keychain/ckks/tests/CKKSCloudKitTests.m

   1 /*
   2  * Copyright (c) 2017 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import <XCTest/XCTest.h>
  25 #import <CloudKit/CloudKit.h>
  26 #import <CloudKit/CloudKit_Private.h>
  27
  28 #import <Security/SecureObjectSync/SOSViews.h>
  29 #import <utilities/SecFileLocations.h>
  30 #import <securityd/SecItemServer.h>
  31 #if NO_SERVER
  32 #include <securityd/spi.h>
  33 #endif
  34
  35 #import "keychain/ckks/CKKS.h"
  36 #import "keychain/ckks/CKKSViewManager.h"
  37 #import "keychain/ckks/CKKSKeychainView.h"
  38 #import "keychain/ckks/CKKSCurrentKeyPointer.h"
  39 #import "keychain/ckks/CKKSMirrorEntry.h"
  40 #import "keychain/ckks/CKKSItemEncrypter.h"
  41 #import "keychain/ckks/CloudKitCategories.h"
  42 #import "keychain/ckks/tests/MockCloudKit.h"
  43
  44 @interface CKKSCloudKitTests : XCTestCase
  45
  46 @property NSOperationQueue *operationQueue;
  47 @property NSBlockOperation *ckksHoldOperation;
  48 @property CKContainer *container;
  49 @property CKDatabase *database;
  50 @property CKKSKeychainView *kcv;
  51 @property NSString *zoneName;
  52 @property CKRecordZoneID *zoneID;
  53 @property NSDictionary *remoteItems;
  54 @property NSInteger queueTimeout;
  55
  56 @end
  57
  58 // TODO: item modification should up gencount, check this
  59
  60 @implementation CKKSCloudKitTests
  61
  62 #if OCTAGON
  63
  64 #pragma mark Setup
  65
  66 + (void)setUp {
  67     SecCKKSResetSyncing();
  68     SecCKKSTestsEnable();
  69     [super setUp];
  70
  71 #if NO_SERVER
  72     securityd_init_local_spi();
  73 #endif
  74 }
  75
  76 - (void)setUp {
  77     self.remoteItems = nil;
  78     self.queueTimeout = 900;    // CloudKit can be *very* slow, and some tests upload a lot of items indeed
  79     NSString *containerName = [NSString stringWithFormat:@"com.apple.test.p01.B.com.apple.security.keychain.%@", [[NSUUID new] UUIDString]];
  80     self.container = [CKContainer containerWithIdentifier:containerName];
  81
  82     SecCKKSTestResetFlags();
  83     SecCKKSTestSetDisableSOS(true);
  84
  85     self.operationQueue = [NSOperationQueue new];
  86     self.ckksHoldOperation = [NSBlockOperation new];
  87     [self.ckksHoldOperation addExecutionBlock:^{
  88         secnotice("ckks", "CKKS testing hold released");
  89     }];
  90
  91     CKKSViewManager* manager = [[CKKSViewManager alloc] initWithContainerName:containerName
  92                                                                        usePCS:SecCKKSContainerUsePCS
  93                                          fetchRecordZoneChangesOperationClass:[CKFetchRecordZoneChangesOperation class]
  94                                                    fetchRecordsOperationClass:[CKFetchRecordsOperation class]
  95                                                           queryOperationClass:[CKQueryOperation class]
  96                                             modifySubscriptionsOperationClass:[CKModifySubscriptionsOperation class]
  97                                               modifyRecordZonesOperationClass:[CKModifyRecordZonesOperation class]
  98                                                            apsConnectionClass:[APSConnection class]
  99                                                     nsnotificationCenterClass:[NSNotificationCenter class]
 100                                                                 notifierClass:[FakeCKKSNotifier class]
 101                                                                     setupHold:self.ckksHoldOperation];
 102     [CKKSViewManager resetManager:false setTo:manager];
 103
 104     // Make a new fake keychain
 105     NSString* smallName = [self.name componentsSeparatedByString:@" "][1];
 106     smallName = [smallName stringByReplacingOccurrencesOfString:@"]" withString:@""];
 107
 108     NSString* tmp_dir = [NSString stringWithFormat: @"/tmp/%@.%X", smallName, arc4random()];
 109     [[NSFileManager defaultManager] createDirectoryAtPath:[NSString stringWithFormat: @"%@/Library/Keychains", tmp_dir] withIntermediateDirectories:YES attributes:nil error:NULL];
 110
 111     SetCustomHomeURLString((__bridge CFStringRef) tmp_dir);
 112     SecKeychainDbReset(NULL);
 113     // Actually load the database.
 114     kc_with_dbt(true, NULL, ^bool (SecDbConnectionRef dbt) { return false; });
 115
 116     self.zoneName = @"keychain";
 117     self.zoneID = [[CKRecordZoneID alloc] initWithZoneName:self.zoneName ownerName:CKCurrentUserDefaultName];
 118     self.kcv = [[CKKSViewManager manager] findOrCreateView:@"keychain"];
 119     [self.kcv.zoneSetupOperation addDependency: self.ckksHoldOperation];
 120 }
 121
 122 - (void)tearDown {
 123     self.remoteItems = nil;
 124     [[CKKSViewManager manager] clearView:@"keychain"];
 125     SecCKKSTestResetFlags();
 126 }
 127
 128 + (void)tearDown {
 129     SecCKKSResetSyncing();
 130 }
 131
 132 #pragma mark Helpers
 133
 134 - (BOOL)waitForEmptyOutgoingQueue:(CKKSKeychainView *)view {
 135     [view processOutgoingQueue:[CKOperationGroup CKKSGroupWithName:@"waitForEmptyOutgoingQueue"]];
 136     NSInteger secondsToWait = self.queueTimeout;
 137     while (true) {
 138         if ([view outgoingQueueEmpty:nil]) {
 139             return YES;
 140         }
 141         [NSThread sleepForTimeInterval:1];
 142         if (--secondsToWait % 60 == 0) {
 143             long minutesWaited = (self.queueTimeout - secondsToWait)/60;
 144             NSLog(@"Waiting %ld minute%@ for empty outgoingQueue", minutesWaited, minutesWaited > 1 ? @"s" : @"");
 145         }
 146         if (secondsToWait <= 0) {
 147             XCTFail(@"Timed out waiting for '%@' OutgoingQueue to become empty", view);
 148             NSLog(@"Giving up waiting for empty outgoingQueue");
 149             return NO;
 150         }
 151
 152     }
 153 }
 154
 155 - (void)startCKKSSubsystem {
 156     if(self.ckksHoldOperation) {
 157         [self.operationQueue addOperation: self.ckksHoldOperation];
 158         self.ckksHoldOperation = nil;
 159     }
 160 }
 161
 162 - (NSMutableDictionary *)fetchLocalItems {
 163     NSDictionary *query = @{(id)kSecClass               : (id)kSecClassGenericPassword,
 164                             (id)kSecAttrSynchronizable  : (id)kCFBooleanTrue,
 165                             (id)kSecReturnAttributes    : (id)kCFBooleanTrue,
 166                             (id)kSecReturnData          : (id)kCFBooleanTrue,
 167                             (id)kSecMatchLimit          : (id)kSecMatchLimitAll,
 168                             };
 169     CFTypeRef cfresults;
 170     OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef) query, &cfresults);
 171     XCTAssert(status == errSecSuccess || status == errSecItemNotFound, @"retrieved zero or more local items");
 172     if (status == errSecItemNotFound) {
 173         return [NSMutableDictionary new];
 174     } else if (status != errSecSuccess) {
 175         return nil;
 176     }
 177
 178     NSArray *results = CFBridgingRelease(cfresults);
 179
 180     NSMutableDictionary *ret = [NSMutableDictionary new];
 181     for (NSMutableDictionary *item in results) {
 182         ret[item[@"UUID"]] = item;
 183     }
 184
 185     return ret;
 186 }
 187
 188 - (NSMutableDictionary *)fetchRemoteItems {
 189     CKFetchRecordZoneChangesOptions *options = [CKFetchRecordZoneChangesOptions new];
 190     options.previousServerChangeToken = nil;
 191
 192     CKFetchRecordZoneChangesOperation *op = [[CKFetchRecordZoneChangesOperation alloc] initWithRecordZoneIDs:@[self.zoneID] optionsByRecordZoneID:@{self.zoneID : options}];
 193     op.qualityOfService = NSQualityOfServiceUserInitiated;
 194     op.configuration.container = self.container;
 195
 196     __block NSMutableDictionary *data = [NSMutableDictionary new];
 197     __block NSUInteger synckeys = 0;
 198     __block NSUInteger currkeys = 0;
 199     op.recordChangedBlock = ^(CKRecord *record) {
 200         if ([record.recordType isEqualToString:SecCKRecordItemType]) {
 201             data[record.recordID.recordName] = [self decryptRecord:record];
 202         } else if ([record.recordType isEqualToString:SecCKRecordIntermediateKeyType]) {
 203             synckeys += 1;
 204         } else if ([record.recordType isEqualToString:SecCKRecordCurrentKeyType]) {
 205             currkeys += 1;
 206         } else {
 207             XCTFail(@"Encountered unexpected item %@", record);
 208         }
 209     };
 210
 211     dispatch_semaphore_t sema = dispatch_semaphore_create(0);
 212     op.recordZoneFetchCompletionBlock = ^(CKRecordZoneID * _Nonnull recordZoneID,
 213                                           CKServerChangeToken * _Nullable serverChangeToken,
 214                                           NSData * _Nullable clientChangeTokenData,
 215                                           BOOL moreComing,
 216                                           NSError * _Nullable recordZoneError) {
 217         XCTAssertNil(recordZoneError, @"No error in recordZoneFetchCompletionBlock");
 218         if (!moreComing) {
 219             dispatch_semaphore_signal(sema);
 220         }
 221     };
 222
 223     [op start];
 224     dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
 225
 226     // These are new, fresh zones for each test. There should not be old keys yet.
 227     if (synckeys != 3) {XCTFail(@"Unexpected number of synckeys: %lu", synckeys);}
 228     if (currkeys != 3) {XCTFail(@"Unexpected number of current keys: %lu", currkeys);}
 229
 230     self.remoteItems = data;
 231     return data;
 232 }
 233
 234 - (BOOL)compareLocalItem:(NSDictionary *)lhs remote:(NSDictionary *)rhs {
 235     if ([lhs[@"cdat"] compare: rhs[@"cdat"]] != NSOrderedSame) {XCTFail(@"Creation date differs"); return NO;}
 236     if ([lhs[@"mdat"] compare: rhs[@"mdat"]] != NSOrderedSame) {XCTFail(@"Modification date differs"); return NO;}
 237     if (![lhs[@"agrp"] isEqualToString:rhs[@"agrp"]]) {XCTFail(@"Access group differs"); return NO;}
 238     if (![lhs[@"acct"] isEqualToString:rhs[@"acct"]]) {XCTFail(@"Account differs"); return NO;}
 239     if (![lhs[@"v_Data"] isEqualToData:rhs[@"v_Data"]]) {XCTFail(@"Data differs"); return NO;}
 240     // class for lhs is already genp due to copymatching query
 241     if (![rhs[@"class"] isEqualToString:@"genp"]) {XCTFail(@"Class not genp for remote item"); return NO;}
 242     return YES;
 243 }
 244
 245 - (BOOL)compareLocalKeychainWithCloudKitState {
 246     BOOL success = YES;
 247     NSMutableDictionary *localItems = [self fetchLocalItems];
 248     if (localItems == nil) {XCTFail(@"Received nil for localItems"); return NO;}
 249     NSMutableDictionary *remoteItems = [self fetchRemoteItems];
 250     if (remoteItems == nil) {XCTFail(@"Received nil for remoteItems"); return NO;}
 251
 252     for (NSString *uuid in localItems.allKeys) {
 253         if (remoteItems[uuid] == nil) {
 254             XCTFail(@"account %@ item %@ not present in remote", localItems[uuid][@"acct"], localItems[uuid]);
 255             success = NO;
 256             continue;
 257         }
 258         if (![self compareLocalItem:localItems[uuid] remote:remoteItems[uuid]]) {
 259             XCTFail(@"local item %@ matches remote item %@", localItems[uuid], remoteItems[uuid]);
 260             success = NO;
 261         }
 262         [remoteItems removeObjectForKey:uuid];
 263     }
 264     if ([remoteItems count]) {
 265         XCTFail(@"No remote items present not found in local, %@", remoteItems);
 266         return NO;
 267     }
 268     return success;
 269 }
 270
 271 - (BOOL)updateGenericPassword:(NSString *)password account:(NSString *)account {
 272     NSDictionary *query = @{(id)kSecClass : (id)kSecClassGenericPassword,
 273                             (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
 274                             (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
 275                             (id)kSecAttrAccount : account,
 276                             (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
 277                             };
 278     NSDictionary *newpasswd = @{(id)kSecValueData : (id) [password dataUsingEncoding:NSUTF8StringEncoding]};
 279
 280     return errSecSuccess == SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)newpasswd);
 281 }
 282
 283 - (BOOL)uploadRecords:(NSArray<CKRecord*>*)records {
 284     CKModifyRecordsOperation *op = [[CKModifyRecordsOperation alloc] initWithRecordsToSave:records recordIDsToDelete:nil];
 285     op.qualityOfService = NSQualityOfServiceUserInitiated;
 286     op.configuration.container = self.container;
 287
 288     dispatch_semaphore_t sema = dispatch_semaphore_create(0);
 289     __block BOOL result = NO;
 290     op.modifyRecordsCompletionBlock = ^(NSArray<CKRecord *> *savedRecords,
 291                                         NSArray<CKRecordID *> *deletedRecordIDs,
 292                                         NSError *operationError) {
 293         XCTAssertNil(operationError, @"No error uploading records, %@", operationError);
 294         if (operationError == nil) {
 295             result = YES;
 296         }
 297         dispatch_semaphore_signal(sema);
 298     };
 299
 300     [op start];
 301     dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
 302
 303     return result;
 304 }
 305
 306 #pragma mark Helpers Adapted from MockXCTest
 307
 308 - (CKRecord*)createFakeRecord: (CKRecordZoneID*)zoneID recordName:(NSString*)recordName {
 309     return [self createFakeRecord: zoneID recordName:recordName withAccount: nil];
 310 }
 311
 312 - (CKRecord*)createFakeRecord: (CKRecordZoneID*)zoneID recordName:(NSString*)recordName withAccount: (NSString*) account {
 313     NSError* error = nil;
 314
 315     /* Basically: @{
 316      @"acct"  : @"account-delete-me",
 317      @"agrp"  : @"com.apple.security.sos",
 318      @"cdat"  : @"2016-12-21 03:33:25 +0000",
 319      @"class" : @"genp",
 320      @"mdat"  : @"2016-12-21 03:33:25 +0000",
 321      @"musr"  : [[NSData alloc] init],
 322      @"pdmn"  : @"ak",
 323      @"sha1"  : [[NSData alloc] initWithBase64EncodedString: @"C3VWONaOIj8YgJjk/xwku4By1CY=" options:0],
 324      @"svce"  : @"",
 325      @"tomb"  : [NSNumber numberWithInt: 0],
 326      @"v_Data" : [@"data" dataUsingEncoding: NSUTF8StringEncoding],
 327      };
 328      TODO: this should be binary encoded instead of expanded, but the plist encoder should handle it fine */
 329     NSData* itemdata = [[NSData alloc] initWithBase64EncodedString:@"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPCFET0NUWVBFIHBsaXN0IFBVQkxJQyAiLS8vQXBwbGUvL0RURCBQTElTVCAxLjAvL0VOIiAiaHR0cDovL3d3dy5hcHBsZS5jb20vRFREcy9Qcm9wZXJ0eUxpc3QtMS4wLmR0ZCI+CjxwbGlzdCB2ZXJzaW9uPSIxLjAiPgo8ZGljdD4KCTxrZXk+YWNjdDwva2V5PgoJPHN0cmluZz5hY2NvdW50LWRlbGV0ZS1tZTwvc3RyaW5nPgoJPGtleT5hZ3JwPC9rZXk+Cgk8c3RyaW5nPmNvbS5hcHBsZS5zZWN1cml0eS5zb3M8L3N0cmluZz4KCTxrZXk+Y2RhdDwva2V5PgoJPGRhdGU+MjAxNi0xMi0yMVQwMzozMzoyNVo8L2RhdGU+Cgk8a2V5PmNsYXNzPC9rZXk+Cgk8c3RyaW5nPmdlbnA8L3N0cmluZz4KCTxrZXk+bWRhdDwva2V5PgoJPGRhdGU+MjAxNi0xMi0yMVQwMzozMzoyNVo8L2RhdGU+Cgk8a2V5Pm11c3I8L2tleT4KCTxkYXRhPgoJPC9kYXRhPgoJPGtleT5wZG1uPC9rZXk+Cgk8c3RyaW5nPmFrPC9zdHJpbmc+Cgk8a2V5PnNoYTE8L2tleT4KCTxkYXRhPgoJQzNWV09OYU9JajhZZ0pqay94d2t1NEJ5MUNZPQoJPC9kYXRhPgoJPGtleT5zdmNlPC9rZXk+Cgk8c3RyaW5nPjwvc3RyaW5nPgoJPGtleT50b21iPC9rZXk+Cgk8aW50ZWdlcj4wPC9pbnRlZ2VyPgoJPGtleT52X0RhdGE8L2tleT4KCTxkYXRhPgoJWkdGMFlRPT0KCTwvZGF0YT4KPC9kaWN0Pgo8L3BsaXN0Pgo=" options:0];
 330     NSMutableDictionary * item = [[NSPropertyListSerialization propertyListWithData:itemdata
 331                                                                             options:0
 332                                                                              format:nil
 333                                                                               error:&error] mutableCopy];
 334     // Fix up dictionary
 335     item[@"agrp"] = @"com.apple.security.ckks";
 336
 337     XCTAssertNil(error, "interpreted data as item");
 338
 339     if(account) {
 340         [item setObject: account forKey: (__bridge id) kSecAttrAccount];
 341     }
 342
 343     CKRecordID* ckrid = [[CKRecordID alloc] initWithRecordName:recordName zoneID:zoneID];
 344     return [self newRecord: ckrid withNewItemData: item];
 345 }
 346
 347 - (CKRecord*)newRecord: (CKRecordID*) recordID withNewItemData:(NSDictionary*) dictionary {
 348     NSError* error = nil;
 349     CKKSKey* classCKey = [CKKSKey currentKeyForClass:SecCKKSKeyClassC zoneID:recordID.zoneID error:&error];
 350     XCTAssertNotNil(classCKey, "Have class C key for zone");
 351
 352     CKKSItem* cipheritem = [CKKSItemEncrypter encryptCKKSItem:[[CKKSItem alloc] initWithUUID:recordID.recordName
 353                                                                                parentKeyUUID:classCKey.uuid
 354                                                                                       zoneID:recordID.zoneID]
 355                                                dataDictionary:dictionary
 356                                              updatingCKKSItem:nil
 357                                                     parentkey:classCKey
 358                                                         error:&error];
 359
 360     CKKSOutgoingQueueEntry* ciphertext = [[CKKSOutgoingQueueEntry alloc] initWithCKKSItem:cipheritem
 361                                                                                    action:SecCKKSActionAdd
 362                                                                                     state:SecCKKSStateNew
 363                                                                                 waitUntil:nil
 364                                                                               accessGroup:@"unused in this function"];
 365     XCTAssertNil(error, "encrypted item with class c key");
 366
 367     CKRecord* ckr = [ciphertext.item CKRecordWithZoneID: recordID.zoneID];
 368     XCTAssertNotNil(ckr, "Created a CKRecord");
 369     return ckr;
 370 }
 371
 372 - (NSDictionary*)decryptRecord: (CKRecord*) record {
 373     CKKSMirrorEntry* ckme = [[CKKSMirrorEntry alloc] initWithCKRecord: record];
 374
 375     NSError* error = nil;
 376
 377     NSDictionary* ret = [CKKSItemEncrypter decryptItemToDictionary:ckme.item error:&error];
 378     XCTAssertNil(error);
 379     XCTAssertNotNil(ret);
 380     return ret;
 381 }
 382
 383 - (BOOL)addMultiplePasswords:(NSString *)password account:(NSString *)account amount:(NSUInteger)amount {
 384     while (amount > 0) {
 385         if (![self addGenericPassword:password account:[NSString stringWithFormat:@"%@%03lu", account, amount]]) {
 386             return NO;
 387         }
 388         amount -= 1;
 389     }
 390     return YES;
 391 }
 392
 393 - (BOOL)deleteMultiplePasswords:(NSString *)account amount:(NSUInteger)amount {
 394     while (amount > 0) {
 395         if (![self deleteGenericPassword:[NSString stringWithFormat:@"%@%03lu", account, amount]]) {
 396             return NO;
 397         }
 398         amount -= 1;
 399     }
 400     return YES;
 401 }
 402
 403 - (BOOL)addGenericPassword: (NSString*) password account: (NSString*) account viewHint: (NSString*) viewHint expecting: (OSStatus) status message: (NSString*) message {
 404     NSMutableDictionary* query = [@{
 405                                     (id)kSecClass : (id)kSecClassGenericPassword,
 406                                     (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
 407                                     (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
 408                                     (id)kSecAttrAccount : account,
 409                                     (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
 410                                     (id)kSecValueData : (id) [password dataUsingEncoding:NSUTF8StringEncoding],
 411                                     } mutableCopy];
 412
 413     if(viewHint) {
 414         query[(id)kSecAttrSyncViewHint] = viewHint;
 415     }
 416
 417     return status == SecItemAdd((__bridge CFDictionaryRef) query, NULL);
 418 }
 419
 420 - (BOOL)addGenericPassword: (NSString*) password account: (NSString*) account expecting: (OSStatus) status message: (NSString*) message {
 421     return [self addGenericPassword:password account:account viewHint:nil expecting:errSecSuccess message:message];
 422 }
 423
 424 - (BOOL)addGenericPassword: (NSString*) password account: (NSString*) account {
 425     return [self addGenericPassword:password account:account viewHint:nil expecting:errSecSuccess message:@"Add item to keychain"];
 426 }
 427
 428 - (BOOL)addGenericPassword: (NSString*) password account: (NSString*) account viewHint:(NSString*)viewHint {
 429     return [self addGenericPassword:password account:account viewHint:viewHint expecting:errSecSuccess message:@"Add item to keychain with a viewhint"];
 430 }
 431
 432 - (BOOL)deleteGenericPassword: (NSString*) account {
 433     NSDictionary* query = @{(id)kSecClass : (id)kSecClassGenericPassword,
 434                             (id)kSecAttrAccount : account,
 435                             (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,};
 436
 437     return errSecSuccess == SecItemDelete((__bridge CFDictionaryRef) query);
 438 }
 439
 440 - (BOOL)findGenericPassword: (NSString*) account expecting: (OSStatus) status {
 441     NSDictionary *query = @{(id)kSecClass : (id)kSecClassGenericPassword,
 442                             (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
 443                             (id)kSecAttrAccount : account,
 444                             (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
 445                             (id)kSecMatchLimit : (id)kSecMatchLimitOne,};
 446
 447     return status == SecItemCopyMatching((__bridge CFDictionaryRef) query, NULL);
 448 }
 449
 450 - (void)checkGenericPassword: (NSString*) password account: (NSString*) account {
 451     NSDictionary *query = @{(id)kSecClass : (id)kSecClassGenericPassword,
 452                             (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
 453                             (id)kSecAttrAccount : account,
 454                             (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
 455                             (id)kSecMatchLimit : (id)kSecMatchLimitOne,
 456                             (id)kSecReturnData : (id)kCFBooleanTrue,
 457                             };
 458     CFTypeRef result = NULL;
 459
 460     XCTAssertEqual(errSecSuccess, SecItemCopyMatching((__bridge CFDictionaryRef) query, &result), "Finding item %@", account);
 461     XCTAssertNotNil((__bridge id)result, "Received an item");
 462
 463     NSString* storedPassword = [[NSString alloc] initWithData: (__bridge NSData*) result encoding: NSUTF8StringEncoding];
 464     XCTAssertNotNil(storedPassword, "Password parsed as a password");
 465
 466     XCTAssertEqualObjects(storedPassword, password, "Stored password matches received password");
 467 }
 468
 469 #pragma mark Tests
 470
 471 - (void)testAddDelete {
 472     [self startCKKSSubsystem];
 473     [self.kcv waitForKeyHierarchyReadiness];
 474
 475     XCTAssert([self addGenericPassword:@"data" account:@"ck-test-adddelete"], @"Added single item");
 476
 477     [self waitForEmptyOutgoingQueue:self.kcv];
 478     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAdd: states match after add");
 479
 480     XCTAssert([self deleteGenericPassword:@"ck-test-adddelete"], @"Deleted single item");
 481
 482     [self waitForEmptyOutgoingQueue:self.kcv];
 483     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAdd: states match after delete");
 484 }
 485
 486 - (void)testAddModDelete {
 487     [self startCKKSSubsystem];
 488     [self.kcv waitForKeyHierarchyReadiness];
 489
 490     [self addGenericPassword:@"data" account:@"ck-test-addmoddelete"];
 491
 492     [self waitForEmptyOutgoingQueue:self.kcv];
 493     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMod: states match after add");
 494
 495     [self updateGenericPassword:@"otherdata" account:@"ck-test-addmoddelete"];
 496
 497     [self waitForEmptyOutgoingQueue:self.kcv];
 498     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMod: states match after mod");
 499
 500     [self deleteGenericPassword:@"ck-test-addmoddelete"];
 501
 502     [self waitForEmptyOutgoingQueue:self.kcv];
 503     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMod: states match after del");
 504 }
 505
 506 - (void)testAddModDeleteImmediate {
 507     [self startCKKSSubsystem];
 508     [self.kcv waitForKeyHierarchyReadiness];
 509
 510     XCTAssert([self addGenericPassword:@"data" account:@"ck-test-addmoddeleteimmediate"], @"Added item");
 511     XCTAssert([self updateGenericPassword:@"otherdata" account:@"ck-test-addmoddeleteimmediate"], @"Modified item");
 512     XCTAssert([self deleteGenericPassword:@"ck-test-addmoddeleteimmediate"], @"Deleted item");
 513
 514     [self waitForEmptyOutgoingQueue:self.kcv];
 515     [self.kcv waitForFetchAndIncomingQueueProcessing];
 516     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMod: states match after immediate add/mod/delete");
 517 }
 518
 519 - (void)testReceive {
 520     [self startCKKSSubsystem];
 521     [self.kcv waitForKeyHierarchyReadiness];
 522
 523     [self findGenericPassword:@"ck-test-receive" expecting:errSecItemNotFound];
 524     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testReceive: states match before receive");
 525
 526     CKRecord *record = [self createFakeRecord:self.zoneID recordName:@"b6050e4d-e7b7-4e4e-b318-825cacc34722" withAccount:@"ck-test-receive"];
 527     [self uploadRecords:@[record]];
 528
 529     [self.kcv notifyZoneChange:nil];
 530     [self.kcv waitForFetchAndIncomingQueueProcessing];
 531
 532     [self findGenericPassword:@"ck-test-receive" expecting:errSecSuccess];
 533     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testReceive: states match after receive");
 534 }
 535
 536 - (void)testReceiveColliding {
 537     [self startCKKSSubsystem];
 538     [self.kcv waitForKeyHierarchyReadiness];
 539
 540     XCTAssert([self findGenericPassword:@"ck-test-receivecolliding" expecting:errSecItemNotFound], @"test item not yet in keychain");
 541
 542     // Conflicting items! This test does not care how conflict gets resolved, just that state is consistent after syncing
 543     CKRecord *r1 = [self createFakeRecord:self.zoneID recordName:@"97576447-c6b8-47fe-8f00-64f5da49d538" withAccount:@"ck-test-receivecolliding"];
 544     CKRecord *r2 = [self createFakeRecord:self.zoneID recordName:@"c6b86447-9757-47fe-8f00-64f5da49d538" withAccount:@"ck-test-receivecolliding"];
 545     [self uploadRecords:@[r1,r2]];
 546
 547     // poke CKKS since we won't have a real CK notification
 548     [self.kcv notifyZoneChange:nil];
 549     [self.kcv waitForFetchAndIncomingQueueProcessing];
 550     [self waitForEmptyOutgoingQueue:self.kcv];
 551
 552     XCTAssert([self findGenericPassword:@"ck-test-receivecolliding" expecting:errSecSuccess], @"Item present after download");
 553     // This will also flag an issue if the two conflicting items persist
 554     XCTAssert([self compareLocalKeychainWithCloudKitState], @"Back in sync after processing incoming changes");
 555 }
 556
 557 - (void)testAddMultipleDeleteAll {
 558     [self startCKKSSubsystem];
 559     [self.kcv waitForKeyHierarchyReadiness];
 560
 561     XCTAssert([self addMultiplePasswords:@"data" account:@"ck-test-addmultipledeleteall" amount:5]);
 562
 563     [self waitForEmptyOutgoingQueue:self.kcv];
 564     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMultipleDeleteAll: states match after adds");
 565
 566     XCTAssert([self deleteMultiplePasswords:@"ck-test-addmultipledeleteall" amount:3]);
 567
 568     [self waitForEmptyOutgoingQueue:self.kcv];
 569     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMultipleDeleteAll: states match after deletes");
 570
 571     XCTAssert([self deleteGenericPassword:@"ck-test-addmultipledeleteall005"]);
 572     XCTAssert([self deleteGenericPassword:@"ck-test-addmultipledeleteall004"]);
 573
 574     [self waitForEmptyOutgoingQueue:self.kcv];
 575     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMultipleDeleteAll: states match after deletes");
 576 }
 577
 578 - (void)testAddLotsOfItems {
 579     [ self startCKKSSubsystem];
 580     [self.kcv waitForKeyHierarchyReadiness];
 581
 582     XCTAssert([self addMultiplePasswords:@"data" account:@"ck-test-addlotsofitems" amount:250], @"Added a truckload of items");
 583
 584     XCTAssert([self waitForEmptyOutgoingQueue:self.kcv], @"Completed upload within %ld seconds", (long)self.queueTimeout);
 585     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddLotsOfItems: states match after adding tons of items");
 586
 587     XCTAssert([self deleteMultiplePasswords:@"ck-test-addlotsofitems" amount:250], @"Got rid of a truckload of items");
 588     XCTAssert([self waitForEmptyOutgoingQueue:self.kcv], @"Completed deletions within %ld seconds",(long)self.queueTimeout);
 589
 590     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddLotsOfItems: states match after removing tons of items again");
 591 }
 592
 593 #endif
 594
 595 @end