$OpenBSD$

index 2afd680..68ba2f4 100644
--- security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c.orig	Fri Feb 20 15:40:39 2015
+++ security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c	Fri Feb 20 15:40:39 2015
@@ -1329,6 +1329,13 @@ pkix_pl_Socket_Create(
                     plContext),
                     PKIX_COULDNOTCREATESOCKETOBJECT);
 
+        // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but
+        // we want to ensure nothing can ever hit this code in production.
+#if 1
+        printf("Tor Browser BUG: Attempted pkix direct socket connect\n");
+        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);
+#endif
+
         socket->isServer = isServer;
         socket->timeout = timeout;
         socket->clientSock = NULL;
@@ -1428,6 +1435,13 @@ pkix_pl_Socket_CreateByName(
 
         localCopyName = PL_strdup(serverName);
 
+        // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but
+        // we want to ensure nothing can ever hit this code in production.
+#if 1
+        printf("Tor Browser BUG: Attempted pkix direct connect to %s\n", serverName);
+        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);
+#endif
+
         sepPtr = strchr(localCopyName, ':');
         /* First strip off the portnum, if present, from the end of the name */
         if (sepPtr) {
@@ -1577,6 +1591,13 @@ pkix_pl_Socket_CreateByHostAndPort(
         PKIX_ENTER(SOCKET, "pkix_pl_Socket_CreateByHostAndPort");
         PKIX_NULLCHECK_THREE(hostname, pStatus, pSocket);
 
+        // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but
+        // we want to ensure nothing can ever hit this code in production.
+#if 1
+        printf("Tor Browser BUG: Attempted pkix direct connect to %s, port %u\n", hostname,
+                portnum);
+        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);
+#endif
 
         prstatus = PR_GetHostByName(hostname, buf, sizeof(buf), &hostent);