Fix for bug 286642 . Move utility functions to new libnssutil shared library. r=nelson

git-svn-id: svn://10.0.0.236/trunk@237631 18797224-902f-48f8-a5cc-f745e15eee43
2007-10-12 01:44:51 +00:00 · 2007-10-12 01:44:51 +00:00 · a8626f2c53
commit a8626f2c53
parent 9f8b3f0751
79 changed files with 2155 additions and 421 deletions
--- a/mozilla/security/coreconf/config.mk
+++ b/mozilla/security/coreconf/config.mk
@ -189,3 +189,9 @@ endif
 ifdef BUILD_LIBPKIX_TESTS
 DEFINES += -DBUILD_LIBPKIX_TESTS
 endif
+
+# This allows all library and tools code to use the util function
+# implementations directly from libnssutil3, rather than the wrappers
+# in libnss3 which are present for binary compatibility only
+DEFINES += -DUSE_UTIL_DIRECTLY
+
--- a/mozilla/security/nss/cmd/platlibs.mk
+++ b/mozilla/security/nss/cmd/platlibs.mk
@ -117,7 +117,7 @@ EXTRA_LIBS += \
 	$(DIST)/lib/$(LIB_PREFIX)certdb.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)softokn.$(LIB_SUFFIX) \
 	$(CRYPTOLIB) \
-	$(DIST)/lib/$(LIB_PREFIX)secutil.$(LIB_SUFFIX) \
+	$(DIST)/lib/$(LIB_PREFIX)nssutil.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)nsspki.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)nssdev.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)nssb.$(LIB_SUFFIX) \
@ -180,7 +180,7 @@ EXTRA_LIBS += \
 	$(DIST)/lib/$(LIB_PREFIX)nssdev.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)nssb.$(LIB_SUFFIX) \
 	$(CRYPTOLIB) \
-	$(DIST)/lib/$(LIB_PREFIX)secutil.$(LIB_SUFFIX) \
+	$(DIST)/lib/$(LIB_PREFIX)nssutil.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)dbm.$(LIB_SUFFIX) \
 	$(PKIXLIB) \
 	$(DIST)/lib/$(LIB_PREFIX)nss.$(LIB_SUFFIX) \
@ -215,12 +215,13 @@ ifeq ($(OS_ARCH), WINNT)
 # $(PROGRAM) has explicit dependencies on $(EXTRA_LIBS)
 EXTRA_LIBS += \
 	$(DIST)/lib/$(LIB_PREFIX)sectool.$(LIB_SUFFIX) \
+	$(DIST)/lib/$(IMPORT_LIB_PREFIX)nssutil3$(IMPORT_LIB_SUFFIX) \
 	$(DIST)/lib/$(IMPORT_LIB_PREFIX)smime3$(IMPORT_LIB_SUFFIX) \
 	$(DIST)/lib/$(IMPORT_LIB_PREFIX)ssl3$(IMPORT_LIB_SUFFIX) \
 	$(DIST)/lib/$(IMPORT_LIB_PREFIX)nss3$(IMPORT_LIB_SUFFIX) \
-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.$(LIB_SUFFIX) \
-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.$(LIB_SUFFIX) \
-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.$(LIB_SUFFIX) \
+	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4$(IMPORT_LIB_SUFFIX) \
+	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4$(IMPORT_LIB_SUFFIX) \
+	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4$(IMPORT_LIB_SUFFIX) \
 	$(NULL)

 # $(PROGRAM) has NO explicit dependencies on $(OS_LIBS)
@ -266,6 +267,7 @@ EXTRA_SHARED_LIBS += \
 	-lssl3 \
 	-lsmime3 \
 	-lnss3 \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
--- a/mozilla/security/nss/lib/certdb/cert.h
+++ b/mozilla/security/nss/lib/certdb/cert.h
@ -37,12 +37,13 @@
 /*
 * cert.h - public data structures and prototypes for the certificate library
 *
- * $Id: cert.h,v 1.61 2007-09-25 23:48:02 rrelyea%redhat.com Exp $
+ * $Id: cert.h,v 1.62 2007-10-12 01:44:40 julien.pierre.boogz%sun.com Exp $
 */

 #ifndef _CERT_H_
 #define _CERT_H_

+#include "utilrename.h"
 #include "plarena.h"
 #include "plhash.h"
 #include "prlong.h"
--- a/mozilla/security/nss/lib/certdb/certdb.c
+++ b/mozilla/security/nss/lib/certdb/certdb.c
@ -38,7 +38,7 @@
 /*
 * Certificate handling code
 *
- * $Id: certdb.c,v 1.80 2007-07-14 05:51:00 nelson%bolyard.com Exp $
+ * $Id: certdb.c,v 1.81 2007-10-12 01:44:40 julien.pierre.boogz%sun.com Exp $
 */

 #include "nssilock.h"
@ -71,6 +71,12 @@
 #include "pki.h"
 #include "pki3hack.h"

+SEC_ASN1_MKSUB(CERT_TimeChoiceTemplate)
+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate)
+SEC_ASN1_MKSUB(SEC_BitStringTemplate)
+SEC_ASN1_MKSUB(SEC_IntegerTemplate)
+SEC_ASN1_MKSUB(SEC_SkipTemplate)
+
 /*
 * Certificate database handling code
 */
@ -92,18 +98,30 @@ const SEC_ASN1Template CERT_SequenceOfCertExtensionTemplate[] = {
    { SEC_ASN1_SEQUENCE_OF, 0, CERT_CertExtensionTemplate }
 };

+const SEC_ASN1Template CERT_ValidityTemplate[] = {
+    { SEC_ASN1_SEQUENCE,
+	  0, NULL, sizeof(CERTValidity) },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+          offsetof(CERTValidity,notBefore),
+          SEC_ASN1_SUB(CERT_TimeChoiceTemplate), 0 },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+          offsetof(CERTValidity,notAfter),
+          SEC_ASN1_SUB(CERT_TimeChoiceTemplate), 0 },
+    { 0 }
+};
+
 const SEC_ASN1Template CERT_CertificateTemplate[] = {
    { SEC_ASN1_SEQUENCE,
      0, NULL, sizeof(CERTCertificate) },
    { SEC_ASN1_EXPLICIT | SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | 
-	  SEC_ASN1_CONTEXT_SPECIFIC | 0, 		/* XXX DER_DEFAULT */ 
+	  SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0, /* XXX DER_DEFAULT */ 
 	  offsetof(CERTCertificate,version),
-	  SEC_IntegerTemplate },
+	  SEC_ASN1_SUB(SEC_IntegerTemplate) },
    { SEC_ASN1_INTEGER,
 	  offsetof(CERTCertificate,serialNumber) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	  offsetof(CERTCertificate,signature),
-	  SECOID_AlgorithmIDTemplate },
+	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_SAVE, 
 	  offsetof(CERTCertificate,derIssuer) },
    { SEC_ASN1_INLINE,
@ -122,12 +140,12 @@ const SEC_ASN1Template CERT_CertificateTemplate[] = {
    { SEC_ASN1_INLINE,
 	  offsetof(CERTCertificate,subjectPublicKeyInfo),
 	  CERT_SubjectPublicKeyInfoTemplate },
-    { SEC_ASN1_OPTIONAL |  SEC_ASN1_CONTEXT_SPECIFIC | 1,
+    { SEC_ASN1_OPTIONAL |  SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1,
 	  offsetof(CERTCertificate,issuerID),
-	  SEC_BitStringTemplate },
-    { SEC_ASN1_OPTIONAL |  SEC_ASN1_CONTEXT_SPECIFIC | 2,
+	  SEC_ASN1_SUB(SEC_BitStringTemplate) },
+    { SEC_ASN1_OPTIONAL |  SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 2,
 	  offsetof(CERTCertificate,subjectID),
-	  SEC_BitStringTemplate },
+	  SEC_ASN1_SUB(SEC_BitStringTemplate) },
    { SEC_ASN1_EXPLICIT | SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | 
 	  SEC_ASN1_CONTEXT_SPECIFIC | 3,
 	  offsetof(CERTCertificate,extensions),
@ -143,9 +161,9 @@ const SEC_ASN1Template SEC_SignedCertificateTemplate[] =
 	  offsetof(CERTCertificate,signatureWrap.data) },
    { SEC_ASN1_INLINE, 
 	  0, CERT_CertificateTemplate },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	  offsetof(CERTCertificate,signatureWrap.signatureAlgorithm),
-	  SECOID_AlgorithmIDTemplate },
+	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_BIT_STRING,
 	  offsetof(CERTCertificate,signatureWrap.signature) },
    { 0 }
@ -158,8 +176,8 @@ const SEC_ASN1Template SEC_CertSubjectTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	  0, NULL, sizeof(SECItem) },
    { SEC_ASN1_EXPLICIT | SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | 
-	  SEC_ASN1_CONTEXT_SPECIFIC | 0,
-	  0, SEC_SkipTemplate },	/* version */
+	  SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
+	  0, SEC_ASN1_SUB(SEC_SkipTemplate) },	/* version */
    { SEC_ASN1_SKIP },		/* serial number */
    { SEC_ASN1_SKIP },		/* signature algorithm */
    { SEC_ASN1_SKIP },		/* issuer */
@ -176,8 +194,8 @@ const SEC_ASN1Template SEC_CertIssuerTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	  0, NULL, sizeof(SECItem) },
    { SEC_ASN1_EXPLICIT | SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | 
-	  SEC_ASN1_CONTEXT_SPECIFIC | 0,
-	  0, SEC_SkipTemplate },	/* version */
+	  SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
+	  0, SEC_ASN1_SUB(SEC_SkipTemplate) },	/* version */
    { SEC_ASN1_SKIP },		/* serial number */
    { SEC_ASN1_SKIP },		/* signature algorithm */
    { SEC_ASN1_ANY, 0, NULL },		/* issuer */
@ -191,8 +209,8 @@ const SEC_ASN1Template SEC_CertSerialNumberTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	  0, NULL, sizeof(SECItem) },
    { SEC_ASN1_EXPLICIT | SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | 
-	  SEC_ASN1_CONTEXT_SPECIFIC | 0,
-	  0, SEC_SkipTemplate },	/* version */
+	  SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
+	  0, SEC_ASN1_SUB(SEC_SkipTemplate) },	/* version */
    { SEC_ASN1_ANY, 0, NULL }, /* serial number */
    { SEC_ASN1_SKIP_REST },
    { 0 }
@ -207,8 +225,8 @@ const SEC_ASN1Template CERT_CertKeyTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	  0, NULL, sizeof(CERTCertKey) },
    { SEC_ASN1_EXPLICIT | SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | 
-	  SEC_ASN1_CONTEXT_SPECIFIC | 0,
-	  0, SEC_SkipTemplate },	/* version */ 
+	  SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
+	  0, SEC_ASN1_SUB(SEC_SkipTemplate) },	/* version */ 
    { SEC_ASN1_INTEGER,
 	  offsetof(CERTCertKey,serialNumber) },
    { SEC_ASN1_SKIP },		/* signature algorithm */
--- a/mozilla/security/nss/lib/certdb/certv3.c
+++ b/mozilla/security/nss/lib/certdb/certv3.c
@ -37,7 +37,7 @@
 /*
 * Code for dealing with X509.V3 extensions.
 *
- * $Id: certv3.c,v 1.9 2006-09-29 20:20:21 alexei.volkov.bugs%sun.com Exp $
+ * $Id: certv3.c,v 1.10 2007-10-12 01:44:40 julien.pierre.boogz%sun.com Exp $
 */

 #include "cert.h"
@ -145,15 +145,16 @@ CERT_FindCertURLExtension(CERTCertificate *cert, int tag, int catag)
 	goto loser;
    }

-    rv = SEC_QuickDERDecodeItem(arena, &urlstringitem, SEC_IA5StringTemplate, 
-			    &urlitem);
+    rv = SEC_QuickDERDecodeItem(arena, &urlstringitem,
+                                SEC_ASN1_GET(SEC_IA5StringTemplate), &urlitem);

    if ( rv != SECSuccess ) {
 	goto loser;
    }
    if ( hasbase ) {
-	rv = SEC_QuickDERDecodeItem(arena, &basestringitem, SEC_IA5StringTemplate,
-				&baseitem);
+	rv = SEC_QuickDERDecodeItem(arena, &basestringitem,
+                                    SEC_ASN1_GET(SEC_IA5StringTemplate),
+                                    &baseitem);

 	if ( rv != SECSuccess ) {
 	    goto loser;
@ -250,8 +251,8 @@ CERT_FindNSStringExtension(CERTCertificate *cert, int oidtag)
 	goto loser;
    }

-    rv = SEC_QuickDERDecodeItem(arena, &tmpItem, SEC_IA5StringTemplate, 
-			    &wrapperItem);
+    rv = SEC_QuickDERDecodeItem(arena, &tmpItem,
+                            SEC_ASN1_GET(SEC_IA5StringTemplate), &wrapperItem);

    if ( rv != SECSuccess ) {
 	goto loser;
@ -305,7 +306,7 @@ CERT_FindSubjectKeyIDExtension(CERTCertificate *cert, SECItem *retItem)
 	PLArenaPool * tmpArena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
 	if (tmpArena) {
 	    rv = SEC_QuickDERDecodeItem(tmpArena, &decodedValue, 
-	                                SEC_OctetStringTemplate, 
+	                                SEC_ASN1_GET(SEC_OctetStringTemplate), 
 					&encodedValue);
 	    if (rv == SECSuccess) {
 	        rv = SECITEM_CopyItem(NULL, retItem, &decodedValue);
--- a/mozilla/security/nss/lib/certdb/certxutl.c
+++ b/mozilla/security/nss/lib/certdb/certxutl.c
@ -305,7 +305,8 @@ CERT_EncodeAndAddBitStrExtension (void *exthandle, int idtag,
  
  PrepareBitStringForEncoding (&bitsmap, value);
  return (CERT_EncodeAndAddExtension
-	  (exthandle, idtag, &bitsmap, critical, SEC_BitStringTemplate));
+	  (exthandle, idtag, &bitsmap, critical,
+          SEC_ASN1_GET(SEC_BitStringTemplate)));
 }

 SECStatus
@ -444,8 +445,9 @@ CERT_FindBitStringExtension (CERTCertExtension **extensions, int tag,
 	goto loser;
    }

-    rv = SEC_QuickDERDecodeItem(arena, &tmpItem, SEC_BitStringTemplate, 
-			    &wrapperItem);
+    rv = SEC_QuickDERDecodeItem(arena, &tmpItem,
+                                SEC_ASN1_GET(SEC_BitStringTemplate),
+                                &wrapperItem);

    if ( rv != SECSuccess ) {
 	goto loser;
--- a/mozilla/security/nss/lib/certdb/crl.c
+++ b/mozilla/security/nss/lib/certdb/crl.c
@ -37,7 +37,7 @@
 /*
 * Moved from secpkcs7.c
 *
- * $Id: crl.c,v 1.56 2007-05-25 07:28:31 alexei.volkov.bugs%sun.com Exp $
+ * $Id: crl.c,v 1.57 2007-10-12 01:44:40 julien.pierre.boogz%sun.com Exp $
 */
 
 #include "cert.h"
@ -103,12 +103,15 @@ static const SEC_ASN1Template cert_KrlEntryTemplate[] = {
    { 0 }
 };

+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate);
+SEC_ASN1_MKSUB(CERT_TimeChoiceTemplate);
+
 static const SEC_ASN1Template cert_KrlTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	  0, NULL, sizeof(CERTCrl) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	  offsetof(CERTCrl,signatureAlg),
-	  SECOID_AlgorithmIDTemplate },
+	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_SAVE,
 	  offsetof(CERTCrl,derName) },
    { SEC_ASN1_INLINE,
@ -132,9 +135,9 @@ static const SEC_ASN1Template cert_SignedKrlTemplate[] = {
    { SEC_ASN1_INLINE,
 	  offsetof(CERTSignedCrl,crl),
 	  cert_KrlTemplate },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	  offsetof(CERTSignedCrl,signatureWrap.signatureAlgorithm),
-	  SECOID_AlgorithmIDTemplate },
+	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_BIT_STRING,
 	  offsetof(CERTSignedCrl,signatureWrap.signature) },
    { 0 }
@ -155,8 +158,9 @@ static const SEC_ASN1Template cert_CrlEntryTemplate[] = {
 	  0, NULL, sizeof(CERTCrlEntry) },
    { SEC_ASN1_INTEGER,
 	  offsetof(CERTCrlEntry,serialNumber) },
-    { SEC_ASN1_INLINE,
-	  offsetof(CERTCrlEntry,revocationDate), CERT_TimeChoiceTemplate },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+	  offsetof(CERTCrlEntry,revocationDate),
+          SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_SEQUENCE_OF,
 	  offsetof(CERTCrlEntry, extensions),
 	  SEC_CERTExtensionTemplate},
@ -167,18 +171,20 @@ const SEC_ASN1Template CERT_CrlTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	  0, NULL, sizeof(CERTCrl) },
    { SEC_ASN1_INTEGER | SEC_ASN1_OPTIONAL, offsetof (CERTCrl, version) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	  offsetof(CERTCrl,signatureAlg),
-	  SECOID_AlgorithmIDTemplate },
+	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate)},
    { SEC_ASN1_SAVE,
 	  offsetof(CERTCrl,derName) },
    { SEC_ASN1_INLINE,
 	  offsetof(CERTCrl,name),
 	  CERT_NameTemplate },
-    { SEC_ASN1_INLINE,
-	  offsetof(CERTCrl,lastUpdate), CERT_TimeChoiceTemplate },
-    { SEC_ASN1_INLINE | SEC_ASN1_OPTIONAL,
-	  offsetof(CERTCrl,nextUpdate), CERT_TimeChoiceTemplate },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+	  offsetof(CERTCrl,lastUpdate),
+          SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
+    { SEC_ASN1_INLINE | SEC_ASN1_OPTIONAL | SEC_ASN1_XTRN,
+	  offsetof(CERTCrl,nextUpdate),
+          SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_SEQUENCE_OF,
 	  offsetof(CERTCrl,entries),
 	  cert_CrlEntryTemplate },
@ -193,18 +199,20 @@ const SEC_ASN1Template CERT_CrlTemplateNoEntries[] = {
    { SEC_ASN1_SEQUENCE,
 	  0, NULL, sizeof(CERTCrl) },
    { SEC_ASN1_INTEGER | SEC_ASN1_OPTIONAL, offsetof (CERTCrl, version) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	  offsetof(CERTCrl,signatureAlg),
-	  SECOID_AlgorithmIDTemplate },
+	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_SAVE,
 	  offsetof(CERTCrl,derName) },
    { SEC_ASN1_INLINE,
 	  offsetof(CERTCrl,name),
 	  CERT_NameTemplate },
-    { SEC_ASN1_INLINE,
-	  offsetof(CERTCrl,lastUpdate), CERT_TimeChoiceTemplate },
-    { SEC_ASN1_INLINE | SEC_ASN1_OPTIONAL,
-	  offsetof(CERTCrl,nextUpdate), CERT_TimeChoiceTemplate },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+	  offsetof(CERTCrl,lastUpdate),
+          SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
+    { SEC_ASN1_INLINE | SEC_ASN1_OPTIONAL | SEC_ASN1_XTRN,
+	  offsetof(CERTCrl,nextUpdate),
+          SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_SEQUENCE_OF |
      SEC_ASN1_SKIP }, /* skip entries */
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC |
@ -220,10 +228,12 @@ const SEC_ASN1Template CERT_CrlTemplateEntriesOnly[] = {
    { SEC_ASN1_SKIP | SEC_ASN1_INTEGER | SEC_ASN1_OPTIONAL },
    { SEC_ASN1_SKIP },
    { SEC_ASN1_SKIP },
-    { SEC_ASN1_SKIP | SEC_ASN1_INLINE,
-        offsetof(CERTCrl,lastUpdate), CERT_TimeChoiceTemplate },
-    { SEC_ASN1_SKIP | SEC_ASN1_INLINE | SEC_ASN1_OPTIONAL,
-        offsetof(CERTCrl,nextUpdate), CERT_TimeChoiceTemplate },
+    { SEC_ASN1_SKIP | SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+        offsetof(CERTCrl,lastUpdate),
+        SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
+    { SEC_ASN1_SKIP | SEC_ASN1_INLINE | SEC_ASN1_OPTIONAL | SEC_ASN1_XTRN,
+        offsetof(CERTCrl,nextUpdate),
+        SEC_ASN1_SUB(CERT_TimeChoiceTemplate) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_SEQUENCE_OF,
 	  offsetof(CERTCrl,entries),
 	  cert_CrlEntryTemplate }, /* decode entries */
@ -239,9 +249,9 @@ const SEC_ASN1Template CERT_SignedCrlTemplate[] = {
    { SEC_ASN1_INLINE,
 	  offsetof(CERTSignedCrl,crl),
 	  CERT_CrlTemplate },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN ,
 	  offsetof(CERTSignedCrl,signatureWrap.signatureAlgorithm),
-	  SECOID_AlgorithmIDTemplate },
+	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_BIT_STRING,
 	  offsetof(CERTSignedCrl,signatureWrap.signature) },
    { 0 }
@ -255,9 +265,9 @@ static const SEC_ASN1Template cert_SignedCrlTemplateNoEntries[] = {
    { SEC_ASN1_INLINE,
 	  offsetof(CERTSignedCrl,crl),
 	  CERT_CrlTemplateNoEntries },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	  offsetof(CERTSignedCrl,signatureWrap.signatureAlgorithm),
-	  SECOID_AlgorithmIDTemplate },
+	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_BIT_STRING,
 	  offsetof(CERTSignedCrl,signatureWrap.signature) },
    { 0 }
--- a/mozilla/security/nss/lib/certdb/genname.c
+++ b/mozilla/security/nss/lib/certdb/genname.c
@ -49,20 +49,26 @@
 #include "prprf.h"
 #include "genname.h"

-
+SEC_ASN1_MKSUB(SEC_AnyTemplate);
+SEC_ASN1_MKSUB(SEC_IntegerTemplate);
+SEC_ASN1_MKSUB(SEC_IA5StringTemplate);
+SEC_ASN1_MKSUB(SEC_ObjectIDTemplate);
+SEC_ASN1_MKSUB(SEC_OctetStringTemplate);

 static const SEC_ASN1Template CERTNameConstraintTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CERTNameConstraint) },
    { SEC_ASN1_ANY, offsetof(CERTNameConstraint, DERName) },
-    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 0, 
-          offsetof(CERTNameConstraint, min), SEC_IntegerTemplate }, 
-    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 1, 
-          offsetof(CERTNameConstraint, max), SEC_IntegerTemplate },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0, 
+          offsetof(CERTNameConstraint, min),
+          SEC_ASN1_SUB(SEC_IntegerTemplate) }, 
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1, 
+          offsetof(CERTNameConstraint, max),
+          SEC_ASN1_SUB(SEC_IntegerTemplate) },
    { 0, }
 };

 const SEC_ASN1Template CERT_NameConstraintSubtreeSubTemplate[] = {
-    { SEC_ASN1_SEQUENCE_OF, 0, SEC_AnyTemplate }
+    { SEC_ASN1_SEQUENCE_OF | SEC_ASN1_XTRN, 0, SEC_ASN1_SUB(SEC_AnyTemplate) }
 };

 static const SEC_ASN1Template CERTNameConstraintsTemplate[] = {
@ -81,8 +87,9 @@ static const SEC_ASN1Template CERTOthNameTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(OtherName) },
    { SEC_ASN1_OBJECT_ID, 
 	  offsetof(OtherName, oid) },
-    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | SEC_ASN1_EXPLICIT | 0,
-          offsetof(OtherName, name), SEC_AnyTemplate },
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | SEC_ASN1_EXPLICIT |
+          SEC_ASN1_XTRN | 0, offsetof(OtherName, name),
+          SEC_ASN1_SUB(SEC_AnyTemplate) },
    { 0, } 
 };

@ -103,57 +110,62 @@ static const SEC_ASN1Template CERTOtherName2Template[] = {
 };

 static const SEC_ASN1Template CERT_RFC822NameTemplate[] = {
-    { SEC_ASN1_CONTEXT_SPECIFIC | 1 ,
-          offsetof(CERTGeneralName, name.other), SEC_IA5StringTemplate,
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1 ,
+          offsetof(CERTGeneralName, name.other),
+          SEC_ASN1_SUB(SEC_IA5StringTemplate),
          sizeof (CERTGeneralName)}
 };

 static const SEC_ASN1Template CERT_DNSNameTemplate[] = {
-    { SEC_ASN1_CONTEXT_SPECIFIC | 2 ,
-          offsetof(CERTGeneralName, name.other), SEC_IA5StringTemplate,
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 2 ,
+          offsetof(CERTGeneralName, name.other),
+          SEC_ASN1_SUB(SEC_IA5StringTemplate),
          sizeof (CERTGeneralName)}
 };

 static const SEC_ASN1Template CERT_X400AddressTemplate[] = {
-    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | 3,
-          offsetof(CERTGeneralName, name.other), SEC_AnyTemplate,
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | SEC_ASN1_XTRN | 3,
+          offsetof(CERTGeneralName, name.other), SEC_ASN1_SUB(SEC_AnyTemplate),
          sizeof (CERTGeneralName)}
 };

 static const SEC_ASN1Template CERT_DirectoryNameTemplate[] = {
-    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | SEC_ASN1_EXPLICIT | 4,
-          offsetof(CERTGeneralName, derDirectoryName), SEC_AnyTemplate,
-          sizeof (CERTGeneralName)}
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | SEC_ASN1_EXPLICIT |
+          SEC_ASN1_XTRN | 4, offsetof(CERTGeneralName, derDirectoryName),
+          SEC_ASN1_SUB(SEC_AnyTemplate), sizeof (CERTGeneralName)}
 };


 static const SEC_ASN1Template CERT_EDIPartyNameTemplate[] = {
-    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | 5,
-          offsetof(CERTGeneralName, name.other), SEC_AnyTemplate,
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | SEC_ASN1_XTRN | 5,
+          offsetof(CERTGeneralName, name.other), SEC_ASN1_SUB(SEC_AnyTemplate),
          sizeof (CERTGeneralName)}
 };

 static const SEC_ASN1Template CERT_URITemplate[] = {
-    { SEC_ASN1_CONTEXT_SPECIFIC | 6 ,
-          offsetof(CERTGeneralName, name.other), SEC_IA5StringTemplate,
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 6 ,
+          offsetof(CERTGeneralName, name.other),
+          SEC_ASN1_SUB(SEC_IA5StringTemplate),
          sizeof (CERTGeneralName)}
 };

 static const SEC_ASN1Template CERT_IPAddressTemplate[] = {
-    { SEC_ASN1_CONTEXT_SPECIFIC | 7 ,
-          offsetof(CERTGeneralName, name.other), SEC_OctetStringTemplate,
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 7 ,
+          offsetof(CERTGeneralName, name.other),
+          SEC_ASN1_SUB(SEC_OctetStringTemplate),
          sizeof (CERTGeneralName)}
 };

 static const SEC_ASN1Template CERT_RegisteredIDTemplate[] = {
-    { SEC_ASN1_CONTEXT_SPECIFIC | 8 ,
-          offsetof(CERTGeneralName, name.other), SEC_ObjectIDTemplate,
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 8 ,
+          offsetof(CERTGeneralName, name.other),
+          SEC_ASN1_SUB(SEC_ObjectIDTemplate),
          sizeof (CERTGeneralName)}
 };


 const SEC_ASN1Template CERT_GeneralNamesTemplate[] = {
-    { SEC_ASN1_SEQUENCE_OF, 0, SEC_AnyTemplate }
+    { SEC_ASN1_SEQUENCE_OF | SEC_ASN1_XTRN , 0, SEC_ASN1_SUB(SEC_AnyTemplate) }
 };


@ -1705,7 +1717,8 @@ CERT_GetNickName(CERTCertificate   *cert,
    if (!found)
    	goto loser;

-    rv = SEC_QuickDERDecodeItem(arena, &nick, SEC_IA5StringTemplate, 
+    rv = SEC_QuickDERDecodeItem(arena, &nick,
+                            SEC_ASN1_GET(SEC_IA5StringTemplate),
 			    &current->name.OthName.name);
    if (rv != SECSuccess) {
 	goto loser;
--- a/mozilla/security/nss/lib/certdb/polcyxtn.c
+++ b/mozilla/security/nss/lib/certdb/polcyxtn.c
@ -37,7 +37,7 @@
 /*
 * Support for various policy related extensions
 *
- * $Id: polcyxtn.c,v 1.8 2007-09-07 18:45:51 neil.williams%sun.com Exp $
+ * $Id: polcyxtn.c,v 1.9 2007-10-12 01:44:40 julien.pierre.boogz%sun.com Exp $
 */

 #include "seccomon.h"
@ -49,6 +49,9 @@
 #include "secerr.h"
 #include "nspr.h"

+SEC_ASN1_MKSUB(SEC_IntegerTemplate);
+SEC_ASN1_MKSUB(SEC_ObjectIDTemplate);
+
 const SEC_ASN1Template CERT_DisplayTextTypeTemplate[] = {
    { SEC_ASN1_CHOICE, offsetof(SECItem, type), 0, sizeof(SECItem) },
    { SEC_ASN1_IA5_STRING, 0, 0, siAsciiString},
@ -64,9 +67,9 @@ const SEC_ASN1Template CERT_NoticeReferenceTemplate[] = {
    { SEC_ASN1_INLINE,
 	  offsetof(CERTNoticeReference, organization),
           CERT_DisplayTextTypeTemplate, 0 },
-    { SEC_ASN1_SEQUENCE_OF,
+    { SEC_ASN1_SEQUENCE_OF | SEC_ASN1_XTRN,
           offsetof(CERTNoticeReference, noticeNumbers),
-           SEC_IntegerTemplate }, 
+           SEC_ASN1_SUB(SEC_IntegerTemplate) }, 
    { 0 }
 };

@ -126,12 +129,12 @@ const SEC_ASN1Template CERT_PolicyMappingsTemplate[] = {

 const SEC_ASN1Template CERT_PolicyConstraintsTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CERTCertificatePolicyConstraints) },
-    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 0,
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
 	  offsetof(CERTCertificatePolicyConstraints, explicitPolicySkipCerts),
-	  SEC_IntegerTemplate },
-    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 1,
+	  SEC_ASN1_SUB(SEC_IntegerTemplate) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1,
 	  offsetof(CERTCertificatePolicyConstraints, inhibitMappingSkipCerts),
-	  SEC_IntegerTemplate },
+	  SEC_ASN1_SUB(SEC_IntegerTemplate) },
    { 0 }
 };

@ -626,9 +629,9 @@ nopolicy:


 const SEC_ASN1Template CERT_OidSeqTemplate[] = {
-    { SEC_ASN1_SEQUENCE_OF,
+    { SEC_ASN1_SEQUENCE_OF | SEC_ASN1_XTRN,
 	  offsetof(CERTOidSequence, oids),
-	  SEC_ObjectIDTemplate }
+	  SEC_ASN1_SUB(SEC_ObjectIDTemplate) }
 };

 CERTOidSequence *
--- a/mozilla/security/nss/lib/certdb/secname.c
+++ b/mozilla/security/nss/lib/certdb/secname.c
@ -644,13 +644,13 @@ CERT_DecodeAVAValue(const SECItem *derAVAValue)
    switch(derAVAValue->data[0]) {
 	case SEC_ASN1_UNIVERSAL_STRING:
 	    convert = conv_ucs4;
-	    theTemplate = SEC_UniversalStringTemplate;
+	    theTemplate = SEC_ASN1_GET(SEC_UniversalStringTemplate);
 	    break;
 	case SEC_ASN1_IA5_STRING:
-	    theTemplate = SEC_IA5StringTemplate;
+	    theTemplate = SEC_ASN1_GET(SEC_IA5StringTemplate);
 	    break;
 	case SEC_ASN1_PRINTABLE_STRING:
-	    theTemplate = SEC_PrintableStringTemplate;
+	    theTemplate = SEC_ASN1_GET(SEC_PrintableStringTemplate);
 	    break;
 	case SEC_ASN1_T61_STRING:
 	    /*
@ -658,15 +658,15 @@ CERT_DecodeAVAValue(const SECItem *derAVAValue)
 	     * treating T61-labeled strings as containing ISO-8859-1.
 	     */
 	    convert = conv_iso88591;
-	    theTemplate = SEC_T61StringTemplate;
+	    theTemplate = SEC_ASN1_GET(SEC_T61StringTemplate);
 	    break;
 	case SEC_ASN1_BMP_STRING:
 	    convert = conv_ucs2;
-	    theTemplate = SEC_BMPStringTemplate;
+	    theTemplate = SEC_ASN1_GET(SEC_BMPStringTemplate);
 	    break;
 	case SEC_ASN1_UTF8_STRING:
 	    /* No conversion needed ! */
-	    theTemplate = SEC_UTF8StringTemplate;
+	    theTemplate = SEC_ASN1_GET(SEC_UTF8StringTemplate);
 	    break;
 	default:
 	    PORT_SetError(SEC_ERROR_INVALID_AVA);
--- a/mozilla/security/nss/lib/certdb/xauthkid.c
+++ b/mozilla/security/nss/lib/certdb/xauthkid.c
@ -51,15 +51,18 @@
 #include "genname.h"
 #include "secerr.h"

-   
+SEC_ASN1_MKSUB(SEC_IntegerTemplate);
+SEC_ASN1_MKSUB(SEC_OctetStringTemplate);
+
 const SEC_ASN1Template CERTAuthKeyIDTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CERTAuthKeyID) },
-    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 0,
-	  offsetof(CERTAuthKeyID,keyID), SEC_OctetStringTemplate},
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
+	  offsetof(CERTAuthKeyID,keyID), SEC_ASN1_SUB(SEC_OctetStringTemplate)},
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC  | 1,
          offsetof(CERTAuthKeyID, DERAuthCertIssuer), CERT_GeneralNamesTemplate},
-    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 2,
-	  offsetof(CERTAuthKeyID,authCertSerialNumber), SEC_IntegerTemplate},
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 2,
+	  offsetof(CERTAuthKeyID,authCertSerialNumber),
+          SEC_ASN1_SUB(SEC_IntegerTemplate) },
    { 0 }
 };

--- a/mozilla/security/nss/lib/certdb/xconst.c
+++ b/mozilla/security/nss/lib/certdb/xconst.c
@ -63,16 +63,17 @@ static const SEC_ASN1Template CERTIA5TypeTemplate[] = {
    { SEC_ASN1_IA5_STRING }
 };

+SEC_ASN1_MKSUB(SEC_GeneralizedTimeTemplate);

 static const SEC_ASN1Template CERTPrivateKeyUsagePeriodTemplate[] = {
    { SEC_ASN1_SEQUENCE,
      0, NULL, sizeof(CERTPrivKeyUsagePeriod) },
-    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC  | 0,	
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC  | SEC_ASN1_XTRN | 0,
 	  offsetof(CERTPrivKeyUsagePeriod, notBefore), 
-	  SEC_GeneralizedTimeTemplate},
-    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC  | 1,
+	  SEC_ASN1_SUB(SEC_GeneralizedTimeTemplate) },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC  | SEC_ASN1_XTRN | 1,
 	  offsetof(CERTPrivKeyUsagePeriod, notAfter), 
-	  SEC_GeneralizedTimeTemplate},
+	  SEC_ASN1_SUB(SEC_GeneralizedTimeTemplate)},
    { 0, } 
 };

--- a/mozilla/security/nss/lib/certhigh/certreq.c
+++ b/mozilla/security/nss/lib/certhigh/certreq.c
@ -42,12 +42,14 @@
 #include "secasn1.h"
 #include "secerr.h"

+SEC_ASN1_MKSUB(SEC_AnyTemplate);
+
 const SEC_ASN1Template CERT_AttributeTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	0, NULL, sizeof(CERTAttribute) },
    { SEC_ASN1_OBJECT_ID, offsetof(CERTAttribute, attrType) },
-    { SEC_ASN1_SET_OF, offsetof(CERTAttribute, attrValue),
-	SEC_AnyTemplate },
+    { SEC_ASN1_SET_OF | SEC_ASN1_XTRN, offsetof(CERTAttribute, attrValue),
+	SEC_ASN1_SUB(SEC_AnyTemplate) },
    { 0 }
 };

--- a/mozilla/security/nss/lib/certhigh/crlv2.c
+++ b/mozilla/security/nss/lib/certhigh/crlv2.c
@ -37,7 +37,7 @@
 /*
 * Code for dealing with x.509 v3 crl and crl entries extensions.
 *
- * $Id: crlv2.c,v 1.5 2007-05-25 07:28:32 alexei.volkov.bugs%sun.com Exp $
+ * $Id: crlv2.c,v 1.6 2007-10-12 01:44:41 julien.pierre.boogz%sun.com Exp $
 */

 #include "cert.h"
@ -112,7 +112,8 @@ SECStatus CERT_FindCRLNumberExten (PRArenaPool *arena, CERTCrl *crl,

    tmpItem = SECITEM_ArenaDupItem(arena, &encodedExtenValue);
    if (tmpItem) {
-        rv = SEC_QuickDERDecodeItem (arena, value, SEC_IntegerTemplate,
+        rv = SEC_QuickDERDecodeItem (arena, value,
+                                     SEC_ASN1_GET(SEC_IntegerTemplate),
                                     tmpItem);
    } else {
        rv = SECFailure;
@ -146,7 +147,8 @@ SECStatus CERT_FindCRLEntryReasonExten (CERTCrlEntry *crlEntry,
 	goto loser;
    }

-    rv = SEC_QuickDERDecodeItem(arena, &tmpItem, SEC_EnumeratedTemplate,
+    rv = SEC_QuickDERDecodeItem(arena, &tmpItem,
+                                SEC_ASN1_GET(SEC_EnumeratedTemplate),
                                &wrapperItem);

    if ( rv != SECSuccess ) {
@ -182,7 +184,8 @@ SECStatus CERT_FindInvalidDateExten (CERTCrl *crl, int64 *value)
 	return (rv);

    rv = SEC_ASN1DecodeItem (NULL, &decodedExtenValue,
-			     SEC_GeneralizedTimeTemplate, &encodedExtenValue);
+			     SEC_ASN1_GET(SEC_GeneralizedTimeTemplate),
+                             &encodedExtenValue);
    if (rv == SECSuccess)
 	rv = DER_GeneralizedTimeToTime(value, &encodedExtenValue);
    PORT_Free (decodedExtenValue.data);
--- a/mozilla/security/nss/lib/certhigh/ocsp.c
+++ b/mozilla/security/nss/lib/certhigh/ocsp.c
@ -39,7 +39,7 @@
 * Implementation of OCSP services, for both client and server.
 * (XXX, really, mostly just for client right now, but intended to do both.)
 *
- * $Id: ocsp.c,v 1.43 2007-10-04 13:04:42 kaie%kuix.de Exp $
+ * $Id: ocsp.c,v 1.44 2007-10-12 01:44:41 julien.pierre.boogz%sun.com Exp $
 */

 #include "prerror.h"
@ -937,6 +937,15 @@ typedef struct ocspCheckingContextStr {
    CERTCertificate *defaultResponderCert;
 } ocspCheckingContext;

+SEC_ASN1_MKSUB(SEC_AnyTemplate);
+SEC_ASN1_MKSUB(SEC_IntegerTemplate);
+SEC_ASN1_MKSUB(SEC_NullTemplate);
+SEC_ASN1_MKSUB(SEC_OctetStringTemplate);
+SEC_ASN1_MKSUB(SEC_PointerToAnyTemplate);
+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate);
+SEC_ASN1_MKSUB(SEC_SequenceOfAnyTemplate);
+SEC_ASN1_MKSUB(SEC_PointerToGeneralizedTimeTemplate)
+SEC_ASN1_MKSUB(SEC_PointerToEnumeratedTemplate)

 /*
 * Forward declarations of sub-types, so I can lay out the types in the
@ -993,13 +1002,13 @@ const SEC_ASN1Template ocsp_TBSRequestTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	0, NULL, sizeof(ocspTBSRequest) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_EXPLICIT |		/* XXX DER_DEFAULT */
-      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
+      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
 	offsetof(ocspTBSRequest, version),
-	SEC_IntegerTemplate },
+	SEC_ASN1_SUB(SEC_IntegerTemplate) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_EXPLICIT |
-      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 1,
+      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1,
 	offsetof(ocspTBSRequest, derRequestorName),
-	SEC_PointerToAnyTemplate },
+	SEC_ASN1_SUB(SEC_PointerToAnyTemplate) },
    { SEC_ASN1_SEQUENCE_OF,
 	offsetof(ocspTBSRequest, requestList),
 	ocsp_SingleRequestTemplate },
@ -1019,15 +1028,15 @@ const SEC_ASN1Template ocsp_TBSRequestTemplate[] = {
 static const SEC_ASN1Template ocsp_SignatureTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	0, NULL, sizeof(ocspSignature) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	offsetof(ocspSignature, signatureAlgorithm),
-	SECOID_AlgorithmIDTemplate },
+	SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_BIT_STRING,
 	offsetof(ocspSignature, signature) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_EXPLICIT |
-      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
+      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
 	offsetof(ocspSignature, derCerts), 
-	SEC_SequenceOfAnyTemplate },
+	SEC_ASN1_SUB(SEC_SequenceOfAnyTemplate) },
    { 0 }
 };

@ -1085,9 +1094,9 @@ const SEC_ASN1Template ocsp_SingleRequestTemplate[] = {
 const SEC_ASN1Template ocsp_CertIDTemplate[] = {
    { SEC_ASN1_SEQUENCE, 
 	0, NULL, sizeof(CERTOCSPCertID) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	offsetof(CERTOCSPCertID, hashAlgorithm),
-	SECOID_AlgorithmIDTemplate },
+	SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_OCTET_STRING,
 	offsetof(CERTOCSPCertID, issuerNameHash) },
    { SEC_ASN1_OCTET_STRING,
@ -1161,15 +1170,15 @@ static const SEC_ASN1Template ocsp_BasicOCSPResponseTemplate[] = {
    { SEC_ASN1_POINTER,
 	offsetof(ocspBasicOCSPResponse, tbsResponseData),
 	ocsp_ResponseDataTemplate },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	offsetof(ocspBasicOCSPResponse, responseSignature.signatureAlgorithm),
-	SECOID_AlgorithmIDTemplate },
+	SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_BIT_STRING,
 	offsetof(ocspBasicOCSPResponse, responseSignature.signature) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_EXPLICIT |
-      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
+      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
 	offsetof(ocspBasicOCSPResponse, responseSignature.derCerts),
-	SEC_SequenceOfAnyTemplate },
+	SEC_ASN1_SUB(SEC_SequenceOfAnyTemplate) },
    { 0 }
 };

@ -1189,9 +1198,9 @@ const SEC_ASN1Template ocsp_ResponseDataTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	0, NULL, sizeof(ocspResponseData) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_EXPLICIT |		/* XXX DER_DEFAULT */
-      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
+      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
 	offsetof(ocspResponseData, version),
-	SEC_IntegerTemplate },
+	SEC_ASN1_SUB(SEC_IntegerTemplate) },
    { SEC_ASN1_ANY,
 	offsetof(ocspResponseData, derResponderID) },
    { SEC_ASN1_GENERALIZED_TIME,
@ -1227,9 +1236,10 @@ static const SEC_ASN1Template ocsp_ResponderIDByNameTemplate[] = {
 	CERT_NameTemplate }
 };
 static const SEC_ASN1Template ocsp_ResponderIDByKeyTemplate[] = {
-    { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 2,
+    { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC |
+        SEC_ASN1_XTRN | 2,
 	offsetof(ocspResponderID, responderIDValue.keyHash),
-	SEC_OctetStringTemplate }
+	SEC_ASN1_SUB(SEC_OctetStringTemplate) }
 };
 static const SEC_ASN1Template ocsp_ResponderIDOtherTemplate[] = {
    { SEC_ASN1_ANY,
@ -1238,8 +1248,8 @@ static const SEC_ASN1Template ocsp_ResponderIDOtherTemplate[] = {

 /* Decode choice container, but leave x509 name object encoded */
 static const SEC_ASN1Template ocsp_ResponderIDDerNameTemplate[] = {
-    { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 1,
-	0, SEC_AnyTemplate }
+    { SEC_ASN1_EXPLICIT | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC |
+        SEC_ASN1_XTRN | 1, 0, SEC_ASN1_SUB(SEC_AnyTemplate) }
 };

 /*
@ -1265,9 +1275,9 @@ const SEC_ASN1Template ocsp_SingleResponseTemplate[] = {
    { SEC_ASN1_GENERALIZED_TIME,
 	offsetof(CERTOCSPSingleResponse, thisUpdate) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_EXPLICIT |
-      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
+      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
 	offsetof(CERTOCSPSingleResponse, nextUpdate),
-	SEC_PointerToGeneralizedTimeTemplate },
+	SEC_ASN1_SUB(SEC_PointerToGeneralizedTimeTemplate) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_EXPLICIT |
      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 1,
 	offsetof(CERTOCSPSingleResponse, singleExtensions),
@ -1289,9 +1299,9 @@ const SEC_ASN1Template ocsp_SingleResponseTemplate[] = {
 * now we list each choice as its own template:
 */
 static const SEC_ASN1Template ocsp_CertStatusGoodTemplate[] = {
-    { SEC_ASN1_POINTER | SEC_ASN1_CONTEXT_SPECIFIC | 0,
+    { SEC_ASN1_POINTER | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
 	offsetof(ocspCertStatus, certStatusInfo.goodInfo),
-	SEC_NullTemplate }
+	SEC_ASN1_SUB(SEC_NullTemplate) }
 };
 static const SEC_ASN1Template ocsp_CertStatusRevokedTemplate[] = {
    { SEC_ASN1_POINTER | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 1, 
@ -1299,14 +1309,14 @@ static const SEC_ASN1Template ocsp_CertStatusRevokedTemplate[] = {
 	ocsp_RevokedInfoTemplate }
 };
 static const SEC_ASN1Template ocsp_CertStatusUnknownTemplate[] = {
-    { SEC_ASN1_POINTER | SEC_ASN1_CONTEXT_SPECIFIC | 2,
+    { SEC_ASN1_POINTER | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 2,
 	offsetof(ocspCertStatus, certStatusInfo.unknownInfo),
-	SEC_NullTemplate }
+	SEC_ASN1_SUB(SEC_NullTemplate) }
 };
 static const SEC_ASN1Template ocsp_CertStatusOtherTemplate[] = {
-    { SEC_ASN1_POINTER,
+    { SEC_ASN1_POINTER | SEC_ASN1_XTRN,
 	offsetof(ocspCertStatus, certStatusInfo.otherInfo),
-	SEC_AnyTemplate }
+	SEC_ASN1_SUB(SEC_AnyTemplate) }
 };

 /*
@ -1324,9 +1334,10 @@ const SEC_ASN1Template ocsp_RevokedInfoTemplate[] = {
    { SEC_ASN1_GENERALIZED_TIME,
 	offsetof(ocspRevokedInfo, revocationTime) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_EXPLICIT |
-      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
+      SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC |
+        SEC_ASN1_XTRN | 0,
 	offsetof(ocspRevokedInfo, revocationReason), 
-	SEC_PointerToEnumeratedTemplate },
+	SEC_ASN1_SUB(SEC_PointerToEnumeratedTemplate) },
    { 0 }
 };

@ -2093,8 +2104,8 @@ CERT_AddOCSPAcceptableResponses(CERTOCSPRequest *request,
    acceptableResponses[i] = NULL;

    rv = CERT_EncodeAndAddExtension(extHandle, SEC_OID_PKIX_OCSP_RESPONSE,
-				    &acceptableResponses, PR_FALSE,
-				    SEC_SequenceOfObjectIDTemplate);
+                                &acceptableResponses, PR_FALSE,
+                                SEC_ASN1_GET(SEC_SequenceOfObjectIDTemplate));
    if (rv != SECSuccess)
 	goto loser;

--- a/mozilla/security/nss/lib/certhigh/xcrldist.c
+++ b/mozilla/security/nss/lib/certhigh/xcrldist.c
@ -41,6 +41,9 @@
 #include "certt.h"
 #include "secerr.h"

+SEC_ASN1_MKSUB(SEC_AnyTemplate);
+SEC_ASN1_MKSUB(SEC_BitStringTemplate);
+
 extern void PrepareBitStringForEncoding (SECItem *bitMap, SECItem *value);

 static const SEC_ASN1Template FullNameTemplate[] = {
@ -56,10 +59,12 @@ static const SEC_ASN1Template RelativeNameTemplate[] = {
 static const SEC_ASN1Template CRLDistributionPointTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CRLDistributionPoint) },
 	{ SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC |
-	    SEC_ASN1_CONSTRUCTED | SEC_ASN1_EXPLICIT | 0,
-	    offsetof(CRLDistributionPoint,derDistPoint), SEC_AnyTemplate},
-	{ SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | 1,
-	    offsetof(CRLDistributionPoint,bitsmap), SEC_BitStringTemplate},
+	    SEC_ASN1_CONSTRUCTED | SEC_ASN1_EXPLICIT | SEC_ASN1_XTRN | 0,
+	    offsetof(CRLDistributionPoint,derDistPoint),
+            SEC_ASN1_SUB(SEC_AnyTemplate)},
+	{ SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1,
+	    offsetof(CRLDistributionPoint,bitsmap),
+            SEC_ASN1_SUB(SEC_BitStringTemplate) },
 	{ SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC |
 	    SEC_ASN1_CONSTRUCTED | 2,
 	    offsetof(CRLDistributionPoint, derCrlIssuer), CERT_GeneralNamesTemplate},
--- a/mozilla/security/nss/lib/ckfw/nssmkey/mobject.c
+++ b/mozilla/security/nss/lib/ckfw/nssmkey/mobject.c
@ -36,7 +36,7 @@
 *
 * ***** END LICENSE BLOCK ***** */
 #ifdef DEBUG
-static const char CVS_ID[] = "@(#) $RCSfile: mobject.c,v $ $Revision: 1.2 $ $Date: 2007-07-06 03:16:56 $";
+static const char CVS_ID[] = "@(#) $RCSfile: mobject.c,v $ $Revision: 1.3 $ $Date: 2007-10-12 01:44:42 $";
 #endif /* DEBUG */

 #include "ckmk.h"
@ -1531,12 +1531,14 @@ const SEC_ASN1Template ckmk_SetOfAttributeTemplate[] = {
    { SEC_ASN1_SET_OF, 0, ckmk_AttributeTemplate },
 };

+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate)
+
 /* ASN1 Templates for new decoder/encoder */
 const SEC_ASN1Template ckmk_PrivateKeyInfoTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(PrivateKeyInfo) },
    { SEC_ASN1_INTEGER, offsetof(PrivateKeyInfo,version) },
-    { SEC_ASN1_INLINE, offsetof(PrivateKeyInfo,algorithm),
-        SECOID_AlgorithmIDTemplate },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN, offsetof(PrivateKeyInfo,algorithm),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_OCTET_STRING, offsetof(PrivateKeyInfo,privateKey) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
        offsetof(PrivateKeyInfo, attributes), ckmk_SetOfAttributeTemplate },
--- a/mozilla/security/nss/lib/cryptohi/seckey.c
+++ b/mozilla/security/nss/lib/cryptohi/seckey.c
@ -50,12 +50,14 @@
 #include "ec.h"
 #include "keyi.h"

+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate);
+
 const SEC_ASN1Template CERT_SubjectPublicKeyInfoTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	  0, NULL, sizeof(CERTSubjectPublicKeyInfo) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	  offsetof(CERTSubjectPublicKeyInfo,algorithm),
-	  SECOID_AlgorithmIDTemplate },
+	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_BIT_STRING,
 	  offsetof(CERTSubjectPublicKeyInfo,subjectPublicKey), },
    { 0, }
--- a/mozilla/security/nss/lib/cryptohi/secsign.c
+++ b/mozilla/security/nss/lib/cryptohi/secsign.c
@ -37,7 +37,7 @@
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */
-/* $Id: secsign.c,v 1.18 2006-06-23 17:01:37 rrelyea%redhat.com Exp $ */
+/* $Id: secsign.c,v 1.19 2007-10-12 01:44:43 julien.pierre.boogz%sun.com Exp $ */

 #include <stdio.h>
 #include "cryptohi.h"
@ -189,7 +189,8 @@ SGN_End(SGNContext *cx, SECItem *result)
 	}

 	/* Der encode the digest as a DigestInfo */
-	rv = DER_Encode(arena, &digder, SGNDigestInfoTemplate, di);
+        rv = DER_Encode(arena, &digder, SEC_ASN1_GET(SGNDigestInfoTemplate),
+                        di);
 	if (rv != SECSuccess) {
 	    goto loser;
 	}
@ -279,6 +280,16 @@ SEC_SignData(SECItem *res, unsigned char *buf, int len,

 /************************************************************************/
    
+static DERTemplate SECAlgorithmIDTemplate[] = {
+    { DER_SEQUENCE,
+	  0, NULL, sizeof(SECAlgorithmID) },
+    { DER_OBJECT_ID,
+	  offsetof(SECAlgorithmID,algorithm), },
+    { DER_OPTIONAL | DER_ANY,
+	  offsetof(SECAlgorithmID,parameters), },
+    { 0, }
+};
+
 DERTemplate CERTSignedDataTemplate[] =
 {
    { DER_SEQUENCE,
@ -293,15 +304,17 @@ DERTemplate CERTSignedDataTemplate[] =
    { 0, }
 };

+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate);
+
 const SEC_ASN1Template CERT_SignedDataTemplate[] =
 {
    { SEC_ASN1_SEQUENCE,
 	  0, NULL, sizeof(CERTSignedData) },
    { SEC_ASN1_ANY,
 	  offsetof(CERTSignedData,data), },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	  offsetof(CERTSignedData,signatureAlgorithm),
-	  SECOID_AlgorithmIDTemplate, },
+	  SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate), },
    { SEC_ASN1_BIT_STRING,
 	  offsetof(CERTSignedData,signature), },
    { 0, }
@ -392,7 +405,8 @@ SGN_Digest(SECKEYPrivateKey *privKey,
 	}

 	/* Der encode the digest as a DigestInfo */
-	rv = DER_Encode(arena, &digder, SGNDigestInfoTemplate, di);
+        rv = DER_Encode(arena, &digder, SEC_ASN1_GET(SGNDigestInfoTemplate),
+                        di);
 	if (rv != SECSuccess) {
 	    goto loser;
 	}
--- a/mozilla/security/nss/lib/freebl/config.mk
+++ b/mozilla/security/nss/lib/freebl/config.mk
@ -73,8 +73,6 @@ LIBRARY      =
 IMPORT_LIBRARY =
 PROGRAM      =

-EXTRA_LIBS   += $(DIST)/lib/$(LIB_PREFIX)secutil.$(LIB_SUFFIX)
-
 ifeq ($(OS_TARGET), SunOS)
 OS_LIBS += -lkstat
 endif
@ -89,6 +87,8 @@ RESNAME = freebl.rc

 ifdef NS_USE_GCC
 EXTRA_SHARED_LIBS += \
+	-L$(DIST)/lib \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
@ -96,6 +96,7 @@ EXTRA_SHARED_LIBS += \
 	$(NULL)
 else # ! NS_USE_GCC
 EXTRA_SHARED_LIBS += \
+	$(DIST)/lib/nssutil3.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
@ -105,6 +106,8 @@ endif # NS_USE_GCC
 else

 EXTRA_SHARED_LIBS += \
+	-L$(DIST)/lib \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
--- a/mozilla/security/nss/lib/freebl/sha-fast-amd64-sun.s
+++ b/mozilla/security/nss/lib/freebl/sha-fast-amd64-sun.s
@ -1952,7 +1952,7 @@ SHA1_End:
 SHA1_NewContext:
 .LFB8:
 	movl	$248, %edi
-	jmp	PORT_Alloc@PLT
+	jmp	PORT_Alloc_Util@PLT
 .LFE8:
 	.size	SHA1_NewContext, .-SHA1_NewContext
 	.align 16
@ -1987,7 +1987,7 @@ SHA1_DestroyContext:
 	movq	(%rsp), %rbx
 	movq	8(%rsp), %r12
 	leave
-	jmp	PORT_Free@PLT
+	jmp	PORT_Free_Util@PLT
 .LFE9:
 	.size	SHA1_DestroyContext, .-SHA1_DestroyContext
 	.align 16
@ -2137,6 +2137,6 @@ SHA1_Clone:
 SHA1_TraceState:
 .LFB16:
 	movl	$-5992, %edi
-	jmp	PORT_SetError@PLT
+	jmp	PORT_SetError_Util@PLT
 .LFE16:
 	.size	SHA1_TraceState, .-SHA1_TraceState
--- a/mozilla/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_ldaptemplates.c
+++ b/mozilla/security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_ldaptemplates.c
@ -38,6 +38,10 @@

 #include "pkix_pl_ldapt.h"

+SEC_ASN1_MKSUB(SEC_AnyTemplate);
+SEC_ASN1_MKSUB(SEC_NullTemplate);
+SEC_ASN1_MKSUB(SEC_OctetStringTemplate);
+
 /*
 * CertificatePair      ::= SEQUENCE {
 *      forward [0]     Certificate OPTIONAL,
@ -49,11 +53,11 @@
 const SEC_ASN1Template PKIX_PL_LDAPCrossCertPairTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(LDAPCertPair) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC |
-        SEC_ASN1_EXPLICIT | 0,
-        offsetof(LDAPCertPair, forward), SEC_AnyTemplate },
+        SEC_ASN1_EXPLICIT | SEC_ASN1_XTRN | 0,
+        offsetof(LDAPCertPair, forward), SEC_ASN1_SUB(SEC_AnyTemplate) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC |
-        SEC_ASN1_EXPLICIT | 1,
-        offsetof(LDAPCertPair, reverse), SEC_AnyTemplate },
+        SEC_ASN1_EXPLICIT | SEC_ASN1_XTRN | 1,
+        offsetof(LDAPCertPair, reverse), SEC_ASN1_SUB(SEC_AnyTemplate) },
    { 0 }
 };

@ -74,7 +78,7 @@ const SEC_ASN1Template PKIX_PL_LDAPCrossCertPairTemplate[] = {
 * LDAPString ::= OCTET STRING
 */

-#define LDAPStringTemplate SEC_OctetStringTemplate
+#define LDAPStringTemplate SEC_ASN1_SUB(SEC_OctetStringTemplate)

 static const SEC_ASN1Template LDAPBindApplTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL },
@ -153,8 +157,8 @@ static const SEC_ASN1Template LDAPBindResponseTemplate[] = {
 */

 static const SEC_ASN1Template LDAPUnbindTemplate[] = {
-    { SEC_ASN1_CONSTRUCTED | SEC_ASN1_APPLICATION | LDAP_UNBIND_TYPE, 0,
-        SEC_NullTemplate }
+    { SEC_ASN1_CONSTRUCTED | SEC_ASN1_APPLICATION | SEC_ASN1_XTRN |
+        LDAP_UNBIND_TYPE , 0, SEC_ASN1_SUB(SEC_NullTemplate) }
 };

 /*
@ -192,12 +196,18 @@ static const SEC_ASN1Template LDAPUnbindTemplate[] = {
 static const SEC_ASN1Template LDAPSubstringFilterChoiceTemplate[] = {
    { SEC_ASN1_CHOICE, offsetof(LDAPSubstring, selector), 0,
        sizeof (LDAPFilter) },
-    { SEC_ASN1_CONTEXT_SPECIFIC | 0, offsetof(LDAPSubstring, item),
-        LDAPSubstringFilterInitialTemplate, LDAP_INITIALSUBSTRING_TYPE },
-    { SEC_ASN1_CONTEXT_SPECIFIC | 1, offsetof(LDAPSubstring, item),
-        LDAPSubstringFilterAnyTemplate, LDAP_ANYSUBSTRING_TYPE },
-    { SEC_ASN1_CONTEXT_SPECIFIC | 2, offsetof(LDAPSubstring, item),
-        LDAPSubstringFilterFinalTemplate, LDAP_FINALSUBSTRING_TYPE },
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0,
+        offsetof(LDAPSubstring, item),
+        LDAPSubstringFilterInitialTemplate,
+        LDAP_INITIALSUBSTRING_TYPE },
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1,
+        offsetof(LDAPSubstring, item),
+        LDAPSubstringFilterAnyTemplate,
+        LDAP_ANYSUBSTRING_TYPE },
+    { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 2,
+        offsetof(LDAPSubstring, item),
+        LDAPSubstringFilterFinalTemplate,
+        LDAP_FINALSUBSTRING_TYPE },
    { 0 }
 };

@ -352,7 +362,8 @@ static const SEC_ASN1Template LDAPSearchTemplate[] = {
 static const SEC_ASN1Template LDAPSearchResponseAttrTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(LDAPSearchResponseAttr) },
    { SEC_ASN1_LDAP_STRING, offsetof(LDAPSearchResponseAttr, attrType) },
-    { SEC_ASN1_SET_OF, offsetof(LDAPSearchResponseAttr, val), LDAPStringTemplate },
+    { SEC_ASN1_SET_OF | SEC_ASN1_XTRN, offsetof(LDAPSearchResponseAttr, val),
+        LDAPStringTemplate },
    { 0 }
 };

--- a/mozilla/security/nss/lib/nss/config.mk
+++ b/mozilla/security/nss/lib/nss/config.mk
@ -53,6 +53,7 @@ RESNAME = $(LIBRARY_NAME).rc
 ifdef NS_USE_GCC
 EXTRA_SHARED_LIBS += \
 	-L$(DIST)/lib \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
@ -60,6 +61,7 @@ EXTRA_SHARED_LIBS += \
 	$(NULL)
 else # ! NS_USE_GCC
 EXTRA_SHARED_LIBS += \
+	$(DIST)/lib/nssutil3.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
@ -72,6 +74,7 @@ else
 # $(EXTRA_SHARED_LIBS) come before $(OS_LIBS), except on AIX.
 EXTRA_SHARED_LIBS += \
 	-L$(DIST)/lib \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
@ -87,7 +90,6 @@ SHARED_LIBRARY_LIBS = \
 	$(DIST)/lib/$(LIB_PREFIX)cryptohi.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)pk11wrap.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)certdb.$(LIB_SUFFIX) \
-	$(DIST)/lib/$(LIB_PREFIX)secutil.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)nsspki.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)nssdev.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)nssb.$(LIB_SUFFIX) \
@ -109,7 +111,6 @@ SHARED_LIBRARY_DIRS = \
 	../cryptohi \
 	../pk11wrap \
 	../certdb \
-	../util \
 	../pki \
 	../dev \
 	../base \
--- a/mozilla/security/nss/lib/nss/manifest.mn
+++ b/mozilla/security/nss/lib/nss/manifest.mn
@ -49,6 +49,7 @@ MODULE = nss
 CSRCS = \
 	nssinit.c \
 	nssver.c \
+	utilwrap.c \
 	$(NULL)

 REQUIRES = dbm
--- a/mozilla/security/nss/lib/nss/nss.def
+++ b/mozilla/security/nss/lib/nss/nss.def
@ -375,6 +375,7 @@ VFY_VerifyDigest;
 ;+# Data objects
 ;+#
 ;+# Don't export these DATA symbols on Windows because they don't work right.
+;+# Use the SEC_ASN1_GET / SEC_ASN1_SUB / SEC_ASN1_XTRN macros to access them.
 ;;CERT_CrlTemplate DATA ;
 ;;CERT_SignedDataTemplate DATA ;
 ;;CERT_CertificateTemplate DATA ;
@ -843,6 +844,7 @@ SECOID_AddEntry;
 ;+# Data objects
 ;+#
 ;+# Don't export these DATA symbols on Windows because they don't work right.
+;+# Use the SEC_ASN1_GET / SEC_ASN1_SUB / SEC_ASN1_XTRN macros to access them.
 ;;CERT_SequenceOfCertExtensionTemplate DATA ;
 ;;CERT_SignedCrlTemplate DATA ;
 NSS_Get_CERT_SequenceOfCertExtensionTemplate;
@ -919,7 +921,6 @@ SECKEY_ECParamsToBasePointOrderLen;
 SECKEY_ECParamsToKeySize;
 SECMOD_DeleteModuleEx;
 SEC_GetRegisteredHttpClient;
-SEC_StringToOID;
 VFY_CreateContextDirect;
 VFY_CreateContextWithAlgorithmID;
 VFY_VerifyDataDirect;
--- a/mozilla/security/nss/lib/nss/nssrenam.h
+++ b/mozilla/security/nss/lib/nss/nssrenam.h
@ -41,7 +41,6 @@
 #define CERT_AddTempCertToPerm __CERT_AddTempCertToPerm
 #define PK11_CreateContextByRawKey __PK11_CreateContextByRawKey
 #define PK11_GetKeyData __PK11_GetKeyData
-#define nss_InitLock __nss_InitLock
 #define CERT_ClosePermCertDB __CERT_ClosePermCertDB
 #define CERT_DecodeDERCertificate __CERT_DecodeDERCertificate
 #define CERT_TraversePermCertsForNickname __CERT_TraversePermCertsForNickname
--- a/mozilla/security/nss/lib/nss/utilwrap.c
+++ b/mozilla/security/nss/lib/nss/utilwrap.c
@ -0,0 +1,840 @@
+/*
+ * NSS utility functions
+ *
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is the Network Security Services libraries.
+ *
+ * The Initial Developer of the Original Code is
+ * Sun Microsystems, Inc.
+ * Portions created by the Initial Developer are Copyright (C) 2007
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "secport.h"
+#include "secoid.h"
+#include "secitem.h"
+#include "secdig.h"
+#include "secder.h"
+#include "secasn1.h"
+#include "base64.h"
+#include "nssb64.h"
+#include "nssrwlk.h"
+#include "nsslocks.h"
+#include "cert.h"
+
+/* wrappers for implementation in libnssutil3 */
+#undef __nss_InitLock
+#undef ATOB_AsciiToData
+#undef ATOB_ConvertAsciiToItem
+#undef BTOA_ConvertItemToAscii
+#undef BTOA_DataToAscii
+#undef CERT_CreateValidity
+#undef CERT_DestroyValidity
+#undef CERT_GenTime2FormattedAscii
+#undef DER_AsciiToTime
+#undef DER_DecodeTimeChoice
+#undef DER_Encode
+#undef DER_EncodeTimeChoice
+#undef DER_GeneralizedDayToAscii
+#undef DER_GeneralizedTimeToTime
+#undef DER_GetInteger
+#undef DER_Lengths
+#undef DER_TimeChoiceDayToAscii
+#undef DER_TimeToGeneralizedTime
+#undef DER_TimeToGeneralizedTimeArena
+#undef DER_TimeToUTCTime
+#undef DER_UTCDayToAscii
+#undef DER_UTCTimeToAscii
+#undef DER_UTCTimeToTime
+#undef NSS_PutEnv
+#undef NSSBase64_DecodeBuffer
+#undef NSSBase64_EncodeItem
+#undef NSSBase64Decoder_Create
+#undef NSSBase64Decoder_Destroy
+#undef NSSBase64Decoder_Update
+#undef NSSBase64Encoder_Create
+#undef NSSBase64Encoder_Destroy
+#undef NSSBase64Encoder_Update
+#undef NSSRWLock_Destroy
+#undef NSSRWLock_HaveWriteLock
+#undef NSSRWLock_LockRead
+#undef NSSRWLock_LockWrite
+#undef NSSRWLock_New
+#undef NSSRWLock_UnlockRead
+#undef NSSRWLock_UnlockWrite
+#undef PORT_Alloc
+#undef PORT_ArenaAlloc
+#undef PORT_ArenaGrow
+#undef PORT_ArenaMark
+#undef PORT_ArenaRelease
+#undef PORT_ArenaStrdup
+#undef PORT_ArenaUnmark
+#undef PORT_ArenaZAlloc
+#undef PORT_Free
+#undef PORT_FreeArena
+#undef PORT_GetError
+#undef PORT_NewArena
+#undef PORT_Realloc
+#undef PORT_SetError
+#undef PORT_SetUCS2_ASCIIConversionFunction
+#undef PORT_SetUCS2_UTF8ConversionFunction
+#undef PORT_SetUCS4_UTF8ConversionFunction
+#undef PORT_Strdup
+#undef PORT_UCS2_ASCIIConversion
+#undef PORT_UCS2_UTF8Conversion
+#undef PORT_ZAlloc
+#undef PORT_ZFree
+#undef SEC_ASN1Decode
+#undef SEC_ASN1DecodeInteger
+#undef SEC_ASN1DecodeItem
+#undef SEC_ASN1DecoderAbort
+#undef SEC_ASN1DecoderClearFilterProc
+#undef SEC_ASN1DecoderClearNotifyProc
+#undef SEC_ASN1DecoderFinish
+#undef SEC_ASN1DecoderSetFilterProc
+#undef SEC_ASN1DecoderSetNotifyProc
+#undef SEC_ASN1DecoderStart
+#undef SEC_ASN1DecoderUpdate
+#undef SEC_ASN1Encode
+#undef SEC_ASN1EncodeInteger
+#undef SEC_ASN1EncodeItem
+#undef SEC_ASN1EncoderAbort
+#undef SEC_ASN1EncoderClearNotifyProc
+#undef SEC_ASN1EncoderClearStreaming
+#undef SEC_ASN1EncoderClearTakeFromBuf
+#undef SEC_ASN1EncoderFinish
+#undef SEC_ASN1EncoderSetNotifyProc
+#undef SEC_ASN1EncoderSetStreaming
+#undef SEC_ASN1EncoderSetTakeFromBuf
+#undef SEC_ASN1EncoderStart
+#undef SEC_ASN1EncoderUpdate
+#undef SEC_ASN1EncodeUnsignedInteger
+#undef SEC_ASN1LengthLength
+#undef SEC_QuickDERDecodeItem
+#undef SECITEM_AllocItem
+#undef SECITEM_ArenaDupItem
+#undef SECITEM_CompareItem
+#undef SECITEM_CopyItem
+#undef SECITEM_DupItem
+#undef SECITEM_FreeItem
+#undef SECITEM_ItemsAreEqual
+#undef SECITEM_ZfreeItem
+#undef SECOID_AddEntry
+#undef SECOID_CompareAlgorithmID
+#undef SECOID_CopyAlgorithmID
+#undef SECOID_DestroyAlgorithmID
+#undef SECOID_FindOID
+#undef SECOID_FindOIDByTag
+#undef SECOID_FindOIDTag
+#undef SECOID_FindOIDTagDescription
+#undef SECOID_GetAlgorithmTag
+#undef SECOID_SetAlgorithmID
+#undef SGN_CompareDigestInfo
+#undef SGN_CopyDigestInfo
+#undef SGN_CreateDigestInfo
+#undef SGN_DestroyDigestInfo
+
+void *
+PORT_Alloc(size_t bytes)
+{
+    return PORT_Alloc_Util(bytes);
+}
+
+void *
+PORT_Realloc(void *oldptr, size_t bytes)
+{
+    return PORT_Realloc_Util(oldptr, bytes);
+}
+
+void *
+PORT_ZAlloc(size_t bytes)
+{
+    return PORT_ZAlloc_Util(bytes);
+}
+
+void
+PORT_Free(void *ptr)
+{
+    PORT_Free_Util(ptr);
+}
+
+void
+PORT_ZFree(void *ptr, size_t len)
+{
+    PORT_ZFree_Util(ptr, len);
+}
+
+char *
+PORT_Strdup(const char *str)
+{
+    return PORT_Strdup_Util(str);
+}
+
+void
+PORT_SetError(int value)
+{
+    PORT_SetError_Util(value);
+}
+
+int
+PORT_GetError(void)
+{
+    return PORT_GetError_Util();
+}
+
+PLArenaPool *
+PORT_NewArena(unsigned long chunksize)
+{
+    return PORT_NewArena_Util(chunksize);
+}
+
+void *
+PORT_ArenaAlloc(PLArenaPool *arena, size_t size)
+{
+    return PORT_ArenaAlloc_Util(arena, size);
+}
+
+void *
+PORT_ArenaZAlloc(PLArenaPool *arena, size_t size)
+{
+    return PORT_ArenaZAlloc_Util(arena, size);
+}
+
+void
+PORT_FreeArena(PLArenaPool *arena, PRBool zero)
+{
+    PORT_FreeArena_Util(arena, zero);
+}
+
+void *
+PORT_ArenaGrow(PLArenaPool *arena, void *ptr, size_t oldsize, size_t newsize)
+{
+    return PORT_ArenaGrow_Util(arena, ptr, oldsize, newsize);
+}
+
+void *
+PORT_ArenaMark(PLArenaPool *arena)
+{
+    return PORT_ArenaMark_Util(arena);
+}
+
+void
+PORT_ArenaRelease(PLArenaPool *arena, void *mark)
+{
+    PORT_ArenaRelease_Util(arena, mark);
+}
+
+void
+PORT_ArenaUnmark(PLArenaPool *arena, void *mark)
+{
+    PORT_ArenaUnmark_Util(arena, mark);
+}
+
+char *
+PORT_ArenaStrdup(PLArenaPool *arena, const char *str)
+{
+    return PORT_ArenaStrdup_Util(arena, str);
+}
+
+void
+PORT_SetUCS4_UTF8ConversionFunction(PORTCharConversionFunc convFunc)
+{
+    PORT_SetUCS4_UTF8ConversionFunction_Util(convFunc);
+}
+
+void
+PORT_SetUCS2_ASCIIConversionFunction(PORTCharConversionWSwapFunc convFunc)
+{ 
+    PORT_SetUCS2_ASCIIConversionFunction_Util(convFunc);
+}
+
+void
+PORT_SetUCS2_UTF8ConversionFunction(PORTCharConversionFunc convFunc)
+{ 
+    PORT_SetUCS2_UTF8ConversionFunction_Util(convFunc);
+}
+
+PRBool 
+PORT_UCS2_UTF8Conversion(PRBool toUnicode, unsigned char *inBuf,
+			 unsigned int inBufLen, unsigned char *outBuf,
+			 unsigned int maxOutBufLen, unsigned int *outBufLen)
+{
+    return PORT_UCS2_UTF8Conversion_Util(toUnicode, inBuf, inBufLen, outBuf,
+                                          maxOutBufLen, outBufLen);
+} 
+
+PRBool 
+PORT_UCS2_ASCIIConversion(PRBool toUnicode, unsigned char *inBuf,
+			  unsigned int inBufLen, unsigned char *outBuf,
+			  unsigned int maxOutBufLen, unsigned int *outBufLen,
+			  PRBool swapBytes)
+{
+    return PORT_UCS2_ASCIIConversion_Util(toUnicode, inBuf, inBufLen, outBuf,
+			  maxOutBufLen, outBufLen, swapBytes);
+}
+
+int
+NSS_PutEnv(const char * envVarName, const char * envValue)
+{
+    return NSS_PutEnv_Util(envVarName, envValue);
+}
+
+SECOidData *SECOID_FindOID( const SECItem *oid)
+{
+    return SECOID_FindOID_Util(oid);
+}
+
+SECOidTag SECOID_FindOIDTag(const SECItem *oid)
+{
+    return SECOID_FindOIDTag_Util(oid);
+}
+
+SECOidData *SECOID_FindOIDByTag(SECOidTag tagnum)
+{
+    return SECOID_FindOIDByTag_Util(tagnum);
+}
+
+SECStatus SECOID_SetAlgorithmID(PRArenaPool *arena, SECAlgorithmID *aid,
+				   SECOidTag tag, SECItem *params)
+{
+    return SECOID_SetAlgorithmID_Util(arena, aid, tag, params);
+}
+
+SECStatus SECOID_CopyAlgorithmID(PRArenaPool *arena, SECAlgorithmID *dest,
+				    SECAlgorithmID *src)
+{
+    return SECOID_CopyAlgorithmID_Util(arena, dest, src);
+}
+
+SECOidTag SECOID_GetAlgorithmTag(SECAlgorithmID *aid)
+{
+    return SECOID_GetAlgorithmTag_Util(aid);
+}
+
+void SECOID_DestroyAlgorithmID(SECAlgorithmID *aid, PRBool freeit)
+{
+    SECOID_DestroyAlgorithmID_Util(aid, freeit);
+}
+
+SECComparison SECOID_CompareAlgorithmID(SECAlgorithmID *a,
+					   SECAlgorithmID *b)
+{
+    return SECOID_CompareAlgorithmID_Util(a, b);
+}
+
+const char *SECOID_FindOIDTagDescription(SECOidTag tagnum)
+{
+    return SECOID_FindOIDTagDescription_Util(tagnum);
+}
+
+SECOidTag SECOID_AddEntry(const SECOidData * src)
+{
+    return SECOID_AddEntry_Util(src);
+}
+
+SECItem *SECITEM_AllocItem(PRArenaPool *arena, SECItem *item,
+				  unsigned int len)
+{
+    return SECITEM_AllocItem_Util(arena, item, len);
+}
+
+SECComparison SECITEM_CompareItem(const SECItem *a, const SECItem *b)
+{
+    return SECITEM_CompareItem_Util(a, b);
+}
+
+PRBool SECITEM_ItemsAreEqual(const SECItem *a, const SECItem *b)
+{
+    return SECITEM_ItemsAreEqual_Util(a, b);
+}
+
+SECStatus SECITEM_CopyItem(PRArenaPool *arena, SECItem *to, 
+                                  const SECItem *from)
+{
+    return SECITEM_CopyItem_Util(arena, to, from);
+}
+
+SECItem *SECITEM_DupItem(const SECItem *from)
+{
+    return SECITEM_DupItem_Util(from);
+}
+
+SECItem *SECITEM_ArenaDupItem(PRArenaPool *arena, const SECItem *from)
+{
+    return SECITEM_ArenaDupItem_Util(arena, from);
+}
+
+void SECITEM_FreeItem(SECItem *zap, PRBool freeit)
+{
+    SECITEM_FreeItem_Util(zap, freeit);
+}
+
+void SECITEM_ZfreeItem(SECItem *zap, PRBool freeit)
+{
+    SECITEM_ZfreeItem_Util(zap, freeit);
+}
+
+SGNDigestInfo *SGN_CreateDigestInfo(SECOidTag algorithm,
+					   unsigned char *sig,
+					   unsigned int sigLen)
+{
+    return SGN_CreateDigestInfo_Util(algorithm, sig, sigLen);
+}
+
+void SGN_DestroyDigestInfo(SGNDigestInfo *info)
+{
+    SGN_DestroyDigestInfo_Util(info);
+}
+
+SECStatus  SGN_CopyDigestInfo(PRArenaPool *poolp,
+					SGNDigestInfo *a, 
+					SGNDigestInfo *b)
+{
+    return SGN_CopyDigestInfo_Util(poolp, a, b);
+}
+
+SECComparison SGN_CompareDigestInfo(SGNDigestInfo *a, SGNDigestInfo *b)
+{
+    return SGN_CompareDigestInfo_Util(a, b);
+}
+
+SECStatus DER_Encode(PRArenaPool *arena, SECItem *dest, DERTemplate *t,
+			   void *src)
+{
+    return DER_Encode_Util(arena, dest, t, src);
+}
+
+SECStatus DER_Lengths(SECItem *item, int *header_len_p,
+                             PRUint32 *contents_len_p)
+{
+    return DER_Lengths_Util(item, header_len_p, contents_len_p);
+}
+
+long DER_GetInteger(SECItem *src)
+{
+    return DER_GetInteger_Util(src);
+}
+
+SECStatus DER_TimeToUTCTime(SECItem *result, int64 time)
+{
+    return DER_TimeToUTCTime_Util(result, time);
+}
+
+SECStatus DER_AsciiToTime(int64 *result, const char *string)
+{
+    return DER_AsciiToTime_Util(result, string);
+}
+
+SECStatus DER_UTCTimeToTime(int64 *result, const SECItem *time)
+{
+    return DER_UTCTimeToTime_Util(result, time);
+}
+
+char *DER_UTCTimeToAscii(SECItem *utcTime)
+{
+    return DER_UTCTimeToAscii_Util(utcTime);
+}
+
+char *DER_UTCDayToAscii(SECItem *utctime)
+{
+    return DER_UTCDayToAscii_Util(utctime);
+}
+
+char *DER_GeneralizedDayToAscii(SECItem *gentime)
+{
+    return DER_GeneralizedDayToAscii_Util(gentime);
+}
+
+char *DER_TimeChoiceDayToAscii(SECItem *timechoice)
+{
+    return DER_TimeChoiceDayToAscii_Util(timechoice);
+}
+
+SECStatus DER_TimeToGeneralizedTime(SECItem *dst, int64 gmttime)
+{
+    return DER_TimeToGeneralizedTime_Util(dst, gmttime);
+}
+
+SECStatus DER_TimeToGeneralizedTimeArena(PRArenaPool* arenaOpt,
+                                                SECItem *dst, int64 gmttime)
+{
+    return DER_TimeToGeneralizedTimeArena_Util(arenaOpt, dst, gmttime);
+}
+
+SECStatus DER_GeneralizedTimeToTime(int64 *dst, const SECItem *time)
+{
+    return DER_GeneralizedTimeToTime_Util(dst, time);
+}
+
+char *CERT_GenTime2FormattedAscii (int64 genTime, char *format)
+{
+    return CERT_GenTime2FormattedAscii_Util(genTime, format);
+}
+
+SECStatus DER_DecodeTimeChoice(PRTime* output, const SECItem* input)
+{
+    return DER_DecodeTimeChoice_Util(output, input);
+}
+
+SECStatus DER_EncodeTimeChoice(PRArenaPool* arena, SECItem* output,
+                                       PRTime input)
+{
+    return DER_EncodeTimeChoice_Util(arena, output, input);
+}
+
+SEC_ASN1DecoderContext *SEC_ASN1DecoderStart(PRArenaPool *pool,
+						    void *dest,
+						    const SEC_ASN1Template *t)
+{
+    return SEC_ASN1DecoderStart_Util(pool, dest, t);
+}
+
+SECStatus SEC_ASN1DecoderUpdate(SEC_ASN1DecoderContext *cx,
+				       const char *buf,
+				       unsigned long len)
+{
+    return SEC_ASN1DecoderUpdate_Util(cx, buf, len);
+}
+
+SECStatus SEC_ASN1DecoderFinish(SEC_ASN1DecoderContext *cx)
+{
+    return SEC_ASN1DecoderFinish_Util(cx);
+}
+
+void SEC_ASN1DecoderAbort(SEC_ASN1DecoderContext *cx, int error)
+{
+    SEC_ASN1DecoderAbort_Util(cx, error);
+}
+
+void SEC_ASN1DecoderSetFilterProc(SEC_ASN1DecoderContext *cx,
+					 SEC_ASN1WriteProc fn,
+					 void *arg, PRBool no_store)
+{
+    SEC_ASN1DecoderSetFilterProc_Util(cx, fn, arg, no_store);
+}
+
+void SEC_ASN1DecoderClearFilterProc(SEC_ASN1DecoderContext *cx)
+{
+    SEC_ASN1DecoderClearFilterProc_Util(cx);
+}
+
+void SEC_ASN1DecoderSetNotifyProc(SEC_ASN1DecoderContext *cx,
+					 SEC_ASN1NotifyProc fn,
+					 void *arg)
+{
+    SEC_ASN1DecoderSetNotifyProc_Util(cx, fn, arg);
+}
+
+void SEC_ASN1DecoderClearNotifyProc(SEC_ASN1DecoderContext *cx)
+{
+    SEC_ASN1DecoderClearNotifyProc_Util(cx);
+}
+
+SECStatus SEC_ASN1Decode(PRArenaPool *pool, void *dest,
+				const SEC_ASN1Template *t,
+				const char *buf, long len)
+{
+    return SEC_ASN1Decode_Util(pool, dest, t, buf, len);
+}
+
+SECStatus SEC_ASN1DecodeItem(PRArenaPool *pool, void *dest,
+				    const SEC_ASN1Template *t,
+				    const SECItem *src)
+{
+    return SEC_ASN1DecodeItem_Util(pool, dest, t, src);
+}
+
+SECStatus SEC_QuickDERDecodeItem(PRArenaPool* arena, void* dest,
+                     const SEC_ASN1Template* templateEntry,
+                     const SECItem* src)
+{
+    return SEC_QuickDERDecodeItem_Util(arena, dest, templateEntry, src);
+}
+
+SEC_ASN1EncoderContext *SEC_ASN1EncoderStart(const void *src,
+						    const SEC_ASN1Template *t,
+						    SEC_ASN1WriteProc fn,
+						    void *output_arg)
+{
+    return SEC_ASN1EncoderStart_Util(src, t, fn, output_arg);
+}
+
+SECStatus SEC_ASN1EncoderUpdate(SEC_ASN1EncoderContext *cx,
+				       const char *buf,
+				       unsigned long len)
+{
+    return SEC_ASN1EncoderUpdate_Util(cx, buf, len);
+}
+
+void SEC_ASN1EncoderFinish(SEC_ASN1EncoderContext *cx)
+{
+    SEC_ASN1EncoderFinish_Util(cx);
+}
+
+void SEC_ASN1EncoderAbort(SEC_ASN1EncoderContext *cx, int error)
+{
+    SEC_ASN1EncoderAbort_Util(cx, error);
+}
+
+void SEC_ASN1EncoderSetNotifyProc(SEC_ASN1EncoderContext *cx,
+					 SEC_ASN1NotifyProc fn,
+					 void *arg)
+{
+    SEC_ASN1EncoderSetNotifyProc_Util(cx, fn, arg);
+}
+
+void SEC_ASN1EncoderClearNotifyProc(SEC_ASN1EncoderContext *cx)
+{
+    SEC_ASN1EncoderClearNotifyProc_Util(cx);
+}
+
+void SEC_ASN1EncoderSetStreaming(SEC_ASN1EncoderContext *cx)
+{
+    SEC_ASN1EncoderSetStreaming_Util(cx);
+}
+
+void SEC_ASN1EncoderClearStreaming(SEC_ASN1EncoderContext *cx)
+{
+    SEC_ASN1EncoderClearStreaming_Util(cx);
+}
+
+void SEC_ASN1EncoderSetTakeFromBuf(SEC_ASN1EncoderContext *cx)
+{
+    SEC_ASN1EncoderSetTakeFromBuf_Util(cx);
+}
+
+void SEC_ASN1EncoderClearTakeFromBuf(SEC_ASN1EncoderContext *cx)
+{
+    SEC_ASN1EncoderClearTakeFromBuf_Util(cx);
+}
+
+SECStatus SEC_ASN1Encode(const void *src, const SEC_ASN1Template *t,
+				SEC_ASN1WriteProc output_proc,
+				void *output_arg)
+{
+    return SEC_ASN1Encode_Util(src, t, output_proc, output_arg);
+}
+
+SECItem * SEC_ASN1EncodeItem(PRArenaPool *pool, SECItem *dest,
+				    const void *src, const SEC_ASN1Template *t)
+{
+    return SEC_ASN1EncodeItem_Util(pool, dest, src, t);
+}
+
+SECItem * SEC_ASN1EncodeInteger(PRArenaPool *pool,
+				       SECItem *dest, long value)
+{
+    return SEC_ASN1EncodeInteger_Util(pool, dest, value);
+}
+
+SECItem * SEC_ASN1EncodeUnsignedInteger(PRArenaPool *pool,
+					       SECItem *dest,
+					       unsigned long value)
+{
+    return SEC_ASN1EncodeUnsignedInteger_Util(pool, dest, value);
+}
+
+SECStatus SEC_ASN1DecodeInteger(SECItem *src,
+				       unsigned long *value)
+{
+    return SEC_ASN1DecodeInteger_Util(src, value);
+}
+
+int SEC_ASN1LengthLength (unsigned long len)
+{
+    return SEC_ASN1LengthLength_Util(len);
+}
+
+char *BTOA_DataToAscii(const unsigned char *data, unsigned int len)
+{
+    return BTOA_DataToAscii_Util(data, len);
+}
+
+unsigned char *ATOB_AsciiToData(const char *string, unsigned int *lenp)
+{
+    return ATOB_AsciiToData_Util(string, lenp);
+}
+ 
+SECStatus ATOB_ConvertAsciiToItem(SECItem *binary_item, char *ascii)
+{
+    return ATOB_ConvertAsciiToItem_Util(binary_item, ascii);
+}
+
+char *BTOA_ConvertItemToAscii(SECItem *binary_item)
+{
+    return BTOA_ConvertItemToAscii_Util(binary_item);
+}
+
+NSSBase64Decoder *
+NSSBase64Decoder_Create (PRInt32 (*output_fn) (void *, const unsigned char *,
+					       PRInt32),
+			 void *output_arg)
+{
+    return NSSBase64Decoder_Create_Util(output_fn, output_arg);
+}
+
+NSSBase64Encoder *
+NSSBase64Encoder_Create (PRInt32 (*output_fn) (void *, const char *, PRInt32),
+			 void *output_arg)
+{
+    return NSSBase64Encoder_Create_Util(output_fn, output_arg);
+}
+
+SECStatus
+NSSBase64Decoder_Update (NSSBase64Decoder *data, const char *buffer,
+			 PRUint32 size)
+{
+    return NSSBase64Decoder_Update_Util(data, buffer, size);
+}
+
+SECStatus
+NSSBase64Encoder_Update (NSSBase64Encoder *data, const unsigned char *buffer,
+			 PRUint32 size)
+{
+    return NSSBase64Encoder_Update_Util(data, buffer, size);
+}
+
+SECStatus
+NSSBase64Decoder_Destroy (NSSBase64Decoder *data, PRBool abort_p)
+{
+    return NSSBase64Decoder_Destroy_Util(data, abort_p);
+}
+
+SECStatus
+NSSBase64Encoder_Destroy (NSSBase64Encoder *data, PRBool abort_p)
+{
+    return NSSBase64Encoder_Destroy_Util(data, abort_p);
+}
+
+SECItem *
+NSSBase64_DecodeBuffer (PRArenaPool *arenaOpt, SECItem *outItemOpt,
+			const char *inStr, unsigned int inLen)
+{
+    return NSSBase64_DecodeBuffer_Util(arenaOpt, outItemOpt, inStr, inLen);
+}
+
+char *
+NSSBase64_EncodeItem (PRArenaPool *arenaOpt, char *outStrOpt,
+		      unsigned int maxOutLen, SECItem *inItem)
+{
+    return NSSBase64_EncodeItem_Util(arenaOpt, outStrOpt, maxOutLen, inItem);
+}
+
+NSSRWLock* NSSRWLock_New(PRUint32 lock_rank, const char *lock_name)
+{
+    return NSSRWLock_New_Util(lock_rank, lock_name);
+}
+
+void NSSRWLock_Destroy(NSSRWLock *lock)
+{
+    NSSRWLock_Destroy_Util(lock);
+}
+
+void NSSRWLock_LockRead(NSSRWLock *lock)
+{
+    NSSRWLock_LockRead_Util(lock);
+}
+
+void NSSRWLock_LockWrite(NSSRWLock *lock)
+{
+    NSSRWLock_LockWrite_Util(lock);
+}
+
+void NSSRWLock_UnlockRead(NSSRWLock *lock)
+{
+    NSSRWLock_UnlockRead_Util(lock);
+}
+
+void NSSRWLock_UnlockWrite(NSSRWLock *lock)
+{
+    NSSRWLock_UnlockWrite_Util(lock);
+}
+
+PRBool NSSRWLock_HaveWriteLock(NSSRWLock *rwlock)
+{
+    return NSSRWLock_HaveWriteLock_Util(rwlock);
+}
+
+SECStatus __nss_InitLock(   PZLock    **ppLock, nssILockType ltype )
+{
+    return __nss_InitLock_Util(ppLock, ltype);
+}
+
+CERTValidity *CERT_CreateValidity(int64 notBefore, int64 notAfter)
+{
+    return CERT_CreateValidity_Util(notBefore, notAfter);
+}
+
+void CERT_DestroyValidity(CERTValidity *v)
+{
+    CERT_DestroyValidity_Util(v);
+}
+
+/* templates duplicated in libnss3 and libnssutil3 */
+
+#undef CERT_TimeChoiceTemplate
+#undef NSS_Get_CERT_TimeChoiceTemplate
+#undef NSS_Get_SEC_AnyTemplate
+#undef NSS_Get_SEC_BitStringTemplate
+#undef NSS_Get_SEC_BMPStringTemplate
+#undef NSS_Get_SEC_BooleanTemplate
+#undef NSS_Get_SEC_GeneralizedTimeTemplate
+#undef NSS_Get_SEC_IA5StringTemplate
+#undef NSS_Get_SEC_IntegerTemplate
+#undef NSS_Get_SEC_NullTemplate
+#undef NSS_Get_SEC_ObjectIDTemplate
+#undef NSS_Get_SEC_OctetStringTemplate
+#undef NSS_Get_SEC_PointerToAnyTemplate
+#undef NSS_Get_SEC_PointerToOctetStringTemplate
+#undef NSS_Get_SEC_SetOfAnyTemplate
+#undef NSS_Get_SEC_UTCTimeTemplate
+#undef NSS_Get_SEC_UTF8StringTemplate
+#undef NSS_Get_SECOID_AlgorithmIDTemplate
+#undef NSS_Get_sgn_DigestInfoTemplate
+#undef SEC_AnyTemplate
+#undef SEC_BitStringTemplate
+#undef SEC_BMPStringTemplate
+#undef SEC_BooleanTemplate
+#undef SEC_GeneralizedTimeTemplate
+#undef SEC_IA5StringTemplate
+#undef SEC_IntegerTemplate
+#undef SEC_NullTemplate
+#undef SEC_ObjectIDTemplate
+#undef SEC_OctetStringTemplate
+#undef SEC_PointerToAnyTemplate
+#undef SEC_PointerToOctetStringTemplate
+#undef SEC_SetOfAnyTemplate
+#undef SEC_UTCTimeTemplate
+#undef SEC_UTF8StringTemplate
+#undef SECOID_AlgorithmIDTemplate
+#undef sgn_DigestInfoTemplate
+
+#include "templates.c"
+
--- a/mozilla/security/nss/lib/pk11wrap/pk11cert.c
+++ b/mozilla/security/nss/lib/pk11wrap/pk11cert.c
@ -1217,7 +1217,7 @@ PK11_FindCertByIssuerAndSNOnToken(PK11SlotInfo *slot,
     */
    derSerial = SEC_ASN1EncodeItem(NULL, NULL,
                                   &issuerSN->serialNumber,
-                                   SEC_IntegerTemplate);
+                                   SEC_ASN1_GET(SEC_IntegerTemplate));
    if (!derSerial) {
 	return NULL;
    }
@ -1556,7 +1556,7 @@ PK11_FindCertByIssuerAndSN(PK11SlotInfo **slotPtr, CERTIssuerAndSN *issuerSN,
     */
    derSerial = SEC_ASN1EncodeItem(NULL, NULL,
                                   &issuerSN->serialNumber,
-                                   SEC_IntegerTemplate);
+                                   SEC_ASN1_GET(SEC_IntegerTemplate));
    if (!derSerial) {
 	return NULL;
    }
--- a/mozilla/security/nss/lib/pk11wrap/pk11mech.c
+++ b/mozilla/security/nss/lib/pk11wrap/pk11mech.c
@ -1274,8 +1274,9 @@ PK11_ParamFromAlgid(SECAlgorithmID *algid)
    case CKM_JUNIPER_COUNTER:
    case CKM_JUNIPER_SHUFFLE:
 	/* simple cases are simply octet string encoded IVs */
-	rv = SEC_ASN1DecodeItem(arena, &iv, SEC_OctetStringTemplate, 
-					    &(algid->parameters));
+	rv = SEC_ASN1DecodeItem(arena, &iv,
+                                SEC_ASN1_GET(SEC_OctetStringTemplate),
+                                &(algid->parameters));
 	if (rv != SECSuccess || iv.data == NULL) {
 	    goto loser;
 	}
@ -1597,7 +1598,7 @@ PK11_ParamToAlgid(SECOidTag algTag, SECItem *param,
    case CKM_JUNIPER_COUNTER:
    case CKM_JUNIPER_SHUFFLE:
 	newParams = SEC_ASN1EncodeItem(NULL,NULL,param,
-						SEC_OctetStringTemplate);
+                                       SEC_ASN1_GET(SEC_OctetStringTemplate) );
 	if (newParams == NULL)
 	    break;
 	rv = SECSuccess;
--- a/mozilla/security/nss/lib/pk11wrap/pk11pk12.c
+++ b/mozilla/security/nss/lib/pk11wrap/pk11pk12.c
@ -112,6 +112,8 @@ struct SECKEYRawPrivateKeyStr {
 };
 typedef struct SECKEYRawPrivateKeyStr SECKEYRawPrivateKey;

+SEC_ASN1_MKSUB(SEC_AnyTemplate);
+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate);

 /* ASN1 Templates for new decoder/encoder */
 /*
@ -121,8 +123,8 @@ const SEC_ASN1Template SECKEY_AttributeTemplate[] = {
    { SEC_ASN1_SEQUENCE,
        0, NULL, sizeof(SECKEYAttribute) },
    { SEC_ASN1_OBJECT_ID, offsetof(SECKEYAttribute, attrType) },
-    { SEC_ASN1_SET_OF, offsetof(SECKEYAttribute, attrValue),
-        SEC_AnyTemplate },
+    { SEC_ASN1_SET_OF | SEC_ASN1_XTRN, offsetof(SECKEYAttribute, attrValue),
+        SEC_ASN1_SUB(SEC_AnyTemplate) },
    { 0 }
 };

@ -133,8 +135,9 @@ const SEC_ASN1Template SECKEY_SetOfAttributeTemplate[] = {
 const SEC_ASN1Template SECKEY_PrivateKeyInfoTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(SECKEYPrivateKeyInfo) },
    { SEC_ASN1_INTEGER, offsetof(SECKEYPrivateKeyInfo,version) },
-    { SEC_ASN1_INLINE, offsetof(SECKEYPrivateKeyInfo,algorithm),
-        SECOID_AlgorithmIDTemplate },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+        offsetof(SECKEYPrivateKeyInfo,algorithm),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_OCTET_STRING, offsetof(SECKEYPrivateKeyInfo,privateKey) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
        offsetof(SECKEYPrivateKeyInfo,attributes),
@ -173,9 +176,9 @@ const SEC_ASN1Template SECKEY_DHPrivateKeyExportTemplate[] = {
 const SEC_ASN1Template SECKEY_EncryptedPrivateKeyInfoTemplate[] = {
    { SEC_ASN1_SEQUENCE,
        0, NULL, sizeof(SECKEYEncryptedPrivateKeyInfo) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
        offsetof(SECKEYEncryptedPrivateKeyInfo,algorithm),
-        SECOID_AlgorithmIDTemplate },
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_OCTET_STRING,
        offsetof(SECKEYEncryptedPrivateKeyInfo,encryptedData) },
    { 0 }
--- a/mozilla/security/nss/lib/pk11wrap/pk11sdr.c
+++ b/mozilla/security/nss/lib/pk11wrap/pk11sdr.c
@ -54,10 +54,13 @@ struct SDRResult
 };
 typedef struct SDRResult SDRResult;

+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate);
+
 static SEC_ASN1Template template[] = {
  { SEC_ASN1_SEQUENCE, 0, NULL, sizeof (SDRResult) },
  { SEC_ASN1_OCTET_STRING, offsetof(SDRResult, keyid) },
-  { SEC_ASN1_INLINE, offsetof(SDRResult, alg), SECOID_AlgorithmIDTemplate },
+  { SEC_ASN1_INLINE | SEC_ASN1_XTRN, offsetof(SDRResult, alg),
+    SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
  { SEC_ASN1_OCTET_STRING, offsetof(SDRResult, data) },
  { 0 }
 };
--- a/mozilla/security/nss/lib/smime/config.mk
+++ b/mozilla/security/nss/lib/smime/config.mk
@ -50,6 +50,7 @@ ifdef NS_USE_GCC
 EXTRA_SHARED_LIBS += \
 	-L$(DIST)/lib \
 	-lnss3 \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
@ -58,6 +59,7 @@ EXTRA_SHARED_LIBS += \
 else # ! NS_USE_GCC
 EXTRA_SHARED_LIBS += \
 	$(DIST)/lib/nss3.lib \
+	$(DIST)/lib/nssutil3.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
@ -69,6 +71,7 @@ else
 EXTRA_SHARED_LIBS += \
 	-L$(DIST)/lib \
 	-lnss3 \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
--- a/mozilla/security/nss/lib/softoken/config.mk
+++ b/mozilla/security/nss/lib/softoken/config.mk
@ -45,7 +45,6 @@ endif

 EXTRA_LIBS += \
 	$(CRYPTOLIB) \
-	$(DIST)/lib/$(LIB_PREFIX)secutil.$(LIB_SUFFIX) \
 	$(NULL)

 # can't do this in manifest.mn because OS_TARGET isn't defined there.
@ -61,6 +60,7 @@ RESNAME = $(LIBRARY_NAME).rc
 ifdef NS_USE_GCC
 EXTRA_SHARED_LIBS += \
 	-L$(DIST)/lib \
+	-lnssutil3 \
 	-lsqlite3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
@ -71,9 +71,11 @@ else # ! NS_USE_GCC

 EXTRA_SHARED_LIBS += \
 	$(DIST)/lib/sqlite3.lib \
+	$(DIST)/lib/nssutil3.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
+	$(DIST)/lib/nssutil3.lib \
 	$(NULL)
 endif # NS_USE_GCC

@ -83,6 +85,7 @@ else
 # $(EXTRA_SHARED_LIBS) come before $(OS_LIBS), except on AIX.
 EXTRA_SHARED_LIBS += \
 	-L$(DIST)/lib \
+	-lnssutil3 \
 	-lsqlite3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
--- a/mozilla/security/nss/lib/softoken/fipstest.c
+++ b/mozilla/security/nss/lib/softoken/fipstest.c
@ -36,7 +36,7 @@
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */
-/* $Id: fipstest.c,v 1.22 2007-06-13 00:24:56 rrelyea%redhat.com Exp $ */
+/* $Id: fipstest.c,v 1.23 2007-10-12 01:44:47 julien.pierre.boogz%sun.com Exp $ */

 #include "softoken.h"   /* Required for RC2-ECB, RC2-CBC, RC4, DES-ECB,  */
                        /*              DES-CBC, DES3-ECB, DES3-CBC, RSA */
@ -47,7 +47,6 @@
 #include "secerr.h"

 #ifdef NSS_ENABLE_ECC
-#include "secdert.h"    /* Required for ECDSA */
 #include "ec.h"         /* Required for ECDSA */
 #endif

--- a/mozilla/security/nss/lib/softoken/legacydb/config.mk
+++ b/mozilla/security/nss/lib/softoken/legacydb/config.mk
@ -45,7 +45,6 @@ endif

 EXTRA_LIBS += \
 	$(CRYPTOLIB) \
-	$(DIST)/lib/$(LIB_PREFIX)secutil.$(LIB_SUFFIX) \
 	$(DIST)/lib/$(LIB_PREFIX)dbm.$(LIB_SUFFIX) \
 	$(NULL)

@ -61,6 +60,8 @@ RESNAME = $(LIBRARY_NAME).rc

 ifdef NS_USE_GCC
 EXTRA_SHARED_LIBS += \
+	-L $(DIST)/lib \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
@ -72,6 +73,7 @@ EXTRA_SHARED_LIBS += \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
+	$(DIST)/lib/nssutil3.lib \
 	$(NULL)
 endif # NS_USE_GCC

@ -80,6 +82,8 @@ else
 # $(PROGRAM) has NO explicit dependencies on $(EXTRA_SHARED_LIBS)
 # $(EXTRA_SHARED_LIBS) come before $(OS_LIBS), except on AIX.
 EXTRA_SHARED_LIBS += \
+	-L $(DIST)/lib \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
--- a/mozilla/security/nss/lib/softoken/legacydb/keydb.c
+++ b/mozilla/security/nss/lib/softoken/legacydb/keydb.c
@ -34,7 +34,7 @@
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */
-/* $Id: keydb.c,v 1.5 2007-09-25 01:14:23 nelson%bolyard.com Exp $ */
+/* $Id: keydb.c,v 1.6 2007-10-12 01:44:48 julien.pierre.boogz%sun.com Exp $ */

 #include "lowkeyi.h"
 #include "secasn1.h"
@ -63,12 +63,14 @@
 /* Size of the global salt for key database */
 #define SALT_LENGTH     16

+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate);
+
 const SEC_ASN1Template nsslowkey_EncryptedPrivateKeyInfoTemplate[] = {
    { SEC_ASN1_SEQUENCE,
 	0, NULL, sizeof(NSSLOWKEYEncryptedPrivateKeyInfo) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	offsetof(NSSLOWKEYEncryptedPrivateKeyInfo,algorithm),
-	SECOID_AlgorithmIDTemplate },
+	SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_OCTET_STRING,
 	offsetof(NSSLOWKEYEncryptedPrivateKeyInfo,encryptedData) },
    { 0 }
@ -1256,9 +1258,9 @@ typedef struct LGEncryptedDataInfoStr LGEncryptedDataInfo;
 const SEC_ASN1Template lg_EncryptedDataInfoTemplate[] = {
    { SEC_ASN1_SEQUENCE,
        0, NULL, sizeof(LGEncryptedDataInfo) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
        offsetof(LGEncryptedDataInfo,algorithm),
-        SECOID_AlgorithmIDTemplate },
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_OCTET_STRING,
        offsetof(LGEncryptedDataInfo,encryptedData) },
    { 0 }
--- a/mozilla/security/nss/lib/softoken/legacydb/lowcert.c
+++ b/mozilla/security/nss/lib/softoken/legacydb/lowcert.c
@ -38,7 +38,7 @@
 /*
 * Certificate handling code
 *
- * $Id: lowcert.c,v 1.2 2007-06-13 00:24:57 rrelyea%redhat.com Exp $
+ * $Id: lowcert.c,v 1.3 2007-10-12 01:44:48 julien.pierre.boogz%sun.com Exp $
 */

 #include "seccomon.h"
@ -50,10 +50,13 @@
 #include "secerr.h"
 #include "pcert.h"

+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate);
+
 static const SEC_ASN1Template nsslowcert_SubjectPublicKeyInfoTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(NSSLOWCERTSubjectPublicKeyInfo) },
-    { SEC_ASN1_INLINE, offsetof(NSSLOWCERTSubjectPublicKeyInfo,algorithm),
-          SECOID_AlgorithmIDTemplate },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+        offsetof(NSSLOWCERTSubjectPublicKeyInfo,algorithm),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_BIT_STRING,
          offsetof(NSSLOWCERTSubjectPublicKeyInfo,subjectPublicKey), },
    { 0, }
--- a/mozilla/security/nss/lib/softoken/legacydb/lowkey.c
+++ b/mozilla/security/nss/lib/softoken/legacydb/lowkey.c
@ -41,12 +41,17 @@
 #include "secasn1.h"
 #include "secerr.h" 

+SEC_ASN1_MKSUB(SEC_AnyTemplate);
+SEC_ASN1_MKSUB(SEC_BitStringTemplate);
+SEC_ASN1_MKSUB(SEC_ObjectIDTemplate);
+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate);
+
 static const SEC_ASN1Template nsslowkey_AttributeTemplate[] = {
    { SEC_ASN1_SEQUENCE, 
 	0, NULL, sizeof(NSSLOWKEYAttribute) },
    { SEC_ASN1_OBJECT_ID, offsetof(NSSLOWKEYAttribute, attrType) },
-    { SEC_ASN1_SET_OF, offsetof(NSSLOWKEYAttribute, attrValue), 
-	SEC_AnyTemplate },
+    { SEC_ASN1_SET_OF | SEC_ASN1_XTRN, offsetof(NSSLOWKEYAttribute, attrValue), 
+	SEC_ASN1_SUB(SEC_AnyTemplate) },
    { 0 }
 };

@ -59,9 +64,9 @@ const SEC_ASN1Template nsslowkey_PrivateKeyInfoTemplate[] = {
 	0, NULL, sizeof(NSSLOWKEYPrivateKeyInfo) },
    { SEC_ASN1_INTEGER,
 	offsetof(NSSLOWKEYPrivateKeyInfo,version) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	offsetof(NSSLOWKEYPrivateKeyInfo,algorithm),
-	SECOID_AlgorithmIDTemplate },
+	SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_OCTET_STRING,
 	offsetof(NSSLOWKEYPrivateKeyInfo,privateKey) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
@ -145,9 +150,9 @@ const SEC_ASN1Template nsslowkey_ECPrivateKeyTemplate[] = {
     */
 #if 1
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED |
-      SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC | 0, 
+      SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 0, 
      offsetof(NSSLOWKEYPrivateKey,u.ec.ecParams.curveOID), 
-      SEC_ObjectIDTemplate }, 
+      SEC_ASN1_SUB(SEC_ObjectIDTemplate) }, 
 #else
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED |
      SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC | 0, 
@ -155,9 +160,10 @@ const SEC_ASN1Template nsslowkey_ECPrivateKeyTemplate[] = {
      nsslowkey_ECParamsTemplate }, 
 #endif
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED |
-      SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC | 1, 
+      SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC |
+      SEC_ASN1_XTRN | 1, 
      offsetof(NSSLOWKEYPrivateKey,u.ec.publicValue),
-      SEC_BitStringTemplate }, 
+      SEC_ASN1_SUB(SEC_BitStringTemplate) }, 
    { 0, }
 };

--- a/mozilla/security/nss/lib/softoken/lowkey.c
+++ b/mozilla/security/nss/lib/softoken/lowkey.c
@ -46,12 +46,18 @@
 #include "softoken.h"
 #endif

+SEC_ASN1_MKSUB(SEC_AnyTemplate);
+SEC_ASN1_MKSUB(SEC_BitStringTemplate);
+SEC_ASN1_MKSUB(SEC_ObjectIDTemplate);
+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate);
+
 const SEC_ASN1Template nsslowkey_AttributeTemplate[] = {
    { SEC_ASN1_SEQUENCE, 
 	0, NULL, sizeof(NSSLOWKEYAttribute) },
    { SEC_ASN1_OBJECT_ID, offsetof(NSSLOWKEYAttribute, attrType) },
-    { SEC_ASN1_SET_OF, offsetof(NSSLOWKEYAttribute, attrValue), 
-	SEC_AnyTemplate },
+    { SEC_ASN1_SET_OF | SEC_ASN1_XTRN ,
+        offsetof(NSSLOWKEYAttribute, attrValue),
+	SEC_ASN1_SUB(SEC_AnyTemplate) },
    { 0 }
 };

@ -64,9 +70,9 @@ const SEC_ASN1Template nsslowkey_PrivateKeyInfoTemplate[] = {
 	0, NULL, sizeof(NSSLOWKEYPrivateKeyInfo) },
    { SEC_ASN1_INTEGER,
 	offsetof(NSSLOWKEYPrivateKeyInfo,version) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
 	offsetof(NSSLOWKEYPrivateKeyInfo,algorithm),
-	SECOID_AlgorithmIDTemplate },
+	SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_OCTET_STRING,
 	offsetof(NSSLOWKEYPrivateKeyInfo,privateKey) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
@ -150,9 +156,10 @@ const SEC_ASN1Template nsslowkey_ECPrivateKeyTemplate[] = {
     */
 #if 1
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED |
-      SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC | 0, 
+      SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC |
+      SEC_ASN1_XTRN | 0, 
      offsetof(NSSLOWKEYPrivateKey,u.ec.ecParams.curveOID), 
-      SEC_ObjectIDTemplate }, 
+      SEC_ASN1_SUB(SEC_ObjectIDTemplate) }, 
 #else
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED |
      SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC | 0, 
@ -160,9 +167,10 @@ const SEC_ASN1Template nsslowkey_ECPrivateKeyTemplate[] = {
      nsslowkey_ECParamsTemplate }, 
 #endif
    { SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED |
-      SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC | 1, 
+      SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC |
+      SEC_ASN1_XTRN | 1, 
      offsetof(NSSLOWKEYPrivateKey,u.ec.publicValue),
-      SEC_BitStringTemplate }, 
+      SEC_ASN1_SUB(SEC_BitStringTemplate) }, 
    { 0, }
 };
 #endif /* NSS_ENABLE_ECC */
--- a/mozilla/security/nss/lib/softoken/lowpbe.c
+++ b/mozilla/security/nss/lib/softoken/lowpbe.c
@ -51,6 +51,8 @@
 #include "softoken.h"
 #include "secerr.h"

+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate)
+
 /* template for PKCS 5 PBE Parameter.  This template has been expanded
 * based upon the additions in PKCS 12.  This should eventually be moved
 * if RSA updates PKCS 5.
@ -89,10 +91,12 @@ typedef struct nsspkcs5V2PBEParameterStr nsspkcs5V2PBEParameter;
 static const SEC_ASN1Template NSSPKCS5V2PBES2ParameterTemplate[] =
 {   
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(nsspkcs5V2PBEParameter) },
-    { SEC_ASN1_INLINE, offsetof(nsspkcs5V2PBEParameter, keyParams), 
-					SECOID_AlgorithmIDTemplate },
-    { SEC_ASN1_INLINE, offsetof(nsspkcs5V2PBEParameter, algParams), 
-					SECOID_AlgorithmIDTemplate },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+        offsetof(nsspkcs5V2PBEParameter, keyParams), 
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+        offsetof(nsspkcs5V2PBEParameter, algParams),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { 0 }
 };

@ -104,8 +108,9 @@ static const SEC_ASN1Template NSSPKCS5V2PBEParameterTemplate[] =
    { SEC_ASN1_OCTET_STRING, offsetof(NSSPKCS5PBEParameter, salt) },
    { SEC_ASN1_INTEGER, offsetof(NSSPKCS5PBEParameter, iteration) },
    { SEC_ASN1_INTEGER, offsetof(NSSPKCS5PBEParameter, keyLength) },
-    { SEC_ASN1_INLINE, offsetof(NSSPKCS5PBEParameter, prfAlg), 
-					SECOID_AlgorithmIDTemplate },
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN,
+        offsetof(NSSPKCS5PBEParameter, prfAlg),
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { 0 }
 };
 #endif
--- a/mozilla/security/nss/lib/softoken/pkcs11c.c
+++ b/mozilla/security/nss/lib/softoken/pkcs11c.c
@ -1659,7 +1659,7 @@ RSA_HashSign(SECOidTag hashOid, NSSLOWKEYPrivateKey *key,
    if (!di) { goto loser; }

    /* Der encode the digest as a DigestInfo */
-    rv = DER_Encode(arena, &digder, SGNDigestInfoTemplate, di);
+    rv = DER_Encode(arena, &digder, SEC_ASN1_GET(SGNDigestInfoTemplate), di);
    if (rv != SECSuccess) {
 	goto loser;
    }
--- a/mozilla/security/nss/lib/softoken/sftkpwd.c
+++ b/mozilla/security/nss/lib/softoken/sftkpwd.c
@ -149,12 +149,14 @@ struct SFTKDBEncryptedDataInfoStr {
 };
 typedef struct SFTKDBEncryptedDataInfoStr SFTKDBEncryptedDataInfo;

+SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate)
+
 const SEC_ASN1Template sftkdb_EncryptedDataInfoTemplate[] = {
    { SEC_ASN1_SEQUENCE,
        0, NULL, sizeof(SFTKDBEncryptedDataInfo) },
-    { SEC_ASN1_INLINE,
+    { SEC_ASN1_INLINE | SEC_ASN1_XTRN ,
        offsetof(SFTKDBEncryptedDataInfo,algorithm),
-        SECOID_AlgorithmIDTemplate },
+        SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) },
    { SEC_ASN1_OCTET_STRING,
        offsetof(SFTKDBEncryptedDataInfo,encryptedData) },
    { 0 }
--- a/mozilla/security/nss/lib/ssl/config.mk
+++ b/mozilla/security/nss/lib/ssl/config.mk
@ -56,6 +56,7 @@ ifdef NS_USE_GCC
 EXTRA_SHARED_LIBS += \
 	-L$(DIST)/lib \
 	-lnss3 \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
@ -64,6 +65,7 @@ EXTRA_SHARED_LIBS += \
 else # ! NS_USE_GCC
 EXTRA_SHARED_LIBS += \
 	$(DIST)/lib/nss3.lib \
+	$(DIST)/lib/nssutil3.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
 	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
@ -102,6 +104,7 @@ EXTRA_LIBS += \
 EXTRA_SHARED_LIBS += \
 	-L$(DIST)/lib \
 	-lnss3 \
+	-lnssutil3 \
 	-L$(NSPR_LIB_DIR) \
 	-lplc4 \
 	-lplds4 \
--- a/mozilla/security/nss/lib/util/base64.h
+++ b/mozilla/security/nss/lib/util/base64.h
@ -38,11 +38,12 @@
 * base64.h - prototypes for base64 encoding/decoding
 * Note: These functions are deprecated; see nssb64.h for new routines.
 *
- * $Id: base64.h,v 1.2 2004-04-25 15:03:17 gerv%gerv.net Exp $
+ * $Id: base64.h,v 1.3 2007-10-12 01:44:50 julien.pierre.boogz%sun.com Exp $
 */
 #ifndef _BASE64_H_
 #define _BASE64_H_

+#include "utilrename.h"
 #include "seccomon.h"

 SEC_BEGIN_PROTOS
--- a/mozilla/security/nss/lib/util/ciferfam.h
+++ b/mozilla/security/nss/lib/util/ciferfam.h
@ -38,12 +38,13 @@
 * ciferfam.h - cipher familie IDs used for configuring ciphers for export
 *              control
 *
- * $Id: ciferfam.h,v 1.3 2007-05-10 01:12:20 nelson%bolyard.com Exp $
+ * $Id: ciferfam.h,v 1.4 2007-10-12 01:44:50 julien.pierre.boogz%sun.com Exp $
 */

 #ifndef _CIFERFAM_H_
 #define _CIFERFAM_H_

+#include "utilrename.h"
 /* Cipher Suite "Families" */
 #define CIPHER_FAMILY_PKCS12			"PKCS12"
 #define CIPHER_FAMILY_SMIME			"SMIME"
--- a/mozilla/security/nss/lib/util/config.mk
+++ b/mozilla/security/nss/lib/util/config.mk
@ -40,8 +40,65 @@
 #  are specifed as dependencies within rules.mk.
 #

-TARGETS        = $(LIBRARY)
-SHARED_LIBRARY =
-IMPORT_LIBRARY =
-PROGRAM        =
+# can't do this in manifest.mn because OS_TARGET isn't defined there.
+ifeq (,$(filter-out WIN%,$(OS_TARGET)))

+# don't want the 32 in the shared library name
+SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
+
+RES = $(OBJDIR)/$(LIBRARY_NAME).res
+RESNAME = $(LIBRARY_NAME).rc
+
+ifdef NS_USE_GCC
+EXTRA_SHARED_LIBS += \
+	-L$(DIST)/lib \
+	-L$(NSPR_LIB_DIR) \
+	-lplc4 \
+	-lplds4 \
+	-lnspr4\
+	$(NULL)
+else # ! NS_USE_GCC
+EXTRA_SHARED_LIBS += \
+	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
+	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
+	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
+	$(NULL)
+endif # NS_USE_GCC
+
+else
+
+# $(PROGRAM) has NO explicit dependencies on $(EXTRA_SHARED_LIBS)
+# $(EXTRA_SHARED_LIBS) come before $(OS_LIBS), except on AIX.
+EXTRA_SHARED_LIBS += \
+	-L$(DIST)/lib \
+	-L$(NSPR_LIB_DIR) \
+	-lplc4 \
+	-lplds4 \
+	-lnspr4 \
+	$(NULL)
+
+endif
+
+ifeq ($(OS_TARGET),SunOS)
+ifeq ($(BUILD_SUN_PKG), 1)
+# The -R '$ORIGIN' linker option instructs this library to search for its
+# dependencies in the same directory where it resides.
+ifeq ($(USE_64), 1)
+MKSHLIB += -R '$$ORIGIN:/usr/lib/mps/secv1/64:/usr/lib/mps/64'
+else
+MKSHLIB += -R '$$ORIGIN:/usr/lib/mps/secv1:/usr/lib/mps'
+endif
+else
+MKSHLIB += -R '$$ORIGIN'
+endif
+endif
+
+ifeq ($(OS_ARCH), HP-UX) 
+ifneq ($(OS_TEST), ia64)
+# pa-risc
+ifeq ($(USE_64), 1)
+MKSHLIB += +b '$$ORIGIN'
+endif
+endif
+endif
--- a/mozilla/security/nss/lib/util/derenc.c
+++ b/mozilla/security/nss/lib/util/derenc.c
@ -36,6 +36,8 @@

 #include "secder.h"
 #include "secerr.h"
+
+#if 0
 /*
 * Generic templates for individual/simple items.
 */
@ -95,6 +97,7 @@ DERTemplate SECUTCTimeTemplate[] = {
 	  0, NULL, sizeof(SECItem) }
 };

+#endif

 static int
 header_length(DERTemplate *dtemplate, PRUint32 contents_len)
--- a/mozilla/security/nss/lib/util/manifest.mn
+++ b/mozilla/security/nss/lib/util/manifest.mn
@ -59,11 +59,13 @@ EXPORTS = \
 	secoidt.h \
 	secport.h \
 	secerr.h \
+	utilrename.h \
 	watcomfx.h \
 	$(NULL)

 PRIVATE_EXPORTS = \
 	pqgutil.h \
+	templates.c \
 	$(NULL)

 CSRCS = \
@ -90,15 +92,17 @@ CSRCS = \
 	sectime.c \
 	secport.c \
 	secinit.c \
+	templates.c \
 	utf8.c \
 	$(NULL)

 MODULE = nss

 # don't duplicate module name in REQUIRES
-REQUIRES = dbm
+MAPFILE = $(OBJDIR)/nssutil.def

-LIBRARY_NAME = secutil
+LIBRARY_NAME = nssutil
+LIBRARY_VERSION = 3

 # This part of the code, including all sub-dirs, can be optimized for size
 export ALLOW_OPT_CODE_SIZE = 1
--- a/mozilla/security/nss/lib/util/nssb64.h
+++ b/mozilla/security/nss/lib/util/nssb64.h
@ -37,11 +37,12 @@
 /*
 * Public prototypes for base64 encoding/decoding.
 *
- * $Id: nssb64.h,v 1.3 2004-04-25 15:03:17 gerv%gerv.net Exp $
+ * $Id: nssb64.h,v 1.4 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */
 #ifndef _NSSB64_H_
 #define _NSSB64_H_

+#include "utilrename.h"
 #include "seccomon.h"
 #include "nssb64t.h"

--- a/mozilla/security/nss/lib/util/nssb64t.h
+++ b/mozilla/security/nss/lib/util/nssb64t.h
@ -37,11 +37,12 @@
 /*
 * Public data structures for base64 encoding/decoding.
 *
- * $Id: nssb64t.h,v 1.2 2004-04-25 15:03:17 gerv%gerv.net Exp $
+ * $Id: nssb64t.h,v 1.3 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */
 #ifndef _NSSB64T_H_
 #define _NSSB64T_H_

+#include "utilrename.h"
 typedef struct NSSBase64DecoderStr NSSBase64Decoder;
 typedef struct NSSBase64EncoderStr NSSBase64Encoder;

--- a/mozilla/security/nss/lib/util/nssilckt.h
+++ b/mozilla/security/nss/lib/util/nssilckt.h
@ -133,6 +133,7 @@
 #ifndef _NSSILCKT_H_
 #define _NSSILCKT_H_

+#include "utilrename.h"
 #include "prtypes.h"
 #include "prmon.h"
 #include "prlock.h"
--- a/mozilla/security/nss/lib/util/nssilock.h
+++ b/mozilla/security/nss/lib/util/nssilock.h
@ -133,6 +133,7 @@
 #ifndef _NSSILOCK_H_
 #define _NSSILOCK_H_

+#include "utilrename.h"
 #include "prtypes.h"
 #include "prmon.h"
 #include "prlock.h"
--- a/mozilla/security/nss/lib/util/nsslocks.c
+++ b/mozilla/security/nss/lib/util/nsslocks.c
@ -39,7 +39,7 @@
 *
 * NOTE - These are not public interfaces
 *
- * $Id: nsslocks.c,v 1.5 2004-04-25 15:03:17 gerv%gerv.net Exp $
+ * $Id: nsslocks.c,v 1.6 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 #include "seccomon.h"
@ -76,12 +76,6 @@ __nss_InitLock(   PZLock    **ppLock, nssILockType ltype )
    return (*ppLock != NULL) ? SECSuccess : SECFailure;
 }

-SECStatus 
-nss_InitLock(   PZLock    **ppLock, nssILockType ltype )
-{
-    return __nss_InitLock(ppLock, ltype);
-}
-
 /* Given the address of a (global) pointer to a PZMonitor, 
 * atomicly create the monitor and initialize the (global) pointer, 
 * if it is not already created/initialized.
--- a/mozilla/security/nss/lib/util/nsslocks.h
+++ b/mozilla/security/nss/lib/util/nsslocks.h
@ -39,12 +39,13 @@
 *
 * NOTE - These are not public interfaces
 *
- * $Id: nsslocks.h,v 1.3 2004-04-25 15:03:17 gerv%gerv.net Exp $
+ * $Id: nsslocks.h,v 1.4 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 #ifndef _NSSLOCKS_H_
 #define _NSSLOCKS_H_

+#include "utilrename.h"
 #include "seccomon.h"
 #include "nssilock.h"
 #include "prmon.h"
@ -52,7 +53,7 @@
 SEC_BEGIN_PROTOS

 /* Given the address of a (global) pointer to a PZLock, 
- * atomicly create the lock and initialize the (global) pointer, 
+ * atomically create the lock and initialize the (global) pointer, 
 * if it is not already created/initialized.
 */

--- a/mozilla/security/nss/lib/util/nssrwlk.h
+++ b/mozilla/security/nss/lib/util/nssrwlk.h
@ -53,6 +53,7 @@
 #ifndef nssrwlk_h___
 #define nssrwlk_h___

+#include "utilrename.h"
 #include "prtypes.h"
 #include "nssrwlkt.h"

--- a/mozilla/security/nss/lib/util/nssrwlkt.h
+++ b/mozilla/security/nss/lib/util/nssrwlkt.h
@ -36,6 +36,8 @@

 #ifndef nssrwlkt_h___
 #define nssrwlkt_h___
+
+#include "utilrename.h"
 #include "nssilock.h"
 /*
 * NSSRWLock --
--- a/mozilla/security/nss/lib/util/nssutil.def
+++ b/mozilla/security/nss/lib/util/nssutil.def
@ -0,0 +1,252 @@
+;+#
+;+# ***** BEGIN LICENSE BLOCK *****
+;+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+;+#
+;+# The contents of this file are subject to the Mozilla Public License Version
+;+# 1.1 (the "License"); you may not use this file except in compliance with
+;+# the License. You may obtain a copy of the License at
+;+# http://www.mozilla.org/MPL/
+;+#
+;+# Software distributed under the License is distributed on an "AS IS" basis,
+;+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+;+# for the specific language governing rights and limitations under the
+;+# License.
+;+#
+;+# The Original Code is the Network Security Services libraries.
+;+#
+;+# The Initial Developer of the Original Code is
+;+# Sun Microsystems, Inc.
+;+# Portions created by the Initial Developer are Copyright (C) 2007
+;+# the Initial Developer. All Rights Reserved.
+;+#
+;+# Contributor(s):
+;+#
+;+# Alternatively, the contents of this file may be used under the terms of
+;+# either the GNU General Public License Version 2 or later (the "GPL"), or
+;+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+;+# in which case the provisions of the GPL or the LGPL are applicable instead
+;+# of those above. If you wish to allow use of your version of this file only
+;+# under the terms of either the GPL or the LGPL, and not to allow others to
+;+# use your version of this file under the terms of the MPL, indicate your
+;+# decision by deleting the provisions above and replace them with the notice
+;+# and other provisions required by the GPL or the LGPL. If you do not delete
+;+# the provisions above, a recipient may use your version of this file under
+;+# the terms of any one of the MPL, the GPL or the LGPL.
+;+#
+;+# ***** END LICENSE BLOCK *****
+;+#
+;+# OK, this file is meant to support SUN, LINUX, AIX and WINDOWS
+;+#   1. For all unix platforms, the string ";-"  means "remove this line"
+;+#   2. For all unix platforms, the string " DATA " will be removed from any 
+;+#	line on which it occurs.
+;+#   3. Lines containing ";+" will have ";+" removed on SUN and LINUX.
+;+#      On AIX, lines containing ";+" will be removed.  
+;+#   4. For all unix platforms, the string ";;" will thave the ";;" removed.
+;+#   5. For all unix platforms, after the above processing has taken place,
+;+#    all characters after the first ";" on the line will be removed.  
+;+#    And for AIX, the first ";" will also be removed.
+;+#  This file is passed directly to windows. Since ';' is a comment, all UNIX
+;+#   directives are hidden behind ";", ";+", and ";-"
+;+NSSUTIL_3.12 {       # NSS Utilities 3.12 release
+;+    global:
+LIBRARY nssutil3	;-
+EXPORTS		;-
+__nss_InitLock_Util;
+ATOB_AsciiToData_Util;
+ATOB_ConvertAsciiToItem_Util;
+BTOA_ConvertItemToAscii_Util;
+BTOA_DataToAscii_Util;
+CERT_CopyValidity;
+CERT_CreateValidity_Util;
+CERT_DestroyValidity_Util;
+CERT_GenTime2FormattedAscii_Util;
+DER_AsciiToTime_Util;
+DER_DecodeTimeChoice_Util;
+DER_Encode_Util;
+DER_EncodeTimeChoice_Util;
+DER_GeneralizedDayToAscii_Util;
+DER_GeneralizedTimeToTime_Util;
+DER_GetInteger_Util;
+DER_GetUInteger;
+DER_LengthLength;
+DER_Lengths_Util;
+DER_SetUInteger;
+DER_StoreHeader;
+DER_TimeChoiceDayToAscii_Util;
+DER_TimeToGeneralizedTime_Util;
+DER_TimeToGeneralizedTimeArena_Util;
+DER_TimeToUTCTime_Util;
+DER_UTCDayToAscii_Util;
+DER_UTCTimeToAscii_Util;
+DER_UTCTimeToTime_Util;
+NSS_PutEnv_Util;
+NSSBase64_DecodeBuffer_Util;
+NSSBase64_EncodeItem_Util;
+NSSBase64Decoder_Create_Util;
+NSSBase64Decoder_Destroy_Util;
+NSSBase64Decoder_Update_Util;
+NSSBase64Encoder_Create_Util;
+NSSBase64Encoder_Destroy_Util;
+NSSBase64Encoder_Update_Util;
+NSSRWLock_Destroy_Util;
+NSSRWLock_HaveWriteLock_Util;
+NSSRWLock_LockRead_Util;
+NSSRWLock_LockWrite_Util;
+NSSRWLock_New_Util;
+NSSRWLock_UnlockRead_Util;
+NSSRWLock_UnlockWrite_Util;
+PORT_Alloc_Util;
+PORT_ArenaAlloc_Util;
+PORT_ArenaGrow_Util;
+PORT_ArenaMark_Util;
+PORT_ArenaRelease_Util;
+PORT_ArenaStrdup_Util;
+PORT_ArenaUnmark_Util;
+PORT_ArenaZAlloc_Util;
+PORT_Free_Util;
+PORT_FreeArena_Util;
+PORT_GetError_Util;
+PORT_ISO88591_UTF8Conversion;
+PORT_NewArena_Util;
+PORT_Realloc_Util;
+PORT_RegExpCaseSearch;
+PORT_RegExpValid;
+PORT_SetError_Util;
+PORT_SetUCS2_ASCIIConversionFunction_Util;
+PORT_SetUCS2_UTF8ConversionFunction_Util;
+PORT_SetUCS4_UTF8ConversionFunction_Util;
+PORT_Strdup_Util;
+PORT_UCS2_ASCIIConversion_Util;
+PORT_UCS2_UTF8Conversion_Util;
+PORT_UCS4_UTF8Conversion;
+PORT_ZAlloc_Util;
+PORT_ZFree_Util;
+PQG_DestroyParams;
+PQG_DestroyVerify;
+PQG_GetBaseFromParams;
+PQG_GetCounterFromVerify;
+PQG_GetHFromVerify;
+PQG_GetPrimeFromParams;
+PQG_GetSeedFromVerify;
+PQG_GetSubPrimeFromParams;
+PQG_NewParams;
+PQG_NewVerify;
+SEC_ASN1Decode_Util;
+SEC_ASN1DecodeInteger_Util;
+SEC_ASN1DecodeItem_Util;
+SEC_ASN1DecoderAbort_Util;
+SEC_ASN1DecoderClearFilterProc_Util;
+SEC_ASN1DecoderClearNotifyProc_Util;
+SEC_ASN1DecoderFinish_Util;
+SEC_ASN1DecoderSetFilterProc_Util;
+SEC_ASN1DecoderSetNotifyProc_Util;
+SEC_ASN1DecoderStart_Util;
+SEC_ASN1DecoderUpdate_Util;
+SEC_ASN1Encode_Util;
+SEC_ASN1EncodeInteger_Util;
+SEC_ASN1EncodeItem_Util;
+SEC_ASN1EncoderAbort_Util;
+SEC_ASN1EncoderClearNotifyProc_Util;
+SEC_ASN1EncoderClearStreaming_Util;
+SEC_ASN1EncoderClearTakeFromBuf_Util;
+SEC_ASN1EncoderFinish_Util;
+SEC_ASN1EncoderSetNotifyProc_Util;
+SEC_ASN1EncoderSetStreaming_Util;
+SEC_ASN1EncoderSetTakeFromBuf_Util;
+SEC_ASN1EncoderStart_Util;
+SEC_ASN1EncoderUpdate_Util;
+SEC_ASN1EncodeUnsignedInteger_Util;
+SEC_ASN1LengthLength_Util;
+SEC_QuickDERDecodeItem_Util;
+SEC_StringToOID;
+SECITEM_AllocItem_Util;
+SECITEM_ArenaDupItem_Util;
+SECITEM_CompareItem_Util;
+SECITEM_CopyItem_Util;
+SECITEM_DupItem_Util;
+SECITEM_FreeItem_Util;
+SECITEM_Hash;
+SECITEM_HashCompare;
+SECITEM_ItemsAreEqual_Util;
+SECITEM_ZfreeItem_Util;
+SECOID_AddEntry_Util;
+SECOID_CompareAlgorithmID_Util;
+SECOID_CopyAlgorithmID_Util;
+SECOID_DestroyAlgorithmID_Util;
+SECOID_FindOID_Util;
+SECOID_FindOIDByMechanism;
+SECOID_FindOIDByTag_Util;
+SECOID_FindOIDTag_Util;
+SECOID_FindOIDTagDescription_Util;
+SECOID_GetAlgorithmTag_Util;
+secoid_Init;
+SECOID_KnownCertExtenOID;
+SECOID_SetAlgorithmID_Util;
+SECOID_Shutdown;
+SGN_CompareDigestInfo_Util;
+SGN_CopyDigestInfo_Util;
+SGN_CreateDigestInfo_Util;
+SGN_DecodeDigestInfo;
+SGN_DestroyDigestInfo_Util;
+;+#
+;+# Data objects
+;+#
+;+# Don't export these DATA symbols on Windows because they don't work right.
+;+# Use the SEC_ASN1_GET / SEC_ASN1_SUB / SEC_ASN1_XTRN macros to access them.
+;;CERT_TimeChoiceTemplate_Util DATA ;
+;;SEC_AnyTemplate_Util DATA ;
+;;SEC_BitStringTemplate_Util DATA ;
+;;SEC_BMPStringTemplate_Util DATA ;
+;;SEC_BooleanTemplate_Util DATA ;
+;;SEC_EnumeratedTemplate DATA ;
+;;SEC_GeneralizedTimeTemplate_Util DATA ;
+;;SEC_IA5StringTemplate_Util DATA ;
+;;SEC_IntegerTemplate_Util DATA ;
+;;SEC_NullTemplate_Util DATA ;
+;;SEC_ObjectIDTemplate_Util DATA ;
+;;SEC_OctetStringTemplate_Util DATA ;
+;;SEC_PointerToAnyTemplate_Util DATA ;
+;;SEC_PointerToEnumeratedTemplate DATA ;
+;;SEC_PointerToGeneralizedTimeTemplate DATA ;
+;;SEC_PointerToOctetStringTemplate_Util DATA ;
+;;SEC_PrintableStringTemplate DATA ;
+;;SEC_SequenceOfAnyTemplate DATA ;
+;;SEC_SequenceOfObjectIDTemplate DATA ;
+;;SEC_SetOfAnyTemplate_Util DATA ;
+;;SEC_SkipTemplate DATA ;
+;;SEC_T61StringTemplate DATA ;
+;;SEC_UniversalStringTemplate DATA ;
+;;SEC_UTF8StringTemplate_Util DATA ;
+;;SECOID_AlgorithmIDTemplate_Util DATA ;
+;;sgn_DigestInfoTemplate_Util DATA ;
+;;SGNDigestInfoTemplate DATA ;
+NSS_Get_CERT_TimeChoiceTemplate_Util;
+NSS_Get_SEC_AnyTemplate_Util;
+NSS_Get_SEC_BitStringTemplate_Util;
+NSS_Get_SEC_BMPStringTemplate_Util;
+NSS_Get_SEC_BooleanTemplate_Util;
+NSS_Get_SEC_EnumeratedTemplate;
+NSS_Get_SEC_GeneralizedTimeTemplate_Util;
+NSS_Get_SEC_IA5StringTemplate_Util;
+NSS_Get_SEC_IntegerTemplate_Util;
+NSS_Get_SEC_NullTemplate_Util;
+NSS_Get_SEC_ObjectIDTemplate_Util;
+NSS_Get_SEC_OctetStringTemplate_Util;
+NSS_Get_SEC_PointerToAnyTemplate_Util;
+NSS_Get_SEC_PointerToEnumeratedTemplate;
+NSS_Get_SEC_PointerToGeneralizedTimeTemplate;
+NSS_Get_SEC_PointerToOctetStringTemplate_Util;
+NSS_Get_SEC_PrintableStringTemplate;
+NSS_Get_SEC_SequenceOfAnyTemplate;
+NSS_Get_SEC_SequenceOfObjectIDTemplate;
+NSS_Get_SEC_SetOfAnyTemplate_Util;
+NSS_Get_SEC_SkipTemplate;
+NSS_Get_SEC_T61StringTemplate;
+NSS_Get_SEC_UniversalStringTemplate;
+NSS_Get_SEC_UTF8StringTemplate_Util;
+NSS_Get_SECOID_AlgorithmIDTemplate_Util;
+NSS_Get_sgn_DigestInfoTemplate_Util;
+NSS_Get_SGNDigestInfoTemplate;
+;+    local:
+;+       *;
+;+};
--- a/mozilla/security/nss/lib/util/nssutil.rc
+++ b/mozilla/security/nss/lib/util/nssutil.rc
@ -0,0 +1,100 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is the Network Security Services libraries.
+ *
+ * The Initial Developer of the Original Code is
+ * Sun Microsystems, Inc.
+ * Portions created by the Initial Developer are Copyright (C) 2007
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nss.h"
+#include <winver.h>
+
+#define MY_LIBNAME "nssutil"
+#define MY_FILEDESCRIPTION "NSS Utility Library"
+
+#define STRINGIZE(x) #x
+#define STRINGIZE2(x) STRINGIZE(x)
+#define NSS_VMAJOR_STR STRINGIZE2(NSS_VMAJOR)
+
+#ifdef _DEBUG
+#define MY_DEBUG_STR " (debug)"
+#define MY_FILEFLAGS_1 VS_FF_DEBUG
+#else
+#define MY_DEBUG_STR ""
+#define MY_FILEFLAGS_1 0x0L
+#endif
+#if NSS_BETA
+#define MY_FILEFLAGS_2 MY_FILEFLAGS_1|VS_FF_PRERELEASE
+#else
+#define MY_FILEFLAGS_2 MY_FILEFLAGS_1
+#endif
+
+#ifdef WINNT
+#define MY_FILEOS VOS_NT_WINDOWS32
+#else
+#define MY_FILEOS VOS__WINDOWS32
+#endif
+
+#define MY_INTERNAL_NAME MY_LIBNAME NSS_VMAJOR_STR
+
+/////////////////////////////////////////////////////////////////////////////
+//
+// Version-information resource
+//
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION NSS_VMAJOR,NSS_VMINOR,NSS_VPATCH,0
+ PRODUCTVERSION NSS_VMAJOR,NSS_VMINOR,NSS_VPATCH,0
+ FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
+ FILEFLAGS MY_FILEFLAGS_2
+ FILEOS MY_FILEOS
+ FILETYPE VFT_DLL
+ FILESUBTYPE 0x0L // not used
+
+BEGIN
+    BLOCK "StringFileInfo"
+    BEGIN
+        BLOCK "040904B0" // Lang=US English, CharSet=Unicode
+        BEGIN
+            VALUE "CompanyName", "Mozilla Foundation\0"
+            VALUE "FileDescription", MY_FILEDESCRIPTION MY_DEBUG_STR "\0"
+            VALUE "FileVersion", NSS_VERSION "\0"
+            VALUE "InternalName", MY_INTERNAL_NAME "\0"
+            VALUE "OriginalFilename", MY_INTERNAL_NAME ".dll\0"
+            VALUE "ProductName", "Network Security Services\0"
+            VALUE "ProductVersion", NSS_VERSION "\0"
+        END
+    END
+    BLOCK "VarFileInfo"
+    BEGIN
+        VALUE "Translation", 0x409, 1200
+    END
+END
--- a/mozilla/security/nss/lib/util/portreg.h
+++ b/mozilla/security/nss/lib/util/portreg.h
@ -61,6 +61,7 @@
 #ifndef SHEXP_H
 #define SHEXP_H

+#include "utilrename.h"
 /*
 * Requires that the macro MALLOC be set to a "safe" malloc that will 
 * exit if no memory is available. 
--- a/mozilla/security/nss/lib/util/pqgutil.h
+++ b/mozilla/security/nss/lib/util/pqgutil.h
@ -36,7 +36,8 @@
 #ifndef _PQGUTIL_H_
 #define _PQGUTIL_H_ 1

-#include "blapi.h"
+#include "utilrename.h"
+#include "blapit.h"

 /**************************************************************************
 *  Return a pointer to a new PQGParams struct that is a duplicate of     *
--- a/mozilla/security/nss/lib/util/secalgid.c
+++ b/mozilla/security/nss/lib/util/secalgid.c
@ -40,27 +40,6 @@
 #include "secitem.h"
 #include "secerr.h"

-/* XXX Old template; want to expunge it eventually. */
-DERTemplate SECAlgorithmIDTemplate[] = {
-    { DER_SEQUENCE,
-	  0, NULL, sizeof(SECAlgorithmID) },
-    { DER_OBJECT_ID,
-	  offsetof(SECAlgorithmID,algorithm), },
-    { DER_OPTIONAL | DER_ANY,
-	  offsetof(SECAlgorithmID,parameters), },
-    { 0, }
-};
-
-const SEC_ASN1Template SECOID_AlgorithmIDTemplate[] = {
-    { SEC_ASN1_SEQUENCE,
-	  0, NULL, sizeof(SECAlgorithmID) },
-    { SEC_ASN1_OBJECT_ID,
-	  offsetof(SECAlgorithmID,algorithm), },
-    { SEC_ASN1_OPTIONAL | SEC_ASN1_ANY,
-	  offsetof(SECAlgorithmID,parameters), },
-    { 0, }
-};
-
 SECOidTag
 SECOID_GetAlgorithmTag(SECAlgorithmID *id)
 {
@ -176,7 +155,3 @@ SECOID_CompareAlgorithmID(SECAlgorithmID *a, SECAlgorithmID *b)
    rv = SECITEM_CompareItem(&a->parameters, &b->parameters);
    return rv;
 }
-
-/* This functions simply returns the address of the above-declared template. */
-SEC_ASN1_CHOOSER_IMPLEMENT(SECOID_AlgorithmIDTemplate)
-
--- a/mozilla/security/nss/lib/util/secasn1.h
+++ b/mozilla/security/nss/lib/util/secasn1.h
@ -39,12 +39,13 @@
 * Encoding Rules).  The routines are found in and used extensively by the
 * security library, but exported for other use.
 *
- * $Id: secasn1.h,v 1.14 2005-10-31 18:52:20 julien.pierre.bugs%sun.com Exp $
+ * $Id: secasn1.h,v 1.15 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 #ifndef _SECASN1_H_
 #define _SECASN1_H_

+#include "utilrename.h"
 #include "plarena.h"

 #include "seccomon.h"
@ -306,5 +307,14 @@ SEC_ASN1_CHOOSER_DECLARE(SEC_PointerToOctetStringTemplate)

 SEC_ASN1_CHOOSER_DECLARE(SEC_SetOfAnyTemplate)

+SEC_ASN1_CHOOSER_DECLARE(SEC_EnumeratedTemplate)
+SEC_ASN1_CHOOSER_DECLARE(SEC_PointerToEnumeratedTemplate)
+SEC_ASN1_CHOOSER_DECLARE(SEC_SequenceOfAnyTemplate)
+SEC_ASN1_CHOOSER_DECLARE(SEC_SequenceOfObjectIDTemplate)
+SEC_ASN1_CHOOSER_DECLARE(SEC_SkipTemplate)
+SEC_ASN1_CHOOSER_DECLARE(SEC_UniversalStringTemplate)
+SEC_ASN1_CHOOSER_DECLARE(SEC_PrintableStringTemplate)
+SEC_ASN1_CHOOSER_DECLARE(SEC_T61StringTemplate)
+SEC_ASN1_CHOOSER_DECLARE(SEC_PointerToGeneralizedTimeTemplate)
 SEC_END_PROTOS
 #endif /* _SECASN1_H_ */
--- a/mozilla/security/nss/lib/util/secasn1d.c
+++ b/mozilla/security/nss/lib/util/secasn1d.c
@ -38,7 +38,7 @@
 * Support for DEcoding ASN.1 data based on BER/DER (Basic/Distinguished
 * Encoding Rules).
 *
- * $Id: secasn1d.c,v 1.37 2007-01-03 12:57:41 nelson%bolyard.com Exp $
+ * $Id: secasn1d.c,v 1.38 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 /* #define DEBUG_ASN1D_STATES 1 */
@ -3002,25 +3002,11 @@ void sec_asn1d_Assert(const char *s, const char *file, PRIntn ln)
 *	the appropriate place.
 */

-const SEC_ASN1Template SEC_AnyTemplate[] = {
-    { SEC_ASN1_ANY | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
-};
-
-const SEC_ASN1Template SEC_PointerToAnyTemplate[] = {
-    { SEC_ASN1_POINTER, 0, SEC_AnyTemplate }
-};
-
 const SEC_ASN1Template SEC_SequenceOfAnyTemplate[] = {
    { SEC_ASN1_SEQUENCE_OF, 0, SEC_AnyTemplate }
 };

-const SEC_ASN1Template SEC_SetOfAnyTemplate[] = {
-    { SEC_ASN1_SET_OF, 0, SEC_AnyTemplate }
-};
-
-const SEC_ASN1Template SEC_BitStringTemplate[] = {
-    { SEC_ASN1_BIT_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
-};
+#if 0

 const SEC_ASN1Template SEC_PointerToBitStringTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_BitStringTemplate }
@ -3034,10 +3020,6 @@ const SEC_ASN1Template SEC_SetOfBitStringTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_BitStringTemplate }
 };

-const SEC_ASN1Template SEC_BMPStringTemplate[] = {
-    { SEC_ASN1_BMP_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
-};
-
 const SEC_ASN1Template SEC_PointerToBMPStringTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_BMPStringTemplate }
 };
@ -3050,10 +3032,6 @@ const SEC_ASN1Template SEC_SetOfBMPStringTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_BMPStringTemplate }
 };

-const SEC_ASN1Template SEC_BooleanTemplate[] = {
-    { SEC_ASN1_BOOLEAN, 0, NULL, sizeof(SECItem) }
-};
-
 const SEC_ASN1Template SEC_PointerToBooleanTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_BooleanTemplate }
 };
@ -3066,6 +3044,8 @@ const SEC_ASN1Template SEC_SetOfBooleanTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_BooleanTemplate }
 };

+#endif
+
 const SEC_ASN1Template SEC_EnumeratedTemplate[] = {
    { SEC_ASN1_ENUMERATED, 0, NULL, sizeof(SECItem) }
 };
@ -3074,22 +3054,24 @@ const SEC_ASN1Template SEC_PointerToEnumeratedTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_EnumeratedTemplate }
 };

+#if 0
+
 const SEC_ASN1Template SEC_SequenceOfEnumeratedTemplate[] = {
    { SEC_ASN1_SEQUENCE_OF, 0, SEC_EnumeratedTemplate }
 };

+#endif
+
 const SEC_ASN1Template SEC_SetOfEnumeratedTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_EnumeratedTemplate }
 };

-const SEC_ASN1Template SEC_GeneralizedTimeTemplate[] = {
-    { SEC_ASN1_GENERALIZED_TIME | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem)}
-};
-
 const SEC_ASN1Template SEC_PointerToGeneralizedTimeTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_GeneralizedTimeTemplate }
 };

+#if 0
+
 const SEC_ASN1Template SEC_SequenceOfGeneralizedTimeTemplate[] = {
    { SEC_ASN1_SEQUENCE_OF, 0, SEC_GeneralizedTimeTemplate }
 };
@ -3098,10 +3080,6 @@ const SEC_ASN1Template SEC_SetOfGeneralizedTimeTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_GeneralizedTimeTemplate }
 };

-const SEC_ASN1Template SEC_IA5StringTemplate[] = {
-    { SEC_ASN1_IA5_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
-};
-
 const SEC_ASN1Template SEC_PointerToIA5StringTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_IA5StringTemplate }
 };
@ -3114,10 +3092,6 @@ const SEC_ASN1Template SEC_SetOfIA5StringTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_IA5StringTemplate }
 };

-const SEC_ASN1Template SEC_IntegerTemplate[] = {
-    { SEC_ASN1_INTEGER, 0, NULL, sizeof(SECItem) }
-};
-
 const SEC_ASN1Template SEC_PointerToIntegerTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_IntegerTemplate }
 };
@ -3130,10 +3104,6 @@ const SEC_ASN1Template SEC_SetOfIntegerTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_IntegerTemplate }
 };

-const SEC_ASN1Template SEC_NullTemplate[] = {
-    { SEC_ASN1_NULL, 0, NULL, sizeof(SECItem) }
-};
-
 const SEC_ASN1Template SEC_PointerToNullTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_NullTemplate }
 };
@ -3146,30 +3116,22 @@ const SEC_ASN1Template SEC_SetOfNullTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_NullTemplate }
 };

-const SEC_ASN1Template SEC_ObjectIDTemplate[] = {
-    { SEC_ASN1_OBJECT_ID, 0, NULL, sizeof(SECItem) }
-};
-
 const SEC_ASN1Template SEC_PointerToObjectIDTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_ObjectIDTemplate }
 };

+#endif
+
 const SEC_ASN1Template SEC_SequenceOfObjectIDTemplate[] = {
    { SEC_ASN1_SEQUENCE_OF, 0, SEC_ObjectIDTemplate }
 };

+#if 0
+
 const SEC_ASN1Template SEC_SetOfObjectIDTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_ObjectIDTemplate }
 };

-const SEC_ASN1Template SEC_OctetStringTemplate[] = {
-    { SEC_ASN1_OCTET_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
-};
-
-const SEC_ASN1Template SEC_PointerToOctetStringTemplate[] = {
-    { SEC_ASN1_POINTER | SEC_ASN1_MAY_STREAM, 0, SEC_OctetStringTemplate }
-};
-
 const SEC_ASN1Template SEC_SequenceOfOctetStringTemplate[] = {
    { SEC_ASN1_SEQUENCE_OF, 0, SEC_OctetStringTemplate }
 };
@ -3178,10 +3140,14 @@ const SEC_ASN1Template SEC_SetOfOctetStringTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_OctetStringTemplate }
 };

+#endif
+
 const SEC_ASN1Template SEC_PrintableStringTemplate[] = {
    { SEC_ASN1_PRINTABLE_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem)}
 };

+#if 0
+
 const SEC_ASN1Template SEC_PointerToPrintableStringTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_PrintableStringTemplate }
 };
@ -3194,10 +3160,14 @@ const SEC_ASN1Template SEC_SetOfPrintableStringTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_PrintableStringTemplate }
 };

+#endif
+
 const SEC_ASN1Template SEC_T61StringTemplate[] = {
    { SEC_ASN1_T61_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
 };

+#if 0
+
 const SEC_ASN1Template SEC_PointerToT61StringTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_T61StringTemplate }
 };
@ -3210,10 +3180,14 @@ const SEC_ASN1Template SEC_SetOfT61StringTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_T61StringTemplate }
 };

+#endif
+
 const SEC_ASN1Template SEC_UniversalStringTemplate[] = {
    { SEC_ASN1_UNIVERSAL_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem)}
 };

+#if 0
+
 const SEC_ASN1Template SEC_PointerToUniversalStringTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_UniversalStringTemplate }
 };
@ -3226,10 +3200,6 @@ const SEC_ASN1Template SEC_SetOfUniversalStringTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_UniversalStringTemplate }
 };

-const SEC_ASN1Template SEC_UTCTimeTemplate[] = {
-    { SEC_ASN1_UTC_TIME | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
-};
-
 const SEC_ASN1Template SEC_PointerToUTCTimeTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_UTCTimeTemplate }
 };
@ -3242,10 +3212,6 @@ const SEC_ASN1Template SEC_SetOfUTCTimeTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_UTCTimeTemplate }
 };

-const SEC_ASN1Template SEC_UTF8StringTemplate[] = {
-    { SEC_ASN1_UTF8_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem)}
-};
-
 const SEC_ASN1Template SEC_PointerToUTF8StringTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_UTF8StringTemplate }
 };
@ -3258,10 +3224,14 @@ const SEC_ASN1Template SEC_SetOfUTF8StringTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_UTF8StringTemplate }
 };

+#endif
+
 const SEC_ASN1Template SEC_VisibleStringTemplate[] = {
    { SEC_ASN1_VISIBLE_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
 };

+#if 0
+
 const SEC_ASN1Template SEC_PointerToVisibleStringTemplate[] = {
    { SEC_ASN1_POINTER, 0, SEC_VisibleStringTemplate }
 };
@ -3274,6 +3244,7 @@ const SEC_ASN1Template SEC_SetOfVisibleStringTemplate[] = {
    { SEC_ASN1_SET_OF, 0, SEC_VisibleStringTemplate }
 };

+#endif

 /*
 * Template for skipping a subitem.
@ -3290,19 +3261,13 @@ const SEC_ASN1Template SEC_SkipTemplate[] = {
 /* These functions simply return the address of the above-declared templates.
 ** This is necessary for Windows DLLs.  Sigh.
 */
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_AnyTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_BMPStringTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_BooleanTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_BitStringTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_IA5StringTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_GeneralizedTimeTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_IntegerTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_NullTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_ObjectIDTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_OctetStringTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_PointerToAnyTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_PointerToOctetStringTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_SetOfAnyTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_UTCTimeTemplate)
-SEC_ASN1_CHOOSER_IMPLEMENT(SEC_UTF8StringTemplate)
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_EnumeratedTemplate)
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_PointerToEnumeratedTemplate)
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_SequenceOfAnyTemplate)
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_SequenceOfObjectIDTemplate)
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_SkipTemplate)
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_UniversalStringTemplate)
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_PrintableStringTemplate)
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_T61StringTemplate)
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_PointerToGeneralizedTimeTemplate)

--- a/mozilla/security/nss/lib/util/secasn1t.h
+++ b/mozilla/security/nss/lib/util/secasn1t.h
@ -38,12 +38,14 @@
 * Types for encoding/decoding of ASN.1 using BER/DER (Basic/Distinguished
 * Encoding Rules).
 *
- * $Id: secasn1t.h,v 1.9 2004-04-25 15:03:18 gerv%gerv.net Exp $
+ * $Id: secasn1t.h,v 1.10 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 #ifndef _SECASN1T_H_
 #define _SECASN1T_H_

+#include "utilrename.h"
+
 /*
 ** An array of these structures defines a BER/DER encoding for an object.
 **
--- a/mozilla/security/nss/lib/util/seccomon.h
+++ b/mozilla/security/nss/lib/util/seccomon.h
@ -41,12 +41,13 @@
 * for security libraries.  It should not be dependent on any other
 * headers, and should not require linking with any libraries.
 *
- * $Id: seccomon.h,v 1.6 2007-09-07 18:45:53 neil.williams%sun.com Exp $
+ * $Id: seccomon.h,v 1.7 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 #ifndef _SECCOMMON_H_
 #define _SECCOMMON_H_

+#include "utilrename.h"
 #include "prtypes.h"


--- a/mozilla/security/nss/lib/util/secder.h
+++ b/mozilla/security/nss/lib/util/secder.h
@ -37,11 +37,13 @@
 #ifndef _SECDER_H_
 #define _SECDER_H_

+#include "utilrename.h"
+
 /*
 * secder.h - public data structures and prototypes for the DER encoding and
 *	      decoding utilities library
 *
- * $Id: secder.h,v 1.10 2007-10-01 11:55:04 biswatosh.chakraborty%sun.com Exp $
+ * $Id: secder.h,v 1.11 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 #if defined(_WIN32_WCE)
--- a/mozilla/security/nss/lib/util/secdert.h
+++ b/mozilla/security/nss/lib/util/secdert.h
@ -40,9 +40,10 @@
 * secdert.h - public data structures for the DER encoding and
 *	       decoding utilities library
 *
- * $Id: secdert.h,v 1.4 2007-07-14 06:21:53 nelson%bolyard.com Exp $
+ * $Id: secdert.h,v 1.5 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

+#include "utilrename.h"
 #include "seccomon.h"

 typedef struct DERTemplateStr DERTemplate;
@ -159,21 +160,4 @@ struct DERTemplateStr {
    (item)->len = ((item)->len + 7) >> 3; \
 }

-SEC_BEGIN_PROTOS
-
-extern DERTemplate SECAnyTemplate[];
-extern DERTemplate SECBitStringTemplate[];
-extern DERTemplate SECBooleanTemplate[];
-extern DERTemplate SECIA5StringTemplate[];
-extern DERTemplate SECIntegerTemplate[];
-extern DERTemplate SECNullTemplate[];
-extern DERTemplate SECObjectIDTemplate[];
-extern DERTemplate SECOctetStringTemplate[];
-extern DERTemplate SECPrintableStringTemplate[];
-extern DERTemplate SECT61StringTemplate[];
-extern DERTemplate SECUTCTimeTemplate[];
-extern DERTemplate SECAlgorithmIDTemplate[];
-
-SEC_END_PROTOS
-
 #endif /* _SECDERT_H_ */
--- a/mozilla/security/nss/lib/util/secdig.c
+++ b/mozilla/security/nss/lib/util/secdig.c
@ -33,13 +33,24 @@
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */
-/* $Id: secdig.c,v 1.7 2006-08-31 03:54:48 nelson%bolyard.com Exp $ */
+/* $Id: secdig.c,v 1.8 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $ */
 #include "secdig.h"

 #include "secoid.h"
 #include "secasn1.h" 
 #include "secerr.h"

+/* XXX Old template; want to expunge it eventually. */
+static DERTemplate SECAlgorithmIDTemplate[] = {
+    { DER_SEQUENCE,
+	  0, NULL, sizeof(SECAlgorithmID) },
+    { DER_OBJECT_ID,
+	  offsetof(SECAlgorithmID,algorithm), },
+    { DER_OPTIONAL | DER_ANY,
+	  offsetof(SECAlgorithmID,parameters), },
+    { 0, }
+};
+
 /*
 * XXX OLD Template.  Once all uses have been switched over to new one,
 * remove this.
@ -55,20 +66,7 @@ DERTemplate SGNDigestInfoTemplate[] = {
    { 0, }
 };

-/* XXX See comment below about SGN_DecodeDigestInfo -- keep this static! */
-/* XXX Changed from static -- need to change name? */
-const SEC_ASN1Template sgn_DigestInfoTemplate[] = {
-    { SEC_ASN1_SEQUENCE,
-	  0, NULL, sizeof(SGNDigestInfo) },
-    { SEC_ASN1_INLINE,
-	  offsetof(SGNDigestInfo,digestAlgorithm),
-	  SECOID_AlgorithmIDTemplate },
-    { SEC_ASN1_OCTET_STRING,
-	  offsetof(SGNDigestInfo,digest) },
-    { 0 }
-};
-
-SEC_ASN1_CHOOSER_IMPLEMENT(sgn_DigestInfoTemplate)
+SEC_ASN1_CHOOSER_IMPLEMENT(SGNDigestInfoTemplate)

 /*
 * XXX Want to have a SGN_DecodeDigestInfo, like:
--- a/mozilla/security/nss/lib/util/secdig.h
+++ b/mozilla/security/nss/lib/util/secdig.h
@ -36,11 +36,12 @@
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */
-/* $Id: secdig.h,v 1.5 2004-04-27 23:04:40 gerv%gerv.net Exp $ */
+/* $Id: secdig.h,v 1.6 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $ */

 #ifndef _SECDIG_H_
 #define _SECDIG_H_

+#include "utilrename.h"
 #include "secdigt.h"

 #include "seccomon.h"
@ -56,6 +57,7 @@ SEC_ASN1_CHOOSER_DECLARE(sgn_DigestInfoTemplate)

 extern DERTemplate SGNDigestInfoTemplate[];

+SEC_ASN1_CHOOSER_DECLARE(SGNDigestInfoTemplate)

 /****************************************/
 /*
--- a/mozilla/security/nss/lib/util/secdigt.h
+++ b/mozilla/security/nss/lib/util/secdigt.h
@ -36,11 +36,12 @@
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */
-/* $Id: secdigt.h,v 1.3 2004-04-27 23:04:40 gerv%gerv.net Exp $ */
+/* $Id: secdigt.h,v 1.4 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $ */

 #ifndef _SECDIGT_H_
 #define _SECDIGT_H_

+#include "utilrename.h"
 #include "plarena.h"
 #include "secoidt.h"
 #include "secitem.h"
--- a/mozilla/security/nss/lib/util/secerr.h
+++ b/mozilla/security/nss/lib/util/secerr.h
@ -37,6 +37,7 @@
 #ifndef __SEC_ERR_H_
 #define __SEC_ERR_H_

+#include "utilrename.h"

 #define SEC_ERROR_BASE				(-0x2000)
 #define SEC_ERROR_LIMIT				(SEC_ERROR_BASE + 1000)
--- a/mozilla/security/nss/lib/util/secitem.h
+++ b/mozilla/security/nss/lib/util/secitem.h
@ -36,11 +36,14 @@

 #ifndef _SECITEM_H_
 #define _SECITEM_H_
+
+#include "utilrename.h"
+
 /*
 * secitem.h - public data structures and prototypes for handling
 *	       SECItems
 *
- * $Id: secitem.h,v 1.6 2006-05-22 22:24:34 wtchang%redhat.com Exp $
+ * $Id: secitem.h,v 1.7 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 #include "plarena.h"
--- a/mozilla/security/nss/lib/util/secoid.h
+++ b/mozilla/security/nss/lib/util/secoid.h
@ -36,10 +36,13 @@

 #ifndef _SECOID_H_
 #define _SECOID_H_
+
+#include "utilrename.h"
+
 /*
 * secoid.h - public data structures and prototypes for ASN.1 OID functions
 *
- * $Id: secoid.h,v 1.7 2007-07-11 23:28:31 nelson%bolyard.com Exp $
+ * $Id: secoid.h,v 1.8 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 #include "plarena.h"
--- a/mozilla/security/nss/lib/util/secoidt.h
+++ b/mozilla/security/nss/lib/util/secoidt.h
@ -37,10 +37,13 @@

 #ifndef _SECOIDT_H_
 #define _SECOIDT_H_
+
+#include "utilrename.h"
+
 /*
 * secoidt.h - public data structures for ASN.1 OID functions
 *
- * $Id: secoidt.h,v 1.25 2007-09-07 18:45:53 neil.williams%sun.com Exp $
+ * $Id: secoidt.h,v 1.26 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 #include "secitem.h"
--- a/mozilla/security/nss/lib/util/secplcy.h
+++ b/mozilla/security/nss/lib/util/secplcy.h
@ -37,6 +37,8 @@
 #ifndef __secplcy_h__
 #define __secplcy_h__

+#include "utilrename.h"
+
 #include "prtypes.h"

 /*
--- a/mozilla/security/nss/lib/util/secport.h
+++ b/mozilla/security/nss/lib/util/secport.h
@ -37,12 +37,14 @@
 /*
 * secport.h - portability interfaces for security libraries
 *
- * $Id: secport.h,v 1.13 2006-08-15 23:56:01 wtchang%redhat.com Exp $
+ * $Id: secport.h,v 1.14 2007-10-12 01:44:51 julien.pierre.boogz%sun.com Exp $
 */

 #ifndef _SECPORT_H_
 #define _SECPORT_H_

+#include "utilrename.h"
+
 /*
 * define XP_MAC, XP_WIN, XP_BEOS, or XP_UNIX, in case they are not defined
 * by anyone else
--- a/mozilla/security/nss/lib/util/sectime.c
+++ b/mozilla/security/nss/lib/util/sectime.c
@ -43,25 +43,6 @@

 static const PRTime January1st2050  = LL_INIT(0x0008f81e, 0x1b098000);

-const SEC_ASN1Template CERT_TimeChoiceTemplate[] = {
-  { SEC_ASN1_CHOICE, offsetof(SECItem, type), 0, sizeof(SECItem) },
-  { SEC_ASN1_UTC_TIME, 0, 0, siUTCTime },
-  { SEC_ASN1_GENERALIZED_TIME, 0, 0, siGeneralizedTime },
-  { 0 }
-};
-
-SEC_ASN1_CHOOSER_IMPLEMENT(CERT_TimeChoiceTemplate)
-
-const SEC_ASN1Template CERT_ValidityTemplate[] = {
-    { SEC_ASN1_SEQUENCE,
-	  0, NULL, sizeof(CERTValidity) },
-    { SEC_ASN1_INLINE,
-	  offsetof(CERTValidity,notBefore), CERT_TimeChoiceTemplate, 0 },
-    { SEC_ASN1_INLINE,
-	  offsetof(CERTValidity,notAfter), CERT_TimeChoiceTemplate, 0 },
-    { 0 }
-};
-
 static char *DecodeUTCTime2FormattedAscii (SECItem *utcTimeDER, char *format);
 static char *DecodeGeneralizedTime2FormattedAscii (SECItem *generalizedTimeDER, char *format);

--- a/mozilla/security/nss/lib/util/templates.c
+++ b/mozilla/security/nss/lib/util/templates.c
@ -0,0 +1,177 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is the Network Security Services libraries.
+ *
+ * The Initial Developer of the Original Code is
+ * Sun Microsystems, Inc.
+ * Portions created by the Initial Developer are Copyright (C) 2007
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+/*
+ * Templates that are compiled and exported from both libnss3 and libnssutil3.
+ * They have to be, because they were previously exported from libnss3, and
+ * there is no way to create data forwarder symbols on Unix.
+ *
+ * Please do not add to this file. New shared templates should be exported
+ * from libnssutil3 only.
+ *
+ */
+
+#include "utilrename.h"
+#include "secasn1.h"
+#include "secder.h"
+#include "secoid.h"
+#include "secdig.h"
+
+const SEC_ASN1Template CERT_TimeChoiceTemplate[] = {
+  { SEC_ASN1_CHOICE, offsetof(SECItem, type), 0, sizeof(SECItem) },
+  { SEC_ASN1_UTC_TIME, 0, 0, siUTCTime },
+  { SEC_ASN1_GENERALIZED_TIME, 0, 0, siGeneralizedTime },
+  { 0 }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(CERT_TimeChoiceTemplate)
+
+const SEC_ASN1Template SECOID_AlgorithmIDTemplate[] = {
+    { SEC_ASN1_SEQUENCE,
+	  0, NULL, sizeof(SECAlgorithmID) },
+    { SEC_ASN1_OBJECT_ID,
+	  offsetof(SECAlgorithmID,algorithm), },
+    { SEC_ASN1_OPTIONAL | SEC_ASN1_ANY,
+	  offsetof(SECAlgorithmID,parameters), },
+    { 0, }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SECOID_AlgorithmIDTemplate)
+
+const SEC_ASN1Template SEC_AnyTemplate[] = {
+    { SEC_ASN1_ANY | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_AnyTemplate)
+
+const SEC_ASN1Template SEC_BMPStringTemplate[] = {
+    { SEC_ASN1_BMP_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_BMPStringTemplate)
+
+const SEC_ASN1Template SEC_BitStringTemplate[] = {
+    { SEC_ASN1_BIT_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_BitStringTemplate)
+
+const SEC_ASN1Template SEC_BooleanTemplate[] = {
+    { SEC_ASN1_BOOLEAN, 0, NULL, sizeof(SECItem) }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_BooleanTemplate)
+
+const SEC_ASN1Template SEC_GeneralizedTimeTemplate[] = {
+    { SEC_ASN1_GENERALIZED_TIME | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem)}
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_GeneralizedTimeTemplate)
+
+const SEC_ASN1Template SEC_IA5StringTemplate[] = {
+    { SEC_ASN1_IA5_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_IA5StringTemplate)
+
+const SEC_ASN1Template SEC_IntegerTemplate[] = {
+    { SEC_ASN1_INTEGER, 0, NULL, sizeof(SECItem) }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_IntegerTemplate)
+
+const SEC_ASN1Template SEC_NullTemplate[] = {
+    { SEC_ASN1_NULL, 0, NULL, sizeof(SECItem) }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_NullTemplate)
+
+const SEC_ASN1Template SEC_ObjectIDTemplate[] = {
+    { SEC_ASN1_OBJECT_ID, 0, NULL, sizeof(SECItem) }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_ObjectIDTemplate)
+
+const SEC_ASN1Template SEC_OctetStringTemplate[] = {
+    { SEC_ASN1_OCTET_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_OctetStringTemplate)
+
+const SEC_ASN1Template SEC_PointerToAnyTemplate[] = {
+    { SEC_ASN1_POINTER, 0, SEC_AnyTemplate }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_PointerToAnyTemplate)
+
+const SEC_ASN1Template SEC_PointerToOctetStringTemplate[] = {
+    { SEC_ASN1_POINTER | SEC_ASN1_MAY_STREAM, 0, SEC_OctetStringTemplate }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_PointerToOctetStringTemplate)
+
+const SEC_ASN1Template SEC_SetOfAnyTemplate[] = {
+    { SEC_ASN1_SET_OF, 0, SEC_AnyTemplate }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_SetOfAnyTemplate)
+
+const SEC_ASN1Template SEC_UTCTimeTemplate[] = {
+    { SEC_ASN1_UTC_TIME | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem) }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_UTCTimeTemplate)
+
+const SEC_ASN1Template SEC_UTF8StringTemplate[] = {
+    { SEC_ASN1_UTF8_STRING | SEC_ASN1_MAY_STREAM, 0, NULL, sizeof(SECItem)}
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(SEC_UTF8StringTemplate)
+
+/* XXX See comment below about SGN_DecodeDigestInfo -- keep this static! */
+/* XXX Changed from static -- need to change name? */
+const SEC_ASN1Template sgn_DigestInfoTemplate[] = {
+    { SEC_ASN1_SEQUENCE,
+	  0, NULL, sizeof(SGNDigestInfo) },
+    { SEC_ASN1_INLINE,
+	  offsetof(SGNDigestInfo,digestAlgorithm),
+	  SECOID_AlgorithmIDTemplate },
+    { SEC_ASN1_OCTET_STRING,
+	  offsetof(SGNDigestInfo,digest) },
+    { 0 }
+};
+
+SEC_ASN1_CHOOSER_IMPLEMENT(sgn_DigestInfoTemplate)
--- a/mozilla/security/nss/lib/util/utilrename.h
+++ b/mozilla/security/nss/lib/util/utilrename.h
@ -0,0 +1,200 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License") you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is the Network Security Services libraries.
+ *
+ * The Initial Developer of the Original Code is
+ * Sun Microsystems, Inc.
+ * Portions created by the Initial Developer are Copyright (C) 2007
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+/*
+ * utilrename.h - rename symbols moved from libnss3 to libnssutil3
+ *
+ */
+
+#ifndef _LIBUTIL_H_
+#define _LIBUTIL_H_ _LIBUTIL_H__Util
+
+#ifdef USE_UTIL_DIRECTLY
+
+/* functions moved from libnss3 */
+#define nss_InitLock __nss_InitLock_Util
+#define __nss_InitLock __nss_InitLock_Util
+#define ATOB_AsciiToData ATOB_AsciiToData_Util
+#define ATOB_ConvertAsciiToItem ATOB_ConvertAsciiToItem_Util
+#define BTOA_ConvertItemToAscii BTOA_ConvertItemToAscii_Util
+#define BTOA_DataToAscii BTOA_DataToAscii_Util
+#define CERT_CreateValidity CERT_CreateValidity_Util
+#define CERT_DestroyValidity CERT_DestroyValidity_Util
+#define CERT_GenTime2FormattedAscii CERT_GenTime2FormattedAscii_Util
+#define DER_AsciiToTime DER_AsciiToTime_Util
+#define DER_DecodeTimeChoice DER_DecodeTimeChoice_Util
+#define DER_Encode DER_Encode_Util
+#define DER_EncodeTimeChoice DER_EncodeTimeChoice_Util
+#define DER_GeneralizedDayToAscii DER_GeneralizedDayToAscii_Util
+#define DER_GeneralizedTimeToTime DER_GeneralizedTimeToTime_Util
+#define DER_GetInteger DER_GetInteger_Util
+#define DER_Lengths DER_Lengths_Util
+#define DER_TimeChoiceDayToAscii DER_TimeChoiceDayToAscii_Util
+#define DER_TimeToGeneralizedTime DER_TimeToGeneralizedTime_Util
+#define DER_TimeToGeneralizedTimeArena DER_TimeToGeneralizedTimeArena_Util
+#define DER_TimeToUTCTime DER_TimeToUTCTime_Util
+#define DER_UTCDayToAscii DER_UTCDayToAscii_Util
+#define DER_UTCTimeToAscii DER_UTCTimeToAscii_Util
+#define DER_UTCTimeToTime DER_UTCTimeToTime_Util
+#define NSS_PutEnv NSS_PutEnv_Util
+#define NSSBase64_DecodeBuffer NSSBase64_DecodeBuffer_Util
+#define NSSBase64_EncodeItem NSSBase64_EncodeItem_Util
+#define NSSBase64Decoder_Create NSSBase64Decoder_Create_Util
+#define NSSBase64Decoder_Destroy NSSBase64Decoder_Destroy_Util
+#define NSSBase64Decoder_Update NSSBase64Decoder_Update_Util
+#define NSSBase64Encoder_Create NSSBase64Encoder_Create_Util
+#define NSSBase64Encoder_Destroy NSSBase64Encoder_Destroy_Util
+#define NSSBase64Encoder_Update NSSBase64Encoder_Update_Util
+#define NSSRWLock_Destroy NSSRWLock_Destroy_Util
+#define NSSRWLock_HaveWriteLock NSSRWLock_HaveWriteLock_Util
+#define NSSRWLock_LockRead NSSRWLock_LockRead_Util
+#define NSSRWLock_LockWrite NSSRWLock_LockWrite_Util
+#define NSSRWLock_New NSSRWLock_New_Util
+#define NSSRWLock_UnlockRead NSSRWLock_UnlockRead_Util
+#define NSSRWLock_UnlockWrite NSSRWLock_UnlockWrite_Util
+#define PORT_Alloc PORT_Alloc_Util
+#define PORT_ArenaAlloc PORT_ArenaAlloc_Util
+#define PORT_ArenaGrow PORT_ArenaGrow_Util
+#define PORT_ArenaMark PORT_ArenaMark_Util
+#define PORT_ArenaRelease PORT_ArenaRelease_Util
+#define PORT_ArenaStrdup PORT_ArenaStrdup_Util
+#define PORT_ArenaUnmark PORT_ArenaUnmark_Util
+#define PORT_ArenaZAlloc PORT_ArenaZAlloc_Util
+#define PORT_Free PORT_Free_Util
+#define PORT_FreeArena PORT_FreeArena_Util
+#define PORT_GetError PORT_GetError_Util
+#define PORT_NewArena PORT_NewArena_Util
+#define PORT_Realloc PORT_Realloc_Util
+#define PORT_SetError PORT_SetError_Util
+#define PORT_SetUCS2_ASCIIConversionFunction PORT_SetUCS2_ASCIIConversionFunction_Util
+#define PORT_SetUCS2_UTF8ConversionFunction PORT_SetUCS2_UTF8ConversionFunction_Util
+#define PORT_SetUCS4_UTF8ConversionFunction PORT_SetUCS4_UTF8ConversionFunction_Util
+#define PORT_Strdup PORT_Strdup_Util
+#define PORT_UCS2_ASCIIConversion PORT_UCS2_ASCIIConversion_Util
+#define PORT_UCS2_UTF8Conversion PORT_UCS2_UTF8Conversion_Util
+#define PORT_ZAlloc PORT_ZAlloc_Util
+#define PORT_ZFree PORT_ZFree_Util
+#define SEC_ASN1Decode SEC_ASN1Decode_Util
+#define SEC_ASN1DecodeInteger SEC_ASN1DecodeInteger_Util
+#define SEC_ASN1DecodeItem SEC_ASN1DecodeItem_Util
+#define SEC_ASN1DecoderAbort SEC_ASN1DecoderAbort_Util
+#define SEC_ASN1DecoderClearFilterProc SEC_ASN1DecoderClearFilterProc_Util
+#define SEC_ASN1DecoderClearNotifyProc SEC_ASN1DecoderClearNotifyProc_Util
+#define SEC_ASN1DecoderFinish SEC_ASN1DecoderFinish_Util
+#define SEC_ASN1DecoderSetFilterProc SEC_ASN1DecoderSetFilterProc_Util
+#define SEC_ASN1DecoderSetNotifyProc SEC_ASN1DecoderSetNotifyProc_Util
+#define SEC_ASN1DecoderStart SEC_ASN1DecoderStart_Util
+#define SEC_ASN1DecoderUpdate SEC_ASN1DecoderUpdate_Util
+#define SEC_ASN1Encode SEC_ASN1Encode_Util
+#define SEC_ASN1EncodeInteger SEC_ASN1EncodeInteger_Util
+#define SEC_ASN1EncodeItem SEC_ASN1EncodeItem_Util
+#define SEC_ASN1EncoderAbort SEC_ASN1EncoderAbort_Util
+#define SEC_ASN1EncoderClearNotifyProc SEC_ASN1EncoderClearNotifyProc_Util
+#define SEC_ASN1EncoderClearStreaming SEC_ASN1EncoderClearStreaming_Util
+#define SEC_ASN1EncoderClearTakeFromBuf SEC_ASN1EncoderClearTakeFromBuf_Util
+#define SEC_ASN1EncoderFinish SEC_ASN1EncoderFinish_Util
+#define SEC_ASN1EncoderSetNotifyProc SEC_ASN1EncoderSetNotifyProc_Util
+#define SEC_ASN1EncoderSetStreaming SEC_ASN1EncoderSetStreaming_Util
+#define SEC_ASN1EncoderSetTakeFromBuf SEC_ASN1EncoderSetTakeFromBuf_Util
+#define SEC_ASN1EncoderStart SEC_ASN1EncoderStart_Util
+#define SEC_ASN1EncoderUpdate SEC_ASN1EncoderUpdate_Util
+#define SEC_ASN1EncodeUnsignedInteger SEC_ASN1EncodeUnsignedInteger_Util
+#define SEC_ASN1LengthLength SEC_ASN1LengthLength_Util
+#define SEC_QuickDERDecodeItem SEC_QuickDERDecodeItem_Util
+#define SECITEM_AllocItem SECITEM_AllocItem_Util
+#define SECITEM_ArenaDupItem SECITEM_ArenaDupItem_Util
+#define SECITEM_CompareItem SECITEM_CompareItem_Util
+#define SECITEM_CopyItem SECITEM_CopyItem_Util
+#define SECITEM_DupItem SECITEM_DupItem_Util
+#define SECITEM_FreeItem SECITEM_FreeItem_Util
+#define SECITEM_ItemsAreEqual SECITEM_ItemsAreEqual_Util
+#define SECITEM_ZfreeItem SECITEM_ZfreeItem_Util
+#define SECOID_AddEntry SECOID_AddEntry_Util
+#define SECOID_CompareAlgorithmID SECOID_CompareAlgorithmID_Util
+#define SECOID_CopyAlgorithmID SECOID_CopyAlgorithmID_Util
+#define SECOID_DestroyAlgorithmID SECOID_DestroyAlgorithmID_Util
+#define SECOID_FindOID SECOID_FindOID_Util
+#define SECOID_FindOIDByTag SECOID_FindOIDByTag_Util
+#define SECOID_FindOIDTag SECOID_FindOIDTag_Util
+#define SECOID_FindOIDTagDescription SECOID_FindOIDTagDescription_Util
+#define SECOID_GetAlgorithmTag SECOID_GetAlgorithmTag_Util
+#define SECOID_SetAlgorithmID SECOID_SetAlgorithmID_Util
+#define SGN_CompareDigestInfo SGN_CompareDigestInfo_Util
+#define SGN_CopyDigestInfo SGN_CopyDigestInfo_Util
+#define SGN_CreateDigestInfo SGN_CreateDigestInfo_Util
+#define SGN_DestroyDigestInfo SGN_DestroyDigestInfo_Util
+
+/* templates moved from libnss3 */
+#define CERT_TimeChoiceTemplate CERT_TimeChoiceTemplate_Util
+#define NSS_Get_CERT_TimeChoiceTemplate NSS_Get_CERT_TimeChoiceTemplate_Util
+#define NSS_Get_SEC_AnyTemplate NSS_Get_SEC_AnyTemplate_Util
+#define NSS_Get_SEC_BitStringTemplate NSS_Get_SEC_BitStringTemplate_Util
+#define NSS_Get_SEC_BMPStringTemplate NSS_Get_SEC_BMPStringTemplate_Util
+#define NSS_Get_SEC_BooleanTemplate NSS_Get_SEC_BooleanTemplate_Util
+#define NSS_Get_SEC_GeneralizedTimeTemplate NSS_Get_SEC_GeneralizedTimeTemplate_Util
+#define NSS_Get_SEC_IA5StringTemplate NSS_Get_SEC_IA5StringTemplate_Util
+#define NSS_Get_SEC_IntegerTemplate NSS_Get_SEC_IntegerTemplate_Util
+#define NSS_Get_SEC_NullTemplate NSS_Get_SEC_NullTemplate_Util
+#define NSS_Get_SEC_ObjectIDTemplate NSS_Get_SEC_ObjectIDTemplate_Util
+#define NSS_Get_SEC_OctetStringTemplate NSS_Get_SEC_OctetStringTemplate_Util
+#define NSS_Get_SEC_PointerToAnyTemplate NSS_Get_SEC_PointerToAnyTemplate_Util
+#define NSS_Get_SEC_PointerToOctetStringTemplate NSS_Get_SEC_PointerToOctetStringTemplate_Util
+#define NSS_Get_SEC_SetOfAnyTemplate NSS_Get_SEC_SetOfAnyTemplate_Util
+#define NSS_Get_SEC_UTCTimeTemplate NSS_Get_SEC_UTCTimeTemplate_Util
+#define NSS_Get_SEC_UTF8StringTemplate NSS_Get_SEC_UTF8StringTemplate_Util
+#define NSS_Get_SECOID_AlgorithmIDTemplate NSS_Get_SECOID_AlgorithmIDTemplate_Util
+#define NSS_Get_sgn_DigestInfoTemplate NSS_Get_sgn_DigestInfoTemplate_Util
+#define SEC_AnyTemplate SEC_AnyTemplate_Util
+#define SEC_BitStringTemplate SEC_BitStringTemplate_Util
+#define SEC_BMPStringTemplate SEC_BMPStringTemplate_Util
+#define SEC_BooleanTemplate SEC_BooleanTemplate_Util
+#define SEC_GeneralizedTimeTemplate SEC_GeneralizedTimeTemplate_Util
+#define SEC_IA5StringTemplate SEC_IA5StringTemplate_Util
+#define SEC_IntegerTemplate SEC_IntegerTemplate_Util
+#define SEC_NullTemplate SEC_NullTemplate_Util
+#define SEC_ObjectIDTemplate SEC_ObjectIDTemplate_Util
+#define SEC_OctetStringTemplate SEC_OctetStringTemplate_Util
+#define SEC_PointerToAnyTemplate SEC_PointerToAnyTemplate_Util
+#define SEC_PointerToOctetStringTemplate SEC_PointerToOctetStringTemplate_Util
+#define SEC_SetOfAnyTemplate SEC_SetOfAnyTemplate_Util
+#define SEC_UTCTimeTemplate SEC_UTCTimeTemplate_Util
+#define SEC_UTF8StringTemplate SEC_UTF8StringTemplate_Util
+#define SECOID_AlgorithmIDTemplate SECOID_AlgorithmIDTemplate_Util
+#define sgn_DigestInfoTemplate sgn_DigestInfoTemplate_Util
+
+#endif /* USE_UTIL_DIRECTLY */
+
+#endif /* _LIBUTIL_H_ */