OSX/sec/securityd/Regressions/secd-33-keychain-ctk.m

   1 /*
   2  * Copyright (c) 2015 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import <Foundation/Foundation.h>
  25
  26 #include <CoreFoundation/CoreFoundation.h>
  27 #include <Security/SecFramework.h>
  28 #include <Security/SecBase.h>
  29 #include <Security/SecItem.h>
  30 #include <Security/SecItemPriv.h>
  31 #include <Security/SecKey.h>
  32 #include <Security/SecKeyPriv.h>
  33 #include <Security/SecECKey.h>
  34 #include <Security/SecAccessControl.h>
  35 #include <Security/SecAccessControlPriv.h>
  36 #include <Security/SecInternal.h>
  37 #include <Security/SecCertificatePriv.h>
  38 #include <utilities/SecFileLocations.h>
  39 #include <utilities/SecCFWrappers.h>
  40 #include <utilities/SecCFError.h>
  41 #include <utilities/SecCFRelease.h>
  42 #include <SecBase64.h>
  43
  44 #include <libaks_acl_cf_keys.h>
  45
  46 #include <ctkclient_test.h>
  47 #include <coreauthd_spi.h>
  48
  49 #include "secd_regressions.h"
  50
  51 #include "SecdTestKeychainUtilities.h"
  52 #include "SecKeybagSupport.h"
  53
  54 const char *cert1 = "MIIFQzCCBCugAwIBAgIBAjANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJVUzENMAsGA1UEChMETklTVDEUMBIGA1UEAxMLUElWIFRlc3QgQ0EwHhcNMTUwOTE2MDAwMDAwWhcNMTYwOTE2MjM1OTU5WjBlMQswCQYDVQQGEwJVUzEbMBkGA1UEChMST2JlcnR1clRlY2hub2xvZ2llMRowGAYDVQQLExFJZGVudGl0eSBEaXZpc2lvbjEdMBsGA1UEAxMUSUQtT25lIFBJViBUZXN0IENhcmQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAN8DrET5AAQ4dVIP+RD3XATFaBYpG9b2H0tV82gVGOv/t5cxOszAMxzsw7xlY/tMRrx5yz7IUUvueylHl98e7yMefP69vwqwSc4DWSELSqHOLMHd/uPLYLINIFqEW8Nq4Q02V2IxqBbiwtZeeSOqY3gQ2kiCd4cF8Itlr3UePJrlAgMBAAGjggKzMIICrzAfBgNVHSMEGDAWgBTr2hnSCEKN9N4lh2nJu6sM05YwATApBgNVHQ4EIgQg5YNVxRTOC13qs9cVUuvDIp6AH+jitdjhWJfai2bfP3QwDgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCGCGSAFlAwYIMBcGA1UdIAQQMA4wDAYKYIZIAWUDAgEDETCBtAYDVR0fBIGsMIGpMIGmoIGjoIGghkRodHRwOi8vZmljdGl0aW91cy5uaXN0Lmdvdi9maWN0aXRpb3VzQ1JMZGlyZWN0b3J5L2ZpY3RpdGlvdXNDUkwxLmNybIZYbGRhcDovL3NtaW1lMi5uaXN0Lmdvdi9jbj1Hb29kJTIwQ0Esbz1UZXN0JTIwQ2VydGlmaWNhdGVzLGM9VVM/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdDCCASEGCCsGAQUFBwEBBIIBEzCCAQ8wPgYIKwYBBQUHMAGGMmh0dHA6Ly9maWN0aXRpb3VzLm5pc3QuZ292L2ZpY3RpdGlvdXNPQ1NQTG9jYXRpb24vMF4GCCsGAQUFBzAChlJodHRwOi8vZmljdGl0aW91cy5uaXN0Lmdvdi9maWN0aXRpb3VzQ2VydHNPbmx5Q01TZGlyZWN0b3J5L2NlcnRzSXNzdWVkVG9Hb29kQ0EucDdjMG0GCCsGAQUFBzAChmFsZGFwOi8vc21pbWUyLm5pc3QuZ292L2NuPUdvb2QlMjBDQSxvPVRlc3QlMjBDZXJ0aWZpY2F0ZXMsYz1VUz9jQUNlcnRpZmljYXRlLGNyb3NzQ2VydGlmaWNhdGVQYWlyMDIGA1UdEQQrMCmgJwYIYIZIAWUDBgagGwQZ1Oc52nOc7TnOc52haFoIySreCmGE5znD4jAQBglghkgBZQMGCQEEAwEBADANBgkqhkiG9w0BAQsFAAOCAQEAVVGMeep+1wpVFdXFIXUTkxy9RjdOO3SmMGVomfVXofVOBfVzooaI+RV5UCURnoqoHYziBidxc9YKW6n9mX6p27KfrC1roHg6wu5xVEHJ93hju35g3WAXTnqNFiQpB+GU7UvJJEhkcTU2rChuYNS5SeFZ0pv1Gyzw7WjLfh9rdAPBfRg4gxpho9SMCUnI+p5KbEiptmimtPfsVq6htT3P+m2V4UXIT6sr7T6IpnPteMppsH43NKXNM6iPCkRCUPQ0d+lpfXAYGSFIzx2WesjSmrs/CHXfwmhnbrJNPCx9zlcCMmmfGcZGyufF+10wF9gv9qx+PUwi2xMKhwuKR1LoCg==";
  55 const char *cert2 =
  56 "MIIFCTCCA/GgAwIBAgIBAzANBgkqhkiG9w0BAQsFADAyMQswCQYDVQQGEwJVUzENMAsGA1UEChMETklTVDEUMBIGA1UEAxMLUElWIFRlc3QgQ0EwHhcNMTUwOTE2MDAwMDAwWhcNMTYwOTE2MjM1OTU5WjBlMQswCQYDVQQGEwJVUzEbMBkGA1UEChMST2JlcnR1clRlY2hub2xvZ2llMRowGAYDVQQLExFJZGVudGl0eSBEaXZpc2lvbjEdMBsGA1UEAxMUSUQtT25lIFBJViBUZXN0IENhcmQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKij0LIQlW0VKahBGF4tu/xdwGWN+KTLLGyMQmuuG+NNG+vQMSsdXD1pd00YMBiGn3sC5b+G7lQLZ85mDQfO+eI8GDjG+Sh8W8Cghku20sxZnQ+kZOLOr//R2/ZXonVaxoBR/9tBPh0MIEIVzRS8JmltZVfhkbIR6Wiox3jVEAsPAgMBAAGjggJ5MIICdTAfBgNVHSMEGDAWgBTr2hnSCEKN9N4lh2nJu6sM05YwATApBgNVHQ4EIgQga85kaqoMEaV+E04P1gZ2OUlbCbvr623fC30WhBZn3bMwDgYDVR0PAQH/BAQDAgbAMBcGA1UdIAQQMA4wDAYKYIZIAWUDAgEDDTCBtAYDVR0fBIGsMIGpMIGmoIGjoIGghkRodHRwOi8vZmljdGl0aW91cy5uaXN0Lmdvdi9maWN0aXRpb3VzQ1JMZGlyZWN0b3J5L2ZpY3RpdGlvdXNDUkwxLmNybIZYbGRhcDovL3NtaW1lMi5uaXN0Lmdvdi9jbj1Hb29kJTIwQ0Esbz1UZXN0JTIwQ2VydGlmaWNhdGVzLGM9VVM/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdDCCASEGCCsGAQUFBwEBBIIBEzCCAQ8wPgYIKwYBBQUHMAGGMmh0dHA6Ly9maWN0aXRpb3VzLm5pc3QuZ292L2ZpY3RpdGlvdXNPQ1NQTG9jYXRpb24vMF4GCCsGAQUFBzAChlJodHRwOi8vZmljdGl0aW91cy5uaXN0Lmdvdi9maWN0aXRpb3VzQ2VydHNPbmx5Q01TZGlyZWN0b3J5L2NlcnRzSXNzdWVkVG9Hb29kQ0EucDdjMG0GCCsGAQUFBzAChmFsZGFwOi8vc21pbWUyLm5pc3QuZ292L2NuPUdvb2QlMjBDQSxvPVRlc3QlMjBDZXJ0aWZpY2F0ZXMsYz1VUz9jQUNlcnRpZmljYXRlLGNyb3NzQ2VydGlmaWNhdGVQYWlyMCIGA1UdEQQbMBmBF2NvbW1vbl9uYW1lQHBpdmRlbW8ub3JnMA0GCSqGSIb3DQEBCwUAA4IBAQANg1tGsgO32fVXDyRPHFeqDa0QmQ4itHrh6BAK6n94QL8383wuPDFkPy1TfVYVdYm0Gne6hyH/Z13ycw1XXNddooT7+OiYK5F1TEhfQNiRhzTqblB/yc2lv6Ho0EsOrwPhaBRaO3EFUyjeNMxsvG8Dr9Y5u2B38ESB4OsLKHq0eD/WZjEAlyGx16Qi7YlLiHGfLMorgkg9Mbp73guNO1PItDTAnqHUUOlQ01ThNug0sR5ua1zlNFx6AIPoX4yAPrtlEMZtbsevsXlgDpO1zc26p5icBmQHYT7uzdTEEN4tmcxXg6Z/dGB63GCluf+Pc+ovRt/MMt2EbcIuwJ9C516H";
  57 const char *cert3 =
  58 "MIICETCCAbigAwIBAgIJANiM7uTufLiKMAkGByqGSM49BAEwgZIxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJQ3VwZXJ0aW5vMRMwEQYDVQQKEwpBcHBsZSBJbmMuMQ8wDQYDVQQLEwZDb3JlT1MxGjAYBgNVBAMTEUFwcGxlIFRlc3QgQ0EyIEVDMSAwHgYJKoZIhvcNAQkBFhF2a3V6ZWxhQGFwcGxlLmNvbTAeFw0xNjA1MTIxMTMyMzlaFw0yNjA1MTAxMTMyMzlaMGYxEDAOBgNVBAMTB3NldG9rZW4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UEBxMJQ3VwZXJ0aW5vMRMwEQYDVQQKEwpBcHBsZSBJbmMuMQ8wDQYDVQQLEwZDb3JlT1MwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQHKxfYgbqRHmThPnO9yQX5KrL/EPa6dZU52Wys5gC3/Mk0dNt9dLhpWblAVaeBzkos4juN3cxbnoB9MsC4bvoLoyMwITAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwICBDAJBgcqhkjOPQQBA0gAMEUCIQClcoYLhEA/xIGU94ZBcup26Pb7pXaWaaOM3+9z510TRwIgV/iprC051SuQzkqXA5weVliJOohFYjO+gUoH/6MJpDg=";
  59
  60 extern void LASetErrorCodeBlock(CFErrorRef (^newCreateErrorBlock)(void));
  61
  62 static void test_item_add(void) {
  63
  64     static const UInt8 data[] = { 0x01, 0x02, 0x03, 0x04 };
  65     CFDataRef valueData = CFDataCreate(NULL, data, sizeof(data));
  66     static const UInt8 oid[] = { 0x05, 0x06, 0x07, 0x08 };
  67     CFDataRef oidData = CFDataCreate(NULL, oid, sizeof(oid));
  68
  69     CFMutableDictionaryRef attrs = CFDictionaryCreateMutableForCFTypesWith(NULL,
  70                                                                            kSecClass, kSecClassGenericPassword,
  71                                                                            kSecAttrTokenID, CFSTR("tokenid"),
  72                                                                            kSecAttrService, CFSTR("ctktest-service"),
  73                                                                            kSecValueData, valueData,
  74                                                                            kSecReturnAttributes, kCFBooleanTrue,
  75                                                                            NULL);
  76     // Setup token hook.
  77     __block int phase = 0;
  78     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
  79         phase++;
  80         eq_cf(CFDictionaryGetValue(attributes, kSecAttrTokenID), CFSTR("tokenid"));
  81
  82         blocks->createOrUpdateObject = ^CFDataRef(CFDataRef objectID, CFMutableDictionaryRef at, CFErrorRef *error) {
  83             phase++;
  84             is(objectID, NULL);
  85             eq_cf(CFDictionaryGetValue(at, kSecClass), kSecClassGenericPassword);
  86             eq_cf(CFDictionaryGetValue(at, kSecAttrService), CFDictionaryGetValue(attrs, kSecAttrService));
  87             eq_cf(CFDictionaryGetValue(at, kSecAttrTokenID), CFSTR("tokenid"));
  88             eq_cf(CFDictionaryGetValue(at, kSecValueData), valueData);
  89             CFDictionaryRemoveValue(at, kSecValueData);
  90             return CFRetainSafe(oidData);
  91         };
  92
  93         blocks->copyObjectAccessControl = ^CFDataRef(CFDataRef oid, CFErrorRef *error) {
  94             phase++;
  95             SecAccessControlRef ac = SecAccessControlCreate(NULL, NULL);
  96             SecAccessControlSetProtection(ac, kSecAttrAccessibleAlwaysPrivate, NULL);
  97             test_IsTrue(SecAccessControlAddConstraintForOperation(ac, kAKSKeyOpDefaultAcl, kCFBooleanTrue, NULL));
  98             CFDataRef acData = SecAccessControlCopyData(ac);
  99             CFRelease(ac);
 100             return acData;
 101         };
 102
 103         blocks->copyObjectData = ^CFTypeRef(CFDataRef oid, CFErrorRef *error) {
 104             phase++;
 105             return CFRetain(valueData);
 106         };
 107     });
 108
 109     CFTypeRef result = NULL;
 110     ok_status(SecItemAdd(attrs, &result));
 111     eq_cf(CFDictionaryGetValue(result, kSecAttrService), CFSTR("ctktest-service"));
 112     eq_cf(CFDictionaryGetValue(result, kSecAttrTokenID), CFSTR("tokenid"));
 113     is(CFDictionaryGetValue(result, kSecValueData), NULL);
 114     CFReleaseNull(result);
 115
 116     is(phase, 3);
 117
 118     phase = 0;
 119     CFDictionarySetValue(attrs, kSecReturnData, kCFBooleanTrue);
 120     CFDictionarySetValue(attrs, kSecAttrService, CFSTR("ctktest-service1"));
 121     ok_status(SecItemAdd(attrs, &result));
 122     eq_cf(CFDictionaryGetValue(result, kSecAttrService), CFSTR("ctktest-service1"));
 123     eq_cf(CFDictionaryGetValue(result, kSecAttrTokenID), CFSTR("tokenid"));
 124     eq_cf(CFDictionaryGetValue(result, kSecValueData), valueData);
 125     CFReleaseNull(result);
 126
 127     is(phase, 4);
 128
 129     phase = 0;
 130     CFDictionaryRemoveValue(attrs, kSecReturnAttributes);
 131     CFDictionarySetValue(attrs, kSecAttrAccount, CFSTR("2nd"));
 132     ok_status(SecItemAdd(attrs, &result));
 133     eq_cf(result, valueData);
 134     CFReleaseNull(result);
 135     is(phase, 4);
 136
 137     CFRelease(attrs);
 138     CFRelease(valueData);
 139     CFRelease(oidData);
 140 }
 141
 142 static void test_item_query() {
 143     static const UInt8 oid[] = { 0x05, 0x06, 0x07, 0x08 };
 144     CFDataRef oidData = CFDataCreate(NULL, oid, sizeof(oid));
 145     static const UInt8 data[] = { 0x01, 0x02, 0x03, 0x04 };
 146     CFDataRef valueData = CFDataCreate(NULL, data, sizeof(data));
 147     CFDataRef valueData2 = CFDataCreate(NULL, data, sizeof(data) - 1);
 148
 149     __block int phase = 0;
 150     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
 151         phase++;
 152         eq_cf(CFDictionaryGetValue(attributes, kSecAttrTokenID), CFSTR("tokenid"));
 153
 154         blocks->copyObjectData = ^CFTypeRef(CFDataRef oid, CFErrorRef *error) {
 155             phase++;
 156             return CFRetain(valueData);
 157         };
 158     });
 159
 160     // Add non-token item with the same service, to test queries returning mixed results.
 161     CFMutableDictionaryRef attrs = CFDictionaryCreateMutableForCFTypesWith(NULL,
 162                                                                            kSecClass, kSecClassGenericPassword,
 163                                                                            kSecAttrService, CFSTR("ctktest-service"),
 164                                                                            kSecValueData, valueData2,
 165                                                                            NULL);
 166     ok_status(SecItemAdd(attrs, NULL));
 167     CFRelease(attrs);
 168
 169     // Query with service.
 170     CFMutableDictionaryRef query;
 171     query = CFDictionaryCreateMutableForCFTypesWith(NULL,
 172                                                     kSecClass, kSecClassGenericPassword,
 173                                                     kSecAttrService, CFSTR("ctktest-service"),
 174                                                     kSecReturnAttributes, kCFBooleanTrue,
 175                                                     kSecReturnData, kCFBooleanTrue,
 176                                                     NULL);
 177
 178     phase = 0;
 179     CFTypeRef result = NULL;
 180     ok_status(SecItemCopyMatching(query, &result));
 181     is(phase, 2);
 182     is(CFGetTypeID(result), CFDictionaryGetTypeID());
 183     eq_cf(CFDictionaryGetValue(result, kSecValueData), valueData);
 184     is(CFGetTypeID(CFDictionaryGetValue(result, kSecAttrAccessControl)), SecAccessControlGetTypeID());
 185     eq_cf(CFDictionaryGetValue(result, kSecAttrService), CFSTR("ctktest-service"));
 186     CFReleaseSafe(result);
 187
 188     phase = 0;
 189     CFDictionarySetValue(query, kSecMatchLimit, kSecMatchLimitAll);
 190     ok_status(SecItemCopyMatching(query, &result));
 191     is(phase, 2);
 192     is(CFGetTypeID(result), CFArrayGetTypeID());
 193     is(CFArrayGetCount(result), 2);
 194     CFReleaseSafe(result);
 195
 196     phase = 0;
 197     CFDictionaryRemoveValue(query, kSecMatchLimit);
 198     CFDictionaryRemoveValue(query, kSecReturnData);
 199     ok_status(SecItemCopyMatching(query, &result));
 200     is(phase, 0);
 201     is(CFGetTypeID(result), CFDictionaryGetTypeID());
 202     is(CFDictionaryGetValue(result, kSecValueData), NULL);
 203     CFReleaseSafe(result);
 204
 205     phase = 0;
 206     CFDictionaryRemoveValue(query, kSecReturnAttributes);
 207     CFDictionarySetValue(query, kSecReturnData, kCFBooleanTrue);
 208     CFDictionarySetValue(query, kSecAttrTokenID, CFSTR("tokenid"));
 209     ok_status(SecItemCopyMatching(query, &result));
 210     is(phase, 2);
 211     eq_cf(result, valueData);
 212     CFReleaseSafe(result);
 213
 214     CFRelease(query);
 215     CFRelease(valueData);
 216     CFRelease(valueData2);
 217     CFRelease(oidData);
 218 }
 219
 220 static void test_item_update() {
 221     static const UInt8 data[] = { 0x01, 0x02, 0x03, 0x04 };
 222     CFDataRef valueData2 = CFDataCreate(NULL, data, sizeof(data) - 1);
 223     CFTypeRef result = NULL;
 224
 225     CFMutableDictionaryRef query, attrs;
 226
 227     // Setup token hook.
 228     __block int phase = 0;
 229     __block bool store_value = false;
 230     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
 231         phase++;
 232         eq_cf(CFDictionaryGetValue(attributes, kSecAttrTokenID), CFSTR("tokenid"));
 233
 234         blocks->createOrUpdateObject = ^CFDataRef(CFDataRef objectID, CFMutableDictionaryRef at, CFErrorRef *error) {
 235             phase++;
 236             eq_cf(CFDictionaryGetValue(at, kSecValueData), valueData2);
 237             if (!store_value) {
 238                 CFDictionaryRemoveValue(at, kSecValueData);
 239             }
 240             return CFRetainSafe(objectID);
 241         };
 242
 243         blocks->copyObjectAccessControl = ^CFDataRef(CFDataRef oid, CFErrorRef *error) {
 244             phase++;
 245             SecAccessControlRef ac = SecAccessControlCreate(NULL, NULL);
 246             SecAccessControlSetProtection(ac, kSecAttrAccessibleAlwaysPrivate, NULL);
 247             test_IsTrue(SecAccessControlAddConstraintForOperation(ac, kAKSKeyOpDefaultAcl, kCFBooleanTrue, NULL));
 248             CFDataRef acData = SecAccessControlCopyData(ac);
 249             CFRelease(ac);
 250             return acData;
 251         };
 252
 253         blocks->copyObjectData = ^CFTypeRef(CFDataRef oid, CFErrorRef *error) {
 254             phase++;
 255             return CFRetain(valueData2);
 256         };
 257     });
 258
 259     query = CFDictionaryCreateMutableForCFTypesWith(NULL,
 260                                                     kSecClass, kSecClassGenericPassword,
 261                                                     kSecAttrTokenID, CFSTR("tokenid"),
 262                                                     kSecAttrService, CFSTR("ctktest-service"),
 263                                                     NULL);
 264
 265     attrs = CFDictionaryCreateMutableForCFTypesWith(NULL,
 266                                                     kSecValueData, valueData2,
 267                                                     NULL);
 268
 269     ok_status(SecItemUpdate(query, attrs));
 270     is(phase, 3);
 271
 272     phase = 0;
 273     CFDictionarySetValue(query, kSecReturnData, kCFBooleanTrue);
 274     ok_status(SecItemCopyMatching(query, &result));
 275     eq_cf(valueData2, result);
 276     CFRelease(result);
 277     is(phase, 2);
 278
 279     phase = 0;
 280     store_value = true;
 281     CFDictionaryRemoveValue(query, kSecReturnData);
 282     ok_status(SecItemUpdate(query, attrs));
 283     is(phase, 3);
 284
 285     phase = 0;
 286     CFDictionarySetValue(query, kSecReturnData, kCFBooleanTrue);
 287     ok_status(SecItemCopyMatching(query, &result));
 288     eq_cf(valueData2, result);
 289     CFRelease(result);
 290     is(phase, 0);
 291
 292     phase = 0;
 293     CFDictionarySetValue(query, kSecAttrService, CFSTR("ctktest-service1"));
 294     CFDictionaryRemoveValue(query, kSecReturnData);
 295     ok_status(SecItemUpdate(query, attrs));
 296     is(phase, 5);
 297
 298     phase = 0;
 299     CFDictionarySetValue(query, kSecMatchLimit, kSecMatchLimitAll);
 300     CFDictionarySetValue(query, kSecReturnData, kCFBooleanTrue);
 301     ok_status(SecItemCopyMatching(query, &result));
 302     is(phase, 0);
 303     is(CFGetTypeID(result), CFArrayGetTypeID());
 304     is(CFArrayGetCount(result), 2);
 305     eq_cf(CFArrayGetValueAtIndex(result, 0), valueData2);
 306     eq_cf(CFArrayGetValueAtIndex(result, 1), valueData2);
 307
 308     CFRelease(query);
 309     CFRelease(attrs);
 310     CFRelease(valueData2);
 311 }
 312
 313 static void test_item_delete(void) {
 314
 315     CFMutableDictionaryRef query;
 316     CFTypeRef result;
 317
 318     __block int phase = 0;
 319     __block CFErrorRef deleteError = NULL;
 320     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
 321         phase++;
 322         eq_cf(CFDictionaryGetValue(attributes, kSecAttrTokenID), CFSTR("tokenid"));
 323
 324         blocks->copyObjectAccessControl = ^CFDataRef(CFDataRef oid, CFErrorRef *error) {
 325             phase++;
 326             SecAccessControlRef ac = SecAccessControlCreate(NULL, NULL);
 327             SecAccessControlSetProtection(ac, kSecAttrAccessibleAlwaysPrivate, NULL);
 328             test_IsTrue(SecAccessControlAddConstraintForOperation(ac, kAKSKeyOpDefaultAcl, kCFBooleanTrue, NULL));
 329             CFDataRef acData = SecAccessControlCopyData(ac);
 330             CFRelease(ac);
 331             return acData;
 332         };
 333
 334         blocks->deleteObject = ^bool(CFDataRef objectID, CFErrorRef *error) {
 335             phase++;
 336             if (deleteError != NULL) {
 337                 CFAssignRetained(*error, deleteError);
 338                 deleteError = NULL;
 339                 return false;
 340             }
 341             return true;
 342         };
 343     });
 344
 345     query = CFDictionaryCreateMutableForCFTypesWith(NULL,
 346                                                     kSecClass, kSecClassGenericPassword,
 347                                                     kSecAttrTokenID, CFSTR("tokenid"),
 348                                                     kSecAttrService, CFSTR("ctktest-service"),
 349                                                     NULL);
 350
 351     phase = 0;
 352     ok_status(SecItemDelete(query));
 353     is(phase, 2);
 354
 355     phase = 0;
 356     is_status(SecItemCopyMatching(query, &result), errSecItemNotFound);
 357     is(phase, 0);
 358
 359     phase = 0;
 360     CFDictionarySetValue(query, kSecAttrService, CFSTR("ctktest-service1"));
 361     ok_status(SecItemCopyMatching(query, &result));
 362     is(phase, 0);
 363
 364     phase = 0;
 365 #if LA_CONTEXT_IMPLEMENTED
 366     LASetErrorCodeBlock(^{ return (CFErrorRef)NULL; });
 367     deleteError = CFErrorCreate(NULL, CFSTR(kTKErrorDomain), kTKErrorCodeAuthenticationFailed, NULL);
 368     ok_status(SecItemDelete(query), "delete multiple token items");
 369     is(phase, 6, "connect + delete-auth-fail + copyAccess + connect + delete + delete-2nd");
 370 #else
 371     ok_status(SecItemDelete(query), "delete multiple token items");
 372     is(phase, 3, "connect + delete + delete");
 373 #endif
 374
 375     phase = 0;
 376     is_status(SecItemCopyMatching(query, &result), errSecItemNotFound);
 377     is(phase, 0);
 378
 379     is_status(SecItemDelete(query), errSecItemNotFound);
 380
 381     CFRelease(query);
 382     CFReleaseSafe(deleteError);
 383 }
 384
 385 static void test_key_generate(int globalPersistence, int privatePersistence, int publicPersistence,
 386                               bool privateIsPersistent, bool publicIsPersistent) {
 387     __block int phase = 0;
 388     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
 389         phase |= 0x01;
 390
 391         blocks->createOrUpdateObject = ^CFDataRef(CFDataRef objectID, CFMutableDictionaryRef at, CFErrorRef *error) {
 392             id privateKey;
 393             CFTypeRef keyClass = CFDictionaryGetValue(at, kSecAttrKeyClass) ?: kSecAttrKeyClassPrivate;
 394             eq_cf(keyClass, kSecAttrKeyClassPrivate, "only private keys can be created on token");
 395             NSDictionary *params = @{ (id)kSecAttrKeyType: (id)kSecAttrKeyTypeECSECPrimeRandom, (id)kSecAttrKeySizeInBits: @256, (id)kSecAttrKeyClass: (id)kSecAttrKeyClassPrivate };
 396             if (objectID != NULL) {
 397                 phase |= 0x20;
 398                 privateKey = CFBridgingRelease(SecKeyCreateWithData((CFDataRef)objectID, (CFDictionaryRef)params, NULL));
 399             } else {
 400                 phase |= 0x02;
 401                 privateKey = CFBridgingRelease(SecKeyCreateRandomKey((CFDictionaryRef)params, error));
 402             }
 403             NSDictionary *privKeyAttrs = CFBridgingRelease(SecKeyCopyAttributes((SecKeyRef)privateKey));
 404             CFDictionarySetValue(at, kSecClass, kSecClassKey);
 405             CFDictionarySetValue(at, kSecAttrKeyType, kSecAttrKeyTypeECSECPrimeRandom);
 406             CFDictionarySetValue(at, kSecAttrKeySizeInBits, CFSTR("256"));
 407             CFDictionarySetValue(at, kSecAttrKeyClass, kSecAttrKeyClassPrivate);
 408             return CFBridgingRetain(privKeyAttrs[(id)kSecValueData]);
 409         };
 410
 411         blocks->copyObjectAccessControl = ^CFDataRef(CFDataRef oid, CFErrorRef *error) {
 412             phase |= 0x04;
 413             SecAccessControlRef ac = SecAccessControlCreate(NULL, NULL);
 414             SecAccessControlSetProtection(ac, kSecAttrAccessibleAlwaysPrivate, NULL);
 415             test_IsTrue(SecAccessControlAddConstraintForOperation(ac, kAKSKeyOpDefaultAcl, kCFBooleanTrue, NULL));
 416             CFDataRef acData = SecAccessControlCopyData(ac);
 417             CFRelease(ac);
 418             return acData;
 419         };
 420
 421         blocks->copyPublicKeyData = ^CFDataRef(CFDataRef objectID, CFErrorRef *error) {
 422             phase |= 0x08;
 423             SecKeyRef privKey = SecKeyCreateECPrivateKey(NULL, CFDataGetBytePtr(objectID), CFDataGetLength(objectID), kSecKeyEncodingBytes);
 424             CFDataRef publicData;
 425             SecKeyCopyPublicBytes(privKey, &publicData);
 426             CFRelease(privKey);
 427             return publicData;
 428         };
 429
 430         blocks->copyObjectData = ^CFTypeRef(CFDataRef oid, CFErrorRef *error) {
 431             phase |= 0x10;
 432             return kCFNull;
 433         };
 434     });
 435
 436     NSMutableDictionary *params = @{ (id)kSecAttrKeyType: (id)kSecAttrKeyTypeEC,
 437                                      (id)kSecAttrKeySizeInBits: @"256",
 438                                      (id)kSecAttrTokenID: @"tokenid",
 439                                      }.mutableCopy;
 440     if (globalPersistence >= 0) {
 441         params[(id)kSecAttrIsPermanent] = globalPersistence ? @YES : @NO;
 442     }
 443     if (publicPersistence >= 0) {
 444         params[(id)kSecPublicKeyAttrs] = @{ (id)kSecAttrIsPermanent: publicPersistence ? @YES : @NO };
 445     }
 446     if (privatePersistence >= 0) {
 447         params[(id)kSecPrivateKeyAttrs] = @{ (id)kSecAttrIsPermanent: privatePersistence ? @YES : @NO };
 448     }
 449
 450     NSError *error;
 451     phase = 0;
 452     id privateKey = CFBridgingRelease(SecKeyCreateRandomKey((CFDictionaryRef)params, (void *)&error));
 453     isnt(privateKey, nil, "failed to generate token key, error %@", error);
 454     is(phase, privateIsPersistent ? 0x3f : 0x1f);
 455     id publicKey = CFBridgingRelease(SecKeyCopyPublicKey((SecKeyRef)privateKey));
 456     isnt(publicKey, nil, "failed to get public key from private key");
 457
 458     NSDictionary *query = @{ (id)kSecValueRef: privateKey,
 459                              (id)kSecReturnAttributes: @YES,
 460                              (id)kSecReturnRef: @YES,
 461                              (id)kSecReturnData: @YES };
 462     phase = 0;
 463     NSDictionary *result;
 464     if (privateIsPersistent) {
 465         ok_status(SecItemCopyMatching((CFDictionaryRef)query, (void *)&result), "persistent private key not found in kc");
 466         is(phase, 0x19);
 467         is(result[(id)kSecValueData], nil);
 468         eq_cf((__bridge CFTypeRef)result[(id)kSecAttrTokenID], @"tokenid");
 469         NSDictionary *keyAttrs = CFBridgingRelease(SecKeyCopyAttributes((SecKeyRef)result[(id)kSecValueRef]));
 470         eq_cf((__bridge CFTypeRef)keyAttrs[(id)kSecAttrApplicationLabel], (__bridge CFTypeRef)result[(id)kSecAttrApplicationLabel]);
 471         keyAttrs = CFBridgingRelease(SecKeyCopyAttributes((SecKeyRef)publicKey));
 472         eq_cf((__bridge CFTypeRef)keyAttrs[(id)kSecAttrApplicationLabel], (__bridge CFTypeRef)result[(id)kSecAttrApplicationLabel]);
 473     } else {
 474         is_status(SecItemCopyMatching((CFDictionaryRef)query, (void *)&result), errSecItemNotFound, "ephemeral private key found in kc");
 475         is(phase, 0x08);
 476
 477         // Balancing test count from the branch above
 478         ok(true);
 479         ok(true);
 480         ok(true);
 481         ok(true);
 482     }
 483
 484     query = @{ (id)kSecValueRef: publicKey,
 485                (id)kSecReturnAttributes: @YES,
 486                (id)kSecReturnRef: @YES,
 487                (id)kSecReturnData: @YES };
 488     phase = 0;
 489     result = nil;
 490     if (publicIsPersistent) {
 491         ok_status(SecItemCopyMatching((CFDictionaryRef)query, (void *)&result), "persistent public key not found in kc");
 492         NSDictionary *keyAttrs = CFBridgingRelease(SecKeyCopyAttributes((SecKeyRef)publicKey));
 493         eq_cf((__bridge CFTypeRef)keyAttrs[(id)kSecAttrApplicationLabel], (__bridge CFTypeRef)result[(id)kSecAttrApplicationLabel]);
 494     } else {
 495         is_status(SecItemCopyMatching((CFDictionaryRef)query, (void *)&result), errSecItemNotFound, "ephemeral public key found in kc");
 496
 497         // Balancing test count from the branch above
 498         ok(true);
 499     }
 500
 501     // Get OID from the private key and try to create duplicate of the key using its OID and attributes.
 502     NSDictionary *attrs = CFBridgingRelease(SecKeyCopyAttributes((SecKeyRef)privateKey));
 503     NSData *oid = attrs[(id)kSecAttrTokenOID];
 504     ok(oid != nil, "private key attributes need OID");
 505     phase = 0;
 506     id copyKey = CFBridgingRelease(SecKeyCreateWithData((CFDataRef)[NSData data],
 507                                                         (CFDictionaryRef)@{ (id)kSecAttrTokenID: @"tokenid", (id)kSecAttrTokenOID: oid },
 508                                                         (void *)&error));
 509     ok(copyKey != nil, "copied key is created");
 510     is(phase, 0x21);
 511     attrs = CFBridgingRelease(SecKeyCopyAttributes((SecKeyRef)copyKey));
 512     is(phase, 0x29);
 513     phase = 0;
 514     eq_cf((__bridge CFTypeRef)attrs[(id)kSecClass], kSecClassKey);
 515     eq_cf((__bridge CFTypeRef)attrs[(id)kSecAttrKeyClass], kSecAttrKeyClassPrivate);
 516     eq_cf((__bridge CFTypeRef)attrs[(id)kSecAttrKeyType], kSecAttrKeyTypeECSECPrimeRandom);
 517     eq_cf((__bridge CFTypeRef)attrs[(id)kSecAttrKeySizeInBits], CFSTR("256"));
 518     eq_cf((__bridge CFTypeRef)attrs[(id)kSecAttrTokenID], CFSTR("tokenid"));
 519     id copyPublicKey = CFBridgingRelease(SecKeyCopyPublicKey((SecKeyRef)copyKey));
 520     ok(copyPublicKey != nil);
 521     is(phase, 0x08);
 522     NSDictionary *pubAttrs = CFBridgingRelease(SecKeyCopyAttributes((SecKeyRef)copyPublicKey));
 523     eq_cf((__bridge CFTypeRef)attrs[(id)kSecAttrApplicationLabel], (__bridge CFTypeRef)pubAttrs[(id)kSecAttrApplicationLabel]);
 524 }
 525
 526 static void test_key_sign(void) {
 527
 528     static const UInt8 data[] = { 0x01, 0x02, 0x03, 0x04 };
 529     CFDataRef valueData = CFDataCreate(NULL, data, sizeof(data));
 530
 531     __block int phase = 0;
 532     __block CFErrorRef cryptoError = NULL;
 533     __block SecKeyOperationType cryptoOperation = -1;
 534     __block SecKeyAlgorithm cryptoAlgorithm = NULL;
 535     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
 536         phase++;
 537
 538         blocks->copyPublicKeyData = ^CFDataRef(CFDataRef objectID, CFErrorRef *error) {
 539             phase++;
 540             SecKeyRef privKey = SecKeyCreateECPrivateKey(NULL, CFDataGetBytePtr(objectID), CFDataGetLength(objectID), kSecKeyEncodingBytes);
 541             CFDataRef publicData;
 542             ok_status(SecKeyCopyPublicBytes(privKey, &publicData));
 543             CFRelease(privKey);
 544             return publicData;
 545         };
 546
 547         blocks->copyObjectAccessControl = ^CFDataRef(CFDataRef oid, CFErrorRef *error) {
 548             phase++;
 549             SecAccessControlRef ac = SecAccessControlCreate(NULL, NULL);
 550             SecAccessControlSetProtection(ac, kSecAttrAccessibleAlwaysPrivate, NULL);
 551             test_IsTrue(SecAccessControlAddConstraintForOperation(ac, kAKSKeyOpDefaultAcl, kCFBooleanTrue, NULL));
 552             CFDataRef acData = SecAccessControlCopyData(ac);
 553             CFRelease(ac);
 554             return acData;
 555         };
 556
 557         blocks->copyOperationResult = ^CFTypeRef(CFDataRef objectID, CFIndex operation, CFArrayRef algorithms, CFIndex secKeyOperationMode, CFTypeRef in1, CFTypeRef in2, CFErrorRef *error) {
 558             SecKeyAlgorithm algorithm = CFArrayGetValueAtIndex(algorithms, CFArrayGetCount(algorithms) - 1);
 559             phase++;
 560             cryptoOperation = operation;
 561             cryptoAlgorithm = algorithm;
 562             if (cryptoError != NULL) {
 563                 CFAssignRetained(*error, cryptoError);
 564                 cryptoError = NULL;
 565                 return NULL;
 566             }
 567             return CFRetainSafe(valueData);
 568         };
 569
 570         blocks->copyObjectData = ^CFTypeRef(CFDataRef objectID, CFErrorRef *error) {
 571             phase++;
 572             return kCFNull;
 573         };
 574     });
 575
 576     NSDictionary *query = @{ (id)kSecClass: (id)kSecClassKey, (id)kSecReturnRef: @YES };
 577
 578     phase = 0;
 579     SecKeyRef privateKey = NULL;
 580     ok_status(SecItemCopyMatching((CFDictionaryRef)query, (CFTypeRef *)&privateKey));
 581     is(phase, 2);
 582
 583     phase = 0;
 584     CFMutableDataRef sig = CFDataCreateMutable(NULL, 0);
 585     CFDataSetLength(sig, 256);
 586     size_t sigLen = CFDataGetLength(sig);
 587     ok_status(SecKeyRawSign(privateKey, kSecPaddingPKCS1, data, sizeof(data), CFDataGetMutableBytePtr(sig), &sigLen));
 588     is(phase, 1);
 589     is(cryptoAlgorithm, kSecKeyAlgorithmECDSASignatureDigestX962);
 590     is(cryptoOperation, kSecKeyOperationTypeSign);
 591     CFDataSetLength(sig, sigLen);
 592     is(CFDataGetLength(sig), CFDataGetLength(valueData));
 593     eq_cf(valueData, sig);
 594
 595 #if LA_CONTEXT_IMPLEMENTED
 596     phase = 0;
 597     CFDataSetLength(sig, 256);
 598     sigLen = CFDataGetLength(sig);
 599     LASetErrorCodeBlock(^{ return (CFErrorRef)NULL; });
 600     cryptoError = CFErrorCreate(NULL, CFSTR(kTKErrorDomain), kTKErrorCodeAuthenticationFailed, NULL);
 601     ok_status(SecKeyRawSign(privateKey, kSecPaddingPKCS1, data, sizeof(data), CFDataGetMutableBytePtr(sig), &sigLen));
 602     is(phase, 4);
 603     is(cryptoError, NULL);
 604     CFDataSetLength(sig, sigLen);
 605     is(CFDataGetLength(sig), CFDataGetLength(valueData));
 606     eq_cf(valueData, sig);
 607 #endif
 608
 609     NSError *error;
 610     NSData *result;
 611     result = CFBridgingRelease(SecKeyCreateDecryptedData(privateKey, kSecKeyAlgorithmRSAEncryptionRaw,
 612                                                          valueData, (void *)&error));
 613     eq_cf((__bridge CFDataRef)result, valueData);
 614     is(cryptoAlgorithm, kSecKeyAlgorithmRSAEncryptionRaw);
 615     is(cryptoOperation, kSecKeyOperationTypeDecrypt);
 616
 617     NSDictionary *params = @{ (id)kSecAttrKeyType: (id)kSecAttrKeyTypeECSECPrimeRandom, (id)kSecAttrKeySizeInBits: @256 };
 618     SecKeyRef otherPrivKey = NULL, otherPubKey = NULL;
 619     ok_status(SecKeyGeneratePair((CFDictionaryRef)params, &otherPubKey, &otherPrivKey));
 620
 621     error = nil;
 622     result = CFBridgingRelease(SecKeyCopyKeyExchangeResult(privateKey, kSecKeyAlgorithmECDHKeyExchangeCofactor,
 623                                                            otherPubKey, (CFDictionaryRef)@{}, (void *)&error));
 624     eq_cf((__bridge CFDataRef)result, valueData);
 625     is(cryptoAlgorithm, kSecKeyAlgorithmECDHKeyExchangeCofactor);
 626     is(cryptoOperation, kSecKeyOperationTypeKeyExchange);
 627
 628     CFReleaseSafe(otherPrivKey);
 629     CFReleaseSafe(otherPubKey);
 630     CFReleaseSafe(cryptoError);
 631     CFRelease(sig);
 632     CFRelease(privateKey);
 633 }
 634
 635 static void test_key_generate_with_params(void) {
 636
 637     const UInt8 data[] = "foo";
 638     CFDataRef cred_ref = CFDataCreate(NULL, data, 4);
 639     __block int phase = 0;
 640     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
 641         phase++;
 642         eq_cf(CFDictionaryGetValue(attributes, kSecUseOperationPrompt), CFSTR("prompt"));
 643         is(CFDictionaryGetValue(attributes, kSecUseAuthenticationUI), NULL);
 644         eq_cf(CFDictionaryGetValue(attributes, kSecUseCredentialReference), cred_ref);
 645
 646         blocks->createOrUpdateObject = ^CFDataRef(CFDataRef objectID, CFMutableDictionaryRef at, CFErrorRef *error) {
 647             phase++;
 648             SecCFCreateError(-4 /* kTKErrorCodeCanceledByUser */, CFSTR(kTKErrorDomain), CFSTR(""), NULL, error);
 649             return NULL;
 650         };
 651     });
 652
 653     CFDictionaryRef prk_params = CFDictionaryCreateForCFTypes(NULL,
 654                                                               kSecAttrIsPermanent, kCFBooleanTrue,
 655                                                               NULL);
 656
 657     CFMutableDictionaryRef params = CFDictionaryCreateMutableForCFTypesWith(NULL,
 658                                                                             kSecAttrKeyType, kSecAttrKeyTypeEC,
 659                                                                             kSecAttrKeySizeInBits, CFSTR("256"),
 660                                                                             kSecAttrTokenID, CFSTR("tokenid"),
 661                                                                             kSecPrivateKeyAttrs, prk_params,
 662                                                                             kSecUseOperationPrompt, CFSTR("prompt"),
 663                                                                             kSecUseAuthenticationUI, kSecUseAuthenticationUIAllow,
 664                                                                             kSecUseCredentialReference, cred_ref,
 665                                                                             NULL);
 666     CFRelease(prk_params);
 667
 668     SecKeyRef publicKey = NULL, privateKey = NULL;
 669     phase = 0;
 670     is_status(SecKeyGeneratePair(params, &publicKey, &privateKey), errSecUserCanceled);
 671     is(phase, 2);
 672
 673     CFReleaseSafe(publicKey);
 674     CFReleaseSafe(privateKey);
 675     CFRelease(params);
 676     CFRelease(cred_ref);
 677 }
 678
 679 static void test_error_codes(void) {
 680
 681     CFMutableDictionaryRef attrs = CFDictionaryCreateMutableForCFTypesWith(NULL,
 682                                                                            kSecClass, kSecClassGenericPassword,
 683                                                                            kSecAttrTokenID, CFSTR("tokenid"),
 684                                                                            NULL);
 685     // Setup token hook.
 686     __block OSStatus ctk_error = 0;
 687     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
 688         blocks->createOrUpdateObject = ^CFDataRef(CFDataRef objectID, CFMutableDictionaryRef at, CFErrorRef *error) {
 689             SecCFCreateError(ctk_error, CFSTR(kTKErrorDomain), CFSTR(""), NULL, error);
 690             return NULL;
 691         };
 692     });
 693
 694     ctk_error = kTKErrorCodeBadParameter;
 695     is_status(SecItemAdd(attrs, NULL), errSecParam);
 696
 697     ctk_error = kTKErrorCodeNotImplemented;
 698     is_status(SecItemAdd(attrs, NULL), errSecUnimplemented);
 699
 700     ctk_error = kTKErrorCodeCanceledByUser;
 701     is_status(SecItemAdd(attrs, NULL), errSecUserCanceled);
 702
 703     CFRelease(attrs);
 704 }
 705
 706 static CFDataRef copy_certificate_data(const char *base64Cert)
 707 {
 708     size_t size = SecBase64Decode(base64Cert, strnlen(base64Cert, 2048), NULL, 0);
 709     ok(size);
 710     CFMutableDataRef data = CFDataCreateMutable(kCFAllocatorDefault, size);
 711     CFDataSetLength(data, size);
 712     size = SecBase64Decode(base64Cert, strnlen(base64Cert, 2048), (char*)CFDataGetMutableBytePtr(data), CFDataGetLength(data));
 713     ok(size);
 714     CFDataSetLength(data, size);
 715
 716     return data;
 717 }
 718
 719 static CFMutableDictionaryRef copy_certificate_attributes(const char *base64Cert)
 720 {
 721     CFDataRef data = copy_certificate_data(base64Cert);
 722
 723     SecCertificateRef cert = SecCertificateCreateWithData(kCFAllocatorDefault, data);
 724     ok(cert);
 725     CFDictionaryRef certAttributes = SecCertificateCopyAttributeDictionary(cert);
 726     ok(certAttributes);
 727     CFMutableDictionaryRef result = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0, certAttributes);
 728     ok(result);
 729
 730     if (certAttributes)
 731         CFRelease(certAttributes);
 732     if (data)
 733         CFRelease(data);
 734     if (cert)
 735         CFRelease(cert);
 736
 737     return result;
 738 }
 739
 740 static CFDictionaryRef copy_certificate_query(const char *base64cert, CFStringRef label, CFStringRef oid, CFStringRef tokenID)
 741 {
 742     CFMutableDictionaryRef certAttributes = copy_certificate_attributes(base64cert);
 743
 744     CFDictionarySetValue(certAttributes, kSecAttrLabel, label);
 745     CFDictionarySetValue(certAttributes, kSecAttrAccessible, kSecAttrAccessibleAlwaysPrivate);
 746     CFDictionarySetValue(certAttributes, kSecAttrTokenOID, oid);
 747     CFDictionaryRemoveValue(certAttributes, kSecValueData);
 748
 749     SecAccessControlRef acl = SecAccessControlCreate(kCFAllocatorDefault, NULL);
 750     ok(acl);
 751     CFTypeRef key[] = { kSecAttrTokenID };
 752     CFTypeRef value[] = { tokenID };
 753     CFDictionaryRef protection = CFDictionaryCreate(kCFAllocatorDefault, key, value, 1, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 754     ok(SecAccessControlSetProtection(acl, protection, NULL));
 755     CFRelease(protection);
 756     ok(SecAccessControlAddConstraintForOperation(acl, kAKSKeyOpDefaultAcl, kCFBooleanTrue, NULL));
 757     CFDataRef aclData = SecAccessControlCopyData(acl);
 758     ok(aclData);
 759     if (aclData) {
 760         CFDictionarySetValue(certAttributes, kSecAttrAccessControl, aclData);
 761         CFRelease(aclData);
 762     }
 763
 764     if (acl)
 765         CFRelease(acl);
 766
 767     return certAttributes;
 768 }
 769
 770 static CFDictionaryRef copy_key_query(CFDictionaryRef certAttributes, CFStringRef label, CFStringRef oid, CFStringRef tokenID)
 771 {
 772     CFMutableDictionaryRef keyAttributes = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks) ;
 773
 774     CFDictionarySetValue(keyAttributes, kSecClass, kSecClassKey);
 775     CFDictionarySetValue(keyAttributes, kSecAttrKeyClass, kSecAttrKeyClassPrivate);
 776     CFDictionarySetValue(keyAttributes, kSecAttrKeyType, kSecAttrKeyTypeRSA);
 777     CFNumberRef keySize = CFNumberCreateWithCFIndex(kCFAllocatorDefault, 2048);
 778     CFDictionarySetValue(keyAttributes, kSecAttrKeySizeInBits, keySize);
 779     CFRelease(keySize);
 780
 781     CFDictionarySetValue(keyAttributes, kSecAttrCanDecrypt, kCFBooleanTrue);
 782     CFDictionarySetValue(keyAttributes, kSecAttrCanSign, kCFBooleanTrue);
 783     CFDictionarySetValue(keyAttributes, kSecAttrCanUnwrap, kCFBooleanTrue);
 784     CFDictionarySetValue(keyAttributes, kSecAttrCanDerive, kCFBooleanFalse);
 785     CFDictionarySetValue(keyAttributes, kSecAttrIsPrivate, kCFBooleanTrue);
 786
 787     CFDictionarySetValue(keyAttributes, kSecAttrLabel, label);
 788     CFDictionarySetValue(keyAttributes, kSecAttrAccessible, kSecAttrAccessibleAlwaysPrivate);
 789     CFDictionarySetValue(keyAttributes, kSecAttrTokenOID, oid);
 790     CFDictionarySetValue(keyAttributes, kSecAttrApplicationLabel, CFDictionaryGetValue(certAttributes, kSecAttrPublicKeyHash));
 791
 792     SecAccessControlRef acl = SecAccessControlCreate(kCFAllocatorDefault, NULL);
 793     ok(acl);
 794     CFTypeRef key[] = { kSecAttrTokenID };
 795     CFTypeRef value[] = { tokenID };
 796     CFDictionaryRef protection = CFDictionaryCreate(kCFAllocatorDefault, key, value, 1, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 797     ok(SecAccessControlSetProtection(acl, protection, NULL));
 798     CFRelease(protection);
 799     ok(SecAccessControlAddConstraintForOperation(acl, kAKSKeyOpDefaultAcl, kCFBooleanTrue, NULL));
 800     CFDataRef aclData = SecAccessControlCopyData(acl);
 801     ok(aclData);
 802     if (aclData) {
 803         CFDictionarySetValue(keyAttributes, kSecAttrAccessControl, aclData);
 804         CFRelease(aclData);
 805     }
 806
 807     if (acl)
 808         CFRelease(acl);
 809
 810     return keyAttributes;
 811 }
 812
 813 static void check_array_for_type_id(CFArrayRef array, CFTypeID typeID)
 814 {
 815     if (array && CFGetTypeID(array) == CFArrayGetTypeID()) {
 816         for (CFIndex i = 0; i < CFArrayGetCount(array); ++i) {
 817             ok(CFGetTypeID(CFArrayGetValueAtIndex(array, i)) == typeID);
 818         }
 819     }
 820 }
 821
 822 static void test_propagate_token_items()
 823 {
 824     CFStringRef cert1OID = CFSTR("oid1");
 825     CFStringRef cert2OID = CFSTR("oid2");
 826     CFStringRef key1OID = CFSTR("oid3");
 827     CFStringRef key2OID = CFSTR("oid4");
 828
 829     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
 830         blocks->copyObjectData = ^CFTypeRef(CFDataRef oid, CFErrorRef *error) {
 831             if (CFEqual(oid, cert1OID)) {
 832                 return copy_certificate_data(cert1);
 833             }
 834             else if (CFEqual(oid, cert2OID)) {
 835                 return copy_certificate_data(cert2);
 836             }
 837             else if (CFEqual(oid, key1OID) || CFEqual(oid, key2OID)) {
 838                 return kCFNull;
 839             }
 840             else {
 841                 return NULL;
 842             }
 843         };
 844     });
 845
 846     CFStringRef tokenID = CFSTR("com.apple.secdtest:propagate_test_token");
 847
 848     CFMutableArrayRef items = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 849
 850     CFDictionaryRef certQuery = copy_certificate_query(cert1, CFSTR("test_cert1"), cert1OID, tokenID);
 851     ok(certQuery);
 852     CFDictionaryRef keyQuery = copy_key_query(certQuery, CFSTR("test_key1"), key1OID, tokenID);
 853     ok(keyQuery);
 854
 855     CFArrayAppendValue(items, certQuery);
 856     CFArrayAppendValue(items, keyQuery);
 857     CFReleaseSafe(certQuery);
 858     CFReleaseSafe(keyQuery);
 859
 860     certQuery = copy_certificate_query(cert2, CFSTR("test_cert2"), cert2OID, tokenID);
 861     ok(certQuery);
 862     keyQuery = copy_key_query(certQuery, CFSTR("test_key2"), key2OID, tokenID);
 863     ok(keyQuery);
 864
 865     CFArrayAppendValue(items, certQuery);
 866     CFArrayAppendValue(items, keyQuery);
 867     CFReleaseSafe(certQuery);
 868     CFReleaseSafe(keyQuery);
 869
 870     OSStatus result;
 871     ok_status(result = SecItemUpdateTokenItems(tokenID, NULL), "Failed to delete items.");
 872
 873     ok_status(result = SecItemUpdateTokenItems(tokenID, items), "Failed to propagate items.");
 874     CFRelease(items);
 875
 876     CFMutableDictionaryRef query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 877     CFDictionarySetValue(query, kSecClass, kSecClassCertificate);
 878     CFDictionarySetValue(query, kSecAttrAccessGroup, CFSTR("com.apple.token"));
 879     CFDictionarySetValue(query, kSecReturnRef, kCFBooleanTrue);
 880     CFDictionarySetValue(query, kSecMatchLimit, kSecMatchLimitAll);
 881     CFTypeRef queryResult;
 882     ok_status(SecItemCopyMatching(query, &queryResult));
 883     ok(queryResult && CFGetTypeID(queryResult) == CFArrayGetTypeID() && CFArrayGetCount(queryResult) == 2, "Expect array with two certs");
 884     check_array_for_type_id(queryResult, SecCertificateGetTypeID());
 885     CFReleaseNull(queryResult);
 886
 887     CFDictionarySetValue(query, kSecReturnRef, kCFBooleanFalse);
 888     CFDictionarySetValue(query, kSecReturnData, kCFBooleanTrue);
 889     ok_status(SecItemCopyMatching(query, &queryResult));
 890     ok(queryResult && CFGetTypeID(queryResult) == CFArrayGetTypeID() && CFArrayGetCount(queryResult) == 2, "Expect array with two certs");
 891     check_array_for_type_id(queryResult, CFDataGetTypeID());
 892     CFReleaseNull(queryResult);
 893
 894     CFDictionarySetValue(query, kSecClass, kSecClassKey);
 895     CFDictionarySetValue(query, kSecReturnRef, kCFBooleanTrue);
 896     CFDictionarySetValue(query, kSecReturnData, kCFBooleanFalse);
 897     ok_status(SecItemCopyMatching(query, &queryResult));
 898     ok(queryResult && CFGetTypeID(queryResult) == CFArrayGetTypeID() && CFArrayGetCount(queryResult) == 2, "Expect array with two keys");
 899     check_array_for_type_id(queryResult, SecKeyGetTypeID());
 900     CFReleaseNull(queryResult);
 901
 902     CFDictionarySetValue(query, kSecReturnRef, kCFBooleanFalse);
 903     CFDictionarySetValue(query, kSecReturnData, kCFBooleanTrue);
 904     ok_status(SecItemCopyMatching(query, &queryResult));
 905     ok(queryResult && CFGetTypeID(queryResult) == CFArrayGetTypeID() && CFArrayGetCount(queryResult) == 0, "Expect empty array");
 906     CFReleaseNull(queryResult);
 907
 908     CFDictionarySetValue(query, kSecClass, kSecClassIdentity);
 909     CFDictionarySetValue(query, kSecReturnRef, kCFBooleanTrue);
 910     CFDictionarySetValue(query, kSecReturnData, kCFBooleanFalse);
 911     ok_status(SecItemCopyMatching(query, &queryResult));
 912     ok(queryResult && CFGetTypeID(queryResult) == CFArrayGetTypeID() && CFArrayGetCount(queryResult) == 2, "Expect array with two identities");
 913     check_array_for_type_id(queryResult, SecIdentityGetTypeID());
 914     CFReleaseNull(queryResult);
 915
 916     CFDictionarySetValue(query, kSecReturnRef, kCFBooleanFalse);
 917     CFDictionarySetValue(query, kSecReturnData, kCFBooleanTrue);
 918     ok_status(SecItemCopyMatching(query, &queryResult));
 919     ok(queryResult && CFGetTypeID(queryResult) == CFArrayGetTypeID() && CFArrayGetCount(queryResult) == 0, "Expect empty array");
 920     CFReleaseNull(queryResult);
 921
 922     ok_status(result = SecItemUpdateTokenItems(tokenID, NULL), "Failed to delete items.");
 923
 924     CFDictionarySetValue(query, kSecReturnRef, kCFBooleanTrue);
 925     CFDictionarySetValue(query, kSecReturnData, kCFBooleanFalse);
 926     is_status(SecItemCopyMatching(query, &queryResult), errSecItemNotFound);
 927     CFReleaseNull(queryResult);
 928     CFRelease(query);
 929 }
 930
 931 static void test_identity_on_two_tokens() {
 932     CFStringRef cert3OID = CFSTR("oid1");
 933     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
 934
 935         blocks->createOrUpdateObject = ^CFDataRef(CFDataRef objectID, CFMutableDictionaryRef at, CFErrorRef *error) {
 936             return CFBridgingRetain([[NSData alloc] initWithBase64EncodedString:@"BAcrF9iBupEeZOE+c73JBfkqsv8Q9rp1lTnZbKzmALf8yTR02310uGlZuUBVp4HOSiziO43dzFuegH0ywLhu+gtJj81RD8Rt+nLR6oTARkL+0l2/fzrIouleaEYpYmEp0A==" options:NSDataBase64DecodingIgnoreUnknownCharacters]);
 937         };
 938
 939         blocks->copyPublicKeyData = ^CFDataRef(CFDataRef objectID, CFErrorRef *error) {
 940             SecKeyRef privKey = SecKeyCreateECPrivateKey(NULL, CFDataGetBytePtr(objectID), CFDataGetLength(objectID), kSecKeyEncodingBytes);
 941             ok(privKey);
 942             CFDataRef publicData;
 943             ok_status(SecKeyCopyPublicBytes(privKey, &publicData));
 944             CFReleaseSafe(privKey);
 945             return publicData;
 946         };
 947
 948         blocks->copyObjectData = ^CFTypeRef(CFDataRef oid, CFErrorRef *error) {
 949             if (CFEqual(oid, cert3OID))
 950                 return copy_certificate_data(cert3);
 951             else
 952                 return kCFNull;
 953         };
 954
 955         blocks->copyObjectAccessControl = ^CFDataRef(CFDataRef oid, CFErrorRef *error) {
 956             SecAccessControlRef ac = SecAccessControlCreate(NULL, NULL);
 957             SecAccessControlSetProtection(ac, kSecAttrAccessibleAlwaysPrivate, NULL);
 958             test_IsTrue(SecAccessControlAddConstraintForOperation(ac, kAKSKeyOpDefaultAcl, kCFBooleanTrue, NULL));
 959             CFDataRef acData = SecAccessControlCopyData(ac);
 960             CFRelease(ac);
 961             return acData;
 962         };
 963
 964         blocks->copyOperationResult = ^CFTypeRef(CFDataRef objectID, CFIndex operation, CFArrayRef algorithms, CFIndex secKeyOperationMode, CFTypeRef in1, CFTypeRef in2, CFErrorRef *error) {
 965             ok(operation == 0);
 966             SecKeyRef privKey = SecKeyCreateECPrivateKey(NULL, CFDataGetBytePtr(objectID), CFDataGetLength(objectID), kSecKeyEncodingBytes);
 967             ok(privKey);
 968             CFDataRef signature  = SecKeyCreateSignature(privKey, kSecKeyAlgorithmECDSASignatureDigestX962, in1, error);
 969             ok(signature);
 970             CFReleaseSafe(privKey);
 971             return signature;
 972         };
 973
 974     });
 975
 976     @autoreleasepool {
 977         NSString *tokenID1 = @"com.apple.secdtest:identity_test_token1";
 978         NSString *tokenID2 = @"com.apple.secdtest:identity_test_token2";
 979
 980         NSDictionary *params = @{ (id)kSecAttrKeyType : (id)kSecAttrKeyTypeEC,
 981                                   (id)kSecAttrKeySizeInBits : @"256",
 982                                   (id)kSecAttrTokenID : tokenID1,
 983                                   (id)kSecPrivateKeyAttrs : @{ (id)kSecAttrIsPermanent : @YES/*, (id)kSecAttrIsPrivate : @YES*/ }
 984                                   };
 985
 986         SecKeyRef publicKey = NULL, privateKey = NULL;
 987         ok_status(SecKeyGeneratePair((CFDictionaryRef)params, &publicKey, &privateKey));
 988
 989         NSDictionary *certQuery = CFBridgingRelease(copy_certificate_query(cert3, CFSTR("test_cert3"), cert3OID, (__bridge CFStringRef)tokenID2));
 990         ok(certQuery);
 991
 992         OSStatus result;
 993         ok_status(result = SecItemUpdateTokenItems((__bridge CFStringRef)tokenID2, (__bridge CFArrayRef)@[certQuery]), "Failed to propagate items.");
 994
 995         NSData *pubKeyHash = CFBridgingRelease(SecKeyCopyPublicKeyHash(publicKey));
 996
 997         CFTypeRef resultRef;
 998         NSDictionary *query = @{ (id)kSecClass : (id)kSecClassKey, (id)kSecAttrApplicationLabel : pubKeyHash, (id)kSecReturnRef : @YES, (id)kSecReturnAttributes : @YES };
 999         ok_status(result = SecItemCopyMatching((CFDictionaryRef)query, (CFTypeRef*)&resultRef));
1000         CFReleaseSafe(resultRef);
1001
1002         query = @{ (id)kSecClass : (id)kSecClassCertificate, (id)kSecAttrPublicKeyHash : pubKeyHash, (id)kSecReturnRef : @YES, (id)kSecReturnAttributes : @YES };
1003         ok_status(result = SecItemCopyMatching((CFDictionaryRef)query, (CFTypeRef*)&resultRef));
1004         CFReleaseSafe(resultRef);
1005
1006         query = @{ (id)kSecClass : (id)kSecClassIdentity, (id)kSecAttrApplicationLabel : pubKeyHash, (id)kSecReturnRef : @YES, (id)kSecReturnAttributes : @YES };
1007         ok_status(result = SecItemCopyMatching((CFDictionaryRef)query, (CFTypeRef*)&resultRef));
1008         CFReleaseSafe(resultRef);
1009     }
1010 }
1011
1012 static void test_ies(SecKeyRef privateKey, SecKeyAlgorithm algorithm) {
1013     TKTokenTestSetHook(^(CFDictionaryRef attributes, TKTokenTestBlocks *blocks) {
1014
1015         blocks->createOrUpdateObject = ^CFDataRef(CFDataRef objectID, CFMutableDictionaryRef at, CFErrorRef *error) {
1016             return CFBridgingRetain([@"oid" dataUsingEncoding:NSUTF8StringEncoding]);
1017         };
1018
1019         blocks->copyPublicKeyData = ^CFDataRef(CFDataRef objectID, CFErrorRef *error) {
1020             SecKeyRef publicKey = SecKeyCopyPublicKey(privateKey);
1021             CFDataRef data = SecKeyCopyExternalRepresentation(publicKey, error);
1022             CFReleaseNull(publicKey);
1023             return data;
1024         };
1025
1026         blocks->copyObjectData = ^CFTypeRef(CFDataRef oid, CFErrorRef *error) {
1027             return kCFNull;
1028         };
1029
1030         blocks->copyObjectAccessControl = ^CFDataRef(CFDataRef oid, CFErrorRef *error) {
1031             SecAccessControlRef ac = SecAccessControlCreate(NULL, NULL);
1032             SecAccessControlSetProtection(ac, kSecAttrAccessibleAlwaysPrivate, NULL);
1033             test_IsTrue(SecAccessControlAddConstraintForOperation(ac, kAKSKeyOpDefaultAcl, kCFBooleanTrue, NULL));
1034             CFDataRef acData = SecAccessControlCopyData(ac);
1035             CFRelease(ac);
1036             return acData;
1037         };
1038
1039         blocks->copyOperationResult = ^CFTypeRef(CFDataRef objectID, CFIndex operation, CFArrayRef algorithms, CFIndex secKeyOperationMode, CFTypeRef in1, CFTypeRef in2, CFErrorRef *error) {
1040             CFTypeRef result = kCFNull;
1041             CFTypeRef algorithm = CFArrayGetValueAtIndex(algorithms, CFArrayGetCount(algorithms) - 1);
1042             switch (operation) {
1043                 case kSecKeyOperationTypeKeyExchange: {
1044                     if (CFEqual(algorithm, kSecKeyAlgorithmECDHKeyExchangeStandard) ||
1045                         CFEqual(algorithm, kSecKeyAlgorithmECDHKeyExchangeCofactor)) {
1046                         NSDictionary *attrs = CFBridgingRelease(SecKeyCopyAttributes(privateKey));
1047                         NSDictionary *params = @{
1048                                                  (id)kSecAttrKeyType: attrs[(id)kSecAttrKeyType],
1049                                                  (id)kSecAttrKeySizeInBits: attrs[(id)kSecAttrKeySizeInBits],
1050                                                  (id)kSecAttrKeyClass: (id)kSecAttrKeyClassPublic,
1051                                                  };
1052                         SecKeyRef pubKey = SecKeyCreateWithData(in1, (CFDictionaryRef)params, error);
1053                         if (pubKey == NULL) {
1054                             return NULL;
1055                         }
1056                         result = SecKeyCopyKeyExchangeResult(privateKey, algorithm, pubKey, in2, error);
1057                         CFReleaseSafe(pubKey);
1058                     }
1059                     break;
1060                 }
1061                 case kSecKeyOperationTypeDecrypt: {
1062                     if (CFEqual(algorithm, kSecKeyAlgorithmRSAEncryptionRaw)) {
1063                         result = SecKeyCreateDecryptedData(privateKey, algorithm, in1, error);
1064                     }
1065                     break;
1066                 }
1067                 default:
1068                     break;
1069             }
1070             return result;
1071         };
1072     });
1073
1074     NSDictionary *privateParams = CFBridgingRelease(SecKeyCopyAttributes(privateKey));
1075     NSDictionary *params = @{ (id)kSecAttrKeyType : privateParams[(id)kSecAttrKeyType],
1076                               (id)kSecAttrKeySizeInBits : privateParams[(id)kSecAttrKeySizeInBits],
1077                               (id)kSecAttrTokenID : @"tid-ies",
1078                               (id)kSecPrivateKeyAttrs : @{ (id)kSecAttrIsPermanent : @YES }
1079                               };
1080     NSError *error;
1081     SecKeyRef tokenKey = SecKeyCreateRandomKey((CFDictionaryRef)params, (void *)&error);
1082     ok(tokenKey != NULL, "create token-based key (err %@)", error);
1083     SecKeyRef tokenPublicKey = SecKeyCopyPublicKey(tokenKey);
1084
1085     NSData *plaintext = [@"plaintext" dataUsingEncoding:NSUTF8StringEncoding];
1086
1087     error = nil;
1088     NSData *ciphertext = CFBridgingRelease(SecKeyCreateEncryptedData(tokenPublicKey, algorithm, (CFDataRef)plaintext, (void *)&error));
1089     ok(ciphertext, "failed to encrypt IES, err %@", error);
1090
1091     NSData *decrypted = CFBridgingRelease(SecKeyCreateDecryptedData(tokenKey, algorithm, (CFDataRef)ciphertext, (void *)&error));
1092     ok(decrypted, "failed to decrypt IES, err %@", error);
1093
1094     eq_cf((__bridge CFDataRef)plaintext, (__bridge CFDataRef)decrypted, "decrypted(%@) != plaintext(%@)", decrypted, plaintext);
1095
1096     CFReleaseNull(tokenKey);
1097     CFReleaseNull(tokenPublicKey);
1098 }
1099
1100 static void test_ecies() {
1101     NSError *error;
1102     SecKeyRef privateKey = SecKeyCreateRandomKey((CFDictionaryRef)@{(id)kSecAttrKeyType: (id)kSecAttrKeyTypeECSECPrimeRandom, (id)kSecAttrKeySizeInBits: @256}, (void *)&error);
1103     ok(privateKey != NULL, "failed to generate CPU EC key: %@", error);
1104
1105     test_ies(privateKey, kSecKeyAlgorithmECIESEncryptionCofactorX963SHA256AESGCM);
1106
1107     CFReleaseNull(privateKey);
1108 }
1109
1110 static void test_rsawrap() {
1111     NSError *error;
1112     SecKeyRef privateKey = SecKeyCreateRandomKey((CFDictionaryRef)@{(id)kSecAttrKeyType: (id)kSecAttrKeyTypeRSA, (id)kSecAttrKeySizeInBits: @2048}, (void *)&error);
1113     ok(privateKey != NULL, "failed to generate CPU RSA key: %@", error);
1114
1115     test_ies(privateKey, kSecKeyAlgorithmRSAEncryptionOAEPSHA256AESGCM);
1116
1117     CFReleaseNull(privateKey);
1118 }
1119
1120 static void tests(void) {
1121     /* custom keychain dir */
1122     secd_test_setup_temp_keychain("secd_33_keychain_ctk", NULL);
1123
1124     test_item_add();
1125     test_item_query();
1126     test_item_update();
1127     test_item_delete();
1128
1129     // params: int globalPersistence, int privatePersistence, int publicPersistence, bool privateIsPersistent, bool publicIsPersistent
1130     test_key_generate(-1, -1, -1, true, false);
1131     test_key_generate(0, -1, -1, false, false);
1132     test_key_generate(1, -1, -1, true, true);
1133     test_key_generate(-1, 0, 0, false, false);
1134     test_key_generate(-1, 1, 0, true, false);
1135     test_key_generate(-1, 0, 1, false, true);
1136     test_key_generate(-1, 1, 1, true, true);
1137     test_key_generate(0, 1, 1, true, true);
1138     test_key_generate(1, 1, 1, true, true);
1139
1140     test_key_sign();
1141     test_key_generate_with_params();
1142     test_error_codes();
1143     test_propagate_token_items();
1144     test_identity_on_two_tokens();
1145     test_rsawrap();
1146     test_ecies();
1147 }
1148
1149 int secd_33_keychain_ctk(int argc, char *const *argv) {
1150     plan_tests(484);
1151     tests();
1152
1153     return 0;
1154 }