Use BoringSSL scopers in //net.

net/cert/x509_certificate_ios.cc

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <Security/Security.h>
 
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
 
 #include "base/mac/scoped_cftyperef.h"
 #include "base/pickle.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
 #include "crypto/openssl_util.h"
-#include "crypto/scoped_openssl_types.h"
 #include "net/base/ip_address.h"
 #include "net/cert/x509_util_openssl.h"
 #include "net/ssl/openssl_ssl_util.h"
 
 using base::ScopedCFTypeRef;
 
 namespace net {
 
 namespace {
 
-using ScopedGENERAL_NAMES =
-    crypto::ScopedOpenSSL<GENERAL_NAMES, GENERAL_NAMES_free>;
-
 // Returns true if a given |cert_handle| is actually a valid X.509 certificate
 // handle.
 //
 // SecCertificateCreateFromData() does not always force the immediate parsing of
 // the certificate, and as such, may return a SecCertificateRef for an
 // invalid/unparsable certificate. Force parsing to occur to ensure that the
 // SecCertificateRef is correct. On later versions where
 // SecCertificateCreateFromData() immediately parses, rather than lazily, this
 // call is cheap, as the subject is cached.
 bool IsValidOSCertHandle(SecCertificateRef cert_handle) {
@@ skipping 60 matching lines @@
   x509_util::ParsePrincipalValueByNID(x509_name, NID_stateOrProvinceName,
                                       &principal->state_or_province_name);
   x509_util::ParsePrincipalValueByNID(x509_name, NID_countryName,
                                       &principal->country_name);
 }
 
 void ParseSubjectAltName(X509Certificate::OSCertHandle os_cert,
                          std::vector<std::string>* dns_names,
                          std::vector<std::string>* ip_addresses) {
   DCHECK(dns_names || ip_addresses);
-  ScopedX509 cert = OSCertHandleToOpenSSL(os_cert);
+  bssl::UniquePtr<X509> cert = OSCertHandleToOpenSSL(os_cert);
   if (!cert.get())
     return;
   int index = X509_get_ext_by_NID(cert.get(), NID_subject_alt_name, -1);
   X509_EXTENSION* alt_name_ext = X509_get_ext(cert.get(), index);
   if (!alt_name_ext)
     return;
 
-  ScopedGENERAL_NAMES alt_names(
+  bssl::UniquePtr<GENERAL_NAMES> alt_names(
       reinterpret_cast<GENERAL_NAMES*>(X509V3_EXT_d2i(alt_name_ext)));
   if (!alt_names.get())
     return;
 
   for (size_t i = 0; i < sk_GENERAL_NAME_num(alt_names.get()); ++i) {
     const GENERAL_NAME* name = sk_GENERAL_NAME_value(alt_names.get(), i);
     if (name->type == GEN_DNS && dns_names) {
       const unsigned char* dns_name = ASN1_STRING_data(name->d.dNSName);
       if (!dns_name)
         continue;
@@ skipping 12 matching lines @@
         // net mask hence 8 or 32 bytes. Logging to help diagnose any mixup.
         LOG(WARNING) << "Bad sized IP Address in cert: " << ip_addr_len;
         continue;
       }
       ip_addresses->push_back(
           std::string(reinterpret_cast<const char*>(ip_addr), ip_addr_len));
     }
   }
 }
 
-// Used to free a list of X509_NAMEs and the objects it points to.
-void sk_X509_NAME_free_all(STACK_OF(X509_NAME) * sk) {
-  sk_X509_NAME_pop_free(sk, X509_NAME_free);
-}
-
 }  // namespace
 
 // static
 X509Certificate::OSCertHandle X509Certificate::DupOSCertHandle(
     OSCertHandle handle) {
   if (!handle)
     return nullptr;
   return reinterpret_cast<OSCertHandle>(const_cast<void*>(CFRetain(handle)));
 }
 
 // static
 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) {
   if (cert_handle)
     CFRelease(cert_handle);
 }
 
 void X509Certificate::Initialize() {
   crypto::EnsureOpenSSLInit();
-  ScopedX509 x509_cert = OSCertHandleToOpenSSL(cert_handle_);
+  bssl::UniquePtr<X509> x509_cert = OSCertHandleToOpenSSL(cert_handle_);
   if (!x509_cert)
     return;
   ASN1_INTEGER* serial_num = X509_get_serialNumber(x509_cert.get());
   if (serial_num) {
     // ASN1_INTEGERS represent the decoded number, in a format internal to
     // OpenSSL. Most notably, this may have leading zeroes stripped off for
     // numbers whose first byte is >= 0x80. Thus, it is necessary to
     // re-encoded the integer back into DER, which is what the interface
     // of X509Certificate exposes, to ensure callers get the proper (DER)
     // value.
@@ skipping 148 matching lines @@
       reinterpret_cast<const char*>(CFDataGetBytePtr(cert_data)),
       CFDataGetLength(cert_data));
 }
 
 // static
 void X509Certificate::GetPublicKeyInfo(OSCertHandle os_cert,
                                        size_t* size_bits,
                                        PublicKeyType* type) {
   *type = kPublicKeyTypeUnknown;
   *size_bits = 0;
-  ScopedX509 cert = OSCertHandleToOpenSSL(os_cert);
+  bssl::UniquePtr<X509> cert = OSCertHandleToOpenSSL(os_cert);
   if (!cert)
     return;
-  crypto::ScopedEVP_PKEY scoped_key(X509_get_pubkey(cert.get()));
+  bssl::UniquePtr<EVP_PKEY> scoped_key(X509_get_pubkey(cert.get()));
   if (!scoped_key)
     return;
 
   EVP_PKEY* key = scoped_key.get();
 
   switch (key->type) {
     case EVP_PKEY_RSA:
       *type = kPublicKeyTypeRSA;
       break;
     case EVP_PKEY_DSA:
@@ skipping 26 matching lines @@
   return cert_list;
 }
 
 bool X509Certificate::IsIssuedByEncoded(
     const std::vector<std::string>& valid_issuers) {
   if (valid_issuers.empty())
     return false;
 
   // Convert to a temporary list of X509_NAME objects.
   // It will own the objects it points to.
-  crypto::ScopedOpenSSL<STACK_OF(X509_NAME), sk_X509_NAME_free_all>
-      issuer_names(sk_X509_NAME_new_null());
+  bssl::UniquePtr<STACK_OF(X509_NAME)> issuer_names(sk_X509_NAME_new_null());

[eroman, 2016/10/10 22:45:55]

The STACK_OF() stuff is kind of inscrutable to me.
I will take your word for now that this is an exact translation, and check this
after I educate myself more...

[davidben, 2016/10/10 23:24:40]

Fake C templates. :-) You can basically pretend it says STACK_OF<X509_NAME>.
Unfortunately OpenSSL doesn't distinguish between the moral equivalent of
std::vector<bssl::UniquePtr<X509_NAME>> and std::vector<X509_NAME*>. The scopers
assume you want the former.

   if (!issuer_names)
     return false;
 
   for (std::vector<std::string>::const_iterator it = valid_issuers.begin();
        it != valid_issuers.end(); ++it) {
     const unsigned char* p = reinterpret_cast<const unsigned char*>(it->data());
     long len = static_cast<long>(it->length());
     X509_NAME* ca_name = d2i_X509_NAME(nullptr, &p, len);
     if (ca_name == nullptr)
       return false;
     sk_X509_NAME_push(issuer_names.get(), ca_name);
   }
 
-  ScopedX509 x509_cert = OSCertHandleToOpenSSL(cert_handle_);
+  bssl::UniquePtr<X509> x509_cert = OSCertHandleToOpenSSL(cert_handle_);
   if (!x509_cert)
     return false;
   X509_NAME* cert_issuer = X509_get_issuer_name(x509_cert.get());
   if (cert_issuer == nullptr)
     return false;
 
   for (size_t m = 0; m < sk_X509_NAME_num(issuer_names.get()); ++m) {
     X509_NAME* issuer = sk_X509_NAME_value(issuer_names.get(), m);
     if (X509_NAME_cmp(issuer, cert_issuer) == 0) {
       return true;
     }
   }
 
   for (OSCertHandles::iterator it = intermediate_ca_certs_.begin();
        it != intermediate_ca_certs_.end(); ++it) {
-    ScopedX509 intermediate_cert = OSCertHandleToOpenSSL(*it);
+    bssl::UniquePtr<X509> intermediate_cert = OSCertHandleToOpenSSL(*it);
     if (!intermediate_cert)
       return false;
     cert_issuer = X509_get_issuer_name(intermediate_cert.get());
     if (cert_issuer == nullptr)
       return false;
 
     for (size_t m = 0; m < sk_X509_NAME_num(issuer_names.get()); ++m) {
       X509_NAME* issuer = sk_X509_NAME_value(issuer_names.get(), m);
       if (X509_NAME_cmp(issuer, cert_issuer) == 0) {
         return true;
       }
     }
   }
 
   return false;
 }
 
 // static
 bool X509Certificate::IsSelfSigned(OSCertHandle os_cert) {
-  ScopedX509 cert = OSCertHandleToOpenSSL(os_cert);
+  bssl::UniquePtr<X509> cert = OSCertHandleToOpenSSL(os_cert);
   if (!cert)
     return false;
-  crypto::ScopedEVP_PKEY scoped_key(X509_get_pubkey(cert.get()));
+  bssl::UniquePtr<EVP_PKEY> scoped_key(X509_get_pubkey(cert.get()));
   if (!scoped_key)
     return false;
   if (!X509_verify(cert.get(), scoped_key.get()))
     return false;
   return X509_check_issued(cert.get(), cert.get()) == X509_V_OK;
 }
 
 }  // namespace net