WKWebView(iOS9): correctly update SSL status for current navigation item

ios/web/web_state/wk_web_view_security_util.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/wk_web_view_security_util.h"
 
 #include "base/mac/scoped_cftyperef.h"
 #include "base/strings/sys_string_conversions.h"
 #include "net/cert/x509_certificate.h"
 #include "net/ssl/ssl_info.h"
@@ skipping 76 matching lines @@
   }
 
   net::X509Certificate::OSCertHandles intermediates;
   for (CFIndex i = 1; i < cert_count; i++) {
     intermediates.push_back(SecTrustGetCertificateAtIndex(trust, i));
   }
   return net::X509Certificate::CreateFromHandle(
       SecTrustGetCertificateAtIndex(trust, 0), intermediates);
 }
 
+base::ScopedCFTypeRef<SecTrustRef> CreateServerTrustFromChain(NSArray* certs,
+                                                              NSString* host) {
+  if (certs.count == 0)
+    return base::ScopedCFTypeRef<SecTrustRef>();
+
+  base::ScopedCFTypeRef<SecPolicyRef> policy(
+      SecPolicyCreateSSL(TRUE, static_cast<CFStringRef>(host)));
+  SecTrustRef result = nullptr;
+  if (SecTrustCreateWithCertificates(certs, policy, &result) == errSecSuccess) {
+    return base::ScopedCFTypeRef<SecTrustRef>(result);
+  }
+  return base::ScopedCFTypeRef<SecTrustRef>();
+}
+
 void EnsureFutureTrustEvaluationSucceeds(SecTrustRef trust) {
   base::ScopedCFTypeRef<CFDataRef> exceptions(SecTrustCopyExceptions(trust));
   SecTrustSetExceptions(trust, exceptions);
 }
 
 BOOL IsWKWebViewSSLError(NSError* error) {
   // SSL errors range is (-2000..-1200], represented by kCFURLError constants:
   // (kCFURLErrorCannotLoadFromNetwork..kCFURLErrorSecureConnectionFailed].
   // It's reasonable to expect that all SSL errors will have the error code
   // less or equal to NSURLErrorSecureConnectionFailed but greater than
   // NSURLErrorCannotLoadFromNetwork.
   return [error.domain isEqualToString:NSURLErrorDomain] &&
          (error.code <= NSURLErrorSecureConnectionFailed &&
           NSURLErrorCannotLoadFromNetwork < error.code);
 }
 
 void GetSSLInfoFromWKWebViewSSLError(NSError* error, net::SSLInfo* ssl_info) {
   DCHECK(IsWKWebViewSSLError(error));
   ssl_info->cert_status = GetCertStatusFromNSErrorCode(error.code);
   ssl_info->cert = CreateCertFromSSLError(error);
 }
 
+SecurityStyle GetSecurityStyleFromTrustResult(SecTrustResultType result) {
+  switch (result) {
+    case kSecTrustResultInvalid:
+      return SECURITY_STYLE_UNKNOWN;
+    case kSecTrustResultProceed:
+    case kSecTrustResultUnspecified:

[felt, 2015/09/15 22:39:11]

^ I'm surprised that "unspecified" ends up being treated as valid

[Eugene But (OOO till 7-30), 2015/09/15 23:04:43]

Yeah, I understand confusion, but this is actual result of evaluating a valid
SSL cert. And this is from Apple documentation:

@constant kSecTrustResultUnspecified Indicates the evaluation succeeded
and the certificate is implicitly trusted, but user intent was not
explicitly specified.  This value may be returned by the SecTrustEvaluate
function or stored as part of the user trust settings.

+      return SECURITY_STYLE_AUTHENTICATED;
+    case kSecTrustResultDeny:
+    case kSecTrustResultRecoverableTrustFailure:
+    case kSecTrustResultFatalTrustFailure:
+    case kSecTrustResultOtherError:
+      return SECURITY_STYLE_AUTHENTICATION_BROKEN;
+  }
+  NOTREACHED();
+  return SECURITY_STYLE_UNKNOWN;
+}
+
 }  // namespace web