Support building BoringSSL with NSS certificates.

net/BUILD.gn

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/crypto.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
 import("//build/module_args/v8.gni")
 import("//url/config.gni")
 import("//testing/test.gni")
@@ skipping 176 matching lines @@
   }
 
   if (use_openssl) {
     sources -= [
       "base/nss_memio.c",
       "base/nss_memio.h",
       "cert/ct_log_verifier_nss.cc",
       "cert/ct_objects_extractor_nss.cc",
       "cert/jwk_serializer_nss.cc",
       "cert/scoped_nss_types.h",
-      "cert/test_root_certs_nss.cc",
       "cert/x509_util_nss.cc",
-      "cert/x509_util_nss.h",
-      "cert_net/nss_ocsp.cc",
-      "cert_net/nss_ocsp.h",
       "quic/crypto/aead_base_decrypter_nss.cc",
       "quic/crypto/aead_base_encrypter_nss.cc",
       "quic/crypto/aes_128_gcm_12_decrypter_nss.cc",
       "quic/crypto/aes_128_gcm_12_encrypter_nss.cc",
       "quic/crypto/chacha20_poly1305_decrypter_nss.cc",
       "quic/crypto/chacha20_poly1305_encrypter_nss.cc",
       "quic/crypto/channel_id_nss.cc",
       "quic/crypto/p256_key_exchange_nss.cc",
       "socket/nss_ssl_util.cc",
       "socket/nss_ssl_util.h",
       "socket/ssl_client_socket_nss.cc",
       "socket/ssl_client_socket_nss.h",
       "socket/ssl_server_socket_nss.cc",
       "socket/ssl_server_socket_nss.h",
     ]
-    if (is_chromeos) {
-      sources -= [
-        "cert/nss_cert_database_chromeos.cc",
-        "cert/nss_cert_database_chromeos.h",
-        "cert/nss_profile_filter_chromeos.cc",
-        "cert/nss_profile_filter_chromeos.h",
-      ]
-    }
-    if (is_linux) {
-      # These are always removed for non-Linux cases below.
-      sources -= [
-        "base/crypto_module_nss.cc",
-        "base/keygen_handler_nss.cc",
-        "cert/cert_database_nss.cc",
-        "cert/nss_cert_database.cc",
-        "cert/nss_cert_database.h",
-        "cert/x509_certificate_nss.cc",
-        "third_party/mozilla_security_manager/nsKeygenHandler.cpp",
-        "third_party/mozilla_security_manager/nsKeygenHandler.h",
-        "third_party/mozilla_security_manager/nsNSSCertificateDB.cpp",
-        "third_party/mozilla_security_manager/nsNSSCertificateDB.h",
-        "third_party/mozilla_security_manager/nsPKCS12Blob.cpp",
-        "third_party/mozilla_security_manager/nsPKCS12Blob.h",
-      ]
-    }
     if (is_ios) {
       # Always removed for !ios below.
       sources -= [
         "cert/cert_verify_proc_nss.cc",
         "cert/cert_verify_proc_nss.h",
       ]
     }
     if (is_win) {
       sources -= [ "cert/sha256_legacy_support_nss_win.cc" ]
     }
+    if (!use_nss_certs && !is_ios) {
+      sources -= [ "cert/x509_util_nss.h" ]
+    }
   } else {
     sources -= [
-      "base/crypto_module_openssl.cc",
       "cert/ct_log_verifier_openssl.cc",
       "cert/ct_objects_extractor_openssl.cc",
       "cert/jwk_serializer_openssl.cc",
       "cert/x509_util_openssl.cc",
       "cert/x509_util_openssl.h",
       "quic/crypto/aead_base_decrypter_openssl.cc",
       "quic/crypto/aead_base_encrypter_openssl.cc",
       "quic/crypto/aes_128_gcm_12_decrypter_openssl.cc",
       "quic/crypto/aes_128_gcm_12_encrypter_openssl.cc",
       "quic/crypto/chacha20_poly1305_decrypter_openssl.cc",
       "quic/crypto/chacha20_poly1305_encrypter_openssl.cc",
       "quic/crypto/channel_id_openssl.cc",
       "quic/crypto/p256_key_exchange_openssl.cc",
       "quic/crypto/scoped_evp_aead_ctx.cc",
       "quic/crypto/scoped_evp_aead_ctx.h",
       "socket/ssl_client_socket_openssl.cc",
       "socket/ssl_client_socket_openssl.h",
       "socket/ssl_server_socket_openssl.cc",
       "socket/ssl_server_socket_openssl.h",
       "ssl/openssl_platform_key.h",
+      "ssl/openssl_platform_key_nss.cc",
       "ssl/openssl_ssl_util.cc",
       "ssl/openssl_ssl_util.h",
       "ssl/ssl_client_session_cache_openssl.cc",
       "ssl/ssl_client_session_cache_openssl.h",
     ]
     if (is_mac) {
       sources -= [ "ssl/openssl_platform_key_mac.cc" ]
     }
     if (is_win) {
       sources -= [
         "cert/sha256_legacy_support_openssl_win.cc",
         "ssl/openssl_platform_key_win.cc",
       ]
     }
   }
 
   if (!use_openssl_certs) {
     sources -= [
+      "base/crypto_module_openssl.cc",
       "base/keygen_handler_openssl.cc",
       "base/openssl_private_key_store.h",
       "base/openssl_private_key_store_memory.cc",
       "cert/cert_database_openssl.cc",
       "cert/cert_verify_proc_openssl.cc",
       "cert/cert_verify_proc_openssl.h",
       "cert/test_root_certs_openssl.cc",
       "cert/x509_certificate_openssl.cc",
       "ssl/openssl_client_key_store.cc",
       "ssl/openssl_client_key_store.h",
@@ skipping 11 matching lines @@
     ]
   }
 
   if (use_glib && !is_chromeos) {
     configs += [ "//build/config/linux:gconf" ]
     deps += [ "//build/config/linux:gio" ]
   }
 
   if (is_linux) {
     configs += [ "//build/config/linux:libresolv" ]
-  } else {
+  }
+
+  if (!use_nss_certs) {
     sources -= [
       "base/crypto_module_nss.cc",
       "base/keygen_handler_nss.cc",
       "cert/cert_database_nss.cc",
       "cert/nss_cert_database.cc",
       "cert/nss_cert_database.h",
       "cert/x509_certificate_nss.cc",
+      "ssl/client_cert_store_nss.cc",
+      "ssl/client_cert_store_nss.h",
       "third_party/mozilla_security_manager/nsKeygenHandler.cpp",
       "third_party/mozilla_security_manager/nsKeygenHandler.h",
       "third_party/mozilla_security_manager/nsNSSCertificateDB.cpp",
       "third_party/mozilla_security_manager/nsNSSCertificateDB.h",
       "third_party/mozilla_security_manager/nsPKCS12Blob.cpp",
       "third_party/mozilla_security_manager/nsPKCS12Blob.h",
     ]
-
-    if (!is_ios && !use_openssl) {
-      # These files are part of the partial implementation of NSS on iOS so
-      # keep them in that case.
-      sources -= [
-        "cert/test_root_certs_nss.cc",
-        "cert_net/nss_ocsp.cc",
-        "cert_net/nss_ocsp.h",
-      ]
-    }
-  }
-
-  if (!use_nss_certs) {
-    sources -= [
-      "ssl/client_cert_store_nss.cc",
-      "ssl/client_cert_store_nss.h",
-    ]
     if (!is_ios) {
       # These files are part of the partial implementation of NSS on iOS so
       # keep them in that case (even though use_nss_certs is not set).
       sources -= [
         "cert/cert_verify_proc_nss.cc",
         "cert/cert_verify_proc_nss.h",
+        "cert/test_root_certs_nss.cc",
+        "cert/x509_util_nss_certs.cc",
+        "cert_net/nss_ocsp.cc",
+        "cert_net/nss_ocsp.h",
       ]
     }
     if (is_chromeos) {
       # These were already removed on non-ChromeOS.
       sources -= [
+        "cert/nss_cert_database_chromeos.cc",
+        "cert/nss_cert_database_chromeos.h",
+        "cert/nss_profile_filter_chromeos.cc",
+        "cert/nss_profile_filter_chromeos.h",
         "ssl/client_cert_store_chromeos.cc",
         "ssl/client_cert_store_chromeos.h",
       ]
     }
+    if (use_openssl) {
+      sources -= [ "ssl/openssl_platform_key_nss.cc" ]
+    }
+  } else if (use_openssl) {
+    # client_cert_store_nss.c requires NSS_CmpCertChainWCANames from NSS's
+    # libssl, but our bundled copy is not built in OpenSSL ports. Pull that file
+    # in directly.
+    sources += [ "third_party/nss/ssl/cmpcert.c" ]
   }
 
   if (!enable_websockets) {
     sources -= [
       "websockets/websocket_basic_handshake_stream.cc",
       "websockets/websocket_basic_handshake_stream.h",
       "websockets/websocket_basic_stream.cc",
       "websockets/websocket_basic_stream.h",
       "websockets/websocket_channel.cc",
       "websockets/websocket_channel.h",
@@ skipping 72 matching lines @@
   if (is_mac) {
     libs = [
       "Foundation.framework",
       "Security.framework",
       "SystemConfiguration.framework",
       "resolv",
     ]
   }
 
   if (is_ios) {
-    # Add back some sources that were otherwise filtered out. iOS additionally
-    # doesn't set USE_NSS_CERTS but needs some of the files.
+    # Add back some sources that were otherwise filtered out. iOS needs some Mac
+    # files.
     set_sources_assignment_filter([])
     sources += [
       "base/net_util_mac.cc",
       "base/net_util_mac.h",
       "base/network_change_notifier_mac.cc",
       "base/network_config_watcher_mac.cc",
       "base/platform_mime_util_mac.mm",
-      "cert/cert_verify_proc_nss.cc",
-      "cert/cert_verify_proc_nss.h",
-      "cert/test_root_certs_nss.cc",
-      "cert/x509_util_nss.cc",
-      "cert/x509_util_nss.h",
-      "cert_net/nss_ocsp.cc",
-      "cert_net/nss_ocsp.h",
       "proxy/proxy_resolver_mac.cc",
       "proxy/proxy_server_mac.cc",
     ]
     set_sources_assignment_filter(sources_assignment_filter)
 
     sources -= [ "disk_cache/blockfile/file_posix.cc" ]
     libs = [
       "CFNetwork.framework",
       "MobileCoreServices.framework",
       "Security.framework",
@@ skipping 896 matching lines @@
         ":net_javatests",  # FIXME(brettw)
         ":net_test_jni_headers",
       ]
     }
 
     if (v8_use_external_startup_data) {
       deps += [ "//gin" ]
     }
 
     if (!use_nss_certs) {
-      sources -= [ "ssl/client_cert_store_nss_unittest.cc" ]
+      sources -= [
+        "cert/nss_cert_database_unittest.cc",
+        "ssl/client_cert_store_nss_unittest.cc",
+      ]
       if (is_chromeos) {  # Already removed for all non-ChromeOS builds.
-        sources -= [ "ssl/client_cert_store_chromeos_unittest.cc" ]
+        sources -= [
+          "cert/nss_cert_database_chromeos_unittest.cc",
+          "cert/nss_profile_filter_chromeos_unittest.cc",
+          "ssl/client_cert_store_chromeos_unittest.cc",
+        ]
       }
     }
 
     if (use_openssl) {
       # When building for OpenSSL, we need to exclude NSS specific tests
       # or functionality not supported by OpenSSL yet.
       # TODO(bulach): Add equivalent tests when the underlying
       #               functionality is ported to OpenSSL.
       sources -= [
-        "cert/nss_cert_database_unittest.cc",
         "cert/x509_util_nss_unittest.cc",
         "quic/test_tools/crypto_test_utils_nss.cc",
       ]
-      if (is_chromeos) {
-        # These were already removed in the non-ChromeOS case.
-        sources -= [
-          "cert/nss_cert_database_chromeos_unittest.cc",
-          "cert/nss_profile_filter_chromeos_unittest.cc",
-        ]
-      }
     } else {
       sources -= [
         "cert/x509_util_openssl_unittest.cc",
         "quic/test_tools/crypto_test_utils_openssl.cc",
         "socket/ssl_client_socket_openssl_unittest.cc",
         "ssl/ssl_client_session_cache_openssl_unittest.cc",
       ]
-      if (!is_desktop_linux && !is_chromeos) {
-        sources -= [ "cert/nss_cert_database_unittest.cc" ]
-      }
     }
 
     if (use_kerberos) {
       defines += [ "USE_KERBEROS" ]
     } else {
       sources -= [
         "http/http_auth_gssapi_posix_unittest.cc",
         "http/http_auth_handler_negotiate_unittest.cc",
         "http/mock_gssapi_library_posix.cc",
         "http/mock_gssapi_library_posix.h",
@@ skipping 213 matching lines @@
   } else {
     sources -= [ "proxy/proxy_resolver_perftest.cc" ]
   }
 
   if (is_win && icu_use_data_file) {
     # This is needed to trigger the dll copy step on windows.
     # TODO(mark): Specifying this here shouldn't be necessary.
     deps += [ "//third_party/icu:icudata" ]
   }
 }