfychain/vfychain.gyp:vfychain',
+            'cmd/vfyserv/vfyserv.gyp:vfyserv',
+            'external_tests/google_test/google_test.gyp:gtest1',
+            'external_tests/common/common.gyp:gtests',
+            'external_tests/der_gtest/der_gtest.gyp:der_gtest',
+            'external_tests/pk11_gtest/pk11_gtest.gyp:pk11_gtest',
+            'external_tests/ssl_gtest/ssl_gtest.gyp:ssl_gtest',
+            'external_tests/util_gtest/util_gtest.gyp:util_gtest'
+          ],
+          'conditions': [
+            [ 'OS=="linux"', {
+              'dependencies': [
+                'cmd/lowhashtest/lowhashtest.gyp:lowhashtest',
+              ],
+            }],
+            [ 'disable_libpkix==0', {
+              'dependencies': [
+                'cmd/pkix-errcodes/pkix-errcodes.gyp:pkix-errcodes',
+              ],
+            }],
+          ],
+        },
+      ],
+    }],
+  ],
+}
--- a/security/nss/tests/cipher/cipher.txt
+++ b/security/nss/tests/cipher/cipher.txt
@@ -40,17 +40,16 @@
 	0	rc4_-E		RC4_Encrypt
 	0	rc4_-D		RC4_Decrypt
 	0	rsa_-E		RSA_Encrypt
 	0	rsa_-D		RSA_Decrypt
 	0	rsa_oaep_-E	RSA_EncryptOAEP
 	0	rsa_oaep_-D	RSA_DecryptOAEP
 	0	rsa_pss_-S	RSA_SignPSS
 	0	rsa_pss_-V	RSA_CheckSignPSS
-	0	rsa_-K		RSA_Populate
 	0	dsa_-S		DSA_Sign
 	0	dsa_-V		DSA_Verify
 	0	md2_-H		MD2_Hash
 	0	md5_-H		MD5_Hash
 	0	sha1_-H		SHA1_Hash
 	0	sha224_-H	SHA224_Hash
 	0	sha256_-H	SHA256_Hash
 	0	sha384_-H	SHA384_Hash
--- a/security/nss/tests/ssl/ssl.sh
+++ b/security/nss/tests/ssl/ssl.sh
@@ -209,20 +209,23 @@ kill_selfserv()
 start_selfserv()
 {
   if [ -n "$testname" ] ; then
       echo "$SCRIPTNAME: $testname ----"
   fi
   sparam=`echo $sparam | sed -e 's;_; ;g'`
   if [ -z "$NSS_DISABLE_ECC" ] && \
      [ -z "$NO_ECC_CERTS" -o "$NO_ECC_CERTS" != "1"  ] ; then
-      ECC_OPTIONS="-e ${HOSTADDR}-ecmixed -e ${HOSTADDR}-ec"
+      ECC_OPTIONS="-e ${HOSTADDR}-ec"
   else
       ECC_OPTIONS=""
   fi
+  if [ "$1" = "mixed" ]; then
+      ECC_OPTIONS="-e ${HOSTADDR}-ecmixed"
+  fi
   echo "selfserv starting at `date`"
   echo "selfserv -D -p ${PORT} -d ${P_R_SERVERDIR} -n ${HOSTADDR} ${SERVER_OPTIONS} \\"
   echo "         ${ECC_OPTIONS} -S ${HOSTADDR}-dsa -w nss ${sparam} -i ${R_SERVERPID}\\"
   echo "         -V ssl3:tls1.2 $verbose -H 1 &"
   if [ ${fileout} -eq 1 ]; then
       ${PROFTOOL} ${BINDIR}/selfserv -D -p ${PORT} -d ${P_R_SERVERDIR} -n ${HOSTADDR} ${SERVER_OPTIONS} \
                ${ECC_OPTIONS} -S ${HOSTADDR}-dsa -w nss ${sparam} -i ${R_SERVERPID} -V ssl3:tls1.2 $verbose -H 1 \
                > ${SERVEROUTFILE} 2>&1 &
@@ -264,16 +267,17 @@ start_selfserv()
 ssl_cov()
 {
   #verbose="-v"
   html_head "SSL Cipher Coverage $NORM_EXT - server $SERVER_MODE/client $CLIENT_MODE $ECC_STRING"
 
   testname=""
   sparam="$CIPHER_SUITES"
 
+  mixed=0
   start_selfserv # Launch the server
 
   VMIN="ssl3"
   VMAX="tls1.1"
 
   exec < ${SSLCOV}
   while read ectype testmax param testname
   do
@@ -290,16 +294,44 @@ ssl_cov()
           fi
           if [ "$testmax" = "TLS11" ]; then
               VMAX="tls1.1"
           fi
           if [ "$testmax" = "TLS12" ]; then
               VMAX="tls1.2"
           fi
 
+# These five tests need an EC cert signed with RSA
+# This requires a different certificate loaded in selfserv
+# due to a (current) NSS limitation of only loaded one cert
+# per type so the default selfserv setup will not work.
+#:C00B TLS ECDH RSA WITH NULL SHA
+#:C00C TLS ECDH RSA WITH RC4 128 SHA
+#:C00D TLS ECDH RSA WITH 3DES EDE CBC SHA
+#:C00E TLS ECDH RSA WITH AES 128 CBC SHA
+#:C00F TLS ECDH RSA WITH AES 256 CBC SHA
+
+          if [ $mixed -eq 0 ]; then
+            if [ "${param}" = ":C00B" -o "${param}" = ":C00C" -o "${param}" = ":C00D" -o "${param}" = ":C00E" -o "${param}" = ":C00F" ]; then
+              kill_selfserv
+              start_selfserv mixed
+              mixed=1
+            else
+              is_selfserv_alive
+            fi
+          else
+            if [ "${param}" = ":C00B" -o "${param}" = ":C00C" -o "${param}" = ":C00D" -o "${param}" = ":C00E" -o "${param}" = ":C00F" ]; then
+              is_selfserv_alive
+            else
+              kill_selfserv
+              start_selfserv
+              mixed=0
+            fi
+          fi
+
           echo "tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} -V ${VMIN}:${VMAX} ${CLIENT_OPTIONS} \\"
           echo "        -f -d ${P_R_CLIENTDIR} $verbose -w nss < ${REQUEST_FILE}"
 
           rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
           ${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} -V ${VMIN}:${VMAX} ${CLIENT_OPTIONS} -f \
                   -d ${P_R_CLIENTDIR} $verbose -w nss < ${REQUEST_FILE} \
                   >${TMP}/$HOST.tmp.$$  2>&1
           ret=$?
@@ -557,17 +589,25 @@ ssl_stress()
           echo "$SCRIPTNAME: skipping  $testname (non-FIPS only)"
       elif [ "`echo $ectype | cut -b 1`" != "#" ]; then
           cparam=`echo $cparam | sed -e 's;_; ;g' -e "s/TestUser/$USER_NICKNAME/g" `
           if [ "$ectype" = "SNI" ]; then
               cparam=`echo $cparam | sed -e "s/Host/$HOST/g" -e "s/Dom/$DOMSUF/g" `
               sparam=`echo $sparam | sed -e "s/Host/$HOST/g" -e "s/Dom/$DOMSUF/g" `
           fi
 
-          start_selfserv
+# These tests need the mixed cert
+# Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse)
+# Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse, client auth)
+          p=`echo "$sparam" | sed -e "s/\(.*\)\(-c_:C0..\)\(.*\)/\2/"`;
+          if [ "$p" = "-c_:C00E" ]; then
+              start_selfserv mixed
+          else
+              start_selfserv
+          fi
 
           if [ "`uname -n`" = "sjsu" ] ; then
               echo "debugging disapering selfserv... ps -ef | grep selfserv"
               ps -ef | grep selfserv
           fi
 
           echo "strsclnt -q -p ${PORT} -d ${P_R_CLIENTDIR} ${CLIENT_OPTIONS} -w nss $cparam \\"
           echo "         -V ssl3:tls1.2 $verbose ${HOSTADDR}"
@@ -682,16 +722,17 @@ ssl_policy()
 
   if [ ! -f "${P_R_CLIENTDIR}/pkcs11.txt" ] ; then
       return;
   fi
 
   echo "Saving pkcs11.txt"
   cp ${P_R_CLIENTDIR}/pkcs11.txt ${P_R_CLIENTDIR}/pkcs11.txt.sav
 
+  mixed=0
   start_selfserv # Launch the server
 
   VMIN="ssl3"
   VMAX="tls1.2"
 
   exec < ${SSLPOLICY}
   while read value ectype testmax param policy testname
   do
@@ -707,16 +748,44 @@ ssl_policy()
           fi
           if [ "$testmax" = "TLS11" ]; then
               VMAX="tls1.1"
           fi
           if [ "$testmax" = "TLS12" ]; then
               VMAX="tls1.2"
           fi
 
+# These five tests need an EC cert signed with RSA
+# This requires a different certificate loaded in selfserv
+# due to a (current) NSS limitation of only loaded one cert
+# per type so the default selfserv setup will not work.
+#:C00B TLS ECDH RSA WITH NULL SHA
+#:C00C TLS ECDH RSA WITH RC4 128 SHA
+#:C00D TLS ECDH RSA WITH 3DES EDE CBC SHA
+#:C00E TLS ECDH RSA WITH AES 128 CBC SHA
+#:C00F TLS ECDH RSA WITH AES 256 CBC SHA
+
+          if [ $mixed -eq 0 ]; then
+            if [ "${param}" = ":C00B" -o "${param}" = ":C00C" -o "${param}" = ":C00D" -o "${param}" = ":C00E" -o "${param}" = ":C00F" ]; then
+              kill_selfserv
+              start_selfserv mixed
+              mixed=1
+            else
+              is_selfserv_alive
+            fi
+          else
+            if [ "${param}" = ":C00B" -o "${param}" = ":C00C" -o "${param}" = ":C00D" -o "${param}" = ":C00E" -o "${param}" = ":C00F" ]; then
+              is_selfserv_alive
+            else
+              kill_selfserv
+              start_selfserv
+              mixed=0
+            fi
+          fi
+
           # load the policy
           policy=`echo ${policy} | sed -e 's;_; ;g'`
 
           cat  > ${P_R_CLIENTDIR}/pkcs11.txt << ++EOF++
 library=
 name=NSS Internal PKCS #11 Module
 parameters=configdir='./client' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription=''
 NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})