keychain/ckks/tests/CKKSAPSHandlingTests.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <CloudKit/CloudKit.h>
  27 #import <XCTest/XCTest.h>
  28 #import <OCMock/OCMock.h>
  29 #import <SecurityFoundation/SFKey.h>
  30 #import <SecurityFoundation/SFKey_Private.h>
  31 #import <SecurityFoundation/SFDigestOperation.h>
  32
  33 #import "keychain/ckks/tests/CloudKitMockXCTest.h"
  34 #import "keychain/ckks/tests/CloudKitKeychainSyncingMockXCTest.h"
  35 #import "keychain/ckks/CKKS.h"
  36 #import "keychain/ckks/CKKSAPSReceiver.h"
  37 #import "keychain/ckks/CKKSKey.h"
  38 #import "keychain/ckks/CKKSPeer.h"
  39 #import "keychain/ckks/CKKSTLKShare.h"
  40 #import "keychain/ckks/CKKSViewManager.h"
  41 #import "keychain/ckks/CloudKitCategories.h"
  42
  43 #import "keychain/ckks/tests/MockCloudKit.h"
  44 #import "keychain/ckks/tests/CKKSTests.h"
  45 #import "keychain/ot/OTDefines.h"
  46
  47 #import "keychain/ckks/tests/CKKSAPSReceiverTests.h"
  48
  49 @interface CKKSAPSHandlingTests : CloudKitKeychainSyncingTestsBase
  50 @property CKRecordZoneID*      manateeZoneID;
  51 @property CKKSKeychainView*    manateeView;
  52 @property FakeCKZone*          manateeZone;
  53 @property (readonly) ZoneKeys* manateeZoneKeys;
  54 @end
  55
  56
  57 @implementation CKKSAPSHandlingTests
  58 // We really just want two views here
  59 - (NSSet*)managedViewList {
  60     return [NSSet setWithObjects:@"keychain", @"Manatee", nil];
  61 }
  62
  63 - (void)setUp {
  64     [super setUp];
  65
  66     // Wait for the ViewManager to be brought up
  67     XCTAssertEqual(0, [self.injectedManager.completedSecCKKSInitialize wait:20*NSEC_PER_SEC], "No timeout waiting for SecCKKSInitialize");
  68
  69     self.manateeZoneID = [[CKRecordZoneID alloc] initWithZoneName:@"Manatee" ownerName:CKCurrentUserDefaultName];
  70     [self.ckksZones addObject:self.manateeZoneID];
  71     self.manateeZone = [[FakeCKZone alloc] initZone: self.manateeZoneID];
  72     self.zones[self.manateeZoneID] = self.manateeZone;
  73     self.manateeView = [[CKKSViewManager manager] findView:@"Manatee"];
  74     [self.ckksViews addObject:self.manateeView];
  75     XCTAssertNotNil(self.manateeView, "CKKSViewManager created the Manatee view");
  76 }
  77
  78 - (void)tearDown {
  79     // If the test didn't already do this, allow each zone to spin up
  80     self.accountStatus = CKAccountStatusNoAccount;
  81     [self startCKKSSubsystem];
  82
  83     [self.manateeView halt];
  84     [self.manateeView waitUntilAllOperationsAreFinished];
  85     self.manateeView = nil;
  86
  87     [super tearDown];
  88 }
  89
  90 + (APSIncomingMessage*)messageWithTracingEnabledForZoneID:(CKRecordZoneID*)zoneID {
  91     APSIncomingMessage* apsMessage = [CKKSAPSReceiverTests messageForZoneID:zoneID];
  92     NSUUID* nsuuid = [NSUUID UUID];
  93     uuid_t uuid = {0};
  94     [nsuuid getUUIDBytes:(unsigned char*)&uuid];
  95     NSData* uuidData = [NSData dataWithBytes:&uuid length:sizeof(uuid)];
  96
  97     apsMessage.tracingUUID = uuidData;
  98     apsMessage.tracingEnabled = YES;
  99
 100     return apsMessage;
 101 }
 102
 103 - (void)testSendPushMetricUponRequest {
 104     for(CKRecordZoneID* zoneID in self.ckksZones) {
 105         [self putFakeKeyHierarchyInCloudKit:zoneID];
 106         [self saveTLKMaterialToKeychain:zoneID];
 107         [self expectCKKSTLKSelfShareUpload:zoneID];
 108     }
 109
 110     [self startCKKSSubsystem];
 111
 112     for(CKKSKeychainView* view in self.ckksViews) {
 113         XCTAssertEqual(0, [view.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "Key state should enter 'ready' for view %@", view);
 114     }
 115
 116     OCMVerifyAllWithDelay(self.mockDatabase, 20);
 117
 118     CKRecord* keychainRecord = [self createFakeRecord:self.keychainZoneID recordName:@"7B598D31-F9C5-481E-98AC-5A507ACB2D85" withAccount:@"keychain-view"];
 119     [self.keychainZone addToZone: keychainRecord];
 120
 121     // Manatee gets one too!
 122     CKRecord* manateeRecord = [self createFakeRecord:self.manateeZoneID recordName:@"7B598D31-F9C5-481E-98AC-000000000000" withAccount:@"manatee-view"];
 123     [self.manateeZone addToZone:manateeRecord];
 124
 125     // Trigger a notification just for keychain zone. Both keychain and Manatee should process their incoming queues, and receive their items.
 126     CKKSResultOperation* keychainProcessOp = [self.keychainView resultsOfNextProcessIncomingQueueOperation];
 127     XCTAssertNotNil(keychainProcessOp, "Should have gotten a promise operation from Keychain");
 128     CKKSResultOperation* manateeProcessOp = [self.manateeView resultsOfNextProcessIncomingQueueOperation];
 129     XCTAssertNotNil(manateeProcessOp, "Should have gotten a promise operation from Manatee");
 130
 131     // But if something goes wrong, don't block the whole test. Only way to do that is to make more operations, since there's no guarantee that the process ops above will ever be added
 132     // to a queue (and thus become 'finished')
 133     CKKSResultOperation* keychainProcessTimeoutOp = [CKKSResultOperation named:@"keychain-timeout" withBlock:^{}];
 134     [keychainProcessTimeoutOp timeout:20*NSEC_PER_SEC];
 135     [keychainProcessTimeoutOp addSuccessDependency:keychainProcessOp];
 136     [self.operationQueue addOperation:keychainProcessTimeoutOp];
 137
 138     CKKSResultOperation* manateeProcessTimeoutOp = [CKKSResultOperation named:@"manatee-timeout" withBlock:^{}];
 139     [manateeProcessTimeoutOp timeout:20*NSEC_PER_SEC];
 140     [manateeProcessTimeoutOp addSuccessDependency:manateeProcessOp];
 141     [self.operationQueue addOperation:manateeProcessTimeoutOp];
 142
 143     APSIncomingMessage* apsMessage = [CKKSAPSHandlingTests messageWithTracingEnabledForZoneID:self.keychainZoneID];
 144
 145     // Inject a message at the APS layer
 146     // Because we can only make APS receivers once iCloud tells us the push environment after sign-in, we can't use our normal injection strategy, and fell back on global state.
 147     CKKSAPSReceiver* apsReceiver = [CKKSAPSReceiver receiverForEnvironment:self.apsEnvironment
 148                                                          namedDelegatePort:SecCKKSAPSNamedPort
 149                                                         apsConnectionClass:[FakeAPSConnection class]];
 150     XCTAssertNotNil(apsReceiver, "Should have gotten an APS receiver");
 151
 152     // Also, CKKS should handle this in one single fetch
 153     self.silentFetchesAllowed = false;
 154     [self expectCKFetch];
 155
 156     // Expect two metric pushes, one from receiving the push and one from after we finish the fetch
 157     // AFAICT there's no way to introspect a metric object to ensure we did it right
 158     OCMExpect([self.mockContainerExpectations submitEventMetric:[OCMArg any]]);
 159     OCMExpect([self.mockContainerExpectations submitEventMetric:[OCMArg any]]);
 160
 161     // Launch!
 162     [apsReceiver connection:nil didReceiveIncomingMessage:apsMessage];
 163
 164     OCMVerifyAllWithDelay(self.mockContainerExpectations, 16);
 165
 166     // Now, wait for both views to run their processing
 167     [keychainProcessTimeoutOp waitUntilFinished];
 168     XCTAssertNil(keychainProcessTimeoutOp.error, "Shouldn't have been any error processing incoming queue (keychain)");
 169
 170     [manateeProcessTimeoutOp waitUntilFinished];
 171     XCTAssertNil(manateeProcessTimeoutOp.error, "Shouldn't have been any error processing incoming queue (manatee)");
 172
 173     [self findGenericPassword:@"keychain-view" expecting:errSecSuccess];
 174     [self findGenericPassword:@"manatee-view" expecting:errSecSuccess];
 175 }
 176
 177 - (void)testDoNotSendPushMetricWithoutRequest {
 178     for(CKRecordZoneID* zoneID in self.ckksZones) {
 179         [self putFakeKeyHierarchyInCloudKit:zoneID];
 180         [self saveTLKMaterialToKeychain:zoneID];
 181         [self expectCKKSTLKSelfShareUpload:zoneID];
 182     }
 183
 184     [self startCKKSSubsystem];
 185
 186     for(CKKSKeychainView* view in self.ckksViews) {
 187         XCTAssertEqual(0, [view.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "Key state should enter 'ready' for view %@", view);
 188     }
 189
 190     OCMVerifyAllWithDelay(self.mockDatabase, 20);
 191
 192     CKRecord* keychainRecord = [self createFakeRecord:self.keychainZoneID recordName:@"7B598D31-F9C5-481E-98AC-5A507ACB2D85" withAccount:@"keychain-view"];
 193     [self.keychainZone addToZone: keychainRecord];
 194
 195      // Trigger a notification just for keychain zone. Both keychain and Manatee should process their incoming queues, and receive their items.
 196     CKKSResultOperation* keychainProcessOp = [self.keychainView resultsOfNextProcessIncomingQueueOperation];
 197     XCTAssertNotNil(keychainProcessOp, "Should have gotten a promise operation from Keychain");
 198
 199     // But if something goes wrong, don't block the whole test. Only way to do that is to make more operations, since there's no guarantee that the process ops above will ever be added
 200     // to a queue (and thus become 'finished')
 201     CKKSResultOperation* keychainProcessTimeoutOp = [CKKSResultOperation named:@"keychain-timeout" withBlock:^{}];
 202     [keychainProcessTimeoutOp timeout:20*NSEC_PER_SEC];
 203     [keychainProcessTimeoutOp addSuccessDependency:keychainProcessOp];
 204     [self.operationQueue addOperation:keychainProcessTimeoutOp];
 205
 206     // Create a push that matchs all push tracing patterns except for the enabled flag
 207     APSIncomingMessage* apsMessage = [CKKSAPSHandlingTests messageWithTracingEnabledForZoneID:self.keychainZoneID];
 208     apsMessage.tracingEnabled = NO;
 209
 210     // Inject a message at the APS layer
 211     // Because we can only make APS receivers once iCloud tells us the push environment after sign-in, we can't use our normal injection strategy, and fell back on global state.
 212     CKKSAPSReceiver* apsReceiver = [CKKSAPSReceiver receiverForEnvironment:self.apsEnvironment
 213                                                          namedDelegatePort:SecCKKSAPSNamedPort
 214                                                         apsConnectionClass:[FakeAPSConnection class]];
 215     XCTAssertNotNil(apsReceiver, "Should have gotten an APS receiver");
 216
 217     // Also, CKKS should handle this in one single fetch
 218     self.silentFetchesAllowed = false;
 219     [self expectCKFetch];
 220
 221     // Any metric push is verboten
 222     OCMReject([self.mockContainerExpectations submitEventMetric:[OCMArg any]]);
 223
 224     // Launch!
 225     [apsReceiver connection:nil didReceiveIncomingMessage:apsMessage];
 226     OCMVerifyAllWithDelay(self.mockContainerExpectations, 16);
 227
 228     // Now, wait for both views to run their processing
 229     [keychainProcessTimeoutOp waitUntilFinished];
 230     XCTAssertNil(keychainProcessTimeoutOp.error, "Shouldn't have been any error processing incoming queue (keychain)");
 231
 232     [self findGenericPassword:@"keychain-view" expecting:errSecSuccess];
 233 }
 234
 235 - (void)testSendPushMetricEvenIfPushArrivesEarly {
 236     CKRecordZoneID* pushTestZone = [[CKRecordZoneID alloc] initWithZoneName:@"PushTestZone" ownerName:CKCurrentUserDefaultName];
 237     [self.ckksZones addObject:pushTestZone];
 238     self.zones[pushTestZone] = [[FakeCKZone alloc] initZone: pushTestZone];
 239
 240     for(CKRecordZoneID* zoneID in self.ckksZones) {
 241         [self putFakeKeyHierarchyInCloudKit:zoneID];
 242         [self saveTLKMaterialToKeychain:zoneID];
 243         [self expectCKKSTLKSelfShareUpload:zoneID];
 244     }
 245
 246     // The push wakes securityd, so it happens before pushTestZone is created locally
 247     // Send 2, just to test our infrastructure
 248     APSIncomingMessage* apsMessage = [CKKSAPSHandlingTests messageWithTracingEnabledForZoneID:pushTestZone];
 249     APSIncomingMessage* apsMessage2 = [CKKSAPSHandlingTests messageWithTracingEnabledForZoneID:pushTestZone];
 250
 251     // Inject a message at the APS layer
 252     // Because we can only make APS receivers once iCloud tells us the push environment after sign-in, we can't use our normal injection strategy, and fell back on global state.
 253     CKKSAPSReceiver* apsReceiver = [CKKSAPSReceiver receiverForEnvironment:self.apsEnvironment
 254                                                                namedDelegatePort:SecCKKSAPSNamedPort
 255                                                               apsConnectionClass:[FakeAPSConnection class]];
 256     XCTAssertNotNil(apsReceiver, "Should have gotten an APS receiver");
 257
 258     [apsReceiver connection:nil didReceiveIncomingMessage:apsMessage];
 259     [apsReceiver connection:nil didReceiveIncomingMessage:apsMessage2];
 260
 261     // Expect four metric pushes, two per push: one from receiving the push and one from after we finish the fetch
 262     // AFAICT there's no way to introspect a metric object to ensure we did it right
 263     OCMExpect([self.mockContainerExpectations submitEventMetric:[OCMArg any]]);
 264     OCMExpect([self.mockContainerExpectations submitEventMetric:[OCMArg any]]);
 265     OCMExpect([self.mockContainerExpectations submitEventMetric:[OCMArg any]]);
 266     OCMExpect([self.mockContainerExpectations submitEventMetric:[OCMArg any]]);
 267
 268     // Launch!
 269     [self.injectedManager findOrCreateView:pushTestZone.zoneName];
 270
 271     [self startCKKSSubsystem];
 272
 273     for(CKKSKeychainView* view in self.ckksViews) {
 274         XCTAssertEqual(0, [view.keyHierarchyConditions[SecCKKSZoneKeyStateReady] wait:20*NSEC_PER_SEC], "Key state should enter 'ready' for view %@", view);
 275     }
 276     OCMVerifyAllWithDelay(self.mockDatabase, 20);
 277 }
 278
 279 @end
 280
 281 #endif