OSX/sec/Security/Regressions/secitem/si-88-sectrust-vpnprofile.c

   1 /*
   2  * Copyright (c) 2015 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #include <CoreFoundation/CoreFoundation.h>
  25 #include <Security/Security.h>
  26 #include <Security/SecCertificatePriv.h>
  27 #include <Security/SecPolicyPriv.h>
  28
  29 #include "utilities/SecCFRelease.h"
  30 #include "utilities/SecCFWrappers.h"
  31
  32 #include "Security_regressions.h"
  33
  34
  35 #include "si-88-sectrust-vpnprofile.h"
  36
  37 static void tests(void)
  38 {
  39     SecTrustRef trust = NULL;
  40     SecPolicyRef policy = NULL;
  41     SecCertificateRef cert0, cert1, cert2, cert3, rootcert;
  42     SecTrustResultType trustResult;
  43
  44     //Evaluation should succeed for cert0 and cert1
  45
  46     isnt(cert0 = SecCertificateCreateWithBytes(NULL, c0, sizeof(c0)), NULL, "create cert0");
  47     isnt(cert1 = SecCertificateCreateWithBytes(NULL, c1, sizeof(c1)), NULL, "create cert1");
  48     isnt(rootcert = SecCertificateCreateWithBytes(NULL, root, sizeof(root)), NULL, "create root cert");
  49
  50     const void *v_certs[] = { cert0, cert1 };
  51     CFArrayRef certs = CFArrayCreate(NULL, v_certs, sizeof(v_certs)/sizeof(*v_certs), &kCFTypeArrayCallBacks);
  52     CFArrayRef anchor_certs = CFArrayCreate(NULL, (const void**)&rootcert, 1, &kCFTypeArrayCallBacks);
  53
  54     /* Create AppleTV VPN profile signing policy instance. */
  55     isnt(policy = SecPolicyCreateAppleATVVPNProfileSigning(), NULL, "create policy");
  56
  57     /* Create trust reference. */
  58     ok_status(SecTrustCreateWithCertificates(certs, policy, &trust), "create trust");
  59
  60     ok_status(SecTrustSetAnchorCertificates(trust, anchor_certs), "set anchor");
  61
  62     ok_status(SecTrustEvaluate(trust, &trustResult), "evaluate trust");
  63     is_status(trustResult, kSecTrustResultUnspecified, "trustResult is kSecTrustResultUnspecified");
  64     is(SecTrustGetCertificateCount(trust), 3, "cert count is 3");
  65
  66
  67     CFReleaseSafe(trust);
  68     CFReleaseSafe(policy);
  69     CFReleaseSafe(certs);
  70     CFReleaseSafe(cert1);
  71     CFReleaseSafe(cert0);
  72
  73     //Evaluation should fail for cert2 and cert3 (wrong OID, not Apple anchor)
  74
  75     isnt(cert2 = SecCertificateCreateWithBytes(NULL, c2, sizeof(c2)), NULL, "create cert2");
  76     isnt(cert3 = SecCertificateCreateWithBytes(NULL, c3, sizeof(c3)), NULL, "create cert3");
  77
  78     const void *v_certs2[] = { cert2, cert3 };
  79     certs = CFArrayCreate(NULL, v_certs2, sizeof(v_certs2)/sizeof(*v_certs2), &kCFTypeArrayCallBacks);
  80
  81     isnt(policy = SecPolicyCreateAppleATVVPNProfileSigning(), NULL, "create policy");
  82     ok_status(SecTrustCreateWithCertificates(certs, policy, &trust), "create trust");
  83
  84     ok_status(SecTrustEvaluate(trust, &trustResult), "evaluate trust");
  85     is_status(trustResult, kSecTrustResultRecoverableTrustFailure, "trustResult is kSecTrustResultRecoverableTrustFailure");
  86
  87     CFReleaseSafe(trust);
  88     CFReleaseSafe(policy);
  89     CFReleaseSafe(certs);
  90     CFReleaseSafe(cert3);
  91     CFReleaseSafe(cert2);
  92 }
  93
  94
  95
  96 int si_88_sectrust_vpnprofile(int argc, char *const *argv);
  97
  98 int si_88_sectrust_vpnprofile(int argc, char *const *argv)
  99 {
 100     plan_tests(15);
 101
 102     tests();
 103
 104     return 0;
 105 }