security/nss: update to 3.24

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.24_release_notes

security/nss/Makefile

@@ -2,7 +2,7 @@
 # $FreeBSD$
 
 PORTNAME=	nss
-PORTVERSION=	3.23
+PORTVERSION=	3.24
 #DISTVERSIONSUFFIX=	-with-ckbi-1.98
 CATEGORIES=	security
 MASTER_SITES=	MOZILLA/security/${PORTNAME}/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src

security/nss/distinfo

@@ -1,2 +1,2 @@
-SHA256 (nss-3.23.tar.gz) = 94b383e31c9671e9dfcca81084a8a813817e8f05a57f54533509b318d26e11cf
+SHA256 (nss-3.24.tar.gz) = 2f0841492f91cca473b73dec6cab9cf765a485e032d48d2e8ae7261e54c419ed
-SIZE (nss-3.23.tar.gz) = 7467001
+SIZE (nss-3.24.tar.gz) = 7307782

security/nss/files/patch-bug1250891

@@ -1,100 +0,0 @@
-diff --git a/coreconf/FreeBSD.mk b/coreconf/FreeBSD.mk
---- coreconf/FreeBSD.mk
-+++ coreconf/FreeBSD.mk
-@@ -21,7 +21,7 @@ ifeq ($(CPU_ARCH),amd64)
- CPU_ARCH		= x86_64
- endif
- 
--OS_CFLAGS		= $(DSO_CFLAGS) -ansi -Wall -Wno-switch -DFREEBSD -DHAVE_STRERROR -DHAVE_BSD_FLOCK
-+OS_CFLAGS		= $(DSO_CFLAGS) -Wall -Wno-switch -DFREEBSD -DHAVE_STRERROR -DHAVE_BSD_FLOCK
- 
- DSO_CFLAGS		= -fPIC
- DSO_LDOPTS		= -shared -Wl,-soname -Wl,$(notdir $@)
-diff --git a/coreconf/NetBSD.mk b/coreconf/NetBSD.mk
---- coreconf/NetBSD.mk
-+++ coreconf/NetBSD.mk
-@@ -26,7 +26,7 @@ else
- DLL_SUFFIX		= so.1.0
- endif
- 
--OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -ansi -Wall -Wno-switch -pipe -DNETBSD -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
-+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DNETBSD -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
- 
- OS_LIBS			= -lcompat
- 
-diff --git a/coreconf/OpenBSD.mk b/coreconf/OpenBSD.mk
---- coreconf/OpenBSD.mk
-+++ coreconf/OpenBSD.mk
-@@ -26,7 +26,7 @@ endif
- 
- DLL_SUFFIX		= so.1.0
- 
--OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -ansi -Wall -Wno-switch -pipe -DOPENBSD
-+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DOPENBSD
- 
- OS_LIBS			= 
- 
-diff --git a/coreconf/Werror.mk b/coreconf/Werror.mk
---- coreconf/Werror.mk
-+++ coreconf/Werror.mk
-@@ -5,6 +5,15 @@
- 
- # This sets WARNING_CFLAGS for gcc-like compilers.
- 
-+ifndef CC_IS_CLANG
-+  CC_IS_CLANG := $(and $(findstring clang, $(shell $(CC) --version 2>&1)), 1)
-+  # Clang claims GCC 4.2.1 compatibility, see GCC_VERSION
-+  CC_IS_GCC = 1
-+  # Export CC_IS_CLANG and CC_IS_GCC to save a shell invocation when recursing.
-+  export CC_IS_CLANG
-+  export CC_IS_GCC
-+endif
-+
- ifndef CC_IS_GCC
-   CC_IS_GCC := $(shell $(CC) -x c -E -Wall -Werror /dev/null >/dev/null 2>&1 && echo 1)
-   # Export CC_IS_GCC to save a shell invocation when recursing.
-@@ -38,7 +44,7 @@ ifndef WARNING_CFLAGS
-     disable_warning = $(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -Wno-$(1))
- 
-     WARNING_CFLAGS = -Wall
--    ifeq ($(CC_NAME),clang)
-+    ifdef CC_IS_CLANG
-       # -Qunused-arguments : clang objects to arguments that it doesn't understand
-       #    and fixing this would require rearchitecture
-       WARNING_CFLAGS += -Qunused-arguments
-@@ -62,10 +68,10 @@ ifndef WARNING_CFLAGS
-         NSS_ENABLE_WERROR = 0
-         $(warning OS_TARGET is Android, disabling -Werror)
-       else
--        ifeq ($(CC_NAME),clang)
-+        ifdef CC_IS_CLANG
-           # Clang reports its version as an older gcc, but it's OK
-           NSS_ENABLE_WERROR = 1
--        else ifeq ($(CC_NAME),gcc)
-+        else ifdef CC_IS_GCC
-           ifneq (,$(filter 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
-             NSS_ENABLE_WERROR = 1
-           endif
-diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile
---- lib/freebl/Makefile
-+++ lib/freebl/Makefile
-@@ -484,7 +484,7 @@ endif
- 
- # poly1305-donna-x64-sse2-incremental-source.c requires __int128 support
- # in GCC 4.6.0.
--ifeq ($(CC_NAME),clang)
-+ifdef CC_IS_CLANG
-     HAVE_INT128_SUPPORT = 1
- else ifeq (1,$(CC_IS_GCC))
-     ifneq (,$(filter 4.6 4.7 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
-@@ -697,8 +697,8 @@ ifdef INTEL_GCM
- # symbolic names to registers, for example,
- #     .set  Htbl, %rdi
- # So we can't use Clang's integrated assembler with intel-gcm.s.
--ifneq (,$(findstring clang,$(shell $(AS) --version)))
--$(OBJDIR)/$(PROG_PREFIX)intel-gcm$(OBJ_SUFFIX): ASFLAGS += -no-integrated-as
-+ifdef CC_IS_CLANG
-+$(OBJDIR)/$(PROG_PREFIX)intel-gcm$(OBJ_SUFFIX): CFLAGS += -no-integrated-as
- endif
- endif
- 

security/nss/files/patch-const

@@ -18,7 +18,8 @@
 +FipsMode(const char *arg)
  {
      char *internal_name;
-@@ -62,14 +62,16 @@
+@@ -25,16 +25,18 @@ FipsMode(char *arg)
+             internal_name = PR_smprintf("%s",
                                          SECMOD_GetInternalModule()->commonName);
              if (SECMOD_DeleteInternalModule(internal_name) != SECSuccess) {
 -                PR_fprintf(PR_STDERR, "%s\n", SECU_Strerror(PORT_GetError()));
@@ -37,6 +38,7 @@
 +            PR_smprintf_free(internal_name);
              PR_fprintf(PR_STDOUT, msgStrings[FIPS_ENABLED_MSG]);
          } else {
+             PR_fprintf(PR_STDERR, errStrings[FIPS_ALREADY_ON_ERR]);
 @@ -112,5 +114,5 @@
   */
  Error

security/nss/pkg-plist

@@ -47,6 +47,8 @@ include/nss/nss/key.h
 include/nss/nss/keyhi.h
 include/nss/nss/keyt.h
 include/nss/nss/keythi.h
+include/nss/nss/lowkeyi.h
+include/nss/nss/lowkeyti.h
 include/nss/nss/nss.h
 include/nss/nss/nssb64.h
 include/nss/nss/nssb64t.h
@@ -122,6 +124,8 @@ include/nss/nss/utilrename.h
 lib/nss/libcrmf.a
 lib/nss/libfreebl3.so
 lib/nss/libfreebl3.so.1
+lib/nss/libfreeblpriv3.so
+lib/nss/libfreeblpriv3.so.1
 lib/nss/libnss3.so
 lib/nss/libnss3.so.1
 lib/nss/libnssckbi.so