Refactor EnsureOpenSSLInit and openssl_util into base

net/base/x509_certificate_openssl.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/x509_certificate.h"
 
 #include <openssl/asn1.h>
 #include <openssl/crypto.h>
 #include <openssl/obj_mac.h>
 #include <openssl/pem.h>
 #include <openssl/pkcs7.h>
 #include <openssl/sha.h>
 #include <openssl/ssl.h>
 #include <openssl/x509v3.h>
 
+#include "base/openssl_util.h"
 #include "base/pickle.h"
 #include "base/singleton.h"
 #include "base/string_number_conversions.h"
 #include "net/base/cert_status_flags.h"
 #include "net/base/cert_verify_result.h"
 #include "net/base/net_errors.h"
-#include "net/base/openssl_util.h"
 #include "net/base/x509_openssl_util.h"
 
 namespace net {
 
 namespace nxou = net::x509_openssl_util;
 
 namespace {
 
 void CreateOSCertHandlesFromPKCS7Bytes(
     const char* data, int length,
     X509Certificate::OSCertHandles* handles) {
+  base::EnsureOpenSSLInit();
   const unsigned char* der_data = reinterpret_cast<const unsigned char*>(data);
-  ScopedSSL<PKCS7, PKCS7_free> pkcs7_cert(
+  base::ScopedOpenSSL<PKCS7, PKCS7_free> pkcs7_cert(
       d2i_PKCS7(NULL, &der_data, length));
   if (!pkcs7_cert.get())
     return;
 
   STACK_OF(X509)* certs = NULL;
   int nid = OBJ_obj2nid(pkcs7_cert.get()->type);
   if (nid == NID_pkcs7_signed) {
     certs = pkcs7_cert.get()->d.sign->cert;
   } else if (nid == NID_pkcs7_signedAndEnveloped) {
     certs = pkcs7_cert.get()->d.signed_and_enveloped->cert;
@@ skipping 45 matching lines @@
                                  &principal->country_name);
 }
 
 void ParseSubjectAltNames(X509Certificate::OSCertHandle cert,
                           std::vector<std::string>* dns_names) {
   int index = X509_get_ext_by_NID(cert, NID_subject_alt_name, -1);
   X509_EXTENSION* alt_name_ext = X509_get_ext(cert, index);
   if (!alt_name_ext)
     return;
 
-  ScopedSSL<GENERAL_NAMES, GENERAL_NAMES_free> alt_names(
+  base::ScopedOpenSSL<GENERAL_NAMES, GENERAL_NAMES_free> alt_names(
       reinterpret_cast<GENERAL_NAMES*>(X509V3_EXT_d2i(alt_name_ext)));
   if (!alt_names.get())
     return;
 
   for (int i = 0; i < sk_GENERAL_NAME_num(alt_names.get()); ++i) {
     const GENERAL_NAME* name = sk_GENERAL_NAME_value(alt_names.get(), i);
     if (name->type == GEN_DNS) {
       unsigned char* dns_name = ASN1_STRING_data(name->d.dNSName);
       if (!dns_name)
         continue;
@@ skipping 87 matching lines @@
   if (!der_cache)
       return;
   if (der_cache->data)
       OPENSSL_free(der_cache->data);
   OPENSSL_free(der_cache);
 }
 
 class X509InitSingleton {
  public:
   int der_cache_ex_index() const { return der_cache_ex_index_; }
+  X509_STORE* store() const { return store_.get(); }
 
  private:
   friend struct DefaultSingletonTraits<X509InitSingleton>;
-  X509InitSingleton() {
-    der_cache_ex_index_ = X509_get_ex_new_index(0, 0, 0, 0, DERCache_free);
+  X509InitSingleton()
+      :   der_cache_ex_index_((base::EnsureOpenSSLInit(),
+                               X509_get_ex_new_index(0, 0, 0, 0,
+                                                     DERCache_free))),
+        store_(X509_STORE_new()) {
     DCHECK_NE(der_cache_ex_index_, -1);
+    X509_STORE_set_default_paths(store_.get());
+    // TODO(joth): Enable CRL (see X509_STORE_set_flags(X509_V_FLAG_CRL_CHECK)).
   }
-  ~X509InitSingleton() {}
 
   int der_cache_ex_index_;
+  base::ScopedOpenSSL<X509_STORE, X509_STORE_free> store_;
 
   DISALLOW_COPY_AND_ASSIGN(X509InitSingleton);
 };
 
 // Takes ownership of |data| (which must have been allocated by OpenSSL).
 DERCache* SetDERCache(X509Certificate::OSCertHandle cert,
                       int x509_der_cache_index,
                       unsigned char* data,
                       int data_length) {
   DERCache* internal_cache = static_cast<DERCache*>(
@@ skipping 54 matching lines @@
 
 // static
 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) {
   // Decrement the ref-count for the cert and, if all references are gone,
   // free the memory and any application-specific data associated with the
   // certificate.
   X509_free(cert_handle);
 }
 
 void X509Certificate::Initialize() {
+  base::EnsureOpenSSLInit();
   fingerprint_ = CalculateFingerprint(cert_handle_);
   ParsePrincipal(cert_handle_, X509_get_subject_name(cert_handle_), &subject_);
   ParsePrincipal(cert_handle_, X509_get_issuer_name(cert_handle_), &issuer_);
   nxou::ParseDate(X509_get_notBefore(cert_handle_), &valid_start_);
   nxou::ParseDate(X509_get_notAfter(cert_handle_), &valid_expiry_);
 }
 
 SHA1Fingerprint X509Certificate::CalculateFingerprint(OSCertHandle cert) {
   SHA1Fingerprint sha1;
   unsigned int sha1_size = static_cast<unsigned int>(sizeof(sha1.data));
   int ret = X509_digest(cert, EVP_sha1(), sha1.data, &sha1_size);
   CHECK(ret);
   CHECK_EQ(sha1_size, sizeof(sha1.data));
   return sha1;
 }
 
 // static
 X509Certificate::OSCertHandle X509Certificate::CreateOSCertHandleFromBytes(
     const char* data, int length) {
   if (length < 0)
     return NULL;
+  base::EnsureOpenSSLInit();
   const unsigned char* d2i_data =
       reinterpret_cast<const unsigned char*>(data);
   // Don't cache this data via SetDERCache as this wire format may be not be
   // identical from the i2d_X509 roundtrip.
   X509* cert = d2i_X509(NULL, &d2i_data, length);
   return cert;
 }
 
 // static
 X509Certificate::OSCertHandles X509Certificate::CreateOSCertHandlesFromBytes(
@@ skipping 15 matching lines @@
     }
     default: {
       NOTREACHED() << "Certificate format " << format << " unimplemented";
       break;
     }
   }
 
   return results;
 }
 
+// static
 X509Certificate* X509Certificate::CreateFromPickle(const Pickle& pickle,
                                                    void** pickle_iter) {
   const char* data;
   int length;
   if (!pickle.ReadData(pickle_iter, &data, &length))
     return NULL;
 
   return CreateFromBytes(data, length);
 }
 
 void X509Certificate::Persist(Pickle* pickle) {
   DERCache der_cache;
   if (!GetDERAndCacheIfNeeded(cert_handle_, &der_cache))
       return;
 
   pickle->WriteData(reinterpret_cast<const char*>(der_cache.data),
                     der_cache.data_length);
 }
 
 void X509Certificate::GetDNSNames(std::vector<std::string>* dns_names) const {
   dns_names->clear();
 
   ParseSubjectAltNames(cert_handle_, dns_names);
 
   if (dns_names->empty())
     dns_names->push_back(subject_.common_name);
 }
 
+// static
+X509_STORE* X509Certificate::cert_store() {
+  return Singleton<X509InitSingleton>::get()->store();
+}
+
 int X509Certificate::Verify(const std::string& hostname,
                             int flags,
                             CertVerifyResult* verify_result) const {
   verify_result->Reset();
 
   // TODO(joth): We should fetch the subjectAltNames directly rather than via
   // GetDNSNames, so we can apply special handling for IP addresses vs DNS
   // names, etc. See http://crbug.com/62973.
   std::vector<std::string> cert_names;
   GetDNSNames(&cert_names);
   if (!x509_openssl_util::VerifyHostname(hostname, cert_names))
     verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID;
 
-  ScopedSSL<X509_STORE_CTX, X509_STORE_CTX_free> ctx(X509_STORE_CTX_new());
+  base::ScopedOpenSSL<X509_STORE_CTX, X509_STORE_CTX_free> ctx(
+      X509_STORE_CTX_new());
 
-  ScopedSSL<STACK_OF(X509), sk_X509_free_fn> intermediates(sk_X509_new_null());
+  base::ScopedOpenSSL<STACK_OF(X509), sk_X509_free_fn> intermediates(
+      sk_X509_new_null());
   if (!intermediates.get())
     return ERR_OUT_OF_MEMORY;
 
   for (OSCertHandles::const_iterator it = intermediate_ca_certs_.begin();
        it != intermediate_ca_certs_.end(); ++it) {
     if (!sk_X509_push(intermediates.get(), *it))
       return ERR_OUT_OF_MEMORY;
   }
-  int rv = X509_STORE_CTX_init(ctx.get(),
-                               GetOpenSSLInitSingleton()->x509_store(),
+  int rv = X509_STORE_CTX_init(ctx.get(), cert_store(),
                                cert_handle_, intermediates.get());
   CHECK_EQ(1, rv);
 
   if (X509_verify_cert(ctx.get()) == 1) {
     return OK;
   }
 
   int x509_error = X509_STORE_CTX_get_error(ctx.get());
   int cert_status = MapCertErrorToCertStatus(x509_error);
   LOG(ERROR) << "X509 Verification error "
@@ skipping 17 matching lines @@
   // cache the DER (if not already cached via X509_set_ex_data).
   DERCache der_cache_a, der_cache_b;
 
   return GetDERAndCacheIfNeeded(a, &der_cache_a) &&
       GetDERAndCacheIfNeeded(b, &der_cache_b) &&
       der_cache_a.data_length == der_cache_b.data_length &&
       memcmp(der_cache_a.data, der_cache_b.data, der_cache_a.data_length) == 0;
 }
 
 } // namespace net