TrustSettingsInterfaceTests.m   [plain text]

/*
* Copyright (c) 2018 Apple Inc. All Rights Reserved.
*
* @APPLE_LICENSE_HEADER_START@
*
* This file contains Original Code and/or Modifications of Original Code
* as defined in and that are subject to the Apple Public Source License
* Version 2.0 (the 'License'). You may not use this file except in
* compliance with the License. Please obtain a copy of the License at
* http://www.opensource.apple.com/apsl/ and read it before using this
* file.
*
* The Original Code and all software distributed under the License are
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
* Please see the License for the specific language governing rights and
* limitations under the License.
*
* @APPLE_LICENSE_HEADER_END@
*
*/

#import <XCTest/XCTest.h>
#include "OSX/utilities/SecCFWrappers.h"
#include <Security/SecTrustSettings.h>
#include <Security/SecTrustSettingsPriv.h>
#include <Security/SecTrust.h>
#include <Security/SecFramework.h>

#include "../TestMacroConversions.h"
#include "TrustFrameworkTestCase.h"

@interface TrustSettingsInterfaceTests : TrustFrameworkTestCase
@end

@implementation TrustSettingsInterfaceTests

#if TARGET_OS_OSX
- (void)testCopySystemAnchors {
CFArrayRef certArray;
ok_status(SecTrustCopyAnchorCertificates(&certArray), "copy anchors");
CFReleaseSafe(certArray);
ok_status(SecTrustSettingsCopyCertificates(kSecTrustSettingsDomainSystem, &certArray), "copy certificates");
CFReleaseSafe(certArray);
}
#endif

#if !TARGET_OS_BRIDGE
- (void)testSetCTExceptions {
CFErrorRef error = NULL;
const CFStringRef TrustTestsAppID = CFSTR("com.apple.trusttests");
CFDictionaryRef copiedExceptions = NULL;

/* Verify no exceptions set */
is(copiedExceptions = SecTrustStoreCopyCTExceptions(NULL, NULL), NULL, "no exceptions set");
if (copiedExceptions) {
/* If we're starting out with exceptions set, a lot of the following will also fail, so just skip them */
CFReleaseNull(copiedExceptions);
return;
}

/* Set exceptions with specified AppID */
NSDictionary *exceptions1 = @{
(__bridge NSString*)kSecCTExceptionsDomainsKey: @[@"test.apple.com", @".test.apple.com"],
};
ok(SecTrustStoreSetCTExceptions(TrustTestsAppID, (__bridge CFDictionaryRef)exceptions1, &error),
"failed to set exceptions for SecurityTests: %@", error);

/* Copy all exceptions (with only one set) */
ok(copiedExceptions = SecTrustStoreCopyCTExceptions(NULL, &error),
"failed to copy all exceptions: %@", error);
ok([exceptions1 isEqualToDictionary:(__bridge NSDictionary*)copiedExceptions],
"got the wrong exceptions back");
CFReleaseNull(copiedExceptions);

/* Copy this app's exceptions */
ok(copiedExceptions = SecTrustStoreCopyCTExceptions(TrustTestsAppID, &error),
"failed to copy SecurityTests' exceptions: %@", error);
ok([exceptions1 isEqualToDictionary:(__bridge NSDictionary*)copiedExceptions],
"got the wrong exceptions back");
CFReleaseNull(copiedExceptions);

/* Set different exceptions with implied AppID */
NSDictionary *exceptions2 = @{
(__bridge NSString*)kSecCTExceptionsDomainsKey: @[@".test.apple.com"],
};
ok(SecTrustStoreSetCTExceptions(NULL, (__bridge CFDictionaryRef)exceptions2, &error),
"failed to set exceptions for this app: %@", error);

/* Ensure exceptions are replaced for SecurityTests */
ok(copiedExceptions = SecTrustStoreCopyCTExceptions(TrustTestsAppID, &error),
"failed to copy SecurityTests' exceptions: %@", error);
ok([exceptions2 isEqualToDictionary:(__bridge NSDictionary*)copiedExceptions],
"got the wrong exceptions back");
CFReleaseNull(copiedExceptions);

/* Set exceptions with bad inputs */
NSDictionary *badExceptions = @{
(__bridge NSString*)kSecCTExceptionsDomainsKey: @[@"test.apple.com", @".test.apple.com"],
@"not a key": @"not a value",
};
is(SecTrustStoreSetCTExceptions(NULL, (__bridge CFDictionaryRef)badExceptions, &error), false,
"set exceptions with unknown key");
if (error) {
is(CFErrorGetCode(error), errSecParam, "bad input produced unxpected error code: %ld", (long)CFErrorGetCode(error));
} else {
fail("expected failure to set NULL exceptions");
}
CFReleaseNull(error);

/* Remove exceptions */
ok(SecTrustStoreSetCTExceptions(NULL, NULL, &error),
"failed to set empty array exceptions for this app: %@", error);
is(copiedExceptions = SecTrustStoreCopyCTExceptions(NULL, NULL), NULL, "no exceptions set");
}
#else // TARGET_OS_BRIDGE
- (void)testSkipTests
{
XCTAssert(true);
}
#endif

@end