RegressionTests/secitemfunctionality/secitemfunctionality.m

   1 //
   2 //  Copyright 2016 Apple. All rights reserved.
   3 //
   4
   5 /*
   6  * This is to fool os services to not provide the Keychain manager
   7  * interface tht doens't work since we don't have unified headers
   8  * between iOS and OS X. rdar://23405418/
   9  */
  10 #define __KEYCHAINCORE__ 1
  11
  12 #include <Foundation/Foundation.h>
  13 #include <Security/Security.h>
  14 #include <Security/SecItemPriv.h>
  15 #include <Security/SecBasePriv.h>
  16 #include <Security/SecIdentityPriv.h>
  17 #include <mach/mach_time.h>
  18 #include <err.h>
  19 #include <strings.h>
  20
  21 #if SEC_OS_OSX_INCLUDES
  22 #include <Security/SecKeychain.h>
  23 #endif
  24
  25 static void
  26 fail(const char *fmt, ...) __printflike(1, 2) __attribute__((noreturn));
  27
  28
  29 static void
  30 fail(const char *fmt, ...)
  31 {
  32     va_list ap;
  33     printf("[FAIL]\n");
  34     fflush(stdout);
  35
  36     va_start(ap, fmt);
  37     verrx(1, fmt, ap);
  38     va_end(ap);
  39 }
  40
  41 /*
  42  * Create item w/o data, try to make sure we end up in the OS X keychain
  43  */
  44
  45 static void
  46 CheckItemAddDeleteMaybeLegacyKeychainNoData(void)
  47 {
  48     OSStatus status;
  49
  50     printf("[BEGIN] %s\n", __FUNCTION__);
  51
  52     NSDictionary *query = @{
  53         (id)kSecClass : (id)kSecClassGenericPassword,
  54         (id)kSecAttrAccount : @"item-delete-me",
  55         (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
  56     };
  57     status = SecItemDelete((__bridge CFDictionaryRef)query);
  58     if (status != errSecSuccess && status != errSecItemNotFound)
  59         fail("cleanup item: %d", (int)status);
  60
  61     /*
  62      * now check add notification
  63      */
  64
  65     status = SecItemAdd((__bridge CFDictionaryRef)query, NULL);
  66     if (status != errSecSuccess)
  67         fail("add item: %d: %s", (int)status, [[query description] UTF8String]);
  68
  69     /*
  70      * clean up
  71      */
  72
  73     status = SecItemDelete((__bridge CFDictionaryRef)query);
  74     if (status != errSecSuccess)
  75         fail("cleanup2 item: %d", (int)status);
  76
  77
  78     printf("[PASS] %s\n", __FUNCTION__);
  79
  80 }
  81
  82 static void
  83 CheckItemAddDeleteNoData(void)
  84 {
  85     OSStatus status;
  86
  87     printf("[BEGIN] %s\n", __FUNCTION__);
  88
  89     NSDictionary *query = @{
  90         (id)kSecClass : (id)kSecClassGenericPassword,
  91         (id)kSecAttrAccessGroup : @"keychain-test1",
  92         (id)kSecAttrAccount : @"item-delete-me",
  93         (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
  94     };
  95     status = SecItemDelete((__bridge CFDictionaryRef)query);
  96     if (status != errSecSuccess && status != errSecItemNotFound)
  97         fail("cleanup item: %d", (int)status);
  98
  99     /*
 100      * Add item
 101      */
 102
 103     status = SecItemAdd((__bridge CFDictionaryRef)query, NULL);
 104     if (status != errSecSuccess)
 105         fail("add item: %d: %s", (int)status, [[query description] UTF8String]);
 106
 107     /*
 108      * clean up
 109      */
 110
 111     status = SecItemDelete((__bridge CFDictionaryRef)query);
 112     if (status != errSecSuccess)
 113         fail("cleanup2 item: %d", (int)status);
 114
 115     printf("[PASS] %s\n", __FUNCTION__);
 116 }
 117
 118 static void
 119 CheckItemUpdateAccessGroupGENP(void)
 120 {
 121     OSStatus status;
 122
 123     printf("[BEGIN] %s\n", __FUNCTION__);
 124
 125     NSDictionary *clean1 = @{
 126         (id)kSecClass : (id)kSecClassGenericPassword,
 127         (id)kSecAttrAccessGroup : @"keychain-test1",
 128     };
 129     NSDictionary *clean2 = @{
 130         (id)kSecClass : (id)kSecClassGenericPassword,
 131         (id)kSecAttrAccessGroup : @"keychain-test2",
 132     };
 133
 134     (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
 135     (void)SecItemDelete((__bridge CFDictionaryRef)clean2);
 136
 137     /*
 138      * Add item
 139      */
 140
 141     NSDictionary *add = @{
 142         (id)kSecClass : (id)kSecClassGenericPassword,
 143         (id)kSecAttrAccessGroup : @"keychain-test1",
 144         (id)kSecAttrAccount : @"item-delete-me",
 145         (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 146         (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
 147     };
 148     status = SecItemAdd((__bridge CFDictionaryRef)add, NULL);
 149     if (status != errSecSuccess)
 150         fail("add item: %d: %s", (int)status, [[add description] UTF8String]);
 151
 152     /*
 153      * Update access group
 154      */
 155     NSDictionary *query = @{
 156         (id)kSecClass : (id)kSecClassGenericPassword,
 157         (id)kSecAttrAccessGroup : @"keychain-test1",
 158         (id)kSecAttrAccount : @"item-delete-me",
 159         (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 160     };
 161     NSDictionary *modified = @{
 162         (id)kSecAttrAccessGroup : @"keychain-test2",
 163     };
 164
 165     status = SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)modified);
 166     if (status != errSecSuccess)
 167         fail("cleanup2 item: %d", (int)status);
 168
 169     /*
 170      *
 171      */
 172     NSDictionary *check1 = @{
 173         (id)kSecClass : (id)kSecClassGenericPassword,
 174         (id)kSecAttrAccessGroup : @"keychain-test1",
 175         (id)kSecAttrAccount : @"item-delete-me",
 176         (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 177     };
 178     status = SecItemCopyMatching((__bridge CFDictionaryRef)check1, NULL);
 179     if (status != errSecItemNotFound)
 180         fail("check1 item: %d", (int)status);
 181
 182
 183     NSDictionary *check2 = @{
 184         (id)kSecClass : (id)kSecClassGenericPassword,
 185         (id)kSecAttrAccessGroup : @"keychain-test2",
 186         (id)kSecAttrAccount : @"item-delete-me",
 187         (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 188     };
 189     status = SecItemCopyMatching((__bridge CFDictionaryRef)check2, NULL);
 190     if (status != errSecSuccess)
 191         fail("check2 item: %d", (int)status);
 192
 193     /*
 194      * Clean
 195      */
 196     (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
 197     (void)SecItemDelete((__bridge CFDictionaryRef)clean2);
 198
 199     printf("[PASS] %s\n", __FUNCTION__);
 200 }
 201
 202 static NSString *certDataBase64 = @"\
 203 MIIEQjCCAyqgAwIBAgIJAJdFadWqNIfiMA0GCSqGSIb3DQEBBQUAMHMxCzAJBgNVBAYTAkNaMQ8wDQYD\
 204 VQQHEwZQcmFndWUxFTATBgNVBAoTDENvc21vcywgSW5jLjEXMBUGA1UEAxMOc3VuLmNvc21vcy5nb2Qx\
 205 IzAhBgkqhkiG9w0BCQEWFHRoaW5nQHN1bi5jb3Ntb3MuZ29kMB4XDTE2MDIyNjE0NTQ0OVoXDTE4MTEy\
 206 MjE0NTQ0OVowczELMAkGA1UEBhMCQ1oxDzANBgNVBAcTBlByYWd1ZTEVMBMGA1UEChMMQ29zbW9zLCBJ\
 207 bmMuMRcwFQYDVQQDEw5zdW4uY29zbW9zLmdvZDEjMCEGCSqGSIb3DQEJARYUdGhpbmdAc3VuLmNvc21v\
 208 cy5nb2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5u9gnYEDzQIVu7yC40VcXTZ01D9CJ\
 209 oD/mH62tebEHEdfVPLWKeq+uAHnJ6fTIJQvksaISOxwiOosFjtI30mbe6LZ/oK22wYX+OUwKhAYjZQPy\
 210 RYfuaJe/52F0zmfUSJ+KTbUZrXbVVFma4xPfpg4bptvtGkFJWnufvEEHimOGmO5O69lXA0Hit1yLU0/A\
 211 MQrIMmZT8gb8LMZGPZearT90KhCbTHAxjcBfswZYeL8q3xuEVHXC7EMs6mq8IgZL7mzSBmrCfmBAIO0V\
 212 jW2kvmy0NFxkjIeHUShtYb11oYYyfHuz+1vr1y6FIoLmDejKVnwfcuNb545m26o+z/m9Lv9bAgMBAAGj\
 213 gdgwgdUwHQYDVR0OBBYEFGDdpPELS92xT+Hkh/7lcc+4G56VMIGlBgNVHSMEgZ0wgZqAFGDdpPELS92x\
 214 T+Hkh/7lcc+4G56VoXekdTBzMQswCQYDVQQGEwJDWjEPMA0GA1UEBxMGUHJhZ3VlMRUwEwYDVQQKEwxD\
 215 b3Ntb3MsIEluYy4xFzAVBgNVBAMTDnN1bi5jb3Ntb3MuZ29kMSMwIQYJKoZIhvcNAQkBFhR0aGluZ0Bz\
 216 dW4uY29zbW9zLmdvZIIJAJdFadWqNIfiMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAFYi\
 217 Zu/dfAMOrD51bYxP88Wu6iDGBe9nMG/0lkKgnX5JQKCxfxFMk875rfa+pljdUMOaPxegOXq1DrYmQB9O\
 218 /pHI+t7ozuWHRj2zKkVgMWAygNWDPcoqBEus53BdAgA644aPN2JvnE4NEPCllOMKftPoIWbd/5ZjCx3a\
 219 bCuxBdXq5YSmiEnOdGfKeXjeeEiIDgARb4tLgH5rkOpB1uH/ZCWn1hkiajBhrGhhPhpA0zbkZg2Ug+8g\
 220 XPlx1yQB1VOJkj2Z8dUEXCaRRijInCJ2eU+pgJvwLV7mxmSED7DEJ+b+opxJKYrsdKBU6RmYpPrDa+KC\
 221 /Yfu88P9hKKj0LmBiREA\
 222 ";
 223
 224 static NSString *keyDataBase64 = @"\
 225 MIIEogIBAAKCAQEAubvYJ2BA80CFbu8guNFXF02dNQ/QiaA/5h+trXmxBxHX1Ty1inqvrgB5yen0yCUL\
 226 5LGiEjscIjqLBY7SN9Jm3ui2f6CttsGF/jlMCoQGI2UD8kWH7miXv+dhdM5n1Eifik21Ga121VRZmuMT\
 227 36YOG6bb7RpBSVp7n7xBB4pjhpjuTuvZVwNB4rdci1NPwDEKyDJmU/IG/CzGRj2Xmq0/dCoQm0xwMY3A\
 228 X7MGWHi/Kt8bhFR1wuxDLOpqvCIGS+5s0gZqwn5gQCDtFY1tpL5stDRcZIyHh1EobWG9daGGMnx7s/tb\
 229 69cuhSKC5g3oylZ8H3LjW+eOZtuqPs/5vS7/WwIDAQABAoIBAGcwmQAPdyZus3OVwa1NCUD2KyB+39KG\
 230 yNmWwgx+br9Jx4s+RnJghVh8BS4MIKZOBtSRaEUOuCvAMNrupZbD+8leq34vDDRcQpCizr+M6Egj6FRj\
 231 Ewl+7Mh+yeN2hbMoghL552MTv9D4Iyxteu4nuPDd/JQ3oQwbDFIL6mlBFtiBDUr9ndemmcJ0WKuzor6a\
 232 3rgsygLs8SPyMefwIKjh5rJZls+iv3AyVEoBdCbHBz0HKgLVE9ZNmY/gWqda2dzAcJxxMdafeNVwHovv\
 233 BtyyRGnA7Yikx2XT4WLgKfuUsYLnDWs4GdAa738uxPBfiddQNeRjN7jRT1GZIWCk0P29rMECgYEA8jWi\
 234 g1Dph+4VlESPOffTEt1aCYQQWtHs13Qex95HrXX/L49fs6cOE7pvBh7nVzaKwBnPRh5+3bCPsPmRVb7h\
 235 k/GreOriCjTZtyt2XGp8eIfstfirofB7c1lNBjT61BhgjJ8Moii5c2ksNIOOZnKtD53n47mf7hiarYkw\
 236 xFEgU6ECgYEAxE8Js3gIPOBjsSw47XHuvsjP880nZZx/oiQ4IeJb/0rkoDMVJjU69WQu1HTNNAnMg4/u\
 237 RXo31h+gDZOlE9t9vSXHdrn3at67KAVmoTbRknGxZ+8tYpRJpPj1hyufynBGcKwevv3eHJHnE5eDqbHx\
 238 ynZFkXemzT9aMy3R4CCFMXsCgYAYyZpnG/m6WohE0zthMFaeoJ6dSLGvyboWVqDrzXjCbMf/4wllRlxv\
 239 cm34T2NXjpJmlH2c7HQJVg9uiivwfYdyb5If3tHhP4VkdIM5dABnCWoVOWy/NvA7XtE+KF/fItuGqKRP\
 240 WCGaiRHoEeqZ23SQm5VmvdF7OXNi/R5LiQ3o4QKBgAGX8qg2TTrRR33ksgGbbyi1UJrWC3/TqWWTjbEY\
 241 uU51OS3jvEQ3ImdjjM3EtPW7LqHSxUhjGZjvYMk7bZefrIGgkOHx2IRRkotcn9ynKURbD+mcE249beuc\
 242 6cFTJVTrXGcFvqomPWtV895A2JzECQZvt1ja88uuu/i2YoHDQdGJAoGAL2TEgiMXiunb6PzYMMKKa+mx\
 243 mFnagF0Ek3UJ9ByXKoLz3HFEl7cADIkqyenXFsAER/ifMyCoZp/PDBd6ZkpqLTdH0jQ2Yo4SllLykoiZ\
 244 fBWMfjRu4iw9E0MbPB3blmtzfv53BtWKy0LUOlN4juvpqryA7TgaUlZkfMT+T1TC7xU=\
 245 ";
 246
 247
 248 static SecIdentityRef
 249 CreateTestIdentity(void)
 250 {
 251     NSData *certData = [[NSData alloc] initWithBase64EncodedString:certDataBase64 options:0];
 252     SecCertificateRef cert = SecCertificateCreateWithData(kCFAllocatorDefault, (CFDataRef)certData);
 253     if (cert == NULL)
 254         fail("create certificate from data");
 255
 256     NSData *keyData = [[NSData alloc] initWithBase64EncodedString:keyDataBase64 options:0];
 257     NSDictionary *keyAttrs = @{
 258                                (id)kSecAttrKeyType: (id)kSecAttrKeyTypeRSA,
 259                                (id)kSecAttrKeySizeInBits: @2048,
 260                                (id)kSecAttrKeyClass: (id)kSecAttrKeyClassPrivate
 261                                };
 262     SecKeyRef privateKey = SecKeyCreateWithData((CFDataRef)keyData, (CFDictionaryRef)keyAttrs, NULL);
 263     if (privateKey == NULL)
 264         fail("create private key from data");
 265
 266     // Create identity from certificate and private key.
 267     SecIdentityRef identity = SecIdentityCreate(kCFAllocatorDefault, cert, privateKey);
 268     CFRelease(privateKey);
 269     CFRelease(cert);
 270
 271     return identity;
 272 }
 273
 274 static void
 275 CheckIdentityItem(NSString *accessGroup, OSStatus expectedStatus)
 276 {
 277     OSStatus status;
 278
 279     NSDictionary *check = @{
 280                              (id)kSecClass : (id)kSecClassIdentity,
 281                              (id)kSecAttrAccessGroup : accessGroup,
 282                              (id)kSecAttrLabel : @"item-delete-me",
 283                              (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 284                              };
 285     status = SecItemCopyMatching((__bridge CFDictionaryRef)check, NULL);
 286     if (status != expectedStatus)
 287         fail("check %s for %d item: %d", [accessGroup UTF8String], (int)expectedStatus, (int)status);
 288 }
 289
 290 static void
 291 CheckItemUpdateAccessGroupIdentity(void)
 292 {
 293     OSStatus status;
 294     CFTypeRef ref = NULL;
 295
 296     printf("[BEGIN] %s\n", __FUNCTION__);
 297
 298     NSDictionary *clean1 = @{
 299         (id)kSecClass : (id)kSecClassIdentity,
 300         (id)kSecAttrAccessGroup : @"keychain-test1",
 301     };
 302     NSDictionary *clean2 = @{
 303         (id)kSecClass : (id)kSecClassIdentity,
 304         (id)kSecAttrAccessGroup : @"keychain-test2",
 305     };
 306
 307     (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
 308     (void)SecItemDelete((__bridge CFDictionaryRef)clean2);
 309
 310     CheckIdentityItem(@"keychain-test1", errSecItemNotFound);
 311     CheckIdentityItem(@"keychain-test2", errSecItemNotFound);
 312
 313     SecIdentityRef identity = CreateTestIdentity();
 314     if (identity == NULL)
 315         fail("create private key from data");
 316
 317
 318     /*
 319      * Add item
 320      */
 321
 322     NSDictionary *add = @{
 323         (id)kSecValueRef : (__bridge id)identity,
 324         (id)kSecAttrAccessGroup : @"keychain-test1",
 325         (id)kSecAttrLabel : @"item-delete-me",
 326         (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
 327         (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 328         (id)kSecReturnPersistentRef: (id)kCFBooleanTrue,
 329     };
 330     status = SecItemAdd((__bridge CFDictionaryRef)add, &ref);
 331     if (status != errSecSuccess)
 332         fail("add item: %d: %s", (int)status, [[add description] UTF8String]);
 333
 334     /*
 335      *
 336      */
 337     CheckIdentityItem(@"keychain-test1", errSecSuccess);
 338     CheckIdentityItem(@"keychain-test2", errSecItemNotFound);
 339
 340
 341     /*
 342      * Update access group
 343      */
 344     NSDictionary *query = @{
 345         (id)kSecClass : (id)kSecClassIdentity,
 346         (id)kSecAttrAccessGroup : @"keychain-test1",
 347         (id)kSecAttrLabel : @"item-delete-me",
 348         (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 349     };
 350     NSDictionary *modified = @{
 351         (id)kSecAttrAccessGroup : @"keychain-test2",
 352     };
 353
 354     status = SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)modified);
 355     if (status != errSecSuccess)
 356         fail("cleanup2 item: %d", (int)status);
 357
 358     /*
 359      *
 360      */
 361
 362     CheckIdentityItem(@"keychain-test1", errSecItemNotFound);
 363     CheckIdentityItem(@"keychain-test2", errSecSuccess);
 364
 365     /*
 366      * Check pref
 367      */
 368     CFDataRef data = NULL;
 369
 370     NSDictionary *prefQuery = @{
 371         (id)kSecClass : (id)kSecClassIdentity,
 372         (id)kSecAttrAccessGroup : @"keychain-test2",
 373         (id)kSecAttrLabel : @"item-delete-me",
 374         (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 375         (id)kSecReturnPersistentRef : (id)kCFBooleanTrue,
 376     };
 377     status = SecItemCopyMatching((__bridge CFDictionaryRef)prefQuery, (CFTypeRef *)&data);
 378     if (status != errSecSuccess)
 379         fail("prefQuery item: %d", (int)status);
 380
 381     /*
 382      * Update access group for identity
 383      */
 384     NSDictionary *query2 = @{
 385         (id)kSecValuePersistentRef : (__bridge id)data,
 386         (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 387     };
 388     NSDictionary *modified2 = @{
 389         (id)kSecAttrAccessGroup : @"keychain-test1",
 390     };
 391
 392     status = SecItemUpdate((__bridge CFDictionaryRef)query2, (__bridge CFDictionaryRef)modified2);
 393     if (status != errSecInternal)
 394         fail("update identity with pref fails differntly: %d", (int)status);
 395
 396 /*
 397     CheckIdentityItem(@"keychain-test1", errSecSuccess);
 398     CheckIdentityItem(@"keychain-test2", errSecItemNotFound);
 399  */
 400
 401
 402     /*
 403      * Clean
 404      */
 405     (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
 406     (void)SecItemDelete((__bridge CFDictionaryRef)clean2);
 407
 408     CFRelease(identity);
 409
 410     CheckIdentityItem(@"keychain-test1", errSecItemNotFound);
 411     CheckIdentityItem(@"keychain-test2", errSecItemNotFound);
 412
 413
 414     printf("[PASS] %s\n", __FUNCTION__);
 415 }
 416
 417 static void
 418 CheckFindIdentityByReference(void)
 419 {
 420     OSStatus status;
 421     CFDataRef pref = NULL, pref2 = NULL;
 422
 423     printf("[BEGIN] %s\n", __FUNCTION__);
 424
 425     /*
 426      * Clean identities
 427      */
 428     NSDictionary *clean1 = @{
 429         (id)kSecClass : (id)kSecClassIdentity,
 430         (id)kSecAttrAccessGroup : @"keychain-test1",
 431     };
 432     (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
 433
 434     /*
 435      * Add
 436      */
 437     SecIdentityRef identity = CreateTestIdentity();
 438     if (identity == NULL)
 439         fail("create private key from data");
 440
 441
 442     NSDictionary *add = @{
 443         (id)kSecValueRef : (__bridge id)identity,
 444         (id)kSecAttrAccessGroup : @"keychain-test1",
 445         (id)kSecAttrLabel : @"CheckItemReference",
 446         (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
 447         (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 448         (id)kSecReturnPersistentRef: (id)kCFBooleanTrue,
 449     };
 450     status = SecItemAdd((__bridge CFDictionaryRef)add, (CFTypeRef *)&pref);
 451     if (status != errSecSuccess)
 452         fail("add item: %d: %s", (int)status, [[add description] UTF8String]);
 453
 454     if (pref == NULL || CFGetTypeID(pref) != CFDataGetTypeID())
 455         fail("no pref returned");
 456
 457     /*
 458      * Find by identity
 459      */
 460
 461     NSDictionary *query = @{
 462         (id)kSecValueRef : (__bridge id)identity,
 463         (id)kSecReturnPersistentRef: (id)kCFBooleanTrue,
 464     };
 465     status = SecItemCopyMatching((CFDictionaryRef)query, (CFTypeRef *)&pref2);
 466     if (status)
 467         fail("SecItemCopyMatching: %d", (int)status);
 468
 469     if (pref2 == NULL || CFGetTypeID(pref2) != CFDataGetTypeID())
 470         fail("no pref2 returned");
 471
 472
 473     if (!CFEqual(pref, pref2))
 474         fail("prefs not same");
 475
 476     CFRelease(pref2);
 477
 478     /*
 479      * Find by label
 480      */
 481
 482     NSDictionary *query2 = @{
 483         (id)kSecClass : (id)kSecClassIdentity,
 484         (id)kSecAttrAccessGroup : @"keychain-test1",
 485         (id)kSecAttrLabel : @"CheckItemReference",
 486         (id)kSecReturnPersistentRef: (id)kCFBooleanTrue,
 487     };
 488     status = SecItemCopyMatching((CFDictionaryRef)query2, (CFTypeRef *)&pref2);
 489     if (status)
 490         fail("SecItemCopyMatching: %d", (int)status);
 491
 492     if (pref2 == NULL || CFGetTypeID(pref2) != CFDataGetTypeID())
 493         fail("no pref2 returned");
 494
 495
 496     if (!CFEqual(pref, pref2))
 497         fail("prefs not same");
 498
 499     CFRelease(pref2);
 500
 501     /*
 502      * Find by label + reference
 503      */
 504
 505     NSDictionary *query3 = @{
 506         (id)kSecAttrAccessGroup : @"keychain-test1",
 507         (id)kSecAttrLabel : @"CheckItemReference",
 508         (id)kSecValueRef : (__bridge id)identity,
 509         (id)kSecReturnPersistentRef: (id)kCFBooleanTrue,
 510     };
 511     status = SecItemCopyMatching((CFDictionaryRef)query3, (CFTypeRef *)&pref2);
 512     if (status)
 513         fail("SecItemCopyMatching: %d", (int)status);
 514
 515     if (pref2 == NULL || CFGetTypeID(pref2) != CFDataGetTypeID())
 516         fail("no pref2 returned");
 517
 518
 519     if (!CFEqual(pref, pref2))
 520         fail("prefs not same");
 521
 522     CFRelease(pref2);
 523
 524     /*
 525      * Free stuff
 526      */
 527
 528     CFRelease(pref);
 529
 530     printf("[PASS] %s\n", __FUNCTION__);
 531 }
 532
 533 static uint64_t
 534 timeDiff(uint64_t start, uint64_t stop)
 535 {
 536     static uint64_t time_overhead_measured = 0;
 537     static double timebase_factor = 0;
 538
 539     if (time_overhead_measured == 0) {
 540         uint64_t t0 = mach_absolute_time();
 541         time_overhead_measured = mach_absolute_time() - t0;
 542
 543         struct mach_timebase_info timebase_info = {};
 544         mach_timebase_info(&timebase_info);
 545         timebase_factor = ((double)timebase_info.numer)/((double)timebase_info.denom);
 546     }
 547
 548     return ((stop - start - time_overhead_measured) * timebase_factor) / NSEC_PER_USEC;
 549 }
 550
 551 static void
 552 RunCopyPerfTest(NSString *name, NSDictionary *query)
 553 {
 554     uint64_t start = mach_absolute_time();
 555     OSStatus status;
 556     CFTypeRef result = NULL;
 557
 558     status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
 559     uint64_t stop = mach_absolute_time();
 560
 561     if (status != 0) {
 562         printf("SecItemCopyMatching failed with: %d\n", (int)status);
 563         fflush(stdout);
 564         abort();
 565     }
 566
 567     if (result)
 568         CFRelease(result);
 569
 570     uint64_t us = timeDiff(start, stop);
 571
 572     puts([[NSString stringWithFormat:@"[RESULT_KEY] SecItemCopyMatching-%@\n[RESULT_VALUE] %lu\n",
 573            name, (unsigned long)us] UTF8String]);
 574 }
 575
 576 static void
 577 RunDigestPerfTest(NSString *name, NSString *itemClass, NSString *accessGroup, NSUInteger expectedCount)
 578 {
 579     uint64_t start = mach_absolute_time();
 580     dispatch_semaphore_t sema = dispatch_semaphore_create(0);
 581     __block uint64_t stop;
 582
 583     _SecItemFetchDigests(itemClass, accessGroup, ^(NSArray *items, NSError *error) {
 584         stop = mach_absolute_time();
 585         if (error) {
 586             printf("_SecItemFetchDigests failed with: %ld\n", (long)error.code);
 587             fflush(stdout);
 588             abort();
 589         }
 590         dispatch_semaphore_signal(sema);
 591
 592         if (expectedCount != [items count]) {
 593             printf("_SecItemFetchDigests didn't return expected items: %ld\n", (long)[items count]);
 594             fflush(stdout);
 595             abort();
 596         }
 597     });
 598     dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
 599
 600
 601     uint64_t us = timeDiff(start, stop);
 602
 603     puts([[NSString stringWithFormat:@"[RESULT_KEY] SecItemCopyDigest-%@\n[RESULT_VALUE] %lu\n",
 604            name, (unsigned long)us] UTF8String]);
 605 }
 606
 607
 608 static void
 609 CheckItemPerformance(void)
 610 {
 611     unsigned n;
 612
 613     printf("[BEGIN] %s\n", __FUNCTION__);
 614
 615     /*
 616      * Clean identities
 617      */
 618     NSDictionary *clean1 = @{
 619         (id)kSecClass : (id)kSecClassGenericPassword,
 620         (id)kSecAttrService : @"service",
 621         (id)kSecAttrAccessGroup : @"keychain-test1",
 622         (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 623     };
 624     (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
 625
 626     NSData *data = [NSData dataWithBytes:"password" length:8];
 627
 628     for (n = 0; n < 1000; n++) {
 629         NSDictionary *item = @{
 630             (id)kSecClass : (id)kSecClassGenericPassword,
 631             (id)kSecAttrAccount : [NSString stringWithFormat:@"account-%d", n],
 632             (id)kSecAttrService : @"service",
 633             (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 634             (id)kSecAttrAccessGroup : @"keychain-test1",
 635             (id)kSecAttrNoLegacy : (id)kCFBooleanTrue,
 636             (id)kSecValueData : data,
 637         };
 638         SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 639     }
 640
 641
 642     RunCopyPerfTest(@"FindOneItemLimit", @{
 643         (id)kSecClass : (id)kSecClassGenericPassword,
 644         (id)kSecAttrService : @"service",
 645         (id)kSecMatchLimit : (id)kSecMatchLimitOne,
 646     });
 647     RunCopyPerfTest(@"FindOneItemUnique", @{
 648         (id)kSecClass : (id)kSecClassGenericPassword,
 649         (id)kSecAttrAccount : @"account-0",
 650         (id)kSecAttrService : @"service",
 651         (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 652     });
 653     RunCopyPerfTest(@"Find1000Items", @{
 654         (id)kSecClass : (id)kSecClassGenericPassword,
 655         (id)kSecAttrService : @"service",
 656         (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 657     });
 658     RunDigestPerfTest(@"Digest1000Items", (id)kSecClassGenericPassword, @"keychain-test1", 1000);
 659     RunCopyPerfTest(@"GetAttrOneItemUnique", @{
 660         (id)kSecClass : (id)kSecClassGenericPassword,
 661         (id)kSecAttrAccount : @"account-0",
 662         (id)kSecAttrService : @"service",
 663         (id)kSecReturnAttributes : (id)kCFBooleanTrue,
 664         (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 665     });
 666     RunCopyPerfTest(@"GetData1000Items", @{
 667         (id)kSecClass : (id)kSecClassGenericPassword,
 668         (id)kSecAttrService : @"service",
 669         (id)kSecReturnData : (id)kCFBooleanTrue,
 670         (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 671     });
 672     RunCopyPerfTest(@"GetDataOneItemUnique", @{
 673         (id)kSecClass : (id)kSecClassGenericPassword,
 674         (id)kSecAttrAccount : @"account-0",
 675         (id)kSecAttrService : @"service",
 676         (id)kSecReturnData : (id)kCFBooleanTrue,
 677         (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 678     });
 679     RunCopyPerfTest(@"GetDataAttrOneItemUnique", @{
 680         (id)kSecClass : (id)kSecClassGenericPassword,
 681         (id)kSecAttrAccount : @"account-0",
 682         (id)kSecAttrService : @"service",
 683         (id)kSecReturnData : (id)kCFBooleanTrue,
 684         (id)kSecReturnAttributes : (id)kCFBooleanTrue,
 685         (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 686     });
 687 #if TARGET_OS_IPHONE /* macOS doesn't support fetching data for more then one item */
 688     RunCopyPerfTest(@"GetData1000Items", @{
 689         (id)kSecClass : (id)kSecClassGenericPassword,
 690         (id)kSecAttrService : @"service",
 691         (id)kSecReturnData : (id)kCFBooleanTrue,
 692         (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 693     });
 694     RunCopyPerfTest(@"GetDataAttr1000Items", @{
 695         (id)kSecClass : (id)kSecClassGenericPassword,
 696         (id)kSecAttrService : @"service",
 697         (id)kSecReturnData : (id)kCFBooleanTrue,
 698         (id)kSecReturnAttributes : (id)kCFBooleanTrue,
 699         (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 700     });
 701 #endif
 702
 703     (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
 704
 705
 706     printf("[PASS] %s\n", __FUNCTION__);
 707 }
 708
 709 int
 710 main(int argc, const char ** argv)
 711 {
 712     printf("[TEST] secitemfunctionality\n");
 713
 714 #if TARGET_OS_OSX
 715     char *user = getenv("USER");
 716     if (user && strcmp("bats", user) == 0) {
 717         (void)SecKeychainUnlock(NULL, 4, "bats", true);
 718     }
 719 #endif
 720     CheckItemPerformance();
 721
 722     CheckFindIdentityByReference();
 723
 724     CheckItemAddDeleteMaybeLegacyKeychainNoData();
 725     CheckItemAddDeleteNoData();
 726     CheckItemUpdateAccessGroupGENP();
 727     CheckItemUpdateAccessGroupIdentity();
 728
 729     printf("[SUMMARY]\n");
 730     printf("test completed\n");
 731
 732     return 0;
 733 }