| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #import "ios/web/web_state/wk_web_view_security_util.h" | 5 #import "ios/web/web_state/wk_web_view_security_util.h" |
| 6 | 6 |
| 7 #include "base/mac/scoped_cftyperef.h" | 7 #include "base/mac/scoped_cftyperef.h" |
| 8 #include "base/strings/sys_string_conversions.h" | 8 #include "base/strings/sys_string_conversions.h" |
| 9 #include "net/cert/x509_certificate.h" | 9 #include "net/cert/x509_certificate.h" |
| 10 #include "net/ssl/ssl_info.h" | 10 #include "net/ssl/ssl_info.h" |
| 11 | 11 |
| 12 #if !defined(__has_feature) || !__has_feature(objc_arc) |
| 13 #error "This file requires ARC support." |
| 14 #endif |
| 15 |
| 12 namespace web { | 16 namespace web { |
| 13 | 17 |
| 14 // These keys were determined by inspecting userInfo dict of an SSL error. | 18 // These keys were determined by inspecting userInfo dict of an SSL error. |
| 15 NSString* const kNSErrorPeerCertificateChainKey = | 19 NSString* const kNSErrorPeerCertificateChainKey = |
| 16 @"NSErrorPeerCertificateChainKey"; | 20 @"NSErrorPeerCertificateChainKey"; |
| 17 NSString* const kNSErrorFailingURLKey = @"NSErrorFailingURLKey"; | 21 NSString* const kNSErrorFailingURLKey = @"NSErrorFailingURLKey"; |
| 18 } | 22 } |
| 19 | 23 |
| 20 namespace { | 24 namespace { |
| 21 | 25 |
| (...skipping 20 matching lines...) Expand all Loading... |
| 42 } // namespace | 46 } // namespace |
| 43 | 47 |
| 44 | 48 |
| 45 namespace web { | 49 namespace web { |
| 46 | 50 |
| 47 scoped_refptr<net::X509Certificate> CreateCertFromChain(NSArray* certs) { | 51 scoped_refptr<net::X509Certificate> CreateCertFromChain(NSArray* certs) { |
| 48 if (certs.count == 0) | 52 if (certs.count == 0) |
| 49 return nullptr; | 53 return nullptr; |
| 50 net::X509Certificate::OSCertHandles intermediates; | 54 net::X509Certificate::OSCertHandles intermediates; |
| 51 for (NSUInteger i = 1; i < certs.count; i++) { | 55 for (NSUInteger i = 1; i < certs.count; i++) { |
| 52 intermediates.push_back(reinterpret_cast<SecCertificateRef>(certs[i])); | 56 intermediates.push_back((__bridge SecCertificateRef)certs[i]); |
| 53 } | 57 } |
| 54 return net::X509Certificate::CreateFromHandle( | 58 return net::X509Certificate::CreateFromHandle( |
| 55 reinterpret_cast<SecCertificateRef>(certs[0]), intermediates); | 59 (__bridge SecCertificateRef)certs[0], intermediates); |
| 56 } | 60 } |
| 57 | 61 |
| 58 scoped_refptr<net::X509Certificate> CreateCertFromTrust(SecTrustRef trust) { | 62 scoped_refptr<net::X509Certificate> CreateCertFromTrust(SecTrustRef trust) { |
| 59 if (!trust) | 63 if (!trust) |
| 60 return nullptr; | 64 return nullptr; |
| 61 | 65 |
| 62 CFIndex cert_count = SecTrustGetCertificateCount(trust); | 66 CFIndex cert_count = SecTrustGetCertificateCount(trust); |
| 63 if (cert_count == 0) { | 67 if (cert_count == 0) { |
| 64 // At the moment there is no API which allows trust creation w/o certs. | 68 // At the moment there is no API which allows trust creation w/o certs. |
| 65 return nullptr; | 69 return nullptr; |
| 66 } | 70 } |
| 67 | 71 |
| 68 net::X509Certificate::OSCertHandles intermediates; | 72 net::X509Certificate::OSCertHandles intermediates; |
| 69 for (CFIndex i = 1; i < cert_count; i++) { | 73 for (CFIndex i = 1; i < cert_count; i++) { |
| 70 intermediates.push_back(SecTrustGetCertificateAtIndex(trust, i)); | 74 intermediates.push_back(SecTrustGetCertificateAtIndex(trust, i)); |
| 71 } | 75 } |
| 72 return net::X509Certificate::CreateFromHandle( | 76 return net::X509Certificate::CreateFromHandle( |
| 73 SecTrustGetCertificateAtIndex(trust, 0), intermediates); | 77 SecTrustGetCertificateAtIndex(trust, 0), intermediates); |
| 74 } | 78 } |
| 75 | 79 |
| 76 base::ScopedCFTypeRef<SecTrustRef> CreateServerTrustFromChain(NSArray* certs, | 80 base::ScopedCFTypeRef<SecTrustRef> CreateServerTrustFromChain(NSArray* certs, |
| 77 NSString* host) { | 81 NSString* host) { |
| 78 base::ScopedCFTypeRef<SecTrustRef> scoped_result; | 82 base::ScopedCFTypeRef<SecTrustRef> scoped_result; |
| 79 if (certs.count == 0) | 83 if (certs.count == 0) |
| 80 return scoped_result; | 84 return scoped_result; |
| 81 | 85 |
| 82 base::ScopedCFTypeRef<SecPolicyRef> policy( | 86 base::ScopedCFTypeRef<SecPolicyRef> policy( |
| 83 SecPolicyCreateSSL(TRUE, static_cast<CFStringRef>(host))); | 87 SecPolicyCreateSSL(TRUE, static_cast<CFStringRef>(host))); |
| 84 SecTrustRef ref_result = nullptr; | 88 SecTrustRef ref_result = nullptr; |
| 85 if (SecTrustCreateWithCertificates(certs, policy, &ref_result) == | 89 if (SecTrustCreateWithCertificates((__bridge CFArrayRef)certs, policy, |
| 86 errSecSuccess) { | 90 &ref_result) == errSecSuccess) { |
| 87 scoped_result.reset(ref_result); | 91 scoped_result.reset(ref_result); |
| 88 } | 92 } |
| 89 return scoped_result; | 93 return scoped_result; |
| 90 } | 94 } |
| 91 | 95 |
| 92 void EnsureFutureTrustEvaluationSucceeds(SecTrustRef trust) { | 96 void EnsureFutureTrustEvaluationSucceeds(SecTrustRef trust) { |
| 93 base::ScopedCFTypeRef<CFDataRef> exceptions(SecTrustCopyExceptions(trust)); | 97 base::ScopedCFTypeRef<CFDataRef> exceptions(SecTrustCopyExceptions(trust)); |
| 94 SecTrustSetExceptions(trust, exceptions); | 98 SecTrustSetExceptions(trust, exceptions); |
| 95 } | 99 } |
| 96 | 100 |
| (...skipping 47 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 144 // kSecTrustResultConfirm was deprecated in iOS7, but leads to a compile | 148 // kSecTrustResultConfirm was deprecated in iOS7, but leads to a compile |
| 145 // error if used with newer SDKs. Remove the default clause once this | 149 // error if used with newer SDKs. Remove the default clause once this |
| 146 // switch statement successfully compiles without kSecTrustResultConfirm. | 150 // switch statement successfully compiles without kSecTrustResultConfirm. |
| 147 default: | 151 default: |
| 148 NOTREACHED(); | 152 NOTREACHED(); |
| 149 return SECURITY_STYLE_UNKNOWN; | 153 return SECURITY_STYLE_UNKNOWN; |
| 150 } | 154 } |
| 151 } | 155 } |
| 152 | 156 |
| 153 } // namespace web | 157 } // namespace web |
| OLD | NEW |