WKWebView(iOS9): correctly update SSL status for current navigation item

ios/web/web_state/wk_web_view_security_util.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/wk_web_view_security_util.h"
 
 #include "base/mac/scoped_cftyperef.h"
 #include "base/strings/sys_string_conversions.h"
 #include "net/cert/x509_certificate.h"
 #include "net/ssl/ssl_info.h"
@@ skipping 76 matching lines @@
   }
 
   net::X509Certificate::OSCertHandles intermediates;
   for (CFIndex i = 1; i < cert_count; i++) {
     intermediates.push_back(SecTrustGetCertificateAtIndex(trust, i));
   }
   return net::X509Certificate::CreateFromHandle(
       SecTrustGetCertificateAtIndex(trust, 0), intermediates);
 }
 
+base::ScopedCFTypeRef<SecTrustRef> CreateServerTrustFromChain(NSArray* certs,
+                                                              NSString* host) {
+  base::ScopedCFTypeRef<SecTrustRef> scoped_result;
+  if (certs.count == 0)
+    return scoped_result;
+
+  base::ScopedCFTypeRef<SecPolicyRef> policy(
+      SecPolicyCreateSSL(TRUE, static_cast<CFStringRef>(host)));

[davidben, 2015/10/05 22:19:11]

(Shouldn't this be YES, or is that a different boolean?)

[Eugene But (OOO till 7-30), 2015/10/06 03:10:09]

YES is for Objective-C BOOL type.
TRUE is for C Boolean type.

+  SecTrustRef ref_result = nullptr;
+  if (SecTrustCreateWithCertificates(certs, policy, &ref_result) ==
+      errSecSuccess) {
+    scoped_result.reset(ref_result);
+  }
+  return scoped_result;
+}
+
 void EnsureFutureTrustEvaluationSucceeds(SecTrustRef trust) {
   base::ScopedCFTypeRef<CFDataRef> exceptions(SecTrustCopyExceptions(trust));
   SecTrustSetExceptions(trust, exceptions);
 }
 
 BOOL IsWKWebViewSSLError(NSError* error) {
   // SSL errors range is (-2000..-1200], represented by kCFURLError constants:
   // (kCFURLErrorCannotLoadFromNetwork..kCFURLErrorSecureConnectionFailed].
   // It's reasonable to expect that all SSL errors will have the error code
   // less or equal to NSURLErrorSecureConnectionFailed but greater than
   // NSURLErrorCannotLoadFromNetwork.
   return [error.domain isEqualToString:NSURLErrorDomain] &&
          (error.code <= NSURLErrorSecureConnectionFailed &&
           NSURLErrorCannotLoadFromNetwork < error.code);
 }
 
 void GetSSLInfoFromWKWebViewSSLError(NSError* error, net::SSLInfo* ssl_info) {
   DCHECK(IsWKWebViewSSLError(error));
   ssl_info->cert_status = GetCertStatusFromNSErrorCode(error.code);
   ssl_info->cert = CreateCertFromSSLError(error);
 }
 
+SecurityStyle GetSecurityStyleFromTrustResult(SecTrustResultType result) {
+  switch (result) {
+    case kSecTrustResultInvalid:
+      return SECURITY_STYLE_UNKNOWN;
+    case kSecTrustResultProceed:
+    case kSecTrustResultUnspecified:
+      return SECURITY_STYLE_AUTHENTICATED;
+    case kSecTrustResultDeny:
+    case kSecTrustResultRecoverableTrustFailure:
+    case kSecTrustResultFatalTrustFailure:
+    case kSecTrustResultOtherError:
+      return SECURITY_STYLE_AUTHENTICATION_BROKEN;
+  }
+  NOTREACHED();
+  return SECURITY_STYLE_UNKNOWN;
+}
+
 }  // namespace web