Security-59754.80.3.tar.gz

[apple/security.git] / OSX / sec / Security / Regressions / secitem / si-25-cms-skid.m

diff --git a/OSX/sec/Security/Regressions/secitem/si-25-cms-skid.m b/OSX/sec/Security/Regressions/secitem/si-25-cms-skid.m
index d6d53b982b5ca4299029ca81a9498927946afc05..7ed59fb0e2cf3d3b85e78c9ffce8a42b1c6c1289 100644 (file)
--- a/OSX/sec/Security/Regressions/secitem/si-25-cms-skid.m
+++ b/OSX/sec/Security/Regressions/secitem/si-25-cms-skid.m
@@ -28,6 +28,7 @@
 
 #import <Security/SecCMS.h>
 #import <Security/SecTrust.h>
 
 #import <Security/SecCMS.h>
 #import <Security/SecTrust.h>

+#import <Security/SecTrustPriv.h>

 #include <utilities/SecCFRelease.h>
 
 #import "si-25-cms-skid.h"
 #include <utilities/SecCFRelease.h>
 
 #import "si-25-cms-skid.h"


@@ -39,22 +40,28 @@ static void test_cms_verification(void)
 
     SecPolicyRef policy = SecPolicyCreateBasicX509();
     SecTrustRef trust = NULL;
 
     SecPolicyRef policy = SecPolicyCreateBasicX509();
     SecTrustRef trust = NULL;

-    SecTrustResultType trustResult = kSecTrustResultInvalid;
+    CFArrayRef certificates = NULL;

 
     ok_status(SecCMSVerify((__bridge CFDataRef)signedData, (__bridge CFDataRef)content, policy, &trust, NULL), "verify CMS message");
 
 
     ok_status(SecCMSVerify((__bridge CFDataRef)signedData, (__bridge CFDataRef)content, policy, &trust, NULL), "verify CMS message");
 

-    //10 Sept 2016
-    ok_status(SecTrustSetVerifyDate(trust, (__bridge CFDateRef)[NSDate dateWithTimeIntervalSinceReferenceDate:495245242.0]), "set verify date");
-    ok_status(SecTrustEvaluate(trust, &trustResult), "evaluate trust");
-    is(trustResult, kSecTrustResultUnspecified, "trust suceeded");
+    /* verify that CMS stack found the certs in the CMS (using the SKID) and stuck them in the trust ref */
+    ok_status(SecTrustCopyInputCertificates(trust, &certificates), "copy input certificates");
+#if TARGET_OS_OSX
+    // macOS implementation of CMS puts the leaf first and then adds all certs (so the signer cert is included twice)
+    is(CFArrayGetCount(certificates), 4, "4 certs in the cms");
+#else
+    // embedded implementation of CMS just orders the certs so the signer cert is first
+    is(CFArrayGetCount(certificates), 3, "3 certs in the cms");
+#endif

 
 

-    CFReleaseSafe(policy);
-    CFRetainSafe(trust);
+    CFReleaseNull(policy);
+    CFReleaseNull(trust);
+    CFReleaseNull(certificates);

 }
 
 int si_25_cms_skid(int argc, char *const *argv)
 {
 }
 
 int si_25_cms_skid(int argc, char *const *argv)
 {

-    plan_tests(4);
+    plan_tests(3);

 
     test_cms_verification();
 
 
     test_cms_verification();