Add X509CertificateBytes which uses CRYPTO_BUFFER instead of macOS-native certificate types.

net/socket/ssl_client_socket_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_impl.h"
 
 #include <errno.h>
 #include <string.h>
 
 #include <algorithm>
@@ skipping 207 matching lines @@
   return buffer_size;
 }
 
 scoped_refptr<X509Certificate> OSChainFromBuffers(STACK_OF(CRYPTO_BUFFER) *
                                                   openssl_chain) {
   if (sk_CRYPTO_BUFFER_num(openssl_chain) == 0) {
     NOTREACHED();
     return nullptr;
   }
 
+#if BUILDFLAG(USE_BYTE_CERTS)
+  std::vector<CRYPTO_BUFFER*> intermediate_chain;
+  for (size_t i = 1; i < sk_CRYPTO_BUFFER_num(openssl_chain); ++i)
+    intermediate_chain.push_back(sk_CRYPTO_BUFFER_value(openssl_chain, i));
+  return X509Certificate::CreateFromHandle(
+      sk_CRYPTO_BUFFER_value(openssl_chain, 0), intermediate_chain);
+#else
   // Convert the certificate chains to a platform certificate handle.
   std::vector<base::StringPiece> der_chain;
   der_chain.reserve(sk_CRYPTO_BUFFER_num(openssl_chain));
   for (size_t i = 0; i < sk_CRYPTO_BUFFER_num(openssl_chain); ++i) {
     const CRYPTO_BUFFER* cert = sk_CRYPTO_BUFFER_value(openssl_chain, i);
     base::StringPiece der;
     der_chain.push_back(base::StringPiece(
         reinterpret_cast<const char*>(CRYPTO_BUFFER_data(cert)),
         CRYPTO_BUFFER_len(cert)));
   }
   return X509Certificate::CreateFromDERCertChain(der_chain);
+#endif
 }
 
-#if !defined(OS_IOS)
+#if !defined(OS_IOS) && !BUILDFLAG(USE_BYTE_CERTS)
 bssl::UniquePtr<CRYPTO_BUFFER> OSCertHandleToBuffer(
     X509Certificate::OSCertHandle os_handle) {
   std::string der_encoded;
   if (!X509Certificate::GetDEREncoded(os_handle, &der_encoded))
     return nullptr;
   return x509_util::CreateCryptoBuffer(der_encoded);
 }
 #endif
 
 }  // namespace
@@ skipping 1323 matching lines @@
   // Second pass: a client certificate should have been selected.
   if (ssl_config_.client_cert.get()) {
     if (!ssl_config_.client_private_key) {
       // The caller supplied a null private key. Fail the handshake and surface
       // an appropriate error to the caller.
       LOG(WARNING) << "Client cert found without private key";
       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY);
       return -1;
     }
 
+#if BUILDFLAG(USE_BYTE_CERTS)
+    std::vector<CRYPTO_BUFFER*> chain_raw;
+    chain_raw.push_back(ssl_config_.client_cert->os_cert_handle());
+    for (X509Certificate::OSCertHandle cert :
+         ssl_config_.client_cert->GetIntermediateCertificates()) {
+      chain_raw.push_back(cert);
+    }
+#else
     std::vector<bssl::UniquePtr<CRYPTO_BUFFER>> chain;
     std::vector<CRYPTO_BUFFER*> chain_raw;
     bssl::UniquePtr<CRYPTO_BUFFER> buf =
         OSCertHandleToBuffer(ssl_config_.client_cert->os_cert_handle());
     if (!buf) {
       LOG(WARNING) << "Failed to import certificate";
       OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT);
       return -1;
     }
     chain_raw.push_back(buf.get());
     chain.push_back(std::move(buf));
 
     for (X509Certificate::OSCertHandle cert :
          ssl_config_.client_cert->GetIntermediateCertificates()) {
       bssl::UniquePtr<CRYPTO_BUFFER> buf = OSCertHandleToBuffer(cert);
       if (!buf) {
         LOG(WARNING) << "Failed to import intermediate";
         OpenSSLPutNetError(FROM_HERE, ERR_SSL_CLIENT_AUTH_CERT_BAD_FORMAT);
         return -1;
       }
       chain_raw.push_back(buf.get());
       chain.push_back(std::move(buf));
     }
+#endif
 
     if (!SSL_set_chain_and_key(ssl_.get(), chain_raw.data(), chain_raw.size(),
                                nullptr, &SSLContext::kPrivateKeyMethod)) {
       LOG(WARNING) << "Failed to set client certificate";
       return -1;
     }
 
     std::vector<SSLPrivateKey::Hash> digest_prefs =
         ssl_config_.client_private_key->GetDigestPreferences();
 
@@ skipping 16 matching lines @@
         case SSLPrivateKey::Hash::MD5_SHA1:
           // MD5-SHA1 is not used in TLS 1.2.
           break;
       }
     }
 
     SSL_set_private_key_digest_prefs(ssl_.get(), digests.data(),
                                      digests.size());
 
     net_log_.AddEvent(NetLogEventType::SSL_CLIENT_CERT_PROVIDED,
-                      NetLog::IntCallback("cert_count", chain.size()));
+                      NetLog::IntCallback("cert_count", chain_raw.size()));
     return 1;
   }
 #endif  // defined(OS_IOS)
 
   // Send no client certificate.
   net_log_.AddEvent(NetLogEventType::SSL_CLIENT_CERT_PROVIDED,
                     NetLog::IntCallback("cert_count", 0));
   return 1;
 }
 
@@ skipping 288 matching lines @@
     if (ERR_GET_REASON(info->error_code) == SSL_R_TLSV1_ALERT_ACCESS_DENIED &&
         !certificate_requested_) {
       net_error = ERR_SSL_PROTOCOL_ERROR;
     }
   }
 
   return net_error;
 }
 
 }  // namespace net