RegressionTests/secitemcanarytest/secitemcanarytest.m

   1 #include <Foundation/Foundation.h>
   2 #include <Security/Security.h>
   3 #include <Security/SecItemPriv.h>
   4 #include <err.h>
   5
   6 static void usage(void) __dead2;
   7 static bool create_item(NSString *acct);
   8 static bool verify_item(NSString *acct, bool deleteit);
   9 static void initial_state(void) __dead2;
  10 static uint64_t update_state(void);
  11 static void reset(void) __dead2;
  12
  13 static NSString *kCanaryAccessGroup = @"com.apple.security.test.canary";
  14 static NSString *kCanaryStateAccount = @"com.apple.security.test.canaryState";
  15
  16 int
  17 main(int argc, char *argv[])
  18 {
  19     int ch;
  20     uint64_t iter;
  21     bool success;
  22
  23     iter = 0;
  24     while ((ch = getopt(argc, argv, "ir")) != -1) {
  25         switch (ch) {
  26         case 'i':
  27             initial_state();
  28             /*notreached*/
  29         case 'r':
  30             reset();
  31             /*notreached*/
  32         default:
  33             usage();
  34             /*notreached*/
  35         }
  36     }
  37
  38     iter = update_state();
  39     fprintf(stderr, "iter = %llu\n\n", iter);
  40
  41     @autoreleasepool {
  42         if (iter > 0) {
  43             printf("[TEST] Verify and delete previous canary item\n");
  44             success = verify_item([NSString stringWithFormat:@"canary%llu", iter - 1], true);
  45             printf("[%s]\n", success ? "PASS" : "FAIL");
  46             fprintf(stderr, "\n");
  47         }
  48
  49         printf("[TEST] Create canary item\n");
  50         success = create_item([NSString stringWithFormat:@"canary%llu", iter]);
  51         printf("[%s]\n", success ? "PASS" : "FAIL");
  52     }
  53 }
  54
  55 static void
  56 usage(void)
  57 {
  58
  59     fprintf(stderr, "usage: secitemcanarytest -i        Generate initial state\n"
  60                     "       secitemcanarytest           Normal operation\n"
  61                     "       secitemcanarytest -r        Reset everything\n");
  62     exit(1);
  63 }
  64
  65 static bool
  66 create_item(NSString *acct)
  67 {
  68     OSStatus status;
  69     NSDictionary *attrs;
  70     int nerrors = 0;
  71
  72     attrs = @{
  73         (id)kSecClass : (id)kSecClassGenericPassword,
  74         (id)kSecAttrLabel : @"secitemcanarytest-oneItem",
  75         (id)kSecAttrAccount : acct,
  76         (id)kSecAttrAccessGroup : kCanaryAccessGroup,
  77         (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
  78         (id)kSecUseDataProtectionKeychain : (id)kCFBooleanTrue,
  79         (id)kSecValueData : [NSData dataWithBytes:"password" length: 8],
  80     };
  81     status = SecItemAdd((__bridge CFDictionaryRef)attrs, NULL);
  82     if (status != 0) {
  83         nerrors++;
  84         fprintf(stderr, "SecItemAdd(%s): %d\n", acct.UTF8String, status);
  85     } else {
  86         printf("created: %s\n", acct.UTF8String);
  87     }
  88
  89     if (!verify_item(acct, false)) {
  90         nerrors++;
  91     }
  92
  93     return (nerrors == 0);
  94 }
  95
  96 static bool
  97 verify_item(NSString *acct, bool deleteit)
  98 {
  99     OSStatus status;
 100     NSDictionary *query;
 101     CFTypeRef result;
 102     int nerrors = 0;
 103
 104     query = @{
 105         (id)kSecClass : (id)kSecClassGenericPassword,
 106         (id)kSecAttrAccessGroup : kCanaryAccessGroup,
 107         (id)kSecAttrAccount : acct,
 108         (id)kSecReturnAttributes : @YES,
 109         (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 110         (id)kSecUseDataProtectionKeychain : (id)kCFBooleanTrue,
 111     };
 112     result = NULL;
 113     status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
 114     if (status != 0) {
 115         nerrors++;
 116         fprintf(stderr, "SecItemCopyMatching(%s): %d\n", acct.UTF8String, status);
 117     } else {
 118         if (CFGetTypeID(result) != CFArrayGetTypeID()) {
 119             nerrors++;
 120             fprintf(stderr, "SecItemCopyMatching(%s): not array\n", acct.UTF8String);
 121         } else if (CFArrayGetCount(result) != 1) {
 122             nerrors++;
 123             fprintf(stderr, "SecItemCopyMatching(%s): incorrect number of results\n", acct.UTF8String);
 124         } else {
 125             printf("verified: %s\n", acct.UTF8String);
 126         }
 127         CFRelease(result);
 128     }
 129
 130     if (deleteit) {
 131         status = SecItemDelete((__bridge CFDictionaryRef)query);
 132         if (status != 0) {
 133             nerrors++;
 134             fprintf(stderr, "SecItemDelete(%s): %d\n", acct.UTF8String, status);
 135         } else {
 136             printf("deleted: %s\n", acct.UTF8String);
 137         }
 138     }
 139
 140     return (nerrors == 0);
 141 }
 142
 143 static void
 144 initial_state(void)
 145 {
 146     OSStatus status;
 147     uint64_t state;
 148     NSDictionary *attrs;
 149
 150     state = 0;
 151     attrs = @{
 152         (id)kSecClass : (id)kSecClassGenericPassword,
 153         (id)kSecAttrLabel : @"canary test state",
 154         (id)kSecAttrAccount : kCanaryStateAccount,
 155         (id)kSecAttrAccessGroup : kCanaryAccessGroup,
 156         (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
 157         (id)kSecUseDataProtectionKeychain : (id)kCFBooleanTrue,
 158         (id)kSecValueData : [NSData dataWithBytes:&state length:sizeof(state)],
 159     };
 160     status = SecItemAdd((__bridge CFDictionaryRef)attrs, NULL);
 161     switch (status) {
 162     case 0:
 163         exit(0);
 164         /*notreached*/
 165     default:
 166         errx(1, "SecItemAdd: %d", status);
 167         /*notreached*/
 168     }
 169 }
 170
 171 static uint64_t
 172 update_state(void)
 173 {
 174     OSStatus status;
 175     NSMutableDictionary *query;
 176     NSDictionary *update;
 177     CFTypeRef result;
 178     uint64_t state = 0, next_state;
 179
 180     query = [NSMutableDictionary dictionary];
 181     query[(id)kSecClass] = (id)kSecClassGenericPassword;
 182     query[(id)kSecAttrAccessGroup] = kCanaryAccessGroup;
 183     query[(id)kSecAttrAccount] = kCanaryStateAccount;
 184     query[(id)kSecUseDataProtectionKeychain] = (id)kCFBooleanTrue;
 185     query[(id)kSecReturnData] = @YES;
 186
 187     status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
 188     switch (status) {
 189     case 0:
 190         if (result != NULL && CFGetTypeID(result) == CFDataGetTypeID() && CFDataGetLength(result) == sizeof(state)) {
 191             memcpy(&state, CFDataGetBytePtr(result), sizeof(state));
 192         } else {
 193             errx(1, "invalid state");
 194             /*notreached*/
 195         }
 196         break;
 197     default:
 198         errx(1, "failed to retrieve state: SecItemCopyMatching(state): %d", status);
 199         /*notreached*/
 200     }
 201
 202     next_state = state + 1;
 203
 204     query[(id)kSecReturnData] = nil;
 205     update = @{
 206         (id)kSecValueData : [NSData dataWithBytes:&next_state length:sizeof(next_state)],
 207     };
 208     status = SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)update);
 209
 210     if (status != 0) {
 211         errx(1, "SecItemUpdate: %d", status);
 212     }
 213
 214     return state;
 215 }
 216
 217 static void
 218 reset(void)
 219 {
 220     OSStatus status;
 221     NSDictionary *query;
 222
 223     query = @{
 224         (id)kSecClass : (id)kSecClassGenericPassword,
 225         (id)kSecAttrAccessGroup : kCanaryAccessGroup,
 226         (id)kSecUseDataProtectionKeychain : (id)kCFBooleanTrue,
 227     };
 228     status = SecItemDelete((__bridge CFDictionaryRef)query);
 229     switch (status) {
 230     case 0:
 231     case errSecItemNotFound:
 232         exit(0);
 233         /*notreached*/
 234     default:
 235         errx(1, "SecItemDelete: %d", status);
 236         /*notreached*/
 237     }
 238 }