C C++ Assembly Shell Makefile Python Other
Latest commit 35efe88 Jan 21, 2017 @martinthomson martinthomson Bug 1323104 - short_header extension and version negotiation interact…
…ions, r=ekr

Differential Revision: https://nss-review.dev.mozaws.net/D162

--HG--
extra : rebase_source : 4e1f82d743a3c5e7c230d091bae686bab903678a
extra : amend_source : bb047c7215bcae2601a6bf28ee64a99a0a53f698
Permalink
Failed to load latest commit information.
automation Bug 1332652 - Replace SPKI and Cert tests with a single QuickDER fuzz… Jan 20, 2017
cmd Bug 1331956 - Remove duplicate dependencies from platlibs.gypi r=fran… Jan 18, 2017
coreconf fix fuzzing build, r=bustage Jan 20, 2017
doc Bug 1253912 - drop more than suite b support, r=mt,rrelyea Aug 3, 2016
fuzz Bug 1332652 - Fix clang-format bustage r=me Jan 20, 2017
gtests Bug 1330655 - Make NSS build within OSS-Fuzz r=franziskus Jan 20, 2017
lib Bug 1323104 - short_header extension and version negotiation interact… Jan 21, 2017
nss-tool Bug 1331594 - nss-tool needs to check whether given DB path exists r=… Jan 17, 2017
pkg Bug 1277852 - add config scripts for packaging, r=kaie Jun 21, 2016
tests Bug 1330602 - Set PATH to Go binary via Dockerfile r=mt Jan 13, 2017
.clang-format Bug 1204998 - travis.yml with clang-format 3.8, mac and asan builds, … May 2, 2016
.gitignore Bug 1330655 - Make NSS build within OSS-Fuzz r=franziskus Jan 20, 2017
.hgignore Bug 1330655 - Make NSS build within OSS-Fuzz r=franziskus Jan 20, 2017
.hgtags Added tag NSS_3_27_BETA3 for changeset 06ed5314230a Sep 8, 2016
.taskcluster.yml Bug 1302810 - Use a .taskcluster.yml file for the decision task r=me,… Sep 14, 2016
COPYING Bug 845556, reorganize NSS directory layout, moving files, very large… Feb 28, 2013
Makefile Bug 1317318 - Run tests by getting the $objdir from dist/latest or ge… Nov 15, 2016
build.sh Bug 1330655 - Make NSS build within OSS-Fuzz r=franziskus Jan 20, 2017
exports.gyp bug 1316604 - Add variables for <(nss_dist_dir)/{public,private}. r=f… Nov 10, 2016
manifest.mn Bug 1316274 - Fuzzing mode: Move fuzz/ to GYP, remove Makefiles and m… Nov 11, 2016
nss.gyp Bug 1330655 - Make NSS build within OSS-Fuzz r=franziskus Jan 20, 2017
readme.md update readme, r=ttaubert DONTBUILD Jan 19, 2017
trademarks.txt Bug 845556, reorganize NSS directory layout, moving files, very large… Feb 28, 2013

readme.md

Network Security Services

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. NSS supports SSL v3-TLS 1.2 (experimental TLS 1.3), PKCS #5, PKCS#7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

Getting started

In order to get started create a new directory on that you will be uses as your local work area, and check out NSS and NSPR. (Note that there's no git mirror of NSPR and you require mercurial to get the latest NSPR source.)

git clone https://github.com/nss-dev/nss.git
hg clone https://hg.mozilla.org/projects/nspr

NSS can also be cloned with mercurial hg clone https://hg.mozilla.org/projects/nspr

Building NSS

This build system is under development. It does not yet support all the features or platforms that NSS supports. To build on anything other than Mac or Linux please use the legacy build system as described below.

Build requirements:

After changing into the NSS directory a typical build is done as follows

./build.sh

Once the build is done the build output is found in the directory ../dist/Debug for debug builds and ../dist/Release for opt builds. Exported header files can be found in the include directory, library files in directory lib, and tools in directory bin. In order to run the tools, set your system environment to use the libraries of your build from the "lib" directory, e.g., using the LD_LIBRARY_PATH or DYLD_LIBRARY_PATH.

Usage: build.sh [-hcv] [-j <n>] [--nspr] [--gyp|-g] [--opt|-o] [-m32]
                [--test] [--fuzz] [--pprof] [--scan-build[=output]]
                [--asan] [--ubsan] [--msan] [--sancov[=edge|bb|func|...]]
                [--ct-verif] [--disable-tests]

This script builds NSS with gyp and ninja.

This build system is still under development.  It does not yet support all
the features or platforms that NSS supports.

NSS build tool options:

    -h               display this help and exit
    -c               clean before build
    -v               verbose build
    -j <n>           run at most <n> concurrent jobs
    --nspr           force a rebuild of NSPR
    --gyp|-g         force a rerun of gyp
    --opt|-o         do an opt build
    -m32             do a 32-bit build on a 64-bit system
    --test           ignore map files and export everything we have
    --fuzz           enable fuzzing mode. this always enables test builds
    --pprof          build with gperftool support
    --ct-verif       build with valgrind for ct-verif
    --scan-build     run the build with scan-build (scan-build has to be in the path)
                     --scan-build=/out/path sets the output path for scan-build
    --asan           do an asan build
    --ubsan          do an ubsan build
                     --ubsan=bool,shift,... sets specific UB sanitizers
    --msan           do an msan build
    --sancov         do sanitize coverage builds
                     --sancov=func sets coverage to function level for example
    --disable-tests  don't build tests and corresponding cmdline utils

Building NSS (legacy build system)

After changing into the NSS directory a typical build of 32-bit NSS is done as follows:

make nss_build_all

The following environment variables might be useful:

  • BUILD_OPT=1 to get an optimised build

  • USE_64=1 to get a 64-bit build (recommended)

The complete list of environment variables can be found here.

To clean the build directory run:

make nss_clean_all

Tests

Setup

Make sure that the address $HOST.$DOMSUF on your computer is available. This is necessary because NSS tests generate certificates and establish TLS connections, which requires a fully qualified domain name. You can test this by calling ping $HOST.$DOMSUF. If this is working, you're all set. If it's not, set or export:

HOST=nss
DOMSUF=local

Note that you might have to add nss.local to /etc/hosts if it's not there. The entry should look something like 127.0.0.1 nss.local nss.

If you get name resolution errors, try to ensure that you are using an IPv4 address; IPv6 is the default on many systems for the loopback device which doesn't work.

Running tests

Runnning all tests will take a while!

cd tests
./all.sh

Make sure that all environment variables set for the build are set while running the tests as well. Test results are published in the folder ../../test_results/.

Individual tests can be run with the NSS_TESTS environment variable, e.g. NSS_TESTS=ssl_gtests ./all.sh or by changing into the according directory and running the bash script there cd ssl_gtests && ./ssl_gtests.sh. The following tests are available:

cipher lowhash libpkix cert dbtests tools fips sdr crmf smime ssl ocsp merge pkits chains ec gtests ssl_gtests bogo

To make tests run faster it's recommended to set NSS_CYCLES=standard to run only the standard cycle.

Releases

NSS releases can be found at Mozilla's download server. Because NSS depends on the base library NSPR you should download the archive that combines both NSS and NSPR.

Contributing

Bugzilla is used to track NSS development and bugs. File new bugs in the NSS product.

A list with good first bugs to start with are listed here.

NSS Folder Structure

The nss directory contains the following important subdirectories:

  • coreconf contains the build logic.

  • lib contains all library code that is used to create the runtime libraries.

  • cmd contains a set of various tool programs that are built with NSS. Several tools are general purpose and can be used to inspect and manipulate the storage files that software using the NSS library creates and modifies. Other tools are only used for testing purposes.

  • test and gtests contain the NSS test suite. While test contains shell scripts to drive test programs in cmd, gtests holds a set of gtests.

A more comprehensible overview of the NSS folder structure and API guidelines can be found here.