WKWebView(iOS9): correctly update SSL status for current navigation item

ios/web/web_state/wk_web_view_security_util.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/wk_web_view_security_util.h"
 
 #include "base/mac/scoped_cftyperef.h"
 #include "base/strings/sys_string_conversions.h"
 #include "net/cert/x509_certificate.h"
 #include "net/ssl/ssl_info.h"
@@ skipping 76 matching lines @@
   }
 
   net::X509Certificate::OSCertHandles intermediates;
   for (CFIndex i = 1; i < cert_count; i++) {
     intermediates.push_back(SecTrustGetCertificateAtIndex(trust, i));
   }
   return net::X509Certificate::CreateFromHandle(
       SecTrustGetCertificateAtIndex(trust, 0), intermediates);
 }
 
+base::ScopedCFTypeRef<SecTrustRef> CreateServerTrustFromChain(NSArray* certs,
+                                                              NSString* host) {
+  if (certs.count == 0)
+    return base::ScopedCFTypeRef<SecTrustRef>();

[Ryan Sleevi, 2015/09/19 12:45:38]

You're preventing NVRO from helping you here with this approach

base::ScopedCFTypeRef<SecTrustRef> result;

if (certs.count == 0)
  return result;
base::....
SecTrustRef tempResult = nil;  // I presume since this is Obj-C++ we're all
about nil over nullptr.
if (SecTrust(...)) {
  result = tempResult;
  return result;
}
return result;

Note how this replaces all return points to a single named variable, which
allows the compiler to do NRVO. It also saves you typing :)

[Eugene But (OOO till 7-30), 2015/09/21 17:23:40]

Done. However I kept nullptr, because nil should be used only for Objective-C
object variables. 

+
+  base::ScopedCFTypeRef<SecPolicyRef> policy(
+      SecPolicyCreateSSL(TRUE, static_cast<CFStringRef>(host)));
+  SecTrustRef result = nullptr;
+  if (SecTrustCreateWithCertificates(certs, policy, &result) == errSecSuccess) {
+    return base::ScopedCFTypeRef<SecTrustRef>(result);
+  }
+  return base::ScopedCFTypeRef<SecTrustRef>();
+}
+
 void EnsureFutureTrustEvaluationSucceeds(SecTrustRef trust) {
   base::ScopedCFTypeRef<CFDataRef> exceptions(SecTrustCopyExceptions(trust));
   SecTrustSetExceptions(trust, exceptions);
 }
 
 BOOL IsWKWebViewSSLError(NSError* error) {
   // SSL errors range is (-2000..-1200], represented by kCFURLError constants:
   // (kCFURLErrorCannotLoadFromNetwork..kCFURLErrorSecureConnectionFailed].
   // It's reasonable to expect that all SSL errors will have the error code
   // less or equal to NSURLErrorSecureConnectionFailed but greater than
   // NSURLErrorCannotLoadFromNetwork.
   return [error.domain isEqualToString:NSURLErrorDomain] &&
          (error.code <= NSURLErrorSecureConnectionFailed &&
           NSURLErrorCannotLoadFromNetwork < error.code);
 }
 
 void GetSSLInfoFromWKWebViewSSLError(NSError* error, net::SSLInfo* ssl_info) {
   DCHECK(IsWKWebViewSSLError(error));
   ssl_info->cert_status = GetCertStatusFromNSErrorCode(error.code);
   ssl_info->cert = CreateCertFromSSLError(error);
 }
 
+SecurityStyle GetSecurityStyleFromTrustResult(SecTrustResultType result) {
+  switch (result) {
+    case kSecTrustResultInvalid:
+      return SECURITY_STYLE_UNKNOWN;

[Ryan Sleevi, 2015/09/19 12:45:38]

Hrm, this implies a more benign result, except it's a pretty bad situation to
get a kSecTrustResultInvalid

[Eugene But (OOO till 7-30), 2015/09/21 17:23:40]

Acknowledged. Let me know if you expect something actionable here.

+    case kSecTrustResultProceed:
+    case kSecTrustResultUnspecified:
+      return SECURITY_STYLE_AUTHENTICATED;
+    case kSecTrustResultDeny:
+    case kSecTrustResultRecoverableTrustFailure:
+    case kSecTrustResultFatalTrustFailure:
+    case kSecTrustResultOtherError:
+      return SECURITY_STYLE_AUTHENTICATION_BROKEN;
+  }
+  NOTREACHED();
+  return SECURITY_STYLE_UNKNOWN;
+}
+
 }  // namespace web