Add X509CertificateBytes which uses CRYPTO_BUFFER instead of macOS-native certificate types.

net/cert/internal/trust_store_mac.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/trust_store_mac.h"
 
 #include <Security/Security.h>
 
 #include "base/logging.h"
 #include "base/mac/foundation_util.h"
 #include "base/mac/mac_logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/synchronization/lock.h"
 #include "crypto/mac_security_services_lock.h"
 #include "net/cert/internal/cert_errors.h"
 #include "net/cert/internal/parse_name.h"
 #include "net/cert/internal/parsed_certificate.h"
 #include "net/cert/test_keychain_search_list_mac.h"
-#include "net/cert/x509_certificate.h"
 #include "net/cert/x509_util.h"
+#include "net/cert/x509_util_mac.h"
 
 namespace net {
 
 namespace {
 
 // The rules for interpreting trust settings are documented at:
 // https://developer.apple.com/reference/security/1400261-sectrustsettingscopytrustsetting?language=objc
 
 // Indicates the trust status of a certificate.
 enum class TrustStatus {
@@ skipping 108 matching lines @@
     if (trust != TrustStatus::UNSPECIFIED)
       return trust;
   }
   return TrustStatus::UNSPECIFIED;
 }
 
 // Returns true if the certificate |cert_handle| is trusted for the policy
 // |policy_oid|.
 TrustStatus IsSecCertificateTrustedForPolicy(SecCertificateRef cert_handle,
                                              const CFStringRef policy_oid) {
-  const bool is_self_signed = X509Certificate::IsSelfSigned(cert_handle);
+  const bool is_self_signed = x509_util::IsSelfSigned(cert_handle);
   // Evaluate trust domains in user, admin, system order. Admin settings can
   // override system ones, and user settings can override both admin and system.
   for (const auto& trust_domain :
        {kSecTrustSettingsDomainUser, kSecTrustSettingsDomainAdmin,
         kSecTrustSettingsDomainSystem}) {
     base::ScopedCFTypeRef<CFArrayRef> trust_settings;
     OSStatus err;
     {
       base::AutoLock lock(crypto::GetMacSecurityServicesLock());
       err = SecTrustSettingsCopyTrustSettings(cert_handle, trust_domain,
@@ skipping 153 matching lines @@
   return matching_items;
 }
 
 // static
 base::ScopedCFTypeRef<CFDataRef> TrustStoreMac::GetMacNormalizedIssuer(
     const scoped_refptr<ParsedCertificate>& cert) {
   base::ScopedCFTypeRef<CFDataRef> name_data;
   // There does not appear to be any public API to get the normalized version
   // of a Name without creating a SecCertificate.
   base::ScopedCFTypeRef<SecCertificateRef> cert_handle(
-      X509Certificate::CreateOSCertHandleFromBytes(
-          cert->der_cert().AsStringPiece().data(), cert->der_cert().Length()));
+      x509_util::CreateSecCertificateFromBytes(cert->der_cert().UnsafeData(),
+                                               cert->der_cert().Length()));
   if (!cert_handle) {
     LOG(ERROR) << "CreateOSCertHandleFromBytes";
     return name_data;
   }
   {
     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
     name_data.reset(
         SecCertificateCopyNormalizedIssuerContent(cert_handle, nullptr));
   }
   if (!name_data)
     LOG(ERROR) << "SecCertificateCopyNormalizedIssuerContent";
   return name_data;
 }
 
 void TrustStoreMac::FindTrustAnchorsByMacNormalizedSubject(
     CFDataRef name_data,
     TrustAnchors* out_anchors) const {
   base::ScopedCFTypeRef<CFArrayRef> scoped_matching_items =
       FindMatchingCertificatesForMacNormalizedSubject(name_data);
   if (!scoped_matching_items)
     return;
 
   FilterTrustedCertificates(scoped_matching_items.get(), policy_oid_,
                             out_anchors);
 }
 
 }  // namespace net