Add X509CertificateBytes which uses CRYPTO_BUFFER instead of macOS-native certificate types.

net/cert/x509_certificate_mac.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/Security.h>
 
@@ skipping 99 matching lines @@
   OSStatus status = cached_cert.GetField(&CSSMOID_X509V1SerialNumber,
                                          &serial_number);
   if (status || !serial_number.field())
     return std::string();
 
   return std::string(
       reinterpret_cast<const char*>(serial_number.field()->Data),
       serial_number.field()->Length);
 }
 
-// Test that a given |cert_handle| is actually a valid X.509 certificate, and
-// return true if it is.
-//
-// On OS X, SecCertificateCreateFromData() does not return any errors if
-// called with invalid data, as long as data is present. The actual decoding
-// of the certificate does not happen until an API that requires a CSSM
-// handle is called. While SecCertificateGetCLHandle is the most likely
-// candidate, as it performs the parsing, it does not check whether the
-// parsing was actually successful. Instead, SecCertificateGetSubject is
-// used (supported since 10.3), as a means to check that the certificate
-// parsed as a valid X.509 certificate.
-bool IsValidOSCertHandle(SecCertificateRef cert_handle) {
-  const CSSM_X509_NAME* sanity_check = NULL;
-  OSStatus status = SecCertificateGetSubject(cert_handle, &sanity_check);
-  return status == noErr && sanity_check;
-}
-
 // Parses |data| of length |length|, attempting to decode it as the specified
 // |format|. If |data| is in the specified format, any certificates contained
 // within are stored into |output|.
 void AddCertificatesFromBytes(const char* data, size_t length,
                               SecExternalFormat format,
                               X509Certificate::OSCertHandles* output) {
   SecExternalFormat input_format = format;
   ScopedCFTypeRef<CFDataRef> local_data(CFDataCreateWithBytesNoCopy(
       kCFAllocatorDefault, reinterpret_cast<const UInt8*>(data),
       base::checked_cast<CFIndex>(length), kCFAllocatorNull));
@@ skipping 28 matching lines @@
       // encoded, attempting to decode data based on internal rules for PEM
       // block headers. If a PKCS#7 blob is encoded with a PEM block of
       // CERTIFICATE, OS X 10.5 will return a single, invalid certificate
       // based on the decoded data. If this happens, the certificate should
       // not be included in |output|. Because |output| is empty,
       // CreateCertificateListfromBytes will use PEMTokenizer to decode the
       // data. When called again with the decoded data, OS X will honor
       // |input_format|, causing decode to succeed. On OS X 10.6, the data
       // is properly decoded as a PKCS#7, whether PEM or not, which avoids
       // the need to fallback to internal decoding.
-      if (IsValidOSCertHandle(cert)) {
+      if (x509_util::IsValidSecCertificate(cert)) {
         CFRetain(cert);
         output->push_back(cert);
       }
     }
   }
 }
 
 }  // namespace
 
 bool X509Certificate::Initialize() {
@@ skipping 95 matching lines @@
 bool X509Certificate::IsSameOSCert(X509Certificate::OSCertHandle a,
                                    X509Certificate::OSCertHandle b) {
   DCHECK(a && b);
   return CFEqual(a, b);
 }
 
 // static
 X509Certificate::OSCertHandle X509Certificate::CreateOSCertHandleFromBytes(
     const char* data,
     size_t length) {
-  CSSM_DATA cert_data;
-  cert_data.Data = const_cast<uint8_t*>(reinterpret_cast<const uint8_t*>(data));
-  cert_data.Length = length;
-
-  OSCertHandle cert_handle = NULL;
-  OSStatus status = SecCertificateCreateFromData(&cert_data,
-                                                 CSSM_CERT_X_509v3,
-                                                 CSSM_CERT_ENCODING_DER,
-                                                 &cert_handle);
-  if (status != noErr)
-    return NULL;
-  if (!IsValidOSCertHandle(cert_handle)) {
-    CFRelease(cert_handle);
-    return NULL;
-  }
-  return cert_handle;
+  return x509_util::CreateSecCertificateFromBytes(
+             reinterpret_cast<const uint8_t*>(data), length)
+      .release();
 }
 
 // static
 X509Certificate::OSCertHandles X509Certificate::CreateOSCertHandlesFromBytes(
     const char* data,
     size_t length,
     Format format) {
   OSCertHandles results;
 
   switch (format) {
@@ skipping 23 matching lines @@
 }
 
 // static
 void X509Certificate::FreeOSCertHandle(OSCertHandle cert_handle) {
   if (cert_handle)
     CFRelease(cert_handle);
 }
 
 // static
 SHA256HashValue X509Certificate::CalculateFingerprint256(OSCertHandle cert) {
-  SHA256HashValue sha256;
-  memset(sha256.data, 0, sizeof(sha256.data));
-
-  CSSM_DATA cert_data;
-  OSStatus status = SecCertificateGetData(cert, &cert_data);
-  if (status)
-    return sha256;
-
-  DCHECK(cert_data.Data);
-  DCHECK_NE(cert_data.Length, 0U);
-
-  CC_SHA256(cert_data.Data, cert_data.Length, sha256.data);
-
-  return sha256;
+  return x509_util::CalculateFingerprint256(cert);
 }
 
 // static
 SHA256HashValue X509Certificate::CalculateCAFingerprint256(
     const OSCertHandles& intermediates) {
   SHA256HashValue sha256;
   memset(sha256.data, 0, sizeof(sha256.data));
 
   // The CC_SHA(3cc) man page says all CC_SHA256_xxx routines return 1, so
   // we don't check their return values.
   CC_SHA256_CTX sha256_ctx;
   CC_SHA256_Init(&sha256_ctx);
   CSSM_DATA cert_data;
   for (size_t i = 0; i < intermediates.size(); ++i) {
     OSStatus status = SecCertificateGetData(intermediates[i], &cert_data);
     if (status)
       return sha256;
     CC_SHA256_Update(&sha256_ctx, cert_data.Data, cert_data.Length);
   }
   CC_SHA256_Final(sha256.data, &sha256_ctx);
 
   return sha256;
 }
 
-CFMutableArrayRef X509Certificate::CreateOSCertChainForCert() const {
-  CFMutableArrayRef cert_list =
-      CFArrayCreateMutable(kCFAllocatorDefault, 0,
-                           &kCFTypeArrayCallBacks);
-  if (!cert_list)
-    return NULL;
-
-  CFArrayAppendValue(cert_list, os_cert_handle());
-  for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i)
-    CFArrayAppendValue(cert_list, intermediate_ca_certs_[i]);
-
-  return cert_list;
-}
-
 // static
 X509Certificate::OSCertHandle X509Certificate::ReadOSCertHandleFromPickle(
     base::PickleIterator* pickle_iter) {
   const char* data;
   int length;
   if (!pickle_iter->ReadData(&data, &length))
     return NULL;
 
   return CreateOSCertHandleFromBytes(data, length);
 }
@@ skipping 52 matching lines @@
       break;
     default:
       *type = kPublicKeyTypeUnknown;
       *size_bits = 0;
       break;
   }
 }
 
 // static
 bool X509Certificate::IsSelfSigned(OSCertHandle cert_handle) {
-  x509_util::CSSMCachedCertificate cached_cert;
-  OSStatus status = cached_cert.Init(cert_handle);
-  if (status != noErr)
-    return false;
-
-  x509_util::CSSMFieldValue subject;
-  status = cached_cert.GetField(&CSSMOID_X509V1SubjectNameStd, &subject);
-  if (status != CSSM_OK || !subject.field())
-    return false;
-
-  x509_util::CSSMFieldValue issuer;
-  status = cached_cert.GetField(&CSSMOID_X509V1IssuerNameStd, &issuer);
-  if (status != CSSM_OK || !issuer.field())
-    return false;
-
-  if (subject.field()->Length != issuer.field()->Length ||
-      memcmp(subject.field()->Data, issuer.field()->Data,
-             issuer.field()->Length) != 0) {
-    return false;
-  }
-
-  CSSM_CL_HANDLE cl_handle = CSSM_INVALID_HANDLE;
-  status = SecCertificateGetCLHandle(cert_handle, &cl_handle);
-  if (status)
-    return false;
-  CSSM_DATA cert_data;
-  status = SecCertificateGetData(cert_handle, &cert_data);
-  if (status)
-    return false;
-
-  if (CSSM_CL_CertVerify(cl_handle, 0, &cert_data, &cert_data, NULL, 0))
-    return false;
-  return true;
+  return x509_util::IsSelfSigned(cert_handle);
 }
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"
 
 }  // namespace net