*WIP* Mac Unittest for client cert selection with intermediate certs

net/ssl/client_cert_store_mac.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ssl/client_cert_store_mac.h"
 
 #include <CommonCrypto/CommonDigest.h>
 #include <CoreFoundation/CFArray.h>
 #include <CoreServices/CoreServices.h>
 #include <Security/SecBase.h>
 #include <Security/Security.h>
 
 #include <algorithm>
 #include <string>
 
 #include "base/callback.h"
 #include "base/logging.h"
 #include "base/mac/mac_logging.h"
 #include "base/mac/scoped_cftyperef.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/synchronization/lock.h"
 #include "crypto/mac_security_services_lock.h"
 #include "net/base/host_port_pair.h"
+#include "net/cert/test_keychain_search_list_mac.h"
 #include "net/cert/x509_util.h"
 #include "net/cert/x509_util_mac.h"
 
 using base::ScopedCFTypeRef;
 
 namespace net {
 
 // CSSM functions are deprecated as of OSX 10.7, but have no replacement.
 // https://bugs.chromium.org/p/chromium/issues/detail?id=590914#c1
 #pragma clang diagnostic push
@@ skipping 25 matching lines @@
   SecTrustRef trust_ref = NULL;
   {
     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
     result = SecTrustCreateWithCertificates(input_certs, ssl_policy,
                                             &trust_ref);
   }
   if (result)
     return result;
   ScopedCFTypeRef<SecTrustRef> trust(trust_ref);
 
+  ScopedCFTypeRef<CFArrayRef> scoped_alternate_keychain_search_list;
+  // XXX use TestKeychainSearchList
+  if (TestKeychainSearchList::HasInstance()) {
+    OSStatus status = TestKeychainSearchList::GetInstance()->CopySearchList(
+        &scoped_alternate_keychain_search_list);
+    if (status)
+      return status;
+
+    {
+      base::AutoLock lock(crypto::GetMacSecurityServicesLock());
+      status = SecTrustSetKeychains(trust, scoped_alternate_keychain_search_list.get());
+    }
+    if (status)
+      return status;
+  }
+
   // Evaluate trust, which creates the cert chain.
   SecTrustResultType status;
   CSSM_TP_APPLE_EVIDENCE_INFO* status_chain;
   {
     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
     result = SecTrustEvaluate(trust, &status);
   }
-  if (result)
+  if (result) {
+    OSSTATUS_LOG(ERROR, result) << "SecTrustEvaluate error";
     return result;
+  }
+LOG(WARNING) << "SecTrustEvaluate status=" << status;
   {
     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
     result = SecTrustGetResult(trust, &status, out_cert_chain, &status_chain);
   }
+  if (result) {
+    OSSTATUS_LOG(ERROR, result) << "SecTrustGetResult error";
+  }
+LOG(WARNING) << "SecTrustGetResult status=" << status;
   return result;
 }
 
 // Returns true if |*cert| is issued by an authority in |valid_issuers|
 // according to Keychain Services, rather than using |cert|'s intermediate
 // certificates. If it is, |*cert| is updated to point to the completed
 // certificate
 bool IsIssuedByInKeychain(const std::vector<std::string>& valid_issuers,
                           scoped_refptr<X509Certificate>* cert) {
   DCHECK(cert);
   DCHECK(cert->get());
 
+LOG(WARNING) << "IsIssuedByInKeychain " << (*cert)->subject().GetDisplayName();
   X509Certificate::OSCertHandle cert_handle = (*cert)->os_cert_handle();
   CFArrayRef cert_chain = NULL;
   OSStatus result = CopyCertChain(cert_handle, &cert_chain);
   if (result) {
     OSSTATUS_LOG(ERROR, result) << "CopyCertChain error";
     return false;
   }
 
   if (!cert_chain)
     return false;
+  
+  LOG(WARNING) << "chain size: " << CFArrayGetCount(cert_chain);
 
   X509Certificate::OSCertHandles intermediates;
   for (CFIndex i = 1, chain_count = CFArrayGetCount(cert_chain);
        i < chain_count; ++i) {
     SecCertificateRef cert = reinterpret_cast<SecCertificateRef>(
         const_cast<void*>(CFArrayGetValueAtIndex(cert_chain, i)));
     intermediates.push_back(cert);
   }
 
   scoped_refptr<X509Certificate> new_cert(X509Certificate::CreateFromHandle(
       cert_handle, intermediates));
   CFRelease(cert_chain);  // Also frees |intermediates|.
 
-  if (!new_cert->IsIssuedByEncoded(valid_issuers))
+  if (!new_cert->IsIssuedByEncoded(valid_issuers)) {
+LOG(WARNING) << "no.";
     return false;
+  }
 
+LOG(WARNING) << "yes.";
   cert->swap(new_cert);
   return true;
 }
 
 // Examines the certificates in |preferred_cert| and |regular_certs| to find
 // all certificates that match the client certificate request in |request|,
 // storing the matching certificates in |selected_certs|.
 // If |query_keychain| is true, Keychain Services will be queried to construct
 // full certificate chains. If it is false, only the the certificates and their
 // intermediates (available via X509Certificate::GetIntermediateCertificates())
@@ skipping 71 matching lines @@
       base::AutoLock lock(crypto::GetMacSecurityServicesLock());
       if (SecIdentityCopyPreference(domain_str, 0, NULL, &identity) == noErr)
         preferred_identity.reset(identity);
     }
   }
 
   // Now enumerate the identities in the available keychains.
   scoped_refptr<X509Certificate> preferred_cert = NULL;
   CertificateList regular_certs;
 
+  ScopedCFTypeRef<CFMutableDictionaryRef> query(
+      CFDictionaryCreateMutable(NULL, 0, &kCFTypeDictionaryKeyCallBacks,
+                                &kCFTypeDictionaryValueCallBacks));
+
+  CFDictionarySetValue(query, kSecClass, kSecClassIdentity);
+  CFDictionarySetValue(query, kSecReturnRef, kCFBooleanTrue);
+  CFDictionarySetValue(query, kSecMatchLimit, kSecMatchLimitAll);
+
+  ScopedCFTypeRef<CFArrayRef> scoped_alternate_keychain_search_list;
+  if (TestKeychainSearchList::HasInstance()) {
+    OSStatus status = TestKeychainSearchList::GetInstance()->CopySearchList(
+        &scoped_alternate_keychain_search_list);
+    if (status) {
+      OSSTATUS_LOG(ERROR, status) << "TestKeychainSearchList::CopySearchList error";
+      selected_certs->clear();
+      callback.Run();
+      return;
+    }
+    CFDictionarySetValue(query, kSecMatchSearchList, scoped_alternate_keychain_search_list.get());
+  }
+
+  CFArrayRef matching_items;
+  OSStatus err; 
+  {
+    base::AutoLock lock(crypto::GetMacSecurityServicesLock());
+    err = SecItemCopyMatching(query, (CFTypeRef*)&matching_items);
+  }
+  if (err) {
+    OSSTATUS_LOG(ERROR, err) << "SecItemCopyMatching error";
+    selected_certs->clear();
+    callback.Run();
+    return;
+  }
+  ScopedCFTypeRef<CFArrayRef> scoped_matching_items(matching_items);
+
+  for (CFIndex i = 0, item_count = CFArrayGetCount(matching_items);
+       i < item_count; ++i) {
+    SecIdentityRef identity = reinterpret_cast<SecIdentityRef>(
+        const_cast<void*>(CFArrayGetValueAtIndex(matching_items, i)));
+    SecCertificateRef cert_handle;
+    err = SecIdentityCopyCertificate(identity, &cert_handle);
+    if (err != noErr)
+      continue;
+    ScopedCFTypeRef<SecCertificateRef> scoped_cert_handle(cert_handle);
+
+    scoped_refptr<X509Certificate> cert(
+        X509Certificate::CreateFromHandle(cert_handle,
+                                          X509Certificate::OSCertHandles()));
+
+    if (preferred_identity && CFEqual(preferred_identity, identity)) {
+      // Only one certificate should match.
+      DCHECK(!preferred_cert.get());
+      preferred_cert = cert;
+    } else {
+      regular_certs.push_back(cert);
+    }
+  }
+LOG(WARNING) << "have preferred=" << !!preferred_cert << "  regular_certs.size=" << regular_certs.size();
+
+#if 0
   SecIdentitySearchRef search = NULL;
   OSStatus err;
   {
     base::AutoLock lock(crypto::GetMacSecurityServicesLock());
-    err = SecIdentitySearchCreate(NULL, CSSM_KEYUSE_SIGN, &search);
+    err = SecIdentitySearchCreate(scoped_alternate_keychain_search_list,
+                                  CSSM_KEYUSE_SIGN, &search);
   }
   if (err) {
     selected_certs->clear();
     callback.Run();
     return;
   }
   ScopedCFTypeRef<SecIdentitySearchRef> scoped_search(search);
   while (!err) {
     SecIdentityRef identity = NULL;
     {
@@ skipping 22 matching lines @@
       regular_certs.push_back(cert);
     }
   }
 
   if (err != errSecItemNotFound) {
     OSSTATUS_LOG(ERROR, err) << "SecIdentitySearch error";
     selected_certs->clear();
     callback.Run();
     return;
   }
+#endif
 
   GetClientCertsImpl(preferred_cert, regular_certs, request, true,
                      selected_certs);
   callback.Run();
 }
 
 bool ClientCertStoreMac::SelectClientCertsForTesting(
     const CertificateList& input_certs,
     const SSLCertRequestInfo& request,
     CertificateList* selected_certs) {
   GetClientCertsImpl(NULL, input_certs, request, false, selected_certs);
   return true;
 }
 
 bool ClientCertStoreMac::SelectClientCertsGivenPreferredForTesting(
     const scoped_refptr<X509Certificate>& preferred_cert,
     const CertificateList& regular_certs,
     const SSLCertRequestInfo& request,
     CertificateList* selected_certs) {
   GetClientCertsImpl(
       preferred_cert, regular_certs, request, false, selected_certs);
   return true;
 }
 
 #pragma clang diagnostic pop  // "-Wdeprecated-declarations"
 
 }  // namespace net