Convert iOS to use X509CertificateBytes.

net/cert/x509_certificate_ios.cc

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_certificate.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <Security/Security.h>
 
 #include "base/mac/scoped_cftyperef.h"
 #include "base/pickle.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
 #include "crypto/openssl_util.h"
 #include "net/base/ip_address.h"
+#include "net/cert/x509_util_ios.h"
 #include "net/cert/x509_util_openssl.h"
 #include "net/ssl/openssl_ssl_util.h"
 #include "third_party/boringssl/src/include/openssl/x509.h"
 #include "third_party/boringssl/src/include/openssl/x509v3.h"
 
 using base::ScopedCFTypeRef;
 
 namespace net {
 
 namespace {
 
-// Returns true if a given |cert_handle| is actually a valid X.509 certificate
-// handle.
-//
-// SecCertificateCreateFromData() does not always force the immediate parsing of
-// the certificate, and as such, may return a SecCertificateRef for an
-// invalid/unparsable certificate. Force parsing to occur to ensure that the
-// SecCertificateRef is correct. On later versions where
-// SecCertificateCreateFromData() immediately parses, rather than lazily, this
-// call is cheap, as the subject is cached.
-bool IsValidOSCertHandle(SecCertificateRef cert_handle) {
-  ScopedCFTypeRef<CFStringRef> sanity_check(
-      SecCertificateCopySubjectSummary(cert_handle));
-  return sanity_check != nullptr;
-}
-
 bssl::UniquePtr<X509> OSCertHandleToOpenSSL(
     X509Certificate::OSCertHandle os_handle) {
   std::string der_encoded;
   if (!X509Certificate::GetDEREncoded(os_handle, &der_encoded))
     return nullptr;
   const uint8_t* bytes = reinterpret_cast<const uint8_t*>(der_encoded.data());
   return bssl::UniquePtr<X509>(d2i_X509(nullptr, &bytes, der_encoded.size()));
 }
 
 void CreateOSCertHandlesFromPKCS7Bytes(
@@ skipping 186 matching lines @@
                      CFDataGetLength(cert_data));
   }
   CC_SHA256_Final(sha256.data, &sha256_ctx);
   return sha256;
 }
 
 // static
 X509Certificate::OSCertHandle X509Certificate::CreateOSCertHandleFromBytes(
     const char* data,
     size_t length) {
-  ScopedCFTypeRef<CFDataRef> cert_data(CFDataCreateWithBytesNoCopy(
-      kCFAllocatorDefault, reinterpret_cast<const UInt8*>(data),
-      base::checked_cast<CFIndex>(length), kCFAllocatorNull));
-  if (!cert_data)
-    return nullptr;
-  OSCertHandle cert_handle = SecCertificateCreateWithData(nullptr, cert_data);
-  if (!cert_handle)
-    return nullptr;
-  if (!IsValidOSCertHandle(cert_handle)) {
-    CFRelease(cert_handle);
-    return nullptr;
-  }
-  return cert_handle;
+  return x509_util::CreateSecCertificateFromBytes(
+      reinterpret_cast<const uint8_t*>(data), length);
 }
 
 // static
 X509Certificate::OSCertHandles X509Certificate::CreateOSCertHandlesFromBytes(
     const char* data,
     size_t length,
     Format format) {
   OSCertHandles results;
 
   switch (format) {
@@ skipping 97 matching lines @@
     case EVP_PKEY_EC:
       *type = kPublicKeyTypeECDSA;
       break;
     case EVP_PKEY_DH:
       *type = kPublicKeyTypeDH;
       break;
   }
   *size_bits = EVP_PKEY_bits(key);
 }
 
-CFMutableArrayRef X509Certificate::CreateOSCertChainForCert() const {
-  CFMutableArrayRef cert_list =
-      CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
-  if (!cert_list)
-    return nullptr;
-
-  CFArrayAppendValue(cert_list, os_cert_handle());
-  for (size_t i = 0; i < intermediate_ca_certs_.size(); ++i)
-    CFArrayAppendValue(cert_list, intermediate_ca_certs_[i]);
-
-  return cert_list;
-}
-
 bool X509Certificate::IsIssuedByEncoded(
     const std::vector<std::string>& valid_issuers) {
   if (valid_issuers.empty())
     return false;
 
   // Convert to a temporary list of X509_NAME objects.
   // It will own the objects it points to.
   bssl::UniquePtr<STACK_OF(X509_NAME)> issuer_names(sk_X509_NAME_new_null());
   if (!issuer_names)
     return false;
@@ skipping 49 matching lines @@
     return false;
   bssl::UniquePtr<EVP_PKEY> scoped_key(X509_get_pubkey(cert.get()));
   if (!scoped_key)
     return false;
   if (!X509_verify(cert.get(), scoped_key.get()))
     return false;
   return X509_check_issued(cert.get(), cert.get()) == X509_V_OK;
 }
 
 }  // namespace net