Reland "Don't use RSAPrivateKey in NSS integration code."

This is a reland of https://codereview.chromium.org/1106103003/ with fixes to
ensure callers never pass in a null slot.

Currently some NSS platform integration logic transits private keys through
RSAPrivateKey on CrOS. This prevents incrementally switching RSAPrivateKey to
BoringSSL while keeping platform integrations on NSS.

The intent of this change is to clarify RSAPrivateKey as a BoringSSL vs NSS
internal crypto library (use_openssl=0 vs use_openssl=1) abstraction. It's
primarily to be used with SignatureCreator. Code which uses NSS based on
use_nss_certs rather than use_openssl because the underlying platform is NSS
should call NSS routines directly, or introduce different abstractions.

Remove the problematic RSAPrivateKey methods and instead add
crypto/nss_key_util.h which contains some helper functions for manipulating NSS
keys. This is sufficient to allow consumers of the removed methods to use NSS
directly with about as much code. (This should not set back migrating that
logic to NSS as that code was already very NSS-specific; those APIs assumed
PK11SlotInfo.)

nss_key_util.h, like nss_util.h, is built whenever NSS is used either
internally or for platform integrations. This is so rsa_private_key_nss.cc can
continue to use the helper functions to implement the NSS-agnostic interface.

With this, the chimera CrOS configuration should build. The RSAPrivateKey logic
is functional with the exception of some logic in components/ownership. That
will be resolved in a future CL.

BUG=478777,483606

Review URL: https://codereview.chromium.org/1128153003

Cr-Commit-Position: refs/heads/master@{#329227}

1 files changed, 14 insertions, 9 deletions

diff --git a/crypto/BUILD.gn b/crypto/BUILD.gn
index c1eabe6..f84c4d4 100644
--- a/crypto/BUILD.gn
+++ b/crypto/BUILD.gn
@@ -50,6 +50,8 @@ component("crypto") {
     "mock_apple_keychain.h",
     "mock_apple_keychain_ios.cc",
     "mock_apple_keychain_mac.cc",
+    "nss_key_util.cc",
+    "nss_key_util.h",
     "nss_util.cc",
     "nss_util.h",
     "nss_util_internal.h",
@@ -171,10 +173,12 @@ component("crypto") {
     ]
   }
 
-  # Remove nss_util when NSS is used for neither the internal crypto library
-  # nor the platform certificate library.
+  # Some files are built when NSS is used at all, either for the internal crypto
+  # library or the platform certificate library.
   if (use_openssl && !use_nss_certs) {
     sources -= [
+      "nss_key_util.cc",
+      "nss_key_util.h",
       "nss_util.cc",
       "nss_util.h",
       "nss_util_internal.h",
@@ -226,12 +230,12 @@ test("crypto_unittests") {
     "ghash_unittest.cc",
     "hkdf_unittest.cc",
     "hmac_unittest.cc",
+    "nss_key_util_unittest.cc",
     "nss_util_unittest.cc",
     "openssl_bio_string_unittest.cc",
     "p224_spake_unittest.cc",
     "p224_unittest.cc",
     "random_unittest.cc",
-    "rsa_private_key_nss_unittest.cc",
     "rsa_private_key_unittest.cc",
     "secure_hash_unittest.cc",
     "sha2_unittest.cc",
@@ -240,15 +244,16 @@ test("crypto_unittests") {
     "symmetric_key_unittest.cc",
   ]
 
-  # Remove nss_util when NSS is used for neither the internal crypto library
-  # nor the platform certificate library.
+  # Some files are built when NSS is used at all, either for the internal crypto
+  # library or the platform certificate library.
   if (use_openssl && !use_nss_certs) {
-    sources -= [ "nss_util_unittest.cc" ]
+    sources -= [
+      "nss_key_util_unittest.cc",
+      "nss_util_unittest.cc",
+    ]
   }
 
-  if (use_openssl) {
-    sources -= [ "rsa_private_key_nss_unittest.cc" ]
-  } else {
+  if (!use_openssl) {
     sources -= [ "openssl_bio_string_unittest.cc" ]
   }