secdxctests/KeychainCryptoTests.m

   1 /*
   2  * Copyright (c) 2017 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "KeychainXCTest.h"
  25 #import "SecDbKeychainItem.h"
  26 #import "SecdTestKeychainUtilities.h"
  27 #import "CKKS.h"
  28 #import "SecDbKeychainItemV7.h"
  29 #import "SecDbKeychainMetadataKeyStore.h"
  30 #import "SecItemPriv.h"
  31 #import "SecItemServer.h"
  32 #import "spi.h"
  33 #import "SecDbKeychainSerializedItemV7.h"
  34 #import "SecDbKeychainSerializedMetadata.h"
  35 #import "SecDbKeychainSerializedMetadataKey.h"
  36 #import "SecDbKeychainSerializedSecretData.h"
  37 #import "SecDbKeychainSerializedAKSWrappedKey.h"
  38 #import <utilities/SecCFWrappers.h>
  39 #import <SecurityFoundation/SFEncryptionOperation.h>
  40 #import <SecurityFoundation/SFCryptoServicesErrors.h>
  41 #import <XCTest/XCTest.h>
  42 #import <OCMock/OCMock.h>
  43 #import <notify.h>
  44
  45 @interface SecDbKeychainItemV7 ()
  46
  47 + (SFAESKeySpecifier*)keySpecifier;
  48
  49 @end
  50
  51 #if USE_KEYSTORE
  52 #include "OSX/utilities/SecAKSWrappers.h"
  53
  54 @interface KeychainCryptoTests : KeychainXCTest
  55 @end
  56
  57 @implementation KeychainCryptoTests
  58
  59 static keyclass_t parse_keyclass(CFTypeRef value) {
  60     if (!value || CFGetTypeID(value) != CFStringGetTypeID()) {
  61         return 0;
  62     }
  63
  64     if (CFEqual(value, kSecAttrAccessibleWhenUnlocked)) {
  65         return key_class_ak;
  66     }
  67     else if (CFEqual(value, kSecAttrAccessibleAfterFirstUnlock)) {
  68         return key_class_ck;
  69     }
  70     else if (CFEqual(value, kSecAttrAccessibleAlwaysPrivate)) {
  71         return key_class_dk;
  72     }
  73     else if (CFEqual(value, kSecAttrAccessibleWhenUnlockedThisDeviceOnly)) {
  74         return key_class_aku;
  75     }
  76     else if (CFEqual(value, kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly)) {
  77         return key_class_cku;
  78     }
  79     else if (CFEqual(value, kSecAttrAccessibleAlwaysThisDeviceOnlyPrivate)) {
  80         return key_class_dku;
  81     }
  82     else if (CFEqual(value, kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly)) {
  83         return key_class_akpu;
  84     }
  85     else {
  86         return 0;
  87     }
  88 }
  89
  90 - (NSDictionary* _Nullable)addTestItemExpecting:(OSStatus)code account:(NSString*)account accessible:(NSString*)accessible
  91 {
  92     NSDictionary* addQuery = @{ (id)kSecClass : (id)kSecClassGenericPassword,
  93                                 (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
  94                                 (id)kSecAttrAccount : account,
  95                                 (id)kSecAttrService : [NSString stringWithFormat:@"%@-Service", account],
  96                                 (id)kSecAttrAccessible : (id)accessible,
  97                                 (id)kSecUseDataProtectionKeychain : @(YES),
  98                                 (id)kSecReturnAttributes : @(YES),
  99                                 };
 100     CFTypeRef result = NULL;
 101
 102     if(code == errSecSuccess) {
 103         XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)addQuery, &result), code, @"Should have succeeded in adding test item to keychain");
 104         XCTAssertNotNil((__bridge id)result, @"Should have received a dictionary back from SecItemAdd");
 105     } else {
 106         XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)addQuery, &result), code, @"Should have failed to adding test item to keychain with code %d", (int)code);
 107         XCTAssertNil((__bridge id)result, @"Should not have received a dictionary back from SecItemAdd");
 108     }
 109
 110     return CFBridgingRelease(result);
 111 }
 112
 113 - (NSDictionary* _Nullable)findTestItemExpecting:(OSStatus)code account:(NSString*)account
 114 {
 115     NSDictionary* findQuery = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 116                                  (id)kSecAttrAccount : account,
 117                                  (id)kSecAttrService : [NSString stringWithFormat:@"%@-Service", account],
 118                                  (id)kSecUseDataProtectionKeychain : @(YES),
 119                                  (id)kSecReturnAttributes : @(YES),
 120                                  };
 121     CFTypeRef result = NULL;
 122
 123     if(code == errSecSuccess) {
 124         XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery, &result), code, @"Should have succeeded in finding test tiem");
 125         XCTAssertNotNil((__bridge id)result, @"Should have received a dictionary back from SecItemCopyMatching");
 126     } else {
 127         XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery, &result), code, @"Should have failed to find items in keychain with code %d", (int)code);
 128         XCTAssertNotNil((__bridge id)result, @"Should not have received a dictionary back from SecItemCopyMatching");
 129     }
 130
 131     return CFBridgingRelease(result);
 132 }
 133
 134
 135 - (void)testBasicEncryptDecrypt
 136 {
 137     CFDataRef enc = NULL;
 138     CFErrorRef error = NULL;
 139     SecAccessControlRef ac = NULL;
 140
 141     NSDictionary* secretData = @{(id)kSecValueData : @"secret here"};
 142     CFDictionaryRef emptyDict = (__bridge CFDictionaryRef)@{};
 143
 144     ac = SecAccessControlCreate(NULL, &error);
 145     XCTAssertNotNil((__bridge id)ac, @"failed to create access control with error: %@", (__bridge id)error);
 146     XCTAssertNil((__bridge id)error, @"encountered error attempting to create access control: %@", (__bridge id)error);
 147     XCTAssertTrue(SecAccessControlSetProtection(ac, kSecAttrAccessibleWhenUnlocked, &error), @"failed to set access control protection with error: %@", error);
 148     XCTAssertNil((__bridge id)error, @"encountered error attempting to set access control protection: %@", (__bridge id)error);
 149
 150     XCTAssertTrue(ks_encrypt_data(KEYBAG_DEVICE, ac, NULL, (__bridge CFDictionaryRef)secretData, emptyDict, emptyDict, &enc, true, &error), @"failed to encrypt data with error: %@", error);
 151     XCTAssertTrue(enc != NULL, @"failed to get encrypted data from encryption function");
 152     XCTAssertNil((__bridge id)error, @"encountered error attempting to encrypt data: %@", (__bridge id)error);
 153     CFReleaseNull(ac);
 154
 155     CFMutableDictionaryRef attributes = NULL;
 156     uint32_t version = 0;
 157     NSData* dummyACM = [NSData dataWithBytes:"dummy" length:5];
 158     const SecDbClass* class = kc_class_with_name(kSecClassGenericPassword);
 159     NSArray* dummyArray = [NSArray array];
 160
 161     keyclass_t keyclass = 0;
 162     XCTAssertTrue(ks_decrypt_data(KEYBAG_DEVICE, kAKSKeyOpDecrypt, &ac, (__bridge CFDataRef _Nonnull)dummyACM, enc, class, (__bridge CFArrayRef)dummyArray, &attributes, &version, true, &keyclass, &error), @"failed to decrypt data with error: %@", error);
 163     XCTAssertNil((__bridge id)error, @"encountered error attempting to decrypt data: %@", (__bridge id)error);
 164     XCTAssertEqual(keyclass, key_class_ak, @"failed to get back the keyclass from decryption");
 165
 166     CFTypeRef aclProtection = ac ? SecAccessControlGetProtection(ac) : NULL;
 167     XCTAssertNotNil((__bridge id)aclProtection, @"failed to get ACL from keychain item decryption");
 168     if (aclProtection) {
 169         XCTAssertTrue(CFEqual(aclProtection, kSecAttrAccessibleWhenUnlocked), @"the acl we got back from decryption does not match what we put in");
 170     }
 171     CFReleaseNull(ac);
 172
 173     CFReleaseNull(error);
 174     CFReleaseNull(enc);
 175 }
 176
 177 - (void)testGetMetadataThenData
 178 {
 179     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 180                             (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 181                             (id)kSecAttrAccount : @"TestAccount",
 182                             (id)kSecAttrService : @"TestService",
 183                             (id)kSecUseDataProtectionKeychain : @(YES) };
 184
 185     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 186     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 187
 188     NSMutableDictionary* metadataQuery = item.mutableCopy;
 189     [metadataQuery removeObjectForKey:(id)kSecValueData];
 190     metadataQuery[(id)kSecReturnAttributes] = @(YES);
 191     CFTypeRef foundItem = NULL;
 192     result = SecItemCopyMatching((__bridge CFDictionaryRef)metadataQuery, &foundItem);
 193     XCTAssertEqual(result, 0, @"failed to find the metadata for the item we just added in the keychain");
 194
 195     NSMutableDictionary* dataQuery = [(__bridge NSDictionary*)foundItem mutableCopy];
 196     dataQuery[(id)kSecReturnData] = @(YES);
 197     dataQuery[(id)kSecClass] = (id)kSecClassGenericPassword;
 198     dataQuery[(id)kSecUseDataProtectionKeychain] = @(YES);
 199     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 200     XCTAssertEqual(result, 0, @"failed to find the data for the item we just added to the keychain");
 201
 202     NSData* foundData = (__bridge NSData*)foundItem;
 203     if ([foundData isKindOfClass:[NSData class]]) {
 204         NSString* foundPassword = [[NSString alloc] initWithData:(__bridge NSData*)foundItem encoding:NSUTF8StringEncoding];
 205         XCTAssertEqualObjects(foundPassword, @"password", @"found password (%@) does not match the expected password", foundPassword);
 206     }
 207     else {
 208         XCTAssertTrue(false, @"found data is not the expected class: %@", foundData);
 209     }
 210 }
 211
 212 - (void)testGetReference
 213 {
 214     NSDictionary* keyParams = @{ (id)kSecAttrKeyType : (id)kSecAttrKeyTypeRSA, (id)kSecAttrKeySizeInBits : @(1024) };
 215     SecKeyRef key = SecKeyCreateRandomKey((__bridge CFDictionaryRef)keyParams, NULL);
 216     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassKey,
 217                             (id)kSecValueRef : (__bridge id)key,
 218                             (id)kSecAttrLabel : @"TestLabel",
 219                             (id)kSecUseDataProtectionKeychain : @(YES) };
 220
 221     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 222     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 223
 224     NSMutableDictionary* refQuery = item.mutableCopy;
 225     [refQuery removeObjectForKey:(id)kSecValueData];
 226     refQuery[(id)kSecReturnRef] = @(YES);
 227     CFTypeRef foundItem = NULL;
 228     result = SecItemCopyMatching((__bridge CFDictionaryRef)refQuery, &foundItem);
 229     XCTAssertEqual(result, 0, @"failed to find the reference for the item we just added in the keychain");
 230
 231     NSData* originalKeyData = (__bridge_transfer NSData*)SecKeyCopyExternalRepresentation(key, NULL);
 232     NSData* foundKeyData = (__bridge_transfer NSData*)SecKeyCopyExternalRepresentation((SecKeyRef)foundItem, NULL);
 233     XCTAssertEqualObjects(originalKeyData, foundKeyData, @"found key does not match the key we put in the keychain");
 234 }
 235
 236 - (void)testMetadataQueriesDoNotGetSecret
 237 {
 238     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 239                             (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 240                             (id)kSecAttrAccount : @"TestAccount",
 241                             (id)kSecAttrService : @"TestService",
 242                             (id)kSecUseDataProtectionKeychain : @(YES) };
 243
 244     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 245     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 246
 247     NSMutableDictionary* metadataQuery = item.mutableCopy;
 248     [metadataQuery removeObjectForKey:(id)kSecValueData];
 249     metadataQuery[(id)kSecReturnAttributes] = @(YES);
 250     CFTypeRef foundItem = NULL;
 251     result = SecItemCopyMatching((__bridge CFDictionaryRef)metadataQuery, &foundItem);
 252     XCTAssertEqual(result, 0, @"failed to find the metadata for the item we just added in the keychain");
 253
 254     NSData* data = [(__bridge NSDictionary*)foundItem valueForKey:(id)kSecValueData];
 255     XCTAssertNil(data, @"unexpectedly found data in a metadata query");
 256 }
 257
 258 - (void)testDeleteItem
 259 {
 260     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 261                             (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 262                             (id)kSecAttrAccount : @"TestAccount",
 263                             (id)kSecAttrService : @"TestService",
 264                             (id)kSecUseDataProtectionKeychain : @(YES) };
 265
 266     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 267     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 268
 269     NSMutableDictionary* dataQuery = item.mutableCopy;
 270     [dataQuery removeObjectForKey:(id)kSecValueData];
 271     dataQuery[(id)kSecReturnData] = @(YES);
 272     CFTypeRef foundItem = NULL;
 273     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 274     XCTAssertEqual(result, 0, @"failed to find the data for the item we just added in the keychain");
 275
 276     result = SecItemDelete((__bridge CFDictionaryRef)dataQuery);
 277     XCTAssertEqual(result, 0, @"failed to delete item");
 278 }
 279
 280 - (SecDbKeychainSerializedItemV7*)serializedItemWithPassword:(NSString*)password metadataAttributes:(NSDictionary*)metadata
 281 {
 282     NSError* error;
 283     SecDbKeychainItemV7* item = [[SecDbKeychainItemV7 alloc] initWithSecretAttributes:@{(id)kSecValueData : password} metadataAttributes:metadata tamperCheck:[[NSUUID UUID] UUIDString] keyclass:9];
 284     [item encryptMetadataWithKeybag:0 error:&error];
 285     XCTAssertNil(error, "error encrypting metadata with keybag 0");
 286     [item encryptSecretDataWithKeybag:0 accessControl:SecAccessControlCreate(NULL, NULL) acmContext:nil error:&error];
 287     XCTAssertNil(error, "error encrypting secret data with keybag 0");
 288     SecDbKeychainSerializedItemV7* serializedItem = [[SecDbKeychainSerializedItemV7 alloc] init];
 289     serializedItem.encryptedMetadata = item.encryptedMetadataBlob;
 290     serializedItem.encryptedSecretData = item.encryptedSecretDataBlob;
 291     serializedItem.keyclass = 9;
 292     return serializedItem;
 293 }
 294
 295 - (void)testTamperChecksThwartTampering
 296 {
 297     SecDbKeychainSerializedItemV7* serializedItem1 = [self serializedItemWithPassword:@"first password" metadataAttributes:nil];
 298     SecDbKeychainSerializedItemV7* serializedItem2 = [self serializedItemWithPassword:@"second password" metadataAttributes:nil];
 299
 300     serializedItem1.encryptedSecretData = serializedItem2.encryptedSecretData;
 301     NSData* tamperedSerializedItemBlob = serializedItem1.data;
 302
 303     NSError* error = nil;
 304     SecDbKeychainItemV7* item = [[SecDbKeychainItemV7 alloc] initWithData:tamperedSerializedItemBlob decryptionKeybag:0 error:&error];
 305     XCTAssertNil(item, @"unexpectedly deserialized an item blob which has been tampered");
 306     XCTAssertNotNil(error, @"failed to get an error when deserializing tampered item blob");
 307 }
 308
 309 - (void)testCacheExpiration
 310 {
 311
 312     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 313                             (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 314                             (id)kSecAttrAccount : @"TestAccount",
 315                             (id)kSecAttrService : @"TestService",
 316                             (id)kSecAttrAccessible : (id)kSecAttrAccessibleWhenUnlocked,
 317                             (id)kSecUseDataProtectionKeychain : @YES };
 318
 319     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 320     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 321
 322     NSMutableDictionary* dataQuery = item.mutableCopy;
 323     [dataQuery removeObjectForKey:(id)kSecValueData];
 324     dataQuery[(id)kSecReturnData] = @(YES);
 325
 326     CFTypeRef foundItem = NULL;
 327
 328     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 329     XCTAssertEqual(result, 0, @"failed to find the data for the item we just added in the keychain");
 330     CFReleaseNull(foundItem);
 331
 332     self.lockState = LockStateLockedAndDisallowAKS;
 333
 334     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 335     XCTAssertEqual(result, errSecInteractionNotAllowed, @"get the lock error");
 336     XCTAssertEqual(foundItem, NULL, @"got item anyway: %@", foundItem);
 337
 338     self.lockState = LockStateUnlocked;
 339
 340     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 341     XCTAssertEqual(result, 0, @"failed to find the data for the item we just added in the keychain");
 342     CFReleaseNull(foundItem);
 343
 344     result = SecItemDelete((__bridge CFDictionaryRef)dataQuery);
 345     XCTAssertEqual(result, 0, @"failed to delete item");
 346 }
 347
 348 - (void)trashMetadataClassAKey
 349 {
 350     __block CFErrorRef cferror = NULL;
 351     kc_with_dbt(true, &cferror, ^bool(SecDbConnectionRef dbt) {
 352         CFStringRef sql = CFSTR("UPDATE metadatakeys SET data = ? WHERE keyclass = '6'");
 353         NSData* garbage = [@"super bad key" dataUsingEncoding:NSUTF8StringEncoding];
 354         SecDbPrepare(dbt, sql, &cferror, ^(sqlite3_stmt *stmt) {
 355             SecDbBindObject(stmt, 1, (__bridge CFDataRef)garbage, &cferror);
 356             SecDbStep(dbt, stmt, &cferror, NULL);
 357             XCTAssertEqual(cferror, NULL, "Should be no error trashing class A metadatakey");
 358             CFReleaseNull(cferror);
 359         });
 360         XCTAssertEqual(cferror, NULL, "Should be no error completing SecDbPrepare for trashing class A metadatakey");
 361         return true;
 362     });
 363     CFReleaseNull(cferror);
 364
 365     [[SecDbKeychainMetadataKeyStore sharedStore] dropClassAKeys];
 366 }
 367
 368 - (void)deleteMetadataClassAKey
 369 {
 370     CFErrorRef cferror = NULL;
 371
 372     kc_with_dbt(true, &cferror, ^bool(SecDbConnectionRef dbt) {
 373         CFErrorRef errref = NULL;
 374         SecDbExec(dbt, CFSTR("DELETE FROM metadatakeys WHERE keyclass = '6'"), &errref);
 375         XCTAssertEqual(errref, NULL, "Should be no error deleting class A metadatakey");
 376         CFReleaseNull(errref);
 377         return true;
 378     });
 379     CFReleaseNull(cferror);
 380
 381     [[SecDbKeychainMetadataKeyStore sharedStore] dropClassAKeys];
 382 }
 383
 384 - (void)checkDatabaseExistenceOfMetadataKey:(keyclass_t)keyclass shouldExist:(bool)shouldExist value:(NSData*)expectedData
 385 {
 386     CFErrorRef cferror = NULL;
 387     __block NSData* wrappedKey;
 388     kc_with_dbt(true, &cferror, ^bool(SecDbConnectionRef dbt) {
 389         __block CFErrorRef errref = NULL;
 390
 391         NSString* sql = [NSString stringWithFormat:@"SELECT data, actualKeyclass FROM metadatakeys WHERE keyclass = %d", keyclass];
 392         __block bool ok = true;
 393         ok &= SecDbPrepare(dbt, (__bridge CFStringRef)sql, &errref, ^(sqlite3_stmt *stmt) {
 394             ok &= SecDbStep(dbt, stmt, &errref, ^(bool *stop) {
 395                 wrappedKey = [[NSData alloc] initWithBytes:sqlite3_column_blob(stmt, 0) length:sqlite3_column_bytes(stmt, 0)];
 396             });
 397         });
 398
 399         XCTAssertTrue(ok, "Should have completed all operations correctly");
 400         XCTAssertEqual(errref, NULL, "Should be no error trying to find class A metadatakey");
 401
 402         if(shouldExist) {
 403             XCTAssertNotNil(wrappedKey, "Metadata class key should exist");
 404             if (expectedData) {
 405                 XCTAssertEqualObjects(wrappedKey, expectedData);
 406             }
 407         } else {
 408             XCTAssertNil(wrappedKey, "Metadata class key should not exist");
 409         }
 410         CFReleaseNull(errref);
 411         return true;
 412     });
 413     CFReleaseNull(cferror);
 414 }
 415
 416 - (void)testKeychainCorruptionCopyMatching
 417 {
 418     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 419                             (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 420                             (id)kSecAttrAccount : @"TestAccount",
 421                             (id)kSecAttrService : @"TestService",
 422                             (id)kSecAttrAccessible : (id)kSecAttrAccessibleWhenUnlocked,
 423                             (id)kSecUseDataProtectionKeychain : @YES };
 424
 425     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 426     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 427     [self checkDatabaseExistenceOfMetadataKey:key_class_ak shouldExist:true value:nil];
 428
 429     NSMutableDictionary* dataQuery = item.mutableCopy;
 430     [dataQuery removeObjectForKey:(id)kSecValueData];
 431     dataQuery[(id)kSecReturnData] = @(YES);
 432
 433     CFTypeRef foundItem = NULL;
 434
 435     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 436     XCTAssertEqual(result, 0, @"failed to find the data for the item we just added in the keychain");
 437     CFReleaseNull(foundItem);
 438
 439     [self trashMetadataClassAKey];
 440     [self checkDatabaseExistenceOfMetadataKey:key_class_ak shouldExist:true value:[@"super bad key" dataUsingEncoding:NSUTF8StringEncoding]];
 441
 442     /* when metadata corrupted, we should not find the item */
 443     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 444     XCTAssertEqual(result, errSecItemNotFound, @"failed to find the data for the item we just added in the keychain");
 445     CFReleaseNull(foundItem);
 446
 447     // Just calling SecItemCopyMatching shouldn't have created a new metadata key
 448     [self checkDatabaseExistenceOfMetadataKey:key_class_ak shouldExist:true value:[@"super bad key" dataUsingEncoding:NSUTF8StringEncoding]];
 449
 450     /* CopyMatching will delete corrupt pre-emptively */
 451     result = SecItemDelete((__bridge CFDictionaryRef)dataQuery);
 452     XCTAssertEqual(result, -25300, @"corrupt item was not deleted for us");
 453 }
 454
 455 - (void)testKeychainDeletionCopyMatching
 456 {
 457     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 458                             (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 459                             (id)kSecAttrAccount : @"TestAccount",
 460                             (id)kSecAttrService : @"TestService",
 461                             (id)kSecAttrAccessible : (id)kSecAttrAccessibleWhenUnlocked,
 462                             (id)kSecUseDataProtectionKeychain : @YES };
 463
 464     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 465     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 466     [self checkDatabaseExistenceOfMetadataKey:key_class_ak shouldExist:true value:nil];
 467
 468     NSMutableDictionary* dataQuery = item.mutableCopy;
 469     [dataQuery removeObjectForKey:(id)kSecValueData];
 470     dataQuery[(id)kSecReturnData] = @(YES);
 471
 472     CFTypeRef foundItem = NULL;
 473
 474     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 475     XCTAssertEqual(result, 0, @"failed to find the data for the item we just added in the keychain");
 476     CFReleaseNull(foundItem);
 477
 478     [self deleteMetadataClassAKey];
 479     [self checkDatabaseExistenceOfMetadataKey:key_class_ak shouldExist:false value:nil];
 480
 481     /* when metadata corrupted, we should not find the item */
 482     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 483     XCTAssertEqual(result, errSecItemNotFound, @"failed to find the data for the item we just added in the keychain");
 484     CFReleaseNull(foundItem);
 485
 486     // Just calling SecItemCopyMatching shouldn't have created a new metadata key
 487     [self checkDatabaseExistenceOfMetadataKey:key_class_ak shouldExist:false value:nil];
 488
 489     /* CopyMatching will delete corrupt pre-emptively */
 490     result = SecItemDelete((__bridge CFDictionaryRef)dataQuery);
 491     XCTAssertEqual(result, -25300, @"corrupt item was not deleted for us");
 492 }
 493
 494 - (void)testKeychainCorruptionAddOverCorruptedEntry
 495 {
 496     __security_simulatecrash_enable(false);
 497
 498     CFTypeRef foundItem = NULL;
 499     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 500                             (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 501                             (id)kSecAttrAccount : @"TestAccount",
 502                             (id)kSecAttrService : @"TestService",
 503                             (id)kSecAttrAccessible : (id)kSecAttrAccessibleWhenUnlocked,
 504                             (id)kSecUseDataProtectionKeychain : @YES };
 505
 506     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 507     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 508
 509     NSMutableDictionary* dataQuery = item.mutableCopy;
 510     [dataQuery removeObjectForKey:(id)kSecValueData];
 511     dataQuery[(id)kSecReturnData] = @(YES);
 512
 513     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 514     XCTAssertEqual(result, 0, @"failed to find the data for the item we just added in the keychain");
 515     CFReleaseNull(foundItem);
 516
 517     [self trashMetadataClassAKey];
 518
 519     result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 520     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 521
 522     result = SecItemDelete((__bridge CFDictionaryRef)dataQuery);
 523     XCTAssertEqual(result, 0, @"failed to delete item");
 524 }
 525
 526 - (void)testKeychainCorruptionUpdateCorruptedEntry
 527 {
 528     __security_simulatecrash_enable(false);
 529
 530     CFTypeRef foundItem = NULL;
 531     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 532                             (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 533                             (id)kSecAttrAccount : @"TestAccount",
 534                             (id)kSecAttrService : @"TestService",
 535                             (id)kSecAttrAccessible : (id)kSecAttrAccessibleWhenUnlocked,
 536                             (id)kSecUseDataProtectionKeychain : @YES };
 537
 538     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 539     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 540
 541     NSMutableDictionary* dataQuery = item.mutableCopy;
 542     [dataQuery removeObjectForKey:(id)kSecValueData];
 543     dataQuery[(id)kSecReturnData] = @(YES);
 544
 545     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 546     XCTAssertEqual(result, 0, @"failed to find the data for the item we just added in the keychain");
 547     CFReleaseNull(foundItem);
 548
 549     [self trashMetadataClassAKey];
 550
 551     NSMutableDictionary* updateQuery = item.mutableCopy;
 552     updateQuery[(id)kSecValueData] = NULL;
 553     NSDictionary *updateData = @{
 554         (id)kSecValueData : [@"foo" dataUsingEncoding:NSUTF8StringEncoding],
 555     };
 556
 557     result = SecItemUpdate((__bridge CFDictionaryRef)updateQuery,
 558                            (__bridge CFDictionaryRef)updateData );
 559     XCTAssertEqual(result, errSecItemNotFound, @"failed to add test item to keychain");
 560
 561     result = SecItemDelete((__bridge CFDictionaryRef)dataQuery);
 562     XCTAssertEqual(result, 0, @"failed to delete item");
 563 }
 564
 565 - (void)testNoCrashWhenMetadataDecryptionFails
 566 {
 567     CFDataRef enc = NULL;
 568     CFErrorRef error = NULL;
 569     SecAccessControlRef ac = NULL;
 570
 571     self.allowDecryption = NO;
 572
 573     NSDictionary* secretData = @{(id)kSecValueData : @"secret here"};
 574     CFDictionaryRef emptyDict = (__bridge CFDictionaryRef)@{};
 575
 576     ac = SecAccessControlCreate(NULL, &error);
 577     XCTAssertNotNil((__bridge id)ac, @"failed to create access control with error: %@", (__bridge id)error);
 578     XCTAssertNil((__bridge id)error, @"encountered error attempting to create access control: %@", (__bridge id)error);
 579     XCTAssertTrue(SecAccessControlSetProtection(ac, kSecAttrAccessibleWhenUnlocked, &error), @"failed to set access control protection with error: %@", error);
 580     XCTAssertNil((__bridge id)error, @"encountered error attempting to set access control protection: %@", (__bridge id)error);
 581
 582     XCTAssertTrue(ks_encrypt_data(KEYBAG_DEVICE, ac, NULL, (__bridge CFDictionaryRef)secretData, emptyDict, emptyDict, &enc, true, &error), @"failed to encrypt data with error: %@", error);
 583     XCTAssertTrue(enc != NULL, @"failed to get encrypted data from encryption function");
 584     XCTAssertNil((__bridge id)error, @"encountered error attempting to encrypt data: %@", (__bridge id)error);
 585     CFReleaseNull(ac);
 586
 587     CFMutableDictionaryRef attributes = NULL;
 588     uint32_t version = 0;
 589     NSData* dummyACM = [NSData dataWithBytes:"dummy" length:5];
 590     const SecDbClass* class = kc_class_with_name(kSecClassGenericPassword);
 591     NSArray* dummyArray = [NSArray array];
 592
 593     keyclass_t keyclass = 0;
 594     XCTAssertNoThrow(ks_decrypt_data(KEYBAG_DEVICE, kAKSKeyOpDecrypt, &ac, (__bridge CFDataRef _Nonnull)dummyACM, enc, class, (__bridge CFArrayRef)dummyArray, &attributes, &version, true, &keyclass, &error), @"unexpected exception when decryption fails");
 595     XCTAssertEqual(keyclass, key_class_ak, @"failed to get back the keyclass when decryption failed");
 596
 597     self.allowDecryption = YES;
 598 }
 599
 600 #if 0
 601 // these tests fail until we address <rdar://problem/37523001> Fix keychain lock state check to be both secure and fast for EDU mode
 602 - (void)testOperationsDontUseCachedKeysWhileLockedWithAKSAvailable // simulating the backup situation
 603 {
 604     self.lockState = LockStateLockedAndAllowAKS;
 605
 606     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 607                             (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 608                             (id)kSecAttrAccount : @"TestAccount",
 609                             (id)kSecAttrService : @"TestService",
 610                             (id)kSecUseDataProtectionKeychain : @(YES) };
 611
 612     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 613     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 614
 615     NSMutableDictionary* metadataQuery = item.mutableCopy;
 616     [metadataQuery removeObjectForKey:(id)kSecValueData];
 617     metadataQuery[(id)kSecReturnAttributes] = @(YES);
 618     CFTypeRef foundItem = NULL;
 619     result = SecItemCopyMatching((__bridge CFDictionaryRef)metadataQuery, &foundItem);
 620     XCTAssertEqual(result, 0, @"failed to find the metadata for the item we just added in the keychain");
 621
 622     XCTAssertTrue(self.didAKSDecrypt, @"we did not go through AKS to decrypt the metadata key while locked - bad!");
 623
 624     NSMutableDictionary* dataQuery = item.mutableCopy;
 625     dataQuery[(id)kSecReturnData] = @(YES);
 626     result = SecItemCopyMatching((__bridge CFDictionaryRef)dataQuery, &foundItem);
 627     XCTAssertEqual(result, 0, @"failed to find the data for the item we just added to the keychain");
 628
 629     NSData* foundData = (__bridge NSData*)foundItem;
 630     if ([foundData isKindOfClass:[NSData class]]) {
 631         NSString* foundPassword = [[NSString alloc] initWithData:(__bridge NSData*)foundItem encoding:NSUTF8StringEncoding];
 632         XCTAssertEqualObjects(foundPassword, @"password", @"found password (%@) does not match the expected password", foundPassword);
 633     }
 634     else {
 635         XCTAssertTrue(false, @"found data is not the expected class: %@", foundData);
 636     }
 637 }
 638
 639 - (void)testNoResultsWhenLocked
 640 {
 641     NSDictionary* item = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 642                             (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 643                             (id)kSecAttrAccount : @"TestAccount",
 644                             (id)kSecAttrService : @"TestService",
 645                             (id)kSecUseDataProtectionKeychain : @(YES) };
 646
 647     OSStatus result = SecItemAdd((__bridge CFDictionaryRef)item, NULL);
 648     XCTAssertEqual(result, 0, @"failed to add test item to keychain");
 649
 650     self.lockState = LockStateLockedAndDisallowAKS;
 651
 652     NSMutableDictionary* metadataQuery = item.mutableCopy;
 653     [metadataQuery removeObjectForKey:(id)kSecValueData];
 654     metadataQuery[(id)kSecReturnAttributes] = @(YES);
 655     CFTypeRef foundItem = NULL;
 656     result = SecItemCopyMatching((__bridge CFDictionaryRef)metadataQuery, &foundItem);
 657     XCTAssertEqual(foundItem, NULL, @"somehow still got results when AKS was locked");
 658 }
 659 #endif
 660
 661 + (NSData*)fakeDecrypt:(SFAuthenticatedCiphertext*)ciphertext withKey:(SFSymmetricKey*)key error:(NSError**)error
 662 {
 663     return nil;
 664 }
 665
 666 - (void)testRecoverFromBadMetadataKey
 667 {
 668     __security_simulatecrash_enable(false);
 669
 670     // Disable caching, so we can change AKS encrypt/decrypt
 671     id mockSecDbKeychainMetadataKeyStore = OCMClassMock([SecDbKeychainMetadataKeyStore class]);
 672     OCMStub([mockSecDbKeychainMetadataKeyStore cachingEnabled]).andReturn(false);
 673
 674     NSDictionary* addQuery = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 675                                 (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 676                                 (id)kSecAttrAccount : @"TestAccount",
 677                                 (id)kSecAttrService : @"TestService",
 678                                 (id)kSecUseDataProtectionKeychain : @(YES),
 679                                 (id)kSecReturnAttributes : @(YES),
 680                              };
 681
 682     NSDictionary* findQuery = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 683                                  (id)kSecAttrAccount : @"TestAccount",
 684                                  (id)kSecAttrService : @"TestService",
 685                                  (id)kSecUseDataProtectionKeychain : @(YES),
 686                                  (id)kSecReturnAttributes : @(YES),
 687                                 };
 688
 689 #if TARGET_OS_OSX
 690     NSDictionary* updateQuery = findQuery;
 691 #else
 692     // iOS won't tolerate kSecReturnAttributes in SecItemUpdate
 693     NSDictionary* updateQuery = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 694                                    (id)kSecAttrAccount : @"TestAccount",
 695                                    (id)kSecAttrService : @"TestService",
 696                                    (id)kSecUseDataProtectionKeychain : @(YES),
 697                                  };
 698 #endif
 699
 700     NSDictionary* addQuery2 = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 701                                  (id)kSecValueData : [@"password" dataUsingEncoding:NSUTF8StringEncoding],
 702                                  (id)kSecAttrAccount : @"TestAccount-second",
 703                                  (id)kSecAttrService : @"TestService-second",
 704                                  (id)kSecUseDataProtectionKeychain : @(YES),
 705                                  (id)kSecReturnAttributes : @(YES),
 706                                  };
 707
 708     NSDictionary* findQuery2 = @{ (id)kSecClass : (id)kSecClassGenericPassword,
 709                                   (id)kSecAttrAccount : @"TestAccount-second",
 710                                   (id)kSecAttrService : @"TestService-second",
 711                                   (id)kSecUseDataProtectionKeychain : @(YES),
 712                                   (id)kSecReturnAttributes : @(YES),
 713                                  };
 714
 715     CFTypeRef result = NULL;
 716
 717     // Add the item
 718     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)addQuery, &result), errSecSuccess, @"Should have succeeded in adding test item to keychain");
 719     XCTAssertNotNil((__bridge id)result, @"Should have received a dictionary back from SecItemAdd");
 720     CFReleaseNull(result);
 721
 722     // Add a second item, for fun and profit
 723     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)addQuery2, &result),
 724                    errSecSuccess,
 725                    @"Should have succeeded in adding test2 item to keychain");
 726
 727     // And we can find te item
 728     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery, &result), errSecSuccess, @"Should be able to find item");
 729     XCTAssertNotNil((__bridge id)result, @"Should have received a dictionary back from SecItemCopyMatching");
 730     CFReleaseNull(result);
 731
 732     // And we can update the item
 733     XCTAssertEqual(SecItemUpdate((__bridge CFDictionaryRef)updateQuery,
 734                                  (__bridge CFDictionaryRef)@{(id)kSecValueData: [@"otherpassword" dataUsingEncoding:NSUTF8StringEncoding]}),
 735                    errSecSuccess,
 736                    "Should be able to update an item");
 737
 738     // And find it again
 739     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery, &result), errSecSuccess, @"Should be able to find item");
 740     XCTAssertNotNil((__bridge id)result, @"Should have received a dictionary back from SecItemCopyMatching");
 741     CFReleaseNull(result);
 742
 743     // And we can find the second item
 744     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery2, &result),
 745                    errSecSuccess, @"Should be able to find second item");
 746     XCTAssertNotNil((__bridge id)result, @"Should have received a dictionary back from SecItemCopyMatching for item 2");
 747     CFReleaseNull(result);
 748
 749     ///////////////////////////////////////////////////////////////////////////////////
 750     // Now, the metadata keys go corrupt (fake that by changing the underlying AKS key)
 751     [self setNewFakeAKSKey:[NSData dataWithBytes:"NotthesameAKSkeyas0123456789etc" length:32]];
 752
 753     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery, &result), errSecItemNotFound,
 754                    "should have received errSecItemNotFound when metadata keys are invalid");
 755     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery, &result), errSecItemNotFound,
 756                    "Multiple finds of the same item should receive errSecItemNotFound when metadata keys are invalid");
 757     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery, &result), errSecItemNotFound,
 758                    "Multiple finds of the same item should receive errSecItemNotFound when metadata keys are invalid");
 759
 760     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery2, &result),
 761                    errSecItemNotFound, @"Should not be able to find corrupt second item");
 762     XCTAssertNil((__bridge id)result, @"Should have received no data back from SICM for corrupt item");
 763
 764     // Updating the now-corrupt item should fail
 765     XCTAssertEqual(SecItemUpdate((__bridge CFDictionaryRef)updateQuery,
 766                                  (__bridge CFDictionaryRef)@{ (id)kSecValueData: [@"otherpassword" dataUsingEncoding:NSUTF8StringEncoding] }),
 767                    errSecItemNotFound,
 768                    "Should not be able to update a corrupt item");
 769
 770     // Re-add the item (should succeed)
 771     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)addQuery, &result), errSecSuccess, @"Should have succeeded in adding test item to keychain");
 772     XCTAssertNotNil((__bridge id)result, @"Should have received a dictionary back from SecItemAdd");
 773     CFReleaseNull(result);
 774
 775     // And we can find it again
 776     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery, &result), errSecSuccess, @"Should be able to find item");
 777     XCTAssertNotNil((__bridge id)result, @"Should have received a dictionary back from SecItemAdd");
 778     CFReleaseNull(result);
 779
 780     // And update it
 781     XCTAssertEqual(SecItemUpdate((__bridge CFDictionaryRef)updateQuery,
 782                                  (__bridge CFDictionaryRef)@{ (id)kSecValueData: [@"otherpassword" dataUsingEncoding:NSUTF8StringEncoding] }),
 783                    errSecSuccess,
 784                    "Should be able to update a fixed item");
 785
 786     /////////////
 787     // And our second item, which is wrapped under an old key, can't be found
 788     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery2, &result),
 789                    errSecItemNotFound, @"Should not be able to find corrupt second item");
 790     XCTAssertNil((__bridge id)result, @"Should have received no data back from SICM for corrupt item");
 791
 792     // But can be re-added
 793     XCTAssertEqual(SecItemAdd((__bridge CFDictionaryRef)addQuery2, &result),
 794                    errSecSuccess,
 795                    @"Should have succeeded in adding test2 item to keychain after corruption");
 796     XCTAssertNotNil((__bridge id)result, @"Should have received a dictionary back from SecItemAdd for item 2 (after corruption)");
 797     CFReleaseNull(result);
 798
 799     // And we can find the second item again
 800     XCTAssertEqual(SecItemCopyMatching((__bridge CFDictionaryRef)findQuery2, &result),
 801                    errSecSuccess, @"Should be able to find second item after re-add");
 802     XCTAssertNotNil((__bridge id)result, @"Should have received a dictionary back from SecItemCopyMatching for item 2 (after re-add)");
 803     CFReleaseNull(result);
 804
 805     [mockSecDbKeychainMetadataKeyStore stopMocking];
 806 }
 807
 808 // If a metadata key is created during a database transaction which is later rolled back, it shouldn't be cached for use later.
 809 - (void)testMetadataKeyDoesntOutliveTxionRollback {
 810     NSString* testAccount = @"TestAccount";
 811     NSString* otherAccount = @"OtherAccount";
 812     NSString* thirdAccount = @"ThirdAccount";
 813     [self addTestItemExpecting:errSecSuccess account:testAccount accessible:(id)kSecAttrAccessibleAfterFirstUnlock];
 814     [self checkDatabaseExistenceOfMetadataKey:key_class_ck shouldExist:true value:nil];
 815     [self checkDatabaseExistenceOfMetadataKey:key_class_cku shouldExist:false value:nil];
 816
 817     // This should fail, and not create a CKU metadata key
 818     [self addTestItemExpecting:errSecDuplicateItem account:testAccount accessible:(id)kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly];
 819     [self checkDatabaseExistenceOfMetadataKey:key_class_ck shouldExist:true value:nil];
 820     [self checkDatabaseExistenceOfMetadataKey:key_class_cku shouldExist:false value:nil];
 821
 822     // But successfully creating a new CKU item should create the key
 823     [self addTestItemExpecting:errSecSuccess account:otherAccount accessible:(id)kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly];
 824     [self checkDatabaseExistenceOfMetadataKey:key_class_ck shouldExist:true value:nil];
 825     [self checkDatabaseExistenceOfMetadataKey:key_class_cku shouldExist:true value:nil];
 826
 827     // Drop all metadata key caches
 828     [SecDbKeychainMetadataKeyStore resetSharedStore];
 829
 830     [self findTestItemExpecting:errSecSuccess account:testAccount];
 831     [self findTestItemExpecting:errSecSuccess account:otherAccount];
 832
 833     // Adding another CKU item now should be fine
 834     [self addTestItemExpecting:errSecSuccess account:thirdAccount accessible:(id)kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly];
 835     [self checkDatabaseExistenceOfMetadataKey:key_class_ck shouldExist:true value:nil];
 836     [self checkDatabaseExistenceOfMetadataKey:key_class_cku shouldExist:true value:nil];
 837
 838     // Drop all metadata key caches once more, to ensure we can find all three items from the persisted keys
 839     [SecDbKeychainMetadataKeyStore resetSharedStore];
 840
 841     [self findTestItemExpecting:errSecSuccess account:testAccount];
 842     [self findTestItemExpecting:errSecSuccess account:otherAccount];
 843     [self findTestItemExpecting:errSecSuccess account:thirdAccount];
 844 }
 845
 846 - (void)testRecoverDataFromBadKeyclassStorage
 847 {
 848     NSDictionary* metadataAttributesInput = @{@"TestMetadata" : @"TestValue"};
 849     SecDbKeychainSerializedItemV7* serializedItem = [self serializedItemWithPassword:@"password" metadataAttributes:metadataAttributesInput];
 850     serializedItem.keyclass = (serializedItem.keyclass | key_class_last + 1);
 851
 852     NSError* error = nil;
 853     SecDbKeychainItemV7* item = [[SecDbKeychainItemV7 alloc] initWithData:serializedItem.data decryptionKeybag:0 error:&error];
 854     NSDictionary* metadataAttributesOut = [item metadataAttributesWithError:&error];
 855     XCTAssertEqualObjects(metadataAttributesOut, metadataAttributesInput, @"failed to retrieve metadata with error: %@", error);
 856     XCTAssertNil(error, @"error encountered attempting to retrieve metadata: %@", error);
 857 }
 858
 859 - (NSData*)performItemEncryptionWithAccessibility:(CFStringRef)accessibility
 860 {
 861     SecAccessControlRef ac = NULL;
 862     CFDataRef enc = NULL;
 863     CFErrorRef error = NULL;
 864
 865     NSDictionary* secretData = @{(id)kSecValueData : @"secret here"};
 866     CFDictionaryRef emptyDict = (__bridge CFDictionaryRef)@{};
 867
 868     ac = SecAccessControlCreate(NULL, &error);
 869     XCTAssertNotNil((__bridge id)ac, @"failed to create access control with error: %@", (__bridge id)error);
 870     XCTAssertNil((__bridge id)error, @"encountered error attempting to create access control: %@", (__bridge id)error);
 871     XCTAssertTrue(SecAccessControlSetProtection(ac, accessibility, &error), @"failed to set access control protection with error: %@", error);
 872     XCTAssertNil((__bridge id)error, @"encountered error attempting to set access control protection: %@", (__bridge id)error);
 873
 874     XCTAssertTrue(ks_encrypt_data(KEYBAG_DEVICE, ac, NULL, (__bridge CFDictionaryRef)secretData, emptyDict, emptyDict, &enc, true, &error), @"failed to encrypt data with error: %@", error);
 875     XCTAssertTrue(enc != NULL, @"failed to get encrypted data from encryption function");
 876     XCTAssertNil((__bridge id)error, @"encountered error attempting to encrypt data: %@", (__bridge id)error);
 877     CFReleaseNull(ac);
 878
 879     return (__bridge_transfer NSData*)enc;
 880 }
 881
 882 - (void)performMetadataDecryptionOfData:(NSData*)encryptedData verifyingAccessibility:(CFStringRef)accessibility
 883 {
 884     CFErrorRef error = NULL;
 885     CFMutableDictionaryRef attributes = NULL;
 886     uint32_t version = 0;
 887
 888     SecAccessControlRef ac = SecAccessControlCreate(NULL, &error);
 889     XCTAssertNotNil((__bridge id)ac, @"failed to create access control with error: %@", (__bridge id)error);
 890     XCTAssertNil((__bridge id)error, @"encountered error attempting to create access control: %@", (__bridge id)error);
 891     XCTAssertTrue(SecAccessControlSetProtection(ac, accessibility, &error), @"failed to set access control protection with error: %@", error);
 892     XCTAssertNil((__bridge id)error, @"encountered error attempting to set access control protection: %@", (__bridge id)error);
 893
 894     keyclass_t keyclass = 0;
 895     NSData* dummyACM = [NSData dataWithBytes:"dummy" length:5];
 896     const SecDbClass* class = kc_class_with_name(kSecClassGenericPassword);
 897     NSArray* dummyArray = [NSArray array];
 898
 899     XCTAssertTrue(ks_decrypt_data(KEYBAG_DEVICE, kAKSKeyOpDecrypt, &ac, (__bridge CFDataRef _Nonnull)dummyACM, (__bridge CFDataRef)encryptedData, class, (__bridge CFArrayRef)dummyArray, &attributes, &version, false, &keyclass, &error), @"failed to decrypt data with error: %@", error);
 900     XCTAssertNil((__bridge id)error, @"encountered error attempting to decrypt data: %@", (__bridge id)error);
 901     XCTAssertEqual(keyclass & key_class_last, parse_keyclass(accessibility), @"failed to get back the keyclass from decryption");
 902
 903     CFReleaseNull(error);
 904 }
 905
 906 - (void)performMetadataEncryptDecryptWithAccessibility:(CFStringRef)accessibility
 907 {
 908     NSData* encryptedData = [self performItemEncryptionWithAccessibility:accessibility];
 909
 910     [SecDbKeychainMetadataKeyStore resetSharedStore];
 911
 912     [self performMetadataDecryptionOfData:encryptedData verifyingAccessibility:accessibility];
 913 }
 914
 915 - (void)testMetadataClassKeyDecryptionWithSimulatedAKSRolledKeys
 916 {
 917     self.simulateRolledAKSKey = YES;
 918
 919     [self performMetadataEncryptDecryptWithAccessibility:kSecAttrAccessibleWhenUnlocked];
 920     XCTAssertEqual(self.keyclassUsedForAKSDecryption, key_class_ak | key_class_last + 1);
 921
 922     [self performMetadataEncryptDecryptWithAccessibility:kSecAttrAccessibleAfterFirstUnlock];
 923     XCTAssertEqual(self.keyclassUsedForAKSDecryption, key_class_ck | key_class_last + 1);
 924
 925 #pragma clang diagnostic push
 926 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
 927     [self performMetadataEncryptDecryptWithAccessibility:kSecAttrAccessibleAlways];
 928     XCTAssertEqual(self.keyclassUsedForAKSDecryption, key_class_dk | key_class_last + 1);
 929 #pragma clang diagnostic pop
 930
 931     [self performMetadataEncryptDecryptWithAccessibility:kSecAttrAccessibleWhenUnlockedThisDeviceOnly];
 932     XCTAssertEqual(self.keyclassUsedForAKSDecryption, key_class_aku | key_class_last + 1);
 933
 934     [self performMetadataEncryptDecryptWithAccessibility:kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly];
 935     XCTAssertEqual(self.keyclassUsedForAKSDecryption, key_class_cku | key_class_last + 1);
 936
 937 #pragma clang diagnostic push
 938 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
 939     [self performMetadataEncryptDecryptWithAccessibility:kSecAttrAccessibleAlwaysThisDeviceOnly];
 940     XCTAssertEqual(self.keyclassUsedForAKSDecryption, key_class_dku | key_class_last + 1);
 941 #pragma clang diagnostic pop
 942
 943     [self performMetadataEncryptDecryptWithAccessibility:kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly];
 944     XCTAssertEqual(self.keyclassUsedForAKSDecryption, key_class_akpu | key_class_last + 1);
 945 }
 946
 947 - (void)testUpgradingMetadataKeyEntry
 948 {
 949     // first, force the creation of a metadata key
 950     NSData* encryptedData = [self performItemEncryptionWithAccessibility:kSecAttrAccessibleWhenUnlocked];
 951
 952     // now let's jury-rig this metadata key to look like an old one with no actualKeyclass information
 953     __block CFErrorRef error = NULL;
 954     __block bool ok = true;
 955     ok &= kc_with_dbt(true, &error, ^bool(SecDbConnectionRef dbt) {
 956         if (checkV12DevEnabled()) { // item is in new format, turn it into an old format item
 957             NSString* sql = [NSString stringWithFormat:@"SELECT metadatakeydata FROM metadatakeys WHERE keyclass = %d", key_class_ak];
 958             __block NSData* key;
 959             ok &= SecDbPrepare(dbt, (__bridge CFStringRef)sql, &error, ^(sqlite3_stmt* stmt) {
 960                 ok &= SecDbStep(dbt, stmt, &error, ^(bool *stop) {
 961                     NSData* wrappedKey = [[NSData alloc] initWithBytes:sqlite3_column_blob(stmt, 0) length:sqlite3_column_bytes(stmt, 0)];
 962                     SecDbKeychainSerializedMetadataKey* mdkdata = [[SecDbKeychainSerializedMetadataKey alloc] initWithData:wrappedKey];
 963                     key = mdkdata.akswrappedkey;
 964                 });
 965             });
 966             sql = [NSString stringWithFormat:@"UPDATE metadatakeys SET actualKeyclass = 0, data = ?, metadatakeydata = ? WHERE keyclass = %d", key_class_ak];
 967             ok &= SecDbPrepare(dbt, (__bridge CFStringRef)sql, &error, ^(sqlite3_stmt *stmt) {
 968                 ok &= SecDbBindBlob(stmt, 1, key.bytes, key.length, SQLITE_TRANSIENT, &error);
 969                 ok &= SecDbStep(dbt, stmt, &error, NULL);
 970             });
 971         } else {
 972             NSString* sql = [NSString stringWithFormat:@"UPDATE metadatakeys SET actualKeyclass = %d WHERE keyclass = %d", 0, key_class_ak];
 973             ok &= SecDbPrepare(dbt, (__bridge CFStringRef)sql, &error, ^(sqlite3_stmt* stmt) {
 974                 ok &= SecDbStep(dbt, stmt, &error, NULL);
 975             });
 976         }
 977         return ok;
 978     });
 979
 980     // now, let's simulate AKS rejecting the decryption, and see if we recover and also update the database
 981     self.simulateRolledAKSKey = YES;
 982     [SecDbKeychainMetadataKeyStore resetSharedStore];
 983     [self performMetadataDecryptionOfData:encryptedData verifyingAccessibility:kSecAttrAccessibleWhenUnlocked];
 984 }
 985
 986 @end
 987
 988 #endif