OSX/sec/Security/Regressions/secitem/si-70-sectrust-unified.c

   1 /*
   2  * Copyright (c) 2013-2014 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 //
  26 //  si-70-sectrust-unified.c
  27 //  regressions
  28 //
  29 //
  30 //
  31 #include <CoreFoundation/CoreFoundation.h>
  32 #include <Security/Security.h>
  33 #include <Security/SecCertificatePriv.h>
  34 #include <utilities/array_size.h>
  35 #include <utilities/SecCFWrappers.h>
  36
  37 #include "shared_regressions.h"
  38 #include <test/testcert.h>
  39
  40 /* This is a minimal test case to ensure that the functionality of
  41  * <rdar://problem/11736016> TLF: SecTrust Unification is present
  42  * and working. Needs to be expanded and split up into separate
  43  * test case files in the future.
  44  */
  45
  46 /* SecPolicy: new in 7.0 */
  47 //CFDictionaryRef SecPolicyCopyProperties(SecPolicyRef policyRef)
  48 //OSStatus SecTrustSetPolicies(SecTrustRef trust, CFTypeRef policies) /* (this was SPI in 6.0) */
  49 //SecPolicyRef SecPolicyCreateRevocation(CFIndex revocationFlags)
  50 //SecPolicyRef SecPolicyCreateWithProperties(CFTypeRef policyIdentifier, CFDictionaryRef properties)
  51
  52 /* SecTrust new in 7.0 */
  53 //OSStatus SecTrustCopyPolicies(SecTrustRef trust, CFArrayRef *policies)
  54 //OSStatus SecTrustSetNetworkFetchAllowed(SecTrustRef trust, Boolean allowFetch)
  55 //OSStatus SecTrustGetNetworkFetchAllowed(SecTrustRef trust, Boolean *allowFetch)
  56 //OSStatus SecTrustCopyCustomAnchorCertificates(SecTrustRef trust, CFArrayRef *anchors)
  57 //CFDictionaryRef SecTrustCopyResult(SecTrustRef trust)
  58 //OSStatus SecTrustSetOCSPResponse(SecTrustRef trust, CFTypeRef responseData)
  59
  60
  61 /* subject:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com */
  62 /* issuer :/C=US/O=Google Trust Services/CN=Google Internet Authority G3 */
  63 const uint8_t google_cert[]={
  64     0x30,0x82,0x03,0xC7,0x30,0x82,0x02,0xAF,0xA0,0x03,0x02,0x01,0x02,0x02,0x08,0x55,
  65     0x81,0x47,0xC4,0x26,0x8C,0x3F,0xC2,0x30,0x0D,0x06,0x09,0x2A,0x86,0x48,0x86,0xF7,
  66     0x0D,0x01,0x01,0x0B,0x05,0x00,0x30,0x54,0x31,0x0B,0x30,0x09,0x06,0x03,0x55,0x04,
  67     0x06,0x13,0x02,0x55,0x53,0x31,0x1E,0x30,0x1C,0x06,0x03,0x55,0x04,0x0A,0x13,0x15,
  68     0x47,0x6F,0x6F,0x67,0x6C,0x65,0x20,0x54,0x72,0x75,0x73,0x74,0x20,0x53,0x65,0x72,
  69     0x76,0x69,0x63,0x65,0x73,0x31,0x25,0x30,0x23,0x06,0x03,0x55,0x04,0x03,0x13,0x1C,
  70     0x47,0x6F,0x6F,0x67,0x6C,0x65,0x20,0x49,0x6E,0x74,0x65,0x72,0x6E,0x65,0x74,0x20,
  71     0x41,0x75,0x74,0x68,0x6F,0x72,0x69,0x74,0x79,0x20,0x47,0x33,0x30,0x1E,0x17,0x0D,
  72     0x31,0x38,0x30,0x35,0x30,0x38,0x31,0x34,0x34,0x37,0x34,0x33,0x5A,0x17,0x0D,0x31,
  73     0x38,0x30,0x37,0x33,0x31,0x31,0x33,0x32,0x37,0x30,0x30,0x5A,0x30,0x68,0x31,0x0B,
  74     0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x13,0x30,0x11,0x06,
  75     0x03,0x55,0x04,0x08,0x0C,0x0A,0x43,0x61,0x6C,0x69,0x66,0x6F,0x72,0x6E,0x69,0x61,
  76     0x31,0x16,0x30,0x14,0x06,0x03,0x55,0x04,0x07,0x0C,0x0D,0x4D,0x6F,0x75,0x6E,0x74,
  77     0x61,0x69,0x6E,0x20,0x56,0x69,0x65,0x77,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,
  78     0x0A,0x0C,0x0A,0x47,0x6F,0x6F,0x67,0x6C,0x65,0x20,0x4C,0x4C,0x43,0x31,0x17,0x30,
  79     0x15,0x06,0x03,0x55,0x04,0x03,0x0C,0x0E,0x77,0x77,0x77,0x2E,0x67,0x6F,0x6F,0x67,
  80     0x6C,0x65,0x2E,0x63,0x6F,0x6D,0x30,0x59,0x30,0x13,0x06,0x07,0x2A,0x86,0x48,0xCE,
  81     0x3D,0x02,0x01,0x06,0x08,0x2A,0x86,0x48,0xCE,0x3D,0x03,0x01,0x07,0x03,0x42,0x00,
  82     0x04,0xDD,0x10,0xCB,0x4F,0xB1,0x49,0xF9,0xE8,0xC2,0x8E,0xB5,0xB9,0xC3,0x7D,0xCC,
  83     0x9D,0x94,0x3A,0x91,0x19,0x7C,0xA9,0xB3,0x78,0x81,0x21,0x01,0xC0,0x76,0x12,0xA9,
  84     0x84,0x65,0xDF,0xD3,0xE2,0x51,0xFF,0x17,0x9F,0x69,0x0F,0x0B,0xFA,0x04,0x0D,0xBA,
  85     0x35,0xBB,0xE8,0x1F,0x14,0x66,0xB7,0xC7,0xD7,0xFC,0xEB,0x10,0xD6,0xCD,0x79,0x8A,
  86     0x22,0xA3,0x82,0x01,0x52,0x30,0x82,0x01,0x4E,0x30,0x13,0x06,0x03,0x55,0x1D,0x25,
  87     0x04,0x0C,0x30,0x0A,0x06,0x08,0x2B,0x06,0x01,0x05,0x05,0x07,0x03,0x01,0x30,0x0E,
  88     0x06,0x03,0x55,0x1D,0x0F,0x01,0x01,0xFF,0x04,0x04,0x03,0x02,0x07,0x80,0x30,0x19,
  89     0x06,0x03,0x55,0x1D,0x11,0x04,0x12,0x30,0x10,0x82,0x0E,0x77,0x77,0x77,0x2E,0x67,
  90     0x6F,0x6F,0x67,0x6C,0x65,0x2E,0x63,0x6F,0x6D,0x30,0x68,0x06,0x08,0x2B,0x06,0x01,
  91     0x05,0x05,0x07,0x01,0x01,0x04,0x5C,0x30,0x5A,0x30,0x2D,0x06,0x08,0x2B,0x06,0x01,
  92     0x05,0x05,0x07,0x30,0x02,0x86,0x21,0x68,0x74,0x74,0x70,0x3A,0x2F,0x2F,0x70,0x6B,
  93     0x69,0x2E,0x67,0x6F,0x6F,0x67,0x2F,0x67,0x73,0x72,0x32,0x2F,0x47,0x54,0x53,0x47,
  94     0x49,0x41,0x47,0x33,0x2E,0x63,0x72,0x74,0x30,0x29,0x06,0x08,0x2B,0x06,0x01,0x05,
  95     0x05,0x07,0x30,0x01,0x86,0x1D,0x68,0x74,0x74,0x70,0x3A,0x2F,0x2F,0x6F,0x63,0x73,
  96     0x70,0x2E,0x70,0x6B,0x69,0x2E,0x67,0x6F,0x6F,0x67,0x2F,0x47,0x54,0x53,0x47,0x49,
  97     0x41,0x47,0x33,0x30,0x1D,0x06,0x03,0x55,0x1D,0x0E,0x04,0x16,0x04,0x14,0x2B,0x53,
  98     0xE0,0x79,0xD4,0xFD,0xA4,0xD4,0xDF,0x18,0x6B,0xDD,0x80,0x4D,0x11,0x35,0xC7,0xB2,
  99     0x41,0xCC,0x30,0x0C,0x06,0x03,0x55,0x1D,0x13,0x01,0x01,0xFF,0x04,0x02,0x30,0x00,
 100     0x30,0x1F,0x06,0x03,0x55,0x1D,0x23,0x04,0x18,0x30,0x16,0x80,0x14,0x77,0xC2,0xB8,
 101     0x50,0x9A,0x67,0x76,0x76,0xB1,0x2D,0xC2,0x86,0xD0,0x83,0xA0,0x7E,0xA6,0x7E,0xBA,
 102     0x4B,0x30,0x21,0x06,0x03,0x55,0x1D,0x20,0x04,0x1A,0x30,0x18,0x30,0x0C,0x06,0x0A,
 103     0x2B,0x06,0x01,0x04,0x01,0xD6,0x79,0x02,0x05,0x03,0x30,0x08,0x06,0x06,0x67,0x81,
 104     0x0C,0x01,0x02,0x02,0x30,0x31,0x06,0x03,0x55,0x1D,0x1F,0x04,0x2A,0x30,0x28,0x30,
 105     0x26,0xA0,0x24,0xA0,0x22,0x86,0x20,0x68,0x74,0x74,0x70,0x3A,0x2F,0x2F,0x63,0x72,
 106     0x6C,0x2E,0x70,0x6B,0x69,0x2E,0x67,0x6F,0x6F,0x67,0x2F,0x47,0x54,0x53,0x47,0x49,
 107     0x41,0x47,0x33,0x2E,0x63,0x72,0x6C,0x30,0x0D,0x06,0x09,0x2A,0x86,0x48,0x86,0xF7,
 108     0x0D,0x01,0x01,0x0B,0x05,0x00,0x03,0x82,0x01,0x01,0x00,0x6E,0x85,0x02,0xC0,0xF0,
 109     0x15,0xBF,0xAF,0x4F,0x29,0x73,0x19,0x87,0x7F,0x30,0xB3,0x24,0xD1,0xEE,0xA7,0xDC,
 110     0x90,0x44,0x30,0xC1,0xA0,0x84,0x65,0x52,0x26,0xE6,0xAD,0x0D,0xCA,0x43,0xEE,0xB6,
 111     0x6B,0x37,0x9D,0xFF,0x97,0x80,0x09,0x85,0x58,0x46,0xEC,0xFF,0xF2,0x42,0x6A,0xBB,
 112     0xE6,0xA3,0xB4,0x9B,0x26,0x26,0xA8,0x53,0xA9,0xB9,0x95,0xB6,0x42,0x06,0x94,0xED,
 113     0x31,0xC5,0x33,0xF7,0x91,0x6A,0x90,0x4B,0xD2,0x8A,0x45,0xAE,0x3A,0xA0,0x10,0x27,
 114     0xAE,0xF4,0x9A,0xC9,0x5E,0x63,0x20,0xAD,0xF2,0xCB,0xDC,0x74,0xA8,0x83,0x32,0x56,
 115     0x6D,0xAA,0x6C,0xCA,0xBC,0xCC,0x71,0x23,0xD4,0xAC,0xA9,0xAE,0xEA,0x04,0xD6,0x75,
 116     0xE7,0xBF,0x18,0xC7,0x9C,0xCC,0x7B,0xE6,0x81,0x62,0xC6,0xFA,0x17,0xA8,0x82,0x2F,
 117     0xCC,0xE9,0xAC,0xEF,0x81,0xCC,0xAE,0x1A,0x1C,0x79,0x35,0x7B,0x54,0xFE,0x06,0x57,
 118     0x2F,0x58,0xD0,0x7C,0x4E,0x5A,0x75,0xAE,0xCC,0x31,0xD6,0x20,0xA6,0xB1,0xDA,0x39,
 119     0x9E,0x46,0x5B,0x15,0x76,0xF2,0x3E,0x2C,0xB1,0x5E,0xBF,0x7F,0x29,0xE3,0xBE,0xC6,
 120     0xF3,0xE5,0xEB,0xD5,0x91,0x48,0x84,0x41,0x7B,0xB6,0x3B,0x83,0xC6,0xCE,0x1B,0xE2,
 121     0x88,0x44,0x91,0x89,0x72,0x27,0xF9,0xD2,0x72,0x33,0xCF,0xC3,0xB2,0x52,0x38,0x65,
 122     0x17,0x14,0x00,0x4E,0x36,0x1C,0xC2,0xAD,0xBF,0x7F,0x3A,0x18,0xF7,0x52,0xFA,0x3B,
 123     0x86,0x18,0xF3,0x24,0x97,0xF7,0x35,0x58,0x48,0x0D,0x7D,0x93,0x18,0xA7,0x14,0x52,
 124     0x1A,0x19,0x9D,0xDB,0xD5,0xCC,0xA3,0xC5,0x48,0x6D,0x8A,
 125 };
 126
 127 /* subject:/C=US/O=Google Trust Services/CN=Google Internet Authority G3 */
 128 /* issuer :/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign */
 129 const uint8_t _GIAG3[]={
 130     0x30,0x82,0x04,0x5C,0x30,0x82,0x03,0x44,0xA0,0x03,0x02,0x01,0x02,0x02,0x0D,0x01,
 131     0xE3,0xA9,0x30,0x1C,0xFC,0x72,0x06,0x38,0x3F,0x9A,0x53,0x1D,0x30,0x0D,0x06,0x09,
 132     0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x0B,0x05,0x00,0x30,0x4C,0x31,0x20,0x30,
 133     0x1E,0x06,0x03,0x55,0x04,0x0B,0x13,0x17,0x47,0x6C,0x6F,0x62,0x61,0x6C,0x53,0x69,
 134     0x67,0x6E,0x20,0x52,0x6F,0x6F,0x74,0x20,0x43,0x41,0x20,0x2D,0x20,0x52,0x32,0x31,
 135     0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x0A,0x13,0x0A,0x47,0x6C,0x6F,0x62,0x61,0x6C,
 136     0x53,0x69,0x67,0x6E,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0A,0x47,
 137     0x6C,0x6F,0x62,0x61,0x6C,0x53,0x69,0x67,0x6E,0x30,0x1E,0x17,0x0D,0x31,0x37,0x30,
 138     0x36,0x31,0x35,0x30,0x30,0x30,0x30,0x34,0x32,0x5A,0x17,0x0D,0x32,0x31,0x31,0x32,
 139     0x31,0x35,0x30,0x30,0x30,0x30,0x34,0x32,0x5A,0x30,0x54,0x31,0x0B,0x30,0x09,0x06,
 140     0x03,0x55,0x04,0x06,0x13,0x02,0x55,0x53,0x31,0x1E,0x30,0x1C,0x06,0x03,0x55,0x04,
 141     0x0A,0x13,0x15,0x47,0x6F,0x6F,0x67,0x6C,0x65,0x20,0x54,0x72,0x75,0x73,0x74,0x20,
 142     0x53,0x65,0x72,0x76,0x69,0x63,0x65,0x73,0x31,0x25,0x30,0x23,0x06,0x03,0x55,0x04,
 143     0x03,0x13,0x1C,0x47,0x6F,0x6F,0x67,0x6C,0x65,0x20,0x49,0x6E,0x74,0x65,0x72,0x6E,
 144     0x65,0x74,0x20,0x41,0x75,0x74,0x68,0x6F,0x72,0x69,0x74,0x79,0x20,0x47,0x33,0x30,
 145     0x82,0x01,0x22,0x30,0x0D,0x06,0x09,0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x01,
 146     0x05,0x00,0x03,0x82,0x01,0x0F,0x00,0x30,0x82,0x01,0x0A,0x02,0x82,0x01,0x01,0x00,
 147     0xCA,0x52,0x4B,0xEA,0x1E,0xFF,0xCE,0x24,0x6B,0xA8,0xDA,0x72,0x18,0x68,0xD5,0x56,
 148     0x5D,0x0E,0x48,0x5A,0x2D,0x35,0x09,0x76,0x5A,0xCF,0xA4,0xC8,0x1C,0xB1,0xA9,0xFE,
 149     0x53,0x89,0xFB,0xAD,0x34,0xFF,0x88,0x5B,0x9F,0xBB,0xE7,0xE8,0x00,0x01,0xDC,0x35,
 150     0x73,0x75,0x03,0xAD,0xB3,0xB1,0xB9,0xA4,0x7D,0x2B,0x26,0x79,0xCE,0x15,0x40,0x0A,
 151     0xEF,0x51,0xB8,0x9F,0x32,0x8C,0x7C,0x70,0x86,0x52,0x4B,0x16,0xFE,0x6A,0x27,0x6B,
 152     0xE6,0x36,0x7A,0x62,0x50,0xD8,0xDF,0x9A,0x89,0xCC,0x09,0x29,0xEB,0x4F,0x29,0x14,
 153     0x88,0x80,0x0B,0x8F,0x38,0x1E,0x80,0x6A,0x18,0x7C,0x1D,0xBD,0x97,0x3B,0x78,0x7D,
 154     0x45,0x49,0x36,0x4F,0x41,0xCD,0xA2,0xE0,0x76,0x57,0x3C,0x68,0x31,0x79,0x64,0xC9,
 155     0x6E,0xD7,0x51,0x1E,0x66,0xC3,0xA2,0x64,0x2C,0x79,0xC0,0xE7,0x65,0xC3,0x56,0x84,
 156     0x53,0x5A,0x43,0x6D,0xCB,0x9A,0x02,0x20,0xD2,0xEF,0x1A,0x69,0xD1,0xB0,0x9D,0x73,
 157     0xA2,0xE0,0x2A,0x60,0x65,0x50,0x31,0xCF,0xFB,0xB3,0x2F,0xBF,0x11,0x88,0x40,0x2E,
 158     0xB5,0x49,0x10,0x0F,0x0A,0x6E,0xDC,0x97,0xFA,0xBF,0x2C,0x9F,0x05,0x39,0x0B,0x58,
 159     0x54,0xAF,0x06,0x96,0xE8,0xC5,0x8E,0x01,0x16,0xBC,0xA8,0x1A,0x4D,0x41,0xC5,0x93,
 160     0x91,0xA2,0x1E,0xA1,0x8B,0xF2,0xFE,0xC1,0x88,0x24,0x49,0xA3,0x47,0x4B,0xC5,0x13,
 161     0x01,0xDD,0xA7,0x57,0x12,0x69,0x62,0x2B,0xEB,0xFE,0x20,0xEF,0x69,0xFB,0x3A,0xA5,
 162     0xF0,0x7E,0x29,0xEE,0xED,0x96,0x16,0xF7,0xB1,0x1F,0xA0,0xE4,0x90,0x25,0xE0,0x33,
 163     0x02,0x03,0x01,0x00,0x01,0xA3,0x82,0x01,0x33,0x30,0x82,0x01,0x2F,0x30,0x0E,0x06,
 164     0x03,0x55,0x1D,0x0F,0x01,0x01,0xFF,0x04,0x04,0x03,0x02,0x01,0x86,0x30,0x1D,0x06,
 165     0x03,0x55,0x1D,0x25,0x04,0x16,0x30,0x14,0x06,0x08,0x2B,0x06,0x01,0x05,0x05,0x07,
 166     0x03,0x01,0x06,0x08,0x2B,0x06,0x01,0x05,0x05,0x07,0x03,0x02,0x30,0x12,0x06,0x03,
 167     0x55,0x1D,0x13,0x01,0x01,0xFF,0x04,0x08,0x30,0x06,0x01,0x01,0xFF,0x02,0x01,0x00,
 168     0x30,0x1D,0x06,0x03,0x55,0x1D,0x0E,0x04,0x16,0x04,0x14,0x77,0xC2,0xB8,0x50,0x9A,
 169     0x67,0x76,0x76,0xB1,0x2D,0xC2,0x86,0xD0,0x83,0xA0,0x7E,0xA6,0x7E,0xBA,0x4B,0x30,
 170     0x1F,0x06,0x03,0x55,0x1D,0x23,0x04,0x18,0x30,0x16,0x80,0x14,0x9B,0xE2,0x07,0x57,
 171     0x67,0x1C,0x1E,0xC0,0x6A,0x06,0xDE,0x59,0xB4,0x9A,0x2D,0xDF,0xDC,0x19,0x86,0x2E,
 172     0x30,0x35,0x06,0x08,0x2B,0x06,0x01,0x05,0x05,0x07,0x01,0x01,0x04,0x29,0x30,0x27,
 173     0x30,0x25,0x06,0x08,0x2B,0x06,0x01,0x05,0x05,0x07,0x30,0x01,0x86,0x19,0x68,0x74,
 174     0x74,0x70,0x3A,0x2F,0x2F,0x6F,0x63,0x73,0x70,0x2E,0x70,0x6B,0x69,0x2E,0x67,0x6F,
 175     0x6F,0x67,0x2F,0x67,0x73,0x72,0x32,0x30,0x32,0x06,0x03,0x55,0x1D,0x1F,0x04,0x2B,
 176     0x30,0x29,0x30,0x27,0xA0,0x25,0xA0,0x23,0x86,0x21,0x68,0x74,0x74,0x70,0x3A,0x2F,
 177     0x2F,0x63,0x72,0x6C,0x2E,0x70,0x6B,0x69,0x2E,0x67,0x6F,0x6F,0x67,0x2F,0x67,0x73,
 178     0x72,0x32,0x2F,0x67,0x73,0x72,0x32,0x2E,0x63,0x72,0x6C,0x30,0x3F,0x06,0x03,0x55,
 179     0x1D,0x20,0x04,0x38,0x30,0x36,0x30,0x34,0x06,0x06,0x67,0x81,0x0C,0x01,0x02,0x02,
 180     0x30,0x2A,0x30,0x28,0x06,0x08,0x2B,0x06,0x01,0x05,0x05,0x07,0x02,0x01,0x16,0x1C,
 181     0x68,0x74,0x74,0x70,0x73,0x3A,0x2F,0x2F,0x70,0x6B,0x69,0x2E,0x67,0x6F,0x6F,0x67,
 182     0x2F,0x72,0x65,0x70,0x6F,0x73,0x69,0x74,0x6F,0x72,0x79,0x2F,0x30,0x0D,0x06,0x09,
 183     0x2A,0x86,0x48,0x86,0xF7,0x0D,0x01,0x01,0x0B,0x05,0x00,0x03,0x82,0x01,0x01,0x00,
 184     0x1C,0xB7,0x89,0x96,0xE4,0x53,0xED,0xBB,0xEC,0xDB,0xA8,0x32,0x01,0x9F,0x2C,0xA3,
 185     0xCD,0x6D,0xAD,0x42,0x12,0x77,0xB3,0xB8,0xE6,0xC9,0x03,0x52,0x60,0x20,0x7B,0x57,
 186     0x27,0xC6,0x11,0xB5,0x3F,0x67,0x0D,0x99,0x2C,0x5B,0x5A,0xCA,0x22,0x0A,0xDD,0x9E,
 187     0xBB,0x1F,0x4B,0x48,0x3F,0x8F,0x02,0x3D,0x8B,0x21,0x84,0x45,0x1D,0x6D,0xF5,0xFF,
 188     0xAC,0x68,0x89,0xCD,0x64,0xE2,0xD6,0xD6,0x5E,0x40,0xC2,0x8E,0x2A,0xF7,0xEF,0x14,
 189     0xD3,0x36,0xA4,0x40,0x30,0xF5,0x32,0x15,0x15,0x92,0x76,0xFB,0x7E,0x9E,0x53,0xEA,
 190     0xC2,0x76,0xFC,0x39,0xAD,0x88,0xFE,0x66,0x92,0x26,0xE9,0x1C,0xC4,0x38,0xCD,0x49,
 191     0xFA,0x43,0x87,0xF0,0x5D,0xD6,0x56,0x4D,0x81,0xD7,0x7F,0xF1,0xC2,0xDD,0xB0,0x4D,
 192     0xFE,0xC3,0x2A,0x6E,0x7C,0x9F,0x6E,0x5C,0xED,0x62,0x42,0x99,0xE1,0xF7,0x36,0xEE,
 193     0x14,0x8C,0x2C,0x20,0xE3,0x46,0x97,0x5A,0x77,0x03,0xC0,0xA0,0xC6,0x4A,0x88,0xFD,
 194     0x40,0x22,0x87,0x72,0x5A,0x18,0xEA,0x9C,0xA5,0xC7,0x5A,0x08,0x8C,0xE4,0x05,0xA4,
 195     0x7D,0xB9,0x84,0x35,0x5F,0x89,0x36,0x56,0x0E,0x40,0x3D,0x12,0xE8,0xBB,0x35,0x72,
 196     0xED,0xAF,0x08,0x56,0x4E,0xB0,0xBB,0x2E,0xA9,0x9B,0xE4,0xFB,0x1D,0x3E,0x0B,0x63,
 197     0xC8,0x9B,0x4B,0x91,0x44,0x66,0x57,0xC0,0x14,0xB4,0x96,0xF0,0xDC,0x2C,0x57,0x3F,
 198     0x52,0x04,0xAD,0x95,0xAA,0x7D,0x4D,0xD0,0xF2,0x0C,0x9F,0x9C,0x40,0xE8,0xD6,0x55,
 199     0x73,0xBA,0x3C,0xDF,0x90,0xCB,0x00,0x5B,0x21,0x11,0x67,0xC2,0xED,0x32,0x1E,0xDE,
 200 };
 201
 202
 203 static void tests(void)
 204 {
 205         SecTrustResultType trustResult;
 206         SecTrustRef trust = NULL;
 207     SecPolicyRef policy = NULL;
 208     CFArrayRef certs = NULL;
 209         CFDateRef date = NULL;
 210
 211         const void *cert_google;
 212         isnt(cert_google = SecCertificateCreateWithBytes(NULL, google_cert,
 213         sizeof(google_cert)), NULL, "create cert_google");
 214     certs = CFArrayCreate(NULL, &cert_google, 1, NULL);
 215
 216     bool server = true;
 217     policy = SecPolicyCreateSSL(server, CFSTR("www2.google.com")); // deliberate hostname mismatch
 218     ok_status(SecTrustCreateWithCertificates(certs, policy, &trust),
 219         "create trust for ssl server www2.google.com");
 220     CFReleaseSafe(certs);
 221     date = CFDateCreate(NULL, 548800000.0); /* May 23, 2018" */
 222     ok_status(SecTrustSetVerifyDate(trust, date), "set trust date to May 23, 2018");
 223
 224         /* This test uses a root which is no longer in our trust store,
 225          * so we need explicitly set it as a trusted anchor
 226          */
 227         SecCertificateRef _anchor;
 228         isnt(_anchor = SecCertificateCreateWithBytes(NULL, _GIAG3, sizeof(_GIAG3)),
 229                 NULL, "create root");
 230         const void *v_roots[] = { _anchor };
 231         CFArrayRef _anchors;
 232         isnt(_anchors = CFArrayCreate(NULL, v_roots, array_size(v_roots), NULL),
 233                 NULL, "create anchors");
 234         SecTrustSetAnchorCertificates(trust, _anchors);
 235
 236     ok_status(SecTrustEvaluate(trust, &trustResult), "evaluate google trust");
 237     is_status(trustResult, kSecTrustResultRecoverableTrustFailure,
 238                 "trust is kSecTrustResultRecoverableTrustFailure (hostname mismatch)");
 239
 240         /* Test SecPolicyCreateRevocation */
 241         {
 242                 /* FIXME need to do more than just call the function, but it's a start */
 243                 SecPolicyRef revocation = SecPolicyCreateRevocation(kSecRevocationUseAnyAvailableMethod);
 244                 isnt(revocation, NULL, "create revocation policy");
 245                 CFReleaseSafe(revocation);
 246         }
 247
 248         /* Test SecTrustCopyPolicies */
 249         {
 250                 CFArrayRef policies = NULL;
 251                 ok_status(SecTrustCopyPolicies(trust, &policies), "copy policies");
 252                 is((policies && (CFArrayGetCount(policies) > 0)), true, "non-empty policies");
 253                 CFReleaseSafe(policies);
 254         }
 255
 256         /* Test SecTrustSetNetworkFetchAllowed */
 257         {
 258                 Boolean curAllow, allow;
 259                 ok_status(SecTrustGetNetworkFetchAllowed(trust, &curAllow));
 260                 allow = !curAllow; /* flip it and see if the setting sticks */
 261                 ok_status(SecTrustSetNetworkFetchAllowed(trust, allow));
 262                 ok_status(SecTrustGetNetworkFetchAllowed(trust, &curAllow));
 263                 is((allow == curAllow), true, "network fetch toggle");
 264
 265         /* <rdar://39514416> ensure trust with revocation policy returns the correct status */
 266         SecPolicyRef revocation = SecPolicyCreateRevocation(kSecRevocationUseAnyAvailableMethod);
 267         ok_status(SecTrustSetPolicies(trust, revocation));
 268         ok_status(SecTrustGetNetworkFetchAllowed(trust, &curAllow));
 269         is(curAllow, true, "network fetch set for revocation policy");
 270
 271         SecPolicyRef basic = SecPolicyCreateBasicX509();
 272         CFMutableArrayRef policies = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
 273         CFArrayAppendValue(policies, basic);
 274         CFArrayAppendValue(policies, revocation);
 275         ok_status(SecTrustSetPolicies(trust, policies));
 276         ok_status(SecTrustGetNetworkFetchAllowed(trust, &curAllow));
 277         is(curAllow, true, "network fetch set for basic+revocation policy");
 278         CFReleaseNull(revocation);
 279         CFReleaseNull(basic);
 280         CFReleaseNull(policies);
 281
 282         revocation = SecPolicyCreateRevocation(kSecRevocationNetworkAccessDisabled);
 283         ok_status(SecTrustSetPolicies(trust, revocation));
 284         ok_status(SecTrustGetNetworkFetchAllowed(trust, &curAllow));
 285         is(curAllow, false, "network fetch not set for revocation policy");
 286         CFReleaseNull(revocation);
 287         }
 288
 289         /* Test setting OCSP response data */
 290         {
 291                 CFDataRef resp = (CFDataRef) CFDataCreateMutable(NULL, 0);
 292                 /* FIXME: use actual OCSPResponse DER blob */
 293                 CFDataIncreaseLength((CFMutableDataRef)resp, 64); /* arbitrary length, zero-filled data */
 294
 295 #pragma clang diagnostic push
 296 #pragma clang diagnostic ignored "-Wnonnull"
 297         // NULL passed as 'trust' newly generates a warning, we need to suppress it in order to compile
 298                 is_status(SecTrustSetOCSPResponse(NULL, resp), errSecParam, "SecTrustSetOCSPResponse param 1 check OK");
 299 #pragma clang diagnostic pop
 300                 is_status(SecTrustSetOCSPResponse(trust, NULL), errSecSuccess, "SecTrustSetOCSPResponse param 2 check OK");
 301                 is_status(SecTrustSetOCSPResponse(trust, resp), errSecSuccess, "SecTrustSetOCSPResponse OK");
 302         CFReleaseSafe(resp);
 303         }
 304
 305         /* Test creation of a policy via SecPolicyCreateWithProperties */
 306         CFReleaseNull(policy);
 307         {
 308                 const void *keys[] = { kSecPolicyName, kSecPolicyClient };
 309                 const void *values[] = { CFSTR("www.google.com"), kCFBooleanFalse };
 310                 CFDictionaryRef properties = CFDictionaryCreate(NULL, keys, values,
 311                                 array_size(keys),
 312                                 &kCFTypeDictionaryKeyCallBacks,
 313                                 &kCFTypeDictionaryValueCallBacks);
 314                 policy = SecPolicyCreateWithProperties(kSecPolicyAppleSSL, properties);
 315                 isnt(policy, NULL, "SecPolicyCreateWithProperties");
 316                 CFReleaseSafe(properties);
 317         }
 318     if (!policy) { goto errOut; }
 319
 320         /* Test introspection of a policy's properties via SecPolicyCopyProperties */
 321         {
 322                 CFDictionaryRef properties = NULL;
 323                 isnt(properties = SecPolicyCopyProperties(policy), NULL, "copy policy properties");
 324                 CFTypeRef value = NULL;
 325                 is(CFDictionaryGetValueIfPresent(properties, kSecPolicyName, (const void **)&value) &&
 326                         kCFCompareEqualTo == CFStringCompare((CFStringRef)value, CFSTR("www.google.com"), 0),
 327                 true, "has policy name");
 328                 is(CFDictionaryGetValueIfPresent(properties, kSecPolicyOid, (const void **)&value) &&
 329                         CFEqual(value, kSecPolicyAppleSSL) , true, "has SSL policy");
 330         CFReleaseSafe(properties);
 331         }
 332         /* Test setting new policy on a trust via SecTrustSetPolicies */
 333         ok_status(SecTrustSetPolicies(trust, policy));
 334         /* Evaluation should now succeed, since our new policy has the correct hostname */
 335     ok_status(SecTrustEvaluate(trust, &trustResult), "evaluate google trust");
 336     is_status(trustResult, kSecTrustResultUnspecified,
 337                 "trust is kSecTrustResultUnspecified");
 338
 339         /* Make sure we can get the results */
 340         {
 341                 CFDictionaryRef results = NULL;
 342                 SecTrustResultType anotherResult = kSecTrustResultInvalid;
 343                 ok_status(SecTrustGetTrustResult(trust, &anotherResult), "get trust result");
 344                 is_status(trustResult, anotherResult, "trust is kSecTrustResultUnspecified");
 345
 346                 isnt(results = SecTrustCopyResult(trust), NULL, "copy trust results");
 347                 CFReleaseSafe(results);
 348         }
 349
 350 errOut:
 351         CFReleaseSafe(trust);
 352         CFReleaseSafe(policy);
 353         CFReleaseSafe(date);
 354         CFReleaseSafe(cert_google);
 355
 356         CFReleaseSafe(_anchor);
 357         CFReleaseSafe(_anchors);
 358 }
 359
 360 int si_70_sectrust_unified(int argc, char *const *argv)
 361 {
 362         plan_tests(36);
 363         tests();
 364
 365         return 0;
 366 }