keychain/ot/tests/octagon/OctagonTests+SOS.swift

   1 #if OCTAGON
   2
   3 class OctagonSOSTests: OctagonTestsBase {
   4
   5     func testSOSOctagonKeyConsistency() throws {
   6         self.putFakeKeyHierarchy(inCloudKit: self.manateeZoneID)
   7         self.putSelfTLKShares(inCloudKit: self.manateeZoneID)
   8         self.saveTLKMaterial(toKeychain: self.manateeZoneID)
   9
  10         self.startCKAccountStatusMock()
  11
  12         self.mockSOSAdapter.circleStatus = SOSCCStatus(kSOSCCInCircle)
  13
  14         XCTAssertTrue(OctagonPerformSOSUpgrade(), "SOS upgrade should be on")
  15         self.cuttlefishContext.startOctagonStateMachine()
  16
  17         self.assertEnters(context: self.cuttlefishContext, state: OctagonStateReady, within: 10 * NSEC_PER_SEC)
  18         self.assertConsidersSelfTrusted(context: self.cuttlefishContext)
  19
  20         assertAllCKKSViews(enter: SecCKKSZoneKeyStateReady, within: 10 * NSEC_PER_SEC)
  21
  22         self.verifyDatabaseMocks()
  23         self.waitForCKModifications()
  24
  25         self.assertSelfTLKSharesInCloudKit(context: self.cuttlefishContext)
  26
  27         let peerID = try self.cuttlefishContext.accountMetadataStore.getEgoPeerID()
  28         XCTAssertNotNil(peerID, "Should have a peer ID")
  29
  30         // CKKS will upload new TLKShares
  31         self.assertAllCKKSViewsUpload(tlkShares: 2)
  32         let newSOSPeer = createSOSPeer(peerID: peerID)
  33         self.mockSOSAdapter.selfPeer = newSOSPeer
  34         self.mockSOSAdapter.trustedPeers.add(newSOSPeer)
  35
  36         // Now restart the context
  37         self.manager.removeContext(forContainerName: OTCKContainerName, contextID: OTDefaultContext)
  38         self.restartCKKSViews()
  39         self.cuttlefishContext = self.manager.context(forContainerName: OTCKContainerName, contextID: OTDefaultContext)
  40
  41         self.cuttlefishContext.startOctagonStateMachine()
  42         self.assertEnters(context: self.cuttlefishContext, state: OctagonStateReady, within: 10 * NSEC_PER_SEC)
  43
  44         self.assertConsidersSelfTrustedCachedAccountStatus(context: self.cuttlefishContext)
  45
  46         let restartedPeerID = try self.cuttlefishContext.accountMetadataStore.getEgoPeerID()
  47         XCTAssertNotNil(restartedPeerID, "Should have a peer ID after restarting")
  48
  49         XCTAssertEqual(peerID, restartedPeerID, "Should have the same peer ID after restarting")
  50         assertAllCKKSViews(enter: SecCKKSZoneKeyStateReady, within: 10 * NSEC_PER_SEC)
  51
  52         self.verifyDatabaseMocks()
  53     }
  54
  55     func testSOSOctagonKeyConsistencyLocked() throws {
  56         self.putFakeKeyHierarchy(inCloudKit: self.manateeZoneID)
  57         self.putSelfTLKShares(inCloudKit: self.manateeZoneID)
  58         self.saveTLKMaterial(toKeychain: self.manateeZoneID)
  59
  60         self.startCKAccountStatusMock()
  61
  62         self.mockSOSAdapter.circleStatus = SOSCCStatus(kSOSCCInCircle)
  63
  64         XCTAssertTrue(OctagonPerformSOSUpgrade(), "SOS upgrade should be on")
  65         self.cuttlefishContext.startOctagonStateMachine()
  66
  67         self.assertEnters(context: self.cuttlefishContext, state: OctagonStateReady, within: 10 * NSEC_PER_SEC)
  68         self.assertConsidersSelfTrusted(context: self.cuttlefishContext)
  69
  70         assertAllCKKSViews(enter: SecCKKSZoneKeyStateReady, within: 10 * NSEC_PER_SEC)
  71
  72         self.verifyDatabaseMocks()
  73         self.waitForCKModifications()
  74
  75         self.assertSelfTLKSharesInCloudKit(context: self.cuttlefishContext)
  76
  77         let peerID = try self.cuttlefishContext.accountMetadataStore.getEgoPeerID()
  78         XCTAssertNotNil(peerID, "Should have a peer ID")
  79
  80         let newSOSPeer = createSOSPeer(peerID: peerID)
  81         self.mockSOSAdapter.selfPeer = newSOSPeer
  82
  83         self.mockSOSAdapter.trustedPeers.add(newSOSPeer)
  84
  85         self.aksLockState = true
  86         self.lockStateTracker.recheck()
  87
  88         assertAllCKKSViews(enter: SecCKKSZoneKeyStateReady, within: 10 * NSEC_PER_SEC)
  89
  90         // Now restart the context
  91         self.manager.removeContext(forContainerName: OTCKContainerName, contextID: OTDefaultContext)
  92         self.restartCKKSViews()
  93         self.cuttlefishContext = self.manager.context(forContainerName: OTCKContainerName, contextID: OTDefaultContext)
  94
  95         self.cuttlefishContext.startOctagonStateMachine()
  96
  97         self.assertEnters(context: self.cuttlefishContext, state: OctagonStateWaitForUnlock, within: 10 * NSEC_PER_SEC)
  98         assertAllCKKSViews(enter: SecCKKSZoneKeyStateWaitForTrust, within: 10 * NSEC_PER_SEC)
  99
 100         self.assertAllCKKSViewsUpload(tlkShares: 2)
 101         self.aksLockState = false
 102         self.lockStateTracker.recheck()
 103
 104         self.assertEnters(context: self.cuttlefishContext, state: OctagonStateReady, within: 10 * NSEC_PER_SEC)
 105         self.assertConsidersSelfTrustedCachedAccountStatus(context: self.cuttlefishContext)
 106
 107         let restartedPeerID = try self.cuttlefishContext.accountMetadataStore.getEgoPeerID()
 108         XCTAssertNotNil(restartedPeerID, "Should have a peer ID after restarting")
 109
 110         XCTAssertEqual(peerID, restartedPeerID, "Should have the same peer ID after restarting")
 111
 112         self.verifyDatabaseMocks()
 113         self.waitForCKModifications()
 114         assertAllCKKSViews(enter: SecCKKSZoneKeyStateReady, within: 10 * NSEC_PER_SEC)
 115     }
 116
 117     func testSOSOctagonKeyConsistencySucceedsAfterUpdatingSOS() throws {
 118         self.putFakeKeyHierarchy(inCloudKit: self.manateeZoneID!)
 119         self.putSelfTLKShares(inCloudKit: self.manateeZoneID!)
 120         self.saveTLKMaterial(toKeychain: self.manateeZoneID!)
 121
 122         self.startCKAccountStatusMock()
 123
 124         self.mockSOSAdapter.circleStatus = SOSCCStatus(kSOSCCInCircle)
 125
 126         XCTAssertTrue(OctagonPerformSOSUpgrade(), "SOS upgrade should be on")
 127         self.cuttlefishContext.startOctagonStateMachine()
 128
 129         self.assertEnters(context: self.cuttlefishContext, state: OctagonStateReady, within: 10 * NSEC_PER_SEC)
 130         self.assertConsidersSelfTrusted(context: self.cuttlefishContext)
 131
 132         assertAllCKKSViews(enter: SecCKKSZoneKeyStateReady, within: 10 * NSEC_PER_SEC)
 133
 134         self.verifyDatabaseMocks()
 135         self.waitForCKModifications()
 136
 137         self.assertSelfTLKSharesInCloudKit(context: self.cuttlefishContext)
 138
 139         let peerID = try self.cuttlefishContext.accountMetadataStore.getEgoPeerID()
 140         XCTAssertNotNil(peerID, "Should have a peer ID")
 141
 142         let newSOSPeer = createSOSPeer(peerID: peerID)
 143         self.mockSOSAdapter.selfPeer = newSOSPeer
 144
 145         self.mockSOSAdapter.trustedPeers.add(newSOSPeer)
 146
 147         self.assertEnters(context: self.cuttlefishContext, state: OctagonStateReady, within: 10 * NSEC_PER_SEC)
 148         self.assertSelfTLKSharesInCloudKit(context: self.cuttlefishContext)
 149         self.assertConsidersSelfTrustedCachedAccountStatus(context: self.cuttlefishContext)
 150         assertAllCKKSViews(enter: SecCKKSZoneKeyStateReady, within: 10 * NSEC_PER_SEC)
 151
 152         // Now restart the context
 153         self.manager.removeContext(forContainerName: OTCKContainerName, contextID: OTDefaultContext)
 154         self.restartCKKSViews()
 155         self.cuttlefishContext = self.manager.context(forContainerName: OTCKContainerName, contextID: OTDefaultContext)
 156
 157         self.cuttlefishContext.startOctagonStateMachine()
 158
 159         self.aksLockState = true
 160         self.lockStateTracker.recheck()
 161
 162         self.assertEnters(context: self.cuttlefishContext, state: OctagonStateWaitForUnlock, within: 10 * NSEC_PER_SEC)
 163         assertAllCKKSViews(enter: SecCKKSZoneKeyStateWaitForTrust, within: 10 * NSEC_PER_SEC)
 164
 165         self.assertAllCKKSViewsUpload(tlkShares: 2)
 166         self.aksLockState = false
 167         self.lockStateTracker.recheck()
 168
 169         self.assertEnters(context: self.cuttlefishContext, state: OctagonStateReady, within: 10 * NSEC_PER_SEC)
 170         self.assertConsidersSelfTrustedCachedAccountStatus(context: self.cuttlefishContext)
 171
 172         let restartedPeerID = try self.cuttlefishContext.accountMetadataStore.getEgoPeerID()
 173         XCTAssertNotNil(restartedPeerID, "Should have a peer ID after restarting")
 174
 175         XCTAssertEqual(peerID, restartedPeerID, "Should have the same peer ID after restarting")
 176
 177         self.verifyDatabaseMocks()
 178         self.waitForCKModifications()
 179         assertAllCKKSViews(enter: SecCKKSZoneKeyStateReady, within: 10 * NSEC_PER_SEC)
 180     }
 181
 182 }
 183
 184 #endif