1  //
  2  //  Copyright 2016 Apple. All rights reserved.
  3  //
  4  
  5  /*
  6   * This is to fool os services to not provide the Keychain manager
  7   * interface tht doens't work since we don't have unified headers
  8   * between iOS and OS X. rdar://23405418/
  9   */
 10  #define __KEYCHAINCORE__ 1
 11  
 12  #include <Foundation/Foundation.h>
 13  #include <Security/Security.h>
 14  #include <Security/SecItemPriv.h>
 15  #include <Security/SecBasePriv.h>
 16  #include <Security/SecIdentityPriv.h>
 17  #include <mach/mach_time.h>
 18  #include <err.h>
 19  #include <strings.h>
 20  
 21  #if SEC_OS_OSX_INCLUDES
 22  #include <Security/SecKeychain.h>
 23  #endif
 24  
 25  static void
 26  fail(const char *fmt, ...) __printflike(1, 2) __attribute__((noreturn));
 27  
 28  
 29  static void
 30  fail(const char *fmt, ...)
 31  {
 32      va_list ap;
 33      printf("[FAIL]\n");
 34      fflush(stdout);
 35  
 36      va_start(ap, fmt);
 37      verrx(1, fmt, ap);
 38      va_end(ap);
 39  }
 40  
 41  #if 0
 42  /*
 43   * Create item w/o data, try to make sure we end up in the OS X keychain
 44   */
 45  
 46  static void
 47  CheckItemAddDeleteMaybeLegacyKeychainNoData(void)
 48  {
 49      OSStatus status;
 50  
 51      printf("[BEGIN] %s\n", __FUNCTION__);
 52  
 53      NSDictionary *query = @{
 54          (id)kSecClass : (id)kSecClassGenericPassword,
 55          (id)kSecAttrAccount : @"item-delete-me",
 56          (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
 57      };
 58      status = SecItemDelete((__bridge CFDictionaryRef)query);
 59      if (status != errSecSuccess && status != errSecItemNotFound)
 60          fail("cleanup item: %d", (int)status);
 61  
 62      /*
 63       * now check add notification
 64       */
 65  
 66      status = SecItemAdd((__bridge CFDictionaryRef)query, NULL);
 67      if (status != errSecSuccess)
 68          fail("add item: %d: %s", (int)status, [[query description] UTF8String]);
 69  
 70      /*
 71       * clean up
 72       */
 73  
 74      status = SecItemDelete((__bridge CFDictionaryRef)query);
 75      if (status != errSecSuccess)
 76          fail("cleanup2 item: %d", (int)status);
 77  
 78  
 79      printf("[PASS] %s\n", __FUNCTION__);
 80  
 81  }
 82  #endif
 83  
 84  static void
 85  CheckItemAddDeleteNoData(void)
 86  {
 87      OSStatus status;
 88  
 89      printf("[BEGIN] %s\n", __FUNCTION__);
 90  
 91      NSDictionary *query = @{
 92          (id)kSecClass : (id)kSecClassGenericPassword,
 93          (id)kSecAttrAccessGroup : @"keychain-test1",
 94          (id)kSecAttrAccount : @"item-delete-me",
 95          (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
 96          (id)kSecUseDataProtectionKeychain: @YES,
 97      };
 98      status = SecItemDelete((__bridge CFDictionaryRef)query);
 99      if (status != errSecSuccess && status != errSecItemNotFound)
100          fail("cleanup item: %d", (int)status);
101  
102      /*
103       * Add item
104       */
105  
106      status = SecItemAdd((__bridge CFDictionaryRef)query, NULL);
107      if (status != errSecSuccess)
108          fail("add item: %d: %s", (int)status, [[query description] UTF8String]);
109  
110      /*
111       * clean up
112       */
113  
114      status = SecItemDelete((__bridge CFDictionaryRef)query);
115      if (status != errSecSuccess)
116          fail("cleanup2 item: %d", (int)status);
117  
118      printf("[PASS] %s\n", __FUNCTION__);
119  }
120  
121  static void
122  CheckItemUpdateAccessGroupGENP(void)
123  {
124      OSStatus status;
125  
126      printf("[BEGIN] %s\n", __FUNCTION__);
127  
128      NSDictionary *clean1 = @{
129          (id)kSecClass : (id)kSecClassGenericPassword,
130          (id)kSecAttrAccessGroup : @"keychain-test1",
131          (id)kSecUseDataProtectionKeychain: @YES,
132      };
133      NSDictionary *clean2 = @{
134          (id)kSecClass : (id)kSecClassGenericPassword,
135          (id)kSecAttrAccessGroup : @"keychain-test2",
136          (id)kSecUseDataProtectionKeychain: @YES,
137      };
138  
139      (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
140      (void)SecItemDelete((__bridge CFDictionaryRef)clean2);
141  
142      /*
143       * Add item
144       */
145  
146      NSDictionary *add = @{
147          (id)kSecClass : (id)kSecClassGenericPassword,
148          (id)kSecAttrAccessGroup : @"keychain-test1",
149          (id)kSecAttrAccount : @"item-delete-me",
150          (id)kSecUseDataProtectionKeychain : (id)kCFBooleanTrue,
151          (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
152          (id)kSecUseDataProtectionKeychain: @YES,
153      };
154      status = SecItemAdd((__bridge CFDictionaryRef)add, NULL);
155      if (status != errSecSuccess)
156          fail("add item: %d: %s", (int)status, [[add description] UTF8String]);
157  
158      /*
159       * Update access group
160       */
161      NSDictionary *query = @{
162          (id)kSecClass : (id)kSecClassGenericPassword,
163          (id)kSecAttrAccessGroup : @"keychain-test1",
164          (id)kSecAttrAccount : @"item-delete-me",
165          (id)kSecUseDataProtectionKeychain: @YES,
166      };
167      NSDictionary *modified = @{
168          (id)kSecAttrAccessGroup : @"keychain-test2",
169      };
170  
171      status = SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)modified);
172      if (status != errSecSuccess)
173          fail("cleanup2 item: %d", (int)status);
174  
175      /*
176       *
177       */
178      NSDictionary *check1 = @{
179          (id)kSecClass : (id)kSecClassGenericPassword,
180          (id)kSecAttrAccessGroup : @"keychain-test1",
181          (id)kSecAttrAccount : @"item-delete-me",
182          (id)kSecUseDataProtectionKeychain: @YES,
183      };
184      status = SecItemCopyMatching((__bridge CFDictionaryRef)check1, NULL);
185      if (status != errSecItemNotFound)
186          fail("check1 item: %d", (int)status);
187  
188  
189      NSDictionary *check2 = @{
190          (id)kSecClass : (id)kSecClassGenericPassword,
191          (id)kSecAttrAccessGroup : @"keychain-test2",
192          (id)kSecAttrAccount : @"item-delete-me",
193          (id)kSecUseDataProtectionKeychain: @YES,
194      };
195      status = SecItemCopyMatching((__bridge CFDictionaryRef)check2, NULL);
196      if (status != errSecSuccess)
197          fail("check2 item: %d", (int)status);
198  
199      /*
200       * Clean
201       */
202      (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
203      (void)SecItemDelete((__bridge CFDictionaryRef)clean2);
204  
205      printf("[PASS] %s\n", __FUNCTION__);
206  }
207  
208  static NSString *certDataBase64 = @"\
209  MIIEQjCCAyqgAwIBAgIJAJdFadWqNIfiMA0GCSqGSIb3DQEBBQUAMHMxCzAJBgNVBAYTAkNaMQ8wDQYD\
210  VQQHEwZQcmFndWUxFTATBgNVBAoTDENvc21vcywgSW5jLjEXMBUGA1UEAxMOc3VuLmNvc21vcy5nb2Qx\
211  IzAhBgkqhkiG9w0BCQEWFHRoaW5nQHN1bi5jb3Ntb3MuZ29kMB4XDTE2MDIyNjE0NTQ0OVoXDTE4MTEy\
212  MjE0NTQ0OVowczELMAkGA1UEBhMCQ1oxDzANBgNVBAcTBlByYWd1ZTEVMBMGA1UEChMMQ29zbW9zLCBJ\
213  bmMuMRcwFQYDVQQDEw5zdW4uY29zbW9zLmdvZDEjMCEGCSqGSIb3DQEJARYUdGhpbmdAc3VuLmNvc21v\
214  cy5nb2QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5u9gnYEDzQIVu7yC40VcXTZ01D9CJ\
215  oD/mH62tebEHEdfVPLWKeq+uAHnJ6fTIJQvksaISOxwiOosFjtI30mbe6LZ/oK22wYX+OUwKhAYjZQPy\
216  RYfuaJe/52F0zmfUSJ+KTbUZrXbVVFma4xPfpg4bptvtGkFJWnufvEEHimOGmO5O69lXA0Hit1yLU0/A\
217  MQrIMmZT8gb8LMZGPZearT90KhCbTHAxjcBfswZYeL8q3xuEVHXC7EMs6mq8IgZL7mzSBmrCfmBAIO0V\
218  jW2kvmy0NFxkjIeHUShtYb11oYYyfHuz+1vr1y6FIoLmDejKVnwfcuNb545m26o+z/m9Lv9bAgMBAAGj\
219  gdgwgdUwHQYDVR0OBBYEFGDdpPELS92xT+Hkh/7lcc+4G56VMIGlBgNVHSMEgZ0wgZqAFGDdpPELS92x\
220  T+Hkh/7lcc+4G56VoXekdTBzMQswCQYDVQQGEwJDWjEPMA0GA1UEBxMGUHJhZ3VlMRUwEwYDVQQKEwxD\
221  b3Ntb3MsIEluYy4xFzAVBgNVBAMTDnN1bi5jb3Ntb3MuZ29kMSMwIQYJKoZIhvcNAQkBFhR0aGluZ0Bz\
222  dW4uY29zbW9zLmdvZIIJAJdFadWqNIfiMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAFYi\
223  Zu/dfAMOrD51bYxP88Wu6iDGBe9nMG/0lkKgnX5JQKCxfxFMk875rfa+pljdUMOaPxegOXq1DrYmQB9O\
224  /pHI+t7ozuWHRj2zKkVgMWAygNWDPcoqBEus53BdAgA644aPN2JvnE4NEPCllOMKftPoIWbd/5ZjCx3a\
225  bCuxBdXq5YSmiEnOdGfKeXjeeEiIDgARb4tLgH5rkOpB1uH/ZCWn1hkiajBhrGhhPhpA0zbkZg2Ug+8g\
226  XPlx1yQB1VOJkj2Z8dUEXCaRRijInCJ2eU+pgJvwLV7mxmSED7DEJ+b+opxJKYrsdKBU6RmYpPrDa+KC\
227  /Yfu88P9hKKj0LmBiREA\
228  ";
229  
230  static NSString *keyDataBase64 = @"\
231  MIIEogIBAAKCAQEAubvYJ2BA80CFbu8guNFXF02dNQ/QiaA/5h+trXmxBxHX1Ty1inqvrgB5yen0yCUL\
232  5LGiEjscIjqLBY7SN9Jm3ui2f6CttsGF/jlMCoQGI2UD8kWH7miXv+dhdM5n1Eifik21Ga121VRZmuMT\
233  36YOG6bb7RpBSVp7n7xBB4pjhpjuTuvZVwNB4rdci1NPwDEKyDJmU/IG/CzGRj2Xmq0/dCoQm0xwMY3A\
234  X7MGWHi/Kt8bhFR1wuxDLOpqvCIGS+5s0gZqwn5gQCDtFY1tpL5stDRcZIyHh1EobWG9daGGMnx7s/tb\
235  69cuhSKC5g3oylZ8H3LjW+eOZtuqPs/5vS7/WwIDAQABAoIBAGcwmQAPdyZus3OVwa1NCUD2KyB+39KG\
236  yNmWwgx+br9Jx4s+RnJghVh8BS4MIKZOBtSRaEUOuCvAMNrupZbD+8leq34vDDRcQpCizr+M6Egj6FRj\
237  Ewl+7Mh+yeN2hbMoghL552MTv9D4Iyxteu4nuPDd/JQ3oQwbDFIL6mlBFtiBDUr9ndemmcJ0WKuzor6a\
238  3rgsygLs8SPyMefwIKjh5rJZls+iv3AyVEoBdCbHBz0HKgLVE9ZNmY/gWqda2dzAcJxxMdafeNVwHovv\
239  BtyyRGnA7Yikx2XT4WLgKfuUsYLnDWs4GdAa738uxPBfiddQNeRjN7jRT1GZIWCk0P29rMECgYEA8jWi\
240  g1Dph+4VlESPOffTEt1aCYQQWtHs13Qex95HrXX/L49fs6cOE7pvBh7nVzaKwBnPRh5+3bCPsPmRVb7h\
241  k/GreOriCjTZtyt2XGp8eIfstfirofB7c1lNBjT61BhgjJ8Moii5c2ksNIOOZnKtD53n47mf7hiarYkw\
242  xFEgU6ECgYEAxE8Js3gIPOBjsSw47XHuvsjP880nZZx/oiQ4IeJb/0rkoDMVJjU69WQu1HTNNAnMg4/u\
243  RXo31h+gDZOlE9t9vSXHdrn3at67KAVmoTbRknGxZ+8tYpRJpPj1hyufynBGcKwevv3eHJHnE5eDqbHx\
244  ynZFkXemzT9aMy3R4CCFMXsCgYAYyZpnG/m6WohE0zthMFaeoJ6dSLGvyboWVqDrzXjCbMf/4wllRlxv\
245  cm34T2NXjpJmlH2c7HQJVg9uiivwfYdyb5If3tHhP4VkdIM5dABnCWoVOWy/NvA7XtE+KF/fItuGqKRP\
246  WCGaiRHoEeqZ23SQm5VmvdF7OXNi/R5LiQ3o4QKBgAGX8qg2TTrRR33ksgGbbyi1UJrWC3/TqWWTjbEY\
247  uU51OS3jvEQ3ImdjjM3EtPW7LqHSxUhjGZjvYMk7bZefrIGgkOHx2IRRkotcn9ynKURbD+mcE249beuc\
248  6cFTJVTrXGcFvqomPWtV895A2JzECQZvt1ja88uuu/i2YoHDQdGJAoGAL2TEgiMXiunb6PzYMMKKa+mx\
249  mFnagF0Ek3UJ9ByXKoLz3HFEl7cADIkqyenXFsAER/ifMyCoZp/PDBd6ZkpqLTdH0jQ2Yo4SllLykoiZ\
250  fBWMfjRu4iw9E0MbPB3blmtzfv53BtWKy0LUOlN4juvpqryA7TgaUlZkfMT+T1TC7xU=\
251  ";
252  
253  
254  static SecIdentityRef
255  CreateTestIdentity(void)
256  {
257      NSData *certData = [[NSData alloc] initWithBase64EncodedString:certDataBase64 options:0];
258      SecCertificateRef cert = SecCertificateCreateWithData(kCFAllocatorDefault, (CFDataRef)certData);
259      if (cert == NULL)
260          fail("create certificate from data");
261  
262      NSData *keyData = [[NSData alloc] initWithBase64EncodedString:keyDataBase64 options:0];
263      NSDictionary *keyAttrs = @{
264                                 (id)kSecAttrKeyType: (id)kSecAttrKeyTypeRSA,
265                                 (id)kSecAttrKeySizeInBits: @2048,
266                                 (id)kSecAttrKeyClass: (id)kSecAttrKeyClassPrivate
267                                 };
268      SecKeyRef privateKey = SecKeyCreateWithData((CFDataRef)keyData, (CFDictionaryRef)keyAttrs, NULL);
269      if (privateKey == NULL)
270          fail("create private key from data");
271  
272      // Create identity from certificate and private key.
273      SecIdentityRef identity = SecIdentityCreate(kCFAllocatorDefault, cert, privateKey);
274      CFRelease(privateKey);
275      CFRelease(cert);
276  
277      return identity;
278  }
279  
280  static void
281  CheckIdentityItem(NSString *accessGroup, OSStatus expectedStatus)
282  {
283      OSStatus status;
284  
285      NSDictionary *check = @{
286                               (id)kSecClass : (id)kSecClassIdentity,
287                               (id)kSecAttrAccessGroup : accessGroup,
288                               (id)kSecAttrLabel : @"item-delete-me",
289                               (id)kSecUseDataProtectionKeychain: @YES,
290                               };
291      status = SecItemCopyMatching((__bridge CFDictionaryRef)check, NULL);
292      if (status != expectedStatus)
293          fail("check %s for %d item: %d", [accessGroup UTF8String], (int)expectedStatus, (int)status);
294  }
295  
296  static void
297  CheckItemUpdateAccessGroupIdentity(void)
298  {
299      OSStatus status;
300      CFTypeRef ref = NULL;
301  
302      printf("[BEGIN] %s\n", __FUNCTION__);
303  
304      NSDictionary *clean1 = @{
305          (id)kSecClass : (id)kSecClassIdentity,
306          (id)kSecAttrAccessGroup : @"keychain-test1",
307      };
308      NSDictionary *clean2 = @{
309          (id)kSecClass : (id)kSecClassIdentity,
310          (id)kSecAttrAccessGroup : @"keychain-test2",
311      };
312  
313      (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
314      (void)SecItemDelete((__bridge CFDictionaryRef)clean2);
315  
316      CheckIdentityItem(@"keychain-test1", errSecItemNotFound);
317      CheckIdentityItem(@"keychain-test2", errSecItemNotFound);
318  
319      SecIdentityRef identity = CreateTestIdentity();
320      if (identity == NULL)
321          fail("create private key from data");
322  
323  
324      /*
325       * Add item
326       */
327  
328      NSDictionary *add = @{
329          (id)kSecValueRef : (__bridge id)identity,
330          (id)kSecAttrAccessGroup : @"keychain-test1",
331          (id)kSecAttrLabel : @"item-delete-me",
332          (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
333          (id)kSecUseDataProtectionKeychain: @YES,
334          (id)kSecReturnPersistentRef: (id)kCFBooleanTrue,
335      };
336      status = SecItemAdd((__bridge CFDictionaryRef)add, &ref);
337      if (status != errSecSuccess)
338          fail("add item: %d: %s", (int)status, [[add description] UTF8String]);
339  
340      /*
341       *
342       */
343      CheckIdentityItem(@"keychain-test1", errSecSuccess);
344      CheckIdentityItem(@"keychain-test2", errSecItemNotFound);
345  
346  
347      /*
348       * Update access group
349       */
350      NSDictionary *query = @{
351          (id)kSecClass : (id)kSecClassIdentity,
352          (id)kSecAttrAccessGroup : @"keychain-test1",
353          (id)kSecAttrLabel : @"item-delete-me",
354          (id)kSecUseDataProtectionKeychain : (id)kCFBooleanTrue,
355      };
356      NSDictionary *modified = @{
357          (id)kSecAttrAccessGroup : @"keychain-test2",
358      };
359  
360      status = SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)modified);
361      if (status != errSecSuccess)
362          fail("cleanup2 item: %d", (int)status);
363  
364      /*
365       *
366       */
367  
368      CheckIdentityItem(@"keychain-test1", errSecItemNotFound);
369      CheckIdentityItem(@"keychain-test2", errSecSuccess);
370  
371      /*
372       * Check pref
373       */
374      CFDataRef data = NULL;
375  
376      NSDictionary *prefQuery = @{
377          (id)kSecClass : (id)kSecClassIdentity,
378          (id)kSecAttrAccessGroup : @"keychain-test2",
379          (id)kSecAttrLabel : @"item-delete-me",
380          (id)kSecUseDataProtectionKeychain: @YES,
381          (id)kSecReturnPersistentRef : (id)kCFBooleanTrue,
382      };
383      status = SecItemCopyMatching((__bridge CFDictionaryRef)prefQuery, (CFTypeRef *)&data);
384      if (status != errSecSuccess)
385          fail("prefQuery item: %d", (int)status);
386  
387      /*
388       * Update access group for identity
389       */
390      NSDictionary *query2 = @{
391          (id)kSecValuePersistentRef : (__bridge id)data,
392          (id)kSecUseDataProtectionKeychain : (id)kCFBooleanTrue,
393      };
394      NSDictionary *modified2 = @{
395          (id)kSecAttrAccessGroup : @"keychain-test1",
396      };
397  
398      status = SecItemUpdate((__bridge CFDictionaryRef)query2, (__bridge CFDictionaryRef)modified2);
399      if (status != errSecInternal)
400          fail("update identity with pref fails differntly: %d", (int)status);
401  
402  /*
403      CheckIdentityItem(@"keychain-test1", errSecSuccess);
404      CheckIdentityItem(@"keychain-test2", errSecItemNotFound);
405   */
406  
407  
408      /*
409       * Clean
410       */
411      (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
412      (void)SecItemDelete((__bridge CFDictionaryRef)clean2);
413  
414      CFRelease(identity);
415  
416      CheckIdentityItem(@"keychain-test1", errSecItemNotFound);
417      CheckIdentityItem(@"keychain-test2", errSecItemNotFound);
418  
419  
420      printf("[PASS] %s\n", __FUNCTION__);
421  }
422  
423  static void
424  CheckFindIdentityByReference(void)
425  {
426      OSStatus status;
427      CFDataRef pref = NULL, pref2 = NULL;
428  
429      printf("[BEGIN] %s\n", __FUNCTION__);
430  
431      /*
432       * Clean identities
433       */
434      NSDictionary *clean1 = @{
435          (id)kSecClass : (id)kSecClassIdentity,
436          (id)kSecAttrAccessGroup : @"keychain-test1",
437      };
438      (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
439  
440      /*
441       * Add
442       */
443      SecIdentityRef identity = CreateTestIdentity();
444      if (identity == NULL)
445          fail("create private key from data");
446  
447  
448      NSDictionary *add = @{
449          (id)kSecValueRef : (__bridge id)identity,
450          (id)kSecAttrAccessGroup : @"keychain-test1",
451          (id)kSecAttrLabel : @"CheckItemReference",
452          (id)kSecAttrAccessible : (id)kSecAttrAccessibleAfterFirstUnlock,
453          (id)kSecUseDataProtectionKeychain: @YES,
454          (id)kSecReturnPersistentRef: (id)kCFBooleanTrue,
455      };
456      status = SecItemAdd((__bridge CFDictionaryRef)add, (CFTypeRef *)&pref);
457      if (status != errSecSuccess)
458          fail("add item: %d: %s", (int)status, [[add description] UTF8String]);
459  
460      if (pref == NULL || CFGetTypeID(pref) != CFDataGetTypeID())
461          fail("no pref returned");
462  
463      /*
464       * Find by identity
465       */
466  
467      NSDictionary *query = @{
468          (id)kSecValueRef : (__bridge id)identity,
469          (id)kSecReturnPersistentRef: (id)kCFBooleanTrue,
470      };
471      status = SecItemCopyMatching((CFDictionaryRef)query, (CFTypeRef *)&pref2);
472      if (status)
473          fail("SecItemCopyMatching: %d", (int)status);
474  
475      if (pref2 == NULL || CFGetTypeID(pref2) != CFDataGetTypeID())
476          fail("no pref2 returned");
477  
478  
479      if (!CFEqual(pref, pref2))
480          fail("prefs not same");
481  
482      CFRelease(pref2);
483  
484      /*
485       * Find by label
486       */
487  
488      NSDictionary *query2 = @{
489          (id)kSecClass : (id)kSecClassIdentity,
490          (id)kSecAttrAccessGroup : @"keychain-test1",
491          (id)kSecAttrLabel : @"CheckItemReference",
492          (id)kSecUseDataProtectionKeychain: @YES,
493          (id)kSecReturnPersistentRef: (id)kCFBooleanTrue,
494      };
495      status = SecItemCopyMatching((CFDictionaryRef)query2, (CFTypeRef *)&pref2);
496      if (status)
497          fail("SecItemCopyMatching: %d", (int)status);
498  
499      if (pref2 == NULL || CFGetTypeID(pref2) != CFDataGetTypeID())
500          fail("no pref2 returned");
501      
502      
503      if (!CFEqual(pref, pref2))
504          fail("prefs not same");
505  
506      CFRelease(pref2);
507  
508      /*
509       * Find by label + reference
510       */
511  
512      NSDictionary *query3 = @{
513          (id)kSecAttrAccessGroup : @"keychain-test1",
514          (id)kSecAttrLabel : @"CheckItemReference",
515          (id)kSecValueRef : (__bridge id)identity,
516          (id)kSecUseDataProtectionKeychain: @YES,
517          (id)kSecReturnPersistentRef: (id)kCFBooleanTrue,
518      };
519      status = SecItemCopyMatching((CFDictionaryRef)query3, (CFTypeRef *)&pref2);
520      if (status)
521          fail("SecItemCopyMatching: %d", (int)status);
522  
523      if (pref2 == NULL || CFGetTypeID(pref2) != CFDataGetTypeID())
524          fail("no pref2 returned");
525      
526      
527      if (!CFEqual(pref, pref2))
528          fail("prefs not same");
529  
530      CFRelease(pref2);
531  
532      /*
533       * Free stuff
534       */
535  
536      CFRelease(pref);
537      if(identity) {
538          CFRelease(identity);
539          identity = NULL;
540      }
541  
542      printf("[PASS] %s\n", __FUNCTION__);
543  }
544  
545  static uint64_t
546  timeDiff(uint64_t start, uint64_t stop)
547  {
548      static uint64_t time_overhead_measured = 0;
549      static double timebase_factor = 0;
550  
551      if (time_overhead_measured == 0) {
552          uint64_t t0 = mach_absolute_time();
553          time_overhead_measured = mach_absolute_time() - t0;
554  
555          struct mach_timebase_info timebase_info = {};
556          mach_timebase_info(&timebase_info);
557          timebase_factor = ((double)timebase_info.numer)/((double)timebase_info.denom);
558      }
559  
560      return ((stop - start - time_overhead_measured) * timebase_factor) / NSEC_PER_USEC;
561  }
562  
563  static void
564  RunCopyPerfTest(NSString *name, NSDictionary *query)
565  {
566      uint64_t start = mach_absolute_time();
567      OSStatus status;
568      CFTypeRef result = NULL;
569  
570      status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
571      uint64_t stop = mach_absolute_time();
572  
573      if (status != 0) {
574          printf("SecItemCopyMatching failed with: %d\n", (int)status);
575          fflush(stdout);
576          abort();
577      }
578  
579      if (result)
580          CFRelease(result);
581  
582      uint64_t us = timeDiff(start, stop);
583  
584      puts([[NSString stringWithFormat:@"[RESULT_KEY] SecItemCopyMatching-%@\n[RESULT_VALUE] %lu\n",
585             name, (unsigned long)us] UTF8String]);
586  }
587  
588  static void
589  RunDigestPerfTest(NSString *name, NSString *itemClass, NSString *accessGroup, NSUInteger expectedCount)
590  {
591      uint64_t start = mach_absolute_time();
592      dispatch_semaphore_t sema = dispatch_semaphore_create(0);
593      __block uint64_t stop;
594  
595      _SecItemFetchDigests(itemClass, accessGroup, ^(NSArray *items, NSError *error) {
596          stop = mach_absolute_time();
597          if (error) {
598              printf("%s: _SecItemFetchDigests failed with: %ld\n", [name UTF8String], (long)error.code);
599              fflush(stdout);
600              abort();
601          }
602          dispatch_semaphore_signal(sema);
603  
604          if (expectedCount != [items count]) {
605              printf("%s: _SecItemFetchDigests didn't return expected items: %ld\n", [name UTF8String], (long)[items count]);
606              fflush(stdout);
607              abort();
608          }
609      });
610      dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
611  
612  
613      uint64_t us = timeDiff(start, stop);
614  
615      puts([[NSString stringWithFormat:@"[RESULT_KEY] SecItemCopyDigest-%@\n[RESULT_VALUE] %lu\n",
616             name, (unsigned long)us] UTF8String]);
617  }
618  
619  
620  static void
621  CheckItemPerformance(void)
622  {
623      unsigned n;
624  
625      printf("[BEGIN] %s\n", __FUNCTION__);
626  
627      /*
628       * Clean identities
629       */
630      NSDictionary *clean1 = @{
631          (id)kSecClass : (id)kSecClassGenericPassword,
632          (id)kSecAttrService : @"service",
633          (id)kSecAttrAccessGroup : @"keychain-test1",
634          (id)kSecUseDataProtectionKeychain : (id)kCFBooleanTrue,
635      };
636      (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
637  
638      NSData *data = [NSData dataWithBytes:"password" length:8];
639  
640      for (n = 0; n < 1000; n++) {
641          NSDictionary *item = @{
642              (id)kSecClass : (id)kSecClassGenericPassword,
643              (id)kSecAttrAccount : [NSString stringWithFormat:@"account-%d", n],
644              (id)kSecAttrService : @"service",
645              (id)kSecUseDataProtectionKeychain : (id)kCFBooleanTrue,
646              (id)kSecAttrAccessGroup : @"keychain-test1",
647              (id)kSecUseDataProtectionKeychain: @YES,
648              (id)kSecValueData : data,
649          };
650          SecItemAdd((__bridge CFDictionaryRef)item, NULL);
651      }
652  
653  
654      RunCopyPerfTest(@"FindOneItemLimit", @{
655          (id)kSecClass : (id)kSecClassGenericPassword,
656          (id)kSecAttrService : @"service",
657          (id)kSecMatchLimit : (id)kSecMatchLimitOne,
658          (id)kSecUseDataProtectionKeychain: @YES,
659      });
660      RunCopyPerfTest(@"FindOneItemUnique", @{
661          (id)kSecClass : (id)kSecClassGenericPassword,
662          (id)kSecAttrAccount : @"account-0",
663          (id)kSecAttrService : @"service",
664          (id)kSecMatchLimit : (id)kSecMatchLimitAll,
665          (id)kSecUseDataProtectionKeychain: @YES,
666      });
667      RunCopyPerfTest(@"Find1000Items", @{
668          (id)kSecClass : (id)kSecClassGenericPassword,
669          (id)kSecAttrService : @"service",
670          (id)kSecMatchLimit : (id)kSecMatchLimitAll,
671          (id)kSecUseDataProtectionKeychain: @YES,
672      });
673      RunDigestPerfTest(@"Digest1000Items", (id)kSecClassGenericPassword, @"keychain-test1", 1000);
674      RunCopyPerfTest(@"GetAttrOneItemUnique", @{
675          (id)kSecClass : (id)kSecClassGenericPassword,
676          (id)kSecAttrAccount : @"account-0",
677          (id)kSecAttrService : @"service",
678          (id)kSecReturnAttributes : (id)kCFBooleanTrue,
679          (id)kSecMatchLimit : (id)kSecMatchLimitAll,
680          (id)kSecUseDataProtectionKeychain: @YES,
681      });
682      RunCopyPerfTest(@"GetData1000Items", @{
683          (id)kSecClass : (id)kSecClassGenericPassword,
684          (id)kSecAttrService : @"service",
685          (id)kSecReturnData : (id)kCFBooleanTrue,
686          (id)kSecMatchLimit : (id)kSecMatchLimitAll,
687          (id)kSecUseDataProtectionKeychain: @YES,
688      });
689      RunCopyPerfTest(@"GetDataOneItemUnique", @{
690          (id)kSecClass : (id)kSecClassGenericPassword,
691          (id)kSecAttrAccount : @"account-0",
692          (id)kSecAttrService : @"service",
693          (id)kSecReturnData : (id)kCFBooleanTrue,
694          (id)kSecMatchLimit : (id)kSecMatchLimitAll,
695          (id)kSecUseDataProtectionKeychain: @YES,
696      });
697      RunCopyPerfTest(@"GetDataAttrOneItemUnique", @{
698          (id)kSecClass : (id)kSecClassGenericPassword,
699          (id)kSecAttrAccount : @"account-0",
700          (id)kSecAttrService : @"service",
701          (id)kSecReturnData : (id)kCFBooleanTrue,
702          (id)kSecReturnAttributes : (id)kCFBooleanTrue,
703          (id)kSecMatchLimit : (id)kSecMatchLimitAll,
704          (id)kSecUseDataProtectionKeychain: @YES,
705      });
706  #if TARGET_OS_IPHONE /* macOS doesn't support fetching data for more then one item */
707      RunCopyPerfTest(@"GetData1000Items", @{
708          (id)kSecClass : (id)kSecClassGenericPassword,
709          (id)kSecAttrService : @"service",
710          (id)kSecReturnData : (id)kCFBooleanTrue,
711          (id)kSecMatchLimit : (id)kSecMatchLimitAll,
712          (id)kSecUseDataProtectionKeychain: @YES,
713      });
714      RunCopyPerfTest(@"GetDataAttr1000Items", @{
715          (id)kSecClass : (id)kSecClassGenericPassword,
716          (id)kSecAttrService : @"service",
717          (id)kSecReturnData : (id)kCFBooleanTrue,
718          (id)kSecReturnAttributes : (id)kCFBooleanTrue,
719          (id)kSecMatchLimit : (id)kSecMatchLimitAll,
720          (id)kSecUseDataProtectionKeychain: @YES,
721      });
722  #endif
723  
724      (void)SecItemDelete((__bridge CFDictionaryRef)clean1);
725  
726  
727      printf("[PASS] %s\n", __FUNCTION__);
728  }
729  
730  int
731  main(int argc, const char ** argv)
732  {
733      printf("[TEST] secitemfunctionality\n");
734  
735      CheckItemPerformance();
736  
737      CheckFindIdentityByReference();
738  
739      //CheckItemAddDeleteMaybeLegacyKeychainNoData();
740      CheckItemAddDeleteNoData();
741      CheckItemUpdateAccessGroupGENP();
742      CheckItemUpdateAccessGroupIdentity();
743  
744      printf("[SUMMARY]\n");
745      printf("test completed\n");
746  
747      return 0;
748  }