keychain/ckks/tests/CKKSCloudKitTests.m

   1 /*
   2  * Copyright (c) 2017 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import <XCTest/XCTest.h>
  25 #import <CloudKit/CloudKit.h>
  26 #import <CloudKit/CloudKit_Private.h>
  27
  28 #import <Security/SecureObjectSync/SOSViews.h>
  29 #import <utilities/SecFileLocations.h>
  30 #import <securityd/SecItemServer.h>
  31 #if NO_SERVER
  32 #include <securityd/spi.h>
  33 #endif
  34
  35 #import "keychain/ckks/CKKS.h"
  36 #import "keychain/ckks/CKKSViewManager.h"
  37 #import "keychain/ckks/CKKSKeychainView.h"
  38 #import "keychain/ckks/CKKSCurrentKeyPointer.h"
  39 #import "keychain/ckks/CKKSMirrorEntry.h"
  40 #import "keychain/ckks/CKKSItemEncrypter.h"
  41 #import "keychain/ckks/CloudKitCategories.h"
  42 #import "keychain/ckks/tests/MockCloudKit.h"
  43
  44 @interface CKKSCloudKitTests : XCTestCase
  45
  46 @property NSOperationQueue *operationQueue;
  47 @property CKContainer *container;
  48 @property CKDatabase *database;
  49 @property CKKSKeychainView *kcv;
  50 @property NSString *zoneName;
  51 @property CKRecordZoneID *zoneID;
  52 @property NSDictionary *remoteItems;
  53 @property NSInteger queueTimeout;
  54
  55 @end
  56
  57 // TODO: item modification should up gencount, check this
  58
  59 @implementation CKKSCloudKitTests
  60
  61 #if OCTAGON
  62
  63 #pragma mark Setup
  64
  65 + (void)setUp {
  66     SecCKKSResetSyncing();
  67     SecCKKSTestsEnable();
  68     SecCKKSSetReduceRateLimiting(true);
  69     [super setUp];
  70
  71 #if NO_SERVER
  72     securityd_init_local_spi();
  73 #endif
  74 }
  75
  76 - (void)setUp {
  77     self.remoteItems = nil;
  78     self.queueTimeout = 900;    // CloudKit can be *very* slow, and some tests upload a lot of items indeed
  79     NSString *containerName = [NSString stringWithFormat:@"com.apple.test.p01.B.com.apple.security.keychain.%@", [[NSUUID new] UUIDString]];
  80     self.container = [CKContainer containerWithIdentifier:containerName];
  81
  82     SecCKKSTestResetFlags();
  83     SecCKKSTestSetDisableSOS(true);
  84
  85     self.operationQueue = [NSOperationQueue new];
  86
  87     CKKSViewManager* manager = [[CKKSViewManager alloc] initWithContainerName:containerName
  88                                                                        usePCS:SecCKKSContainerUsePCS
  89                                          fetchRecordZoneChangesOperationClass:[CKFetchRecordZoneChangesOperation class]
  90                                                    fetchRecordsOperationClass:[CKFetchRecordsOperation class]
  91                                                           queryOperationClass:[CKQueryOperation class]
  92                                             modifySubscriptionsOperationClass:[CKModifySubscriptionsOperation class]
  93                                               modifyRecordZonesOperationClass:[CKModifyRecordZonesOperation class]
  94                                                            apsConnectionClass:[APSConnection class]
  95                                                     nsnotificationCenterClass:[NSNotificationCenter class]
  96                                                                 notifierClass:[FakeCKKSNotifier class]];
  97     [CKKSViewManager resetManager:false setTo:manager];
  98
  99     // Make a new fake keychain
 100     NSString* smallName = [self.name componentsSeparatedByString:@" "][1];
 101     smallName = [smallName stringByReplacingOccurrencesOfString:@"]" withString:@""];
 102
 103     NSString* tmp_dir = [NSString stringWithFormat: @"/tmp/%@.%X", smallName, arc4random()];
 104     [[NSFileManager defaultManager] createDirectoryAtPath:[NSString stringWithFormat: @"%@/Library/Keychains", tmp_dir] withIntermediateDirectories:YES attributes:nil error:NULL];
 105
 106     SetCustomHomeURLString((__bridge CFStringRef) tmp_dir);
 107     SecKeychainDbReset(NULL);
 108     // Actually load the database.
 109     kc_with_dbt(true, NULL, ^bool (SecDbConnectionRef dbt) { return false; });
 110
 111     self.zoneName = @"keychain";
 112     self.zoneID = [[CKRecordZoneID alloc] initWithZoneName:self.zoneName ownerName:CKCurrentUserDefaultName];
 113     self.kcv = [[CKKSViewManager manager] findOrCreateView:@"keychain"];
 114 }
 115
 116 - (void)tearDown {
 117     self.remoteItems = nil;
 118     [[CKKSViewManager manager] clearView:@"keychain"];
 119     SecCKKSTestResetFlags();
 120 }
 121
 122 + (void)tearDown {
 123     SecCKKSResetSyncing();
 124 }
 125
 126 #pragma mark Helpers
 127
 128 - (BOOL)waitForEmptyOutgoingQueue:(CKKSKeychainView *)view {
 129     [view processOutgoingQueue:[CKOperationGroup CKKSGroupWithName:@"waitForEmptyOutgoingQueue"]];
 130     NSInteger secondsToWait = self.queueTimeout;
 131     while (true) {
 132         if ([view outgoingQueueEmpty:nil]) {
 133             return YES;
 134         }
 135         [NSThread sleepForTimeInterval:1];
 136         if (--secondsToWait % 60 == 0) {
 137             long minutesWaited = (self.queueTimeout - secondsToWait)/60;
 138             NSLog(@"Waiting %ld minute%@ for empty outgoingQueue", minutesWaited, minutesWaited > 1 ? @"s" : @"");
 139         }
 140         if (secondsToWait <= 0) {
 141             XCTFail(@"Timed out waiting for '%@' OutgoingQueue to become empty", view);
 142             NSLog(@"Giving up waiting for empty outgoingQueue");
 143             return NO;
 144         }
 145
 146     }
 147 }
 148
 149 - (void)startCKKSSubsystem {
 150     // TODO: we removed this mechanism, but haven't tested to see if these tests still succeed
 151 }
 152
 153 - (NSMutableDictionary *)fetchLocalItems {
 154     NSDictionary *query = @{(id)kSecClass               : (id)kSecClassGenericPassword,
 155                             (id)kSecAttrSynchronizable  : (id)kCFBooleanTrue,
 156                             (id)kSecReturnAttributes    : (id)kCFBooleanTrue,
 157                             (id)kSecReturnData          : (id)kCFBooleanTrue,
 158                             (id)kSecMatchLimit          : (id)kSecMatchLimitAll,
 159                             };
 160     CFTypeRef cfresults;
 161     OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef) query, &cfresults);
 162     XCTAssert(status == errSecSuccess || status == errSecItemNotFound, @"retrieved zero or more local items");
 163     if (status == errSecItemNotFound) {
 164         return [NSMutableDictionary new];
 165     } else if (status != errSecSuccess) {
 166         return nil;
 167     }
 168
 169     NSArray *results = CFBridgingRelease(cfresults);
 170
 171     NSMutableDictionary *ret = [NSMutableDictionary new];
 172     for (NSMutableDictionary *item in results) {
 173         ret[item[@"UUID"]] = item;
 174     }
 175
 176     return ret;
 177 }
 178
 179 - (NSMutableDictionary *)fetchRemoteItems {
 180     CKFetchRecordZoneChangesOptions *options = [CKFetchRecordZoneChangesOptions new];
 181     options.previousServerChangeToken = nil;
 182
 183     CKFetchRecordZoneChangesOperation *op = [[CKFetchRecordZoneChangesOperation alloc] initWithRecordZoneIDs:@[self.zoneID] optionsByRecordZoneID:@{self.zoneID : options}];
 184     op.qualityOfService = NSQualityOfServiceUserInitiated;
 185     op.configuration.container = self.container;
 186
 187     __block NSMutableDictionary *data = [NSMutableDictionary new];
 188     __block NSUInteger synckeys = 0;
 189     __block NSUInteger currkeys = 0;
 190     op.recordChangedBlock = ^(CKRecord *record) {
 191         if ([record.recordType isEqualToString:SecCKRecordItemType]) {
 192             data[record.recordID.recordName] = [self decryptRecord:record];
 193         } else if ([record.recordType isEqualToString:SecCKRecordIntermediateKeyType]) {
 194             synckeys += 1;
 195         } else if ([record.recordType isEqualToString:SecCKRecordCurrentKeyType]) {
 196             currkeys += 1;
 197         } else {
 198             XCTFail(@"Encountered unexpected item %@", record);
 199         }
 200     };
 201
 202     dispatch_semaphore_t sema = dispatch_semaphore_create(0);
 203     op.recordZoneFetchCompletionBlock = ^(CKRecordZoneID * _Nonnull recordZoneID,
 204                                           CKServerChangeToken * _Nullable serverChangeToken,
 205                                           NSData * _Nullable clientChangeTokenData,
 206                                           BOOL moreComing,
 207                                           NSError * _Nullable recordZoneError) {
 208         XCTAssertNil(recordZoneError, @"No error in recordZoneFetchCompletionBlock");
 209         if (!moreComing) {
 210             dispatch_semaphore_signal(sema);
 211         }
 212     };
 213
 214     [op start];
 215     dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
 216
 217     // These are new, fresh zones for each test. There should not be old keys yet.
 218     if (synckeys != 3) {XCTFail(@"Unexpected number of synckeys: %lu", synckeys);}
 219     if (currkeys != 3) {XCTFail(@"Unexpected number of current keys: %lu", currkeys);}
 220
 221     self.remoteItems = data;
 222     return data;
 223 }
 224
 225 - (BOOL)compareLocalItem:(NSDictionary *)lhs remote:(NSDictionary *)rhs {
 226     if ([lhs[@"cdat"] compare: rhs[@"cdat"]] != NSOrderedSame) {XCTFail(@"Creation date differs"); return NO;}
 227     if ([lhs[@"mdat"] compare: rhs[@"mdat"]] != NSOrderedSame) {XCTFail(@"Modification date differs"); return NO;}
 228     if (![lhs[@"agrp"] isEqualToString:rhs[@"agrp"]]) {XCTFail(@"Access group differs"); return NO;}
 229     if (![lhs[@"acct"] isEqualToString:rhs[@"acct"]]) {XCTFail(@"Account differs"); return NO;}
 230     if (![lhs[@"v_Data"] isEqualToData:rhs[@"v_Data"]]) {XCTFail(@"Data differs"); return NO;}
 231     // class for lhs is already genp due to copymatching query
 232     if (![rhs[@"class"] isEqualToString:@"genp"]) {XCTFail(@"Class not genp for remote item"); return NO;}
 233     return YES;
 234 }
 235
 236 - (BOOL)compareLocalKeychainWithCloudKitState {
 237     BOOL success = YES;
 238     NSMutableDictionary *localItems = [self fetchLocalItems];
 239     if (localItems == nil) {XCTFail(@"Received nil for localItems"); return NO;}
 240     NSMutableDictionary *remoteItems = [self fetchRemoteItems];
 241     if (remoteItems == nil) {XCTFail(@"Received nil for remoteItems"); return NO;}
 242
 243     for (NSString *uuid in localItems.allKeys) {
 244         if (remoteItems[uuid] == nil) {
 245             XCTFail(@"account %@ item %@ not present in remote", localItems[uuid][@"acct"], localItems[uuid]);
 246             success = NO;
 247             continue;
 248         }
 249         if (![self compareLocalItem:localItems[uuid] remote:remoteItems[uuid]]) {
 250             XCTFail(@"local item %@ matches remote item %@", localItems[uuid], remoteItems[uuid]);
 251             success = NO;
 252         }
 253         [remoteItems removeObjectForKey:uuid];
 254     }
 255     if ([remoteItems count]) {
 256         XCTFail(@"No remote items present not found in local, %@", remoteItems);
 257         return NO;
 258     }
 259     return success;
 260 }
 261
 262 - (BOOL)updateGenericPassword:(NSString *)password account:(NSString *)account {
 263     NSDictionary *query = @{(id)kSecClass : (id)kSecClassGenericPassword,
 264                             (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
 265                             (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
 266                             (id)kSecAttrAccount : account,
 267                             (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
 268                             };
 269     NSDictionary *newpasswd = @{(id)kSecValueData : (id) [password dataUsingEncoding:NSUTF8StringEncoding]};
 270
 271     return errSecSuccess == SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)newpasswd);
 272 }
 273
 274 - (BOOL)uploadRecords:(NSArray<CKRecord*>*)records {
 275     CKModifyRecordsOperation *op = [[CKModifyRecordsOperation alloc] initWithRecordsToSave:records recordIDsToDelete:nil];
 276     op.qualityOfService = NSQualityOfServiceUserInitiated;
 277     op.configuration.container = self.container;
 278
 279     dispatch_semaphore_t sema = dispatch_semaphore_create(0);
 280     __block BOOL result = NO;
 281     op.modifyRecordsCompletionBlock = ^(NSArray<CKRecord *> *savedRecords,
 282                                         NSArray<CKRecordID *> *deletedRecordIDs,
 283                                         NSError *operationError) {
 284         XCTAssertNil(operationError, @"No error uploading records, %@", operationError);
 285         if (operationError == nil) {
 286             result = YES;
 287         }
 288         dispatch_semaphore_signal(sema);
 289     };
 290
 291     [op start];
 292     dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
 293
 294     return result;
 295 }
 296
 297 #pragma mark Helpers Adapted from MockXCTest
 298
 299 - (CKRecord*)createFakeRecord: (CKRecordZoneID*)zoneID recordName:(NSString*)recordName {
 300     return [self createFakeRecord: zoneID recordName:recordName withAccount: nil];
 301 }
 302
 303 - (CKRecord*)createFakeRecord: (CKRecordZoneID*)zoneID recordName:(NSString*)recordName withAccount: (NSString*) account {
 304     NSError* error = nil;
 305
 306     /* Basically: @{
 307      @"acct"  : @"account-delete-me",
 308      @"agrp"  : @"com.apple.security.sos",
 309      @"cdat"  : @"2016-12-21 03:33:25 +0000",
 310      @"class" : @"genp",
 311      @"mdat"  : @"2016-12-21 03:33:25 +0000",
 312      @"musr"  : [[NSData alloc] init],
 313      @"pdmn"  : @"ak",
 314      @"sha1"  : [[NSData alloc] initWithBase64EncodedString: @"C3VWONaOIj8YgJjk/xwku4By1CY=" options:0],
 315      @"svce"  : @"",
 316      @"tomb"  : [NSNumber numberWithInt: 0],
 317      @"v_Data" : [@"data" dataUsingEncoding: NSUTF8StringEncoding],
 318      };
 319      TODO: this should be binary encoded instead of expanded, but the plist encoder should handle it fine */
 320     NSData* itemdata = [[NSData alloc] initWithBase64EncodedString:@"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPCFET0NUWVBFIHBsaXN0IFBVQkxJQyAiLS8vQXBwbGUvL0RURCBQTElTVCAxLjAvL0VOIiAiaHR0cDovL3d3dy5hcHBsZS5jb20vRFREcy9Qcm9wZXJ0eUxpc3QtMS4wLmR0ZCI+CjxwbGlzdCB2ZXJzaW9uPSIxLjAiPgo8ZGljdD4KCTxrZXk+YWNjdDwva2V5PgoJPHN0cmluZz5hY2NvdW50LWRlbGV0ZS1tZTwvc3RyaW5nPgoJPGtleT5hZ3JwPC9rZXk+Cgk8c3RyaW5nPmNvbS5hcHBsZS5zZWN1cml0eS5zb3M8L3N0cmluZz4KCTxrZXk+Y2RhdDwva2V5PgoJPGRhdGU+MjAxNi0xMi0yMVQwMzozMzoyNVo8L2RhdGU+Cgk8a2V5PmNsYXNzPC9rZXk+Cgk8c3RyaW5nPmdlbnA8L3N0cmluZz4KCTxrZXk+bWRhdDwva2V5PgoJPGRhdGU+MjAxNi0xMi0yMVQwMzozMzoyNVo8L2RhdGU+Cgk8a2V5Pm11c3I8L2tleT4KCTxkYXRhPgoJPC9kYXRhPgoJPGtleT5wZG1uPC9rZXk+Cgk8c3RyaW5nPmFrPC9zdHJpbmc+Cgk8a2V5PnNoYTE8L2tleT4KCTxkYXRhPgoJQzNWV09OYU9JajhZZ0pqay94d2t1NEJ5MUNZPQoJPC9kYXRhPgoJPGtleT5zdmNlPC9rZXk+Cgk8c3RyaW5nPjwvc3RyaW5nPgoJPGtleT50b21iPC9rZXk+Cgk8aW50ZWdlcj4wPC9pbnRlZ2VyPgoJPGtleT52X0RhdGE8L2tleT4KCTxkYXRhPgoJWkdGMFlRPT0KCTwvZGF0YT4KPC9kaWN0Pgo8L3BsaXN0Pgo=" options:0];
 321     NSMutableDictionary * item = [[NSPropertyListSerialization propertyListWithData:itemdata
 322                                                                             options:0
 323                                                                              format:nil
 324                                                                               error:&error] mutableCopy];
 325     // Fix up dictionary
 326     item[@"agrp"] = @"com.apple.security.ckks";
 327
 328     XCTAssertNil(error, "interpreted data as item");
 329
 330     if(account) {
 331         [item setObject: account forKey: (__bridge id) kSecAttrAccount];
 332     }
 333
 334     CKRecordID* ckrid = [[CKRecordID alloc] initWithRecordName:recordName zoneID:zoneID];
 335     return [self newRecord: ckrid withNewItemData: item];
 336 }
 337
 338 - (CKRecord*)newRecord: (CKRecordID*) recordID withNewItemData:(NSDictionary*) dictionary {
 339     NSError* error = nil;
 340     CKKSKey* classCKey = [CKKSKey currentKeyForClass:SecCKKSKeyClassC zoneID:recordID.zoneID error:&error];
 341     XCTAssertNotNil(classCKey, "Have class C key for zone");
 342
 343     CKKSItem* cipheritem = [CKKSItemEncrypter encryptCKKSItem:[[CKKSItem alloc] initWithUUID:recordID.recordName
 344                                                                                parentKeyUUID:classCKey.uuid
 345                                                                                       zoneID:recordID.zoneID]
 346                                                dataDictionary:dictionary
 347                                              updatingCKKSItem:nil
 348                                                     parentkey:classCKey
 349                                                         error:&error];
 350
 351     CKKSOutgoingQueueEntry* ciphertext = [[CKKSOutgoingQueueEntry alloc] initWithCKKSItem:cipheritem
 352                                                                                    action:SecCKKSActionAdd
 353                                                                                     state:SecCKKSStateNew
 354                                                                                 waitUntil:nil
 355                                                                               accessGroup:@"unused in this function"];
 356     XCTAssertNil(error, "encrypted item with class c key");
 357
 358     CKRecord* ckr = [ciphertext.item CKRecordWithZoneID: recordID.zoneID];
 359     XCTAssertNotNil(ckr, "Created a CKRecord");
 360     return ckr;
 361 }
 362
 363 - (NSDictionary*)decryptRecord: (CKRecord*) record {
 364     CKKSMirrorEntry* ckme = [[CKKSMirrorEntry alloc] initWithCKRecord: record];
 365
 366     NSError* error = nil;
 367
 368     NSDictionary* ret = [CKKSItemEncrypter decryptItemToDictionary:ckme.item error:&error];
 369     XCTAssertNil(error);
 370     XCTAssertNotNil(ret);
 371     return ret;
 372 }
 373
 374 - (BOOL)addMultiplePasswords:(NSString *)password account:(NSString *)account amount:(NSUInteger)amount {
 375     while (amount > 0) {
 376         if (![self addGenericPassword:password account:[NSString stringWithFormat:@"%@%03lu", account, amount]]) {
 377             return NO;
 378         }
 379         amount -= 1;
 380     }
 381     return YES;
 382 }
 383
 384 - (BOOL)deleteMultiplePasswords:(NSString *)account amount:(NSUInteger)amount {
 385     while (amount > 0) {
 386         if (![self deleteGenericPassword:[NSString stringWithFormat:@"%@%03lu", account, amount]]) {
 387             return NO;
 388         }
 389         amount -= 1;
 390     }
 391     return YES;
 392 }
 393
 394 - (BOOL)addGenericPassword: (NSString*) password account: (NSString*) account viewHint: (NSString*) viewHint expecting: (OSStatus) status message: (NSString*) message {
 395     NSMutableDictionary* query = [@{
 396                                     (id)kSecClass : (id)kSecClassGenericPassword,
 397                                     (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
 398                                     (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlock,
 399                                     (id)kSecAttrAccount : account,
 400                                     (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
 401                                     (id)kSecValueData : (id) [password dataUsingEncoding:NSUTF8StringEncoding],
 402                                     } mutableCopy];
 403
 404     if(viewHint) {
 405         query[(id)kSecAttrSyncViewHint] = viewHint;
 406     }
 407
 408     return status == SecItemAdd((__bridge CFDictionaryRef) query, NULL);
 409 }
 410
 411 - (BOOL)addGenericPassword: (NSString*) password account: (NSString*) account expecting: (OSStatus) status message: (NSString*) message {
 412     return [self addGenericPassword:password account:account viewHint:nil expecting:errSecSuccess message:message];
 413 }
 414
 415 - (BOOL)addGenericPassword: (NSString*) password account: (NSString*) account {
 416     return [self addGenericPassword:password account:account viewHint:nil expecting:errSecSuccess message:@"Add item to keychain"];
 417 }
 418
 419 - (BOOL)addGenericPassword: (NSString*) password account: (NSString*) account viewHint:(NSString*)viewHint {
 420     return [self addGenericPassword:password account:account viewHint:viewHint expecting:errSecSuccess message:@"Add item to keychain with a viewhint"];
 421 }
 422
 423 - (BOOL)deleteGenericPassword: (NSString*) account {
 424     NSDictionary* query = @{(id)kSecClass : (id)kSecClassGenericPassword,
 425                             (id)kSecAttrAccount : account,
 426                             (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,};
 427
 428     return errSecSuccess == SecItemDelete((__bridge CFDictionaryRef) query);
 429 }
 430
 431 - (BOOL)findGenericPassword: (NSString*) account expecting: (OSStatus) status {
 432     NSDictionary *query = @{(id)kSecClass : (id)kSecClassGenericPassword,
 433                             (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
 434                             (id)kSecAttrAccount : account,
 435                             (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
 436                             (id)kSecMatchLimit : (id)kSecMatchLimitOne,};
 437
 438     return status == SecItemCopyMatching((__bridge CFDictionaryRef) query, NULL);
 439 }
 440
 441 - (void)checkGenericPassword: (NSString*) password account: (NSString*) account {
 442     NSDictionary *query = @{(id)kSecClass : (id)kSecClassGenericPassword,
 443                             (id)kSecAttrAccessGroup : @"com.apple.security.ckks",
 444                             (id)kSecAttrAccount : account,
 445                             (id)kSecAttrSynchronizable : (id)kCFBooleanTrue,
 446                             (id)kSecMatchLimit : (id)kSecMatchLimitOne,
 447                             (id)kSecReturnData : (id)kCFBooleanTrue,
 448                             };
 449     CFTypeRef result = NULL;
 450
 451     XCTAssertEqual(errSecSuccess, SecItemCopyMatching((__bridge CFDictionaryRef) query, &result), "Finding item %@", account);
 452     XCTAssertNotNil((__bridge id)result, "Received an item");
 453
 454     NSString* storedPassword = [[NSString alloc] initWithData: (__bridge NSData*) result encoding: NSUTF8StringEncoding];
 455     XCTAssertNotNil(storedPassword, "Password parsed as a password");
 456
 457     XCTAssertEqualObjects(storedPassword, password, "Stored password matches received password");
 458 }
 459
 460 #pragma mark Tests
 461
 462 - (void)testAddDelete {
 463     [self startCKKSSubsystem];
 464     [self.kcv waitForKeyHierarchyReadiness];
 465
 466     XCTAssert([self addGenericPassword:@"data" account:@"ck-test-adddelete"], @"Added single item");
 467
 468     [self waitForEmptyOutgoingQueue:self.kcv];
 469     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAdd: states match after add");
 470
 471     XCTAssert([self deleteGenericPassword:@"ck-test-adddelete"], @"Deleted single item");
 472
 473     [self waitForEmptyOutgoingQueue:self.kcv];
 474     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAdd: states match after delete");
 475 }
 476
 477 - (void)testAddModDelete {
 478     [self startCKKSSubsystem];
 479     [self.kcv waitForKeyHierarchyReadiness];
 480
 481     [self addGenericPassword:@"data" account:@"ck-test-addmoddelete"];
 482
 483     [self waitForEmptyOutgoingQueue:self.kcv];
 484     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMod: states match after add");
 485
 486     [self updateGenericPassword:@"otherdata" account:@"ck-test-addmoddelete"];
 487
 488     [self waitForEmptyOutgoingQueue:self.kcv];
 489     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMod: states match after mod");
 490
 491     [self deleteGenericPassword:@"ck-test-addmoddelete"];
 492
 493     [self waitForEmptyOutgoingQueue:self.kcv];
 494     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMod: states match after del");
 495 }
 496
 497 - (void)testAddModDeleteImmediate {
 498     [self startCKKSSubsystem];
 499     [self.kcv waitForKeyHierarchyReadiness];
 500
 501     XCTAssert([self addGenericPassword:@"data" account:@"ck-test-addmoddeleteimmediate"], @"Added item");
 502     XCTAssert([self updateGenericPassword:@"otherdata" account:@"ck-test-addmoddeleteimmediate"], @"Modified item");
 503     XCTAssert([self deleteGenericPassword:@"ck-test-addmoddeleteimmediate"], @"Deleted item");
 504
 505     [self waitForEmptyOutgoingQueue:self.kcv];
 506     [self.kcv waitForFetchAndIncomingQueueProcessing];
 507     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMod: states match after immediate add/mod/delete");
 508 }
 509
 510 - (void)testReceive {
 511     [self startCKKSSubsystem];
 512     [self.kcv waitForKeyHierarchyReadiness];
 513
 514     [self findGenericPassword:@"ck-test-receive" expecting:errSecItemNotFound];
 515     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testReceive: states match before receive");
 516
 517     CKRecord *record = [self createFakeRecord:self.zoneID recordName:@"b6050e4d-e7b7-4e4e-b318-825cacc34722" withAccount:@"ck-test-receive"];
 518     [self uploadRecords:@[record]];
 519
 520     [self.kcv notifyZoneChange:nil];
 521     [self.kcv waitForFetchAndIncomingQueueProcessing];
 522
 523     [self findGenericPassword:@"ck-test-receive" expecting:errSecSuccess];
 524     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testReceive: states match after receive");
 525 }
 526
 527 - (void)testReceiveColliding {
 528     [self startCKKSSubsystem];
 529     [self.kcv waitForKeyHierarchyReadiness];
 530
 531     XCTAssert([self findGenericPassword:@"ck-test-receivecolliding" expecting:errSecItemNotFound], @"test item not yet in keychain");
 532
 533     // Conflicting items! This test does not care how conflict gets resolved, just that state is consistent after syncing
 534     CKRecord *r1 = [self createFakeRecord:self.zoneID recordName:@"97576447-c6b8-47fe-8f00-64f5da49d538" withAccount:@"ck-test-receivecolliding"];
 535     CKRecord *r2 = [self createFakeRecord:self.zoneID recordName:@"c6b86447-9757-47fe-8f00-64f5da49d538" withAccount:@"ck-test-receivecolliding"];
 536     [self uploadRecords:@[r1,r2]];
 537
 538     // poke CKKS since we won't have a real CK notification
 539     [self.kcv notifyZoneChange:nil];
 540     [self.kcv waitForFetchAndIncomingQueueProcessing];
 541     [self waitForEmptyOutgoingQueue:self.kcv];
 542
 543     XCTAssert([self findGenericPassword:@"ck-test-receivecolliding" expecting:errSecSuccess], @"Item present after download");
 544     // This will also flag an issue if the two conflicting items persist
 545     XCTAssert([self compareLocalKeychainWithCloudKitState], @"Back in sync after processing incoming changes");
 546 }
 547
 548 - (void)testAddMultipleDeleteAll {
 549     [self startCKKSSubsystem];
 550     [self.kcv waitForKeyHierarchyReadiness];
 551
 552     XCTAssert([self addMultiplePasswords:@"data" account:@"ck-test-addmultipledeleteall" amount:5]);
 553
 554     [self waitForEmptyOutgoingQueue:self.kcv];
 555     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMultipleDeleteAll: states match after adds");
 556
 557     XCTAssert([self deleteMultiplePasswords:@"ck-test-addmultipledeleteall" amount:3]);
 558
 559     [self waitForEmptyOutgoingQueue:self.kcv];
 560     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMultipleDeleteAll: states match after deletes");
 561
 562     XCTAssert([self deleteGenericPassword:@"ck-test-addmultipledeleteall005"]);
 563     XCTAssert([self deleteGenericPassword:@"ck-test-addmultipledeleteall004"]);
 564
 565     [self waitForEmptyOutgoingQueue:self.kcv];
 566     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddMultipleDeleteAll: states match after deletes");
 567 }
 568
 569 - (void)testAddLotsOfItems {
 570     [ self startCKKSSubsystem];
 571     [self.kcv waitForKeyHierarchyReadiness];
 572
 573     XCTAssert([self addMultiplePasswords:@"data" account:@"ck-test-addlotsofitems" amount:250], @"Added a truckload of items");
 574
 575     XCTAssert([self waitForEmptyOutgoingQueue:self.kcv], @"Completed upload within %ld seconds", (long)self.queueTimeout);
 576     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddLotsOfItems: states match after adding tons of items");
 577
 578     XCTAssert([self deleteMultiplePasswords:@"ck-test-addlotsofitems" amount:250], @"Got rid of a truckload of items");
 579     XCTAssert([self waitForEmptyOutgoingQueue:self.kcv], @"Completed deletions within %ld seconds",(long)self.queueTimeout);
 580
 581     XCTAssert([self compareLocalKeychainWithCloudKitState], @"testAddLotsOfItems: states match after removing tons of items again");
 582 }
 583
 584 #endif
 585
 586 @end