Use BoringSSL scopers in //net.

net/socket/ssl_client_socket_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_impl.h"
 
 #include <errno.h>
 #include <openssl/bio.h>
 #include <openssl/bytestring.h>
 #include <openssl/err.h>
@@ skipping 12 matching lines @@
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread_local.h"
 #include "base/trace_event/trace_event.h"
 #include "base/values.h"
-#include "crypto/auto_cbb.h"
 #include "crypto/ec_private_key.h"
 #include "crypto/openssl_util.h"
-#include "crypto/scoped_openssl_types.h"
 #include "net/base/ip_address.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/ct_ev_whitelist.h"
 #include "net/cert/ct_policy_enforcer.h"
 #include "net/cert/ct_policy_status.h"
 #include "net/cert/ct_verifier.h"
 #include "net/cert/x509_certificate_net_log_param.h"
 #include "net/cert/x509_util_openssl.h"
 #include "net/http/transport_security_state.h"
 #include "net/log/net_log.h"
 #include "net/log/net_log_event_type.h"
 #include "net/log/net_log_parameters_callback.h"
-#include "net/ssl/scoped_openssl_types.h"
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/ssl/ssl_cipher_suite_names.h"
 #include "net/ssl/ssl_client_session_cache.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "net/ssl/ssl_info.h"
 #include "net/ssl/ssl_private_key.h"
 #include "net/ssl/token_binding.h"
 
 #if !defined(OS_NACL)
 #include "net/ssl/ssl_key_logger.h"
@@ skipping 290 matching lines @@
 #if !defined(OS_NACL)
   static void KeyLogCallback(const SSL* ssl, const char* line) {
     GetInstance()->ssl_key_logger_->WriteLine(line);
   }
 #endif
 
   // This is the index used with SSL_get_ex_data to retrieve the owner
   // SSLClientSocketImpl object from an SSL instance.
   int ssl_socket_data_index_;
 
-  ScopedSSL_CTX ssl_ctx_;
+  bssl::UniquePtr<SSL_CTX> ssl_ctx_;
 
 #if !defined(OS_NACL)
   std::unique_ptr<SSLKeyLogger> ssl_key_logger_;
 #endif
 
   // TODO(davidben): Use a separate cache per URLRequestContext.
   // https://crbug.com/458365
   //
   // TODO(davidben): Sessions should be invalidated on fatal
   // alerts. https://crbug.com/466352
@@ skipping 38 matching lines @@
   }
 
   bool empty() const { return size() == 0; }
 
   X509* Get(size_t index) const {
     DCHECK_LT(index, size());
     return sk_X509_value(openssl_chain_.get(), index);
   }
 
  private:
-  ScopedX509Stack openssl_chain_;
+  bssl::UniquePtr<STACK_OF(X509)> openssl_chain_;
 };
 
 SSLClientSocketImpl::PeerCertificateChain&
 SSLClientSocketImpl::PeerCertificateChain::operator=(
     const PeerCertificateChain& other) {
   if (this == &other)
     return *this;
 
   openssl_chain_.reset(X509_chain_up_ref(other.openssl_chain_.get()));
   return *this;
@@ skipping 54 matching lines @@
       transport_write_error_(OK),
       server_cert_chain_(new PeerCertificateChain(NULL)),
       completed_connect_(false),
       was_ever_used_(false),
       cert_verifier_(context.cert_verifier),
       cert_transparency_verifier_(context.cert_transparency_verifier),
       channel_id_service_(context.channel_id_service),
       tb_was_negotiated_(false),
       tb_negotiated_param_(TB_PARAM_ECDSAP256),
       tb_signature_map_(10),
-      ssl_(NULL),
-      transport_bio_(NULL),
       transport_(std::move(transport_socket)),
       host_and_port_(host_and_port),
       ssl_config_(ssl_config),
       ssl_session_cache_shard_(context.ssl_session_cache_shard),
       next_handshake_state_(STATE_NONE),
       disconnected_(false),
       negotiated_protocol_(kProtoUnknown),
       channel_id_sent_(false),
       certificate_verified_(false),
       certificate_requested_(false),
@@ skipping 41 matching lines @@
   if (!key->ExportRawPublicKey(&raw_public_key))
     return ERR_FAILED;
   auto it = tb_signature_map_.Get(std::make_pair(tb_type, raw_public_key));
   if (it != tb_signature_map_.end()) {
     *out = it->second;
     return OK;
   }
 
   uint8_t tb_ekm_buf[32];
   static const char kTokenBindingExporterLabel[] = "EXPORTER-Token-Binding";
-  if (!SSL_export_keying_material(ssl_, tb_ekm_buf, sizeof(tb_ekm_buf),
+  if (!SSL_export_keying_material(ssl_.get(), tb_ekm_buf, sizeof(tb_ekm_buf),
                                   kTokenBindingExporterLabel,
                                   strlen(kTokenBindingExporterLabel), nullptr,
                                   0, false /* no context */)) {
     return ERR_FAILED;
   }
 
   if (!CreateTokenBindingSignature(
           base::StringPiece(reinterpret_cast<char*>(tb_ekm_buf),
                             sizeof(tb_ekm_buf)),
           tb_type, key, out))
@@ skipping 11 matching lines @@
                                               bool has_context,
                                               const base::StringPiece& context,
                                               unsigned char* out,
                                               unsigned int outlen) {
   if (!IsConnected())
     return ERR_SOCKET_NOT_CONNECTED;
 
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
 
   if (!SSL_export_keying_material(
-          ssl_, out, outlen, label.data(), label.size(),
+          ssl_.get(), out, outlen, label.data(), label.size(),
           reinterpret_cast<const unsigned char*>(context.data()),
           context.length(), has_context ? 1 : 0)) {
     LOG(ERROR) << "Failed to export keying material.";
     return ERR_FAILED;
   }
 
   return OK;
 }
 
 int SSLClientSocketImpl::Connect(const CompletionCallback& callback) {
   // Although StreamSocket does allow calling Connect() after Disconnect(),
   // this has never worked for layered sockets. CHECK to detect any consumers
   // reconnecting an SSL socket.
   //
   // TODO(davidben,mmenke): Remove this API feature. See
   // https://crbug.com/499289.
   CHECK(!disconnected_);
 
   net_log_.BeginEvent(NetLogEventType::SSL_CONNECT);
 
   // Set up new ssl object.
   int rv = Init();
   if (rv != OK) {
     LogConnectEndEvent(rv);
     return rv;
   }
 
   // Set SSL to client mode. Handshake happens in the loop below.
-  SSL_set_connect_state(ssl_);
+  SSL_set_connect_state(ssl_.get());
 
   next_handshake_state_ = STATE_HANDSHAKE;
   rv = DoHandshakeLoop(OK);
   if (rv == ERR_IO_PENDING) {
     user_connect_callback_ = callback;
   } else {
     LogConnectEndEvent(rv);
   }
 
   return rv > OK ? OK : rv;
 }
 
 void SSLClientSocketImpl::Disconnect() {
   crypto::OpenSSLErrStackTracer tracer(FROM_HERE);
 
   if (ssl_) {
     // Calling SSL_shutdown prevents the session from being marked as
     // unresumable.
-    SSL_shutdown(ssl_);
-    SSL_free(ssl_);
-    ssl_ = NULL;
+    SSL_shutdown(ssl_.get());
+    ssl_.reset();
   }
-  if (transport_bio_) {
-    BIO_free_all(transport_bio_);
-    transport_bio_ = NULL;
-  }
+  transport_bio_.reset();
 
   disconnected_ = true;
 
   // Shut down anything that may call us back.
   cert_verifier_request_.reset();
   transport_->socket()->Disconnect();
 
   // Null all callbacks, delete all buffers.
   transport_send_busy_ = false;
   send_buffer_ = NULL;
@@ skipping 55 matching lines @@
   if (user_read_buf_.get() || user_write_buf_.get())
     return false;
 
   // If there is data read from the network that has not yet been consumed, do
   // not treat the connection as idle.
   //
   // Note that this does not check |BIO_pending|, whether there is ciphertext
   // that has not yet been flushed to the network. |Write| returns early, so
   // this can cause race conditions which cause a socket to not be treated
   // reusable when it should be. See https://crbug.com/466147.
-  if (BIO_wpending(transport_bio_) > 0)
+  if (BIO_wpending(transport_bio_.get()) > 0)
     return false;
 
   return transport_->socket()->IsConnectedAndIdle();
 }
 
 int SSLClientSocketImpl::GetPeerAddress(IPEndPoint* addressList) const {
   return transport_->socket()->GetPeerAddress(addressList);
 }
 
 int SSLClientSocketImpl::GetLocalAddress(IPEndPoint* addressList) const {
@@ skipping 47 matching lines @@
   ssl_info->client_cert_sent =
       ssl_config_.send_client_cert && ssl_config_.client_cert.get();
   ssl_info->channel_id_sent = channel_id_sent_;
   ssl_info->token_binding_negotiated = tb_was_negotiated_;
   ssl_info->token_binding_key_param = tb_negotiated_param_;
   ssl_info->pinning_failure_log = pinning_failure_log_;
   ssl_info->ocsp_result = server_cert_verify_result_.ocsp_result;
 
   AddCTInfoToSSLInfo(ssl_info);
 
-  const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_);
+  const SSL_CIPHER* cipher = SSL_get_current_cipher(ssl_.get());
   CHECK(cipher);
   ssl_info->security_bits = SSL_CIPHER_get_bits(cipher, NULL);
   // Historically, the "group" was known as "curve".
-  ssl_info->key_exchange_group = SSL_get_curve_id(ssl_);
+  ssl_info->key_exchange_group = SSL_get_curve_id(ssl_.get());
 
   SSLConnectionStatusSetCipherSuite(
       static_cast<uint16_t>(SSL_CIPHER_get_id(cipher)),
       &ssl_info->connection_status);
-  SSLConnectionStatusSetVersion(GetNetSSLVersion(ssl_),
+  SSLConnectionStatusSetVersion(GetNetSSLVersion(ssl_.get()),
                                 &ssl_info->connection_status);
 
-  if (!SSL_get_secure_renegotiation_support(ssl_))
+  if (!SSL_get_secure_renegotiation_support(ssl_.get()))
     ssl_info->connection_status |= SSL_CONNECTION_NO_RENEGOTIATION_EXTENSION;
 
-  ssl_info->handshake_type = SSL_session_reused(ssl_)
+  ssl_info->handshake_type = SSL_session_reused(ssl_.get())
                                  ? SSLInfo::HANDSHAKE_RESUME
                                  : SSLInfo::HANDSHAKE_FULL;
 
   return true;
 }
 
 void SSLClientSocketImpl::GetConnectionAttempts(ConnectionAttempts* out) const {
   out->clear();
 }
 
@@ skipping 57 matching lines @@
   if (ssl_config_.cert_io_enabled) {
     // TODO(davidben): Move this out of SSLClientSocket. See
     // https://crbug.com/539520.
     EnsureNSSHttpIOInit();
   }
 #endif
 
   SSLContext* context = SSLContext::GetInstance();
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
 
-  ssl_ = SSL_new(context->ssl_ctx());
-  if (!ssl_ || !context->SetClientSocketForSSL(ssl_, this))
+  ssl_.reset(SSL_new(context->ssl_ctx()));
+  if (!ssl_ || !context->SetClientSocketForSSL(ssl_.get(), this))
     return ERR_UNEXPECTED;
 
   // SNI should only contain valid DNS hostnames, not IP addresses (see RFC
   // 6066, Section 3).
   //
   // TODO(rsleevi): Should this code allow hostnames that violate the LDH rule?
   // See https://crbug.com/496472 and https://crbug.com/496468 for discussion.
   IPAddress unused;
   if (!unused.AssignFromIPLiteral(host_and_port_.host()) &&
-      !SSL_set_tlsext_host_name(ssl_, host_and_port_.host().c_str())) {
+      !SSL_set_tlsext_host_name(ssl_.get(), host_and_port_.host().c_str())) {
     return ERR_UNEXPECTED;
   }
 
-  ScopedSSL_SESSION session =
+  bssl::UniquePtr<SSL_SESSION> session =
       context->session_cache()->Lookup(GetSessionCacheKey());
   if (session)
-    SSL_set_session(ssl_, session.get());
+    SSL_set_session(ssl_.get(), session.get());
 
   // Get read and write buffer sizes from field trials, if possible. If values
   // not present, use default.  Also make sure values are in reasonable range.
   int send_buffer_size = kDefaultOpenSSLBufferSize;
 #if !defined(OS_NACL)
   int override_send_buffer_size;
   if (base::StringToInt(base::FieldTrialList::FindFullName("SSLBufferSizeSend"),
                         &override_send_buffer_size)) {
     send_buffer_size = override_send_buffer_size;
     send_buffer_size = std::max(send_buffer_size, 1000);
@@ skipping 14 matching lines @@
     recv_buffer_size =
         std::min(recv_buffer_size, 2 * kDefaultOpenSSLBufferSize);
   }
 #endif  // !defined(OS_NACL)
   recv_buffer_ = new GrowableIOBuffer();
   recv_buffer_->SetCapacity(recv_buffer_size);
 
   BIO* ssl_bio = NULL;
 
   // SSLClientSocketImpl retains ownership of the BIO buffers.
+  BIO* transport_bio_raw;
   if (!BIO_new_bio_pair_external_buf(
           &ssl_bio, send_buffer_->capacity(),
-          reinterpret_cast<uint8_t*>(send_buffer_->data()), &transport_bio_,
+          reinterpret_cast<uint8_t*>(send_buffer_->data()), &transport_bio_raw,
           recv_buffer_->capacity(),
           reinterpret_cast<uint8_t*>(recv_buffer_->data())))
     return ERR_UNEXPECTED;
+  transport_bio_.reset(transport_bio_raw);
   DCHECK(ssl_bio);
   DCHECK(transport_bio_);
 
   // Install a callback on OpenSSL's end to plumb transport errors through.
   BIO_set_callback(ssl_bio, &SSLClientSocketImpl::BIOCallback);
   BIO_set_callback_arg(ssl_bio, reinterpret_cast<char*>(this));
 
-  SSL_set_bio(ssl_, ssl_bio, ssl_bio);
+  SSL_set_bio(ssl_.get(), ssl_bio, ssl_bio);
 
   DCHECK_LT(SSL3_VERSION, ssl_config_.version_min);
   DCHECK_LT(SSL3_VERSION, ssl_config_.version_max);
-  if (!SSL_set_min_proto_version(ssl_, ssl_config_.version_min) ||
-      !SSL_set_max_proto_version(ssl_, ssl_config_.version_max)) {
+  if (!SSL_set_min_proto_version(ssl_.get(), ssl_config_.version_min) ||
+      !SSL_set_max_proto_version(ssl_.get(), ssl_config_.version_max)) {
     return ERR_UNEXPECTED;
   }
 
   // OpenSSL defaults some options to on, others to off. To avoid ambiguity,
   // set everything we care about to an absolute value.
   SslSetClearMask options;
   options.ConfigureFlag(SSL_OP_NO_COMPRESSION, true);
 
   // TODO(joth): Set this conditionally, see http://crbug.com/55410
   options.ConfigureFlag(SSL_OP_LEGACY_SERVER_CONNECT, true);
 
-  SSL_set_options(ssl_, options.set_mask);
-  SSL_clear_options(ssl_, options.clear_mask);
+  SSL_set_options(ssl_.get(), options.set_mask);
+  SSL_clear_options(ssl_.get(), options.clear_mask);
 
   // Same as above, this time for the SSL mode.
   SslSetClearMask mode;
 
   mode.ConfigureFlag(SSL_MODE_RELEASE_BUFFERS, true);
   mode.ConfigureFlag(SSL_MODE_CBC_RECORD_SPLITTING, true);
 
   mode.ConfigureFlag(SSL_MODE_ENABLE_FALSE_START,
                      ssl_config_.false_start_enabled);
 
-  SSL_set_mode(ssl_, mode.set_mask);
-  SSL_clear_mode(ssl_, mode.clear_mask);
+  SSL_set_mode(ssl_.get(), mode.set_mask);
+  SSL_clear_mode(ssl_.get(), mode.clear_mask);
 
   // Use BoringSSL defaults, but disable HMAC-SHA256 and HMAC-SHA384 ciphers
   // (note that SHA256 and SHA384 only select legacy CBC ciphers). Also disable
   // DHE_RSA_WITH_AES_256_GCM_SHA384. Historically, AES_256_GCM was not
   // supported. As DHE is being deprecated, don't add a cipher only to remove it
   // immediately.
   std::string command;
   if (SSLClientSocket::IsPostQuantumExperimentEnabled()) {
     // These are experimental, non-standard ciphersuites.  They are part of an
     // experiment in post-quantum cryptography.  They're not intended to
@@ skipping 25 matching lines @@
 
   // Remove any disabled ciphers.
   for (uint16_t id : ssl_config_.disabled_cipher_suites) {
     const SSL_CIPHER* cipher = SSL_get_cipher_by_value(id);
     if (cipher) {
       command.append(":!");
       command.append(SSL_CIPHER_get_name(cipher));
     }
   }
 
-  int rv = SSL_set_cipher_list(ssl_, command.c_str());
+  int rv = SSL_set_cipher_list(ssl_.get(), command.c_str());
   // If this fails (rv = 0) it means there are no ciphers enabled on this SSL.
   // This will almost certainly result in the socket failing to complete the
   // handshake at which point the appropriate error is bubbled up to the client.
   LOG_IF(WARNING, rv != 1) << "SSL_set_cipher_list('" << command << "') "
                                                                     "returned "
                            << rv;
 
   // TLS channel ids.
   if (IsChannelIDEnabled()) {
-    SSL_enable_tls_channel_id(ssl_);
+    SSL_enable_tls_channel_id(ssl_.get());
   }
 
   if (!ssl_config_.alpn_protos.empty()) {
     std::vector<uint8_t> wire_protos =
         SerializeNextProtos(ssl_config_.alpn_protos);
-    SSL_set_alpn_protos(ssl_, wire_protos.empty() ? NULL : &wire_protos[0],
+    SSL_set_alpn_protos(ssl_.get(),
+                        wire_protos.empty() ? NULL : &wire_protos[0],
                         wire_protos.size());
   }
 
   if (ssl_config_.signed_cert_timestamps_enabled) {
-    SSL_enable_signed_cert_timestamps(ssl_);
-    SSL_enable_ocsp_stapling(ssl_);
+    SSL_enable_signed_cert_timestamps(ssl_.get());
+    SSL_enable_ocsp_stapling(ssl_.get());
   }
 
   if (cert_verifier_->SupportsOCSPStapling())
-    SSL_enable_ocsp_stapling(ssl_);
+    SSL_enable_ocsp_stapling(ssl_.get());
 
   return OK;
 }
 
 void SSLClientSocketImpl::DoReadCallback(int rv) {
   // Since Run may result in Read being called, clear |user_read_callback_|
   // up front.
   if (rv > 0)
     was_ever_used_ = true;
   user_read_buf_ = NULL;
@@ skipping 32 matching lines @@
     LAZY_INSTANCE_INITIALIZER;
 
 int SSLClientSocketImpl::DoHandshake() {
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
 
   int rv;
 
   // TODO(cbentzel): Leave only 1 call to SSL_do_handshake once crbug.com/424386
   // is fixed.
   if (ssl_config_.send_client_cert && ssl_config_.client_cert.get()) {
-    rv = SSL_do_handshake(ssl_);
+    rv = SSL_do_handshake(ssl_.get());
   } else {
     if (g_first_run_completed.Get().Get()) {
       // TODO(cbentzel): Remove ScopedTracker below once crbug.com/424386 is
       // fixed.
       tracked_objects::ScopedTracker tracking_profile(
           FROM_HERE_WITH_EXPLICIT_FUNCTION("424386 SSL_do_handshake()"));
 
-      rv = SSL_do_handshake(ssl_);
+      rv = SSL_do_handshake(ssl_.get());
     } else {
       g_first_run_completed.Get().Set(true);
-      rv = SSL_do_handshake(ssl_);
+      rv = SSL_do_handshake(ssl_.get());
     }
   }
 
   int net_error = OK;
   if (rv <= 0) {
-    int ssl_error = SSL_get_error(ssl_, rv);
+    int ssl_error = SSL_get_error(ssl_.get(), rv);
     if (ssl_error == SSL_ERROR_WANT_CHANNEL_ID_LOOKUP) {
       // The server supports channel ID. Stop to look one up before returning to
       // the handshake.
       next_handshake_state_ = STATE_CHANNEL_ID_LOOKUP;
       return OK;
     }
     if (ssl_error == SSL_ERROR_WANT_X509_LOOKUP &&
         !ssl_config_.send_client_cert) {
       return ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
     }
@@ skipping 26 matching lines @@
 int SSLClientSocketImpl::DoHandshakeComplete(int result) {
   if (result < 0)
     return result;
 
   // DHE is offered on the deprecated cipher fallback and then rejected
   // afterwards. This is to aid in diagnosing connection failures because a
   // server requires DHE ciphers.
   //
   // TODO(davidben): A few releases after DHE's removal, remove this logic.
   if (!ssl_config_.dhe_enabled &&
-      SSL_CIPHER_is_DHE(SSL_get_current_cipher(ssl_))) {
+      SSL_CIPHER_is_DHE(SSL_get_current_cipher(ssl_.get()))) {
     return ERR_SSL_OBSOLETE_CIPHER;
   }
 
   // Check that if token binding was negotiated, then extended master secret
   // and renegotiation indication must also be negotiated.
   if (tb_was_negotiated_ &&
-      !(SSL_get_extms_support(ssl_) &&
-        SSL_get_secure_renegotiation_support(ssl_))) {
+      !(SSL_get_extms_support(ssl_.get()) &&
+        SSL_get_secure_renegotiation_support(ssl_.get()))) {
     return ERR_SSL_PROTOCOL_ERROR;
   }
 
   const uint8_t* alpn_proto = NULL;
   unsigned alpn_len = 0;
-  SSL_get0_alpn_selected(ssl_, &alpn_proto, &alpn_len);
+  SSL_get0_alpn_selected(ssl_.get(), &alpn_proto, &alpn_len);
   if (alpn_len > 0) {
     base::StringPiece proto(reinterpret_cast<const char*>(alpn_proto),
                             alpn_len);
     negotiated_protocol_ = NextProtoFromString(proto);
   }
 
   RecordNegotiatedProtocol();
   RecordChannelIDSupport();
 
   const uint8_t* ocsp_response_raw;
   size_t ocsp_response_len;
-  SSL_get0_ocsp_response(ssl_, &ocsp_response_raw, &ocsp_response_len);
+  SSL_get0_ocsp_response(ssl_.get(), &ocsp_response_raw, &ocsp_response_len);
   std::string ocsp_response;
   if (ocsp_response_len > 0) {
     ocsp_response_.assign(reinterpret_cast<const char*>(ocsp_response_raw),
                           ocsp_response_len);
   }
   set_stapled_ocsp_response_received(ocsp_response_len != 0);
   UMA_HISTOGRAM_BOOLEAN("Net.OCSPResponseStapled", ocsp_response_len != 0);
 
   const uint8_t* sct_list;
   size_t sct_list_len;
-  SSL_get0_signed_cert_timestamp_list(ssl_, &sct_list, &sct_list_len);
+  SSL_get0_signed_cert_timestamp_list(ssl_.get(), &sct_list, &sct_list_len);
   set_signed_cert_timestamps_received(sct_list_len != 0);
 
   if (IsRenegotiationAllowed())
-    SSL_set_renegotiate_mode(ssl_, ssl_renegotiate_freely);
+    SSL_set_renegotiate_mode(ssl_.get(), ssl_renegotiate_freely);
 
-  uint16_t signature_algorithm = SSL_get_peer_signature_algorithm(ssl_);
+  uint16_t signature_algorithm = SSL_get_peer_signature_algorithm(ssl_.get());
   if (signature_algorithm != 0) {
     UMA_HISTOGRAM_SPARSE_SLOWLY("Net.SSLSignatureAlgorithm",
                                 signature_algorithm);
   }
 
   // Verify the certificate.
   UpdateServerCert();
   next_handshake_state_ = STATE_VERIFY_CERT;
   return OK;
 }
@@ skipping 14 matching lines @@
   net_log_.EndEvent(NetLogEventType::SSL_GET_CHANNEL_ID,
                     base::Bind(&NetLogChannelIDLookupCompleteCallback,
                                channel_id_key_.get(), result));
   if (result < 0)
     return result;
 
   // Hand the key to OpenSSL. Check for error in case OpenSSL rejects the key
   // type.
   DCHECK(channel_id_key_);
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
-  if (!SSL_set1_tls_channel_id(ssl_, channel_id_key_->key())) {
+  if (!SSL_set1_tls_channel_id(ssl_.get(), channel_id_key_->key())) {
     LOG(ERROR) << "Failed to set Channel ID.";
     return ERR_FAILED;
   }
 
   // Return to the handshake.
   channel_id_sent_ = true;
   next_handshake_state_ = STATE_HANDSHAKE;
   return OK;
 }
 
@@ skipping 94 matching lines @@
 
 void SSLClientSocketImpl::DoConnectCallback(int rv) {
   if (!user_connect_callback_.is_null()) {
     CompletionCallback c = user_connect_callback_;
     user_connect_callback_.Reset();
     c.Run(rv > OK ? OK : rv);
   }
 }
 
 void SSLClientSocketImpl::UpdateServerCert() {
-  server_cert_chain_->Reset(SSL_get_peer_cert_chain(ssl_));
+  server_cert_chain_->Reset(SSL_get_peer_cert_chain(ssl_.get()));
   server_cert_ = server_cert_chain_->AsOSChain();
   if (server_cert_.get()) {
     net_log_.AddEvent(NetLogEventType::SSL_CERTIFICATES_RECEIVED,
                       base::Bind(&NetLogX509CertificateCallback,
                                  base::Unretained(server_cert_.get())));
   }
 }
 
 void SSLClientSocketImpl::OnHandshakeIOComplete(int result) {
   int rv = DoHandshakeLoop(result);
@@ skipping 125 matching lines @@
                                            pending_read_error_info_));
     }
     pending_read_ssl_error_ = SSL_ERROR_NONE;
     pending_read_error_info_ = OpenSSLErrorInfo();
     return rv;
   }
 
   int total_bytes_read = 0;
   int ssl_ret;
   do {
-    ssl_ret = SSL_read(ssl_, user_read_buf_->data() + total_bytes_read,
+    ssl_ret = SSL_read(ssl_.get(), user_read_buf_->data() + total_bytes_read,
                        user_read_buf_len_ - total_bytes_read);
     if (ssl_ret > 0)
       total_bytes_read += ssl_ret;
   } while (total_bytes_read < user_read_buf_len_ && ssl_ret > 0);
 
   // Although only the final SSL_read call may have failed, the failure needs to
   // processed immediately, while the information still available in OpenSSL's
   // error queue.
   if (ssl_ret <= 0) {
     // A zero return from SSL_read may mean any of:
     // - The underlying BIO_read returned 0.
     // - The peer sent a close_notify.
     // - Any arbitrary error. https://crbug.com/466303
     //
     // TransportReadComplete converts the first to an ERR_CONNECTION_CLOSED
     // error, so it does not occur. The second and third are distinguished by
     // SSL_ERROR_ZERO_RETURN.
-    pending_read_ssl_error_ = SSL_get_error(ssl_, ssl_ret);
+    pending_read_ssl_error_ = SSL_get_error(ssl_.get(), ssl_ret);
     if (pending_read_ssl_error_ == SSL_ERROR_ZERO_RETURN) {
       pending_read_error_ = 0;
     } else if (pending_read_ssl_error_ == SSL_ERROR_WANT_X509_LOOKUP &&
                !ssl_config_.send_client_cert) {
       pending_read_error_ = ERR_SSL_CLIENT_AUTH_CERT_NEEDED;
     } else if (pending_read_ssl_error_ ==
                SSL_ERROR_WANT_PRIVATE_KEY_OPERATION) {
       DCHECK(ssl_config_.client_private_key);
       DCHECK_NE(kNoPendingResult, signature_result_);
       pending_read_error_ = ERR_IO_PENDING;
@@ skipping 38 matching lines @@
         CreateNetLogOpenSSLErrorCallback(rv, pending_read_ssl_error_,
                                          pending_read_error_info_));
     pending_read_ssl_error_ = SSL_ERROR_NONE;
     pending_read_error_info_ = OpenSSLErrorInfo();
   }
   return rv;
 }
 
 int SSLClientSocketImpl::DoPayloadWrite() {
   crypto::OpenSSLErrStackTracer err_tracer(FROM_HERE);
-  int rv = SSL_write(ssl_, user_write_buf_->data(), user_write_buf_len_);
+  int rv = SSL_write(ssl_.get(), user_write_buf_->data(), user_write_buf_len_);
 
   if (rv >= 0) {
     net_log_.AddByteTransferEvent(NetLogEventType::SSL_SOCKET_BYTES_SENT, rv,
                                   user_write_buf_->data());
     return rv;
   }
 
-  int ssl_error = SSL_get_error(ssl_, rv);
+  int ssl_error = SSL_get_error(ssl_.get(), rv);
   if (ssl_error == SSL_ERROR_WANT_PRIVATE_KEY_OPERATION)
     return ERR_IO_PENDING;
   OpenSSLErrorInfo error_info;
   int net_error = MapLastOpenSSLError(ssl_error, err_tracer, &error_info);
 
   if (net_error != ERR_IO_PENDING) {
     net_log_.AddEvent(
         NetLogEventType::SSL_WRITE_ERROR,
         CreateNetLogOpenSSLErrorCallback(net_error, ssl_error, error_info));
   }
@@ skipping 27 matching lines @@
     DoWriteCallback(rv_write);
 }
 
 int SSLClientSocketImpl::BufferSend(void) {
   if (transport_send_busy_)
     return ERR_IO_PENDING;
 
   size_t buffer_read_offset;
   uint8_t* read_buf;
   size_t max_read;
-  int status = BIO_zero_copy_get_read_buf(transport_bio_, &read_buf,
+  int status = BIO_zero_copy_get_read_buf(transport_bio_.get(), &read_buf,
                                           &buffer_read_offset, &max_read);
   DCHECK_EQ(status, 1);  // Should never fail.
   if (!max_read)
     return 0;  // Nothing pending in the OpenSSL write BIO.
   CHECK_EQ(read_buf, reinterpret_cast<uint8_t*>(send_buffer_->StartOfBuffer()));
   CHECK_LT(buffer_read_offset, static_cast<size_t>(send_buffer_->capacity()));
   send_buffer_->set_offset(buffer_read_offset);
 
   int rv = transport_->socket()->Write(
       send_buffer_.get(), max_read,
       base::Bind(&SSLClientSocketImpl::BufferSendComplete,
                  base::Unretained(this)));
   if (rv == ERR_IO_PENDING) {
     transport_send_busy_ = true;
   } else {
     TransportWriteComplete(rv);
   }
   return rv;
 }
 
 int SSLClientSocketImpl::BufferRecv(void) {
   if (transport_recv_busy_)
     return ERR_IO_PENDING;
 
   // Determine how much was requested from |transport_bio_| that was not
   // actually available.
-  size_t requested = BIO_ctrl_get_read_request(transport_bio_);
+  size_t requested = BIO_ctrl_get_read_request(transport_bio_.get());
   if (requested == 0) {
     // This is not a perfect match of error codes, as no operation is
     // actually pending. However, returning 0 would be interpreted as
     // a possible sign of EOF, which is also an inappropriate match.
     return ERR_IO_PENDING;
   }
 
   // Known Issue: While only reading |requested| data is the more correct
   // implementation, it has the downside of resulting in frequent reads:
   // One read for the SSL record header (~5 bytes) and one read for the SSL
   // record body. Rather than issuing these reads to the underlying socket
   // (and constantly allocating new IOBuffers), a single Read() request to
   // fill |transport_bio_| is issued. As long as an SSL client socket cannot
   // be gracefully shutdown (via SSL close alerts) and re-used for non-SSL
   // traffic, this over-subscribed Read()ing will not cause issues.
 
   size_t buffer_write_offset;
   uint8_t* write_buf;
   size_t max_write;
-  int status = BIO_zero_copy_get_write_buf(transport_bio_, &write_buf,
+  int status = BIO_zero_copy_get_write_buf(transport_bio_.get(), &write_buf,
                                            &buffer_write_offset, &max_write);
   DCHECK_EQ(status, 1);  // Should never fail.
   if (!max_write)
     return ERR_IO_PENDING;
 
   CHECK_EQ(write_buf,
            reinterpret_cast<uint8_t*>(recv_buffer_->StartOfBuffer()));
   CHECK_LT(buffer_write_offset, static_cast<size_t>(recv_buffer_->capacity()));
 
   recv_buffer_->set_offset(buffer_write_offset);
@@ skipping 23 matching lines @@
   DCHECK(ERR_IO_PENDING != result);
   int bytes_written = 0;
   if (result < 0) {
     // Record the error. Save it to be reported in a future read or write on
     // transport_bio_'s peer.
     transport_write_error_ = result;
   } else {
     bytes_written = result;
   }
   DCHECK_GE(send_buffer_->RemainingCapacity(), bytes_written);
-  int ret = BIO_zero_copy_get_read_buf_done(transport_bio_, bytes_written);
+  int ret =
+      BIO_zero_copy_get_read_buf_done(transport_bio_.get(), bytes_written);
   DCHECK_EQ(1, ret);
   transport_send_busy_ = false;
 }
 
 int SSLClientSocketImpl::TransportReadComplete(int result) {
   DCHECK(ERR_IO_PENDING != result);
   // If an EOF, canonicalize to ERR_CONNECTION_CLOSED here so MapOpenSSLError
   // does not report success.
   if (result == 0)
     result = ERR_CONNECTION_CLOSED;
   int bytes_read = 0;
   if (result < 0) {
     // Received an error. Save it to be reported in a future read on
     // transport_bio_'s peer.
     transport_read_error_ = result;
   } else {
     bytes_read = result;
   }
   DCHECK_GE(recv_buffer_->RemainingCapacity(), bytes_read);
-  int ret = BIO_zero_copy_get_write_buf_done(transport_bio_, bytes_read);
+  int ret = BIO_zero_copy_get_write_buf_done(transport_bio_.get(), bytes_read);
   DCHECK_EQ(1, ret);
   transport_recv_busy_ = false;
   return result;
 }
 
 int SSLClientSocketImpl::VerifyCT() {
   const uint8_t* sct_list_raw;
   size_t sct_list_len;
-  SSL_get0_signed_cert_timestamp_list(ssl_, &sct_list_raw, &sct_list_len);
+  SSL_get0_signed_cert_timestamp_list(ssl_.get(), &sct_list_raw, &sct_list_len);
   std::string sct_list;
   if (sct_list_len > 0)
     sct_list.assign(reinterpret_cast<const char*>(sct_list_raw), sct_list_len);
 
   // Note that this is a completely synchronous operation: The CT Log Verifier
   // gets all the data it needs for SCT verification and does not do any
   // external communication.
   cert_transparency_verifier_->Verify(
       server_cert_verify_result_.verified_cert.get(), ocsp_response_, sct_list,
       &ct_verify_result_, net_log_);
@@ skipping 36 matching lines @@
           server_cert_verify_result_.public_key_hashes)) {
     server_cert_verify_result_.cert_status |=
         CERT_STATUS_CERTIFICATE_TRANSPARENCY_REQUIRED;
     return ERR_CERTIFICATE_TRANSPARENCY_REQUIRED;
   }
 
   return OK;
 }
 
 int SSLClientSocketImpl::ClientCertRequestCallback(SSL* ssl) {
-  DCHECK(ssl == ssl_);
+  DCHECK(ssl == ssl_.get());
 
   net_log_.AddEvent(NetLogEventType::SSL_CLIENT_CERT_REQUESTED);
   certificate_requested_ = true;
 
   // Clear any currently configured certificates.
-  SSL_certs_clear(ssl_);
+  SSL_certs_clear(ssl_.get());
 
 #if defined(OS_IOS)
   // TODO(droger): Support client auth on iOS. See http://crbug.com/145954).
   LOG(WARNING) << "Client auth is not supported";
 #else   // !defined(OS_IOS)
   if (!ssl_config_.send_client_cert) {
     // First pass: we know that a client certificate is needed, but we do not
     // have one at hand.
     STACK_OF(X509_NAME)* authorities = SSL_get_client_CA_list(ssl);
     for (size_t i = 0; i < sk_X509_NAME_num(authorities); i++) {
@@ skipping 12 matching lines @@
       cert_key_types_.push_back(
           static_cast<SSLClientCertType>(client_cert_types[i]));
     }
 
     // Suspends handshake. SSL_get_error will return SSL_ERROR_WANT_X509_LOOKUP.
     return -1;
   }
 
   // Second pass: a client certificate should have been selected.
   if (ssl_config_.client_cert.get()) {
-    ScopedX509 leaf_x509 =
+    bssl::UniquePtr<X509> leaf_x509 =
         OSCertHandleToOpenSSL(ssl_config_.client_cert->os_cert_handle());
     if (!leaf_x509) {
       LOG(WARNING) << "Failed to import certificate";
       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT);
       return -1;
     }
 
-    ScopedX509Stack chain = OSCertHandlesToOpenSSL(
+    bssl::UniquePtr<STACK_OF(X509)> chain = OSCertHandlesToOpenSSL(
         ssl_config_.client_cert->GetIntermediateCertificates());
     if (!chain) {
       LOG(WARNING) << "Failed to import intermediate certificates";
       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT);
       return -1;
     }
 
-    if (!SSL_use_certificate(ssl_, leaf_x509.get()) ||
-        !SSL_set1_chain(ssl_, chain.get())) {
+    if (!SSL_use_certificate(ssl_.get(), leaf_x509.get()) ||
+        !SSL_set1_chain(ssl_.get(), chain.get())) {
       LOG(WARNING) << "Failed to set client certificate";
       return -1;
     }
 
     if (!ssl_config_.client_private_key) {
       // The caller supplied a null private key. Fail the handshake and surface
       // an appropriate error to the caller.
       LOG(WARNING) << "Client cert found without private key";
       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY);
       return -1;
     }
 
-    SSL_set_private_key_method(ssl_, &SSLContext::kPrivateKeyMethod);
+    SSL_set_private_key_method(ssl_.get(), &SSLContext::kPrivateKeyMethod);
 
     std::vector<SSLPrivateKey::Hash> digest_prefs =
         ssl_config_.client_private_key->GetDigestPreferences();
 
     size_t digests_len = digest_prefs.size();
     std::vector<int> digests;
     for (size_t i = 0; i < digests_len; i++) {
       switch (digest_prefs[i]) {
         case SSLPrivateKey::Hash::SHA1:
           digests.push_back(NID_sha1);
           break;
         case SSLPrivateKey::Hash::SHA256:
           digests.push_back(NID_sha256);
           break;
         case SSLPrivateKey::Hash::SHA384:
           digests.push_back(NID_sha384);
           break;
         case SSLPrivateKey::Hash::SHA512:
           digests.push_back(NID_sha512);
           break;
         case SSLPrivateKey::Hash::MD5_SHA1:
           // MD5-SHA1 is not used in TLS 1.2.
           break;
       }
     }
 
-    SSL_set_private_key_digest_prefs(ssl_, digests.data(), digests.size());
+    SSL_set_private_key_digest_prefs(ssl_.get(), digests.data(),
+                                     digests.size());
 
     int cert_count = 1 + sk_X509_num(chain.get());
     net_log_.AddEvent(NetLogEventType::SSL_CLIENT_CERT_PROVIDED,
                       NetLog::IntCallback("cert_count", cert_count));
     return 1;
   }
 #endif  // defined(OS_IOS)
 
   // Send no client certificate.
   net_log_.AddEvent(NetLogEventType::SSL_CLIENT_CERT_PROVIDED,
@@ skipping 218 matching lines @@
   // asynchronous private key operation.
   PumpReadWriteEvents();
 }
 
 int SSLClientSocketImpl::TokenBindingAdd(const uint8_t** out,
                                          size_t* out_len,
                                          int* out_alert_value) {
   if (ssl_config_.token_binding_params.empty()) {
     return 0;
   }
-  crypto::AutoCBB output;
+  bssl::ScopedCBB output;
   CBB parameters_list;
   if (!CBB_init(output.get(), 7) ||
       !CBB_add_u8(output.get(), kTbProtocolVersionMajor) ||
       !CBB_add_u8(output.get(), kTbProtocolVersionMinor) ||
       !CBB_add_u8_length_prefixed(output.get(), &parameters_list)) {
     *out_alert_value = SSL_AD_INTERNAL_ERROR;
     return -1;
   }
   for (size_t i = 0; i < ssl_config_.token_binding_params.size(); ++i) {
     if (!CBB_add_u8(&parameters_list, ssl_config_.token_binding_params[i])) {
@@ skipping 128 matching lines @@
     if (ERR_GET_REASON(info->error_code) == SSL_R_TLSV1_ALERT_ACCESS_DENIED &&
         !certificate_requested_) {
       net_error = ERR_SSL_PROTOCOL_ERROR;
     }
   }
 
   return net_error;
 }
 
 }  // namespace net