Support building BoringSSL with NSS certificates.

net/net.gyp

 # Copyright 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 {
   'variables': {
     'chromium_code': 1,
 
     'linux_link_kerberos%': 0,
     'conditions': [
@@ skipping 186 matching lines @@
           ]
         }, { # else
           'sources!': [
             'dns/address_sorter_posix.cc',
             'dns/address_sorter_posix.h',
             'dns/dns_client.cc',
           ],
         }],
         ['use_openssl==1', {
             'sources!': [
-              'base/crypto_module_nss.cc',
-              'base/keygen_handler_nss.cc',
               'base/nss_memio.c',
               'base/nss_memio.h',
-              'cert/cert_database_nss.cc',
-              'cert/cert_verify_proc_nss.cc',
-              'cert/cert_verify_proc_nss.h',
               'cert/ct_log_verifier_nss.cc',
               'cert/ct_objects_extractor_nss.cc',
               'cert/jwk_serializer_nss.cc',
-              'cert/nss_cert_database.cc',
-              'cert/nss_cert_database.h',
-              'cert/nss_cert_database_chromeos.cc',
-              'cert/nss_cert_database_chromeos.h',
               'cert/nss_profile_filter_chromeos.cc',
               'cert/nss_profile_filter_chromeos.h',
               'cert/scoped_nss_types.h',
               'cert/sha256_legacy_support_nss_win.cc',
-              'cert/test_root_certs_nss.cc',
-              'cert/x509_certificate_nss.cc',
               'cert/x509_util_nss.cc',
-              'cert/x509_util_nss.h',
-              'ocsp/nss_ocsp.cc',
-              'ocsp/nss_ocsp.h',
               'quic/crypto/aead_base_decrypter_nss.cc',
               'quic/crypto/aead_base_encrypter_nss.cc',
               'quic/crypto/aes_128_gcm_12_decrypter_nss.cc',
               'quic/crypto/aes_128_gcm_12_encrypter_nss.cc',
               'quic/crypto/chacha20_poly1305_decrypter_nss.cc',
               'quic/crypto/chacha20_poly1305_encrypter_nss.cc',
               'quic/crypto/channel_id_nss.cc',
               'quic/crypto/p256_key_exchange_nss.cc',
               'socket/nss_ssl_util.cc',
               'socket/nss_ssl_util.h',
               'socket/ssl_client_socket_nss.cc',
               'socket/ssl_client_socket_nss.h',
               'socket/ssl_server_socket_nss.cc',
               'socket/ssl_server_socket_nss.h',
-              'third_party/mozilla_security_manager/nsKeygenHandler.cpp',
-              'third_party/mozilla_security_manager/nsKeygenHandler.h',
-              'third_party/mozilla_security_manager/nsNSSCertificateDB.cpp',
-              'third_party/mozilla_security_manager/nsNSSCertificateDB.h',
-              'third_party/mozilla_security_manager/nsPKCS12Blob.cpp',
-              'third_party/mozilla_security_manager/nsPKCS12Blob.h',
             ],
             'dependencies': [
               '../third_party/boringssl/boringssl.gyp:boringssl',
             ],
           },
           {  # else !use_openssl: remove the unneeded files and depend on NSS.
             'sources!': [
-              'base/crypto_module_openssl.cc',
               'cert/ct_log_verifier_openssl.cc',
               'cert/ct_objects_extractor_openssl.cc',
               'cert/jwk_serializer_openssl.cc',
               'cert/sha256_legacy_support_openssl_win.cc',
               'cert/x509_util_openssl.cc',
               'cert/x509_util_openssl.h',
               'quic/crypto/aead_base_decrypter_openssl.cc',
               'quic/crypto/aead_base_encrypter_openssl.cc',
               'quic/crypto/aes_128_gcm_12_decrypter_openssl.cc',
               'quic/crypto/aes_128_gcm_12_encrypter_openssl.cc',
               'quic/crypto/chacha20_poly1305_decrypter_openssl.cc',
               'quic/crypto/chacha20_poly1305_encrypter_openssl.cc',
               'quic/crypto/channel_id_openssl.cc',
               'quic/crypto/p256_key_exchange_openssl.cc',
               'quic/crypto/scoped_evp_aead_ctx.cc',
               'quic/crypto/scoped_evp_aead_ctx.h',
               'socket/ssl_client_socket_openssl.cc',
               'socket/ssl_client_socket_openssl.h',
               'socket/ssl_server_socket_openssl.cc',
               'socket/ssl_server_socket_openssl.h',
               'socket/ssl_session_cache_openssl.cc',
               'socket/ssl_session_cache_openssl.h',
               'ssl/openssl_platform_key.h',
               'ssl/openssl_platform_key_mac.cc',
+              'ssl/openssl_platform_key_nss.cc',
               'ssl/openssl_platform_key_win.cc',
               'ssl/openssl_ssl_util.cc',
               'ssl/openssl_ssl_util.h',
             ],
+          },
+        ],
+        [ 'use_nss == 1 or OS == "ios" or use_openssl == 0', {
             'conditions': [
               # Pull in the bundled or system NSS as appropriate.
               [ 'desktop_linux == 1 or chromeos == 1', {
                 'dependencies': [
                   '../build/linux/system.gyp:ssl',
                 ],
               }, {
                 'dependencies': [
                   '../third_party/nss/nss.gyp:nspr',
                   '../third_party/nss/nss.gyp:nss',
                   'third_party/nss/ssl.gyp:libssl',
                 ],
               }]
             ],
-          },
-        ],
+        }, {
+            'sources!': [
+              'cert/x509_util_nss.h',
+            ],
+        }],
         [ 'use_openssl_certs == 0', {
             'sources!': [
+              'base/crypto_module_openssl.cc',
               'base/keygen_handler_openssl.cc',
               'base/openssl_private_key_store.h',
               'base/openssl_private_key_store_android.cc',
               'base/openssl_private_key_store_memory.cc',
               'cert/cert_database_openssl.cc',
               'cert/cert_verify_proc_openssl.cc',
               'cert/cert_verify_proc_openssl.h',
               'cert/test_root_certs_openssl.cc',
               'cert/x509_certificate_openssl.cc',
               'ssl/openssl_client_key_store.cc',
@@ skipping 21 matching lines @@
               }],
               ['OS=="solaris"', {
                 'link_settings': {
                   'ldflags': [
                     '-R/usr/lib/mps',
                   ],
                 },
               }],
             ],
           },
-          {  # else: OS is not in the above list
+        ],
+        [ 'use_nss != 1', {
             'sources!': [
               'base/crypto_module_nss.cc',
               'base/keygen_handler_nss.cc',
               'cert/cert_database_nss.cc',
+              'cert/cert_verify_proc_nss.cc',
+              'cert/cert_verify_proc_nss.h',
               'cert/nss_cert_database.cc',
               'cert/nss_cert_database.h',
+              'ssl/openssl_platform_key_nss.cc',
               'cert/test_root_certs_nss.cc',
               'cert/x509_certificate_nss.cc',
+              'cert/x509_util_nss_certs.cc',
               'ocsp/nss_ocsp.cc',
               'ocsp/nss_ocsp.h',
+              'ssl/client_cert_store_chromeos.cc',
+              'ssl/client_cert_store_chromeos.h',
+              'ssl/client_cert_store_nss.cc',
+              'ssl/client_cert_store_nss.h',
               'third_party/mozilla_security_manager/nsKeygenHandler.cpp',
               'third_party/mozilla_security_manager/nsKeygenHandler.h',
               'third_party/mozilla_security_manager/nsNSSCertificateDB.cpp',
               'third_party/mozilla_security_manager/nsNSSCertificateDB.h',
               'third_party/mozilla_security_manager/nsPKCS12Blob.cpp',
               'third_party/mozilla_security_manager/nsPKCS12Blob.h',
             ],
-          },
-        ],
-        [ 'use_nss != 1', {
-            'sources!': [
-              'cert/cert_verify_proc_nss.cc',
-              'cert/cert_verify_proc_nss.h',
-              'ssl/client_cert_store_chromeos.cc',
-              'ssl/client_cert_store_chromeos.h',
-              'ssl/client_cert_store_nss.cc',
-              'ssl/client_cert_store_nss.h',
+        }],
+        # client_cert_store_nss.c requires NSS_CmpCertChainWCANames from NSS's
+        # libssl, but our bundled copy is not built in OpenSSL ports. Pull that
+        # file in directly.
+        [ 'use_nss == 1 and use_openssl == 1', {
+            'sources': [
+              'third_party/nss/ssl/cmpcert.c',
             ],
         }],
         [ 'enable_websockets != 1', {
             'sources/': [
               ['exclude', '^websockets/'],
             ],
         }],
         [ 'enable_mdns != 1', {
             'sources!' : [
               'dns/mdns_cache.cc',
@@ skipping 118 matching lines @@
             ['include', '^base/net_util_mac\\.h$'],
             ['include', '^base/network_change_notifier_mac\\.cc$'],
             ['include', '^base/network_config_watcher_mac\\.cc$'],
             ['include', '^base/platform_mime_util_mac\\.mm$'],
             # The iOS implementation only partially uses NSS and thus does not
             # defines |use_nss|. In particular the |USE_NSS| preprocessor
             # definition is not used. The following files are needed though:
             ['include', '^cert/cert_verify_proc_nss\\.cc$'],
             ['include', '^cert/cert_verify_proc_nss\\.h$'],
             ['include', '^cert/test_root_certs_nss\\.cc$'],
-            ['include', '^cert/x509_util_nss\\.cc$'],
-            ['include', '^cert/x509_util_nss\\.h$'],
+            ['include', '^cert/x509_util_nss_certs\\.cc$'],
             ['include', '^proxy/proxy_resolver_mac\\.cc$'],
             ['include', '^proxy/proxy_server_mac\\.cc$'],
             ['include', '^ocsp/nss_ocsp\\.cc$'],
             ['include', '^ocsp/nss_ocsp\\.h$'],
           ],
         }],
       ],
     },
     {
       'target_name': 'net_unittests',
@@ skipping 58 matching lines @@
           'sources!': [
             'ssl/client_cert_store_chromeos_unittest.cc',
             'ssl/client_cert_store_nss_unittest.cc',
           ],
         }],
         [ 'use_openssl == 1', {
           # Avoid compiling/linking with the system library.
           'dependencies': [
             '../third_party/boringssl/boringssl.gyp:boringssl',
           ],
         }, {  # use_openssl == 0

[haavardm, 2015/03/11 14:42:51]

For shared library builds, like you did on line 269 you must add the condition
'use_nss == 1 or OS == "ios" or use_openssl == 0'  instead of an 'else'.

[davidben, 2015/03/11 23:32:42]

Done. I suspect this is redundant with a bunch of stuff through.

(Actually that file exclusion for the unit tests is wrong anyway... fixing those
up too)

           'conditions': [
             [ 'desktop_linux == 1 or chromeos == 1', {
               'dependencies': [
                 '../build/linux/system.gyp:ssl',
               ],
             }, {  # desktop_linux == 0 and chromeos == 0
               'dependencies': [
                 '../third_party/nss/nss.gyp:nspr',
                 '../third_party/nss/nss.gyp:nss',
                 'third_party/nss/ssl.gyp:libssl',
@@ skipping 1260 matching lines @@
             '../build/isolate.gypi',
           ],
           'sources': [
             'net_unittests.isolate',
           ],
         },
       ],
     }],
   ],
 }