Update NSS to 3.36.4-RTM

39 files changed, 1461 insertions, 733 deletions

diff --git a/security/nss/gtests/der_gtest/der_gtest.gyp b/security/nss/gtests/der_gtest/der_gtest.gyp
index 9a382912e1..2df9242d35 100644
--- a/security/nss/gtests/der_gtest/der_gtest.gyp
+++ b/security/nss/gtests/der_gtest/der_gtest.gyp
@@ -13,6 +13,7 @@
       'sources': [
         'der_getint_unittest.cc',
         'der_quickder_unittest.cc',
+        'p12_import_unittest.cc',
         '<(DEPTH)/gtests/common/gtests.cc'
       ],
       'dependencies': [
@@ -21,6 +22,8 @@
         '<(DEPTH)/lib/util/util.gyp:nssutil3',
         '<(DEPTH)/lib/ssl/ssl.gyp:ssl3',
         '<(DEPTH)/lib/nss/nss.gyp:nss3',
+        '<(DEPTH)/lib/pkcs12/pkcs12.gyp:pkcs12',
+        '<(DEPTH)/lib/pkcs7/pkcs7.gyp:pkcs7',
       ]
     }
   ],
diff --git a/security/nss/gtests/der_gtest/manifest.mn b/security/nss/gtests/der_gtest/manifest.mn
index a61d0f1048..f0d6b519f4 100644
--- a/security/nss/gtests/der_gtest/manifest.mn
+++ b/security/nss/gtests/der_gtest/manifest.mn
@@ -9,6 +9,7 @@ MODULE = nss
 CPPSRCS = \
       der_getint_unittest.cc \
       der_quickder_unittest.cc \
+      p12_import_unittest.cc \
       $(NULL)
 
 INCLUDES += -I$(CORE_DEPTH)/gtests/google_test/gtest/include \
diff --git a/security/nss/gtests/der_gtest/p12_import_unittest.cc b/security/nss/gtests/der_gtest/p12_import_unittest.cc
new file mode 100644
index 0000000000..6ffcda3482
--- /dev/null
+++ b/security/nss/gtests/der_gtest/p12_import_unittest.cc
@@ -0,0 +1,251 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nss.h"
+#include "p12.h"
+
+#include "gtest/gtest.h"
+#include "scoped_ptrs.h"
+
+namespace nss_test {
+
+static const uint8_t cert_p12[] = {
+    0x30, 0x82, 0x0a, 0x1f, 0x02, 0x01, 0x03, 0x30, 0x82, 0x09, 0xe5, 0x06,
+    0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01, 0xa0, 0x82,
+    0x09, 0xd6, 0x04, 0x82, 0x09, 0xd2, 0x30, 0x82, 0x09, 0xce, 0x30, 0x82,
+    0x04, 0x42, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07,
+    0x06, 0xa0, 0x82, 0x04, 0x33, 0x30, 0x82, 0x04, 0x2f, 0x02, 0x01, 0x00,
+    0x30, 0x82, 0x04, 0x28, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
+    0x01, 0x07, 0x01, 0x30, 0x57, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
+    0x0d, 0x01, 0x05, 0x0d, 0x30, 0x4a, 0x30, 0x29, 0x06, 0x09, 0x2a, 0x86,
+    0x48, 0x86, 0xf7, 0x0d, 0x01, 0x05, 0x0c, 0x30, 0x1c, 0x04, 0x08, 0x05,
+    0x66, 0xc7, 0x5c, 0x27, 0x4e, 0x15, 0xd9, 0x02, 0x02, 0x08, 0x00, 0x30,
+    0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x09, 0x05,
+    0x00, 0x30, 0x1d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04,
+    0x01, 0x2a, 0x04, 0x10, 0x4e, 0x61, 0xa7, 0x23, 0xc4, 0x3b, 0x37, 0xea,
+    0xba, 0xe9, 0x9f, 0x44, 0x8e, 0x5e, 0xf7, 0xf2, 0x80, 0x82, 0x03, 0xc0,
+    0x76, 0x7d, 0x91, 0x89, 0xe1, 0x04, 0x59, 0x91, 0x0c, 0x72, 0x14, 0x93,
+    0xc4, 0x37, 0xe8, 0xd1, 0xbb, 0x49, 0xfc, 0x23, 0x49, 0x19, 0x6f, 0xc9,
+    0x05, 0x08, 0x52, 0xd8, 0x63, 0xdf, 0x27, 0x63, 0x24, 0x85, 0x73, 0x11,
+    0xfa, 0x6d, 0xca, 0xed, 0xb2, 0x91, 0x77, 0xc6, 0x1f, 0x0b, 0xdb, 0x4d,
+    0x66, 0x34, 0xb9, 0x51, 0xef, 0xf0, 0x8f, 0xf8, 0x71, 0x2b, 0x68, 0xf7,
+    0x5c, 0xdf, 0x99, 0x21, 0x7c, 0xb6, 0xa7, 0x45, 0xdb, 0x71, 0x69, 0x0b,
+    0xb3, 0x2e, 0xff, 0x84, 0xcd, 0xd1, 0xb8, 0x87, 0xe9, 0xaa, 0x3e, 0xcd,
+    0x11, 0x90, 0xcb, 0xd8, 0xe7, 0x08, 0x87, 0x32, 0x82, 0x26, 0x69, 0x9b,
+    0xa6, 0xb1, 0x76, 0xf2, 0x28, 0xe2, 0x6c, 0xf5, 0x50, 0x16, 0x2d, 0x13,
+    0x75, 0x73, 0xed, 0xd1, 0x40, 0x1b, 0xd9, 0x43, 0xf5, 0x1d, 0x60, 0x98,
+    0x33, 0x5e, 0x18, 0xb0, 0xba, 0xe0, 0x8a, 0xaa, 0xa4, 0x3b, 0x78, 0x49,
+    0x59, 0x5f, 0xa4, 0xd5, 0xb5, 0x10, 0xb8, 0x87, 0x46, 0x48, 0xff, 0x5e,
+    0x91, 0x3b, 0xf9, 0xef, 0x29, 0x92, 0x99, 0xfd, 0x22, 0x8c, 0xcd, 0x05,
+    0x2e, 0x0a, 0x24, 0xbf, 0xe4, 0x1b, 0x95, 0x86, 0x94, 0xf2, 0xd9, 0x8c,
+    0x4d, 0xac, 0xe8, 0xb8, 0x49, 0x93, 0x74, 0xcd, 0x79, 0x3f, 0xa4, 0x29,
+    0x09, 0x5a, 0x00, 0x44, 0xfe, 0x75, 0x53, 0x23, 0x7e, 0xe4, 0xf5, 0x71,
+    0xcf, 0x1e, 0x48, 0x1d, 0x89, 0x42, 0x67, 0xa6, 0x1d, 0x0d, 0x0b, 0xe0,
+    0x4a, 0x7a, 0x59, 0xe0, 0x88, 0x63, 0xfc, 0x72, 0x97, 0xc2, 0x9f, 0x5d,
+    0xc3, 0xb2, 0x75, 0x73, 0x25, 0x10, 0x6f, 0x40, 0x93, 0x4f, 0x7d, 0x69,
+    0x01, 0x2d, 0xf4, 0xbe, 0xa9, 0xd9, 0x3c, 0x83, 0x77, 0x92, 0xf4, 0xa1,
+    0x2a, 0x7d, 0x3e, 0xab, 0x2d, 0xa1, 0x53, 0x63, 0x98, 0xaf, 0xc6, 0x11,
+    0x78, 0x3d, 0x37, 0xa9, 0x3f, 0x9c, 0xa8, 0xce, 0xc1, 0x9f, 0xac, 0x45,
+    0x9a, 0x2e, 0x38, 0x9f, 0x08, 0xf9, 0x2d, 0x9e, 0xf5, 0xca, 0x4d, 0x33,
+    0x77, 0x89, 0x2b, 0xde, 0x32, 0x05, 0xe4, 0x39, 0x1a, 0x78, 0x06, 0x7f,
+    0x74, 0x28, 0xab, 0x07, 0xbc, 0x59, 0xd0, 0x52, 0x11, 0x1b, 0x6a, 0x98,
+    0x51, 0xed, 0x5c, 0xf7, 0x96, 0x59, 0xad, 0xb1, 0x48, 0x81, 0xc8, 0xde,
+    0xec, 0xb0, 0x16, 0x7d, 0x61, 0x09, 0xaf, 0x36, 0xe8, 0x2d, 0xd3, 0x88,
+    0x99, 0x35, 0xf2, 0x72, 0xa5, 0xfd, 0xd9, 0xbe, 0xf5, 0x6d, 0x52, 0x4f,
+    0xdb, 0x65, 0x1b, 0x06, 0xfd, 0x1f, 0x61, 0xb3, 0xae, 0x03, 0x96, 0x50,
+    0x96, 0xc4, 0x74, 0x28, 0x26, 0xda, 0x51, 0xc2, 0xd4, 0xff, 0xce, 0xc5,
+    0x26, 0xea, 0x8c, 0xfd, 0x1e, 0x22, 0x03, 0xf0, 0xcd, 0x00, 0xf2, 0x72,
+    0xf3, 0x81, 0x46, 0x1e, 0x95, 0xaf, 0xe1, 0xc1, 0x0a, 0x12, 0xfe, 0xb0,
+    0x97, 0x2d, 0x40, 0xe8, 0x6d, 0xde, 0xe0, 0x9c, 0x7f, 0xad, 0x85, 0x89,
+    0x28, 0x88, 0x4a, 0x64, 0xc1, 0xa4, 0x2f, 0xb6, 0x25, 0xae, 0x89, 0xb4,
+    0xab, 0x02, 0xea, 0xca, 0xd6, 0x05, 0x4f, 0x3a, 0x64, 0xd0, 0xbf, 0x2d,
+    0xba, 0x0a, 0x9c, 0x5a, 0xa5, 0x0b, 0xf5, 0xc7, 0x84, 0x6e, 0xb4, 0x5c,
+    0x0e, 0x43, 0x96, 0xac, 0xfe, 0xc1, 0xc5, 0x3d, 0x15, 0x2b, 0x4d, 0x67,
+    0x2a, 0x09, 0xd8, 0x64, 0x83, 0x13, 0x00, 0x10, 0xe1, 0x60, 0x76, 0x9b,
+    0xf0, 0xa0, 0xdc, 0x8c, 0x4b, 0x4f, 0xc5, 0x93, 0xa8, 0xf8, 0xef, 0xd9,
+    0x75, 0xdc, 0x62, 0xe9, 0xcf, 0xdf, 0x3f, 0x7b, 0x8d, 0x2c, 0x0e, 0x5a,
+    0x99, 0xc6, 0x38, 0x4c, 0xd9, 0xfb, 0xe6, 0xb5, 0x1b, 0x6e, 0xbd, 0xae,
+    0xef, 0x89, 0x71, 0x4e, 0xfd, 0x74, 0x46, 0x35, 0xf9, 0x48, 0x43, 0x11,
+    0x81, 0xcd, 0x6f, 0xdc, 0xf3, 0x2e, 0x92, 0x93, 0x9e, 0xca, 0xf8, 0xfa,
+    0xc6, 0x56, 0x75, 0x1e, 0x04, 0x89, 0x7d, 0x1c, 0x2e, 0xdb, 0xbd, 0x5b,
+    0xec, 0xc8, 0x2d, 0xa3, 0xe2, 0x05, 0xef, 0xe9, 0x5f, 0x05, 0x4b, 0x89,
+    0x82, 0x0c, 0x1e, 0x8c, 0x74, 0xe1, 0x5a, 0x67, 0xe4, 0x97, 0x9b, 0x22,
+    0xd7, 0xdc, 0xe2, 0x74, 0xcf, 0x93, 0xc1, 0xca, 0xc6, 0xde, 0xae, 0xc0,
+    0xd2, 0xf9, 0x57, 0xc5, 0x90, 0x96, 0x48, 0x0a, 0x25, 0x43, 0x75, 0xc1,
+    0x94, 0xa4, 0xd5, 0x14, 0xb2, 0x27, 0xf8, 0x45, 0xf1, 0x3c, 0x01, 0xd6,
+    0xb8, 0x73, 0x1c, 0xb6, 0x55, 0xc5, 0xc9, 0x10, 0x28, 0x2f, 0xba, 0x18,
+    0x36, 0x8d, 0xfe, 0x0b, 0x23, 0xf3, 0x9a, 0x98, 0xfb, 0x2f, 0x59, 0x52,
+    0x3a, 0x0f, 0x75, 0x60, 0xa0, 0x92, 0x0d, 0x78, 0xf0, 0xc7, 0x5d, 0x9d,
+    0x3a, 0x72, 0xd0, 0xd1, 0x30, 0x73, 0x9e, 0x3c, 0x03, 0x99, 0x4c, 0xe2,
+    0xe5, 0xd4, 0x77, 0xfe, 0x3a, 0x92, 0x08, 0x5b, 0x99, 0x51, 0x15, 0x57,
+    0x05, 0x13, 0x51, 0xc2, 0xf4, 0xb5, 0x2d, 0xae, 0x68, 0x9f, 0x4e, 0xbf,
+    0x00, 0x11, 0xc1, 0xe1, 0x48, 0xb3, 0xce, 0x36, 0x42, 0x6a, 0x74, 0xd7,
+    0xe7, 0x84, 0x1e, 0xf3, 0x47, 0xc4, 0xab, 0x59, 0x18, 0x15, 0x31, 0xa4,
+    0x28, 0x68, 0x16, 0xa3, 0x68, 0xbf, 0x6c, 0xfe, 0x7a, 0x36, 0xd9, 0xc1,
+    0x22, 0xd6, 0x5e, 0x2d, 0xbb, 0x9a, 0x1f, 0xb6, 0x8c, 0xa6, 0x65, 0x24,
+    0x3e, 0x01, 0x9c, 0x75, 0x5e, 0x17, 0x42, 0x12, 0x89, 0x85, 0x6f, 0x05,
+    0xac, 0x54, 0xd5, 0x02, 0xea, 0x1e, 0xc2, 0xe1, 0xcd, 0x61, 0x0e, 0x53,
+    0xd5, 0x9d, 0x3a, 0x67, 0x1b, 0x50, 0x9b, 0x90, 0x18, 0x66, 0x6d, 0xb2,
+    0x7f, 0x3a, 0x69, 0xc9, 0xef, 0x07, 0x17, 0x91, 0x8a, 0xe9, 0x15, 0x35,
+    0xed, 0x70, 0x9e, 0x74, 0x8c, 0xe7, 0xf4, 0xaa, 0xcf, 0xbe, 0xa3, 0x98,
+    0x89, 0x8d, 0x3c, 0x5e, 0xa4, 0x6b, 0x8f, 0x1b, 0x18, 0x04, 0x79, 0xd2,
+    0x11, 0x64, 0xb1, 0xc7, 0x68, 0xca, 0xaf, 0x44, 0xa1, 0x39, 0x29, 0x58,
+    0x70, 0x4e, 0xce, 0xb7, 0x7a, 0x3c, 0x4b, 0xdc, 0x32, 0x92, 0x76, 0x74,
+    0xab, 0x0a, 0x6f, 0x8b, 0x74, 0xf5, 0xfd, 0xed, 0x3b, 0x11, 0x95, 0xe8,
+    0x10, 0x74, 0x4c, 0xd8, 0xbe, 0x0f, 0x50, 0xee, 0xa0, 0xee, 0x39, 0xd8,
+    0x9f, 0xa1, 0xa0, 0x21, 0xa3, 0x47, 0x8c, 0xa6, 0xd9, 0xca, 0x8c, 0xb3,
+    0x8b, 0x86, 0x9e, 0x31, 0x3b, 0xcc, 0x7f, 0xea, 0x23, 0xb1, 0x25, 0x73,
+    0xfb, 0x66, 0x99, 0x28, 0xff, 0xf4, 0xe9, 0xb7, 0x19, 0x3e, 0xd5, 0xc6,
+    0x5d, 0xd1, 0xaa, 0x08, 0x6f, 0xf2, 0xff, 0xab, 0x39, 0x69, 0x1f, 0xd3,
+    0x6b, 0x20, 0xf3, 0x2f, 0xe4, 0xd5, 0xb8, 0x76, 0x3f, 0x6c, 0x8f, 0x05,
+    0x3c, 0xe0, 0x18, 0x81, 0x82, 0xca, 0x05, 0x7f, 0xc0, 0x8e, 0x87, 0x50,
+    0xfb, 0xb1, 0x65, 0xfa, 0x2f, 0xb7, 0xba, 0x20, 0x0b, 0x35, 0x5c, 0x87,
+    0xba, 0x90, 0x5a, 0x7f, 0xfc, 0xe9, 0xf2, 0x98, 0x5f, 0x6e, 0xb2, 0xcc,
+    0xef, 0x4b, 0x2d, 0xde, 0xdd, 0x6f, 0xd9, 0x8e, 0x79, 0x89, 0x45, 0xcd,
+    0x4c, 0xdf, 0x27, 0xf1, 0x26, 0x47, 0x9e, 0x83, 0xdb, 0x73, 0x4a, 0x20,
+    0x84, 0xde, 0x09, 0xe0, 0x58, 0xfe, 0x19, 0xcb, 0x92, 0xc4, 0x5b, 0x83,
+    0x30, 0x82, 0x05, 0x84, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
+    0x01, 0x07, 0x01, 0xa0, 0x82, 0x05, 0x75, 0x04, 0x82, 0x05, 0x71, 0x30,
+    0x82, 0x05, 0x6d, 0x30, 0x82, 0x05, 0x69, 0x06, 0x0b, 0x2a, 0x86, 0x48,
+    0x86, 0xf7, 0x0d, 0x01, 0x0c, 0x0a, 0x01, 0x02, 0xa0, 0x82, 0x05, 0x31,
+    0x30, 0x82, 0x05, 0x2d, 0x30, 0x57, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
+    0xf7, 0x0d, 0x01, 0x05, 0x0d, 0x30, 0x4a, 0x30, 0x29, 0x06, 0x09, 0x2a,
+    0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x05, 0x0c, 0x30, 0x1c, 0x04, 0x08,
+    0x5c, 0x72, 0x5e, 0xfb, 0xbc, 0x49, 0xaa, 0xa1, 0x02, 0x02, 0x08, 0x00,
+    0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x09,
+    0x05, 0x00, 0x30, 0x1d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03,
+    0x04, 0x01, 0x2a, 0x04, 0x10, 0xcb, 0xa8, 0xda, 0x75, 0xba, 0x64, 0x22,
+    0x70, 0x39, 0x3c, 0x83, 0x35, 0x0b, 0x41, 0xc4, 0x49, 0x04, 0x82, 0x04,
+    0xd0, 0xb3, 0x3d, 0x9b, 0x03, 0x34, 0xdf, 0x62, 0x37, 0xb0, 0xbb, 0x37,
+    0x0d, 0x88, 0x8c, 0x6b, 0xf2, 0x46, 0x33, 0xa4, 0x4b, 0x48, 0x86, 0x0a,
+    0x36, 0x37, 0x24, 0x21, 0x08, 0x8e, 0x86, 0xbf, 0x4e, 0x9c, 0xe7, 0xa9,
+    0x56, 0x4a, 0x02, 0xb4, 0x74, 0x6a, 0x8a, 0x1e, 0x51, 0x91, 0xe3, 0x8f,
+    0xe3, 0xf6, 0xca, 0x0a, 0x2d, 0xe7, 0x09, 0x5e, 0x1e, 0x59, 0x46, 0x01,
+    0xda, 0xe9, 0x5b, 0xb9, 0xd8, 0x15, 0x7c, 0x05, 0xd9, 0x5f, 0x8c, 0x3d,
+    0xd4, 0xb2, 0xff, 0x25, 0x9d, 0xfe, 0x0e, 0xe3, 0x0c, 0xf0, 0x7f, 0x30,
+    0x25, 0x92, 0x0e, 0x44, 0xf4, 0x16, 0xc7, 0xa2, 0x22, 0xb2, 0x31, 0xfa,
+    0x55, 0x97, 0xf7, 0xd0, 0xd7, 0x58, 0x1f, 0x96, 0x81, 0x06, 0x86, 0xbb,
+    0x07, 0x30, 0x9d, 0x01, 0xb8, 0x15, 0xb2, 0x81, 0xa9, 0x35, 0x09, 0x2c,
+    0x97, 0xbc, 0x8e, 0x2e, 0x2e, 0x30, 0x20, 0x51, 0x94, 0x9d, 0x9f, 0xbd,
+    0x83, 0x48, 0x7b, 0x25, 0xfc, 0x95, 0x42, 0xd7, 0x29, 0xd5, 0x67, 0xcd,
+    0x48, 0xc6, 0x78, 0xe1, 0x6d, 0xdf, 0xf8, 0x0b, 0x3a, 0x95, 0xcc, 0xd0,
+    0x93, 0xfe, 0x23, 0x8d, 0x99, 0xd9, 0x8c, 0x67, 0x38, 0x9f, 0xd0, 0x4c,
+    0xff, 0x32, 0x45, 0x32, 0xa9, 0xe8, 0x9d, 0xbc, 0xbf, 0xaa, 0xb2, 0x49,
+    0xaa, 0x1d, 0xa0, 0x04, 0x53, 0x14, 0xa4, 0x77, 0x96, 0x3f, 0x17, 0xbb,
+    0x2e, 0x14, 0xbe, 0x39, 0x6b, 0x69, 0x16, 0x7a, 0x99, 0xb2, 0xf4, 0x16,
+    0x1a, 0xb7, 0xaa, 0x0a, 0x97, 0xd9, 0x1d, 0x62, 0xbe, 0xfc, 0x38, 0x00,
+    0x6c, 0x65, 0x75, 0xe0, 0xb0, 0x65, 0x8f, 0xb6, 0x4b, 0xe7, 0x21, 0x41,
+    0x65, 0x65, 0x5a, 0x7c, 0x5b, 0xe8, 0x70, 0x83, 0x71, 0xd6, 0x65, 0x7c,
+    0x4f, 0x00, 0x90, 0x55, 0xca, 0xff, 0xc9, 0x3f, 0x61, 0x1e, 0xc0, 0x41,
+    0x67, 0x0c, 0x71, 0xb2, 0xef, 0x12, 0x8e, 0xb1, 0xaa, 0xcf, 0xf1, 0x78,
+    0x9f, 0x5b, 0xb9, 0x7b, 0xbe, 0x04, 0x39, 0xf0, 0x87, 0xca, 0x3a, 0x77,
+    0x31, 0xab, 0x85, 0x8f, 0x4f, 0x06, 0xad, 0x45, 0xf2, 0xe2, 0xc2, 0x20,
+    0x74, 0xf1, 0xdc, 0x21, 0x3f, 0x79, 0x0d, 0xcc, 0xcf, 0x7f, 0xb9, 0x85,
+    0x9e, 0x1a, 0x1b, 0x84, 0xe2, 0x5b, 0xe3, 0x77, 0x27, 0x91, 0xcc, 0xf2,
+    0xe4, 0xf2, 0x19, 0xdd, 0x98, 0x64, 0x9d, 0xcb, 0xf1, 0xc5, 0xe6, 0x7b,
+    0x75, 0x55, 0x4e, 0xa5, 0xca, 0xe3, 0x5b, 0xbe, 0xc2, 0xcd, 0x83, 0x27,
+    0x92, 0xe1, 0x23, 0x3f, 0xd7, 0x3d, 0xb7, 0x3a, 0x8b, 0x3a, 0x26, 0xc1,
+    0xfb, 0xed, 0x69, 0x7a, 0xab, 0xec, 0x0a, 0xe5, 0xaa, 0x81, 0x9f, 0xdf,
+    0x97, 0x45, 0x64, 0x35, 0x7d, 0xad, 0x88, 0x4a, 0x75, 0x13, 0xc3, 0x13,
+    0xd6, 0x9a, 0xf3, 0xa2, 0x94, 0xf7, 0x96, 0x09, 0xa7, 0xbe, 0xb8, 0xe4,
+    0x29, 0x7d, 0xb0, 0xef, 0x4a, 0x5d, 0x0d, 0x02, 0xb4, 0x10, 0x54, 0x17,
+    0x62, 0xef, 0xe2, 0xad, 0x89, 0x6d, 0x91, 0x51, 0x7e, 0x35, 0x28, 0xb4,
+    0xe7, 0x02, 0xbb, 0xcb, 0x03, 0x37, 0xa6, 0xeb, 0x55, 0x51, 0xc0, 0xc2,
+    0x21, 0x7a, 0x78, 0x44, 0x44, 0x70, 0x06, 0xb0, 0x5d, 0x19, 0xaa, 0xcb,
+    0xf1, 0x9f, 0xaa, 0xd3, 0x5a, 0x29, 0xc4, 0xc7, 0x7a, 0x36, 0x1d, 0x65,
+    0x21, 0x52, 0xf9, 0xe2, 0xc7, 0x60, 0xd4, 0x32, 0x03, 0xdf, 0x03, 0xcc,
+    0xe5, 0x7c, 0xf9, 0x15, 0xe3, 0xe6, 0x46, 0xeb, 0xa8, 0xa8, 0x6f, 0xe7,
+    0x46, 0x03, 0xc7, 0x5c, 0x29, 0xf6, 0xac, 0x61, 0x2d, 0xbe, 0xa0, 0xda,
+    0xdc, 0xca, 0x29, 0x35, 0x3b, 0xa0, 0x43, 0x22, 0x22, 0x61, 0x65, 0x8f,
+    0x2d, 0x13, 0xce, 0x61, 0x7c, 0x27, 0x45, 0x9d, 0x9b, 0x8d, 0xd6, 0xc1,
+    0xb5, 0x8c, 0x5b, 0xdb, 0xbb, 0xf6, 0x7e, 0x9a, 0xd4, 0x5c, 0x6b, 0x7e,
+    0xf3, 0x6d, 0x7e, 0x45, 0x2e, 0x55, 0x7d, 0x9f, 0x62, 0xc7, 0xf4, 0x03,
+    0x6f, 0xb9, 0x02, 0xcf, 0x3d, 0x07, 0xc5, 0xc8, 0xce, 0x9e, 0xac, 0x56,
+    0x43, 0x8b, 0xcc, 0xf0, 0x2d, 0xc5, 0x56, 0xfa, 0x61, 0xf9, 0xee, 0x1b,
+    0x89, 0xa9, 0xd6, 0xe8, 0x1e, 0xa2, 0xdf, 0xfd, 0x0d, 0x33, 0x03, 0x91,
+    0xd9, 0x30, 0x4d, 0xfb, 0x2d, 0x7e, 0x5b, 0xb0, 0xb5, 0x55, 0x1e, 0x9c,
+    0x13, 0x96, 0x5a, 0xa6, 0xab, 0x88, 0x79, 0xe7, 0x42, 0x31, 0xb2, 0x2d,
+    0xf8, 0x40, 0x89, 0xe4, 0x96, 0x4c, 0x42, 0xc9, 0x72, 0xd1, 0x8f, 0x3f,
+    0x2d, 0xee, 0x1d, 0x91, 0xe0, 0xfb, 0x1f, 0xb5, 0x94, 0x41, 0xce, 0x89,
+    0xed, 0xe7, 0xec, 0xa0, 0xb6, 0xb2, 0xa2, 0x5c, 0x72, 0xa1, 0x91, 0x40,
+    0x82, 0xde, 0x62, 0xba, 0x12, 0x12, 0xa1, 0xab, 0x31, 0x62, 0x38, 0x48,
+    0x4c, 0x49, 0x9e, 0x6c, 0xf3, 0xf1, 0x69, 0x3e, 0x8b, 0x6a, 0x24, 0x45,
+    0x99, 0x5c, 0x5a, 0xe3, 0x52, 0x24, 0xb7, 0xcf, 0xf0, 0xc8, 0x82, 0x5e,
+    0x9e, 0x10, 0x29, 0xcf, 0xda, 0x01, 0xd0, 0xc0, 0x81, 0xfd, 0x56, 0x15,
+    0x1c, 0x6b, 0xff, 0x78, 0x91, 0xaa, 0x47, 0x63, 0xb0, 0xe2, 0xbd, 0x67,
+    0x0d, 0x24, 0xc5, 0xfd, 0x1a, 0x6a, 0x6a, 0x71, 0x9b, 0xca, 0xc4, 0xb3,
+    0xc0, 0x07, 0x3d, 0xd7, 0x3b, 0xf4, 0xc0, 0xb7, 0xb5, 0xc4, 0x46, 0x85,
+    0x3d, 0x22, 0x03, 0x1b, 0xcf, 0xe6, 0xce, 0x2f, 0xae, 0x41, 0xcf, 0x67,
+    0x6b, 0xd3, 0x87, 0x3f, 0xca, 0x4c, 0xb7, 0x9f, 0x47, 0x36, 0xa5, 0xd7,
+    0xd3, 0x70, 0xf7, 0xc4, 0x9f, 0x7d, 0xbd, 0xe4, 0xc6, 0xec, 0x7b, 0x03,
+    0xca, 0xb0, 0x78, 0x06, 0xa3, 0xf1, 0xd0, 0x98, 0xdf, 0x1c, 0x60, 0x90,
+    0x61, 0xcb, 0x7b, 0x68, 0xd2, 0x8e, 0x24, 0x76, 0x7b, 0xf6, 0x2f, 0xf3,
+    0x7b, 0x96, 0x2d, 0x80, 0x6f, 0xae, 0xc5, 0x2b, 0xe9, 0xad, 0x78, 0x25,
+    0x78, 0x4e, 0xd7, 0x81, 0xb7, 0x60, 0x20, 0x0c, 0x20, 0x46, 0xb4, 0x88,
+    0xfe, 0x12, 0x0a, 0x8d, 0x7a, 0x9a, 0x0b, 0xdd, 0x6d, 0x37, 0xb3, 0xa5,
+    0x99, 0x1d, 0xf2, 0xd4, 0xa6, 0x79, 0x1e, 0x89, 0x1a, 0xda, 0xe8, 0x83,
+    0x24, 0xc9, 0xd9, 0x1f, 0x76, 0x82, 0xec, 0x64, 0x35, 0x6b, 0x9b, 0xfd,
+    0x91, 0x31, 0x96, 0xf2, 0x8b, 0x4f, 0x30, 0xbb, 0xd9, 0xcd, 0xe0, 0x66,
+    0x73, 0xfd, 0xd7, 0x05, 0x16, 0x7c, 0xed, 0x94, 0xc0, 0xa0, 0x73, 0x9e,
+    0xe7, 0x85, 0xac, 0x0e, 0x20, 0xd1, 0x5e, 0x66, 0x7a, 0xef, 0x93, 0x20,
+    0xd7, 0x3f, 0xb5, 0xbd, 0xb7, 0xb7, 0xcb, 0x64, 0xc8, 0xde, 0x2f, 0xd9,
+    0x92, 0x5f, 0xa1, 0xb6, 0xbd, 0xd0, 0xe6, 0xb4, 0x55, 0xf4, 0xa1, 0xa8,
+    0x51, 0x5e, 0x00, 0x6f, 0xaa, 0x09, 0xff, 0x56, 0xb4, 0xbc, 0xdf, 0xc1,
+    0x20, 0x13, 0xc4, 0x3c, 0x48, 0xb1, 0x6d, 0xeb, 0x19, 0xb8, 0xbf, 0x4f,
+    0x3d, 0x35, 0x96, 0x14, 0xc3, 0xc3, 0xef, 0x8e, 0x0b, 0x95, 0xbc, 0x78,
+    0x47, 0x6a, 0x6c, 0x24, 0x10, 0xbd, 0x06, 0x13, 0x5c, 0x69, 0x7b, 0xb5,
+    0x53, 0x43, 0xd1, 0x7a, 0x1d, 0x9a, 0x7f, 0x57, 0xcd, 0x81, 0xc5, 0x3f,
+    0xde, 0x98, 0xb5, 0x73, 0x95, 0xd2, 0x10, 0xcf, 0x4f, 0x6a, 0xce, 0xac,
+    0x35, 0x49, 0x4d, 0xf3, 0xbe, 0xbf, 0x38, 0xf2, 0xcf, 0x1b, 0x1c, 0x19,
+    0x27, 0xa3, 0x3f, 0xd9, 0x35, 0xfe, 0xc2, 0xe5, 0x49, 0x16, 0x28, 0xd0,
+    0x8e, 0xb9, 0x34, 0x6e, 0x8b, 0xa5, 0xe2, 0x9c, 0xbe, 0xad, 0xa1, 0x43,
+    0x61, 0x2e, 0x48, 0x65, 0xb3, 0x20, 0xe7, 0x1d, 0x65, 0x00, 0x9d, 0x6e,
+    0x71, 0xe7, 0x79, 0x44, 0xac, 0x0c, 0x38, 0x5a, 0x1d, 0x40, 0x06, 0x30,
+    0xd0, 0xe8, 0xbe, 0x95, 0x16, 0xaf, 0xd8, 0x5f, 0x67, 0xd3, 0xb0, 0x6a,
+    0xa3, 0x7c, 0xc1, 0x9b, 0x3f, 0xc7, 0xae, 0x27, 0xb1, 0xc1, 0xb5, 0xce,
+    0xdf, 0xbb, 0xa4, 0x4f, 0xb4, 0x58, 0xa1, 0xb9, 0x7c, 0x9c, 0x5f, 0x26,
+    0x4f, 0x13, 0xfa, 0x7c, 0x1a, 0xb7, 0x1b, 0x69, 0xd6, 0x0e, 0x1b, 0x92,
+    0x31, 0x4b, 0xb4, 0x71, 0x12, 0xc8, 0xc4, 0xbd, 0x99, 0xe3, 0xc8, 0x9d,
+    0x68, 0xb3, 0x38, 0x35, 0x3f, 0x16, 0xd8, 0xde, 0x01, 0x71, 0xf6, 0x66,
+    0x77, 0xcb, 0xbd, 0xe2, 0x97, 0x10, 0x91, 0x41, 0x00, 0xa1, 0x0d, 0x9d,
+    0x40, 0x0b, 0xfc, 0x25, 0xc8, 0x44, 0xc3, 0x78, 0xaa, 0x89, 0xd5, 0x59,
+    0xe4, 0xa2, 0x9e, 0xd0, 0x85, 0xa2, 0xdd, 0x80, 0x3b, 0x35, 0x5a, 0x50,
+    0x86, 0xcd, 0x72, 0xf4, 0x9d, 0x69, 0x0e, 0x2d, 0x97, 0x42, 0x09, 0x5e,
+    0xa6, 0x86, 0xf7, 0x35, 0xcf, 0x9b, 0x42, 0xa7, 0x60, 0xa0, 0x71, 0x41,
+    0x28, 0x35, 0x22, 0xd6, 0x55, 0xe1, 0xdb, 0xb3, 0x8e, 0x0d, 0x47, 0xb7,
+    0xd6, 0x02, 0x0f, 0xb1, 0xdf, 0xb8, 0xfb, 0xd8, 0x20, 0xcf, 0x6a, 0x47,
+    0x3f, 0x8a, 0x91, 0x08, 0x64, 0x08, 0xba, 0x19, 0x10, 0x1f, 0xcf, 0xe5,
+    0x34, 0xf1, 0x32, 0x49, 0x3b, 0xaf, 0x18, 0x67, 0x96, 0x47, 0x7f, 0x21,
+    0x8a, 0x37, 0x15, 0x5c, 0xc0, 0xe8, 0x7b, 0xd6, 0x08, 0x5b, 0x45, 0x10,
+    0x1f, 0x1c, 0x7f, 0xce, 0x3b, 0x88, 0xe5, 0x0e, 0xd9, 0x00, 0xce, 0xe5,
+    0x9b, 0x4b, 0x25, 0xc7, 0x11, 0x8a, 0x4f, 0x22, 0xa7, 0x31, 0x25, 0x30,
+    0x23, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x15,
+    0x31, 0x16, 0x04, 0x14, 0xad, 0x7f, 0xeb, 0xe6, 0xb2, 0x6c, 0xf4, 0xdc,
+    0x9f, 0x4d, 0x52, 0x40, 0x07, 0x15, 0xd9, 0xe8, 0xbc, 0x0d, 0x4e, 0xd7,
+    0x30, 0x31, 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
+    0x1a, 0x05, 0x00, 0x04, 0x14, 0xa4, 0xac, 0xdb, 0xa8, 0x4c, 0xe9, 0x7a,
+    0x02, 0x9d, 0x07, 0x39, 0x21, 0xf0, 0x71, 0xae, 0x46, 0x5a, 0xd8, 0x13,
+    0x51, 0x04, 0x08, 0xa1, 0x52, 0xdd, 0x64, 0x46, 0xe9, 0x9e, 0x3e, 0x02,
+    0x02, 0x08, 0x00};
+
+class PK12ImportTest : public ::testing::Test {};
+
+TEST_F(PK12ImportTest, ImportPK12With2P7) {
+  SECItem password = {siBuffer, nullptr, 0};
+  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
+  ScopedSEC_PKCS12DecoderContext dcx(
+      SEC_PKCS12DecoderStart(&password, slot.get(), nullptr, nullptr, nullptr,
+                             nullptr, nullptr, nullptr));
+  ASSERT_TRUE(dcx);
+  SECStatus rv = SEC_PKCS12DecoderUpdate(
+      dcx.get(), const_cast<uint8_t *>(cert_p12), sizeof(cert_p12));
+  ASSERT_EQ(SECSuccess, rv);
+  rv = SEC_PKCS12DecoderVerify(dcx.get());
+  // NSS can't properly decode this P12. But it shouldn't crash.
+  ASSERT_EQ(SECFailure, rv);
+}
+
+}  // namespace nss_test
diff --git a/security/nss/gtests/nss_bogo_shim/config.json b/security/nss/gtests/nss_bogo_shim/config.json
index fed7ca993b..03f8754662 100644
--- a/security/nss/gtests/nss_bogo_shim/config.json
+++ b/security/nss/gtests/nss_bogo_shim/config.json
@@ -1,6 +1,70 @@
 {
     "DisabledTests": {
         "### These tests break whenever we rev versions, so just leave them here for easy uncommenting":"",
+        "SendWarningAlerts-Pass":"BoringSSL updated",
+        "SendBogusAlertType":"BoringSSL updated",
+        "SendEmptyRecords-Pass":"BoringSSL updated",
+        "ExtraCompressionMethods-TLS12":"BoringSSL updated",
+        "SendSNIWarningAlert":"BoringSSL updated",
+        "NoNullCompression-TLS12":"BoringSSL updated",
+        "InvalidCompressionMethod":"BoringSSL updated",
+        "SupportTicketsWithSessionID":"BoringSSL updated",
+        "NoSharedCipher":"BoringSSL updated",
+        "ServerHelloBogusCipher":"BoringSSL updated",
+        "ClientHelloVersionTooHigh":"BoringSSL updated",
+        "ServerAuth-SignatureType":"BoringSSL updated",
+        "ECDSACurveMismatch-Verify-TLS12":"BoringSSL updated",
+        "UnknownExtension-Client":"BoringSSL updated",
+        "UnofferedExtension-Client":"BoringSSL updated",
+        "SendClientVersion-RSA":"BoringSSL updated",
+        "SupportedCurves-ServerHello-TLS12":"BoringSSL updated",
+        "Basic-Client*Sync":"BoringSSL updated",
+        "Resume-Client-CipherMismatch":"BoringSSL updated",
+        "ClientAuth-SignatureType":"BoringSSL updated",
+        "Agree-Digest-Default":"BoringSSL updated",
+        "Basic-Server*Sync":"BoringSSL updated",
+        "ClientAuth-*-Sync":"BoringSSL updated",
+        "RSA-PSS-Default*":"BoringSSL updated",
+        "Renegotiate-Server-NoExt*":"BoringSSL updated",
+        "Downgrade-TLS12*":"BoringSSL updated",
+        "MaxCBCPadding":"BoringSSL updated",
+        "UnknownCipher":"BoringSSL updated",
+        "LargeMessage":"BoringSSL updated",
+        "NoCommonCurves":"BoringSSL updated",
+        "UnknownCurve":"BoringSSL updated",
+        "SessionTicketsDisabled*":"BoringSSL updated",
+        "BadFinished-*":"BoringSSL updated",
+        "ServerSkipCertificateVerify":"BoringSSL updated",
+        "*VersionTolerance":"BoringSSL updated",
+        "ConflictingVersionNegotiation*":"BoringSSL updated",
+        "Ed25519DefaultDisable*":"BoringSSL updated",
+        "*SHA1-Fallback*":"BoringSSL updated",
+        "ExtendedMasterSecret-NoToNo*":"BoringSSL updated",
+        "ServerNameExtensionClientMissing*":"BoringSSL updated",
+        "NoClientCertificate*":"BoringSSL updated",
+        "ServerCipherFilter*":"BoringSSL updated",
+        "*FallbackSCSV*":"BoringSSL updated",
+        "LooseInitialRecordVersion*":"BoringSSL updated",
+        "ALPNClient*":"BoringSSL updated",
+        "MinimumVersion*":"BoringSSL updated",
+        "VersionNegotiation*":"BoringSSL updated",
+        "*Client-ClientAuth*":"BoringSSL updated",
+        "*Server-ClientAuth*":"BoringSSL updated",
+        "NoExtendedMasterSecret*":"BoringSSL updated",
+        "PointFormat*":"BoringSSL updated",
+        "*Sync-SplitHandshakeRecords*":"BoringSSL updated",
+        "*Sync-PackHandshakeFlight*":"BoringSSL updated",
+        "TicketSessionIDLength*":"BoringSSL updated",
+        "*LargeRecord*":"BoringSSL updated",
+        "WrongMessageType-NewSessionTicket":"BoringSSL updated",
+        "WrongMessageType*Certificate*":"BoringSSL updated",
+        "WrongMessageType*Client*":"BoringSSL updated",
+        "WrongMessageType*Server*":"BoringSSL updated",
+        "WrongMessageType*DTLS":"BoringSSL updated",
+        "GarbageCertificate*":"BoringSSL updated",
+        "EmptyExtensions*":"BoringSSL updated",
+        "*OmitExtensions*":"BoringSSL updated",
+        "SupportedVersionSelection-TLS12":"Should maybe reject TLS 1.2 in SH.supported_versions (Bug 1438266)",
         "*TLS13*":"(NSS=19, BoGo=18)",
         "*HelloRetryRequest*":"(NSS=19, BoGo=18)",
         "*KeyShare*":"(NSS=19, BoGo=18)",
diff --git a/security/nss/gtests/ssl_gtest/bloomfilter_unittest.cc b/security/nss/gtests/ssl_gtest/bloomfilter_unittest.cc
index 110cfa13a9..6efe06ec77 100644
--- a/security/nss/gtests/ssl_gtest/bloomfilter_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/bloomfilter_unittest.cc
@@ -105,4 +105,4 @@ static const BloomFilterConfig kBloomFilterConfigurations[] = {
 INSTANTIATE_TEST_CASE_P(BloomFilterConfigurations, BloomFilterTest,
                         ::testing::ValuesIn(kBloomFilterConfigurations));
 
-}  // namespace nspr_test
+}  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/libssl_internals.c b/security/nss/gtests/ssl_gtest/libssl_internals.c
index 887d852786..17b4ffe49a 100644
--- a/security/nss/gtests/ssl_gtest/libssl_internals.c
+++ b/security/nss/gtests/ssl_gtest/libssl_internals.c
@@ -332,10 +332,6 @@ void SSLInt_SetTicketLifetime(uint32_t lifetime) {
   ssl_ticket_lifetime = lifetime;
 }
 
-void SSLInt_SetMaxEarlyDataSize(uint32_t size) {
-  ssl_max_early_data_size = size;
-}
-
 SECStatus SSLInt_SetSocketMaxEarlyDataSize(PRFileDesc *fd, uint32_t size) {
   sslSocket *ss;
 
diff --git a/security/nss/gtests/ssl_gtest/libssl_internals.h b/security/nss/gtests/ssl_gtest/libssl_internals.h
index 95d4afdaf9..3efb362c27 100644
--- a/security/nss/gtests/ssl_gtest/libssl_internals.h
+++ b/security/nss/gtests/ssl_gtest/libssl_internals.h
@@ -50,7 +50,6 @@ PK11SymKey *SSLInt_CipherSpecToKey(const ssl3CipherSpec *spec);
 SSLCipherAlgorithm SSLInt_CipherSpecToAlgorithm(const ssl3CipherSpec *spec);
 const PRUint8 *SSLInt_CipherSpecToIv(const ssl3CipherSpec *spec);
 void SSLInt_SetTicketLifetime(uint32_t lifetime);
-void SSLInt_SetMaxEarlyDataSize(uint32_t size);
 SECStatus SSLInt_SetSocketMaxEarlyDataSize(PRFileDesc *fd, uint32_t size);
 void SSLInt_RolloverAntiReplay(void);
 
diff --git a/security/nss/gtests/ssl_gtest/ssl_0rtt_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_0rtt_unittest.cc
index a602954902..08781af711 100644
--- a/security/nss/gtests/ssl_gtest/ssl_0rtt_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_0rtt_unittest.cc
@@ -94,7 +94,7 @@ class TlsZeroRttReplayTest : public TlsConnectTls13 {
 
     // Now run a true 0-RTT handshake, but capture the first packet.
     auto first_packet = std::make_shared<SaveFirstPacket>();
-    client_->SetPacketFilter(first_packet);
+    client_->SetFilter(first_packet);
     client_->Set0RttEnabled(true);
     server_->Set0RttEnabled(true);
     ExpectResumption(RESUME_TICKET);
@@ -116,8 +116,7 @@ class TlsZeroRttReplayTest : public TlsConnectTls13 {
 
     // Capture the early_data extension, which should not appear.
     auto early_data_ext =
-        std::make_shared<TlsExtensionCapture>(ssl_tls13_early_data_xtn);
-    server_->SetPacketFilter(early_data_ext);
+        MakeTlsFilter<TlsExtensionCapture>(server_, ssl_tls13_early_data_xtn);
 
     // Finally, replay the ClientHello and force the server to consume it.  Stop
     // after the server sends its first flight; the client will not be able to
@@ -405,6 +404,9 @@ TEST_P(TlsConnectTls13, TestTls13ZeroRttDowngrade) {
 // The client should abort the connection when sending a 0-rtt handshake but
 // the servers responds with a TLS 1.2 ServerHello. (with app data)
 TEST_P(TlsConnectTls13, TestTls13ZeroRttDowngradeEarlyData) {
+  const char* k0RttData = "ABCDEF";
+  const PRInt32 k0RttDataLen = static_cast<PRInt32>(strlen(k0RttData));
+
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   server_->Set0RttEnabled(true);  // set ticket_allow_early_data
   Connect();
@@ -422,27 +424,28 @@ TEST_P(TlsConnectTls13, TestTls13ZeroRttDowngradeEarlyData) {
   // Send the early data xtn in the CH, followed by early app data. The server
   // will fail right after sending its flight, when receiving the early data.
   client_->Set0RttEnabled(true);
-  ZeroRttSendReceive(true, false, [this]() {
-    client_->ExpectSendAlert(kTlsAlertIllegalParameter);
-    if (variant_ == ssl_variant_stream) {
-      server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
-    }
-    return true;
-  });
-
-  client_->Handshake();
-  server_->Handshake();
-  ASSERT_TRUE_WAIT(
-      (client_->error_code() == SSL_ERROR_DOWNGRADE_WITH_EARLY_DATA), 2000);
+  client_->Handshake();  // Send ClientHello.
+  PRInt32 rv =
+      PR_Write(client_->ssl_fd(), k0RttData, k0RttDataLen);  // 0-RTT write.
+  EXPECT_EQ(k0RttDataLen, rv);
 
-  // DTLS will timeout as we bump the epoch when installing the early app data
-  // cipher suite. Thus the encrypted alert will be ignored.
   if (variant_ == ssl_variant_stream) {
-    // The server sends an alert when receiving the early app data record.
-    ASSERT_TRUE_WAIT(
-        (server_->error_code() == SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA),
-        2000);
+    // When the server receives the early data, it will fail.
+    server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
+    server_->Handshake();  // Consume ClientHello
+    EXPECT_EQ(TlsAgent::STATE_ERROR, server_->state());
+    server_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_APPLICATION_DATA);
+  } else {
+    // If it's datagram, we just discard the early data.
+    server_->Handshake();  // Consume ClientHello
+    EXPECT_EQ(TlsAgent::STATE_CONNECTING, server_->state());
   }
+
+  // The client now reads the ServerHello and fails.
+  ASSERT_EQ(TlsAgent::STATE_CONNECTING, client_->state());
+  client_->ExpectSendAlert(kTlsAlertIllegalParameter);
+  client_->Handshake();
+  client_->CheckErrorCode(SSL_ERROR_DOWNGRADE_WITH_EARLY_DATA);
 }
 
 static void CheckEarlyDataLimit(const std::shared_ptr<TlsAgent>& agent,
@@ -455,10 +458,13 @@ static void CheckEarlyDataLimit(const std::shared_ptr<TlsAgent>& agent,
 }
 
 TEST_P(TlsConnectTls13, SendTooMuchEarlyData) {
+  EnsureTlsSetup();
   const char* big_message = "0123456789abcdef";
   const size_t short_size = strlen(big_message) - 1;
   const PRInt32 short_length = static_cast<PRInt32>(short_size);
-  SSLInt_SetMaxEarlyDataSize(static_cast<PRUint32>(short_size));
+  EXPECT_EQ(SECSuccess,
+            SSL_SetMaxEarlyDataSize(server_->ssl_fd(),
+                                    static_cast<PRUint32>(short_size)));
   SetupForZeroRtt();
 
   client_->Set0RttEnabled(true);
@@ -510,8 +516,10 @@ TEST_P(TlsConnectTls13, SendTooMuchEarlyData) {
 }
 
 TEST_P(TlsConnectTls13, ReceiveTooMuchEarlyData) {
+  EnsureTlsSetup();
+
   const size_t limit = 5;
-  SSLInt_SetMaxEarlyDataSize(limit);
+  EXPECT_EQ(SECSuccess, SSL_SetMaxEarlyDataSize(server_->ssl_fd(), limit));
   SetupForZeroRtt();
 
   client_->Set0RttEnabled(true);
@@ -521,6 +529,8 @@ TEST_P(TlsConnectTls13, ReceiveTooMuchEarlyData) {
   client_->Handshake();  // Send ClientHello
   CheckEarlyDataLimit(client_, limit);
 
+  server_->Handshake();  // Process ClientHello, send server flight.
+
   // Lift the limit on the client.
   EXPECT_EQ(SECSuccess,
             SSLInt_SetSocketMaxEarlyDataSize(client_->ssl_fd(), 1000));
@@ -534,21 +544,31 @@ TEST_P(TlsConnectTls13, ReceiveTooMuchEarlyData) {
     // This error isn't fatal for DTLS.
     ExpectAlert(server_, kTlsAlertUnexpectedMessage);
   }
-  server_->Handshake();  // Process ClientHello, send server flight.
-  server_->Handshake();  // Just to make sure that we don't read ahead.
+
+  server_->Handshake();  // This reads the early data and maybe throws an error.
+  if (variant_ == ssl_variant_stream) {
+    server_->CheckErrorCode(SSL_ERROR_TOO_MUCH_EARLY_DATA);
+  } else {
+    EXPECT_EQ(TlsAgent::STATE_CONNECTING, server_->state());
+  }
   CheckEarlyDataLimit(server_, limit);
 
-  // Attempt to read early data.
+  // Attempt to read early data. This will get an error.
   std::vector<uint8_t> buf(strlen(message) + 1);
   EXPECT_GT(0, PR_Read(server_->ssl_fd(), buf.data(), buf.capacity()));
   if (variant_ == ssl_variant_stream) {
-    server_->CheckErrorCode(SSL_ERROR_TOO_MUCH_EARLY_DATA);
+    EXPECT_EQ(SSL_ERROR_HANDSHAKE_FAILED, PORT_GetError());
+  } else {
+    EXPECT_EQ(PR_WOULD_BLOCK_ERROR, PORT_GetError());
   }
 
-  client_->Handshake();  // Process the handshake.
-  client_->Handshake();  // Process the alert.
+  client_->Handshake();  // Process the server's first flight.
   if (variant_ == ssl_variant_stream) {
+    client_->Handshake();  // Process the alert.
     client_->CheckErrorCode(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT);
+  } else {
+    server_->Handshake();  // Finish connecting.
+    EXPECT_EQ(TlsAgent::STATE_CONNECTED, server_->state());
   }
 }
 
@@ -583,7 +603,7 @@ TEST_P(TlsConnectTls13, ZeroRttOrdering) {
   // Now, coalesce the next three things from the client: early data, second
   // flight and 1-RTT data.
   auto coalesce = std::make_shared<PacketCoalesceFilter>();
-  client_->SetPacketFilter(coalesce);
+  client_->SetFilter(coalesce);
 
   // Send (and hold) early data.
   static const std::vector<uint8_t> early_data = {3, 2, 1};
diff --git a/security/nss/gtests/ssl_gtest/ssl_agent_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_agent_unittest.cc
index 0aa9a4c78d..f0c57e8b10 100644
--- a/security/nss/gtests/ssl_gtest/ssl_agent_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_agent_unittest.cc
@@ -160,9 +160,8 @@ TEST_F(TlsAgentStreamTestClient, Set0RttOptionThenWrite) {
                           SSL_LIBRARY_VERSION_TLS_1_3);
   agent_->StartConnect();
   agent_->Set0RttEnabled(true);
-  auto filter = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeClientHello);
-  agent_->SetPacketFilter(filter);
+  auto filter =
+      MakeTlsFilter<TlsHandshakeRecorder>(agent_, kTlsHandshakeClientHello);
   PRInt32 rv = PR_Write(agent_->ssl_fd(), k0RttData, strlen(k0RttData));
   EXPECT_EQ(-1, rv);
   int32_t err = PORT_GetError();
diff --git a/security/nss/gtests/ssl_gtest/ssl_auth_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_auth_unittest.cc
index dbcdd92eae..7f2b2840d5 100644
--- a/security/nss/gtests/ssl_gtest/ssl_auth_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_auth_unittest.cc
@@ -95,10 +95,9 @@ TEST_P(TlsConnectGeneric, ClientAuthBigRsa) {
 }
 
 // Offset is the position in the captured buffer where the signature sits.
-static void CheckSigScheme(
-    std::shared_ptr<TlsInspectorRecordHandshakeMessage>& capture, size_t offset,
-    std::shared_ptr<TlsAgent>& peer, uint16_t expected_scheme,
-    size_t expected_size) {
+static void CheckSigScheme(std::shared_ptr<TlsHandshakeRecorder>& capture,
+                           size_t offset, std::shared_ptr<TlsAgent>& peer,
+                           uint16_t expected_scheme, size_t expected_size) {
   EXPECT_LT(offset + 2U, capture->buffer().len());
 
   uint32_t scheme = 0;
@@ -114,9 +113,8 @@ static void CheckSigScheme(
 // in the default certificate.
 TEST_P(TlsConnectTls12, ServerAuthCheckSigAlg) {
   EnsureTlsSetup();
-  auto capture_ske = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeServerKeyExchange);
-  server_->SetPacketFilter(capture_ske);
+  auto capture_ske = MakeTlsFilter<TlsHandshakeRecorder>(
+      server_, kTlsHandshakeServerKeyExchange);
   Connect();
   CheckKeys();
 
@@ -127,15 +125,14 @@ TEST_P(TlsConnectTls12, ServerAuthCheckSigAlg) {
   EXPECT_TRUE(buffer.Read(1, 2, &tmp)) << "read NamedCurve";
   EXPECT_EQ(ssl_grp_ec_curve25519, tmp);
   EXPECT_TRUE(buffer.Read(3, 1, &tmp)) << " read ECPoint";
-  CheckSigScheme(capture_ske, 4 + tmp, client_, ssl_sig_rsa_pss_sha256, 1024);
+  CheckSigScheme(capture_ske, 4 + tmp, client_, ssl_sig_rsa_pss_rsae_sha256,
+                 1024);
 }
 
 TEST_P(TlsConnectTls12, ClientAuthCheckSigAlg) {
   EnsureTlsSetup();
-  auto capture_cert_verify =
-      std::make_shared<TlsInspectorRecordHandshakeMessage>(
-          kTlsHandshakeCertificateVerify);
-  client_->SetPacketFilter(capture_cert_verify);
+  auto capture_cert_verify = MakeTlsFilter<TlsHandshakeRecorder>(
+      client_, kTlsHandshakeCertificateVerify);
   client_->SetupClientAuth();
   server_->RequestClientAuth(true);
   Connect();
@@ -146,21 +143,20 @@ TEST_P(TlsConnectTls12, ClientAuthCheckSigAlg) {
 
 TEST_P(TlsConnectTls12, ClientAuthBigRsaCheckSigAlg) {
   Reset(TlsAgent::kServerRsa, TlsAgent::kRsa2048);
-  auto capture_cert_verify =
-      std::make_shared<TlsInspectorRecordHandshakeMessage>(
-          kTlsHandshakeCertificateVerify);
-  client_->SetPacketFilter(capture_cert_verify);
+  auto capture_cert_verify = MakeTlsFilter<TlsHandshakeRecorder>(
+      client_, kTlsHandshakeCertificateVerify);
   client_->SetupClientAuth();
   server_->RequestClientAuth(true);
   Connect();
   CheckKeys();
-  CheckSigScheme(capture_cert_verify, 0, server_, ssl_sig_rsa_pss_sha256, 2048);
+  CheckSigScheme(capture_cert_verify, 0, server_, ssl_sig_rsa_pss_rsae_sha256,
+                 2048);
 }
 
 class TlsZeroCertificateRequestSigAlgsFilter : public TlsHandshakeFilter {
  public:
-  TlsZeroCertificateRequestSigAlgsFilter()
-      : TlsHandshakeFilter({kTlsHandshakeCertificateRequest}) {}
+  TlsZeroCertificateRequestSigAlgsFilter(const std::shared_ptr<TlsAgent>& agent)
+      : TlsHandshakeFilter(agent, {kTlsHandshakeCertificateRequest}) {}
   virtual PacketFilter::Action FilterHandshake(
       const TlsHandshakeFilter::HandshakeHeader& header,
       const DataBuffer& input, DataBuffer* output) {
@@ -205,12 +201,9 @@ class TlsZeroCertificateRequestSigAlgsFilter : public TlsHandshakeFilter {
 // supported_signature_algorithms in the CertificateRequest message.
 TEST_P(TlsConnectTls12, ClientAuthNoSigAlgsFallback) {
   EnsureTlsSetup();
-  auto filter = std::make_shared<TlsZeroCertificateRequestSigAlgsFilter>();
-  server_->SetPacketFilter(filter);
-  auto capture_cert_verify =
-      std::make_shared<TlsInspectorRecordHandshakeMessage>(
-          kTlsHandshakeCertificateVerify);
-  client_->SetPacketFilter(capture_cert_verify);
+  MakeTlsFilter<TlsZeroCertificateRequestSigAlgsFilter>(server_);
+  auto capture_cert_verify = MakeTlsFilter<TlsHandshakeRecorder>(
+      client_, kTlsHandshakeCertificateVerify);
   client_->SetupClientAuth();
   server_->RequestClientAuth(true);
 
@@ -358,8 +351,7 @@ TEST_P(TlsConnectPre12, SignatureAlgorithmNoOverlapEcdsa) {
 
 // The signature_algorithms extension is mandatory in TLS 1.3.
 TEST_P(TlsConnectTls13, SignatureAlgorithmDrop) {
-  client_->SetPacketFilter(
-      std::make_shared<TlsExtensionDropper>(ssl_signature_algorithms_xtn));
+  MakeTlsFilter<TlsExtensionDropper>(client_, ssl_signature_algorithms_xtn);
   ConnectExpectAlert(server_, kTlsAlertMissingExtension);
   client_->CheckErrorCode(SSL_ERROR_MISSING_EXTENSION_ALERT);
   server_->CheckErrorCode(SSL_ERROR_MISSING_SIGNATURE_ALGORITHMS_EXTENSION);
@@ -368,8 +360,7 @@ TEST_P(TlsConnectTls13, SignatureAlgorithmDrop) {
 // TLS 1.2 has trouble detecting this sort of modification: it uses SHA1 and
 // only fails when the Finished is checked.
 TEST_P(TlsConnectTls12, SignatureAlgorithmDrop) {
-  client_->SetPacketFilter(
-      std::make_shared<TlsExtensionDropper>(ssl_signature_algorithms_xtn));
+  MakeTlsFilter<TlsExtensionDropper>(client_, ssl_signature_algorithms_xtn);
   ConnectExpectAlert(server_, kTlsAlertDecryptError);
   client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT);
   server_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
@@ -387,11 +378,11 @@ class BeforeFinished : public TlsRecordFilter {
   enum HandshakeState { BEFORE_CCS, AFTER_CCS, DONE };
 
  public:
-  BeforeFinished(std::shared_ptr<TlsAgent>& client,
-                 std::shared_ptr<TlsAgent>& server, VoidFunction before_ccs,
-                 VoidFunction before_finished)
-      : client_(client),
-        server_(server),
+  BeforeFinished(const std::shared_ptr<TlsAgent>& server,
+                 const std::shared_ptr<TlsAgent>& client,
+                 VoidFunction before_ccs, VoidFunction before_finished)
+      : TlsRecordFilter(server),
+        client_(client),
         before_ccs_(before_ccs),
         before_finished_(before_finished),
         state_(BEFORE_CCS) {}
@@ -411,7 +402,7 @@ class BeforeFinished : public TlsRecordFilter {
           // but that means that they both get processed together.
           DataBuffer ccs;
           header.Write(&ccs, 0, body);
-          server_.lock()->SendDirect(ccs);
+          agent()->SendDirect(ccs);
           client_.lock()->Handshake();
           state_ = AFTER_CCS;
           // Request that the original record be dropped by the filter.
@@ -436,7 +427,6 @@ class BeforeFinished : public TlsRecordFilter {
 
  private:
   std::weak_ptr<TlsAgent> client_;
-  std::weak_ptr<TlsAgent> server_;
   VoidFunction before_ccs_;
   VoidFunction before_finished_;
   HandshakeState state_;
@@ -461,11 +451,11 @@ class BeforeFinished13 : public PacketFilter {
   };
 
  public:
-  BeforeFinished13(std::shared_ptr<TlsAgent>& client,
-                   std::shared_ptr<TlsAgent>& server,
+  BeforeFinished13(const std::shared_ptr<TlsAgent>& server,
+                   const std::shared_ptr<TlsAgent>& client,
                    VoidFunction before_finished)
-      : client_(client),
-        server_(server),
+      : server_(server),
+        client_(client),
         before_finished_(before_finished),
         records_(0) {}
 
@@ -497,8 +487,8 @@ class BeforeFinished13 : public PacketFilter {
   }
 
  private:
-  std::weak_ptr<TlsAgent> client_;
   std::weak_ptr<TlsAgent> server_;
+  std::weak_ptr<TlsAgent> client_;
   VoidFunction before_finished_;
   size_t records_;
 };
@@ -512,11 +502,9 @@ static SECStatus AuthCompleteBlock(TlsAgent*, PRBool, PRBool) {
 // processed by the client, SSL_AuthCertificateComplete() is called.
 TEST_F(TlsConnectDatagram13, AuthCompleteBeforeFinished) {
   client_->SetAuthCertificateCallback(AuthCompleteBlock);
-  server_->SetPacketFilter(
-      std::make_shared<BeforeFinished13>(client_, server_, [this]() {
-        EXPECT_EQ(SECSuccess,
-                  SSL_AuthCertificateComplete(client_->ssl_fd(), 0));
-      }));
+  MakeTlsFilter<BeforeFinished13>(server_, client_, [this]() {
+    EXPECT_EQ(SECSuccess, SSL_AuthCertificateComplete(client_->ssl_fd(), 0));
+  });
   Connect();
 }
 
@@ -544,13 +532,13 @@ TEST_F(TlsConnectDatagram13, AuthCompleteAfterFinished) {
 
 TEST_P(TlsConnectGenericPre13, ClientWriteBetweenCCSAndFinishedWithFalseStart) {
   client_->EnableFalseStart();
-  server_->SetPacketFilter(std::make_shared<BeforeFinished>(
-      client_, server_,
+  MakeTlsFilter<BeforeFinished>(
+      server_, client_,
       [this]() { EXPECT_TRUE(client_->can_falsestart_hook_called()); },
       [this]() {
         // Write something, which used to fail: bug 1235366.
         client_->SendData(10);
-      }));
+      });
 
   Connect();
   server_->SendData(10);
@@ -560,8 +548,8 @@ TEST_P(TlsConnectGenericPre13, ClientWriteBetweenCCSAndFinishedWithFalseStart) {
 TEST_P(TlsConnectGenericPre13, AuthCompleteBeforeFinishedWithFalseStart) {
   client_->EnableFalseStart();
   client_->SetAuthCertificateCallback(AuthCompleteBlock);
-  server_->SetPacketFilter(std::make_shared<BeforeFinished>(
-      client_, server_,
+  MakeTlsFilter<BeforeFinished>(
+      server_, client_,
       []() {
         // Do nothing before CCS
       },
@@ -572,7 +560,7 @@ TEST_P(TlsConnectGenericPre13, AuthCompleteBeforeFinishedWithFalseStart) {
                   SSL_AuthCertificateComplete(client_->ssl_fd(), 0));
         EXPECT_TRUE(client_->can_falsestart_hook_called());
         client_->SendData(10);
-      }));
+      });
 
   Connect();
   server_->SendData(10);
@@ -606,7 +594,7 @@ TEST_P(TlsConnectGenericPre13, AuthCompleteDelayed) {
   EXPECT_EQ(TlsAgent::STATE_CONNECTED, server_->state());
 
   // The client should send nothing from here on.
-  client_->SetPacketFilter(std::make_shared<EnforceNoActivity>());
+  client_->SetFilter(std::make_shared<EnforceNoActivity>());
   client_->Handshake();
   EXPECT_EQ(TlsAgent::STATE_CONNECTING, client_->state());
 
@@ -616,8 +604,33 @@ TEST_P(TlsConnectGenericPre13, AuthCompleteDelayed) {
   EXPECT_EQ(TlsAgent::STATE_CONNECTED, client_->state());
   EXPECT_EQ(TlsAgent::STATE_CONNECTED, server_->state());
 
-  // Remove this before closing or the close_notify alert will trigger it.
-  client_->DeletePacketFilter();
+  // Remove filter before closing or the close_notify alert will trigger it.
+  client_->ClearFilter();
+}
+
+TEST_P(TlsConnectGenericPre13, AuthCompleteFailDelayed) {
+  client_->SetAuthCertificateCallback(AuthCompleteBlock);
+
+  StartConnect();
+  client_->Handshake();  // Send ClientHello
+  server_->Handshake();  // Send ServerHello
+  client_->Handshake();  // Send ClientKeyExchange and Finished
+  server_->Handshake();  // Send Finished
+  // The server should now report that it is connected
+  EXPECT_EQ(TlsAgent::STATE_CONNECTED, server_->state());
+
+  // The client should send nothing from here on.
+  client_->SetFilter(std::make_shared<EnforceNoActivity>());
+  client_->Handshake();
+  EXPECT_EQ(TlsAgent::STATE_CONNECTING, client_->state());
+
+  // Report failure.
+  client_->ClearFilter();
+  client_->ExpectSendAlert(kTlsAlertBadCertificate);
+  EXPECT_EQ(SECSuccess, SSL_AuthCertificateComplete(client_->ssl_fd(),
+                                                    SSL_ERROR_BAD_CERTIFICATE));
+  client_->Handshake();  // Fail
+  EXPECT_EQ(TlsAgent::STATE_ERROR, client_->state());
 }
 
 // TLS 1.3 handles a delayed AuthComplete callback differently since the
@@ -632,12 +645,12 @@ TEST_P(TlsConnectTls13, AuthCompleteDelayed) {
   EXPECT_EQ(TlsAgent::STATE_CONNECTING, server_->state());
 
   // The client will send nothing until AuthCertificateComplete is called.
-  client_->SetPacketFilter(std::make_shared<EnforceNoActivity>());
+  client_->SetFilter(std::make_shared<EnforceNoActivity>());
   client_->Handshake();
   EXPECT_EQ(TlsAgent::STATE_CONNECTING, client_->state());
 
   // This should allow the handshake to complete now.
-  client_->DeletePacketFilter();
+  client_->ClearFilter();
   EXPECT_EQ(SECSuccess, SSL_AuthCertificateComplete(client_->ssl_fd(), 0));
   client_->Handshake();  // Send Finished
   server_->Handshake();  // Transition to connected and send NewSessionTicket
@@ -645,6 +658,44 @@ TEST_P(TlsConnectTls13, AuthCompleteDelayed) {
   EXPECT_EQ(TlsAgent::STATE_CONNECTED, server_->state());
 }
 
+TEST_P(TlsConnectTls13, AuthCompleteFailDelayed) {
+  client_->SetAuthCertificateCallback(AuthCompleteBlock);
+
+  StartConnect();
+  client_->Handshake();  // Send ClientHello
+  server_->Handshake();  // Send ServerHello
+  EXPECT_EQ(TlsAgent::STATE_CONNECTING, client_->state());
+  EXPECT_EQ(TlsAgent::STATE_CONNECTING, server_->state());
+
+  // The client will send nothing until AuthCertificateComplete is called.
+  client_->SetFilter(std::make_shared<EnforceNoActivity>());
+  client_->Handshake();
+  EXPECT_EQ(TlsAgent::STATE_CONNECTING, client_->state());
+
+  // Report failure.
+  client_->ClearFilter();
+  ExpectAlert(client_, kTlsAlertBadCertificate);
+  EXPECT_EQ(SECSuccess, SSL_AuthCertificateComplete(client_->ssl_fd(),
+                                                    SSL_ERROR_BAD_CERTIFICATE));
+  client_->Handshake();  // This should now fail.
+  server_->Handshake();  // Get the error.
+  EXPECT_EQ(TlsAgent::STATE_ERROR, client_->state());
+  EXPECT_EQ(TlsAgent::STATE_ERROR, server_->state());
+}
+
+static SECStatus AuthCompleteFail(TlsAgent*, PRBool, PRBool) {
+  PORT_SetError(SSL_ERROR_BAD_CERTIFICATE);
+  return SECFailure;
+}
+
+TEST_P(TlsConnectGeneric, AuthFailImmediate) {
+  client_->SetAuthCertificateCallback(AuthCompleteFail);
+
+  StartConnect();
+  ConnectExpectAlert(client_, kTlsAlertBadCertificate);
+  client_->CheckErrorCode(SSL_ERROR_BAD_CERTIFICATE);
+}
+
 static const SSLExtraServerCertData ServerCertDataRsaPkcs1Decrypt = {
     ssl_auth_rsa_decrypt, nullptr, nullptr, nullptr};
 static const SSLExtraServerCertData ServerCertDataRsaPkcs1Sign = {
@@ -767,8 +818,7 @@ TEST_P(TlsSignatureSchemeConfiguration, SignatureSchemeConfigServer) {
 TEST_P(TlsSignatureSchemeConfiguration, SignatureSchemeConfigClient) {
   Reset(certificate_);
   auto capture =
-      std::make_shared<TlsExtensionCapture>(ssl_signature_algorithms_xtn);
-  client_->SetPacketFilter(capture);
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_signature_algorithms_xtn);
   TestSignatureSchemeConfig(client_);
 
   const DataBuffer& ext = capture->extension();
@@ -796,8 +846,8 @@ INSTANTIATE_TEST_CASE_P(
         ::testing::Values(TlsAgent::kServerRsaSign),
         ::testing::Values(ssl_auth_rsa_sign),
         ::testing::Values(ssl_sig_rsa_pkcs1_sha256, ssl_sig_rsa_pkcs1_sha384,
-                          ssl_sig_rsa_pkcs1_sha512, ssl_sig_rsa_pss_sha256,
-                          ssl_sig_rsa_pss_sha384)));
+                          ssl_sig_rsa_pkcs1_sha512, ssl_sig_rsa_pss_rsae_sha256,
+                          ssl_sig_rsa_pss_rsae_sha384)));
 // PSS with SHA-512 needs a bigger key to work.
 INSTANTIATE_TEST_CASE_P(
     SignatureSchemeBigRsa, TlsSignatureSchemeConfiguration,
@@ -805,7 +855,7 @@ INSTANTIATE_TEST_CASE_P(
                        TlsConnectTestBase::kTlsV12Plus,
                        ::testing::Values(TlsAgent::kRsa2048),
                        ::testing::Values(ssl_auth_rsa_sign),
-                       ::testing::Values(ssl_sig_rsa_pss_sha512)));
+                       ::testing::Values(ssl_sig_rsa_pss_rsae_sha512)));
 INSTANTIATE_TEST_CASE_P(
     SignatureSchemeRsaSha1, TlsSignatureSchemeConfiguration,
     ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll,
@@ -842,4 +892,4 @@ INSTANTIATE_TEST_CASE_P(
                                          TlsAgent::kServerEcdsa384),
                        ::testing::Values(ssl_auth_ecdsa),
                        ::testing::Values(ssl_sig_ecdsa_sha1)));
-}
+}  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/ssl_cert_ext_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_cert_ext_unittest.cc
index 36ee104afd..573c69c754 100644
--- a/security/nss/gtests/ssl_gtest/ssl_cert_ext_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_cert_ext_unittest.cc
@@ -180,9 +180,8 @@ TEST_P(TlsConnectGenericPre13, OcspMangled) {
       server_->ConfigServerCert(TlsAgent::kServerRsa, true, &kOcspExtraData));
 
   static const uint8_t val[] = {1};
-  auto replacer = std::make_shared<TlsExtensionReplacer>(
-      ssl_cert_status_xtn, DataBuffer(val, sizeof(val)));
-  server_->SetPacketFilter(replacer);
+  auto replacer = MakeTlsFilter<TlsExtensionReplacer>(
+      server_, ssl_cert_status_xtn, DataBuffer(val, sizeof(val)));
   ConnectExpectAlert(client_, kTlsAlertIllegalParameter);
   client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_SERVER_HELLO);
   server_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
@@ -192,8 +191,7 @@ TEST_P(TlsConnectGeneric, OcspSuccess) {
   EnsureTlsSetup();
   client_->SetOption(SSL_ENABLE_OCSP_STAPLING, PR_TRUE);
   auto capture_ocsp =
-      std::make_shared<TlsExtensionCapture>(ssl_cert_status_xtn);
-  server_->SetPacketFilter(capture_ocsp);
+      MakeTlsFilter<TlsExtensionCapture>(server_, ssl_cert_status_xtn);
 
   // The value should be available during the AuthCertificateCallback
   client_->SetAuthCertificateCallback([](TlsAgent* agent, bool checksig,
@@ -245,4 +243,4 @@ TEST_P(TlsConnectGeneric, OcspHugeSuccess) {
   Connect();
 }
 
-}  // namespace nspr_test
+}  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/ssl_ciphersuite_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_ciphersuite_unittest.cc
index 810656868e..fa2238be7d 100644
--- a/security/nss/gtests/ssl_gtest/ssl_ciphersuite_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_ciphersuite_unittest.cc
@@ -74,12 +74,12 @@ class TlsCipherSuiteTestBase : public TlsConnectTestBase {
           Reset(TlsAgent::kServerRsaSign);
           auth_type_ = ssl_auth_rsa_sign;
           break;
-        case ssl_sig_rsa_pss_sha256:
-        case ssl_sig_rsa_pss_sha384:
+        case ssl_sig_rsa_pss_rsae_sha256:
+        case ssl_sig_rsa_pss_rsae_sha384:
           Reset(TlsAgent::kServerRsaSign);
           auth_type_ = ssl_auth_rsa_sign;
           break;
-        case ssl_sig_rsa_pss_sha512:
+        case ssl_sig_rsa_pss_rsae_sha512:
           // You can't fit SHA-512 PSS in a 1024-bit key.
           Reset(TlsAgent::kRsa2048);
           auth_type_ = ssl_auth_rsa_sign;
@@ -313,8 +313,8 @@ static const auto kDummySignatureSchemesParams =
 static SSLSignatureScheme kSignatureSchemesParamsArr[] = {
     ssl_sig_rsa_pkcs1_sha256,       ssl_sig_rsa_pkcs1_sha384,
     ssl_sig_rsa_pkcs1_sha512,       ssl_sig_ecdsa_secp256r1_sha256,
-    ssl_sig_ecdsa_secp384r1_sha384, ssl_sig_rsa_pss_sha256,
-    ssl_sig_rsa_pss_sha384,         ssl_sig_rsa_pss_sha512,
+    ssl_sig_ecdsa_secp384r1_sha384, ssl_sig_rsa_pss_rsae_sha256,
+    ssl_sig_rsa_pss_rsae_sha384,    ssl_sig_rsa_pss_rsae_sha512,
 };
 #endif
 
@@ -466,4 +466,4 @@ static const SecStatusParams kSecStatusTestValuesArr[] = {
 INSTANTIATE_TEST_CASE_P(TestSecurityStatus, SecurityStatusTest,
                         ::testing::ValuesIn(kSecStatusTestValuesArr));
 
-}  // namespace nspr_test
+}  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/ssl_custext_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_custext_unittest.cc
index dad944a1fc..c2f582a93a 100644
--- a/security/nss/gtests/ssl_gtest/ssl_custext_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_custext_unittest.cc
@@ -150,9 +150,8 @@ TEST_F(TlsConnectStreamTls13, CustomExtensionWriterDisable) {
       client_->ssl_fd(), ssl_signed_cert_timestamp_xtn, NoopExtensionWriter,
       nullptr, NoopExtensionHandler, nullptr);
   EXPECT_EQ(SECSuccess, rv);
-  auto capture =
-      std::make_shared<TlsExtensionCapture>(ssl_signed_cert_timestamp_xtn);
-  client_->SetPacketFilter(capture);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(
+      client_, ssl_signed_cert_timestamp_xtn);
 
   Connect();
   // So nothing will be sent.
@@ -204,9 +203,8 @@ TEST_F(TlsConnectStreamTls13, CustomExtensionOverride) {
   EXPECT_EQ(SECSuccess, rv);
 
   // Capture it to see what we got.
-  auto capture =
-      std::make_shared<TlsExtensionCapture>(ssl_signed_cert_timestamp_xtn);
-  client_->SetPacketFilter(capture);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(
+      client_, ssl_signed_cert_timestamp_xtn);
 
   ConnectExpectAlert(server_, kTlsAlertDecodeError);
 
@@ -246,8 +244,7 @@ TEST_F(TlsConnectStreamTls13, CustomExtensionClientToServer) {
   EXPECT_EQ(SECSuccess, rv);
 
   // Capture it to see what we got.
-  auto capture = std::make_shared<TlsExtensionCapture>(extension_code);
-  client_->SetPacketFilter(capture);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(client_, extension_code);
 
   // Handle it so that the handshake completes.
   rv = SSL_InstallExtensionHooks(server_->ssl_fd(), extension_code,
@@ -290,9 +287,8 @@ TEST_F(TlsConnectStreamTls13, CustomExtensionServerToClientSH) {
   EXPECT_EQ(SECSuccess, rv);
 
   // Capture the extension from the ServerHello only and check it.
-  auto capture = std::make_shared<TlsExtensionCapture>(extension_code);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(server_, extension_code);
   capture->SetHandshakeTypes({kTlsHandshakeServerHello});
-  server_->SetPacketFilter(capture);
 
   Connect();
 
@@ -329,9 +325,9 @@ TEST_F(TlsConnectStreamTls13, CustomExtensionServerToClientEE) {
   EXPECT_EQ(SECSuccess, rv);
 
   // Capture the extension from the EncryptedExtensions only and check it.
-  auto capture = std::make_shared<TlsExtensionCapture>(extension_code);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(server_, extension_code);
   capture->SetHandshakeTypes({kTlsHandshakeEncryptedExtensions});
-  server_->SetTlsRecordFilter(capture);
+  capture->EnableDecryption();
 
   Connect();
 
@@ -350,8 +346,7 @@ TEST_F(TlsConnectStreamTls13, CustomExtensionUnsolicitedServer) {
   EXPECT_EQ(SECSuccess, rv);
 
   // Capture it to see what we got.
-  auto capture = std::make_shared<TlsExtensionCapture>(extension_code);
-  server_->SetPacketFilter(capture);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(server_, extension_code);
 
   client_->ExpectSendAlert(kTlsAlertUnsupportedExtension);
   server_->ExpectSendAlert(kTlsAlertBadRecordMac);
@@ -500,4 +495,4 @@ TEST_F(TlsConnectStreamTls13, CustomExtensionOverrunBuffer) {
   client_->CheckErrorCode(SEC_ERROR_APPLICATION_CALLBACK_ERROR);
 }
 
-}  // namespace "nss_test"
+}  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/ssl_damage_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_damage_unittest.cc
index d1668b823a..b8836d7fc2 100644
--- a/security/nss/gtests/ssl_gtest/ssl_damage_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_damage_unittest.cc
@@ -50,19 +50,19 @@ TEST_F(TlsConnectTest, DamageSecretHandleServerFinished) {
                            SSL_LIBRARY_VERSION_TLS_1_3);
   server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_1,
                            SSL_LIBRARY_VERSION_TLS_1_3);
-  server_->SetPacketFilter(std::make_shared<AfterRecordN>(
+  MakeTlsFilter<AfterRecordN>(
       server_, client_,
       0,  // ServerHello.
-      [this]() { SSLInt_DamageServerHsTrafficSecret(client_->ssl_fd()); }));
+      [this]() { SSLInt_DamageServerHsTrafficSecret(client_->ssl_fd()); });
   ConnectExpectAlert(client_, kTlsAlertDecryptError);
   client_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
 }
 
 TEST_P(TlsConnectGenericPre13, DamageServerSignature) {
   EnsureTlsSetup();
-  auto filter =
-      std::make_shared<TlsLastByteDamager>(kTlsHandshakeServerKeyExchange);
-  server_->SetTlsRecordFilter(filter);
+  auto filter = MakeTlsFilter<TlsLastByteDamager>(
+      server_, kTlsHandshakeServerKeyExchange);
+  filter->EnableDecryption();
   ExpectAlert(client_, kTlsAlertDecryptError);
   ConnectExpectFail();
   client_->CheckErrorCode(SEC_ERROR_BAD_SIGNATURE);
@@ -71,9 +71,9 @@ TEST_P(TlsConnectGenericPre13, DamageServerSignature) {
 
 TEST_P(TlsConnectTls13, DamageServerSignature) {
   EnsureTlsSetup();
-  auto filter =
-      std::make_shared<TlsLastByteDamager>(kTlsHandshakeCertificateVerify);
-  server_->SetTlsRecordFilter(filter);
+  auto filter = MakeTlsFilter<TlsLastByteDamager>(
+      server_, kTlsHandshakeCertificateVerify);
+  filter->EnableDecryption();
   ConnectExpectAlert(client_, kTlsAlertDecryptError);
   client_->CheckErrorCode(SEC_ERROR_BAD_SIGNATURE);
 }
@@ -82,9 +82,9 @@ TEST_P(TlsConnectGeneric, DamageClientSignature) {
   EnsureTlsSetup();
   client_->SetupClientAuth();
   server_->RequestClientAuth(true);
-  auto filter =
-      std::make_shared<TlsLastByteDamager>(kTlsHandshakeCertificateVerify);
-  client_->SetTlsRecordFilter(filter);
+  auto filter = MakeTlsFilter<TlsLastByteDamager>(
+      client_, kTlsHandshakeCertificateVerify);
+  filter->EnableDecryption();
   server_->ExpectSendAlert(kTlsAlertDecryptError);
   // Do these handshakes by hand to avoid race condition on
   // the client processing the server's alert.
@@ -100,4 +100,4 @@ TEST_P(TlsConnectGeneric, DamageClientSignature) {
   server_->CheckErrorCode(SEC_ERROR_BAD_SIGNATURE);
 }
 
-}  // namespace nspr_test
+}  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/ssl_dhe_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_dhe_unittest.cc
index 4aa3bb6392..cdafa7a84f 100644
--- a/security/nss/gtests/ssl_gtest/ssl_dhe_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_dhe_unittest.cc
@@ -24,7 +24,7 @@ TEST_P(TlsConnectGeneric, ConnectDhe) {
   EnableOnlyDheCiphers();
   Connect();
   CheckKeys(ssl_kea_dh, ssl_grp_ffdhe_2048, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 }
 
 TEST_P(TlsConnectTls13, SharesForBothEcdheAndDhe) {
@@ -32,12 +32,12 @@ TEST_P(TlsConnectTls13, SharesForBothEcdheAndDhe) {
   client_->ConfigNamedGroups(kAllDHEGroups);
 
   auto groups_capture =
-      std::make_shared<TlsExtensionCapture>(ssl_supported_groups_xtn);
+      std::make_shared<TlsExtensionCapture>(client_, ssl_supported_groups_xtn);
   auto shares_capture =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
+      std::make_shared<TlsExtensionCapture>(client_, ssl_tls13_key_share_xtn);
   std::vector<std::shared_ptr<PacketFilter>> captures = {groups_capture,
                                                          shares_capture};
-  client_->SetPacketFilter(std::make_shared<ChainedPacketFilter>(captures));
+  client_->SetFilter(std::make_shared<ChainedPacketFilter>(captures));
 
   Connect();
 
@@ -61,12 +61,12 @@ TEST_P(TlsConnectGeneric, ConnectFfdheClient) {
   EnableOnlyDheCiphers();
   client_->SetOption(SSL_REQUIRE_DH_NAMED_GROUPS, PR_TRUE);
   auto groups_capture =
-      std::make_shared<TlsExtensionCapture>(ssl_supported_groups_xtn);
+      std::make_shared<TlsExtensionCapture>(client_, ssl_supported_groups_xtn);
   auto shares_capture =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
+      std::make_shared<TlsExtensionCapture>(client_, ssl_tls13_key_share_xtn);
   std::vector<std::shared_ptr<PacketFilter>> captures = {groups_capture,
                                                          shares_capture};
-  client_->SetPacketFilter(std::make_shared<ChainedPacketFilter>(captures));
+  client_->SetFilter(std::make_shared<ChainedPacketFilter>(captures));
 
   Connect();
 
@@ -103,8 +103,8 @@ TEST_P(TlsConnectGenericPre13, ConnectFfdheServer) {
 
 class TlsDheServerKeyExchangeDamager : public TlsHandshakeFilter {
  public:
-  TlsDheServerKeyExchangeDamager()
-      : TlsHandshakeFilter({kTlsHandshakeServerKeyExchange}) {}
+  TlsDheServerKeyExchangeDamager(const std::shared_ptr<TlsAgent>& agent)
+      : TlsHandshakeFilter(agent, {kTlsHandshakeServerKeyExchange}) {}
   virtual PacketFilter::Action FilterHandshake(
       const TlsHandshakeFilter::HandshakeHeader& header,
       const DataBuffer& input, DataBuffer* output) {
@@ -122,7 +122,7 @@ class TlsDheServerKeyExchangeDamager : public TlsHandshakeFilter {
 TEST_P(TlsConnectGenericPre13, DamageServerKeyShare) {
   EnableOnlyDheCiphers();
   client_->SetOption(SSL_REQUIRE_DH_NAMED_GROUPS, PR_TRUE);
-  server_->SetPacketFilter(std::make_shared<TlsDheServerKeyExchangeDamager>());
+  MakeTlsFilter<TlsDheServerKeyExchangeDamager>(server_);
 
   ConnectExpectAlert(client_, kTlsAlertIllegalParameter);
 
@@ -141,8 +141,9 @@ class TlsDheSkeChangeY : public TlsHandshakeFilter {
     kYZeroPad
   };
 
-  TlsDheSkeChangeY(uint8_t handshake_type, ChangeYTo change)
-      : TlsHandshakeFilter({handshake_type}), change_Y_(change) {}
+  TlsDheSkeChangeY(const std::shared_ptr<TlsAgent>& agent,
+                   uint8_t handshake_type, ChangeYTo change)
+      : TlsHandshakeFilter(agent, {handshake_type}), change_Y_(change) {}
 
  protected:
   void ChangeY(const DataBuffer& input, DataBuffer* output, size_t offset,
@@ -207,8 +208,9 @@ class TlsDheSkeChangeY : public TlsHandshakeFilter {
 
 class TlsDheSkeChangeYServer : public TlsDheSkeChangeY {
  public:
-  TlsDheSkeChangeYServer(ChangeYTo change, bool modify)
-      : TlsDheSkeChangeY(kTlsHandshakeServerKeyExchange, change),
+  TlsDheSkeChangeYServer(const std::shared_ptr<TlsAgent>& agent,
+                         ChangeYTo change, bool modify)
+      : TlsDheSkeChangeY(agent, kTlsHandshakeServerKeyExchange, change),
         modify_(modify),
         p_() {}
 
@@ -245,9 +247,9 @@ class TlsDheSkeChangeYServer : public TlsDheSkeChangeY {
 class TlsDheSkeChangeYClient : public TlsDheSkeChangeY {
  public:
   TlsDheSkeChangeYClient(
-      ChangeYTo change,
+      const std::shared_ptr<TlsAgent>& agent, ChangeYTo change,
       std::shared_ptr<const TlsDheSkeChangeYServer> server_filter)
-      : TlsDheSkeChangeY(kTlsHandshakeClientKeyExchange, change),
+      : TlsDheSkeChangeY(agent, kTlsHandshakeClientKeyExchange, change),
         server_filter_(server_filter) {}
 
  protected:
@@ -282,8 +284,7 @@ TEST_P(TlsDamageDHYTest, DamageServerY) {
     client_->SetOption(SSL_REQUIRE_DH_NAMED_GROUPS, PR_TRUE);
   }
   TlsDheSkeChangeY::ChangeYTo change = std::get<2>(GetParam());
-  server_->SetPacketFilter(
-      std::make_shared<TlsDheSkeChangeYServer>(change, true));
+  MakeTlsFilter<TlsDheSkeChangeYServer>(server_, change, true);
 
   if (change == TlsDheSkeChangeY::kYZeroPad) {
     ExpectAlert(client_, kTlsAlertDecryptError);
@@ -312,14 +313,12 @@ TEST_P(TlsDamageDHYTest, DamageClientY) {
     client_->SetOption(SSL_REQUIRE_DH_NAMED_GROUPS, PR_TRUE);
   }
   // The filter on the server is required to capture the prime.
-  auto server_filter =
-      std::make_shared<TlsDheSkeChangeYServer>(TlsDheSkeChangeY::kYZero, false);
-  server_->SetPacketFilter(server_filter);
+  auto server_filter = MakeTlsFilter<TlsDheSkeChangeYServer>(
+      server_, TlsDheSkeChangeY::kYZero, false);
 
   // The client filter does the damage.
   TlsDheSkeChangeY::ChangeYTo change = std::get<2>(GetParam());
-  client_->SetPacketFilter(
-      std::make_shared<TlsDheSkeChangeYClient>(change, server_filter));
+  MakeTlsFilter<TlsDheSkeChangeYClient>(client_, change, server_filter);
 
   if (change == TlsDheSkeChangeY::kYZeroPad) {
     ExpectAlert(server_, kTlsAlertDecryptError);
@@ -358,7 +357,9 @@ INSTANTIATE_TEST_CASE_P(
 
 class TlsDheSkeMakePEven : public TlsHandshakeFilter {
  public:
-  TlsDheSkeMakePEven() : TlsHandshakeFilter({kTlsHandshakeServerKeyExchange}) {}
+  TlsDheSkeMakePEven(const std::shared_ptr<TlsAgent>& agent)
+      : TlsHandshakeFilter(agent, {kTlsHandshakeServerKeyExchange}) {}
+
   virtual PacketFilter::Action FilterHandshake(
       const TlsHandshakeFilter::HandshakeHeader& header,
       const DataBuffer& input, DataBuffer* output) {
@@ -379,7 +380,7 @@ class TlsDheSkeMakePEven : public TlsHandshakeFilter {
 // Even without requiring named groups, an even value for p is bad news.
 TEST_P(TlsConnectGenericPre13, MakeDhePEven) {
   EnableOnlyDheCiphers();
-  server_->SetPacketFilter(std::make_shared<TlsDheSkeMakePEven>());
+  MakeTlsFilter<TlsDheSkeMakePEven>(server_);
 
   ConnectExpectAlert(client_, kTlsAlertIllegalParameter);
 
@@ -389,7 +390,9 @@ TEST_P(TlsConnectGenericPre13, MakeDhePEven) {
 
 class TlsDheSkeZeroPadP : public TlsHandshakeFilter {
  public:
-  TlsDheSkeZeroPadP() : TlsHandshakeFilter({kTlsHandshakeServerKeyExchange}) {}
+  TlsDheSkeZeroPadP(const std::shared_ptr<TlsAgent>& agent)
+      : TlsHandshakeFilter(agent, {kTlsHandshakeServerKeyExchange}) {}
+
   virtual PacketFilter::Action FilterHandshake(
       const TlsHandshakeFilter::HandshakeHeader& header,
       const DataBuffer& input, DataBuffer* output) {
@@ -407,7 +410,7 @@ class TlsDheSkeZeroPadP : public TlsHandshakeFilter {
 // Zero padding only causes signature failure.
 TEST_P(TlsConnectGenericPre13, PadDheP) {
   EnableOnlyDheCiphers();
-  server_->SetPacketFilter(std::make_shared<TlsDheSkeZeroPadP>());
+  MakeTlsFilter<TlsDheSkeZeroPadP>(server_);
 
   ConnectExpectAlert(client_, kTlsAlertDecryptError);
 
@@ -455,7 +458,7 @@ TEST_P(TlsConnectGenericPre13, NamedGroupMismatchPre13) {
 
   Connect();
   CheckKeys(ssl_kea_dh, ssl_grp_ffdhe_custom, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 }
 
 // Same test but for TLS 1.3. This has to fail.
@@ -499,8 +502,8 @@ TEST_P(TlsConnectGenericPre13, PreferredFfdhe) {
   Connect();
   client_->CheckKEA(ssl_kea_dh, ssl_grp_ffdhe_3072, 3072);
   server_->CheckKEA(ssl_kea_dh, ssl_grp_ffdhe_3072, 3072);
-  client_->CheckAuthType(ssl_auth_rsa_sign, ssl_sig_rsa_pss_sha256);
-  server_->CheckAuthType(ssl_auth_rsa_sign, ssl_sig_rsa_pss_sha256);
+  client_->CheckAuthType(ssl_auth_rsa_sign, ssl_sig_rsa_pss_rsae_sha256);
+  server_->CheckAuthType(ssl_auth_rsa_sign, ssl_sig_rsa_pss_rsae_sha256);
 }
 
 TEST_P(TlsConnectGenericPre13, MismatchDHE) {
@@ -524,29 +527,28 @@ TEST_P(TlsConnectTls13, ResumeFfdhe) {
   Connect();
   SendReceive();  // Need to read so that we absorb the session ticket.
   CheckKeys(ssl_kea_dh, ssl_grp_ffdhe_2048, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 
   Reset();
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   EnableOnlyDheCiphers();
   auto clientCapture =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_pre_shared_key_xtn);
-  client_->SetPacketFilter(clientCapture);
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_tls13_pre_shared_key_xtn);
   auto serverCapture =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_pre_shared_key_xtn);
-  server_->SetPacketFilter(serverCapture);
+      MakeTlsFilter<TlsExtensionCapture>(server_, ssl_tls13_pre_shared_key_xtn);
   ExpectResumption(RESUME_TICKET);
   Connect();
   CheckKeys(ssl_kea_dh, ssl_grp_ffdhe_2048, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   ASSERT_LT(0UL, clientCapture->extension().len());
   ASSERT_LT(0UL, serverCapture->extension().len());
 }
 
 class TlsDheSkeChangeSignature : public TlsHandshakeFilter {
  public:
-  TlsDheSkeChangeSignature(uint16_t version, const uint8_t* data, size_t len)
-      : TlsHandshakeFilter({kTlsHandshakeServerKeyExchange}),
+  TlsDheSkeChangeSignature(const std::shared_ptr<TlsAgent>& agent,
+                           uint16_t version, const uint8_t* data, size_t len)
+      : TlsHandshakeFilter(agent, {kTlsHandshakeServerKeyExchange}),
         version_(version),
         data_(data),
         len_(len) {}
@@ -595,8 +597,8 @@ TEST_P(TlsConnectGenericPre13, InvalidDERSignatureFfdhe) {
   const std::vector<SSLNamedGroup> client_groups = {ssl_grp_ffdhe_2048};
   client_->ConfigNamedGroups(client_groups);
 
-  server_->SetPacketFilter(std::make_shared<TlsDheSkeChangeSignature>(
-      version_, kBogusDheSignature, sizeof(kBogusDheSignature)));
+  MakeTlsFilter<TlsDheSkeChangeSignature>(server_, version_, kBogusDheSignature,
+                                          sizeof(kBogusDheSignature));
 
   ConnectExpectAlert(client_, kTlsAlertDecryptError);
   client_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
diff --git a/security/nss/gtests/ssl_gtest/ssl_drop_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_drop_unittest.cc
index c059e9938d..ee8906deb5 100644
--- a/security/nss/gtests/ssl_gtest/ssl_drop_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_drop_unittest.cc
@@ -22,13 +22,13 @@ extern "C" {
 namespace nss_test {
 
 TEST_P(TlsConnectDatagramPre13, DropClientFirstFlightOnce) {
-  client_->SetPacketFilter(std::make_shared<SelectiveDropFilter>(0x1));
+  client_->SetFilter(std::make_shared<SelectiveDropFilter>(0x1));
   Connect();
   SendReceive();
 }
 
 TEST_P(TlsConnectDatagramPre13, DropServerFirstFlightOnce) {
-  server_->SetPacketFilter(std::make_shared<SelectiveDropFilter>(0x1));
+  server_->SetFilter(std::make_shared<SelectiveDropFilter>(0x1));
   Connect();
   SendReceive();
 }
@@ -37,32 +37,32 @@ TEST_P(TlsConnectDatagramPre13, DropServerFirstFlightOnce) {
 // flights that they send.  Note: In DTLS 1.3, the shorter handshake means that
 // this will also drop some application data, so we can't call SendReceive().
 TEST_P(TlsConnectDatagramPre13, DropAllFirstTransmissions) {
-  client_->SetPacketFilter(std::make_shared<SelectiveDropFilter>(0x15));
-  server_->SetPacketFilter(std::make_shared<SelectiveDropFilter>(0x5));
+  client_->SetFilter(std::make_shared<SelectiveDropFilter>(0x15));
+  server_->SetFilter(std::make_shared<SelectiveDropFilter>(0x5));
   Connect();
 }
 
 // This drops the server's first flight three times.
 TEST_P(TlsConnectDatagramPre13, DropServerFirstFlightThrice) {
-  server_->SetPacketFilter(std::make_shared<SelectiveDropFilter>(0x7));
+  server_->SetFilter(std::make_shared<SelectiveDropFilter>(0x7));
   Connect();
 }
 
 // This drops the client's second flight once
 TEST_P(TlsConnectDatagramPre13, DropClientSecondFlightOnce) {
-  client_->SetPacketFilter(std::make_shared<SelectiveDropFilter>(0x2));
+  client_->SetFilter(std::make_shared<SelectiveDropFilter>(0x2));
   Connect();
 }
 
 // This drops the client's second flight three times.
 TEST_P(TlsConnectDatagramPre13, DropClientSecondFlightThrice) {
-  client_->SetPacketFilter(std::make_shared<SelectiveDropFilter>(0xe));
+  client_->SetFilter(std::make_shared<SelectiveDropFilter>(0xe));
   Connect();
 }
 
 // This drops the server's second flight three times.
 TEST_P(TlsConnectDatagramPre13, DropServerSecondFlightThrice) {
-  server_->SetPacketFilter(std::make_shared<SelectiveDropFilter>(0xe));
+  server_->SetFilter(std::make_shared<SelectiveDropFilter>(0xe));
   Connect();
 }
 
@@ -74,7 +74,7 @@ class TlsDropDatagram13 : public TlsConnectDatagram13 {
         expected_client_acks_(0),
         expected_server_acks_(1) {}
 
-  void SetUp() {
+  void SetUp() override {
     TlsConnectDatagram13::SetUp();
     ConfigureSessionCache(RESUME_NONE, RESUME_NONE);
     SetFilters();
@@ -82,12 +82,8 @@ class TlsDropDatagram13 : public TlsConnectDatagram13 {
 
   void SetFilters() {
     EnsureTlsSetup();
-    client_->SetPacketFilter(client_filters_.chain_);
-    client_filters_.ack_->SetAgent(client_.get());
-    client_filters_.ack_->EnableDecryption();
-    server_->SetPacketFilter(server_filters_.chain_);
-    server_filters_.ack_->SetAgent(server_.get());
-    server_filters_.ack_->EnableDecryption();
+    client_filters_.Init(client_);
+    server_filters_.Init(server_);
   }
 
   void HandshakeAndAck(const std::shared_ptr<TlsAgent>& agent) {
@@ -119,11 +115,17 @@ class TlsDropDatagram13 : public TlsConnectDatagram13 {
   class DropAckChain {
    public:
     DropAckChain()
-        : records_(std::make_shared<TlsRecordRecorder>()),
-          ack_(std::make_shared<TlsRecordRecorder>(content_ack)),
-          drop_(std::make_shared<SelectiveRecordDropFilter>(0, false)),
-          chain_(std::make_shared<ChainedPacketFilter>(
-              ChainedPacketFilterInit({records_, ack_, drop_}))) {}
+        : records_(nullptr), ack_(nullptr), drop_(nullptr), chain_(nullptr) {}
+
+    void Init(const std::shared_ptr<TlsAgent>& agent) {
+      records_ = std::make_shared<TlsRecordRecorder>(agent);
+      ack_ = std::make_shared<TlsRecordRecorder>(agent, content_ack);
+      ack_->EnableDecryption();
+      drop_ = std::make_shared<SelectiveRecordDropFilter>(agent, 0, false);
+      chain_ = std::make_shared<ChainedPacketFilter>(
+          ChainedPacketFilterInit({records_, ack_, drop_}));
+      agent->SetFilter(chain_);
+    }
 
     const TlsRecord& record(size_t i) const { return records_->record(i); }
 
@@ -227,7 +229,7 @@ TEST_F(TlsDropDatagram13, DropServerSecondRecordOnce) {
   HandshakeAndAck(client_);
   expected_client_acks_ = 1;
   CheckedHandshakeSendReceive();
-  CheckAcks(client_filters_, 0, {0});
+  CheckAcks(client_filters_, 0, {0});  // ServerHello
   CheckAcks(server_filters_, 0, {0x0002000000000000ULL});
 }
 
@@ -257,7 +259,7 @@ TEST_F(TlsDropDatagram13, DropServerAckOnce) {
   CheckPostHandshake();
   // There should be two copies of the finished ACK
   CheckAcks(server_filters_, 0, {0x0002000000000000ULL});
-  CheckAcks(server_filters_, 0, {0x0002000000000000ULL});
+  CheckAcks(server_filters_, 1, {0x0002000000000000ULL});
 }
 
 // Drop the client certificate verify.
@@ -276,10 +278,9 @@ TEST_F(TlsDropDatagram13, DropClientCertVerify) {
   // Ack of the whole client handshake.
   CheckAcks(
       server_filters_, 1,
-      {0x0002000000000000ULL,  // CH (we drop everything after this on client)
-       0x0002000000000003ULL,  // CT (2)
-       0x0002000000000004ULL}  // FIN (2)
-      );
+      {0x0002000000000000ULL,    // CH (we drop everything after this on client)
+       0x0002000000000003ULL,    // CT (2)
+       0x0002000000000004ULL});  // FIN (2)
 }
 
 // Shrink the MTU down so that certs get split and drop the first piece.
@@ -303,10 +304,9 @@ TEST_F(TlsDropDatagram13, DropFirstHalfOfServerCertificate) {
   EXPECT_EQ(ct1_size, server_filters_.record(0).buffer.len());
   CheckedHandshakeSendReceive();
   CheckAcks(client_filters_, 0,
-            {0,                      // SH
-             0x0002000000000000ULL,  // EE
-             0x0002000000000002ULL}  // CT2
-            );
+            {0,                        // SH
+             0x0002000000000000ULL,    // EE
+             0x0002000000000002ULL});  // CT2
   CheckAcks(server_filters_, 0, {0x0002000000000000ULL});
 }
 
@@ -540,7 +540,10 @@ TEST_F(TlsDropDatagram13, NoDropsDuringZeroRtt) {
   ExpectEarlyDataAccepted(true);
   CheckConnected();
   SendReceive();
-  CheckAcks(server_filters_, 0, {0x0002000000000000ULL});
+  EXPECT_EQ(0U, client_filters_.ack_->count());
+  CheckAcks(server_filters_, 0,
+            {0x0001000000000001ULL,    // EOED
+             0x0002000000000000ULL});  // Finished
 }
 
 TEST_F(TlsDropDatagram13, DropEEDuringZeroRtt) {
@@ -558,7 +561,9 @@ TEST_F(TlsDropDatagram13, DropEEDuringZeroRtt) {
   CheckConnected();
   SendReceive();
   CheckAcks(client_filters_, 0, {0});
-  CheckAcks(server_filters_, 0, {0x0002000000000000ULL});
+  CheckAcks(server_filters_, 0,
+            {0x0001000000000002ULL,    // EOED
+             0x0002000000000000ULL});  // Finished
 }
 
 class TlsReorderDatagram13 : public TlsDropDatagram13 {
@@ -688,6 +693,7 @@ TEST_F(TlsDropDatagram13, SendOutOfOrderHsNonsenseWithHandshakeKey) {
       kTlsHandshakeType, DataBuffer(buf, sizeof(buf))));
   server_->Handshake();
   EXPECT_EQ(2UL, server_filters_.ack_->count());
+  // The server acknowledges client Finished twice.
   CheckAcks(server_filters_, 0, {0x0002000000000000ULL});
   CheckAcks(server_filters_, 1, {0x0002000000000000ULL});
 }
@@ -746,7 +752,9 @@ TEST_F(TlsReorderDatagram13, DataAfterEOEDDuringZeroRtt) {
   ReSend(TlsAgent::CLIENT, std::vector<size_t>({1, 0, 2}));
   server_->Handshake();
   CheckConnected();
-  CheckAcks(server_filters_, 0, {0x0002000000000000ULL});
+  EXPECT_EQ(0U, client_filters_.ack_->count());
+  // Acknowledgements for EOED and Finished.
+  CheckAcks(server_filters_, 0, {0x0001000000000002ULL, 0x0002000000000000ULL});
   uint8_t buf[8];
   rv = PR_Read(server_->ssl_fd(), buf, sizeof(buf));
   EXPECT_EQ(-1, rv);
@@ -783,7 +791,9 @@ TEST_F(TlsReorderDatagram13, DataAfterFinDuringZeroRtt) {
   ReSend(TlsAgent::CLIENT, std::vector<size_t>({1, 2, 0}));
   server_->Handshake();
   CheckConnected();
-  CheckAcks(server_filters_, 0, {0x0002000000000000ULL});
+  EXPECT_EQ(0U, client_filters_.ack_->count());
+  // Acknowledgements for EOED and Finished.
+  CheckAcks(server_filters_, 0, {0x0001000000000002ULL, 0x0002000000000000ULL});
   uint8_t buf[8];
   rv = PR_Read(server_->ssl_fd(), buf, sizeof(buf));
   EXPECT_EQ(-1, rv);
diff --git a/security/nss/gtests/ssl_gtest/ssl_ecdh_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_ecdh_unittest.cc
index e0f8b1f55f..3c7cd2ecfa 100644
--- a/security/nss/gtests/ssl_gtest/ssl_ecdh_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_ecdh_unittest.cc
@@ -69,20 +69,19 @@ TEST_P(TlsConnectGeneric, ConnectEcdheP384Client) {
   server_->ConfigNamedGroups(groups);
   Connect();
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 }
 
 // This causes a HelloRetryRequest in TLS 1.3.  Earlier versions don't care.
 TEST_P(TlsConnectGeneric, ConnectEcdheP384Server) {
   EnsureTlsSetup();
-  auto hrr_capture = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeHelloRetryRequest);
-  server_->SetPacketFilter(hrr_capture);
+  auto hrr_capture = MakeTlsFilter<TlsHandshakeRecorder>(
+      server_, kTlsHandshakeHelloRetryRequest);
   const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1};
   server_->ConfigNamedGroups(groups);
   Connect();
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   EXPECT_EQ(version_ == SSL_LIBRARY_VERSION_TLS_1_3,
             hrr_capture->buffer().len() != 0);
 }
@@ -112,7 +111,7 @@ TEST_P(TlsKeyExchangeTest, P384Priority) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 
   std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1};
   CheckKEXDetails(groups, shares);
@@ -129,7 +128,7 @@ TEST_P(TlsKeyExchangeTest, DuplicateGroupConfig) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 
   std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1};
   std::vector<SSLNamedGroup> expectedGroups = {ssl_grp_ec_secp384r1,
@@ -147,7 +146,7 @@ TEST_P(TlsKeyExchangeTest, P384PriorityDHEnabled) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 
   if (version_ >= SSL_LIBRARY_VERSION_TLS_1_3) {
     std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp384r1};
@@ -172,7 +171,7 @@ TEST_P(TlsConnectGenericPre13, P384PriorityOnServer) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 }
 
 TEST_P(TlsConnectGenericPre13, P384PriorityFromModelSocket) {
@@ -188,13 +187,13 @@ TEST_P(TlsConnectGenericPre13, P384PriorityFromModelSocket) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp384r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 }
 
 class TlsKeyExchangeGroupCapture : public TlsHandshakeFilter {
  public:
-  TlsKeyExchangeGroupCapture()
-      : TlsHandshakeFilter({kTlsHandshakeServerKeyExchange}),
+  TlsKeyExchangeGroupCapture(const std::shared_ptr<TlsAgent> &agent)
+      : TlsHandshakeFilter(agent, {kTlsHandshakeServerKeyExchange}),
         group_(ssl_grp_none) {}
 
   SSLNamedGroup group() const { return group_; }
@@ -221,10 +220,8 @@ class TlsKeyExchangeGroupCapture : public TlsHandshakeFilter {
 // P-256 is supported by the client (<= 1.2 only).
 TEST_P(TlsConnectGenericPre13, DropSupportedGroupExtensionP256) {
   EnsureTlsSetup();
-  client_->SetPacketFilter(
-      std::make_shared<TlsExtensionDropper>(ssl_supported_groups_xtn));
-  auto group_capture = std::make_shared<TlsKeyExchangeGroupCapture>();
-  server_->SetPacketFilter(group_capture);
+  MakeTlsFilter<TlsExtensionDropper>(client_, ssl_supported_groups_xtn);
+  auto group_capture = MakeTlsFilter<TlsKeyExchangeGroupCapture>(server_);
 
   ConnectExpectAlert(server_, kTlsAlertDecryptError);
   client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT);
@@ -236,8 +233,7 @@ TEST_P(TlsConnectGenericPre13, DropSupportedGroupExtensionP256) {
 // Supported groups is mandatory in TLS 1.3.
 TEST_P(TlsConnectTls13, DropSupportedGroupExtension) {
   EnsureTlsSetup();
-  client_->SetPacketFilter(
-      std::make_shared<TlsExtensionDropper>(ssl_supported_groups_xtn));
+  MakeTlsFilter<TlsExtensionDropper>(client_, ssl_supported_groups_xtn);
   ConnectExpectAlert(server_, kTlsAlertMissingExtension);
   client_->CheckErrorCode(SSL_ERROR_MISSING_EXTENSION_ALERT);
   server_->CheckErrorCode(SSL_ERROR_MISSING_SUPPORTED_GROUPS_EXTENSION);
@@ -276,7 +272,7 @@ TEST_P(TlsConnectStreamPre13, ConfiguredGroupsRenegotiate) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   CheckConnected();
 
   // The renegotiation has to use the same preferences as the original session.
@@ -284,7 +280,7 @@ TEST_P(TlsConnectStreamPre13, ConfiguredGroupsRenegotiate) {
   client_->StartRenegotiate();
   Handshake();
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 }
 
 TEST_P(TlsKeyExchangeTest, Curve25519) {
@@ -318,7 +314,7 @@ TEST_P(TlsConnectGenericPre13, GroupPreferenceServerPriority) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 }
 
 #ifndef NSS_DISABLE_TLS_1_3
@@ -337,7 +333,7 @@ TEST_P(TlsKeyExchangeTest13, Curve25519P256EqualPriorityClient13) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_secp256r1};
   CheckKEXDetails(client_groups, shares);
 }
@@ -357,7 +353,7 @@ TEST_P(TlsKeyExchangeTest13, Curve25519P256EqualPriorityServer13) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
   CheckKEXDetails(client_groups, shares);
 }
@@ -379,7 +375,7 @@ TEST_P(TlsKeyExchangeTest13, EqualPriorityTestRetryECServer13) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
   CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);
 }
@@ -401,7 +397,7 @@ TEST_P(TlsKeyExchangeTest13, NotEqualPriorityWithIntermediateGroup13) {
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
   CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);
 }
@@ -423,7 +419,7 @@ TEST_P(TlsKeyExchangeTest13,
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
   CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);
 }
@@ -445,7 +441,7 @@ TEST_P(TlsKeyExchangeTest13,
   Connect();
 
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519};
   CheckKEXDetails(client_groups, shares, ssl_grp_ec_secp256r1);
 }
@@ -507,7 +503,7 @@ TEST_P(TlsKeyExchangeTest13, MultipleClientShares) {
 
   // The server would accept 25519 but its preferred group (P256) has to win.
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_secp256r1, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   const std::vector<SSLNamedGroup> shares = {ssl_grp_ec_curve25519,
                                              ssl_grp_ec_secp256r1};
   CheckKEXDetails(client_groups, shares);
@@ -516,7 +512,8 @@ TEST_P(TlsKeyExchangeTest13, MultipleClientShares) {
 // Replace the point in the client key exchange message with an empty one
 class ECCClientKEXFilter : public TlsHandshakeFilter {
  public:
-  ECCClientKEXFilter() : TlsHandshakeFilter({kTlsHandshakeClientKeyExchange}) {}
+  ECCClientKEXFilter(const std::shared_ptr<TlsAgent> &client)
+      : TlsHandshakeFilter(client, {kTlsHandshakeClientKeyExchange}) {}
 
  protected:
   virtual PacketFilter::Action FilterHandshake(const HandshakeHeader &header,
@@ -532,7 +529,8 @@ class ECCClientKEXFilter : public TlsHandshakeFilter {
 // Replace the point in the server key exchange message with an empty one
 class ECCServerKEXFilter : public TlsHandshakeFilter {
  public:
-  ECCServerKEXFilter() : TlsHandshakeFilter({kTlsHandshakeServerKeyExchange}) {}
+  ECCServerKEXFilter(const std::shared_ptr<TlsAgent> &server)
+      : TlsHandshakeFilter(server, {kTlsHandshakeServerKeyExchange}) {}
 
  protected:
   virtual PacketFilter::Action FilterHandshake(const HandshakeHeader &header,
@@ -550,15 +548,13 @@ class ECCServerKEXFilter : public TlsHandshakeFilter {
 };
 
 TEST_P(TlsConnectGenericPre13, ConnectECDHEmptyServerPoint) {
-  // add packet filter
-  server_->SetPacketFilter(std::make_shared<ECCServerKEXFilter>());
+  MakeTlsFilter<ECCServerKEXFilter>(server_);
   ConnectExpectAlert(client_, kTlsAlertIllegalParameter);
   client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_SERVER_KEY_EXCH);
 }
 
 TEST_P(TlsConnectGenericPre13, ConnectECDHEmptyClientPoint) {
-  // add packet filter
-  client_->SetPacketFilter(std::make_shared<ECCClientKEXFilter>());
+  MakeTlsFilter<ECCClientKEXFilter>(client_);
   ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_KEY_EXCH);
 }
diff --git a/security/nss/gtests/ssl_gtest/ssl_extension_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_extension_unittest.cc
index 4142ab07af..0453dabdb6 100644
--- a/security/nss/gtests/ssl_gtest/ssl_extension_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_extension_unittest.cc
@@ -19,8 +19,9 @@ namespace nss_test {
 
 class TlsExtensionTruncator : public TlsExtensionFilter {
  public:
-  TlsExtensionTruncator(uint16_t extension, size_t length)
-      : extension_(extension), length_(length) {}
+  TlsExtensionTruncator(const std::shared_ptr<TlsAgent>& agent,
+                        uint16_t extension, size_t length)
+      : TlsExtensionFilter(agent), extension_(extension), length_(length) {}
   virtual PacketFilter::Action FilterExtension(uint16_t extension_type,
                                                const DataBuffer& input,
                                                DataBuffer* output) {
@@ -42,8 +43,9 @@ class TlsExtensionTruncator : public TlsExtensionFilter {
 
 class TlsExtensionDamager : public TlsExtensionFilter {
  public:
-  TlsExtensionDamager(uint16_t extension, size_t index)
-      : extension_(extension), index_(index) {}
+  TlsExtensionDamager(const std::shared_ptr<TlsAgent>& agent,
+                      uint16_t extension, size_t index)
+      : TlsExtensionFilter(agent), extension_(extension), index_(index) {}
   virtual PacketFilter::Action FilterExtension(uint16_t extension_type,
                                                const DataBuffer& input,
                                                DataBuffer* output) {
@@ -63,8 +65,11 @@ class TlsExtensionDamager : public TlsExtensionFilter {
 
 class TlsExtensionAppender : public TlsHandshakeFilter {
  public:
-  TlsExtensionAppender(uint8_t handshake_type, uint16_t ext, DataBuffer& data)
-      : TlsHandshakeFilter({handshake_type}), extension_(ext), data_(data) {}
+  TlsExtensionAppender(const std::shared_ptr<TlsAgent>& agent,
+                       uint8_t handshake_type, uint16_t ext, DataBuffer& data)
+      : TlsHandshakeFilter(agent, {handshake_type}),
+        extension_(ext),
+        data_(data) {}
 
   virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
                                                const DataBuffer& input,
@@ -124,13 +129,13 @@ class TlsExtensionTestBase : public TlsConnectTestBase {
 
   void ClientHelloErrorTest(std::shared_ptr<PacketFilter> filter,
                             uint8_t desc = kTlsAlertDecodeError) {
-    client_->SetPacketFilter(filter);
+    client_->SetFilter(filter);
     ConnectExpectAlert(server_, desc);
   }
 
   void ServerHelloErrorTest(std::shared_ptr<PacketFilter> filter,
                             uint8_t desc = kTlsAlertDecodeError) {
-    server_->SetPacketFilter(filter);
+    server_->SetFilter(filter);
     ConnectExpectAlert(client_, desc);
   }
 
@@ -156,7 +161,7 @@ class TlsExtensionTestBase : public TlsConnectTestBase {
     StartConnect();
     client_->Handshake();  // Send ClientHello
     server_->Handshake();  // Send HRR.
-    client_->SetPacketFilter(std::make_shared<TlsExtensionDropper>(type));
+    MakeTlsFilter<TlsExtensionDropper>(client_, type);
     Handshake();
     client_->CheckErrorCode(client_error);
     server_->CheckErrorCode(server_error);
@@ -197,8 +202,8 @@ class TlsExtensionTest13
 
   void ConnectWithBogusVersionList(const uint8_t* buf, size_t len) {
     DataBuffer versions_buf(buf, len);
-    client_->SetPacketFilter(std::make_shared<TlsExtensionReplacer>(
-        ssl_tls13_supported_versions_xtn, versions_buf));
+    MakeTlsFilter<TlsExtensionReplacer>(
+        client_, ssl_tls13_supported_versions_xtn, versions_buf);
     ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
     client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
     server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
@@ -209,8 +214,8 @@ class TlsExtensionTest13
 
     size_t index = versions_buf.Write(0, 2, 1);
     versions_buf.Write(index, version, 2);
-    client_->SetPacketFilter(std::make_shared<TlsExtensionReplacer>(
-        ssl_tls13_supported_versions_xtn, versions_buf));
+    MakeTlsFilter<TlsExtensionReplacer>(
+        client_, ssl_tls13_supported_versions_xtn, versions_buf);
     ConnectExpectFail();
   }
 };
@@ -241,26 +246,26 @@ class TlsExtensionTestPre13 : public TlsExtensionTestBase,
 
 TEST_P(TlsExtensionTestGeneric, DamageSniLength) {
   ClientHelloErrorTest(
-      std::make_shared<TlsExtensionDamager>(ssl_server_name_xtn, 1));
+      std::make_shared<TlsExtensionDamager>(client_, ssl_server_name_xtn, 1));
 }
 
 TEST_P(TlsExtensionTestGeneric, DamageSniHostLength) {
   ClientHelloErrorTest(
-      std::make_shared<TlsExtensionDamager>(ssl_server_name_xtn, 4));
+      std::make_shared<TlsExtensionDamager>(client_, ssl_server_name_xtn, 4));
 }
 
 TEST_P(TlsExtensionTestGeneric, TruncateSni) {
   ClientHelloErrorTest(
-      std::make_shared<TlsExtensionTruncator>(ssl_server_name_xtn, 7));
+      std::make_shared<TlsExtensionTruncator>(client_, ssl_server_name_xtn, 7));
 }
 
 // A valid extension that appears twice will be reported as unsupported.
 TEST_P(TlsExtensionTestGeneric, RepeatSni) {
   DataBuffer extension;
   InitSimpleSni(&extension);
-  ClientHelloErrorTest(
-      std::make_shared<TlsExtensionInjector>(ssl_server_name_xtn, extension),
-      kTlsAlertIllegalParameter);
+  ClientHelloErrorTest(std::make_shared<TlsExtensionInjector>(
+                           client_, ssl_server_name_xtn, extension),
+                       kTlsAlertIllegalParameter);
 }
 
 // An SNI entry with zero length is considered invalid (strangely, not if it is
@@ -272,23 +277,23 @@ TEST_P(TlsExtensionTestGeneric, BadSni) {
   extension.Allocate(simple.len() + 3);
   extension.Write(0, static_cast<uint32_t>(0), 3);
   extension.Write(3, simple);
-  ClientHelloErrorTest(
-      std::make_shared<TlsExtensionReplacer>(ssl_server_name_xtn, extension));
+  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
+      client_, ssl_server_name_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestGeneric, EmptySni) {
   DataBuffer extension;
   extension.Allocate(2);
   extension.Write(0, static_cast<uint32_t>(0), 2);
-  ClientHelloErrorTest(
-      std::make_shared<TlsExtensionReplacer>(ssl_server_name_xtn, extension));
+  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
+      client_, ssl_server_name_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestGeneric, EmptyAlpnExtension) {
   EnableAlpn();
   DataBuffer extension;
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-                           ssl_app_layer_protocol_xtn, extension),
+                           client_, ssl_app_layer_protocol_xtn, extension),
                        kTlsAlertIllegalParameter);
 }
 
@@ -299,21 +304,21 @@ TEST_P(TlsExtensionTestGeneric, EmptyAlpnList) {
   const uint8_t val[] = {0x00, 0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-                           ssl_app_layer_protocol_xtn, extension),
+                           client_, ssl_app_layer_protocol_xtn, extension),
                        kTlsAlertNoApplicationProtocol);
 }
 
 TEST_P(TlsExtensionTestGeneric, OneByteAlpn) {
   EnableAlpn();
-  ClientHelloErrorTest(
-      std::make_shared<TlsExtensionTruncator>(ssl_app_layer_protocol_xtn, 1));
+  ClientHelloErrorTest(std::make_shared<TlsExtensionTruncator>(
+      client_, ssl_app_layer_protocol_xtn, 1));
 }
 
 TEST_P(TlsExtensionTestGeneric, AlpnMissingValue) {
   EnableAlpn();
   // This will leave the length of the second entry, but no value.
-  ClientHelloErrorTest(
-      std::make_shared<TlsExtensionTruncator>(ssl_app_layer_protocol_xtn, 5));
+  ClientHelloErrorTest(std::make_shared<TlsExtensionTruncator>(
+      client_, ssl_app_layer_protocol_xtn, 5));
 }
 
 TEST_P(TlsExtensionTestGeneric, AlpnZeroLength) {
@@ -321,7 +326,7 @@ TEST_P(TlsExtensionTestGeneric, AlpnZeroLength) {
   const uint8_t val[] = {0x01, 0x61, 0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_app_layer_protocol_xtn, extension));
+      client_, ssl_app_layer_protocol_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestGeneric, AlpnMismatch) {
@@ -340,7 +345,7 @@ TEST_P(TlsExtensionTestPre13, AlpnReturnedEmptyList) {
   const uint8_t val[] = {0x00, 0x00};
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_app_layer_protocol_xtn, extension));
+      server_, ssl_app_layer_protocol_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, AlpnReturnedEmptyName) {
@@ -348,7 +353,7 @@ TEST_P(TlsExtensionTestPre13, AlpnReturnedEmptyName) {
   const uint8_t val[] = {0x00, 0x01, 0x00};
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_app_layer_protocol_xtn, extension));
+      server_, ssl_app_layer_protocol_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, AlpnReturnedListTrailingData) {
@@ -356,7 +361,7 @@ TEST_P(TlsExtensionTestPre13, AlpnReturnedListTrailingData) {
   const uint8_t val[] = {0x00, 0x02, 0x01, 0x61, 0x00};
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_app_layer_protocol_xtn, extension));
+      server_, ssl_app_layer_protocol_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, AlpnReturnedExtraEntry) {
@@ -364,7 +369,7 @@ TEST_P(TlsExtensionTestPre13, AlpnReturnedExtraEntry) {
   const uint8_t val[] = {0x00, 0x04, 0x01, 0x61, 0x01, 0x62};
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_app_layer_protocol_xtn, extension));
+      server_, ssl_app_layer_protocol_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, AlpnReturnedBadListLength) {
@@ -372,7 +377,7 @@ TEST_P(TlsExtensionTestPre13, AlpnReturnedBadListLength) {
   const uint8_t val[] = {0x00, 0x99, 0x01, 0x61, 0x00};
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_app_layer_protocol_xtn, extension));
+      server_, ssl_app_layer_protocol_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, AlpnReturnedBadNameLength) {
@@ -380,7 +385,7 @@ TEST_P(TlsExtensionTestPre13, AlpnReturnedBadNameLength) {
   const uint8_t val[] = {0x00, 0x02, 0x99, 0x61};
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_app_layer_protocol_xtn, extension));
+      server_, ssl_app_layer_protocol_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, AlpnReturnedUnknownName) {
@@ -388,55 +393,64 @@ TEST_P(TlsExtensionTestPre13, AlpnReturnedUnknownName) {
   const uint8_t val[] = {0x00, 0x02, 0x01, 0x67};
   DataBuffer extension(val, sizeof(val));
   ServerHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-                           ssl_app_layer_protocol_xtn, extension),
+                           server_, ssl_app_layer_protocol_xtn, extension),
                        kTlsAlertIllegalParameter);
 }
 
 TEST_P(TlsExtensionTestDtls, SrtpShort) {
   EnableSrtp();
   ClientHelloErrorTest(
-      std::make_shared<TlsExtensionTruncator>(ssl_use_srtp_xtn, 3));
+      std::make_shared<TlsExtensionTruncator>(client_, ssl_use_srtp_xtn, 3));
 }
 
 TEST_P(TlsExtensionTestDtls, SrtpOdd) {
   EnableSrtp();
   const uint8_t val[] = {0x00, 0x01, 0xff, 0x00};
   DataBuffer extension(val, sizeof(val));
-  ClientHelloErrorTest(
-      std::make_shared<TlsExtensionReplacer>(ssl_use_srtp_xtn, extension));
+  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
+      client_, ssl_use_srtp_xtn, extension));
 }
 
 TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmsBadLength) {
   const uint8_t val[] = {0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_signature_algorithms_xtn, extension));
+      client_, ssl_signature_algorithms_xtn, extension));
 }
 
 TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmsTrailingData) {
   const uint8_t val[] = {0x00, 0x02, 0x04, 0x01, 0x00};  // sha-256, rsa
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_signature_algorithms_xtn, extension));
+      client_, ssl_signature_algorithms_xtn, extension));
 }
 
 TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmsEmpty) {
   const uint8_t val[] = {0x00, 0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_signature_algorithms_xtn, extension));
+                           client_, ssl_signature_algorithms_xtn, extension),
+                       kTlsAlertHandshakeFailure);
+}
+
+TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmsNoOverlap) {
+  const uint8_t val[] = {0x00, 0x02, 0xff, 0xff};
+  DataBuffer extension(val, sizeof(val));
+  ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
+                           client_, ssl_signature_algorithms_xtn, extension),
+                       kTlsAlertHandshakeFailure);
 }
 
 TEST_P(TlsExtensionTest12Plus, SignatureAlgorithmsOddLength) {
   const uint8_t val[] = {0x00, 0x01, 0x04};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_signature_algorithms_xtn, extension));
+      client_, ssl_signature_algorithms_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestGeneric, NoSupportedGroups) {
   ClientHelloErrorTest(
-      std::make_shared<TlsExtensionDropper>(ssl_supported_groups_xtn),
+      std::make_shared<TlsExtensionDropper>(client_, ssl_supported_groups_xtn),
       version_ < SSL_LIBRARY_VERSION_TLS_1_3 ? kTlsAlertDecryptError
                                              : kTlsAlertMissingExtension);
 }
@@ -445,75 +459,74 @@ TEST_P(TlsExtensionTestGeneric, SupportedCurvesShort) {
   const uint8_t val[] = {0x00, 0x01, 0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_elliptic_curves_xtn, extension));
+      client_, ssl_elliptic_curves_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestGeneric, SupportedCurvesBadLength) {
   const uint8_t val[] = {0x09, 0x99, 0x00, 0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_elliptic_curves_xtn, extension));
+      client_, ssl_elliptic_curves_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestGeneric, SupportedCurvesTrailingData) {
   const uint8_t val[] = {0x00, 0x02, 0x00, 0x00, 0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_elliptic_curves_xtn, extension));
+      client_, ssl_elliptic_curves_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, SupportedPointsEmpty) {
   const uint8_t val[] = {0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_ec_point_formats_xtn, extension));
+      client_, ssl_ec_point_formats_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, SupportedPointsBadLength) {
   const uint8_t val[] = {0x99, 0x00, 0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_ec_point_formats_xtn, extension));
+      client_, ssl_ec_point_formats_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, SupportedPointsTrailingData) {
   const uint8_t val[] = {0x01, 0x00, 0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_ec_point_formats_xtn, extension));
+      client_, ssl_ec_point_formats_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, RenegotiationInfoBadLength) {
   const uint8_t val[] = {0x99};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_renegotiation_info_xtn, extension));
+      client_, ssl_renegotiation_info_xtn, extension));
 }
 
 TEST_P(TlsExtensionTestPre13, RenegotiationInfoMismatch) {
   const uint8_t val[] = {0x01, 0x00};
   DataBuffer extension(val, sizeof(val));
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_renegotiation_info_xtn, extension));
+      client_, ssl_renegotiation_info_xtn, extension));
 }
 
 // The extension has to contain a length.
 TEST_P(TlsExtensionTestPre13, RenegotiationInfoExtensionEmpty) {
   DataBuffer extension;
   ClientHelloErrorTest(std::make_shared<TlsExtensionReplacer>(
-      ssl_renegotiation_info_xtn, extension));
+      client_, ssl_renegotiation_info_xtn, extension));
 }
 
 // This only works on TLS 1.2, since it relies on static RSA; otherwise libssl
 // picks the wrong cipher suite.
 TEST_P(TlsExtensionTest12, SignatureAlgorithmConfiguration) {
-  const SSLSignatureScheme schemes[] = {ssl_sig_rsa_pss_sha512,
-                                        ssl_sig_rsa_pss_sha384};
+  const SSLSignatureScheme schemes[] = {ssl_sig_rsa_pss_rsae_sha512,
+                                        ssl_sig_rsa_pss_rsae_sha384};
 
   auto capture =
-      std::make_shared<TlsExtensionCapture>(ssl_signature_algorithms_xtn);
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_signature_algorithms_xtn);
   client_->SetSignatureSchemes(schemes, PR_ARRAY_SIZE(schemes));
-  client_->SetPacketFilter(capture);
   EnableOnlyStaticRsaCiphers();
   Connect();
 
@@ -531,9 +544,9 @@ TEST_P(TlsExtensionTest12, SignatureAlgorithmConfiguration) {
 // Temporary test to verify that we choke on an empty ClientKeyShare.
 // This test will fail when we implement HelloRetryRequest.
 TEST_P(TlsExtensionTest13, EmptyClientKeyShare) {
-  ClientHelloErrorTest(
-      std::make_shared<TlsExtensionTruncator>(ssl_tls13_key_share_xtn, 2),
-      kTlsAlertHandshakeFailure);
+  ClientHelloErrorTest(std::make_shared<TlsExtensionTruncator>(
+                           client_, ssl_tls13_key_share_xtn, 2),
+                       kTlsAlertHandshakeFailure);
 }
 
 // These tests only work in stream mode because the client sends a
@@ -542,8 +555,7 @@ TEST_P(TlsExtensionTest13, EmptyClientKeyShare) {
 // packet gets dropped.
 TEST_F(TlsExtensionTest13Stream, DropServerKeyShare) {
   EnsureTlsSetup();
-  server_->SetPacketFilter(
-      std::make_shared<TlsExtensionDropper>(ssl_tls13_key_share_xtn));
+  MakeTlsFilter<TlsExtensionDropper>(server_, ssl_tls13_key_share_xtn);
   client_->ExpectSendAlert(kTlsAlertMissingExtension);
   server_->ExpectSendAlert(kTlsAlertBadRecordMac);
   ConnectExpectFail();
@@ -563,8 +575,7 @@ TEST_F(TlsExtensionTest13Stream, WrongServerKeyShare) {
       0x02};
   DataBuffer buf(key_share, sizeof(key_share));
   EnsureTlsSetup();
-  server_->SetPacketFilter(
-      std::make_shared<TlsExtensionReplacer>(ssl_tls13_key_share_xtn, buf));
+  MakeTlsFilter<TlsExtensionReplacer>(server_, ssl_tls13_key_share_xtn, buf);
   client_->ExpectSendAlert(kTlsAlertIllegalParameter);
   server_->ExpectSendAlert(kTlsAlertBadRecordMac);
   ConnectExpectFail();
@@ -585,8 +596,7 @@ TEST_F(TlsExtensionTest13Stream, UnknownServerKeyShare) {
       0x02};
   DataBuffer buf(key_share, sizeof(key_share));
   EnsureTlsSetup();
-  server_->SetPacketFilter(
-      std::make_shared<TlsExtensionReplacer>(ssl_tls13_key_share_xtn, buf));
+  MakeTlsFilter<TlsExtensionReplacer>(server_, ssl_tls13_key_share_xtn, buf);
   client_->ExpectSendAlert(kTlsAlertMissingExtension);
   server_->ExpectSendAlert(kTlsAlertBadRecordMac);
   ConnectExpectFail();
@@ -597,8 +607,8 @@ TEST_F(TlsExtensionTest13Stream, UnknownServerKeyShare) {
 TEST_F(TlsExtensionTest13Stream, AddServerSignatureAlgorithmsOnResumption) {
   SetupForResume();
   DataBuffer empty;
-  server_->SetPacketFilter(std::make_shared<TlsExtensionInjector>(
-      ssl_signature_algorithms_xtn, empty));
+  MakeTlsFilter<TlsExtensionInjector>(server_, ssl_signature_algorithms_xtn,
+                                      empty);
   client_->ExpectSendAlert(kTlsAlertUnsupportedExtension);
   server_->ExpectSendAlert(kTlsAlertBadRecordMac);
   ConnectExpectFail();
@@ -618,8 +628,12 @@ typedef std::function<void(TlsPreSharedKeyReplacer*)>
 
 class TlsPreSharedKeyReplacer : public TlsExtensionFilter {
  public:
-  TlsPreSharedKeyReplacer(TlsPreSharedKeyReplacerFunc function)
-      : identities_(), binders_(), function_(function) {}
+  TlsPreSharedKeyReplacer(const std::shared_ptr<TlsAgent>& agent,
+                          TlsPreSharedKeyReplacerFunc function)
+      : TlsExtensionFilter(agent),
+        identities_(),
+        binders_(),
+        function_(function) {}
 
   static size_t CopyAndMaybeReplace(TlsParser* parser, size_t size,
                                     const std::unique_ptr<DataBuffer>& replace,
@@ -733,8 +747,10 @@ class TlsPreSharedKeyReplacer : public TlsExtensionFilter {
 TEST_F(TlsExtensionTest13Stream, ResumeEmptyPskLabel) {
   SetupForResume();
 
-  client_->SetPacketFilter(std::make_shared<TlsPreSharedKeyReplacer>([](
-      TlsPreSharedKeyReplacer* r) { r->identities_[0].identity.Truncate(0); }));
+  MakeTlsFilter<TlsPreSharedKeyReplacer>(
+      client_, [](TlsPreSharedKeyReplacer* r) {
+        r->identities_[0].identity.Truncate(0);
+      });
   ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
@@ -744,10 +760,10 @@ TEST_F(TlsExtensionTest13Stream, ResumeEmptyPskLabel) {
 TEST_F(TlsExtensionTest13Stream, ResumeIncorrectBinderValue) {
   SetupForResume();
 
-  client_->SetPacketFilter(
-      std::make_shared<TlsPreSharedKeyReplacer>([](TlsPreSharedKeyReplacer* r) {
+  MakeTlsFilter<TlsPreSharedKeyReplacer>(
+      client_, [](TlsPreSharedKeyReplacer* r) {
         r->binders_[0].Write(0, r->binders_[0].data()[0] ^ 0xff, 1);
-      }));
+      });
   ConnectExpectAlert(server_, kTlsAlertDecryptError);
   client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT);
   server_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
@@ -757,10 +773,10 @@ TEST_F(TlsExtensionTest13Stream, ResumeIncorrectBinderValue) {
 TEST_F(TlsExtensionTest13Stream, ResumeIncorrectBinderLength) {
   SetupForResume();
 
-  client_->SetPacketFilter(
-      std::make_shared<TlsPreSharedKeyReplacer>([](TlsPreSharedKeyReplacer* r) {
+  MakeTlsFilter<TlsPreSharedKeyReplacer>(
+      client_, [](TlsPreSharedKeyReplacer* r) {
         r->binders_[0].Write(r->binders_[0].len(), 0xff, 1);
-      }));
+      });
   ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
@@ -770,8 +786,8 @@ TEST_F(TlsExtensionTest13Stream, ResumeIncorrectBinderLength) {
 TEST_F(TlsExtensionTest13Stream, ResumeBinderTooShort) {
   SetupForResume();
 
-  client_->SetPacketFilter(std::make_shared<TlsPreSharedKeyReplacer>(
-      [](TlsPreSharedKeyReplacer* r) { r->binders_[0].Truncate(31); }));
+  MakeTlsFilter<TlsPreSharedKeyReplacer>(
+      client_, [](TlsPreSharedKeyReplacer* r) { r->binders_[0].Truncate(31); });
   ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
@@ -782,11 +798,11 @@ TEST_F(TlsExtensionTest13Stream, ResumeBinderTooShort) {
 TEST_F(TlsExtensionTest13Stream, ResumeTwoPsks) {
   SetupForResume();
 
-  client_->SetPacketFilter(
-      std::make_shared<TlsPreSharedKeyReplacer>([](TlsPreSharedKeyReplacer* r) {
+  MakeTlsFilter<TlsPreSharedKeyReplacer>(
+      client_, [](TlsPreSharedKeyReplacer* r) {
         r->identities_.push_back(r->identities_[0]);
         r->binders_.push_back(r->binders_[0]);
-      }));
+      });
   ConnectExpectAlert(server_, kTlsAlertDecryptError);
   client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT);
   server_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
@@ -797,10 +813,10 @@ TEST_F(TlsExtensionTest13Stream, ResumeTwoPsks) {
 TEST_F(TlsExtensionTest13Stream, ResumeTwoIdentitiesOneBinder) {
   SetupForResume();
 
-  client_->SetPacketFilter(
-      std::make_shared<TlsPreSharedKeyReplacer>([](TlsPreSharedKeyReplacer* r) {
+  MakeTlsFilter<TlsPreSharedKeyReplacer>(
+      client_, [](TlsPreSharedKeyReplacer* r) {
         r->identities_.push_back(r->identities_[0]);
-      }));
+      });
   ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
@@ -809,8 +825,10 @@ TEST_F(TlsExtensionTest13Stream, ResumeTwoIdentitiesOneBinder) {
 TEST_F(TlsExtensionTest13Stream, ResumeOneIdentityTwoBinders) {
   SetupForResume();
 
-  client_->SetPacketFilter(std::make_shared<TlsPreSharedKeyReplacer>([](
-      TlsPreSharedKeyReplacer* r) { r->binders_.push_back(r->binders_[0]); }));
+  MakeTlsFilter<TlsPreSharedKeyReplacer>(
+      client_, [](TlsPreSharedKeyReplacer* r) {
+        r->binders_.push_back(r->binders_[0]);
+      });
   ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
@@ -822,8 +840,8 @@ TEST_F(TlsExtensionTest13Stream, ResumePskExtensionNotLast) {
   const uint8_t empty_buf[] = {0};
   DataBuffer empty(empty_buf, 0);
   // Inject an unused extension after the PSK extension.
-  client_->SetPacketFilter(std::make_shared<TlsExtensionAppender>(
-      kTlsHandshakeClientHello, 0xffff, empty));
+  MakeTlsFilter<TlsExtensionAppender>(client_, kTlsHandshakeClientHello, 0xffff,
+                                      empty);
   ConnectExpectAlert(server_, kTlsAlertIllegalParameter);
   client_->CheckErrorCode(SSL_ERROR_ILLEGAL_PARAMETER_ALERT);
   server_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_CLIENT_HELLO);
@@ -833,8 +851,8 @@ TEST_F(TlsExtensionTest13Stream, ResumeNoKeModes) {
   SetupForResume();
 
   DataBuffer empty;
-  client_->SetPacketFilter(std::make_shared<TlsExtensionDropper>(
-      ssl_tls13_psk_key_exchange_modes_xtn));
+  MakeTlsFilter<TlsExtensionDropper>(client_,
+                                     ssl_tls13_psk_key_exchange_modes_xtn);
   ConnectExpectAlert(server_, kTlsAlertMissingExtension);
   client_->CheckErrorCode(SSL_ERROR_MISSING_EXTENSION_ALERT);
   server_->CheckErrorCode(SSL_ERROR_MISSING_PSK_KEY_EXCHANGE_MODES);
@@ -849,8 +867,8 @@ TEST_F(TlsExtensionTest13Stream, ResumeBogusKeModes) {
                                      kTls13PskKe};
 
   DataBuffer modes(ke_modes, sizeof(ke_modes));
-  client_->SetPacketFilter(std::make_shared<TlsExtensionReplacer>(
-      ssl_tls13_psk_key_exchange_modes_xtn, modes));
+  MakeTlsFilter<TlsExtensionReplacer>(
+      client_, ssl_tls13_psk_key_exchange_modes_xtn, modes);
   client_->ExpectSendAlert(kTlsAlertBadRecordMac);
   server_->ExpectSendAlert(kTlsAlertBadRecordMac);
   ConnectExpectFail();
@@ -860,9 +878,8 @@ TEST_F(TlsExtensionTest13Stream, ResumeBogusKeModes) {
 
 TEST_P(TlsExtensionTest13, NoKeModesIfResumptionOff) {
   ConfigureSessionCache(RESUME_NONE, RESUME_NONE);
-  auto capture = std::make_shared<TlsExtensionCapture>(
-      ssl_tls13_psk_key_exchange_modes_xtn);
-  client_->SetPacketFilter(capture);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(
+      client_, ssl_tls13_psk_key_exchange_modes_xtn);
   Connect();
   EXPECT_FALSE(capture->captured());
 }
@@ -958,11 +975,9 @@ class TlsBogusExtensionTest : public TlsConnectTestBase,
     static uint8_t empty_buf[1] = {0};
     DataBuffer empty(empty_buf, 0);
     auto filter =
-        std::make_shared<TlsExtensionAppender>(message, extension, empty);
+        MakeTlsFilter<TlsExtensionAppender>(server_, message, extension, empty);
     if (version_ >= SSL_LIBRARY_VERSION_TLS_1_3) {
-      server_->SetTlsRecordFilter(filter);
-    } else {
-      server_->SetPacketFilter(filter);
+      filter->EnableDecryption();
     }
   }
 
@@ -1078,8 +1093,7 @@ TEST_P(TlsConnectStream, IncludePadding) {
   SECStatus rv = SSL_SetURL(client_->ssl_fd(), long_name);
   EXPECT_EQ(SECSuccess, rv);
 
-  auto capture = std::make_shared<TlsExtensionCapture>(ssl_padding_xtn);
-  client_->SetPacketFilter(capture);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(client_, ssl_padding_xtn);
   client_->StartConnect();
   client_->Handshake();
   EXPECT_TRUE(capture->captured());
diff --git a/security/nss/gtests/ssl_gtest/ssl_fragment_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_fragment_unittest.cc
index 64b824786d..f4940bf282 100644
--- a/security/nss/gtests/ssl_gtest/ssl_fragment_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_fragment_unittest.cc
@@ -149,13 +149,13 @@ class RecordFragmenter : public PacketFilter {
 };
 
 TEST_P(TlsConnectDatagram, FragmentClientPackets) {
-  client_->SetPacketFilter(std::make_shared<RecordFragmenter>());
+  client_->SetFilter(std::make_shared<RecordFragmenter>());
   Connect();
   SendReceive();
 }
 
 TEST_P(TlsConnectDatagram, FragmentServerPackets) {
-  server_->SetPacketFilter(std::make_shared<RecordFragmenter>());
+  server_->SetFilter(std::make_shared<RecordFragmenter>());
   Connect();
   SendReceive();
 }
diff --git a/security/nss/gtests/ssl_gtest/ssl_fuzz_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_fuzz_unittest.cc
index ab4c0eab7e..99448321c5 100644
--- a/security/nss/gtests/ssl_gtest/ssl_fuzz_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_fuzz_unittest.cc
@@ -27,7 +27,8 @@ class TlsFuzzTest : public ::testing::Test {};
 // Record the application data stream.
 class TlsApplicationDataRecorder : public TlsRecordFilter {
  public:
-  TlsApplicationDataRecorder() : buffer_() {}
+  TlsApplicationDataRecorder(const std::shared_ptr<TlsAgent>& agent)
+      : TlsRecordFilter(agent), buffer_() {}
 
   virtual PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                             const DataBuffer& input,
@@ -106,16 +107,16 @@ FUZZ_P(TlsConnectGeneric, DeterministicTranscript) {
     DisableECDHEServerKeyReuse();
 
     DataBuffer buffer;
-    client_->SetPacketFilter(std::make_shared<TlsConversationRecorder>(buffer));
-    server_->SetPacketFilter(std::make_shared<TlsConversationRecorder>(buffer));
+    MakeTlsFilter<TlsConversationRecorder>(client_, buffer);
+    MakeTlsFilter<TlsConversationRecorder>(server_, buffer);
 
     // Reset the RNG state.
     EXPECT_EQ(SECSuccess, RNG_RandomUpdate(NULL, 0));
     Connect();
 
     // Ensure the filters go away before |buffer| does.
-    client_->DeletePacketFilter();
-    server_->DeletePacketFilter();
+    client_->ClearFilter();
+    server_->ClearFilter();
 
     if (last.len() > 0) {
       EXPECT_EQ(last, buffer);
@@ -133,10 +134,8 @@ FUZZ_P(TlsConnectGeneric, ConnectSendReceive_NullCipher) {
   EnsureTlsSetup();
 
   // Set up app data filters.
-  auto client_recorder = std::make_shared<TlsApplicationDataRecorder>();
-  client_->SetPacketFilter(client_recorder);
-  auto server_recorder = std::make_shared<TlsApplicationDataRecorder>();
-  server_->SetPacketFilter(server_recorder);
+  auto client_recorder = MakeTlsFilter<TlsApplicationDataRecorder>(client_);
+  auto server_recorder = MakeTlsFilter<TlsApplicationDataRecorder>(server_);
 
   Connect();
 
@@ -161,10 +160,9 @@ FUZZ_P(TlsConnectGeneric, ConnectSendReceive_NullCipher) {
 FUZZ_P(TlsConnectGeneric, BogusClientFinished) {
   EnsureTlsSetup();
 
-  auto i1 = std::make_shared<TlsInspectorReplaceHandshakeMessage>(
-      kTlsHandshakeFinished,
+  MakeTlsFilter<TlsInspectorReplaceHandshakeMessage>(
+      client_, kTlsHandshakeFinished,
       DataBuffer(kShortEmptyFinished, sizeof(kShortEmptyFinished)));
-  client_->SetPacketFilter(i1);
   Connect();
   SendReceive();
 }
@@ -173,10 +171,9 @@ FUZZ_P(TlsConnectGeneric, BogusClientFinished) {
 FUZZ_P(TlsConnectGeneric, BogusServerFinished) {
   EnsureTlsSetup();
 
-  auto i1 = std::make_shared<TlsInspectorReplaceHandshakeMessage>(
-      kTlsHandshakeFinished,
+  MakeTlsFilter<TlsInspectorReplaceHandshakeMessage>(
+      server_, kTlsHandshakeFinished,
       DataBuffer(kLongEmptyFinished, sizeof(kLongEmptyFinished)));
-  server_->SetPacketFilter(i1);
   Connect();
   SendReceive();
 }
@@ -187,7 +184,7 @@ FUZZ_P(TlsConnectGeneric, BogusServerAuthSignature) {
   uint8_t msg_type = version_ == SSL_LIBRARY_VERSION_TLS_1_3
                          ? kTlsHandshakeCertificateVerify
                          : kTlsHandshakeServerKeyExchange;
-  server_->SetPacketFilter(std::make_shared<TlsLastByteDamager>(msg_type));
+  MakeTlsFilter<TlsLastByteDamager>(server_, msg_type);
   Connect();
   SendReceive();
 }
@@ -197,8 +194,7 @@ FUZZ_P(TlsConnectGeneric, BogusClientAuthSignature) {
   EnsureTlsSetup();
   client_->SetupClientAuth();
   server_->RequestClientAuth(true);
-  client_->SetPacketFilter(
-      std::make_shared<TlsLastByteDamager>(kTlsHandshakeCertificateVerify));
+  MakeTlsFilter<TlsLastByteDamager>(client_, kTlsHandshakeCertificateVerify);
   Connect();
 }
 
@@ -219,29 +215,28 @@ FUZZ_P(TlsConnectGeneric, SessionTicketResumption) {
 FUZZ_P(TlsConnectGeneric, UnencryptedSessionTickets) {
   ConfigureSessionCache(RESUME_TICKET, RESUME_TICKET);
 
-  auto i1 = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeNewSessionTicket);
-  server_->SetPacketFilter(i1);
+  auto filter = MakeTlsFilter<TlsHandshakeRecorder>(
+      server_, kTlsHandshakeNewSessionTicket);
   Connect();
 
-  std::cerr << "ticket" << i1->buffer() << std::endl;
+  std::cerr << "ticket" << filter->buffer() << std::endl;
   size_t offset = 4; /* lifetime */
   if (version_ == SSL_LIBRARY_VERSION_TLS_1_3) {
     offset += 4; /* ticket_age_add */
     uint32_t nonce_len = 0;
-    EXPECT_TRUE(i1->buffer().Read(offset, 1, &nonce_len));
+    EXPECT_TRUE(filter->buffer().Read(offset, 1, &nonce_len));
     offset += 1 + nonce_len;
   }
   offset += 2 + /* ticket length */
             2;  /* TLS_EX_SESS_TICKET_VERSION */
   // Check the protocol version number.
   uint32_t tls_version = 0;
-  EXPECT_TRUE(i1->buffer().Read(offset, sizeof(version_), &tls_version));
+  EXPECT_TRUE(filter->buffer().Read(offset, sizeof(version_), &tls_version));
   EXPECT_EQ(version_, static_cast<decltype(version_)>(tls_version));
 
   // Check the cipher suite.
   uint32_t suite = 0;
-  EXPECT_TRUE(i1->buffer().Read(offset + sizeof(version_), 2, &suite));
+  EXPECT_TRUE(filter->buffer().Read(offset + sizeof(version_), 2, &suite));
   client_->CheckCipherSuite(static_cast<uint16_t>(suite));
 }
 }
diff --git a/security/nss/gtests/ssl_gtest/ssl_hrr_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_hrr_unittest.cc
index 93e19a7203..05ae870348 100644
--- a/security/nss/gtests/ssl_gtest/ssl_hrr_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_hrr_unittest.cc
@@ -35,17 +35,15 @@ TEST_P(TlsConnectTls13, HelloRetryRequestAbortsZeroRtt) {
 
   // Send first ClientHello and send 0-RTT data
   auto capture_early_data =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_early_data_xtn);
-  client_->SetPacketFilter(capture_early_data);
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_tls13_early_data_xtn);
   client_->Handshake();
   EXPECT_EQ(k0RttDataLen, PR_Write(client_->ssl_fd(), k0RttData,
                                    k0RttDataLen));  // 0-RTT write.
   EXPECT_TRUE(capture_early_data->captured());
 
   // Send the HelloRetryRequest
-  auto hrr_capture = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeHelloRetryRequest);
-  server_->SetPacketFilter(hrr_capture);
+  auto hrr_capture = MakeTlsFilter<TlsHandshakeRecorder>(
+      server_, kTlsHandshakeHelloRetryRequest);
   server_->Handshake();
   EXPECT_LT(0U, hrr_capture->buffer().len());
 
@@ -56,8 +54,7 @@ TEST_P(TlsConnectTls13, HelloRetryRequestAbortsZeroRtt) {
 
   // Make a new capture for the early data.
   capture_early_data =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_early_data_xtn);
-  client_->SetPacketFilter(capture_early_data);
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_tls13_early_data_xtn);
 
   // Complete the handshake successfully
   Handshake();
@@ -71,6 +68,10 @@ TEST_P(TlsConnectTls13, HelloRetryRequestAbortsZeroRtt) {
 // packet. If the record is split into two packets, or there are multiple
 // handshake packets, this will break.
 class CorrectMessageSeqAfterHrrFilter : public TlsRecordFilter {
+ public:
+  CorrectMessageSeqAfterHrrFilter(const std::shared_ptr<TlsAgent>& agent)
+      : TlsRecordFilter(agent) {}
+
  protected:
   PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                     const DataBuffer& record, size_t* offset,
@@ -131,8 +132,7 @@ TEST_P(TlsConnectTls13, SecondClientHelloRejectEarlyDataXtn) {
 
   // Correct the DTLS message sequence number after an HRR.
   if (variant_ == ssl_variant_datagram) {
-    client_->SetPacketFilter(
-        std::make_shared<CorrectMessageSeqAfterHrrFilter>());
+    MakeTlsFilter<CorrectMessageSeqAfterHrrFilter>(client_);
   }
 
   server_->SetPeer(client_);
@@ -151,7 +151,8 @@ TEST_P(TlsConnectTls13, SecondClientHelloRejectEarlyDataXtn) {
 
 class KeyShareReplayer : public TlsExtensionFilter {
  public:
-  KeyShareReplayer() {}
+  KeyShareReplayer(const std::shared_ptr<TlsAgent>& agent)
+      : TlsExtensionFilter(agent) {}
 
   virtual PacketFilter::Action FilterExtension(uint16_t extension_type,
                                                const DataBuffer& input,
@@ -178,7 +179,7 @@ class KeyShareReplayer : public TlsExtensionFilter {
 // server should reject this.
 TEST_P(TlsConnectTls13, RetryWithSameKeyShare) {
   EnsureTlsSetup();
-  client_->SetPacketFilter(std::make_shared<KeyShareReplayer>());
+  MakeTlsFilter<KeyShareReplayer>(client_);
   static const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1,
                                                     ssl_grp_ec_secp521r1};
   server_->ConfigNamedGroups(groups);
@@ -192,7 +193,7 @@ TEST_P(TlsConnectTls13, RetryWithSameKeyShare) {
 TEST_P(TlsConnectTls13, RetryWithTwoShares) {
   EnsureTlsSetup();
   EXPECT_EQ(SECSuccess, SSL_SendAdditionalKeyShares(client_->ssl_fd(), 1));
-  client_->SetPacketFilter(std::make_shared<KeyShareReplayer>());
+  MakeTlsFilter<KeyShareReplayer>(client_);
 
   static const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1,
                                                     ssl_grp_ec_secp521r1};
@@ -238,9 +239,9 @@ TEST_P(TlsConnectTls13, RetryCallbackAcceptGroupMismatch) {
     return ssl_hello_retry_accept;
   };
 
-  auto capture = std::make_shared<TlsExtensionCapture>(ssl_tls13_cookie_xtn);
+  auto capture =
+      MakeTlsFilter<TlsExtensionCapture>(server_, ssl_tls13_cookie_xtn);
   capture->SetHandshakeTypes({kTlsHandshakeHelloRetryRequest});
-  server_->SetPacketFilter(capture);
 
   static const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1};
   server_->ConfigNamedGroups(groups);
@@ -359,14 +360,14 @@ SSLHelloRetryRequestAction RetryHello(PRBool firstHello,
 TEST_P(TlsConnectTls13, RetryCallbackRetry) {
   EnsureTlsSetup();
 
-  auto capture_hrr = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      ssl_hs_hello_retry_request);
+  auto capture_hrr = std::make_shared<TlsHandshakeRecorder>(
+      server_, ssl_hs_hello_retry_request);
   auto capture_key_share =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
+      std::make_shared<TlsExtensionCapture>(server_, ssl_tls13_key_share_xtn);
   capture_key_share->SetHandshakeTypes({kTlsHandshakeHelloRetryRequest});
   std::vector<std::shared_ptr<PacketFilter>> chain = {capture_hrr,
                                                       capture_key_share};
-  server_->SetPacketFilter(std::make_shared<ChainedPacketFilter>(chain));
+  server_->SetFilter(std::make_shared<ChainedPacketFilter>(chain));
 
   size_t cb_called = 0;
   EXPECT_EQ(SECSuccess, SSL_HelloRetryRequestCallback(server_->ssl_fd(),
@@ -383,8 +384,7 @@ TEST_P(TlsConnectTls13, RetryCallbackRetry) {
       << "no key_share extension expected";
 
   auto capture_cookie =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_cookie_xtn);
-  client_->SetPacketFilter(capture_cookie);
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_tls13_cookie_xtn);
 
   Handshake();
   CheckConnected();
@@ -413,9 +413,8 @@ TEST_P(TlsConnectTls13, RetryCallbackRetryWithAdditionalShares) {
   EXPECT_EQ(SECSuccess, SSL_SendAdditionalKeyShares(client_->ssl_fd(), 1));
 
   auto capture_server =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
+      MakeTlsFilter<TlsExtensionCapture>(server_, ssl_tls13_key_share_xtn);
   capture_server->SetHandshakeTypes({kTlsHandshakeHelloRetryRequest});
-  server_->SetPacketFilter(capture_server);
 
   size_t cb_called = 0;
   EXPECT_EQ(SECSuccess, SSL_HelloRetryRequestCallback(server_->ssl_fd(),
@@ -431,8 +430,7 @@ TEST_P(TlsConnectTls13, RetryCallbackRetryWithAdditionalShares) {
       << "no key_share extension expected from server";
 
   auto capture_client_2nd =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
-  client_->SetPacketFilter(capture_client_2nd);
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_tls13_key_share_xtn);
 
   Handshake();
   CheckConnected();
@@ -449,12 +447,12 @@ TEST_P(TlsConnectTls13, RetryCallbackRetryWithGroupMismatch) {
   EnsureTlsSetup();
 
   auto capture_cookie =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_cookie_xtn);
+      std::make_shared<TlsExtensionCapture>(server_, ssl_tls13_cookie_xtn);
   capture_cookie->SetHandshakeTypes({kTlsHandshakeHelloRetryRequest});
   auto capture_key_share =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
+      std::make_shared<TlsExtensionCapture>(server_, ssl_tls13_key_share_xtn);
   capture_key_share->SetHandshakeTypes({kTlsHandshakeHelloRetryRequest});
-  server_->SetPacketFilter(std::make_shared<ChainedPacketFilter>(
+  server_->SetFilter(std::make_shared<ChainedPacketFilter>(
       ChainedPacketFilterInit{capture_cookie, capture_key_share}));
 
   static const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1};
@@ -493,9 +491,8 @@ TEST_P(TlsConnectTls13, RetryCallbackRetryWithToken) {
   EnsureTlsSetup();
 
   auto capture_key_share =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
+      MakeTlsFilter<TlsExtensionCapture>(server_, ssl_tls13_key_share_xtn);
   capture_key_share->SetHandshakeTypes({kTlsHandshakeHelloRetryRequest});
-  server_->SetPacketFilter(capture_key_share);
 
   size_t cb_called = 0;
   EXPECT_EQ(SECSuccess,
@@ -513,9 +510,8 @@ TEST_P(TlsConnectTls13, RetryCallbackRetryWithTokenAndGroupMismatch) {
   server_->ConfigNamedGroups(groups);
 
   auto capture_key_share =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
+      MakeTlsFilter<TlsExtensionCapture>(server_, ssl_tls13_key_share_xtn);
   capture_key_share->SetHandshakeTypes({kTlsHandshakeHelloRetryRequest});
-  server_->SetPacketFilter(capture_key_share);
 
   size_t cb_called = 0;
   EXPECT_EQ(SECSuccess,
@@ -589,8 +585,7 @@ TEST_P(TlsConnectTls13, RetryStatefulDropCookie) {
   EnsureTlsSetup();
 
   TriggerHelloRetryRequest(client_, server_);
-  client_->SetPacketFilter(
-      std::make_shared<TlsExtensionDropper>(ssl_tls13_cookie_xtn));
+  MakeTlsFilter<TlsExtensionDropper>(client_, ssl_tls13_cookie_xtn);
 
   ExpectAlert(server_, kTlsAlertMissingExtension);
   Handshake();
@@ -603,8 +598,8 @@ TEST_F(TlsConnectStreamTls13, RetryStatelessDamageFirstClientHello) {
   ConfigureSelfEncrypt();
   EnsureTlsSetup();
 
-  auto damage_ch = std::make_shared<TlsExtensionInjector>(0xfff3, DataBuffer());
-  client_->SetPacketFilter(damage_ch);
+  auto damage_ch =
+      MakeTlsFilter<TlsExtensionInjector>(client_, 0xfff3, DataBuffer());
 
   TriggerHelloRetryRequest(client_, server_);
   MakeNewServer();
@@ -625,8 +620,8 @@ TEST_F(TlsConnectStreamTls13, RetryStatelessDamageSecondClientHello) {
   TriggerHelloRetryRequest(client_, server_);
   MakeNewServer();
 
-  auto damage_ch = std::make_shared<TlsExtensionInjector>(0xfff3, DataBuffer());
-  client_->SetPacketFilter(damage_ch);
+  auto damage_ch =
+      MakeTlsFilter<TlsExtensionInjector>(client_, 0xfff3, DataBuffer());
 
   // Key exchange fails when the handshake continues because client and server
   // disagree about the transcript.
@@ -640,7 +635,7 @@ TEST_F(TlsConnectStreamTls13, RetryStatelessDamageSecondClientHello) {
 // Read the cipher suite from the HRR and disable it on the identified agent.
 static void DisableSuiteFromHrr(
     std::shared_ptr<TlsAgent>& agent,
-    std::shared_ptr<TlsInspectorRecordHandshakeMessage>& capture_hrr) {
+    std::shared_ptr<TlsHandshakeRecorder>& capture_hrr) {
   uint32_t tmp;
   size_t offset = 2 + 32;  // skip version + server_random
   ASSERT_TRUE(
@@ -657,9 +652,8 @@ TEST_P(TlsConnectTls13, RetryStatelessDisableSuiteClient) {
   ConfigureSelfEncrypt();
   EnsureTlsSetup();
 
-  auto capture_hrr = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      ssl_hs_hello_retry_request);
-  server_->SetPacketFilter(capture_hrr);
+  auto capture_hrr =
+      MakeTlsFilter<TlsHandshakeRecorder>(server_, ssl_hs_hello_retry_request);
 
   TriggerHelloRetryRequest(client_, server_);
   MakeNewServer();
@@ -678,9 +672,8 @@ TEST_P(TlsConnectTls13, RetryStatelessDisableSuiteServer) {
   ConfigureSelfEncrypt();
   EnsureTlsSetup();
 
-  auto capture_hrr = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      ssl_hs_hello_retry_request);
-  server_->SetPacketFilter(capture_hrr);
+  auto capture_hrr =
+      MakeTlsFilter<TlsHandshakeRecorder>(server_, ssl_hs_hello_retry_request);
 
   TriggerHelloRetryRequest(client_, server_);
   MakeNewServer();
@@ -761,8 +754,8 @@ TEST_F(TlsConnectStreamTls13, RetryWithDifferentCipherSuite) {
   static const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1};
   server_->ConfigNamedGroups(groups);
   // Then switch out the default suite (TLS_AES_128_GCM_SHA256).
-  server_->SetPacketFilter(std::make_shared<SelectedCipherSuiteReplacer>(
-      TLS_CHACHA20_POLY1305_SHA256));
+  MakeTlsFilter<SelectedCipherSuiteReplacer>(server_,
+                                             TLS_CHACHA20_POLY1305_SHA256);
 
   client_->ExpectSendAlert(kTlsAlertIllegalParameter);
   server_->ExpectSendAlert(kTlsAlertBadRecordMac);
@@ -777,7 +770,7 @@ TEST_F(TlsConnectDatagram13, DropClientSecondFlightWithHelloRetry) {
   static const std::vector<SSLNamedGroup> groups = {ssl_grp_ec_secp384r1,
                                                     ssl_grp_ec_secp521r1};
   server_->ConfigNamedGroups(groups);
-  server_->SetPacketFilter(std::make_shared<SelectiveDropFilter>(0x2));
+  server_->SetFilter(std::make_shared<SelectiveDropFilter>(0x2));
   Connect();
 }
 
@@ -833,9 +826,9 @@ TEST_P(TlsKeyExchange13,
   EXPECT_EQ(SECSuccess, SSL_SendAdditionalKeyShares(client_->ssl_fd(), 1));
 
   auto capture_server =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
+      std::make_shared<TlsExtensionCapture>(server_, ssl_tls13_key_share_xtn);
   capture_server->SetHandshakeTypes({kTlsHandshakeHelloRetryRequest});
-  server_->SetPacketFilter(std::make_shared<ChainedPacketFilter>(
+  server_->SetFilter(std::make_shared<ChainedPacketFilter>(
       ChainedPacketFilterInit{capture_hrr_, capture_server}));
 
   size_t cb_called = 0;
diff --git a/security/nss/gtests/ssl_gtest/ssl_keylog_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_keylog_unittest.cc
index 8ed3423054..322b648375 100644
--- a/security/nss/gtests/ssl_gtest/ssl_keylog_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_keylog_unittest.cc
@@ -20,8 +20,8 @@ static const std::string keylog_env = "SSLKEYLOGFILE=" + keylog_file_path;
 
 class KeyLogFileTest : public TlsConnectGeneric {
  public:
-  void SetUp() {
-    TlsConnectTestBase::SetUp();
+  void SetUp() override {
+    TlsConnectGeneric::SetUp();
     // Remove previous results (if any).
     (void)remove(keylog_file_path.c_str());
     PR_SetEnv(keylog_env.c_str());
diff --git a/security/nss/gtests/ssl_gtest/ssl_loopback_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_loopback_unittest.cc
index 4bc6e60ab4..f1b78f52fd 100644
--- a/security/nss/gtests/ssl_gtest/ssl_loopback_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_loopback_unittest.cc
@@ -56,7 +56,8 @@ TEST_P(TlsConnectGeneric, CipherSuiteMismatch) {
 
 class TlsAlertRecorder : public TlsRecordFilter {
  public:
-  TlsAlertRecorder() : level_(255), description_(255) {}
+  TlsAlertRecorder(const std::shared_ptr<TlsAgent>& agent)
+      : TlsRecordFilter(agent), level_(255), description_(255) {}
 
   PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                     const DataBuffer& input,
@@ -86,9 +87,9 @@ class TlsAlertRecorder : public TlsRecordFilter {
 
 class HelloTruncator : public TlsHandshakeFilter {
  public:
-  HelloTruncator()
+  HelloTruncator(const std::shared_ptr<TlsAgent>& agent)
       : TlsHandshakeFilter(
-            {kTlsHandshakeClientHello, kTlsHandshakeServerHello}) {}
+            agent, {kTlsHandshakeClientHello, kTlsHandshakeServerHello}) {}
   PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
                                        const DataBuffer& input,
                                        DataBuffer* output) override {
@@ -99,9 +100,8 @@ class HelloTruncator : public TlsHandshakeFilter {
 
 // Verify that when NSS reports that an alert is sent, it is actually sent.
 TEST_P(TlsConnectGeneric, CaptureAlertServer) {
-  client_->SetPacketFilter(std::make_shared<HelloTruncator>());
-  auto alert_recorder = std::make_shared<TlsAlertRecorder>();
-  server_->SetPacketFilter(alert_recorder);
+  MakeTlsFilter<HelloTruncator>(client_);
+  auto alert_recorder = MakeTlsFilter<TlsAlertRecorder>(server_);
 
   ConnectExpectAlert(server_, kTlsAlertDecodeError);
   EXPECT_EQ(kTlsAlertFatal, alert_recorder->level());
@@ -109,9 +109,8 @@ TEST_P(TlsConnectGeneric, CaptureAlertServer) {
 }
 
 TEST_P(TlsConnectGenericPre13, CaptureAlertClient) {
-  server_->SetPacketFilter(std::make_shared<HelloTruncator>());
-  auto alert_recorder = std::make_shared<TlsAlertRecorder>();
-  client_->SetPacketFilter(alert_recorder);
+  MakeTlsFilter<HelloTruncator>(server_);
+  auto alert_recorder = MakeTlsFilter<TlsAlertRecorder>(client_);
 
   ConnectExpectAlert(client_, kTlsAlertDecodeError);
   EXPECT_EQ(kTlsAlertFatal, alert_recorder->level());
@@ -120,9 +119,8 @@ TEST_P(TlsConnectGenericPre13, CaptureAlertClient) {
 
 // In TLS 1.3, the server can't read the client alert.
 TEST_P(TlsConnectTls13, CaptureAlertClient) {
-  server_->SetPacketFilter(std::make_shared<HelloTruncator>());
-  auto alert_recorder = std::make_shared<TlsAlertRecorder>();
-  client_->SetPacketFilter(alert_recorder);
+  MakeTlsFilter<HelloTruncator>(server_);
+  auto alert_recorder = MakeTlsFilter<TlsAlertRecorder>(client_);
 
   StartConnect();
 
@@ -173,7 +171,8 @@ TEST_P(TlsConnectGeneric, ConnectSendReceive) {
 
 class SaveTlsRecord : public TlsRecordFilter {
  public:
-  SaveTlsRecord(size_t index) : index_(index), count_(0), contents_() {}
+  SaveTlsRecord(const std::shared_ptr<TlsAgent>& agent, size_t index)
+      : TlsRecordFilter(agent), index_(index), count_(0), contents_() {}
 
   const DataBuffer& contents() const { return contents_; }
 
@@ -198,8 +197,8 @@ class SaveTlsRecord : public TlsRecordFilter {
 TEST_F(TlsConnectStreamTls13, DecryptRecordClient) {
   EnsureTlsSetup();
   // 0 = ClientHello, 1 = Finished, 2 = SendReceive, 3 = SendBuffer
-  auto saved = std::make_shared<SaveTlsRecord>(3);
-  client_->SetTlsRecordFilter(saved);
+  auto saved = MakeTlsFilter<SaveTlsRecord>(client_, 3);
+  saved->EnableDecryption();
   Connect();
   SendReceive();
 
@@ -215,8 +214,8 @@ TEST_F(TlsConnectStreamTls13, DecryptRecordServer) {
   EXPECT_EQ(SECSuccess, SSL_OptionSet(server_->ssl_fd(),
                                       SSL_ENABLE_SESSION_TICKETS, PR_FALSE));
   // 0 = ServerHello, 1 = other handshake, 2 = SendReceive, 3 = SendBuffer
-  auto saved = std::make_shared<SaveTlsRecord>(3);
-  server_->SetTlsRecordFilter(saved);
+  auto saved = MakeTlsFilter<SaveTlsRecord>(server_, 3);
+  saved->EnableDecryption();
   Connect();
   SendReceive();
 
@@ -228,7 +227,8 @@ TEST_F(TlsConnectStreamTls13, DecryptRecordServer) {
 
 class DropTlsRecord : public TlsRecordFilter {
  public:
-  DropTlsRecord(size_t index) : index_(index), count_(0) {}
+  DropTlsRecord(const std::shared_ptr<TlsAgent>& agent, size_t index)
+      : TlsRecordFilter(agent), index_(index), count_(0) {}
 
  protected:
   PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
@@ -253,7 +253,8 @@ TEST_F(TlsConnectStreamTls13, DropRecordServer) {
                                       SSL_ENABLE_SESSION_TICKETS, PR_FALSE));
 
   // 0 = ServerHello, 1 = other handshake, 2 = first write
-  server_->SetTlsRecordFilter(std::make_shared<DropTlsRecord>(2));
+  auto filter = MakeTlsFilter<DropTlsRecord>(server_, 2);
+  filter->EnableDecryption();
   Connect();
   server_->SendData(23, 23);  // This should be dropped, so it won't be counted.
   server_->ResetSentBytes();
@@ -263,7 +264,8 @@ TEST_F(TlsConnectStreamTls13, DropRecordServer) {
 TEST_F(TlsConnectStreamTls13, DropRecordClient) {
   EnsureTlsSetup();
   // 0 = ClientHello, 1 = Finished, 2 = first write
-  client_->SetTlsRecordFilter(std::make_shared<DropTlsRecord>(2));
+  auto filter = MakeTlsFilter<DropTlsRecord>(client_, 2);
+  filter->EnableDecryption();
   Connect();
   client_->SendData(26, 26);  // This should be dropped, so it won't be counted.
   client_->ResetSentBytes();
@@ -371,7 +373,8 @@ TEST_P(TlsHolddownTest, TestDtlsHolddownExpiryResumption) {
 
 class TlsPreCCSHeaderInjector : public TlsRecordFilter {
  public:
-  TlsPreCCSHeaderInjector() {}
+  TlsPreCCSHeaderInjector(const std::shared_ptr<TlsAgent>& agent)
+      : TlsRecordFilter(agent) {}
   virtual PacketFilter::Action FilterRecord(
       const TlsRecordHeader& record_header, const DataBuffer& input,
       size_t* offset, DataBuffer* output) override {
@@ -388,14 +391,14 @@ class TlsPreCCSHeaderInjector : public TlsRecordFilter {
 };
 
 TEST_P(TlsConnectStreamPre13, ClientFinishedHeaderBeforeCCS) {
-  client_->SetPacketFilter(std::make_shared<TlsPreCCSHeaderInjector>());
+  MakeTlsFilter<TlsPreCCSHeaderInjector>(client_);
   ConnectExpectAlert(server_, kTlsAlertUnexpectedMessage);
   client_->CheckErrorCode(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT);
   server_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_CHANGE_CIPHER);
 }
 
 TEST_P(TlsConnectStreamPre13, ServerFinishedHeaderBeforeCCS) {
-  server_->SetPacketFilter(std::make_shared<TlsPreCCSHeaderInjector>());
+  MakeTlsFilter<TlsPreCCSHeaderInjector>(server_);
   StartConnect();
   ExpectAlert(client_, kTlsAlertUnexpectedMessage);
   Handshake();
@@ -476,8 +479,7 @@ TEST_F(TlsConnectTest, OneNRecordSplitting) {
   ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_0);
   EnsureTlsSetup();
   ConnectWithCipherSuite(TLS_RSA_WITH_AES_128_CBC_SHA);
-  auto records = std::make_shared<TlsRecordRecorder>();
-  server_->SetPacketFilter(records);
+  auto records = MakeTlsFilter<TlsRecordRecorder>(server_);
   // This should be split into 1, 16384 and 20.
   DataBuffer big_buffer;
   big_buffer.Allocate(1 + 16384 + 20);
@@ -535,4 +537,27 @@ INSTANTIATE_TEST_CASE_P(Version12Plus, TlsConnectTls12Plus,
                         ::testing::Combine(TlsConnectTestBase::kTlsVariantsAll,
                                            TlsConnectTestBase::kTlsV12Plus));
 
-}  // namespace nspr_test
+INSTANTIATE_TEST_CASE_P(
+    GenericStream, TlsConnectGenericResumption,
+    ::testing::Combine(TlsConnectTestBase::kTlsVariantsStream,
+                       TlsConnectTestBase::kTlsVAll,
+                       ::testing::Values(true, false)));
+INSTANTIATE_TEST_CASE_P(
+    GenericDatagram, TlsConnectGenericResumption,
+    ::testing::Combine(TlsConnectTestBase::kTlsVariantsDatagram,
+                       TlsConnectTestBase::kTlsV11Plus,
+                       ::testing::Values(true, false)));
+
+INSTANTIATE_TEST_CASE_P(
+    GenericStream, TlsConnectGenericResumptionToken,
+    ::testing::Combine(TlsConnectTestBase::kTlsVariantsStream,
+                       TlsConnectTestBase::kTlsVAll));
+INSTANTIATE_TEST_CASE_P(
+    GenericDatagram, TlsConnectGenericResumptionToken,
+    ::testing::Combine(TlsConnectTestBase::kTlsVariantsDatagram,
+                       TlsConnectTestBase::kTlsV11Plus));
+
+INSTANTIATE_TEST_CASE_P(GenericDatagram, TlsConnectTls13ResumptionToken,
+                        TlsConnectTestBase::kTlsVariantsAll);
+
+}  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/ssl_record_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_record_unittest.cc
index d1d496f492..3b87278501 100644
--- a/security/nss/gtests/ssl_gtest/ssl_record_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_record_unittest.cc
@@ -103,8 +103,8 @@ TEST_P(TlsPaddingTest, LastByteOfPadWrong) {
 
 class RecordReplacer : public TlsRecordFilter {
  public:
-  RecordReplacer(size_t size)
-      : TlsRecordFilter(), enabled_(false), size_(size) {}
+  RecordReplacer(const std::shared_ptr<TlsAgent>& agent, size_t size)
+      : TlsRecordFilter(agent), enabled_(false), size_(size) {}
 
   PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                     const DataBuffer& data,
@@ -135,8 +135,8 @@ TEST_F(TlsConnectStreamTls13, LargeRecord) {
   EnsureTlsSetup();
 
   const size_t record_limit = 16384;
-  auto replacer = std::make_shared<RecordReplacer>(record_limit);
-  client_->SetTlsRecordFilter(replacer);
+  auto replacer = MakeTlsFilter<RecordReplacer>(client_, record_limit);
+  replacer->EnableDecryption();
   Connect();
 
   replacer->Enable();
@@ -149,8 +149,8 @@ TEST_F(TlsConnectStreamTls13, TooLargeRecord) {
   EnsureTlsSetup();
 
   const size_t record_limit = 16384;
-  auto replacer = std::make_shared<RecordReplacer>(record_limit + 1);
-  client_->SetTlsRecordFilter(replacer);
+  auto replacer = MakeTlsFilter<RecordReplacer>(client_, record_limit + 1);
+  replacer->EnableDecryption();
   Connect();
 
   replacer->Enable();
@@ -177,4 +177,4 @@ auto kTrueFalse = ::testing::ValuesIn(kTrueFalseArr);
 
 INSTANTIATE_TEST_CASE_P(TlsPadding, TlsPaddingTest,
                         ::testing::Combine(kContentSizes, kTrueFalse));
-}  // namespace nspr_test
+}  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/ssl_resumption_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_resumption_unittest.cc
index a413caf2c2..eb78c05851 100644
--- a/security/nss/gtests/ssl_gtest/ssl_resumption_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_resumption_unittest.cc
@@ -60,7 +60,7 @@ TEST_P(TlsConnectGenericPre13, ConnectResumed) {
   Connect();
 }
 
-TEST_P(TlsConnectGeneric, ConnectClientCacheDisabled) {
+TEST_P(TlsConnectGenericResumption, ConnectClientCacheDisabled) {
   ConfigureSessionCache(RESUME_NONE, RESUME_SESSIONID);
   Connect();
   SendReceive();
@@ -71,7 +71,7 @@ TEST_P(TlsConnectGeneric, ConnectClientCacheDisabled) {
   SendReceive();
 }
 
-TEST_P(TlsConnectGeneric, ConnectServerCacheDisabled) {
+TEST_P(TlsConnectGenericResumption, ConnectServerCacheDisabled) {
   ConfigureSessionCache(RESUME_SESSIONID, RESUME_NONE);
   Connect();
   SendReceive();
@@ -82,7 +82,7 @@ TEST_P(TlsConnectGeneric, ConnectServerCacheDisabled) {
   SendReceive();
 }
 
-TEST_P(TlsConnectGeneric, ConnectSessionCacheDisabled) {
+TEST_P(TlsConnectGenericResumption, ConnectSessionCacheDisabled) {
   ConfigureSessionCache(RESUME_NONE, RESUME_NONE);
   Connect();
   SendReceive();
@@ -93,7 +93,7 @@ TEST_P(TlsConnectGeneric, ConnectSessionCacheDisabled) {
   SendReceive();
 }
 
-TEST_P(TlsConnectGeneric, ConnectResumeSupportBoth) {
+TEST_P(TlsConnectGenericResumption, ConnectResumeSupportBoth) {
   // This prefers tickets.
   ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
   Connect();
@@ -106,7 +106,7 @@ TEST_P(TlsConnectGeneric, ConnectResumeSupportBoth) {
   SendReceive();
 }
 
-TEST_P(TlsConnectGeneric, ConnectResumeClientTicketServerBoth) {
+TEST_P(TlsConnectGenericResumption, ConnectResumeClientTicketServerBoth) {
   // This causes no resumption because the client needs the
   // session cache to resume even with tickets.
   ConfigureSessionCache(RESUME_TICKET, RESUME_BOTH);
@@ -120,7 +120,7 @@ TEST_P(TlsConnectGeneric, ConnectResumeClientTicketServerBoth) {
   SendReceive();
 }
 
-TEST_P(TlsConnectGeneric, ConnectResumeClientBothTicketServerTicket) {
+TEST_P(TlsConnectGenericResumption, ConnectResumeClientBothTicketServerTicket) {
   // This causes a ticket resumption.
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   Connect();
@@ -133,7 +133,7 @@ TEST_P(TlsConnectGeneric, ConnectResumeClientBothTicketServerTicket) {
   SendReceive();
 }
 
-TEST_P(TlsConnectGeneric, ConnectResumeClientServerTicketOnly) {
+TEST_P(TlsConnectGenericResumption, ConnectResumeClientServerTicketOnly) {
   // This causes no resumption because the client needs the
   // session cache to resume even with tickets.
   ConfigureSessionCache(RESUME_TICKET, RESUME_TICKET);
@@ -147,7 +147,7 @@ TEST_P(TlsConnectGeneric, ConnectResumeClientServerTicketOnly) {
   SendReceive();
 }
 
-TEST_P(TlsConnectGeneric, ConnectResumeClientBothServerNone) {
+TEST_P(TlsConnectGenericResumption, ConnectResumeClientBothServerNone) {
   ConfigureSessionCache(RESUME_BOTH, RESUME_NONE);
   Connect();
   SendReceive();
@@ -159,7 +159,7 @@ TEST_P(TlsConnectGeneric, ConnectResumeClientBothServerNone) {
   SendReceive();
 }
 
-TEST_P(TlsConnectGeneric, ConnectResumeClientNoneServerBoth) {
+TEST_P(TlsConnectGenericResumption, ConnectResumeClientNoneServerBoth) {
   ConfigureSessionCache(RESUME_NONE, RESUME_BOTH);
   Connect();
   SendReceive();
@@ -202,7 +202,7 @@ TEST_P(TlsConnectGeneric, ConnectResumeClientBothTicketServerTicketForget) {
   SendReceive();
 }
 
-TEST_P(TlsConnectGeneric, ConnectWithExpiredTicketAtClient) {
+TEST_P(TlsConnectGenericResumption, ConnectWithExpiredTicketAtClient) {
   SSLInt_SetTicketLifetime(1);  // one second
   // This causes a ticket resumption.
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
@@ -219,8 +219,7 @@ TEST_P(TlsConnectGeneric, ConnectWithExpiredTicketAtClient) {
   SSLExtensionType xtn = (version_ >= SSL_LIBRARY_VERSION_TLS_1_3)
                              ? ssl_tls13_pre_shared_key_xtn
                              : ssl_session_ticket_xtn;
-  auto capture = std::make_shared<TlsExtensionCapture>(xtn);
-  client_->SetPacketFilter(capture);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(client_, xtn);
   Connect();
 
   if (version_ >= SSL_LIBRARY_VERSION_TLS_1_3) {
@@ -245,8 +244,7 @@ TEST_P(TlsConnectGeneric, ConnectWithExpiredTicketAtServer) {
   SSLExtensionType xtn = (version_ >= SSL_LIBRARY_VERSION_TLS_1_3)
                              ? ssl_tls13_pre_shared_key_xtn
                              : ssl_session_ticket_xtn;
-  auto capture = std::make_shared<TlsExtensionCapture>(xtn);
-  client_->SetPacketFilter(capture);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(client_, xtn);
   StartConnect();
   client_->Handshake();
   EXPECT_TRUE(capture->captured());
@@ -327,25 +325,23 @@ TEST_P(TlsConnectGeneric, ServerSNICertTypeSwitch) {
 
 // Prior to TLS 1.3, we were not fully ephemeral; though 1.3 fixes that
 TEST_P(TlsConnectGenericPre13, ConnectEcdheTwiceReuseKey) {
-  auto i1 = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeServerKeyExchange);
-  server_->SetPacketFilter(i1);
+  auto filter = MakeTlsFilter<TlsHandshakeRecorder>(
+      server_, kTlsHandshakeServerKeyExchange);
   Connect();
   CheckKeys();
   TlsServerKeyExchangeEcdhe dhe1;
-  EXPECT_TRUE(dhe1.Parse(i1->buffer()));
+  EXPECT_TRUE(dhe1.Parse(filter->buffer()));
 
   // Restart
   Reset();
-  auto i2 = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeServerKeyExchange);
-  server_->SetPacketFilter(i2);
+  auto filter2 = MakeTlsFilter<TlsHandshakeRecorder>(
+      server_, kTlsHandshakeServerKeyExchange);
   ConfigureSessionCache(RESUME_NONE, RESUME_NONE);
   Connect();
   CheckKeys();
 
   TlsServerKeyExchangeEcdhe dhe2;
-  EXPECT_TRUE(dhe2.Parse(i2->buffer()));
+  EXPECT_TRUE(dhe2.Parse(filter2->buffer()));
 
   // Make sure they are the same.
   EXPECT_EQ(dhe1.public_key_.len(), dhe2.public_key_.len());
@@ -356,26 +352,24 @@ TEST_P(TlsConnectGenericPre13, ConnectEcdheTwiceReuseKey) {
 // This test parses the ServerKeyExchange, which isn't in 1.3
 TEST_P(TlsConnectGenericPre13, ConnectEcdheTwiceNewKey) {
   server_->SetOption(SSL_REUSE_SERVER_ECDHE_KEY, PR_FALSE);
-  auto i1 = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeServerKeyExchange);
-  server_->SetPacketFilter(i1);
+  auto filter = MakeTlsFilter<TlsHandshakeRecorder>(
+      server_, kTlsHandshakeServerKeyExchange);
   Connect();
   CheckKeys();
   TlsServerKeyExchangeEcdhe dhe1;
-  EXPECT_TRUE(dhe1.Parse(i1->buffer()));
+  EXPECT_TRUE(dhe1.Parse(filter->buffer()));
 
   // Restart
   Reset();
   server_->SetOption(SSL_REUSE_SERVER_ECDHE_KEY, PR_FALSE);
-  auto i2 = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeServerKeyExchange);
-  server_->SetPacketFilter(i2);
+  auto filter2 = MakeTlsFilter<TlsHandshakeRecorder>(
+      server_, kTlsHandshakeServerKeyExchange);
   ConfigureSessionCache(RESUME_NONE, RESUME_NONE);
   Connect();
   CheckKeys();
 
   TlsServerKeyExchangeEcdhe dhe2;
-  EXPECT_TRUE(dhe2.Parse(i2->buffer()));
+  EXPECT_TRUE(dhe2.Parse(filter2->buffer()));
 
   // Make sure they are different.
   EXPECT_FALSE((dhe1.public_key_.len() == dhe2.public_key_.len()) &&
@@ -397,7 +391,7 @@ TEST_P(TlsConnectTls13, TestTls13ResumeDifferentGroup) {
   server_->ConfigNamedGroups(kFFDHEGroups);
   Connect();
   CheckKeys(ssl_kea_dh, ssl_grp_ffdhe_2048, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
 }
 
 // We need to enable different cipher suites at different times in the following
@@ -417,7 +411,7 @@ static uint16_t ChooseAnotherCipher(uint16_t version) {
 }
 
 // Test that we don't resume when we can't negotiate the same cipher.
-TEST_P(TlsConnectGeneric, TestResumeClientDifferentCipher) {
+TEST_P(TlsConnectGenericResumption, TestResumeClientDifferentCipher) {
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   client_->EnableSingleCipher(ChooseOneCipher(version_));
   Connect();
@@ -434,15 +428,15 @@ TEST_P(TlsConnectGeneric, TestResumeClientDifferentCipher) {
   } else {
     ticket_extension = ssl_session_ticket_xtn;
   }
-  auto ticket_capture = std::make_shared<TlsExtensionCapture>(ticket_extension);
-  client_->SetPacketFilter(ticket_capture);
+  auto ticket_capture =
+      MakeTlsFilter<TlsExtensionCapture>(client_, ticket_extension);
   Connect();
   CheckKeys(ssl_kea_ecdh, ssl_auth_rsa_sign);
   EXPECT_EQ(0U, ticket_capture->extension().len());
 }
 
 // Test that we don't resume when we can't negotiate the same cipher.
-TEST_P(TlsConnectGeneric, TestResumeServerDifferentCipher) {
+TEST_P(TlsConnectGenericResumption, TestResumeServerDifferentCipher) {
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   server_->EnableSingleCipher(ChooseOneCipher(version_));
   Connect();
@@ -468,8 +462,8 @@ TEST_P(TlsConnectStream, TestResumptionOverrideCipher) {
 
   Reset();
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
-  server_->SetPacketFilter(std::make_shared<SelectedCipherSuiteReplacer>(
-      ChooseAnotherCipher(version_)));
+  MakeTlsFilter<SelectedCipherSuiteReplacer>(server_,
+                                             ChooseAnotherCipher(version_));
 
   if (version_ >= SSL_LIBRARY_VERSION_TLS_1_3) {
     client_->ExpectSendAlert(kTlsAlertIllegalParameter);
@@ -490,8 +484,10 @@ TEST_P(TlsConnectStream, TestResumptionOverrideCipher) {
 
 class SelectedVersionReplacer : public TlsHandshakeFilter {
  public:
-  SelectedVersionReplacer(uint16_t version)
-      : TlsHandshakeFilter({kTlsHandshakeServerHello}), version_(version) {}
+  SelectedVersionReplacer(const std::shared_ptr<TlsAgent>& agent,
+                          uint16_t version)
+      : TlsHandshakeFilter(agent, {kTlsHandshakeServerHello}),
+        version_(version) {}
 
  protected:
   PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
@@ -543,8 +539,7 @@ TEST_P(TlsConnectGenericPre13, TestResumptionOverrideVersion) {
   // Enable the lower version on the client.
   client_->SetVersionRange(version_ - 1, version_);
   server_->EnableSingleCipher(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA);
-  server_->SetPacketFilter(
-      std::make_shared<SelectedVersionReplacer>(override_version));
+  MakeTlsFilter<SelectedVersionReplacer>(server_, override_version);
 
   ConnectExpectAlert(client_, kTlsAlertHandshakeFailure);
   client_->CheckErrorCode(SSL_ERROR_RX_MALFORMED_SERVER_HELLO);
@@ -567,12 +562,12 @@ TEST_F(TlsConnectTest, TestTls13ResumptionTwice) {
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
   ExpectResumption(RESUME_TICKET);
-  auto c1 = std::make_shared<TlsExtensionCapture>(ssl_tls13_pre_shared_key_xtn);
-  client_->SetPacketFilter(c1);
+  auto c1 =
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_tls13_pre_shared_key_xtn);
   Connect();
   SendReceive();
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   // The filter will go away when we reset, so save the captured extension.
   DataBuffer initialTicket(c1->extension());
   ASSERT_LT(0U, initialTicket.len());
@@ -584,13 +579,13 @@ TEST_F(TlsConnectTest, TestTls13ResumptionTwice) {
   ClearStats();
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
-  auto c2 = std::make_shared<TlsExtensionCapture>(ssl_tls13_pre_shared_key_xtn);
-  client_->SetPacketFilter(c2);
+  auto c2 =
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_tls13_pre_shared_key_xtn);
   ExpectResumption(RESUME_TICKET);
   Connect();
   SendReceive();
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   ASSERT_LT(0U, c2->extension().len());
 
   ScopedCERTCertificate cert2(SSL_PeerCertificate(client_->ssl_fd()));
@@ -656,9 +651,9 @@ TEST_F(TlsConnectTest, TestTls13ResumptionDuplicateNSTWithToken) {
   ConfigureSessionCache(RESUME_BOTH, RESUME_TICKET);
   ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_3);
 
-  auto nst_capture = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      ssl_hs_new_session_ticket);
-  server_->SetTlsRecordFilter(nst_capture);
+  auto nst_capture =
+      MakeTlsFilter<TlsHandshakeRecorder>(server_, ssl_hs_new_session_ticket);
+  nst_capture->EnableDecryption();
   Connect();
 
   // Clear the session ticket keys to invalidate the old ticket.
@@ -679,8 +674,7 @@ TEST_F(TlsConnectTest, TestTls13ResumptionDuplicateNSTWithToken) {
   ExpectResumption(RESUME_TICKET);
 
   auto psk_capture =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_pre_shared_key_xtn);
-  client_->SetPacketFilter(psk_capture);
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_tls13_pre_shared_key_xtn);
   Connect();
   SendReceive();
 
@@ -696,9 +690,9 @@ TEST_F(TlsConnectTest, SendSessionTicketWithTicketsDisabled) {
   EXPECT_EQ(SECSuccess, SSL_OptionSet(server_->ssl_fd(),
                                       SSL_ENABLE_SESSION_TICKETS, PR_FALSE));
 
-  auto nst_capture = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      ssl_hs_new_session_ticket);
-  server_->SetTlsRecordFilter(nst_capture);
+  auto nst_capture =
+      MakeTlsFilter<TlsHandshakeRecorder>(server_, ssl_hs_new_session_ticket);
+  nst_capture->EnableDecryption();
   Connect();
 
   EXPECT_EQ(0U, nst_capture->buffer().len()) << "expect nothing captured yet";
@@ -715,8 +709,7 @@ TEST_F(TlsConnectTest, SendSessionTicketWithTicketsDisabled) {
   ExpectResumption(RESUME_TICKET);
 
   auto psk_capture =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_pre_shared_key_xtn);
-  client_->SetPacketFilter(psk_capture);
+      MakeTlsFilter<TlsExtensionCapture>(client_, ssl_tls13_pre_shared_key_xtn);
   Connect();
   SendReceive();
 
@@ -819,20 +812,20 @@ TEST_F(TlsConnectTest, TestTls13ResumptionForcedDowngrade) {
   // We will eventually fail the (sid.version == SH.version) check.
   std::vector<std::shared_ptr<PacketFilter>> filters;
   filters.push_back(std::make_shared<SelectedCipherSuiteReplacer>(
-      TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256));
-  filters.push_back(
-      std::make_shared<SelectedVersionReplacer>(SSL_LIBRARY_VERSION_TLS_1_2));
+      server_, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256));
+  filters.push_back(std::make_shared<SelectedVersionReplacer>(
+      server_, SSL_LIBRARY_VERSION_TLS_1_2));
 
   // Drop a bunch of extensions so that we get past the SH processing.  The
   // version extension says TLS 1.3, which is counter to our goal, the others
   // are not permitted in TLS 1.2 handshakes.
+  filters.push_back(std::make_shared<TlsExtensionDropper>(
+      server_, ssl_tls13_supported_versions_xtn));
   filters.push_back(
-      std::make_shared<TlsExtensionDropper>(ssl_tls13_supported_versions_xtn));
-  filters.push_back(
-      std::make_shared<TlsExtensionDropper>(ssl_tls13_key_share_xtn));
-  filters.push_back(
-      std::make_shared<TlsExtensionDropper>(ssl_tls13_pre_shared_key_xtn));
-  server_->SetPacketFilter(std::make_shared<ChainedPacketFilter>(filters));
+      std::make_shared<TlsExtensionDropper>(server_, ssl_tls13_key_share_xtn));
+  filters.push_back(std::make_shared<TlsExtensionDropper>(
+      server_, ssl_tls13_pre_shared_key_xtn));
+  server_->SetFilter(std::make_shared<ChainedPacketFilter>(filters));
 
   // The client here generates an unexpected_message alert when it receives an
   // encrypted handshake message from the server (EncryptedExtension).  The
@@ -845,13 +838,13 @@ TEST_F(TlsConnectTest, TestTls13ResumptionForcedDowngrade) {
   server_->CheckErrorCode(SSL_ERROR_BAD_MAC_READ);
 }
 
-TEST_P(TlsConnectGeneric, ReConnectTicket) {
+TEST_P(TlsConnectGenericResumption, ReConnectTicket) {
   ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
   server_->EnableSingleCipher(ChooseOneCipher(version_));
   Connect();
   SendReceive();
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   // Resume
   Reset();
   ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
@@ -859,7 +852,7 @@ TEST_P(TlsConnectGeneric, ReConnectTicket) {
   Connect();
   // Only the client knows this.
   CheckKeysResumption(ssl_kea_ecdh, ssl_grp_none, ssl_grp_ec_curve25519,
-                      ssl_auth_rsa_sign, ssl_sig_rsa_pss_sha256);
+                      ssl_auth_rsa_sign, ssl_sig_rsa_pss_rsae_sha256);
 }
 
 TEST_P(TlsConnectGenericPre13, ReConnectCache) {
@@ -868,22 +861,22 @@ TEST_P(TlsConnectGenericPre13, ReConnectCache) {
   Connect();
   SendReceive();
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   // Resume
   Reset();
   ExpectResumption(RESUME_SESSIONID);
   Connect();
   CheckKeysResumption(ssl_kea_ecdh, ssl_grp_none, ssl_grp_ec_curve25519,
-                      ssl_auth_rsa_sign, ssl_sig_rsa_pss_sha256);
+                      ssl_auth_rsa_sign, ssl_sig_rsa_pss_rsae_sha256);
 }
 
-TEST_P(TlsConnectGeneric, ReConnectAgainTicket) {
+TEST_P(TlsConnectGenericResumption, ReConnectAgainTicket) {
   ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
   server_->EnableSingleCipher(ChooseOneCipher(version_));
   Connect();
   SendReceive();
   CheckKeys(ssl_kea_ecdh, ssl_grp_ec_curve25519, ssl_auth_rsa_sign,
-            ssl_sig_rsa_pss_sha256);
+            ssl_sig_rsa_pss_rsae_sha256);
   // Resume
   Reset();
   ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
@@ -891,7 +884,7 @@ TEST_P(TlsConnectGeneric, ReConnectAgainTicket) {
   Connect();
   // Only the client knows this.
   CheckKeysResumption(ssl_kea_ecdh, ssl_grp_none, ssl_grp_ec_curve25519,
-                      ssl_auth_rsa_sign, ssl_sig_rsa_pss_sha256);
+                      ssl_auth_rsa_sign, ssl_sig_rsa_pss_rsae_sha256);
   // Resume connection again
   Reset();
   ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
@@ -899,7 +892,140 @@ TEST_P(TlsConnectGeneric, ReConnectAgainTicket) {
   Connect();
   // Only the client knows this.
   CheckKeysResumption(ssl_kea_ecdh, ssl_grp_none, ssl_grp_ec_curve25519,
-                      ssl_auth_rsa_sign, ssl_sig_rsa_pss_sha256);
+                      ssl_auth_rsa_sign, ssl_sig_rsa_pss_rsae_sha256);
+}
+
+void CheckGetInfoResult(uint32_t alpnSize, uint32_t earlyDataSize,
+                        ScopedCERTCertificate& cert,
+                        ScopedSSLResumptionTokenInfo& token) {
+  ASSERT_TRUE(cert);
+  ASSERT_TRUE(token->peerCert);
+
+  // Check that the server cert is the correct one.
+  ASSERT_EQ(cert->derCert.len, token->peerCert->derCert.len);
+  EXPECT_EQ(0, memcmp(cert->derCert.data, token->peerCert->derCert.data,
+                      cert->derCert.len));
+
+  ASSERT_EQ(alpnSize, token->alpnSelectionLen);
+  EXPECT_EQ(0, memcmp("a", token->alpnSelection, token->alpnSelectionLen));
+
+  ASSERT_EQ(earlyDataSize, token->maxEarlyDataSize);
+}
+
+TEST_P(TlsConnectGenericResumptionToken, ConnectResumeGetInfo) {
+  ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
+  Connect();
+  SendReceive();
+
+  Reset();
+  ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
+  ExpectResumption(RESUME_TICKET);
+
+  StartConnect();
+  ASSERT_TRUE(client_->MaybeSetResumptionToken());
+
+  // Get resumption token infos
+  SSLResumptionTokenInfo tokenInfo = {0};
+  ScopedSSLResumptionTokenInfo token(&tokenInfo);
+  client_->GetTokenInfo(token);
+  ScopedCERTCertificate cert(
+      PK11_FindCertFromNickname(server_->name().c_str(), nullptr));
+
+  CheckGetInfoResult(0, 0, cert, token);
+
+  Handshake();
+  CheckConnected();
+
+  SendReceive();
+}
+
+TEST_P(TlsConnectGenericResumptionToken, ConnectResumeGetInfoAlpn) {
+  EnableAlpn();
+  ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
+  Connect();
+  CheckAlpn("a");
+  SendReceive();
+
+  Reset();
+  EnableAlpn();
+  ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
+  ExpectResumption(RESUME_TICKET);
+
+  StartConnect();
+  ASSERT_TRUE(client_->MaybeSetResumptionToken());
+
+  // Get resumption token infos
+  SSLResumptionTokenInfo tokenInfo = {0};
+  ScopedSSLResumptionTokenInfo token(&tokenInfo);
+  client_->GetTokenInfo(token);
+  ScopedCERTCertificate cert(
+      PK11_FindCertFromNickname(server_->name().c_str(), nullptr));
+
+  CheckGetInfoResult(1, 0, cert, token);
+
+  Handshake();
+  CheckConnected();
+  CheckAlpn("a");
+
+  SendReceive();
+}
+
+TEST_P(TlsConnectTls13ResumptionToken, ConnectResumeGetInfoZeroRtt) {
+  EnableAlpn();
+  SSLInt_RolloverAntiReplay();
+  ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
+  server_->Set0RttEnabled(true);
+  Connect();
+  CheckAlpn("a");
+  SendReceive();
+
+  Reset();
+  EnableAlpn();
+  ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
+  ExpectResumption(RESUME_TICKET);
+
+  StartConnect();
+  server_->Set0RttEnabled(true);
+  client_->Set0RttEnabled(true);
+  ASSERT_TRUE(client_->MaybeSetResumptionToken());
+
+  // Get resumption token infos
+  SSLResumptionTokenInfo tokenInfo = {0};
+  ScopedSSLResumptionTokenInfo token(&tokenInfo);
+  client_->GetTokenInfo(token);
+  ScopedCERTCertificate cert(
+      PK11_FindCertFromNickname(server_->name().c_str(), nullptr));
+
+  CheckGetInfoResult(1, 1024, cert, token);
+
+  ZeroRttSendReceive(true, true);
+  Handshake();
+  ExpectEarlyDataAccepted(true);
+  CheckConnected();
+  CheckAlpn("a");
+
+  SendReceive();
+}
+
+// Resumption on sessions with client authentication only works with internal
+// caching.
+TEST_P(TlsConnectGenericResumption, ConnectResumeClientAuth) {
+  ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
+  client_->SetupClientAuth();
+  server_->RequestClientAuth(true);
+  Connect();
+  SendReceive();
+  EXPECT_FALSE(client_->resumption_callback_called());
+
+  Reset();
+  ConfigureSessionCache(RESUME_BOTH, RESUME_BOTH);
+  if (use_external_cache()) {
+    ExpectResumption(RESUME_NONE);
+  } else {
+    ExpectResumption(RESUME_TICKET);
+  }
+  Connect();
+  SendReceive();
 }
 
 }  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/ssl_skip_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_skip_unittest.cc
index 335bfecfa5..e4a9e5aed7 100644
--- a/security/nss/gtests/ssl_gtest/ssl_skip_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_skip_unittest.cc
@@ -22,8 +22,11 @@ namespace nss_test {
 class TlsHandshakeSkipFilter : public TlsRecordFilter {
  public:
   // A TLS record filter that skips handshake messages of the identified type.
-  TlsHandshakeSkipFilter(uint8_t handshake_type)
-      : handshake_type_(handshake_type), skipped_(false) {}
+  TlsHandshakeSkipFilter(const std::shared_ptr<TlsAgent>& agent,
+                         uint8_t handshake_type)
+      : TlsRecordFilter(agent),
+        handshake_type_(handshake_type),
+        skipped_(false) {}
 
  protected:
   // Takes a record; if it is a handshake record, it removes the first handshake
@@ -92,9 +95,14 @@ class TlsSkipTest : public TlsConnectTestBase,
   TlsSkipTest()
       : TlsConnectTestBase(std::get<0>(GetParam()), std::get<1>(GetParam())) {}
 
+  void SetUp() override {
+    TlsConnectTestBase::SetUp();
+    EnsureTlsSetup();
+  }
+
   void ServerSkipTest(std::shared_ptr<PacketFilter> filter,
                       uint8_t alert = kTlsAlertUnexpectedMessage) {
-    server_->SetPacketFilter(filter);
+    server_->SetFilter(filter);
     ConnectExpectAlert(client_, alert);
   }
 };
@@ -105,9 +113,14 @@ class Tls13SkipTest : public TlsConnectTestBase,
   Tls13SkipTest()
       : TlsConnectTestBase(GetParam(), SSL_LIBRARY_VERSION_TLS_1_3) {}
 
-  void ServerSkipTest(std::shared_ptr<TlsRecordFilter> filter, int32_t error) {
+  void SetUp() override {
+    TlsConnectTestBase::SetUp();
     EnsureTlsSetup();
-    server_->SetTlsRecordFilter(filter);
+  }
+
+  void ServerSkipTest(std::shared_ptr<TlsRecordFilter> filter, int32_t error) {
+    filter->EnableDecryption();
+    server_->SetFilter(filter);
     ExpectAlert(client_, kTlsAlertUnexpectedMessage);
     ConnectExpectFail();
     client_->CheckErrorCode(error);
@@ -115,8 +128,8 @@ class Tls13SkipTest : public TlsConnectTestBase,
   }
 
   void ClientSkipTest(std::shared_ptr<TlsRecordFilter> filter, int32_t error) {
-    EnsureTlsSetup();
-    client_->SetTlsRecordFilter(filter);
+    filter->EnableDecryption();
+    client_->SetFilter(filter);
     server_->ExpectSendAlert(kTlsAlertUnexpectedMessage);
     ConnectExpectFailOneSide(TlsAgent::SERVER);
 
@@ -129,48 +142,49 @@ class Tls13SkipTest : public TlsConnectTestBase,
 
 TEST_P(TlsSkipTest, SkipCertificateRsa) {
   EnableOnlyStaticRsaCiphers();
-  ServerSkipTest(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeCertificate));
+  ServerSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
+      server_, kTlsHandshakeCertificate));
   client_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);
 }
 
 TEST_P(TlsSkipTest, SkipCertificateDhe) {
-  ServerSkipTest(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeCertificate));
+  ServerSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
+      server_, kTlsHandshakeCertificate));
   client_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH);
 }
 
 TEST_P(TlsSkipTest, SkipCertificateEcdhe) {
-  ServerSkipTest(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeCertificate));
+  ServerSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
+      server_, kTlsHandshakeCertificate));
   client_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH);
 }
 
 TEST_P(TlsSkipTest, SkipCertificateEcdsa) {
   Reset(TlsAgent::kServerEcdsa256);
-  ServerSkipTest(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeCertificate));
+  ServerSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
+      server_, kTlsHandshakeCertificate));
   client_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_SERVER_KEY_EXCH);
 }
 
 TEST_P(TlsSkipTest, SkipServerKeyExchange) {
-  ServerSkipTest(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeServerKeyExchange));
+  ServerSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
+      server_, kTlsHandshakeServerKeyExchange));
   client_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);
 }
 
 TEST_P(TlsSkipTest, SkipServerKeyExchangeEcdsa) {
   Reset(TlsAgent::kServerEcdsa256);
-  ServerSkipTest(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeServerKeyExchange));
+  ServerSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
+      server_, kTlsHandshakeServerKeyExchange));
   client_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);
 }
 
 TEST_P(TlsSkipTest, SkipCertAndKeyExch) {
-  auto chain = std::make_shared<ChainedPacketFilter>(ChainedPacketFilterInit{
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeCertificate),
-      std::make_shared<TlsHandshakeSkipFilter>(
-          kTlsHandshakeServerKeyExchange)});
+  auto chain = std::make_shared<ChainedPacketFilter>(
+      ChainedPacketFilterInit{std::make_shared<TlsHandshakeSkipFilter>(
+                                  server_, kTlsHandshakeCertificate),
+                              std::make_shared<TlsHandshakeSkipFilter>(
+                                  server_, kTlsHandshakeServerKeyExchange)});
   ServerSkipTest(chain);
   client_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);
 }
@@ -178,48 +192,48 @@ TEST_P(TlsSkipTest, SkipCertAndKeyExch) {
 TEST_P(TlsSkipTest, SkipCertAndKeyExchEcdsa) {
   Reset(TlsAgent::kServerEcdsa256);
   auto chain = std::make_shared<ChainedPacketFilter>();
-  chain->Add(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeCertificate));
-  chain->Add(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeServerKeyExchange));
+  chain->Add(std::make_shared<TlsHandshakeSkipFilter>(
+      server_, kTlsHandshakeCertificate));
+  chain->Add(std::make_shared<TlsHandshakeSkipFilter>(
+      server_, kTlsHandshakeServerKeyExchange));
   ServerSkipTest(chain);
   client_->CheckErrorCode(SSL_ERROR_RX_UNEXPECTED_HELLO_DONE);
 }
 
 TEST_P(Tls13SkipTest, SkipEncryptedExtensions) {
   ServerSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
-                     kTlsHandshakeEncryptedExtensions),
+                     server_, kTlsHandshakeEncryptedExtensions),
                  SSL_ERROR_RX_UNEXPECTED_CERTIFICATE);
 }
 
 TEST_P(Tls13SkipTest, SkipServerCertificate) {
-  ServerSkipTest(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeCertificate),
-      SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY);
+  ServerSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
+                     server_, kTlsHandshakeCertificate),
+                 SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY);
 }
 
 TEST_P(Tls13SkipTest, SkipServerCertificateVerify) {
-  ServerSkipTest(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeCertificateVerify),
-      SSL_ERROR_RX_UNEXPECTED_FINISHED);
+  ServerSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
+                     server_, kTlsHandshakeCertificateVerify),
+                 SSL_ERROR_RX_UNEXPECTED_FINISHED);
 }
 
 TEST_P(Tls13SkipTest, SkipClientCertificate) {
   client_->SetupClientAuth();
   server_->RequestClientAuth(true);
   client_->ExpectReceiveAlert(kTlsAlertUnexpectedMessage);
-  ClientSkipTest(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeCertificate),
-      SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY);
+  ClientSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
+                     client_, kTlsHandshakeCertificate),
+                 SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY);
 }
 
 TEST_P(Tls13SkipTest, SkipClientCertificateVerify) {
   client_->SetupClientAuth();
   server_->RequestClientAuth(true);
   client_->ExpectReceiveAlert(kTlsAlertUnexpectedMessage);
-  ClientSkipTest(
-      std::make_shared<TlsHandshakeSkipFilter>(kTlsHandshakeCertificateVerify),
-      SSL_ERROR_RX_UNEXPECTED_FINISHED);
+  ClientSkipTest(std::make_shared<TlsHandshakeSkipFilter>(
+                     client_, kTlsHandshakeCertificateVerify),
+                 SSL_ERROR_RX_UNEXPECTED_FINISHED);
 }
 
 INSTANTIATE_TEST_CASE_P(
diff --git a/security/nss/gtests/ssl_gtest/ssl_staticrsa_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_staticrsa_unittest.cc
index e7fe44d92f..e5fccc12b6 100644
--- a/security/nss/gtests/ssl_gtest/ssl_staticrsa_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_staticrsa_unittest.cc
@@ -48,10 +48,9 @@ TEST_P(TlsConnectGenericPre13, ConnectStaticRSA) {
 // This test is stream so we can catch the bad_record_mac alert.
 TEST_P(TlsConnectStreamPre13, ConnectStaticRSABogusCKE) {
   EnableOnlyStaticRsaCiphers();
-  auto i1 = std::make_shared<TlsInspectorReplaceHandshakeMessage>(
-      kTlsHandshakeClientKeyExchange,
+  MakeTlsFilter<TlsInspectorReplaceHandshakeMessage>(
+      client_, kTlsHandshakeClientKeyExchange,
       DataBuffer(kBogusClientKeyExchange, sizeof(kBogusClientKeyExchange)));
-  client_->SetPacketFilter(i1);
   ConnectExpectAlert(server_, kTlsAlertBadRecordMac);
 }
 
@@ -59,8 +58,7 @@ TEST_P(TlsConnectStreamPre13, ConnectStaticRSABogusCKE) {
 // This test is stream so we can catch the bad_record_mac alert.
 TEST_P(TlsConnectStreamPre13, ConnectStaticRSABogusPMSVersionDetect) {
   EnableOnlyStaticRsaCiphers();
-  client_->SetPacketFilter(
-      std::make_shared<TlsInspectorClientHelloVersionChanger>(server_));
+  MakeTlsFilter<TlsClientHelloVersionChanger>(client_, server_);
   ConnectExpectAlert(server_, kTlsAlertBadRecordMac);
 }
 
@@ -69,8 +67,7 @@ TEST_P(TlsConnectStreamPre13, ConnectStaticRSABogusPMSVersionDetect) {
 // ConnectStaticRSABogusPMSVersionDetect.
 TEST_P(TlsConnectGenericPre13, ConnectStaticRSABogusPMSVersionIgnore) {
   EnableOnlyStaticRsaCiphers();
-  client_->SetPacketFilter(
-      std::make_shared<TlsInspectorClientHelloVersionChanger>(server_));
+  MakeTlsFilter<TlsClientHelloVersionChanger>(client_, server_);
   server_->SetOption(SSL_ROLLBACK_DETECTION, PR_FALSE);
   Connect();
 }
@@ -79,10 +76,9 @@ TEST_P(TlsConnectGenericPre13, ConnectStaticRSABogusPMSVersionIgnore) {
 TEST_P(TlsConnectStreamPre13, ConnectExtendedMasterSecretStaticRSABogusCKE) {
   EnableOnlyStaticRsaCiphers();
   EnableExtendedMasterSecret();
-  auto inspect = std::make_shared<TlsInspectorReplaceHandshakeMessage>(
-      kTlsHandshakeClientKeyExchange,
+  MakeTlsFilter<TlsInspectorReplaceHandshakeMessage>(
+      client_, kTlsHandshakeClientKeyExchange,
       DataBuffer(kBogusClientKeyExchange, sizeof(kBogusClientKeyExchange)));
-  client_->SetPacketFilter(inspect);
   ConnectExpectAlert(server_, kTlsAlertBadRecordMac);
 }
 
@@ -91,8 +87,7 @@ TEST_P(TlsConnectStreamPre13,
        ConnectExtendedMasterSecretStaticRSABogusPMSVersionDetect) {
   EnableOnlyStaticRsaCiphers();
   EnableExtendedMasterSecret();
-  client_->SetPacketFilter(
-      std::make_shared<TlsInspectorClientHelloVersionChanger>(server_));
+  MakeTlsFilter<TlsClientHelloVersionChanger>(client_, server_);
   ConnectExpectAlert(server_, kTlsAlertBadRecordMac);
 }
 
@@ -100,10 +95,9 @@ TEST_P(TlsConnectStreamPre13,
        ConnectExtendedMasterSecretStaticRSABogusPMSVersionIgnore) {
   EnableOnlyStaticRsaCiphers();
   EnableExtendedMasterSecret();
-  client_->SetPacketFilter(
-      std::make_shared<TlsInspectorClientHelloVersionChanger>(server_));
+  MakeTlsFilter<TlsClientHelloVersionChanger>(client_, server_);
   server_->SetOption(SSL_ROLLBACK_DETECTION, PR_FALSE);
   Connect();
 }
 
-}  // namespace nspr_test
+}  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc
index 75cee52fc9..f5ccf096b8 100644
--- a/security/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc
@@ -67,10 +67,7 @@ class Tls13CompatTest : public TlsConnectStreamTls13 {
 
  private:
   struct Recorders {
-    Recorders()
-        : records_(new TlsRecordRecorder()),
-          hello_(new TlsInspectorRecordHandshakeMessage(std::set<uint8_t>(
-              {kTlsHandshakeClientHello, kTlsHandshakeServerHello}))) {}
+    Recorders() : records_(nullptr), hello_(nullptr) {}
 
     uint8_t session_id_length() const {
       // session_id is always after version (2) and random (32).
@@ -91,12 +88,22 @@ class Tls13CompatTest : public TlsConnectStreamTls13 {
     }
 
     void Install(std::shared_ptr<TlsAgent>& agent) {
-      agent->SetPacketFilter(std::make_shared<ChainedPacketFilter>(
+      if (records_ && records_->agent() == agent) {
+        // Avoid replacing the filters if they are already installed on this
+        // agent. This ensures that InstallFilters() can be used after
+        // MakeNewServer() without losing state on the client filters.
+        return;
+      }
+      records_.reset(new TlsRecordRecorder(agent));
+      hello_.reset(new TlsHandshakeRecorder(
+          agent, std::set<uint8_t>(
+                     {kTlsHandshakeClientHello, kTlsHandshakeServerHello})));
+      agent->SetFilter(std::make_shared<ChainedPacketFilter>(
           ChainedPacketFilterInit({records_, hello_})));
     }
 
     std::shared_ptr<TlsRecordRecorder> records_;
-    std::shared_ptr<TlsInspectorRecordHandshakeMessage> hello_;
+    std::shared_ptr<TlsHandshakeRecorder> hello_;
   };
 
   void CheckRecordsAreTls12(const std::string& agent,
@@ -171,16 +178,20 @@ TEST_F(Tls13CompatTest, EnabledStatelessHrr) {
   server_->StartConnect();
   client_->Handshake();
   server_->Handshake();
+
+  // The server should send CCS before HRR.
   CheckForCCS(false, true);
 
-  // A new server should just work, but not send another CCS.
+  // A new server should complete the handshake, and not send CCS.
   MakeNewServer();
   InstallFilters();
   server_->ConfigNamedGroups({ssl_grp_ec_secp384r1});
 
   Handshake();
   CheckConnected();
-  CheckForCompatHandshake();
+  CheckRecordVersions();
+  CheckHelloVersions();
+  CheckForCCS(true, false);
 }
 
 TEST_F(Tls13CompatTest, EnabledHrrZeroRtt) {
@@ -262,10 +273,8 @@ TEST_F(TlsConnectStreamTls13, ChangeCipherSpecBeforeClientHello12) {
 TEST_F(TlsConnectDatagram13, CompatModeDtlsClient) {
   EnsureTlsSetup();
   client_->SetOption(SSL_ENABLE_TLS13_COMPAT_MODE, PR_TRUE);
-  auto client_records = std::make_shared<TlsRecordRecorder>();
-  client_->SetPacketFilter(client_records);
-  auto server_records = std::make_shared<TlsRecordRecorder>();
-  server_->SetPacketFilter(server_records);
+  auto client_records = MakeTlsFilter<TlsRecordRecorder>(client_);
+  auto server_records = MakeTlsFilter<TlsRecordRecorder>(server_);
   Connect();
 
   ASSERT_EQ(2U, client_records->count());  // CH, Fin
@@ -283,7 +292,8 @@ TEST_F(TlsConnectDatagram13, CompatModeDtlsClient) {
 
 class AddSessionIdFilter : public TlsHandshakeFilter {
  public:
-  AddSessionIdFilter() : TlsHandshakeFilter({ssl_hs_client_hello}) {}
+  AddSessionIdFilter(const std::shared_ptr<TlsAgent>& client)
+      : TlsHandshakeFilter(client, {ssl_hs_client_hello}) {}
 
  protected:
   PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
@@ -303,14 +313,14 @@ class AddSessionIdFilter : public TlsHandshakeFilter {
 // mode.  It should be ignored instead.
 TEST_F(TlsConnectDatagram13, CompatModeDtlsServer) {
   EnsureTlsSetup();
-  auto client_records = std::make_shared<TlsRecordRecorder>();
-  client_->SetPacketFilter(
+  auto client_records = std::make_shared<TlsRecordRecorder>(client_);
+  client_->SetFilter(
       std::make_shared<ChainedPacketFilter>(ChainedPacketFilterInit(
-          {client_records, std::make_shared<AddSessionIdFilter>()})));
-  auto server_hello = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeServerHello);
-  auto server_records = std::make_shared<TlsRecordRecorder>();
-  server_->SetPacketFilter(std::make_shared<ChainedPacketFilter>(
+          {client_records, std::make_shared<AddSessionIdFilter>(client_)})));
+  auto server_hello =
+      std::make_shared<TlsHandshakeRecorder>(server_, kTlsHandshakeServerHello);
+  auto server_records = std::make_shared<TlsRecordRecorder>(server_);
+  server_->SetFilter(std::make_shared<ChainedPacketFilter>(
       ChainedPacketFilterInit({server_records, server_hello})));
   StartConnect();
   client_->Handshake();
@@ -334,4 +344,20 @@ TEST_F(TlsConnectDatagram13, CompatModeDtlsServer) {
   EXPECT_EQ(0U, session_id_len);
 }
 
-}  // nss_test
+TEST_F(Tls13CompatTest, ConnectWith12ThenAttemptToResume13CompatMode) {
+  ConfigureSessionCache(RESUME_SESSIONID, RESUME_SESSIONID);
+  ConfigureVersion(SSL_LIBRARY_VERSION_TLS_1_2);
+  Connect();
+
+  Reset();
+  ExpectResumption(RESUME_NONE);
+  version_ = SSL_LIBRARY_VERSION_TLS_1_3;
+  client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
+                           SSL_LIBRARY_VERSION_TLS_1_3);
+  server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
+                           SSL_LIBRARY_VERSION_TLS_1_3);
+  EnableCompatMode();
+  Connect();
+}
+
+}  // namespace nss_test
diff --git a/security/nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc
index 2f8ddd6fed..1005957322 100644
--- a/security/nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc
@@ -23,7 +23,8 @@ namespace nss_test {
 // Replaces the client hello with an SSLv2 version once.
 class SSLv2ClientHelloFilter : public PacketFilter {
  public:
-  SSLv2ClientHelloFilter(std::shared_ptr<TlsAgent>& client, uint16_t version)
+  SSLv2ClientHelloFilter(const std::shared_ptr<TlsAgent>& client,
+                         uint16_t version)
       : replaced_(false),
         client_(client),
         version_(version),
@@ -147,10 +148,9 @@ class SSLv2ClientHelloTestF : public TlsConnectTestBase {
   SSLv2ClientHelloTestF(SSLProtocolVariant variant, uint16_t version)
       : TlsConnectTestBase(variant, version), filter_(nullptr) {}
 
-  void SetUp() {
+  void SetUp() override {
     TlsConnectTestBase::SetUp();
-    filter_ = std::make_shared<SSLv2ClientHelloFilter>(client_, version_);
-    client_->SetPacketFilter(filter_);
+    filter_ = MakeTlsFilter<SSLv2ClientHelloFilter>(client_, version_);
   }
 
   void SetExpectedVersion(uint16_t version) {
diff --git a/security/nss/gtests/ssl_gtest/ssl_version_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_version_unittest.cc
index 9db293b07c..4e9099561f 100644
--- a/security/nss/gtests/ssl_gtest/ssl_version_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_version_unittest.cc
@@ -56,18 +56,15 @@ TEST_P(TlsConnectGeneric, ServerNegotiateTls12) {
 // two validate that we can also detect fallback using the
 // SSL_SetDowngradeCheckVersion() API.
 TEST_F(TlsConnectTest, TestDowngradeDetectionToTls11) {
-  client_->SetPacketFilter(
-      std::make_shared<TlsInspectorClientHelloVersionSetter>(
-          SSL_LIBRARY_VERSION_TLS_1_1));
+  MakeTlsFilter<TlsClientHelloVersionSetter>(client_,
+                                             SSL_LIBRARY_VERSION_TLS_1_1);
   ConnectExpectFail();
   ASSERT_EQ(SSL_ERROR_RX_MALFORMED_SERVER_HELLO, client_->error_code());
 }
 
 /* Attempt to negotiate the bogus DTLS 1.1 version. */
 TEST_F(DtlsConnectTest, TestDtlsVersion11) {
-  client_->SetPacketFilter(
-      std::make_shared<TlsInspectorClientHelloVersionSetter>(
-          ((~0x0101) & 0xffff)));
+  MakeTlsFilter<TlsClientHelloVersionSetter>(client_, ((~0x0101) & 0xffff));
   ConnectExpectFail();
   // It's kind of surprising that SSL_ERROR_NO_CYPHER_OVERLAP is
   // what is returned here, but this is deliberate in ssl3_HandleAlert().
@@ -78,9 +75,8 @@ TEST_F(DtlsConnectTest, TestDtlsVersion11) {
 // Disabled as long as we have draft version.
 TEST_F(TlsConnectTest, TestDowngradeDetectionToTls12) {
   EnsureTlsSetup();
-  client_->SetPacketFilter(
-      std::make_shared<TlsInspectorClientHelloVersionSetter>(
-          SSL_LIBRARY_VERSION_TLS_1_2));
+  MakeTlsFilter<TlsClientHelloVersionSetter>(client_,
+                                             SSL_LIBRARY_VERSION_TLS_1_2);
   client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
                            SSL_LIBRARY_VERSION_TLS_1_3);
   server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
@@ -92,9 +88,8 @@ TEST_F(TlsConnectTest, TestDowngradeDetectionToTls12) {
 // TLS 1.1 clients do not check the random values, so we should
 // instead get a handshake failure alert from the server.
 TEST_F(TlsConnectTest, TestDowngradeDetectionToTls10) {
-  client_->SetPacketFilter(
-      std::make_shared<TlsInspectorClientHelloVersionSetter>(
-          SSL_LIBRARY_VERSION_TLS_1_0));
+  MakeTlsFilter<TlsClientHelloVersionSetter>(client_,
+                                             SSL_LIBRARY_VERSION_TLS_1_0);
   client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_0,
                            SSL_LIBRARY_VERSION_TLS_1_1);
   server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_0,
@@ -177,12 +172,10 @@ class Tls13NoSupportedVersions : public TlsConnectStreamTls12 {
     client_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2,
                              SSL_LIBRARY_VERSION_TLS_1_2);
     server_->SetVersionRange(SSL_LIBRARY_VERSION_TLS_1_2, max_server_version);
-    client_->SetPacketFilter(
-        std::make_shared<TlsInspectorClientHelloVersionSetter>(
-            overwritten_client_version));
-    auto capture = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-        kTlsHandshakeServerHello);
-    server_->SetPacketFilter(capture);
+    MakeTlsFilter<TlsClientHelloVersionSetter>(client_,
+                                               overwritten_client_version);
+    auto capture =
+        MakeTlsFilter<TlsHandshakeRecorder>(server_, kTlsHandshakeServerHello);
     ConnectExpectAlert(server_, kTlsAlertDecryptError);
     client_->CheckErrorCode(SSL_ERROR_DECRYPT_ERROR_ALERT);
     server_->CheckErrorCode(SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE);
@@ -214,12 +207,10 @@ TEST_F(Tls13NoSupportedVersions,
 // Offer 1.3 but with ClientHello.legacy_version == TLS 1.4. This
 // causes a bad MAC error when we read EncryptedExtensions.
 TEST_F(TlsConnectStreamTls13, Tls14ClientHelloWithSupportedVersions) {
-  client_->SetPacketFilter(
-      std::make_shared<TlsInspectorClientHelloVersionSetter>(
-          SSL_LIBRARY_VERSION_TLS_1_3 + 1));
-  auto capture =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_supported_versions_xtn);
-  server_->SetPacketFilter(capture);
+  MakeTlsFilter<TlsClientHelloVersionSetter>(client_,
+                                             SSL_LIBRARY_VERSION_TLS_1_3 + 1);
+  auto capture = MakeTlsFilter<TlsExtensionCapture>(
+      server_, ssl_tls13_supported_versions_xtn);
   client_->ExpectSendAlert(kTlsAlertBadRecordMac);
   server_->ExpectSendAlert(kTlsAlertBadRecordMac);
   ConnectExpectFail();
diff --git a/security/nss/gtests/ssl_gtest/ssl_versionpolicy_unittest.cc b/security/nss/gtests/ssl_gtest/ssl_versionpolicy_unittest.cc
index eda96831c7..7f3c4a8964 100644
--- a/security/nss/gtests/ssl_gtest/ssl_versionpolicy_unittest.cc
+++ b/security/nss/gtests/ssl_gtest/ssl_versionpolicy_unittest.cc
@@ -189,12 +189,12 @@ class TestPolicyVersionRange
     }
   }
 
-  void SetUp() {
-    SetPolicy(policy_.range());
+  void SetUp() override {
     TlsConnectTestBase::SetUp();
+    SetPolicy(policy_.range());
   }
 
-  void TearDown() {
+  void TearDown() override {
     TlsConnectTestBase::TearDown();
     saved_version_policy_.RestoreOriginalPolicy();
   }
diff --git a/security/nss/gtests/ssl_gtest/test_io.cc b/security/nss/gtests/ssl_gtest/test_io.cc
index adcdbfbafb..7282178515 100644
--- a/security/nss/gtests/ssl_gtest/test_io.cc
+++ b/security/nss/gtests/ssl_gtest/test_io.cc
@@ -25,10 +25,6 @@ namespace nss_test {
     if (g_ssl_gtest_verbose) LOG(a); \
   } while (false)
 
-void DummyPrSocket::SetPacketFilter(std::shared_ptr<PacketFilter> filter) {
-  filter_ = filter;
-}
-
 ScopedPRFileDesc DummyPrSocket::CreateFD() {
   static PRDescIdentity test_fd_identity =
       PR_GetUniqueIdentity("testtransportadapter");
diff --git a/security/nss/gtests/ssl_gtest/test_io.h b/security/nss/gtests/ssl_gtest/test_io.h
index 469d90a7c8..dbeb6b9d4c 100644
--- a/security/nss/gtests/ssl_gtest/test_io.h
+++ b/security/nss/gtests/ssl_gtest/test_io.h
@@ -74,7 +74,9 @@ class DummyPrSocket : public DummyIOLayerMethods {
 
   std::weak_ptr<DummyPrSocket>& peer() { return peer_; }
   void SetPeer(const std::shared_ptr<DummyPrSocket>& peer) { peer_ = peer; }
-  void SetPacketFilter(std::shared_ptr<PacketFilter> filter);
+  void SetPacketFilter(const std::shared_ptr<PacketFilter>& filter) {
+    filter_ = filter;
+  }
   // Drops peer, packet filter and any outstanding packets.
   void Reset();
 
@@ -176,6 +178,6 @@ class Poller {
       timers_;
 };
 
-}  // end of namespace
+}  // namespace nss_test
 
 #endif
diff --git a/security/nss/gtests/ssl_gtest/tls_agent.cc b/security/nss/gtests/ssl_gtest/tls_agent.cc
index 3b939bba86..2f71caedb0 100644
--- a/security/nss/gtests/ssl_gtest/tls_agent.cc
+++ b/security/nss/gtests/ssl_gtest/tls_agent.cc
@@ -12,6 +12,7 @@
 #include "sslerr.h"
 #include "sslexp.h"
 #include "sslproto.h"
+#include "tls_filter.h"
 #include "tls_parser.h"
 
 extern "C" {
@@ -66,6 +67,7 @@ TlsAgent::TlsAgent(const std::string& name, Role role,
       expected_sent_alert_(kTlsAlertCloseNotify),
       expected_sent_alert_level_(kTlsAlertWarning),
       handshake_callback_called_(false),
+      resumption_callback_called_(false),
       error_code_(0),
       send_ctr_(0),
       recv_ctr_(0),
@@ -73,7 +75,8 @@ TlsAgent::TlsAgent(const std::string& name, Role role,
       handshake_callback_(),
       auth_certificate_callback_(),
       sni_callback_(),
-      skip_version_checks_(false) {
+      skip_version_checks_(false),
+      resumption_token_() {
   memset(&info_, 0, sizeof(info_));
   memset(&csinfo_, 0, sizeof(csinfo_));
   SECStatus rv = SSL_VersionRangeGetDefault(variant_, &vrange_);
@@ -182,6 +185,10 @@ bool TlsAgent::EnsureTlsSetup(PRFileDesc* modelSocket) {
     ScopedCERTCertList anchors(CERT_NewCertList());
     rv = SSL_SetTrustAnchors(ssl_fd(), anchors.get());
     if (rv != SECSuccess) return false;
+
+    rv = SSL_SetMaxEarlyDataSize(ssl_fd(), 1024);
+    EXPECT_EQ(SECSuccess, rv);
+    if (rv != SECSuccess) return false;
   } else {
     rv = SSL_SetURL(ssl_fd(), "server");
     EXPECT_EQ(SECSuccess, rv);
@@ -207,6 +214,29 @@ bool TlsAgent::EnsureTlsSetup(PRFileDesc* modelSocket) {
   return true;
 }
 
+bool TlsAgent::MaybeSetResumptionToken() {
+  if (!resumption_token_.empty()) {
+    SECStatus rv = SSL_SetResumptionToken(ssl_fd(), resumption_token_.data(),
+                                          resumption_token_.size());
+
+    // rv is SECFailure with error set to SSL_ERROR_BAD_RESUMPTION_TOKEN_ERROR
+    // if the resumption token was bad (expired/malformed/etc.).
+    if (expect_resumption_) {
+      // Only in case we expect resumption this has to be successful. We might
+      // not expect resumption due to some reason but the token is totally fine.
+      EXPECT_EQ(SECSuccess, rv);
+    }
+    if (rv != SECSuccess) {
+      EXPECT_EQ(SSL_ERROR_BAD_RESUMPTION_TOKEN_ERROR, PORT_GetError());
+      resumption_token_.clear();
+      EXPECT_FALSE(expect_resumption_);
+      if (expect_resumption_) return false;
+    }
+  }
+
+  return true;
+}
+
 void TlsAgent::SetupClientAuth() {
   EXPECT_TRUE(EnsureTlsSetup());
   ASSERT_EQ(CLIENT, role_);
@@ -386,6 +416,27 @@ void TlsAgent::SetVersionRange(uint16_t minver, uint16_t maxver) {
   }
 }
 
+SECStatus ResumptionTokenCallback(PRFileDesc* fd,
+                                  const PRUint8* resumptionToken,
+                                  unsigned int len, void* ctx) {
+  EXPECT_NE(nullptr, resumptionToken);
+  if (!resumptionToken) {
+    return SECFailure;
+  }
+
+  std::vector<uint8_t> new_token(resumptionToken, resumptionToken + len);
+  reinterpret_cast<TlsAgent*>(ctx)->SetResumptionToken(new_token);
+  reinterpret_cast<TlsAgent*>(ctx)->SetResumptionCallbackCalled();
+  return SECSuccess;
+}
+
+void TlsAgent::SetResumptionTokenCallback() {
+  EXPECT_TRUE(EnsureTlsSetup());
+  SECStatus rv =
+      SSL_SetResumptionTokenCallback(ssl_fd(), ResumptionTokenCallback, this);
+  EXPECT_EQ(SECSuccess, rv);
+}
+
 void TlsAgent::GetVersionRange(uint16_t* minver, uint16_t* maxver) {
   *minver = vrange_.min;
   *maxver = vrange_.max;
diff --git a/security/nss/gtests/ssl_gtest/tls_agent.h b/security/nss/gtests/ssl_gtest/tls_agent.h
index b3fd892ae4..6cd6d5073b 100644
--- a/security/nss/gtests/ssl_gtest/tls_agent.h
+++ b/security/nss/gtests/ssl_gtest/tls_agent.h
@@ -14,7 +14,6 @@
 #include <iostream>
 
 #include "test_io.h"
-#include "tls_filter.h"
 
 #define GTEST_HAS_RTTI 0
 #include "gtest/gtest.h"
@@ -37,7 +36,10 @@ enum SessionResumptionMode {
   RESUME_BOTH = RESUME_SESSIONID | RESUME_TICKET
 };
 
+class PacketFilter;
 class TlsAgent;
+class TlsCipherSpec;
+struct TlsRecord;
 
 const extern std::vector<SSLNamedGroup> kAllDHEGroups;
 const extern std::vector<SSLNamedGroup> kECDHEGroups;
@@ -80,18 +82,10 @@ class TlsAgent : public PollTarget {
     adapter_->SetPeer(peer->adapter_);
   }
 
-  // Set a filter that can access plaintext (TLS 1.3 only).
-  void SetTlsRecordFilter(std::shared_ptr<TlsRecordFilter> filter) {
-    filter->SetAgent(this);
+  void SetFilter(std::shared_ptr<PacketFilter> filter) {
     adapter_->SetPacketFilter(filter);
-    filter->EnableDecryption();
   }
-
-  void SetPacketFilter(std::shared_ptr<PacketFilter> filter) {
-    adapter_->SetPacketFilter(filter);
-  }
-
-  void DeletePacketFilter() { adapter_->SetPacketFilter(nullptr); }
+  void ClearFilter() { adapter_->SetPacketFilter(nullptr); }
 
   void StartConnect(PRFileDesc* model = nullptr);
   void CheckKEA(SSLKEAType kea_type, SSLNamedGroup group,
@@ -165,6 +159,24 @@ class TlsAgent : public PollTarget {
   void DisableECDHEServerKeyReuse();
   bool GetPeerChainLength(size_t* count);
   void CheckCipherSuite(uint16_t cipher_suite);
+  void SetResumptionTokenCallback();
+  bool MaybeSetResumptionToken();
+  void SetResumptionToken(const std::vector<uint8_t>& resumption_token) {
+    resumption_token_ = resumption_token;
+  }
+  const std::vector<uint8_t>& GetResumptionToken() const {
+    return resumption_token_;
+  }
+  void GetTokenInfo(ScopedSSLResumptionTokenInfo& token) {
+    SECStatus rv = SSL_GetResumptionTokenInfo(
+        resumption_token_.data(), resumption_token_.size(), token.get(),
+        sizeof(SSLResumptionTokenInfo));
+    ASSERT_EQ(SECSuccess, rv);
+  }
+  void SetResumptionCallbackCalled() { resumption_callback_called_ = true; }
+  bool resumption_callback_called() const {
+    return resumption_callback_called_;
+  }
 
   const std::string& name() const { return name_; }
 
@@ -382,6 +394,7 @@ class TlsAgent : public PollTarget {
   uint8_t expected_sent_alert_;
   uint8_t expected_sent_alert_level_;
   bool handshake_callback_called_;
+  bool resumption_callback_called_;
   SSLChannelInfo info_;
   SSLCipherSuiteInfo csinfo_;
   SSLVersionRange vrange_;
@@ -393,6 +406,7 @@ class TlsAgent : public PollTarget {
   AuthCertificateCallbackFunction auth_certificate_callback_;
   SniCallbackFunction sni_callback_;
   bool skip_version_checks_;
+  std::vector<uint8_t> resumption_token_;
 };
 
 inline std::ostream& operator<<(std::ostream& stream,
@@ -443,7 +457,7 @@ class TlsAgentTestBase : public ::testing::Test {
   void ProcessMessage(const DataBuffer& buffer, TlsAgent::State expected_state,
                       int32_t error_code = 0);
 
-  std::unique_ptr<TlsAgent> agent_;
+  std::shared_ptr<TlsAgent> agent_;
   TlsAgent::Role role_;
   SSLProtocolVariant variant_;
   uint16_t version_;
diff --git a/security/nss/gtests/ssl_gtest/tls_connect.cc b/security/nss/gtests/ssl_gtest/tls_connect.cc
index 0af5123e9e..8567b392fd 100644
--- a/security/nss/gtests/ssl_gtest/tls_connect.cc
+++ b/security/nss/gtests/ssl_gtest/tls_connect.cc
@@ -197,7 +197,6 @@ void TlsConnectTestBase::SetUp() {
   SSL_ConfigServerSessionIDCache(1024, 0, 0, g_working_dir_path.c_str());
   SSLInt_ClearSelfEncryptKey();
   SSLInt_SetTicketLifetime(30);
-  SSLInt_SetMaxEarlyDataSize(1024);
   SSL_SetupAntiReplay(1 * PR_USEC_PER_SEC, 1, 3);
   ClearStats();
   Init();
@@ -230,7 +229,9 @@ void TlsConnectTestBase::Reset() {
 
 void TlsConnectTestBase::Reset(const std::string& server_name,
                                const std::string& client_name) {
+  auto token = client_->GetResumptionToken();
   client_.reset(new TlsAgent(client_name, TlsAgent::CLIENT, variant_));
+  client_->SetResumptionToken(token);
   server_.reset(new TlsAgent(server_name, TlsAgent::SERVER, variant_));
   if (skip_version_checks_) {
     client_->SkipVersionChecks();
@@ -290,6 +291,7 @@ void TlsConnectTestBase::EnableExtendedMasterSecret() {
 void TlsConnectTestBase::Connect() {
   server_->StartConnect(server_model_ ? server_model_->ssl_fd() : nullptr);
   client_->StartConnect(client_model_ ? client_model_->ssl_fd() : nullptr);
+  client_->MaybeSetResumptionToken();
   Handshake();
   CheckConnected();
 }
@@ -402,13 +404,13 @@ void TlsConnectTestBase::CheckKeys(SSLKEAType kea_type,
       break;
     case ssl_auth_rsa_sign:
       if (version_ >= SSL_LIBRARY_VERSION_TLS_1_2) {
-        scheme = ssl_sig_rsa_pss_sha256;
+        scheme = ssl_sig_rsa_pss_rsae_sha256;
       } else {
         scheme = ssl_sig_rsa_pkcs1_sha256;
       }
       break;
     case ssl_auth_rsa_pss:
-      scheme = ssl_sig_rsa_pss_sha256;
+      scheme = ssl_sig_rsa_pss_rsae_sha256;
       break;
     case ssl_auth_ecdsa:
       scheme = ssl_sig_ecdsa_secp256r1_sha256;
@@ -670,7 +672,8 @@ void TlsConnectTestBase::ZeroRttSendReceive(
     EXPECT_EQ(k0RttDataLen, rv);
   } else {
     EXPECT_EQ(SECFailure, rv);
-    EXPECT_EQ(PR_WOULD_BLOCK_ERROR, PORT_GetError());
+    EXPECT_EQ(PR_WOULD_BLOCK_ERROR, PORT_GetError())
+        << "Unexpected error: " << PORT_ErrorToName(PORT_GetError());
   }
 
   // Do a second read. this should fail.
@@ -754,20 +757,29 @@ TlsConnectTls12Plus::TlsConnectTls12Plus()
 TlsConnectTls13::TlsConnectTls13()
     : TlsConnectTestBase(GetParam(), SSL_LIBRARY_VERSION_TLS_1_3) {}
 
+TlsConnectGenericResumption::TlsConnectGenericResumption()
+    : TlsConnectTestBase(std::get<0>(GetParam()), std::get<1>(GetParam())),
+      external_cache_(std::get<2>(GetParam())) {}
+
+TlsConnectTls13ResumptionToken::TlsConnectTls13ResumptionToken()
+    : TlsConnectTestBase(GetParam(), SSL_LIBRARY_VERSION_TLS_1_3) {}
+
+TlsConnectGenericResumptionToken::TlsConnectGenericResumptionToken()
+    : TlsConnectTestBase(std::get<0>(GetParam()), std::get<1>(GetParam())) {}
+
 void TlsKeyExchangeTest::EnsureKeyShareSetup() {
   EnsureTlsSetup();
   groups_capture_ =
-      std::make_shared<TlsExtensionCapture>(ssl_supported_groups_xtn);
+      std::make_shared<TlsExtensionCapture>(client_, ssl_supported_groups_xtn);
   shares_capture_ =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn);
-  shares_capture2_ =
-      std::make_shared<TlsExtensionCapture>(ssl_tls13_key_share_xtn, true);
+      std::make_shared<TlsExtensionCapture>(client_, ssl_tls13_key_share_xtn);
+  shares_capture2_ = std::make_shared<TlsExtensionCapture>(
+      client_, ssl_tls13_key_share_xtn, true);
   std::vector<std::shared_ptr<PacketFilter>> captures = {
       groups_capture_, shares_capture_, shares_capture2_};
-  client_->SetPacketFilter(std::make_shared<ChainedPacketFilter>(captures));
-  capture_hrr_ = std::make_shared<TlsInspectorRecordHandshakeMessage>(
-      kTlsHandshakeHelloRetryRequest);
-  server_->SetPacketFilter(capture_hrr_);
+  client_->SetFilter(std::make_shared<ChainedPacketFilter>(captures));
+  capture_hrr_ = MakeTlsFilter<TlsHandshakeRecorder>(
+      server_, kTlsHandshakeHelloRetryRequest);
 }
 
 void TlsKeyExchangeTest::ConfigNamedGroups(
diff --git a/security/nss/gtests/ssl_gtest/tls_connect.h b/security/nss/gtests/ssl_gtest/tls_connect.h
index c650dda1dc..7dffe7f8aa 100644
--- a/security/nss/gtests/ssl_gtest/tls_connect.h
+++ b/security/nss/gtests/ssl_gtest/tls_connect.h
@@ -45,8 +45,8 @@ class TlsConnectTestBase : public ::testing::Test {
   TlsConnectTestBase(SSLProtocolVariant variant, uint16_t version);
   virtual ~TlsConnectTestBase();
 
-  void SetUp();
-  void TearDown();
+  virtual void SetUp();
+  virtual void TearDown();
 
   // Initialize client and server.
   void Init();
@@ -55,7 +55,7 @@ class TlsConnectTestBase : public ::testing::Test {
   // Clear the server session cache.
   void ClearServerCache();
   // Make sure TLS is configured for a connection.
-  void EnsureTlsSetup();
+  virtual void EnsureTlsSetup();
   // Reset and keep the same certificate names
   void Reset();
   // Reset, and update the certificate names on both peers
@@ -208,6 +208,52 @@ class TlsConnectGeneric : public TlsConnectTestBase,
   TlsConnectGeneric();
 };
 
+class TlsConnectGenericResumption
+    : public TlsConnectTestBase,
+      public ::testing::WithParamInterface<
+          std::tuple<SSLProtocolVariant, uint16_t, bool>> {
+ private:
+  bool external_cache_;
+
+ public:
+  TlsConnectGenericResumption();
+
+  virtual void EnsureTlsSetup() {
+    TlsConnectTestBase::EnsureTlsSetup();
+    // Enable external resumption token cache.
+    if (external_cache_) {
+      client_->SetResumptionTokenCallback();
+    }
+  }
+
+  bool use_external_cache() const { return external_cache_; }
+};
+
+class TlsConnectTls13ResumptionToken
+    : public TlsConnectTestBase,
+      public ::testing::WithParamInterface<SSLProtocolVariant> {
+ public:
+  TlsConnectTls13ResumptionToken();
+
+  virtual void EnsureTlsSetup() {
+    TlsConnectTestBase::EnsureTlsSetup();
+    client_->SetResumptionTokenCallback();
+  }
+};
+
+class TlsConnectGenericResumptionToken
+    : public TlsConnectTestBase,
+      public ::testing::WithParamInterface<
+          std::tuple<SSLProtocolVariant, uint16_t>> {
+ public:
+  TlsConnectGenericResumptionToken();
+
+  virtual void EnsureTlsSetup() {
+    TlsConnectTestBase::EnsureTlsSetup();
+    client_->SetResumptionTokenCallback();
+  }
+};
+
 // A Pre TLS 1.2 generic test.
 class TlsConnectPre12 : public TlsConnectTestBase,
                         public ::testing::WithParamInterface<
@@ -273,7 +319,7 @@ class TlsKeyExchangeTest : public TlsConnectGeneric {
   std::shared_ptr<TlsExtensionCapture> groups_capture_;
   std::shared_ptr<TlsExtensionCapture> shares_capture_;
   std::shared_ptr<TlsExtensionCapture> shares_capture2_;
-  std::shared_ptr<TlsInspectorRecordHandshakeMessage> capture_hrr_;
+  std::shared_ptr<TlsHandshakeRecorder> capture_hrr_;
 
   void EnsureKeyShareSetup();
   void ConfigNamedGroups(const std::vector<SSLNamedGroup>& groups);
diff --git a/security/nss/gtests/ssl_gtest/tls_filter.cc b/security/nss/gtests/ssl_gtest/tls_filter.cc
index 89f2012950..d34b13bcb5 100644
--- a/security/nss/gtests/ssl_gtest/tls_filter.cc
+++ b/security/nss/gtests/ssl_gtest/tls_filter.cc
@@ -452,7 +452,7 @@ size_t TlsHandshakeFilter::HandshakeHeader::Write(
   return offset;
 }
 
-PacketFilter::Action TlsInspectorRecordHandshakeMessage::FilterHandshake(
+PacketFilter::Action TlsHandshakeRecorder::FilterHandshake(
     const HandshakeHeader& header, const DataBuffer& input,
     DataBuffer* output) {
   // Only do this once.
@@ -763,7 +763,7 @@ PacketFilter::Action AfterRecordN::FilterRecord(const TlsRecordHeader& header,
   if (counter_++ == record_) {
     DataBuffer buf;
     header.Write(&buf, 0, body);
-    src_.lock()->SendDirect(buf);
+    agent()->SendDirect(buf);
     dest_.lock()->Handshake();
     func_();
     return DROP;
@@ -772,7 +772,7 @@ PacketFilter::Action AfterRecordN::FilterRecord(const TlsRecordHeader& header,
   return KEEP;
 }
 
-PacketFilter::Action TlsInspectorClientHelloVersionChanger::FilterHandshake(
+PacketFilter::Action TlsClientHelloVersionChanger::FilterHandshake(
     const HandshakeHeader& header, const DataBuffer& input,
     DataBuffer* output) {
   EXPECT_EQ(SECSuccess,
@@ -808,7 +808,7 @@ PacketFilter::Action SelectiveRecordDropFilter::FilterRecord(
   return pattern;
 }
 
-PacketFilter::Action TlsInspectorClientHelloVersionSetter::FilterHandshake(
+PacketFilter::Action TlsClientHelloVersionSetter::FilterHandshake(
     const HandshakeHeader& header, const DataBuffer& input,
     DataBuffer* output) {
   *output = input;
diff --git a/security/nss/gtests/ssl_gtest/tls_filter.h b/security/nss/gtests/ssl_gtest/tls_filter.h
index 1db3b90f69..1bbe190abe 100644
--- a/security/nss/gtests/ssl_gtest/tls_filter.h
+++ b/security/nss/gtests/ssl_gtest/tls_filter.h
@@ -13,6 +13,7 @@
 #include <vector>
 
 #include "test_io.h"
+#include "tls_agent.h"
 #include "tls_parser.h"
 #include "tls_protect.h"
 
@@ -23,7 +24,6 @@ extern "C" {
 namespace nss_test {
 
 class TlsCipherSpec;
-class TlsAgent;
 
 class TlsVersioned {
  public:
@@ -71,19 +71,27 @@ struct TlsRecord {
   const DataBuffer buffer;
 };
 
+// Make a filter and install it on a TlsAgent.
+template <class T, typename... Args>
+inline std::shared_ptr<T> MakeTlsFilter(const std::shared_ptr<TlsAgent>& agent,
+                                        Args&&... args) {
+  auto filter = std::make_shared<T>(agent, std::forward<Args>(args)...);
+  agent->SetFilter(filter);
+  return filter;
+}
+
 // Abstract filter that operates on entire (D)TLS records.
 class TlsRecordFilter : public PacketFilter {
  public:
-  TlsRecordFilter()
-      : agent_(nullptr),
+  TlsRecordFilter(const std::shared_ptr<TlsAgent>& agent)
+      : agent_(agent),
         count_(0),
         cipher_spec_(),
         dropped_record_(false),
         in_sequence_number_(0),
         out_sequence_number_(0) {}
 
-  void SetAgent(const TlsAgent* agent) { agent_ = agent; }
-  const TlsAgent* agent() const { return agent_; }
+  std::shared_ptr<TlsAgent> agent() const { return agent_.lock(); }
 
   // External interface. Overrides PacketFilter.
   PacketFilter::Action Filter(const DataBuffer& input, DataBuffer* output);
@@ -126,7 +134,7 @@ class TlsRecordFilter : public PacketFilter {
   static void CipherSpecChanged(void* arg, PRBool sending,
                                 ssl3CipherSpec* newSpec);
 
-  const TlsAgent* agent_;
+  std::weak_ptr<TlsAgent> agent_;
   size_t count_;
   std::unique_ptr<TlsCipherSpec> cipher_spec_;
   // Whether we dropped a record since the cipher spec changed.
@@ -175,9 +183,13 @@ inline std::ostream& operator<<(std::ostream& stream,
 // records and that they don't span records or anything crazy like that.
 class TlsHandshakeFilter : public TlsRecordFilter {
  public:
-  TlsHandshakeFilter() : handshake_types_(), preceding_fragment_() {}
-  TlsHandshakeFilter(const std::set<uint8_t>& types)
-      : handshake_types_(types), preceding_fragment_() {}
+  TlsHandshakeFilter(const std::shared_ptr<TlsAgent>& agent)
+      : TlsRecordFilter(agent), handshake_types_(), preceding_fragment_() {}
+  TlsHandshakeFilter(const std::shared_ptr<TlsAgent>& agent,
+                     const std::set<uint8_t>& types)
+      : TlsRecordFilter(agent),
+        handshake_types_(types),
+        preceding_fragment_() {}
 
   // This filter can be set to be selective based on handshake message type.  If
   // this function isn't used (or the set is empty), then all handshake messages
@@ -229,12 +241,14 @@ class TlsHandshakeFilter : public TlsRecordFilter {
 };
 
 // Make a copy of the first instance of a handshake message.
-class TlsInspectorRecordHandshakeMessage : public TlsHandshakeFilter {
+class TlsHandshakeRecorder : public TlsHandshakeFilter {
  public:
-  TlsInspectorRecordHandshakeMessage(uint8_t handshake_type)
-      : TlsHandshakeFilter({handshake_type}), buffer_() {}
-  TlsInspectorRecordHandshakeMessage(const std::set<uint8_t>& handshake_types)
-      : TlsHandshakeFilter(handshake_types), buffer_() {}
+  TlsHandshakeRecorder(const std::shared_ptr<TlsAgent>& agent,
+                       uint8_t handshake_type)
+      : TlsHandshakeFilter(agent, {handshake_type}), buffer_() {}
+  TlsHandshakeRecorder(const std::shared_ptr<TlsAgent>& agent,
+                       const std::set<uint8_t>& handshake_types)
+      : TlsHandshakeFilter(agent, handshake_types), buffer_() {}
 
   virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
                                                const DataBuffer& input,
@@ -251,9 +265,10 @@ class TlsInspectorRecordHandshakeMessage : public TlsHandshakeFilter {
 // Replace all instances of a handshake message.
 class TlsInspectorReplaceHandshakeMessage : public TlsHandshakeFilter {
  public:
-  TlsInspectorReplaceHandshakeMessage(uint8_t handshake_type,
+  TlsInspectorReplaceHandshakeMessage(const std::shared_ptr<TlsAgent>& agent,
+                                      uint8_t handshake_type,
                                       const DataBuffer& replacement)
-      : TlsHandshakeFilter({handshake_type}), buffer_(replacement) {}
+      : TlsHandshakeFilter(agent, {handshake_type}), buffer_(replacement) {}
 
   virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
                                                const DataBuffer& input,
@@ -266,9 +281,11 @@ class TlsInspectorReplaceHandshakeMessage : public TlsHandshakeFilter {
 // Make a copy of each record of a given type.
 class TlsRecordRecorder : public TlsRecordFilter {
  public:
-  TlsRecordRecorder(uint8_t ct) : filter_(true), ct_(ct), records_() {}
-  TlsRecordRecorder()
-      : filter_(false),
+  TlsRecordRecorder(const std::shared_ptr<TlsAgent>& agent, uint8_t ct)
+      : TlsRecordFilter(agent), filter_(true), ct_(ct), records_() {}
+  TlsRecordRecorder(const std::shared_ptr<TlsAgent>& agent)
+      : TlsRecordFilter(agent),
+        filter_(false),
         ct_(content_handshake),  // dummy (<optional> is C++14)
         records_() {}
   virtual PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
@@ -289,7 +306,9 @@ class TlsRecordRecorder : public TlsRecordFilter {
 // Make a copy of the complete conversation.
 class TlsConversationRecorder : public TlsRecordFilter {
  public:
-  TlsConversationRecorder(DataBuffer& buffer) : buffer_(buffer) {}
+  TlsConversationRecorder(const std::shared_ptr<TlsAgent>& agent,
+                          DataBuffer& buffer)
+      : TlsRecordFilter(agent), buffer_(buffer) {}
 
   virtual PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                             const DataBuffer& input,
@@ -302,6 +321,8 @@ class TlsConversationRecorder : public TlsRecordFilter {
 // Make a copy of the records
 class TlsHeaderRecorder : public TlsRecordFilter {
  public:
+  TlsHeaderRecorder(const std::shared_ptr<TlsAgent>& agent)
+      : TlsRecordFilter(agent) {}
   virtual PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                             const DataBuffer& input,
                                             DataBuffer* output);
@@ -338,13 +359,15 @@ typedef std::function<bool(TlsParser* parser, const TlsVersioned& header)>
 
 class TlsExtensionFilter : public TlsHandshakeFilter {
  public:
-  TlsExtensionFilter()
-      : TlsHandshakeFilter({kTlsHandshakeClientHello, kTlsHandshakeServerHello,
+  TlsExtensionFilter(const std::shared_ptr<TlsAgent>& agent)
+      : TlsHandshakeFilter(agent,
+                           {kTlsHandshakeClientHello, kTlsHandshakeServerHello,
                             kTlsHandshakeHelloRetryRequest,
                             kTlsHandshakeEncryptedExtensions}) {}
 
-  TlsExtensionFilter(const std::set<uint8_t>& types)
-      : TlsHandshakeFilter(types) {}
+  TlsExtensionFilter(const std::shared_ptr<TlsAgent>& agent,
+                     const std::set<uint8_t>& types)
+      : TlsHandshakeFilter(agent, types) {}
 
   static bool FindExtensions(TlsParser* parser, const HandshakeHeader& header);
 
@@ -365,8 +388,13 @@ class TlsExtensionFilter : public TlsHandshakeFilter {
 
 class TlsExtensionCapture : public TlsExtensionFilter {
  public:
-  TlsExtensionCapture(uint16_t ext, bool last = false)
-      : extension_(ext), captured_(false), last_(last), data_() {}
+  TlsExtensionCapture(const std::shared_ptr<TlsAgent>& agent, uint16_t ext,
+                      bool last = false)
+      : TlsExtensionFilter(agent),
+        extension_(ext),
+        captured_(false),
+        last_(last),
+        data_() {}
 
   const DataBuffer& extension() const { return data_; }
   bool captured() const { return captured_; }
@@ -385,8 +413,9 @@ class TlsExtensionCapture : public TlsExtensionFilter {
 
 class TlsExtensionReplacer : public TlsExtensionFilter {
  public:
-  TlsExtensionReplacer(uint16_t extension, const DataBuffer& data)
-      : extension_(extension), data_(data) {}
+  TlsExtensionReplacer(const std::shared_ptr<TlsAgent>& agent,
+                       uint16_t extension, const DataBuffer& data)
+      : TlsExtensionFilter(agent), extension_(extension), data_(data) {}
   PacketFilter::Action FilterExtension(uint16_t extension_type,
                                        const DataBuffer& input,
                                        DataBuffer* output) override;
@@ -398,7 +427,9 @@ class TlsExtensionReplacer : public TlsExtensionFilter {
 
 class TlsExtensionDropper : public TlsExtensionFilter {
  public:
-  TlsExtensionDropper(uint16_t extension) : extension_(extension) {}
+  TlsExtensionDropper(const std::shared_ptr<TlsAgent>& agent,
+                      uint16_t extension)
+      : TlsExtensionFilter(agent), extension_(extension) {}
   PacketFilter::Action FilterExtension(uint16_t extension_type,
                                        const DataBuffer&, DataBuffer*) override;
 
@@ -408,8 +439,9 @@ class TlsExtensionDropper : public TlsExtensionFilter {
 
 class TlsExtensionInjector : public TlsHandshakeFilter {
  public:
-  TlsExtensionInjector(uint16_t ext, const DataBuffer& data)
-      : extension_(ext), data_(data) {}
+  TlsExtensionInjector(const std::shared_ptr<TlsAgent>& agent, uint16_t ext,
+                       const DataBuffer& data)
+      : TlsHandshakeFilter(agent), extension_(ext), data_(data) {}
 
  protected:
   PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
@@ -426,16 +458,20 @@ typedef std::function<void(void)> VoidFunction;
 
 class AfterRecordN : public TlsRecordFilter {
  public:
-  AfterRecordN(std::shared_ptr<TlsAgent>& src, std::shared_ptr<TlsAgent>& dest,
-               unsigned int record, VoidFunction func)
-      : src_(src), dest_(dest), record_(record), func_(func), counter_(0) {}
+  AfterRecordN(const std::shared_ptr<TlsAgent>& src,
+               const std::shared_ptr<TlsAgent>& dest, unsigned int record,
+               VoidFunction func)
+      : TlsRecordFilter(src),
+        dest_(dest),
+        record_(record),
+        func_(func),
+        counter_(0) {}
 
   virtual PacketFilter::Action FilterRecord(const TlsRecordHeader& header,
                                             const DataBuffer& body,
                                             DataBuffer* out) override;
 
  private:
-  std::weak_ptr<TlsAgent> src_;
   std::weak_ptr<TlsAgent> dest_;
   unsigned int record_;
   VoidFunction func_;
@@ -444,10 +480,12 @@ class AfterRecordN : public TlsRecordFilter {
 
 // When we see the ClientKeyExchange from |client|, increment the
 // ClientHelloVersion on |server|.
-class TlsInspectorClientHelloVersionChanger : public TlsHandshakeFilter {
+class TlsClientHelloVersionChanger : public TlsHandshakeFilter {
  public:
-  TlsInspectorClientHelloVersionChanger(std::shared_ptr<TlsAgent>& server)
-      : TlsHandshakeFilter({kTlsHandshakeClientKeyExchange}), server_(server) {}
+  TlsClientHelloVersionChanger(const std::shared_ptr<TlsAgent>& client,
+                               const std::shared_ptr<TlsAgent>& server)
+      : TlsHandshakeFilter(client, {kTlsHandshakeClientKeyExchange}),
+        server_(server) {}
 
   virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
                                                const DataBuffer& input,
@@ -477,14 +515,16 @@ class SelectiveDropFilter : public PacketFilter {
 // datagram, we just drop one.
 class SelectiveRecordDropFilter : public TlsRecordFilter {
  public:
-  SelectiveRecordDropFilter(uint32_t pattern, bool enabled = true)
-      : pattern_(pattern), counter_(0) {
+  SelectiveRecordDropFilter(const std::shared_ptr<TlsAgent>& agent,
+                            uint32_t pattern, bool enabled = true)
+      : TlsRecordFilter(agent), pattern_(pattern), counter_(0) {
     if (!enabled) {
       Disable();
     }
   }
-  SelectiveRecordDropFilter(std::initializer_list<size_t> records)
-      : SelectiveRecordDropFilter(ToPattern(records), true) {}
+  SelectiveRecordDropFilter(const std::shared_ptr<TlsAgent>& agent,
+                            std::initializer_list<size_t> records)
+      : SelectiveRecordDropFilter(agent, ToPattern(records), true) {}
 
   void Reset(uint32_t pattern) {
     counter_ = 0;
@@ -509,10 +549,12 @@ class SelectiveRecordDropFilter : public TlsRecordFilter {
 };
 
 // Set the version number in the ClientHello.
-class TlsInspectorClientHelloVersionSetter : public TlsHandshakeFilter {
+class TlsClientHelloVersionSetter : public TlsHandshakeFilter {
  public:
-  TlsInspectorClientHelloVersionSetter(uint16_t version)
-      : TlsHandshakeFilter({kTlsHandshakeClientHello}), version_(version) {}
+  TlsClientHelloVersionSetter(const std::shared_ptr<TlsAgent>& agent,
+                              uint16_t version)
+      : TlsHandshakeFilter(agent, {kTlsHandshakeClientHello}),
+        version_(version) {}
 
   virtual PacketFilter::Action FilterHandshake(const HandshakeHeader& header,
                                                const DataBuffer& input,
@@ -525,7 +567,8 @@ class TlsInspectorClientHelloVersionSetter : public TlsHandshakeFilter {
 // Damages the last byte of a handshake message.
 class TlsLastByteDamager : public TlsHandshakeFilter {
  public:
-  TlsLastByteDamager(uint8_t type) : type_(type) {}
+  TlsLastByteDamager(const std::shared_ptr<TlsAgent>& agent, uint8_t type)
+      : TlsHandshakeFilter(agent), type_(type) {}
   PacketFilter::Action FilterHandshake(
       const TlsHandshakeFilter::HandshakeHeader& header,
       const DataBuffer& input, DataBuffer* output) override {
@@ -545,8 +588,10 @@ class TlsLastByteDamager : public TlsHandshakeFilter {
 
 class SelectedCipherSuiteReplacer : public TlsHandshakeFilter {
  public:
-  SelectedCipherSuiteReplacer(uint16_t suite)
-      : TlsHandshakeFilter({kTlsHandshakeServerHello}), cipher_suite_(suite) {}
+  SelectedCipherSuiteReplacer(const std::shared_ptr<TlsAgent>& agent,
+                              uint16_t suite)
+      : TlsHandshakeFilter(agent, {kTlsHandshakeServerHello}),
+        cipher_suite_(suite) {}
 
  protected:
   PacketFilter::Action FilterHandshake(const HandshakeHeader& header,