Convert android to use X509CertificateBytes instead of X509CertificateOpenSSL.

net/socket/ssl_server_socket_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_server_socket_impl.h"
 
 #include <utility>
 
 #include "base/callback_helpers.h"
 #include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "crypto/openssl_util.h"
 #include "crypto/rsa_private_key.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/client_cert_verifier.h"
+#include "net/cert/x509_util.h"
 #include "net/cert/x509_util_openssl.h"
 #include "net/log/net_log_event_type.h"
 #include "net/log/net_log_with_source.h"
 #include "net/socket/socket_bio_adapter.h"
 #include "net/ssl/openssl_ssl_util.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "net/ssl/ssl_info.h"
 #include "third_party/boringssl/src/include/openssl/err.h"
 #include "third_party/boringssl/src/include/openssl/ssl.h"
 #include "third_party/boringssl/src/include/openssl/x509.h"
@@ skipping 590 matching lines @@
     : ssl_server_config_(ssl_server_config),
       cert_(certificate),
       key_(key.Copy()) {
   CHECK(key_);
   crypto::EnsureOpenSSLInit();
   ssl_ctx_.reset(SSL_CTX_new(TLS_method()));
   SSL_CTX_set_session_cache_mode(ssl_ctx_.get(), SSL_SESS_CACHE_SERVER);
   uint8_t session_ctx_id = 0;
   SSL_CTX_set_session_id_context(ssl_ctx_.get(), &session_ctx_id,
                                  sizeof(session_ctx_id));
+  // Deduplicate all certificates minted from the SSL_CTX in memory.
+  SSL_CTX_set0_buffer_pool(ssl_ctx_.get(), x509_util::GetBufferPool());
 
   int verify_mode = 0;
   switch (ssl_server_config_.client_cert_type) {
     case SSLServerConfig::ClientCertType::REQUIRE_CLIENT_CERT:
       verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
     // Fall-through
     case SSLServerConfig::ClientCertType::OPTIONAL_CLIENT_CERT:
       verify_mode |= SSL_VERIFY_PEER;
       SSL_CTX_set_verify(ssl_ctx_.get(), verify_mode, nullptr);
       SSL_CTX_set_cert_verify_callback(ssl_ctx_.get(),
                                        SSLServerSocketImpl::CertVerifyCallback,
                                        ssl_server_config_.client_cert_verifier);
       break;
     case SSLServerConfig::ClientCertType::NO_CLIENT_CERT:
       break;
   }
 
   // Set certificate and private key.
   DCHECK(cert_->os_cert_handle());
-#if defined(USE_OPENSSL_CERTS)
+  DCHECK(key_->key());
+#if BUILDFLAG(USE_BYTE_CERTS)
+  // On success, SSL_CTX_set_chain_and_key acquires a reference to
+  // |cert_->os_cert_handle()| and |key_->key()|.
+  CRYPTO_BUFFER* cert_buffers[] = {cert_->os_cert_handle()};
+  CHECK(SSL_CTX_set_chain_and_key(ssl_ctx_.get(), cert_buffers,
+                                  arraysize(cert_buffers), key_->key(),
+                                  nullptr /* privkey_method */));
+#elif defined(USE_OPENSSL_CERTS)
   CHECK(SSL_CTX_use_certificate(ssl_ctx_.get(), cert_->os_cert_handle()));
+  CHECK(SSL_CTX_use_PrivateKey(ssl_ctx_.get(), key_->key()));
 #else
-  // Convert OSCertHandle to X509 structure.
   std::string der_string;
   CHECK(X509Certificate::GetDEREncoded(cert_->os_cert_handle(), &der_string));
-
-  const unsigned char* der_string_array =
-      reinterpret_cast<const unsigned char*>(der_string.data());
-
-  bssl::UniquePtr<X509> x509(
-      d2i_X509(NULL, &der_string_array, der_string.length()));
-  CHECK(x509);
-
-  // On success, SSL_CTX_use_certificate acquires a reference to |x509|.
-  CHECK(SSL_CTX_use_certificate(ssl_ctx_.get(), x509.get()));
-#endif  // USE_OPENSSL_CERTS
-
-  DCHECK(key_->key());
+  CHECK(SSL_CTX_use_certificate_ASN1(
+      ssl_ctx_.get(), der_string.length(),
+      reinterpret_cast<const unsigned char*>(der_string.data())));
+  // On success, SSL_CTX_use_PrivateKey acquires a reference to |key_->key()|.
   CHECK(SSL_CTX_use_PrivateKey(ssl_ctx_.get(), key_->key()));
+#endif  // USE_OPENSSL_CERTS && !USE_BYTE_CERTS
 
   DCHECK_LT(SSL3_VERSION, ssl_server_config_.version_min);
   DCHECK_LT(SSL3_VERSION, ssl_server_config_.version_max);
   CHECK(SSL_CTX_set_min_proto_version(ssl_ctx_.get(),
                                       ssl_server_config_.version_min));
   CHECK(SSL_CTX_set_max_proto_version(ssl_ctx_.get(),
                                       ssl_server_config_.version_max));
 
   // OpenSSL defaults some options to on, others to off. To avoid ambiguity,
   // set everything we care about to an absolute value.
@@ skipping 55 matching lines @@
 SSLServerContextImpl::~SSLServerContextImpl() {}
 
 std::unique_ptr<SSLServerSocket> SSLServerContextImpl::CreateSSLServerSocket(
     std::unique_ptr<StreamSocket> socket) {
   bssl::UniquePtr<SSL> ssl(SSL_new(ssl_ctx_.get()));
   return std::unique_ptr<SSLServerSocket>(
       new SSLServerSocketImpl(std::move(socket), std::move(ssl)));
 }
 
 }  // namespace net