]> git.saurik.com Git - apple/security.git/blame - OTAPKIAssetTool/OTAServiceApp.m
projects / apple / security.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Security-58286.31.2.tar.gz
[apple/security.git] / OTAPKIAssetTool / OTAServiceApp.m
CommitLineData
d8f41ccd
A		 1//
2// OTAServiceApp.m
3// Security
4//
d8f41ccd
A		 5//
6
7
8#import "OTAServiceApp.h"
9
10#import <TargetConditionals.h>
11#import <Security/Security.h>
12#import <Security/SecPolicyPriv.h>
13#import <Security/SecTrustPriv.h>
14#import <syslog.h>
15#import <xpc/xpc.h>
16#import <MobileAsset/MobileAsset.h>
17#import <Security/Security.h>
18#import <Security/SecCMS.h>
19#import <Security/SecCmsMessage.h>
20#import <Security/SecCmsDecoder.h>
21#import <Security/SecCmsContentInfo.h>
22#import <Security/SecCmsSignedData.h>
23#import <CommonCrypto/CommonDigest.h>
6b200bc3 24#import <CommonCrypto/CommonDigestSPI.h>
d8f41ccd
A		 25#import <CommonNumerics/CommonBaseXX.h>
26#import <ManagedConfiguration/MCProfileConnection.h>
27#import <MobileGestalt.h>
28
29#if !TARGET_IPHONE_SIMULATOR
30#import <BackgroundTaskAgent/BackgroundTaskAgent.h>
31#endif
32
33#import <sys/types.h>
34#import <pwd.h>
35#import <stdlib.h>
36#import <unistd.h>
37#import <stdio.h>
38#import <grp.h>
39#import <sys/stat.h>
40#import <syslog.h>
41
42#define CFReleaseSafe(CF) { CFTypeRef _cf = (CF); if (_cf) { CFRelease(_cf); } }
43#define CFReleaseNull(CF) { CFTypeRef _cf = (CF); if (_cf) { (CF) = NULL; CFRelease(_cf); } }
44
45//#define VERBOSE_LOGGING 1
46
47#if VERBOSE_LOGGING
48
49static void OTAPKI_LOG(const char* sz, ...)
50{
51 va_list va;
52 va_start(va, sz);
53
54 FILE* fp = fopen("/tmp/OTAPKITool.log", "a");
55 if (NULL != fp)
56 {
57 vfprintf(fp, sz, va);
58 fclose(fp);
59 }
60 va_end(va);
61}
62
63#else
64
65#define OTAPKI_LOG(sz, ...)
66
67#endif
68
69//#define NEW_LOCATION 1
70
71
72
73/* ==========================================================================
74 The following are a set of string constants used by this program.
75
76 kBaseAssetDirectoryPath - This is the full path on the device that
77 will contain the Assets directory. This
78 directory was chosen because it is owned
79 by securityd
80
81 kkManifestFileName - The file name of the manifest file for the
82 OTA PKI trust asset
5c19dc3a 83
e3d460c9 84 kAllowListFileName - The file name of the asset file that contains
5c19dc3a
A		 85 hashes of the allowed leaf certificates whose
86 trust store root has been removed
d8f41ccd
A		 87
88 kAssetVersionFileName - The file name of the plist file in the asset
89 that contains the version number of this
90 OTA PKI trust asset. It is a plist that is a
91 dictionary with a single key with a single
92 key value pair that has the version number
93 of the asset. This is used to ensure against
94 anti-replay.
95
96 kBlockKeyFileName - The file name of the asset file that contains
97 blocked keys. Any certificate with these keys
98 will be marked as not being trusted.
99
100 kGrayListedKeysFileName - The file name of the asset file that contains
101 gray listed keys. If a chain has any of these
102 keys, than the chain will still be approved but
103 an entry will be added to the details dictionary
104 noting that the key was gray listed
105
106
107 kEVRootsFileName - The file name of the asset file that contains
108 the list of EV OIDS and their corresponding
109 certificates. This file sets which certs will
110 be considered to be EV.
111
e3d460c9
A		 112 kCTLogsFileName - The file name of the asset file that contains
113 the list of Certificate Transparency logs and
114 their public keys.
115
d8f41ccd
A		 116 kCertsIndexFileName - The file name of the asset file that contains
117 a hash table of offsets into the cert table
118 file. This is used to look up anchor certs.
119
120 kCertsTableFileName - The file name of the asset file that contains
121 all of the anchor certificates. The
122 kCertsIndexFileName file is used to find the
123 correct offset in this file to retrieve a
124 specific anchor certificate.
125
126 kVersionNumberKey - The dictionary key for the kAssetVersionFileName
127 file to get the version number
128
129 kVersionDirectoryNamePrefix -
130 The directory name prefix for all of the
131 asset directorys
132
133 kPKITrustDataAssetType - The asset identifier of the OTA PKI asset
134
135
136========================================================================== */
137
138#if NEW_LOCATION
139static const NSString* kBaseAssetDirectoryPath = @"/var/OTAPKI";
140#else
141static const NSString* kBaseAssetDirectoryPath = @"/var/Keychains";
142#endif
143
144static const NSString* kManifestFileName = @"manifest.data";
5c19dc3a 145static const NSString* kAllowListFileName = @"Allowed.plist";
d8f41ccd
A		 146static const NSString* kAssetVersionFileName = @"AssetVersion.plist";
147static const NSString* kAppleESCertificatesName = @"AppleESCertificates.plist";
148static const NSString* kBlockKeyFileName = @"Blocked.plist";
149static const NSString* kGrayListedKeysFileName = @"GrayListedKeys.plist";
150static const NSString* kEVRootsFileName = @"EVRoots.plist";
e3d460c9 151static const NSString* kCTLogsFileName = @"TrustedCTLogs.plist";
d8f41ccd
A		 152static const NSString* kCertsIndexFileName = @"certsIndex.data";
153static const NSString* kCertsTableFileName = @"certsTable.data";
154static const NSString* kVersionNumberKey = @"VersionNumber";
155static const NSString* kAssetDirectoryName = @"Assets";
156static const NSString* kAssetDirectoryUser = @"_securityd";
157static const NSString* kAssetDirectoryGroup = @"wheel";
158#if NEW_LOCATION
159static const unsigned long kAssetDirectoryPermission = S_IRWXU | S_IRWXG | S_IRWXO;
160#else
161static const unsigned long kAssetDirectoryPermission = S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH;
162#endif
163static const NSString* kVersionDirectoryNamePrefix = @"Version_";
164static const NSString* kPKITrustDataAssetType =@"com.apple.MobileAsset.PKITrustServices.PKITrustData";
165
166const char *kOTAPKIAssetToolActivity = "com.apple.OTAPKIAssetTool.asset-check";
5c19dc3a 167const char *kOTAPKIAssetToolBTAJob = "com.apple.BTA.OTAPKIAssetTool.asset-check";
d8f41ccd
A		 168
169static const UInt8 kApplePKISettingsRootCACert[] = {
170 0x30, 0x82, 0x07, 0xca, 0x30, 0x82, 0x05, 0xb2, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x4e,
171 0xa1, 0x31, 0xe7, 0xca, 0x50, 0xb8, 0x97, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
172 0x0d, 0x01, 0x01, 0x0d, 0x05, 0x00, 0x30, 0x81, 0x84, 0x31, 0x38, 0x30, 0x36, 0x06, 0x03, 0x55,
173 0x04, 0x03, 0x0c, 0x2f, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x50, 0x4b, 0x49, 0x20, 0x53, 0x65,
174 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x65, 0x72, 0x74,
175 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
176 0x69, 0x74, 0x79, 0x31, 0x26, 0x30, 0x24, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x0c, 0x1d, 0x41, 0x70,
177 0x70, 0x6c, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f,
178 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x31, 0x13, 0x30, 0x11, 0x06,
179 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x2e,
180 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x30, 0x1e, 0x17,
181 0x0d, 0x31, 0x33, 0x30, 0x36, 0x32, 0x34, 0x32, 0x33, 0x33, 0x33, 0x33, 0x39, 0x5a, 0x17, 0x0d,
182 0x34, 0x33, 0x30, 0x36, 0x31, 0x37, 0x32, 0x33, 0x33, 0x33, 0x33, 0x39, 0x5a, 0x30, 0x81, 0x84,
183 0x31, 0x38, 0x30, 0x36, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x2f, 0x41, 0x70, 0x70, 0x6c, 0x65,
184 0x20, 0x50, 0x4b, 0x49, 0x20, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x20, 0x52, 0x6f,
185 0x6f, 0x74, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
186 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x31, 0x26, 0x30, 0x24, 0x06, 0x03,
187 0x55, 0x04, 0x0b, 0x0c, 0x1d, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69,
188 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
189 0x74, 0x79, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x41, 0x70, 0x70,
190 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
191 0x13, 0x02, 0x55, 0x53, 0x30, 0x82, 0x02, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
192 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x02, 0x0f, 0x00, 0x30, 0x82, 0x02, 0x0a,
193 0x02, 0x82, 0x02, 0x01, 0x00, 0xce, 0x15, 0xf7, 0x6f, 0xd8, 0x42, 0x0c, 0x6f, 0x45, 0xb4, 0x04,
194 0x59, 0x24, 0xcb, 0x70, 0x88, 0x84, 0x77, 0xa1, 0x91, 0x54, 0xf4, 0x87, 0x61, 0xb3, 0xd3, 0xfc,
195 0xbe, 0xb6, 0x05, 0x3c, 0xb9, 0xb7, 0x7d, 0x7c, 0xbc, 0x0b, 0xe8, 0x87, 0x07, 0xcf, 0x20, 0xbe,
196 0xaa, 0xeb, 0x24, 0xc5, 0xe4, 0x5c, 0xcd, 0xcb, 0x89, 0x9f, 0x7a, 0xea, 0xb4, 0x5d, 0x3b, 0x29,
197 0x6c, 0xba, 0x4d, 0x15, 0xfb, 0x59, 0xd0, 0x5a, 0xea, 0x41, 0x4e, 0x0d, 0x1d, 0xf7, 0x66, 0x77,
198 0xa2, 0x96, 0x56, 0xed, 0xd1, 0x16, 0x7b, 0xea, 0xf5, 0x60, 0xdf, 0x32, 0x9c, 0xa9, 0xfd, 0xbf,
199 0xb8, 0x34, 0x6f, 0x57, 0x17, 0xe6, 0x04, 0x37, 0x71, 0x07, 0xc0, 0xe9, 0x0f, 0x3c, 0xed, 0x4f,
200 0x31, 0x87, 0x05, 0xa4, 0xed, 0xab, 0xac, 0xd6, 0x50, 0x05, 0x5b, 0xca, 0xd3, 0xf9, 0xd6, 0xaa,
201 0xaa, 0x88, 0x57, 0x66, 0xf6, 0x6d, 0x8d, 0x4b, 0x71, 0x29, 0xd4, 0x3d, 0x1d, 0xbc, 0x82, 0x6e,
202 0x81, 0xe9, 0x19, 0xf5, 0xe1, 0x12, 0x9f, 0x47, 0xdb, 0x5c, 0xed, 0x88, 0xba, 0x51, 0xe7, 0x3a,
203 0xa0, 0x77, 0x2d, 0xe6, 0xcc, 0xb4, 0x34, 0xdf, 0xad, 0xbd, 0x7b, 0xf8, 0xa7, 0x79, 0x51, 0x2d,
204 0xe6, 0xc2, 0xee, 0xd2, 0x96, 0xfa, 0x60, 0x60, 0x32, 0x40, 0x41, 0x37, 0x12, 0xeb, 0x63, 0x99,
205 0x3d, 0xf3, 0x21, 0xbe, 0xdf, 0xa1, 0x77, 0xe6, 0x81, 0xa9, 0x99, 0x0c, 0x4b, 0x43, 0x0c, 0x05,
206 0x6a, 0x6b, 0x8f, 0x05, 0x02, 0xd9, 0x43, 0xab, 0x72, 0x76, 0xca, 0xa7, 0x75, 0x63, 0x85, 0xe3,
207 0xa5, 0x5c, 0xc0, 0xd6, 0xd4, 0x1c, 0xeb, 0xac, 0x2c, 0x9a, 0x15, 0x6b, 0x4e, 0x99, 0x74, 0x7d,
208 0xd2, 0x69, 0x9f, 0xa8, 0xf7, 0x65, 0xde, 0xeb, 0x36, 0x85, 0xd5, 0x7e, 0x4a, 0x7a, 0x8a, 0xeb,
209 0x7c, 0xcd, 0x43, 0x9e, 0x05, 0xdb, 0x34, 0xc3, 0x69, 0xbd, 0xc2, 0xe7, 0xfb, 0xa0, 0x43, 0xb3,
210 0xd7, 0x15, 0x28, 0x8a, 0x91, 0xce, 0xd7, 0xa7, 0xa4, 0xcc, 0xf4, 0x1b, 0x37, 0x33, 0x76, 0xc4,
211 0x58, 0xb9, 0x2d, 0x89, 0xe2, 0xb6, 0x2c, 0x56, 0x10, 0x96, 0xcc, 0xa6, 0x07, 0x79, 0x11, 0x7d,
212 0x26, 0xd2, 0x85, 0x22, 0x19, 0x20, 0xb7, 0xef, 0xc3, 0xd9, 0x4e, 0x18, 0xf3, 0xaa, 0x05, 0xce,
213 0x87, 0x99, 0xde, 0x76, 0x90, 0x08, 0x74, 0xac, 0x61, 0x31, 0xf8, 0x51, 0xa0, 0xc9, 0x70, 0xfc,
214 0xb9, 0x22, 0xfe, 0xd2, 0x0d, 0xc8, 0x49, 0x64, 0x00, 0xe4, 0xf1, 0x53, 0xfd, 0xa1, 0xe6, 0xff,
215 0x8e, 0xd6, 0xde, 0x9e, 0xcc, 0x3d, 0x37, 0x3a, 0x10, 0x62, 0x59, 0xb2, 0x34, 0x8a, 0x1d, 0xf7,
216 0x9e, 0xa0, 0xbb, 0xf4, 0x53, 0xd9, 0xb8, 0x18, 0x88, 0x12, 0x5c, 0x92, 0x0d, 0xc9, 0x94, 0x7f,
217 0x24, 0xb9, 0x9f, 0xda, 0x07, 0xb6, 0x79, 0x77, 0x09, 0xa3, 0x29, 0x3a, 0x70, 0x63, 0x3b, 0x22,
218 0x42, 0x14, 0xd0, 0xf9, 0x7b, 0x90, 0x52, 0x2b, 0x3f, 0x7f, 0xb7, 0x41, 0x20, 0x0d, 0x7e, 0x70,
219 0xd7, 0x88, 0x36, 0xa2, 0xe9, 0x81, 0x77, 0xf4, 0xb0, 0x15, 0x43, 0x9c, 0x5f, 0x4d, 0x3e, 0x4f,
220 0x83, 0x79, 0x06, 0x73, 0x7a, 0xe7, 0xcb, 0x79, 0x1d, 0xec, 0xa3, 0xce, 0x93, 0x5c, 0x68, 0xbf,
221 0x5a, 0xe6, 0x4c, 0x23, 0x86, 0x41, 0x7f, 0xb4, 0xfc, 0xd0, 0x2c, 0x1b, 0x64, 0x39, 0x64, 0xb7,
222 0xd2, 0x1d, 0xd0, 0x2d, 0x16, 0x77, 0xfe, 0x4d, 0xad, 0xf0, 0x4f, 0x38, 0xb3, 0xf9, 0x5a, 0xee,
223 0x0e, 0x1d, 0xb6, 0xf9, 0x3f, 0xba, 0x77, 0x5a, 0x20, 0xd2, 0x74, 0x1a, 0x4b, 0x5a, 0xaf, 0x62,
224 0xb5, 0xd3, 0xef, 0x37, 0x49, 0xfe, 0x1e, 0xcd, 0xb5, 0xba, 0xb5, 0xa6, 0x46, 0x7b, 0x38, 0x63,
225 0x62, 0x3c, 0x18, 0x7d, 0x57, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x82, 0x02, 0x3c, 0x30, 0x82,
226 0x02, 0x38, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, 0x35, 0x07, 0x82,
227 0xfe, 0x0e, 0x8f, 0xf5, 0xa0, 0x7c, 0x2e, 0xf9, 0x65, 0x7b, 0xa8, 0x48, 0xe8, 0x8f, 0x61, 0xb6,
228 0x1c, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x05, 0x30, 0x03, 0x01,
229 0x01, 0xff, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x35,
230 0x07, 0x82, 0xfe, 0x0e, 0x8f, 0xf5, 0xa0, 0x7c, 0x2e, 0xf9, 0x65, 0x7b, 0xa8, 0x48, 0xe8, 0x8f,
231 0x61, 0xb6, 0x1c, 0x30, 0x82, 0x01, 0xd3, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04, 0x82, 0x01, 0xca,
232 0x30, 0x82, 0x01, 0xc6, 0x30, 0x82, 0x01, 0xc2, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x63,
233 0x64, 0x05, 0x01, 0x30, 0x82, 0x01, 0xb3, 0x30, 0x82, 0x01, 0x78, 0x06, 0x08, 0x2b, 0x06, 0x01,
234 0x05, 0x05, 0x07, 0x02, 0x02, 0x30, 0x82, 0x01, 0x6a, 0x1e, 0x82, 0x01, 0x66, 0x00, 0x52, 0x00,
235 0x65, 0x00, 0x6c, 0x00, 0x69, 0x00, 0x61, 0x00, 0x6e, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00,
236 0x6f, 0x00, 0x6e, 0x00, 0x20, 0x00, 0x74, 0x00, 0x68, 0x00, 0x69, 0x00, 0x73, 0x00, 0x20, 0x00,
237 0x63, 0x00, 0x65, 0x00, 0x72, 0x00, 0x74, 0x00, 0x69, 0x00, 0x66, 0x00, 0x69, 0x00, 0x63, 0x00,
238 0x61, 0x00, 0x74, 0x00, 0x65, 0x00, 0x20, 0x00, 0x62, 0x00, 0x79, 0x00, 0x20, 0x00, 0x61, 0x00,
239 0x6e, 0x00, 0x79, 0x00, 0x20, 0x00, 0x70, 0x00, 0x61, 0x00, 0x72, 0x00, 0x74, 0x00, 0x79, 0x00,
240 0x20, 0x00, 0x61, 0x00, 0x73, 0x00, 0x73, 0x00, 0x75, 0x00, 0x6d, 0x00, 0x65, 0x00, 0x73, 0x00,
241 0x20, 0x00, 0x61, 0x00, 0x63, 0x00, 0x63, 0x00, 0x65, 0x00, 0x70, 0x00, 0x74, 0x00, 0x61, 0x00,
242 0x6e, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00, 0x6f, 0x00, 0x66, 0x00, 0x20, 0x00, 0x74, 0x00,
243 0x68, 0x00, 0x65, 0x00, 0x20, 0x00, 0x74, 0x00, 0x68, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x20, 0x00,
244 0x61, 0x00, 0x70, 0x00, 0x70, 0x00, 0x6c, 0x00, 0x69, 0x00, 0x63, 0x00, 0x61, 0x00, 0x62, 0x00,
245 0x6c, 0x00, 0x65, 0x00, 0x20, 0x00, 0x73, 0x00, 0x74, 0x00, 0x61, 0x00, 0x6e, 0x00, 0x64, 0x00,
246 0x61, 0x00, 0x72, 0x00, 0x64, 0x00, 0x20, 0x00, 0x74, 0x00, 0x65, 0x00, 0x72, 0x00, 0x6d, 0x00,
247 0x73, 0x00, 0x20, 0x00, 0x61, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x20, 0x00, 0x63, 0x00, 0x6f, 0x00,
248 0x6e, 0x00, 0x64, 0x00, 0x69, 0x00, 0x74, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x6e, 0x00, 0x73, 0x00,
249 0x20, 0x00, 0x6f, 0x00, 0x66, 0x00, 0x20, 0x00, 0x75, 0x00, 0x73, 0x00, 0x65, 0x00, 0x2c, 0x00,
250 0x20, 0x00, 0x63, 0x00, 0x65, 0x00, 0x72, 0x00, 0x74, 0x00, 0x69, 0x00, 0x66, 0x00, 0x69, 0x00,
251 0x63, 0x00, 0x61, 0x00, 0x74, 0x00, 0x65, 0x00, 0x20, 0x00, 0x70, 0x00, 0x6f, 0x00, 0x6c, 0x00,
252 0x69, 0x00, 0x63, 0x00, 0x79, 0x00, 0x20, 0x00, 0x61, 0x00, 0x6e, 0x00, 0x64, 0x00, 0x20, 0x00,
253 0x63, 0x00, 0x65, 0x00, 0x72, 0x00, 0x74, 0x00, 0x69, 0x00, 0x66, 0x00, 0x69, 0x00, 0x63, 0x00,
254 0x61, 0x00, 0x74, 0x00, 0x69, 0x00, 0x6f, 0x00, 0x6e, 0x00, 0x20, 0x00, 0x70, 0x00, 0x72, 0x00,
255 0x61, 0x00, 0x63, 0x00, 0x74, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00, 0x73, 0x00,
256 0x74, 0x00, 0x61, 0x00, 0x74, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x65, 0x00, 0x6e, 0x00, 0x74, 0x00,
257 0x73, 0x00, 0x2e, 0x30, 0x35, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x02, 0x01, 0x16,
258 0x29, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x61, 0x70, 0x70, 0x6c,
259 0x65, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
260 0x65, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d,
261 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
262 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0d, 0x05, 0x00, 0x03, 0x82, 0x02, 0x01, 0x00, 0x6f, 0x8a,
263 0xb7, 0x35, 0x73, 0x5a, 0xc5, 0x34, 0xf7, 0x8c, 0xf0, 0xd1, 0x4a, 0x17, 0x52, 0x1c, 0x70, 0xf0,
264 0xe0, 0x53, 0xb4, 0x16, 0xde, 0x81, 0xda, 0x2a, 0xa4, 0xf9, 0x5b, 0x0e, 0xa6, 0x17, 0x86, 0x52,
265 0xc6, 0x70, 0x73, 0xf3, 0x3f, 0x1c, 0x87, 0x94, 0xdd, 0xfe, 0x02, 0x0b, 0x85, 0xc9, 0xb9, 0xcf,
266 0x15, 0x91, 0x05, 0x2e, 0x7e, 0xeb, 0xe6, 0xce, 0x0e, 0x4e, 0xd1, 0xf7, 0xe2, 0xd7, 0xf4, 0x60,
267 0xd2, 0xfc, 0x1d, 0xbf, 0xad, 0x61, 0x28, 0xf8, 0x53, 0x31, 0xb3, 0x92, 0xef, 0xa4, 0x05, 0x34,
268 0x97, 0x57, 0x97, 0x56, 0x3b, 0x12, 0x20, 0x2d, 0x88, 0x76, 0x81, 0x0e, 0x77, 0x85, 0xf1, 0x37,
269 0xc6, 0x19, 0x8b, 0x23, 0xc2, 0x42, 0x55, 0x40, 0xc9, 0x91, 0x5c, 0x78, 0xc5, 0xe6, 0x77, 0xfe,
270 0x72, 0x5f, 0xb2, 0x2c, 0x00, 0xf2, 0xe6, 0x8c, 0xcc, 0x02, 0x49, 0xd9, 0x78, 0x20, 0xae, 0xbd,
271 0x75, 0x61, 0x6a, 0xaa, 0xc5, 0x71, 0x3e, 0x5d, 0x02, 0xdf, 0xd2, 0x91, 0x5c, 0x0a, 0x85, 0xc9,
272 0x59, 0x7d, 0x4e, 0x89, 0x21, 0x59, 0x59, 0xe3, 0xc7, 0xdc, 0xff, 0x1e, 0x62, 0x1e, 0xb9, 0x62,
273 0x2c, 0x34, 0x49, 0x15, 0xd9, 0xdf, 0x47, 0x99, 0x39, 0xcc, 0x1a, 0x01, 0xc0, 0xda, 0x48, 0x44,
274 0xd4, 0x8b, 0xd3, 0x17, 0x7e, 0x39, 0xf9, 0x00, 0xe1, 0x2a, 0x46, 0xaa, 0x14, 0x22, 0xa1, 0x38,
275 0x09, 0x0b, 0xb7, 0x0c, 0x88, 0xa5, 0x73, 0xfd, 0xc4, 0x6b, 0xee, 0x07, 0xb4, 0x1b, 0xb3, 0x4a,
276 0xab, 0xae, 0xf6, 0xe7, 0x04, 0x61, 0x4b, 0x34, 0x7a, 0xe4, 0xff, 0xf9, 0x30, 0x28, 0x61, 0x92,
277 0x52, 0x58, 0x10, 0x15, 0x3a, 0x9f, 0x0a, 0xaf, 0x15, 0x29, 0x6c, 0x67, 0xc4, 0xb4, 0xcf, 0xe6,
278 0xf9, 0x46, 0x68, 0xe2, 0x2a, 0x97, 0x29, 0x16, 0xed, 0x1a, 0x9b, 0x9a, 0x45, 0x70, 0x3c, 0xf2,
279 0xdf, 0x29, 0x20, 0x9e, 0x33, 0x4b, 0x5b, 0x8d, 0xf6, 0x19, 0xec, 0x4b, 0xae, 0x1a, 0x2f, 0x53,
280 0x03, 0x9a, 0xfd, 0x68, 0x39, 0x58, 0xf7, 0x2e, 0x07, 0x9c, 0xf1, 0x3c, 0x1b, 0x47, 0x43, 0x19,
281 0x81, 0x0e, 0x0a, 0xbb, 0x84, 0xa0, 0xda, 0x87, 0xbc, 0x8a, 0x2a, 0xb7, 0x9c, 0xe1, 0xf9, 0xeb,
282 0x37, 0xb0, 0x11, 0x20, 0x7e, 0x4c, 0x11, 0x2e, 0x54, 0x30, 0xce, 0xaf, 0x63, 0xed, 0x6a, 0x63,
283 0x1f, 0x1e, 0x61, 0x62, 0x04, 0xf3, 0x3a, 0x5f, 0x26, 0x6c, 0x5c, 0xd7, 0xba, 0x4f, 0xf2, 0x61,
284 0x26, 0x29, 0x99, 0xea, 0x61, 0x84, 0x0d, 0x68, 0xa2, 0x5d, 0x9b, 0x5c, 0xe7, 0x86, 0x1d, 0xef,
285 0xf4, 0x6f, 0x3b, 0x6c, 0x67, 0xf0, 0x70, 0xe9, 0xc5, 0xdc, 0x0a, 0x9d, 0x0f, 0xdc, 0xcc, 0x0e,
286 0x7b, 0xf8, 0xc4, 0xee, 0x64, 0xe4, 0xd9, 0x3f, 0x14, 0xae, 0x8f, 0xc8, 0x18, 0x4d, 0xa1, 0xe4,
287 0x40, 0x2c, 0xe9, 0x13, 0xc6, 0xc1, 0xe0, 0xb9, 0x13, 0xbe, 0xd9, 0x93, 0x66, 0x56, 0x35, 0x5c,
288 0xc1, 0x38, 0x7d, 0xa1, 0xbb, 0x87, 0xa5, 0x90, 0x33, 0x4f, 0xea, 0xb6, 0x37, 0x19, 0x61, 0x81,
289 0x40, 0xba, 0xd7, 0x07, 0x69, 0x05, 0x15, 0x96, 0xe9, 0xde, 0x4f, 0x8a, 0x2b, 0x99, 0x5a, 0x17,
290 0x3f, 0x9f, 0xcf, 0x86, 0xf5, 0x37, 0x0a, 0xa1, 0x0e, 0x25, 0x65, 0x2d, 0x52, 0xce, 0x87, 0x10,
291 0x0f, 0x25, 0xc2, 0x1e, 0x0f, 0x71, 0x93, 0xb5, 0xc0, 0xb3, 0xb4, 0xd1, 0x65, 0xa8, 0xb4, 0xf6,
292 0xa5, 0x71, 0xad, 0x45, 0xdb, 0xdf, 0xec, 0xe3, 0x2a, 0x7e, 0x99, 0x96, 0x5a, 0x5d, 0x69, 0xfa,
293 0xdb, 0x13, 0x39, 0xb8, 0xf5, 0x58, 0xbb, 0x87, 0x69, 0x8d, 0x2c, 0x6d, 0x39, 0xff, 0x26, 0xce,
294 0x2c, 0xa8, 0x5a, 0x7e, 0x4b, 0x3f, 0xed, 0xac, 0x5f, 0xf0, 0xef, 0x48, 0xd3, 0xf8
295};
296
297
298static const UInt8 kAppleTestPKISettingsRootCACert[] = {
299 0x30, 0x82, 0x05, 0xd7, 0x30, 0x82, 0x03, 0xbf, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x26,
300 0xfe, 0xf8, 0xda, 0x41, 0xf3, 0x61, 0x90, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
301 0x0d, 0x01, 0x01, 0x0d, 0x05, 0x00, 0x30, 0x79, 0x31, 0x2d, 0x30, 0x2b, 0x06, 0x03, 0x55, 0x04,
302 0x03, 0x0c, 0x24, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x50, 0x4b, 0x49, 0x20, 0x53, 0x65, 0x74,
303 0x74, 0x69, 0x6e, 0x67, 0x73, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x20, 0x2d, 0x20,
304 0x54, 0x45, 0x53, 0x54, 0x49, 0x4e, 0x47, 0x31, 0x26, 0x30, 0x24, 0x06, 0x03, 0x55, 0x04, 0x0b,
305 0x0c, 0x1d, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
306 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x31,
307 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20,
308 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55,
309 0x53, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x33, 0x30, 0x34, 0x32, 0x32, 0x32, 0x30, 0x33, 0x31, 0x34,
310 0x36, 0x5a, 0x17, 0x0d, 0x34, 0x33, 0x30, 0x34, 0x31, 0x35, 0x32, 0x30, 0x33, 0x31, 0x34, 0x36,
311 0x5a, 0x30, 0x79, 0x31, 0x2d, 0x30, 0x2b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x24, 0x41, 0x70,
312 0x70, 0x6c, 0x65, 0x20, 0x50, 0x4b, 0x49, 0x20, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73,
313 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x20, 0x2d, 0x20, 0x54, 0x45, 0x53, 0x54, 0x49,
314 0x4e, 0x47, 0x31, 0x26, 0x30, 0x24, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x0c, 0x1d, 0x41, 0x70, 0x70,
315 0x6c, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
316 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03,
317 0x55, 0x04, 0x0a, 0x0c, 0x0a, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31,
318 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x30, 0x82, 0x02, 0x22,
319 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03,
320 0x82, 0x02, 0x0f, 0x00, 0x30, 0x82, 0x02, 0x0a, 0x02, 0x82, 0x02, 0x01, 0x00, 0x84, 0xbe, 0xc2,
321 0x69, 0x9b, 0xec, 0xd5, 0xde, 0x72, 0xf0, 0x4f, 0x78, 0x81, 0x10, 0xa9, 0x56, 0x59, 0x77, 0x9c,
322 0x46, 0x95, 0xd7, 0xb7, 0x0b, 0x77, 0x73, 0x02, 0xce, 0xf8, 0xaa, 0x32, 0x89, 0xee, 0xbe, 0xaa,
323 0x40, 0x53, 0xf9, 0x2d, 0x96, 0x08, 0xcd, 0x2a, 0xa4, 0x61, 0xd4, 0xfd, 0x7d, 0x67, 0x2a, 0x35,
324 0xc1, 0xfc, 0x43, 0xa4, 0x9c, 0xd0, 0xbd, 0xcd, 0x82, 0x27, 0xed, 0xa1, 0x1c, 0x2d, 0x9a, 0x62,
325 0xd5, 0x99, 0xbd, 0x74, 0xaa, 0xf3, 0xce, 0x78, 0xc6, 0x47, 0x07, 0x43, 0x04, 0x5b, 0xbc, 0x27,
326 0x5e, 0x26, 0x3e, 0x77, 0x90, 0x69, 0x7a, 0xf6, 0xe0, 0x8e, 0xaa, 0xdf, 0x96, 0x12, 0x2c, 0xb2,
327 0x8b, 0xb9, 0x7e, 0x17, 0xfe, 0xde, 0x99, 0x67, 0x9b, 0x50, 0x13, 0x5c, 0x8d, 0x15, 0x26, 0x0a,
328 0x9f, 0x08, 0x2f, 0x3f, 0x7c, 0x01, 0x2c, 0x3e, 0xa1, 0xba, 0xb1, 0x25, 0x33, 0xe5, 0xd9, 0x39,
329 0x37, 0xde, 0x06, 0x3a, 0x63, 0x48, 0xa0, 0x9d, 0x3b, 0xa5, 0x72, 0x46, 0xfb, 0x6e, 0xa2, 0xd4,
330 0x74, 0xe6, 0xf1, 0xc1, 0x69, 0xc8, 0x31, 0xff, 0x58, 0x84, 0x3a, 0xc2, 0x6b, 0x9a, 0x0d, 0x19,
331 0x76, 0xe4, 0xd4, 0x4d, 0x85, 0xbc, 0x84, 0xf0, 0x07, 0x75, 0x66, 0x5f, 0xd7, 0xea, 0xab, 0x9e,
332 0x46, 0xf2, 0x8a, 0x29, 0xab, 0x73, 0x57, 0xaf, 0x95, 0x4f, 0xc7, 0xf3, 0x3b, 0x55, 0xb4, 0x26,
333 0x57, 0x68, 0xe9, 0x5a, 0x34, 0xbb, 0xa9, 0x39, 0xb3, 0x57, 0x5f, 0x25, 0x93, 0xd6, 0x34, 0xb7,
334 0xd1, 0xc4, 0xd7, 0x70, 0xed, 0x30, 0xdb, 0x21, 0xc1, 0xcc, 0xdf, 0xed, 0xec, 0x37, 0xc5, 0xdc,
335 0x0b, 0xc9, 0x85, 0x46, 0x26, 0xa7, 0x51, 0xc8, 0xdd, 0xe6, 0x47, 0xfc, 0x37, 0xd6, 0x73, 0x6f,
336 0x91, 0x3d, 0xef, 0xd8, 0xa4, 0xa5, 0x08, 0x32, 0x8c, 0xae, 0x8f, 0x57, 0xf7, 0x99, 0x48, 0xef,
337 0x81, 0x44, 0xac, 0x80, 0x42, 0x57, 0x9f, 0x64, 0x77, 0x40, 0x2a, 0xec, 0x03, 0x21, 0x79, 0x01,
338 0x0b, 0x87, 0xc3, 0x9d, 0x22, 0xc9, 0xc0, 0x69, 0xe0, 0x34, 0xff, 0x73, 0xdd, 0x1e, 0x1b, 0x0c,
339 0xe0, 0x68, 0xf0, 0x8c, 0x7a, 0x4b, 0xcd, 0x1d, 0x3f, 0x38, 0x2d, 0xe8, 0x9b, 0x91, 0xa6, 0xfe,
340 0xa8, 0x8b, 0x45, 0x1c, 0xdf, 0xaf, 0x49, 0x34, 0x48, 0x17, 0x02, 0x28, 0xdb, 0xe0, 0x6e, 0x74,
341 0x34, 0xea, 0xac, 0x6b, 0x00, 0x45, 0x89, 0xa9, 0xb5, 0x63, 0xbd, 0x2f, 0xe0, 0x58, 0x2e, 0xd3,
342 0xc2, 0x74, 0xa2, 0x37, 0x37, 0x62, 0xf6, 0x76, 0x1b, 0x3f, 0xfb, 0x98, 0x64, 0x13, 0xd6, 0x8c,
343 0xa0, 0x0c, 0xbc, 0x54, 0x00, 0xe0, 0xf8, 0x63, 0x17, 0x22, 0x44, 0x36, 0xe0, 0x28, 0xa0, 0x7d,
344 0x50, 0x9e, 0x50, 0x94, 0xea, 0xd7, 0x62, 0xab, 0x6d, 0x7a, 0x19, 0xa4, 0xa2, 0x74, 0x79, 0x5d,
345 0x15, 0x85, 0x21, 0xfe, 0x9a, 0x35, 0x76, 0x40, 0x78, 0x01, 0xe3, 0x46, 0x2f, 0x6f, 0x2d, 0x0a,
346 0x1d, 0xac, 0x2e, 0x23, 0xec, 0xb8, 0x48, 0x74, 0xbc, 0xee, 0x29, 0x72, 0xb6, 0xe7, 0x52, 0x8c,
347 0xd4, 0x1a, 0x00, 0x34, 0x75, 0x1c, 0x4b, 0x83, 0x50, 0xbb, 0x57, 0x21, 0x9b, 0xd8, 0xb4, 0x75,
348 0xf3, 0x98, 0x8a, 0x9b, 0x45, 0xa8, 0x61, 0x50, 0x10, 0xb4, 0xec, 0x91, 0x2e, 0xe7, 0xf2, 0xb8,
349 0xb9, 0x62, 0x70, 0xc2, 0x93, 0xe7, 0xd9, 0xf1, 0x02, 0x27, 0xd7, 0xec, 0xde, 0x5b, 0x42, 0xa1,
350 0x26, 0x37, 0x41, 0x32, 0x65, 0x11, 0x63, 0x38, 0xbb, 0x6f, 0x23, 0x7a, 0xa0, 0xb7, 0x24, 0xeb,
351 0xa8, 0x38, 0x8b, 0xa7, 0x73, 0xe2, 0xc8, 0x30, 0x56, 0x73, 0x6f, 0x17, 0x6e, 0x1a, 0xe5, 0x32,
352 0xff, 0xd6, 0xa2, 0x08, 0x7b, 0x6a, 0x23, 0x33, 0x9f, 0x10, 0x05, 0x71, 0xdd, 0x02, 0x03, 0x01,
353 0x00, 0x01, 0xa3, 0x63, 0x30, 0x61, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04,
354 0x14, 0xd2, 0xa5, 0x3b, 0xf2, 0x5d, 0xfd, 0x1f, 0x25, 0xda, 0xfb, 0x06, 0xfb, 0x59, 0x99, 0xc4,
355 0xac, 0xc4, 0x0b, 0xac, 0x64, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04,
356 0x05, 0x30, 0x03, 0x01, 0x01, 0xff, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30,
357 0x16, 0x80, 0x14, 0xd2, 0xa5, 0x3b, 0xf2, 0x5d, 0xfd, 0x1f, 0x25, 0xda, 0xfb, 0x06, 0xfb, 0x59,
358 0x99, 0xc4, 0xac, 0xc4, 0x0b, 0xac, 0x64, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01,
359 0xff, 0x04, 0x04, 0x03, 0x02, 0x01, 0x06, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
360 0x0d, 0x01, 0x01, 0x0d, 0x05, 0x00, 0x03, 0x82, 0x02, 0x01, 0x00, 0x71, 0x10, 0x3c, 0x89, 0xd5,
361 0xc0, 0x00, 0xdc, 0x36, 0x1d, 0x93, 0xaa, 0xab, 0x4a, 0xb6, 0xfa, 0xa8, 0x5b, 0x89, 0x1c, 0xb3,
362 0x4a, 0x04, 0x2e, 0xb3, 0x25, 0x0f, 0x12, 0x07, 0x29, 0x70, 0x3d, 0x34, 0xd1, 0xdd, 0x7e, 0x30,
363 0xfd, 0xf5, 0xfa, 0x94, 0xf4, 0xcb, 0xdb, 0xac, 0x1b, 0xed, 0xe5, 0x11, 0x4a, 0xc8, 0xab, 0x26,
364 0xe2, 0x41, 0xcb, 0xa5, 0x74, 0x4b, 0xe1, 0xd2, 0xf3, 0x83, 0x1c, 0x7a, 0xcb, 0x29, 0xd9, 0xd2,
365 0xa6, 0x9d, 0x08, 0x95, 0x73, 0x63, 0xe2, 0x9c, 0xeb, 0xa5, 0x82, 0x8b, 0x6c, 0xf4, 0x64, 0x98,
366 0x03, 0x53, 0x91, 0x35, 0x04, 0x89, 0x25, 0xa0, 0x1f, 0xdc, 0x42, 0xf7, 0x59, 0x44, 0x63, 0x75,
367 0xe6, 0x49, 0x10, 0x66, 0x0f, 0x08, 0x07, 0x39, 0xc4, 0x3e, 0x1f, 0xba, 0x30, 0x42, 0xf8, 0x7a,
368 0xc8, 0xbe, 0x6f, 0xdb, 0xec, 0x16, 0xb2, 0x76, 0x84, 0x2c, 0x6e, 0x20, 0xd1, 0xbd, 0xd5, 0x90,
369 0x22, 0x0a, 0x90, 0x5c, 0x70, 0x47, 0xc9, 0x2d, 0xe3, 0x77, 0x74, 0xfd, 0xbb, 0x85, 0x1a, 0xd8,
370 0x5c, 0x38, 0x94, 0x4c, 0x83, 0x28, 0x23, 0xa5, 0x4f, 0x55, 0x5f, 0xe3, 0x42, 0x80, 0x10, 0xd4,
371 0xa5, 0x8d, 0xcf, 0x8b, 0x53, 0x69, 0x6d, 0xc5, 0x37, 0xd2, 0xfa, 0xbb, 0xc0, 0x5a, 0xab, 0x6f,
372 0x71, 0x37, 0x92, 0xd4, 0x90, 0xef, 0x5d, 0xf1, 0xc3, 0xb8, 0x64, 0x08, 0xd3, 0xba, 0x36, 0x69,
373 0x2b, 0x00, 0xed, 0xad, 0x36, 0x21, 0x38, 0xdf, 0x4a, 0xc6, 0x44, 0xc4, 0x6b, 0xd8, 0xb0, 0x7f,
374 0x67, 0x05, 0xaa, 0x6f, 0x9e, 0x8a, 0xf1, 0x81, 0x95, 0x99, 0xb9, 0x56, 0xf4, 0x73, 0xa7, 0xb4,
375 0x19, 0xb9, 0x4b, 0xb8, 0x1d, 0x10, 0xa5, 0x88, 0x7c, 0x39, 0xa3, 0x85, 0xe7, 0xba, 0x65, 0x86,
376 0xca, 0xf7, 0x0e, 0xe0, 0x0d, 0x73, 0x3f, 0xea, 0x98, 0x88, 0x58, 0x73, 0xfa, 0x68, 0x5b, 0xaa,
377 0x8c, 0xfd, 0x3e, 0x22, 0x3e, 0x92, 0xc7, 0xe2, 0x77, 0x14, 0x81, 0xe6, 0xd9, 0xdc, 0xc1, 0xe9,
378 0xc0, 0x06, 0x57, 0xb4, 0xca, 0xb6, 0x14, 0x15, 0x16, 0x80, 0x7e, 0xc5, 0x11, 0xa4, 0x05, 0x66,
379 0xad, 0x1d, 0xa3, 0xb6, 0xab, 0x2a, 0xbe, 0xd0, 0x52, 0x4e, 0x9e, 0x84, 0x61, 0x6b, 0xf4, 0x34,
380 0x23, 0x94, 0x24, 0xc6, 0xc8, 0xb0, 0x94, 0x22, 0x4c, 0x3b, 0xac, 0x85, 0xe3, 0xd4, 0xf7, 0x38,
381 0xe5, 0x9a, 0x76, 0xb3, 0x1b, 0xf0, 0xbc, 0x78, 0xc6, 0x6f, 0x11, 0xb3, 0x1a, 0x5c, 0x4f, 0x07,
382 0x52, 0x06, 0x92, 0x7a, 0x25, 0x86, 0x91, 0x71, 0x8a, 0xf4, 0x03, 0xce, 0x19, 0x0d, 0xfc, 0xde,
383 0x8f, 0xc9, 0x4e, 0x84, 0xf1, 0x17, 0x18, 0x6f, 0x37, 0x56, 0xb9, 0x76, 0x7e, 0x8f, 0xca, 0xde,
384 0xd4, 0x1b, 0x2d, 0x8d, 0xcf, 0x12, 0x9f, 0xf9, 0xb9, 0x8b, 0x82, 0x8f, 0x4d, 0xb7, 0x63, 0x26,
385 0x8d, 0xda, 0x35, 0x94, 0x18, 0xf9, 0x55, 0xca, 0x39, 0x09, 0xe9, 0x62, 0xe1, 0x00, 0xd8, 0x67,
386 0xed, 0x5e, 0x84, 0xc2, 0xe5, 0x8e, 0x46, 0x57, 0xa4, 0xa7, 0x17, 0x70, 0xcf, 0x6d, 0xdf, 0x43,
387 0x64, 0x2b, 0x36, 0xe6, 0xf3, 0xc1, 0x4c, 0x7a, 0x7e, 0x9e, 0x47, 0xc4, 0x14, 0x82, 0xbe, 0x94,
388 0x73, 0x54, 0xd0, 0x2c, 0xc2, 0x31, 0xc6, 0xd5, 0xc3, 0xd7, 0xa9, 0xef, 0x11, 0x24, 0x2f, 0xd0,
389 0x5b, 0xb8, 0x6a, 0x8e, 0x3c, 0xb7, 0x4b, 0x00, 0x9b, 0xc1, 0xca, 0x00, 0x6f, 0xd4, 0x73, 0x93,
390 0x2e, 0x39, 0x37, 0x2a, 0x73, 0x44, 0x9b, 0x1b, 0x05, 0x1a, 0x7c, 0x2f, 0xc9, 0x2b, 0x37, 0xf3,
391 0xcd, 0x8c, 0x4e, 0xc2, 0x7a, 0x6e, 0xd9, 0xd4, 0xf1, 0x8d, 0x6d, 0x07, 0x4b, 0xb5, 0x09, 0xb9,
392 0x48, 0x55, 0xac, 0xc6, 0x7e, 0xbc, 0xc6, 0x76, 0xeb, 0x5f, 0x0f
393
394};
395
396static NSDictionary* VerifyMessage(CFDataRef message, SecPolicyRef policy, CFDataRef cert_data)
397{
398 NSDictionary* result = nil;
399
400 SecTrustRef trustRef = NULL;
401 CFDataRef payload = NULL;
402 CFArrayRef anchors = NULL;
403 OSStatus status = noErr;
404 SecCertificateRef aCertRef = NULL;
405 SecTrustResultType trust_result = kSecTrustResultRecoverableTrustFailure;
406
407 if (NULL == message || NULL == policy || NULL == cert_data)
408 {
409 goto out;
410 }
411
412 status = SecCMSVerifyCopyDataAndAttributes(message, NULL, policy, &trustRef, &payload, NULL);
413 if (noErr != status || NULL == trustRef || NULL == payload)
414 {
415 goto out;
416 }
417
418 aCertRef = SecCertificateCreateWithData(NULL, cert_data);
419 if (NULL == aCertRef)
420 {
421 goto out;
422 }
423
424 anchors = CFArrayCreate(kCFAllocatorDefault, (const void **)&aCertRef, 1, &kCFTypeArrayCallBacks);
425 if (NULL == anchors)
426 {
427 goto out;
428 }
429
430 status = SecTrustSetAnchorCertificates(trustRef, anchors);
431 if (noErr != status)
432 {
433 goto out;
434 }
435
436 status = SecTrustEvaluate(trustRef, &trust_result);
437
438 if (noErr != status)
439 {
440 goto out;
441 }
442
443 if (trust_result == kSecTrustResultUnspecified)
444 {
445 // Life is good and we got back the expected result.
446
447 NSData* property_list_data = CFBridgingRelease(payload);
448
449 NSPropertyListFormat format;
450 NSError* error = nil;
451 result = [NSPropertyListSerialization propertyListWithData:property_list_data options:0 format:&format error:&error];
452 if (nil != error)
453 {
454 result = nil;
455 }
456 }
457
458out:
459 CFReleaseSafe(aCertRef)
460 CFReleaseSafe(anchors);
461 return result;
462}
463
464/* ==========================================================================
465 Private Methods for the OTAServiceApp class
466 ========================================================================== */
467@interface OTAServiceApp (PrivateMethods)
468- (void)processAssets:(NSArray*)assets;
469- (BOOL)checkAssetVersions:(NSString *)assetDir;
470- (BOOL)validateAsset:(NSString *)assetDir;
471- (BOOL)validateDirectory:(NSString *)assetDir withFiles:(NSArray *)file_names;
472- (NSDictionary *)decodeManifest:(NSData *)manifest_file_data;
473- (BOOL)checkFileHash:(NSString *)file_path hash:(NSData *)hash;
474- (BOOL)installAssetFiles:(NSString *)assetDir;
475- (NSString*)getCurrentAssetDirectory;
476
477@end
478
479@implementation OTAServiceApp
480
481@synthesize file_list = _file_list;
482@synthesize manifest_file_name = _manifest_file_name;
483@synthesize asset_version_file_name = _asset_version_file_name;
484@synthesize current_asset_version = _current_asset_version;
485@synthesize next_asset_version = _next_asset_version;
486@synthesize fileManager = _fileManager;
487@synthesize current_asset_directory = _current_asset_directory;
488@synthesize assets_directory = _assets_directory;
489
490/* --------------------------------------------------------------------------
491 OTAServiceApp init:withArguments:
492
493 Initialize a new instance of the OTAServiceApp class
494 -------------------------------------------------------------------------- */
495- (id)init:(int)argc withArguments:(const char**)argv
496{
497 if ((self = [super init]))
498 {
499 _fileManager = [NSFileManager defaultManager];
500
501 _manifest_file_name = (NSString *)kManifestFileName;
502 _asset_version_file_name = (NSString *)kAssetVersionFileName;
503 _file_list = [NSArray arrayWithObjects:kBlockKeyFileName, kGrayListedKeysFileName,
504 kEVRootsFileName, kCertsIndexFileName, kCertsTableFileName,
5c19dc3a 505 kManifestFileName, kAssetVersionFileName, kAppleESCertificatesName,
e3d460c9 506 kAllowListFileName, kCTLogsFileName, nil];
d8f41ccd
A		 507
508 _current_asset_version = nil;
509 _next_asset_version = nil;
510 _assets_directory = nil;
511 _current_asset_directory = [self getCurrentAssetDirectory];
512
513 /* Default interval is one hour */
514 _asset_query_retry_interval = 60.0 * 60;
515 _verbose = false;
516
517 int ch;
518 while ((ch = getopt(argc, (char * const *)argv, "d:v")) != -1 )
519 {
520 switch (ch)
521 {
522 case 'd':
523 {
524 char *endptr = NULL;
525 errno = 0;
526 CFTimeInterval interval = strtod(optarg, &endptr);
527 if ((interval == 0 && endptr == optarg) || errno == ERANGE) {
528 syslog(LOG_ERR, "invalid argument '%s', ignoring", optarg);
529 } else {
530 syslog(LOG_NOTICE, "Setting query retry interval to %f seconds", interval);
531 _asset_query_retry_interval = (CFTimeInterval)interval;
532 }
533 }
534 break;
535 case 'v':
536 syslog(LOG_NOTICE, "Enabling verbose logging");
537 _verbose = true;
538 break;
539 default:
540 break;
541 }
542 }
543
544 struct stat info;
545#if NEW_LOCATION
546 if (stat([kBaseAssetDirectoryPath UTF8String], &info))
547 {
548 OTAPKI_LOG("OTAServiceApp.init:withArguments: stat of %s failed\n", [kBaseAssetDirectoryPath UTF8String]);
549
550 if (mkdir([kBaseAssetDirectoryPath UTF8String], kAssetDirectoryPermission))
551 {
552 OTAPKI_LOG("OTAServiceApp.init:withArguments: mkdir of %s failed\n", [kBaseAssetDirectoryPath UTF8String]);
553 }
554 else
555 {
556 if (stat([kBaseAssetDirectoryPath UTF8String], &info))
557 {
558 OTAPKI_LOG("OTAServiceApp.init:withArguments: second stat of %s failed\n", [kBaseAssetDirectoryPath UTF8String]);
559 }
560 }
561 }
562#else
563 stat([kBaseAssetDirectoryPath UTF8String], &info);
564
565 _uid = info.st_uid;
566 _gid = info.st_gid;
567#endif
568
569 }
570
571 return self;
572}
573
574#if !TARGET_IPHONE_SIMULATOR
575
576- (void)registerBackgroundTaskAgentJobWithDelay:(CFTimeInterval)delay
577{
578 /*
579 * ELEs are very important, so allow asset queries on any network type and
580 * construct the job so that it will fire as soon as possible, unless we are
581 * scheduling a retry after a failure.
582 */
583 xpc_object_t job = xpc_dictionary_create(NULL, NULL, 0);
584 if (delay != 0)
585 {
586 xpc_dictionary_set_double(job, kBackgroundTaskAgentJobWindowStartTime, CFAbsoluteTimeGetCurrent() + delay);
587 }
588 xpc_dictionary_set_double(job, kBackgroundTaskAgentJobWindowEndTime, CFAbsoluteTimeGetCurrent() + BACKGROUND_TASK_AGENT_JOB_WINDOW_MAX_TIME_FROM_NOW_SEC);
589 xpc_dictionary_set_bool(job, kBackgroundTaskAgentNetworkRequired, true);
590 xpc_dictionary_set_bool(job, kBackgroundTaskAgentCellularAllowed, true);
591 xpc_dictionary_set_bool(job, kBackgroundTaskAgentAllowedDuringRoaming, true);
592 xpc_dictionary_set_bool(job, kBackgroundTaskAgentPowerOptLevel, kBackgroundTaskAgentPowerDontCare);
593
594 if (_verbose)
595 {
596 char *desc = xpc_copy_description(job);
597 syslog(LOG_NOTICE, "Adding BTA job %s", desc);
598 free(desc);
599 }
600#pragma GCC diagnostic push
601#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
5c19dc3a 602 BackgroundTaskAgentAddJob(kOTAPKIAssetToolBTAJob, job);
d8f41ccd
A		 603#pragma GCC diagnostic pop
604}
605
606#endif
607
608/* --------------------------------------------------------------------------
609 OTAServiceApp checkInWithActivity
610
611 Check in with the XPC activity configured in OTAPKIAssetTool's launchd
612 plist. This activity will launch OTAPKIAssetTool every three days (with
613 some leeway decided by the system). At that time, we schedule a
614 BackgroundTaskAgent job to be notified immediately when the network is
615 available so we can perform an asset query.
616 -------------------------------------------------------------------------- */
617- (void)checkInWithActivity
618{
619#if !TARGET_IPHONE_SIMULATOR
620#pragma GCC diagnostic push
621#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
622 BackgroundTaskAgentInit("com.apple.OTAPKIAssetTool", dispatch_get_main_queue(), ^(const char *job_name, xpc_object_t job)
623 {
624 /*
625 * We're doing real work at this point, so open a transaction so
626 * that the system (hopefully) won't kill us while we're busy
627 */
628 xpc_transaction_begin();
629
6b200bc3 630 if (self->_verbose)
d8f41ccd
A		 631 {
632 syslog(LOG_NOTICE, "BackgroundTaskAgent job %s fired", job_name);
633 }
634
635 int64_t job_status = xpc_dictionary_get_int64(job, kBackgroundTaskAgentJobStatus);
636 if (job_status == kBackgroundTaskAgentJobRequestError)
637 {
638 syslog(LOG_ERR, "Failed to create BTA job -- malformed job?");
639 }
640 else if (job_status == kBackgroundTaskAgentJobSatisfied)
641 {
6b200bc3 642 if (self->_verbose)
d8f41ccd
A		 643 {
644 syslog(LOG_NOTICE, "BTA job %s is satisfied -- performing asset query", job_name);
645 }
646 bool shouldReschedule = false;
647 if ([self run:&shouldReschedule] || !shouldReschedule)
648 {
6b200bc3 649 if (self->_verbose)
d8f41ccd
A		 650 {
651 syslog(LOG_NOTICE, "Unscheduling BTA job");
652 }
5c19dc3a 653 BackgroundTaskAgentRemoveJob(kOTAPKIAssetToolBTAJob);
d8f41ccd
A		 654 }
655 else
656 {
6b200bc3
A		 657 syslog(LOG_NOTICE, "Asset query failed due to network error. Re-scheduling BTA job for another attempt in %f seconds.", self->_asset_query_retry_interval);
658 [self registerBackgroundTaskAgentJobWithDelay:self->_asset_query_retry_interval];
d8f41ccd
A		 659 }
660 }
661 else if (job_status == kBackgroundTaskAgentJobUnsatisfied)
662 {
663 /*
664 * We will receive this if the job expires before we get to do our
665 * work. We still want to check for new assets as soon as possible,
666 * so reschedule the job.
667 */
668 if (xpc_dictionary_get_bool(job, kBackgroundTaskAgentJobExpired))
669 {
670 [self registerBackgroundTaskAgentJobWithDelay:0];
671 }
672 }
673
674 xpc_transaction_end();
675 });
676#pragma GCC diagnostic pop
677#endif
678
679 xpc_activity_register(kOTAPKIAssetToolActivity, XPC_ACTIVITY_CHECK_IN, ^(xpc_activity_t activity)
680 {
681 xpc_activity_state_t state = xpc_activity_get_state(activity);
682
6b200bc3 683 if (self->_verbose)
d8f41ccd
A		 684 {
685 xpc_object_t criteria = xpc_activity_copy_criteria(activity);
686
687 if (criteria != NULL)
688 {
689 char *desc = xpc_copy_description(criteria);
690 syslog(LOG_NOTICE, "Criteria for XPC activity %s: %s", kOTAPKIAssetToolActivity, desc);
691 free(desc);
692 }
693 else
694 {
695 syslog(LOG_NOTICE, "No critera for XPC activity %s", kOTAPKIAssetToolActivity);
696 }
697 }
698
699 if (state == XPC_ACTIVITY_STATE_CHECK_IN)
700 {
701 /*
702 * The activity is already configured in the launchd plist, so there
703 * is nothing to do here
704 */
6b200bc3 705 if (self->_verbose)
d8f41ccd
A		 706 {
707 syslog(LOG_NOTICE, "Activity %s in check in state", kOTAPKIAssetToolActivity);
708 }
709 }
710 else if (state == XPC_ACTIVITY_STATE_RUN)
711 {
712#if !TARGET_IPHONE_SIMULATOR
713#pragma GCC diagnostic push
714#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
5c19dc3a 715 xpc_object_t job = BackgroundTaskAgentCopyJob(kOTAPKIAssetToolBTAJob);
d8f41ccd
A		 716#pragma GCC diagnostic pop
717 if (job == NULL)
718 {
719 syslog(LOG_NOTICE, "Activity %s in run state. Scheduling BTA job for earliest network availability.", kOTAPKIAssetToolActivity);
720 [self registerBackgroundTaskAgentJobWithDelay:0];
721 }
6b200bc3 722 else if (self->_verbose)
d8f41ccd
A		 723 {
724 syslog(LOG_NOTICE, "Already have a BTA job registered. Ignoring activity.");
725 }
726#else
727 /*
728 * BackgroundTaskAgent doesn't exist on the iOS simulator, so we
729 * just directly try to find and download new assets.
730 */
731 xpc_transaction_begin();
732 bool shouldReschedule = false;
733 if (![self run:&shouldReschedule]) {
734 syslog(LOG_NOTICE, "Asset query failed%s.", shouldReschedule ? " due to network issue" : "");
735 }
736 xpc_transaction_end();
737#endif
738 }
739 });
740}
741
742/* --------------------------------------------------------------------------
743 OTAServiceApp run
744
745 Run this program and leave. This program will currently run every 3 days,
746 with some leeway based on network availability. That will provide the
747 longest time from publisihing a change in the PKI trust setting asset and
748 having that asset be consumed by a device.
749
750 The program simnply ask the mobile asset daemon if there are any assets
751 to be processed with the PKITrustDataAssetType. If not this program
752 will just complete and will be re-run in 3 days. If there is an asset to
753 process then the asset will be process and then the program will complete.
754
755 Returns false if the operation failed. On return, shouldReschedule is set
756 to true if the operation failed due to a network error and the caller
757 should reschedule this operation at a more opportune time.
758 -------------------------------------------------------------------------- */
759- (bool)run:(bool *)shouldReschedule
760{
761 @autoreleasepool
762 {
763 if (shouldReschedule != NULL) {
764 *shouldReschedule = false;
765 }
766
767 syslog(LOG_NOTICE, "OTAPKIAssetTool running");
768 if (![[MCProfileConnection sharedConnection] isOTAPKIUpdatesAllowed])
769 {
770 syslog(LOG_NOTICE, "OTAPKIAssetTool: OTAPKI updates are not allowed.");
771 return false;
772 }
773
774 ASAssetQuery *assetQuery = [[ASAssetQuery alloc] initWithAssetType:(NSString *)kPKITrustDataAssetType];
775 if (assetQuery == nil)
776 {
777 syslog(LOG_NOTICE, "OTAPKIAssetTool: Could not create the asset query.");
778 return false;
779 }
780
781 // Get the asset synchronously
782 NSError *error = nil;
783 NSArray *foundAssets = [assetQuery runQueryAndReturnError:&error];
784 if (nil != foundAssets)
785 {
786 [self processAssets:foundAssets];
787 }
788 else
789 {
790 syslog(LOG_NOTICE, "OTAPKIAssetTool: No assets returned from query: %s", [[error description] UTF8String]);
791
792 NSArray *networkErrorCodes = @[ @(ASErrorNetwork), @(ASErrorNetworkNoConnection), @(ASErrorNetworkTimedOut), @(ASErrorNetworkUnexpectedResponse) ];
793 if ([[error domain] isEqualToString:ASErrorDomain] && [networkErrorCodes containsObject:@([error code])])
794 {
795 syslog(LOG_NOTICE, "OTAPKIAssetTool: Query failed due to network error.");
796 if (shouldReschedule != NULL) {
797 *shouldReschedule = true;
798 }
799 }
800 return false;
801 }
802
803 return true;
804 }
805}
806
807/* --------------------------------------------------------------------------
808 OTAServiceApp processAssets:
809
810 If when run is called asset(s) are found they will be processed here.
811 -------------------------------------------------------------------------- */
812- (void)processAssets:(NSArray*)assets
813{
814 if (nil == assets)
815 {
816 return;
817 }
818
819 NSError* error = nil;
820 ASAsset* asset = nil;
821 int asset_version = 0;
822
823 for (asset in assets)
824 {
825 NSDictionary* asset_attributes = asset.attributes;
826
827 NSNumber* contentVersion = [asset_attributes objectForKey:@"ContentVersion"];
828 OTAPKI_LOG("In processAssets: about to check the ContentVersion\n");
829 if (nil != contentVersion)
830 {
831 asset_version = [contentVersion intValue];
832 int current_asset_version_number = (nil != _current_asset_version) ? [_current_asset_version intValue] : 0;
833
834 if (asset_version <= current_asset_version_number)
835 {
836 syslog(LOG_NOTICE, "OTAPKIAssetTool: content version %d is too small. Current asset version id %d",
837 asset_version, current_asset_version_number);
838
839 OTAPKI_LOG("In processAssets: content version is too small: current asset version is %d\nContent version is %d\n",
840 current_asset_version_number, asset_version);
841 asset = nil;
842 continue;
843 }
844 }
845
846 if (nil == asset)
847 {
848 syslog(LOG_NOTICE, "OTAPKIAssetTool: no suitable asset found");
849 return;
850 }
851
852
853 // Check to see if the asset needs to be downloaded
854 if (asset.state == ASAssetStateNotPresent)
855 {
856 __block dispatch_semaphore_t sem = dispatch_semaphore_create(0);
857
858 [asset setProgressHandler:^(NSDictionary *state, NSError *anError)
859 {
860 if (error != nil)
861 {
862 // An error occured. Signal the semaphore to bail
863 dispatch_semaphore_signal(sem);
864 }
865 else if ([[state objectForKey:@"Operation"] isEqualToString:(NSString *) @"OperationCompleted"])
866 {
867 // The download is complete. Signal the semaphore
868 dispatch_semaphore_signal(sem);
869 }
870 }];
871
872 NSNumber* yesValue = [NSNumber numberWithBool:YES];
873 const id keys[] = {ASDownloadOptionAllow3G, ASDownloadOptionAllow4G, ASDownloadOptionPriority, ASDownloadOptionAllowBatteryPower};
874 const id values[] = {yesValue, yesValue, ASDownloadPriorityHigh, yesValue};
875
876 NSDictionary* options = [NSDictionary dictionaryWithObjects:values forKeys:keys count:(sizeof (keys) / sizeof(keys[0]))];
877
878 [asset beginDownloadWithOptions:options];
879 dispatch_semaphore_wait(sem, DISPATCH_TIME_FOREVER);
880 }
881
882 // Check to see if the asset is now available for processing
883 if ([asset state] == ASAssetStateInstalled)
884 {
885 // Get the asset data directory
886 NSString* assetDir = [[[asset localURL] URLByAppendingPathComponent:@"PKITrustData"] path];
887 if (nil != assetDir)
888 {
889 // validate the asset.
890 OTAPKI_LOG("In processAssets: about to validateAsset\n");
891 if ([self validateAsset:assetDir])
892 {
893 OTAPKI_LOG("In processAssets: asset validated installing\n");
894 // The asset is valid so install the files
895 [self installAssetFiles:assetDir];
896
897 // Signal securityd to idle-exit at it's next opportunity
898 OTAPKI_LOG("In processAssets: notifying securityd\n");
899 int didUpdate = 0;
900 (void)SecTrustOTAPKIGetUpdatedAsset(&didUpdate);
901 syslog(LOG_NOTICE, "OTAPKIAssetTool: installed new asset %d", asset_version);
5c19dc3a 902 _current_asset_version = contentVersion;
d8f41ccd
A		 903 }
904 else
905 {
906 syslog(LOG_NOTICE, "OTAPKIAssetTool: Asset %d did not validate", asset_version);
907 }
908
909 // regaurdless if the asset is valid. Now that it is
910 // installed, it needs to be purged to ensure that
911 // we can retrieve a new updated asset.
912 [asset purgeAndReturnError:&error];
913 }
914 else
915 {
916 syslog(LOG_NOTICE, "OTAPKIAssetTool: Asset directory %s not found", [assetDir UTF8String]);
917 }
918 }
919 }
920}
921
922/* --------------------------------------------------------------------------
923 OTAServiceApp checkAssetVersions:
924
925 If when run is called asset(s) are found they will be processed here.
926 -------------------------------------------------------------------------- */
927- (BOOL)checkAssetVersions:(NSString *)assetDir
928{
929 BOOL result = NO;
930
931 OTAPKI_LOG("Entering checkAssetVersions\n");
932
933 if (nil == assetDir || nil == self.current_asset_version)
934 {
935 OTAPKI_LOG("checkAssetVersions: parameter error\n");
936 return result;
937 }
938
939 // first get the new version number from the downloaded asset
940 NSString* next_asset_version_path = [assetDir stringByAppendingPathComponent:self.asset_version_file_name];
941 if (![self.fileManager fileExistsAtPath:next_asset_version_path])
942 {
943 // The asset is missing the AssertVersion.plist
944 // This is an invalid asset
945 OTAPKI_LOG("checkAssetVersions: could not file asseet version file %s\n", [self.asset_version_file_name UTF8String]);
946 return result;
947 }
948
949 NSError* error = nil;
950 NSInputStream* input_stream = [NSInputStream inputStreamWithFileAtPath:next_asset_version_path];
951 [input_stream open];
952 NSDictionary* asset_dict = [NSPropertyListSerialization propertyListWithStream:input_stream options:0 format:nil error:&error];
953 [input_stream close];
954
955 if (nil != error)
956 {
957 OTAPKI_LOG("checkAssetVersions: error reading asset version file: %s\n", [[error localizedDescription] UTF8String]);
958 return result;
959 }
960
961 _next_asset_version = [asset_dict objectForKey:kVersionNumberKey];
962 if (nil == _next_asset_version)
963 {
964 OTAPKI_LOG("asset_dict did not have a entry with a key of kVersionNumberKey\n");
965 return result;
966 }
967
968 // Check the current asset version against the new asset version. The new asset version MUST be larger than the
969 // current asset version
970 NSInteger current_asset_version_value = [self.current_asset_version integerValue];
971 NSInteger next_asset_version_value = [self.next_asset_version integerValue];
972
973 if (next_asset_version_value <= current_asset_version_value)
974 {
975 OTAPKI_LOG("heckAssetVersions: assert version too small. current_asset_version_value = %d next_asset_version_value = %d\n",
976 current_asset_version_value, next_asset_version_value);
977 return result;
978 }
979
980 return YES;
981}
982
983
984/* --------------------------------------------------------------------------
985 OTAServiceApp validateAsset:
986
987 Decode the manifest and verify the file hashes
988 -------------------------------------------------------------------------- */
989- (BOOL)validateAsset:(NSString *)assetDir
990{
991 BOOL result = NO;
992
993 OTAPKI_LOG("Enterning validateAsset\n");
994
995 if (![self validateDirectory:assetDir withFiles:self.file_list])
996 {
997 OTAPKI_LOG("validateAsset param\n");
998 return result;
999 }
1000
1001 NSString* manifest_file_path = [assetDir stringByAppendingPathComponent:self.manifest_file_name];
1002 NSError* error = nil;
1003 NSData* manifest_file_data = [NSData dataWithContentsOfFile:manifest_file_path options:0 error:&error];
1004 if (nil != error)
1005 {
1006 OTAPKI_LOG("validateAsset: could not read manifest file. error = %s\n", [[error localizedDescription] UTF8String]);
1007 return result;
1008 }
1009
1010 NSDictionary* manifest_data = [self decodeManifest:manifest_file_data];
1011 if (nil == manifest_data)
1012 {
1013 OTAPKI_LOG("validateAsset: decodeManifest failed!\n");
1014 return result;
1015 }
1016
1017 NSString* full_file_path = nil;
1018 NSData* hash = nil;
1019 for (NSString* file_name in self.file_list)
1020 {
1021 if ([file_name isEqualToString:self.manifest_file_name])
1022 {
1023 continue;
1024 }
1025
1026 hash = [manifest_data objectForKey:file_name];
1027 if (nil == hash)
1028 {
1029 OTAPKI_LOG("validateAsset: could not get hash for file %s\n", [file_name UTF8String]);
1030 return result;
1031 }
1032
1033 full_file_path = [assetDir stringByAppendingPathComponent:file_name];
1034 if (![self checkFileHash:full_file_path hash:hash])
1035 {
1036 OTAPKI_LOG("validateAsset: hash for file %s does not match\n", [file_name UTF8String]);
1037 return result;
1038 }
1039 }
1040
1041 result = [self checkAssetVersions:assetDir];
1042 return result;
1043}
1044
1045/* --------------------------------------------------------------------------
1046 OTAServiceApp validateDirectory:withFiles:
1047
1048 Ensure that a given directory has the files listed in the files_names
1049 parameter
1050 -------------------------------------------------------------------------- */
1051- (BOOL)validateDirectory:(NSString *)assetDir withFiles:(NSArray *)file_names
1052{
1053 BOOL result = NO;
1054 OTAPKI_LOG("Enterning validateDirectory\n");
1055
1056 if (nil == assetDir || nil == file_names)
1057 {
1058 OTAPKI_LOG("validateDirectory param error\n");
1059 return result;
1060 }
1061 NSError* error = nil;
1062 NSArray* dir_items = [self.fileManager contentsOfDirectoryAtPath:assetDir error:&error];
1063 if (nil != error)
1064 {
1065 OTAPKI_LOG("validateDirectory: Error calling contentsOfDirectoryAtPath: error = %s\n", [[error localizedDescription] UTF8String]);
1066 return result;
1067 }
1068
1069 for (NSString* file_name in file_names)
1070 {
1071 if (![dir_items containsObject:file_name])
1072 {
1073 OTAPKI_LOG("validateDirectory: missing file %s\n", [file_name UTF8String]);
1074 return result;
1075 }
1076 }
1077
1078 return YES;
1079}
1080
1081/* --------------------------------------------------------------------------
1082 OTAServiceApp decodeManifest:
1083
1084 Ensure that the asset manifest blob has it CMS signature verified
1085 -------------------------------------------------------------------------- */
1086- (NSDictionary *)decodeManifest:(NSData *)manifest_file_data
1087{
1088 NSDictionary* result = nil;
1089 CFDataRef cert_data = NULL;
1090 CFDataRef message = NULL;
1091 SecPolicyRef policy = NULL;
1092 CFBooleanRef mgResult = NULL;
1093
1094 OTAPKI_LOG("Enterning decodeManifest\n");
1095
1096 if (nil == manifest_file_data)
1097 {
1098 OTAPKI_LOG("decodeManifest: parameter error\n");
1099 goto out;
1100 }
1101
1102 message = CFBridgingRetain(manifest_file_data);
1103
1104 policy = SecPolicyCreateOTAPKISigner();
1105 if (NULL == policy)
1106 {
1107 OTAPKI_LOG("decodeManifest: could not get the SecPolicyCreateOTAPKISigner policyRef\n");
1108 goto out;
1109 }
1110
1111 cert_data = CFDataCreate(kCFAllocatorDefault, kApplePKISettingsRootCACert, sizeof(kApplePKISettingsRootCACert));
1112 if (NULL == cert_data)
1113 {
1114 OTAPKI_LOG("decodeManifest: could not kApplePKISettingsRootCACert data\n");
1115 goto out;
1116 }
1117
1118 result = VerifyMessage(message, policy, cert_data);
1119
1120 if (NULL != result)
1121 {
1122 OTAPKI_LOG("decodeManifest: SecPolicyCreateOTAPKISigner success!\n");
1123 goto out;
1124 }
1125
1126 OTAPKI_LOG("decodeManifest: SecPolicyCreateOTAPKISigner failed! Checking to see if this is an internal build\n");
1127
1128 // The first attempt did not work so check to see if this is running on an internal build.
1129 if (!MGIsQuestionValid(kMGQAppleInternalInstallCapability))
1130 {
1131 OTAPKI_LOG("decodeManifest: kMGQAppleInternalInstallCapability had an error\n");
1132 goto out;
1133 }
1134
1135 mgResult = MGCopyAnswer(kMGQAppleInternalInstallCapability, NULL);
1136
1137 if (NULL == mgResult || !CFEqual(mgResult, kCFBooleanTrue))
1138 {
1139 OTAPKI_LOG("decodeManifest: Not an internal build");
1140 goto out;
1141 }
1142
1143 OTAPKI_LOG("decodeManifest: This is an internal build\n");
1144
1145 CFReleaseNull(policy);
1146 CFReleaseNull(cert_data);
1147
1148 policy = SecPolicyCreateTestOTAPKISigner();
1149 if (NULL == policy)
1150 {
1151 OTAPKI_LOG("decodeManifest: could not SecPolicyCreateTestOTAPKISigner policyRef\n");
1152 goto out;
1153 }
1154
1155 cert_data = CFDataCreate(kCFAllocatorDefault, kAppleTestPKISettingsRootCACert, sizeof(kAppleTestPKISettingsRootCACert));
1156 if (NULL == cert_data)
1157 {
1158 OTAPKI_LOG("decodeManifest: could not kAppleTestPKISettingsRootCACert data\n");
1159 goto out;
1160 }
1161
1162 result = VerifyMessage(message, policy, cert_data);
1163
1164out:
1165
1166 CFReleaseSafe(mgResult);
1167 CFReleaseSafe(message);
1168 CFReleaseSafe(policy);
1169 CFReleaseSafe(cert_data);
1170 return result;
1171}
1172
1173/* --------------------------------------------------------------------------
1174 OTAServiceApp checkFileHash:hash:
1175
1176 Ensure that the given asset file's hash is the same as in the manifest
1177 -------------------------------------------------------------------------- */
1178- (BOOL)checkFileHash:(NSString *)file_path hash:(NSData *)hash
1179{
1180 BOOL result = NO;
1181 if (nil == file_path || nil == hash)
1182 {
1183 return result;
1184 }
6b200bc3 1185
d8f41ccd
A		 1186 NSError* error = nil;
1187 NSData* file_data = [NSData dataWithContentsOfFile:file_path options:0 error:&error];
1188 if (nil != error)
1189 {
1190 return result;
1191 }
6b200bc3
A		 1192
1193 NSMutableData *digest = [NSMutableData dataWithLength:CC_SHA256_DIGEST_LENGTH];
1194 uint8_t *dp = (digest) ? [digest mutableBytes] : NULL;
1195 if (NULL == dp)
1196 {
1197 return result;
1198 }
1199
1200 memset(dp, 0, CC_SHA256_DIGEST_LENGTH);
1201 CCDigest(kCCDigestSHA256,
1202 (const uint8_t *)[file_data bytes],
1203 (size_t)[file_data length], dp);
d8f41ccd 1204
6b200bc3 1205 result = [hash isEqualToData:digest];
d8f41ccd
A		 1206
1207 return result;
1208}
1209
1210/* --------------------------------------------------------------------------
1211 OTAServiceApp installAssetFiles:
1212
1213 Copy over the files into the /var/Keychains/Assets directory.
1214 -------------------------------------------------------------------------- */
1215- (BOOL)installAssetFiles:(NSString *)assetDir
1216{
1217 BOOL result = NO;
1218
1219 OTAPKI_LOG("Entering installAssetFiles\n");
1220
1221 if (nil == assetDir)
1222 {
1223 OTAPKI_LOG("installAssetFiles: parameter error\n");
1224 return result;
1225 }
1226
1227 if (nil == self.assets_directory)
1228 {
1229 OTAPKI_LOG("installAssetFiles: no assets directory\n");
1230 return result;
1231 }
1232
1233 // Create a temp directory to hold the new asset files.
1234 NSString* tempDir = [self.assets_directory stringByAppendingPathComponent:@"TempAssetDir"];
1235 NSError* error = nil;
1236
1237#if NEW_LOCATION
1238 id values[] = {[NSNumber numberWithUnsignedLong: kAssetDirectoryPermission]};
1239 id keys[] = {NSFilePosixPermissions};
1240
1241 NSDictionary* attributes = [NSDictionary dictionaryWithObjects:values forKeys:keys count:1];
1242#else
1243 struct passwd *user_info = getpwnam([kAssetDirectoryUser UTF8String]);
1244 struct group *group_info = getgrnam([kAssetDirectoryGroup UTF8String]);
1245 NSNumber* uid_num = [NSNumber numberWithUnsignedInt: user_info->pw_uid];
1246 NSNumber* gid_num = [NSNumber numberWithUnsignedInt: group_info->gr_gid];
1247
1248 id values[] = {uid_num, gid_num, [NSNumber numberWithUnsignedLong: kAssetDirectoryPermission]};
1249 id keys[] = {NSFileOwnerAccountID, NSFileGroupOwnerAccountID, NSFilePosixPermissions};
1250
1251 NSDictionary* attributes = [NSDictionary dictionaryWithObjects:values forKeys:keys count:3];
1252#endif
1253
1254
1255 if (![self.fileManager createDirectoryAtPath:tempDir withIntermediateDirectories:YES
1256 attributes:attributes error:&error])
1257 {
1258 OTAPKI_LOG("installAssetFiles: could not create directory %s\n", [tempDir UTF8String]);
1259 return result;
1260 }
1261
1262#ifndef NEW_LOCATION
1263 // Copy all of the asset files to the newly created directory
1264 for (NSString* file_name in self.file_list)
1265 {
1266 NSString* download_assert_path = [assetDir stringByAppendingPathComponent:file_name];
1267 NSString* asset_path = [tempDir stringByAppendingPathComponent:file_name];
1268 if ([self.fileManager copyItemAtPath:download_assert_path toPath:asset_path error:&error])
1269 {
1270 chown([asset_path UTF8String], self.uid, self.gid);
1271 }
1272 else
1273 {
1274 [self.fileManager removeItemAtPath:tempDir error:nil];
1275 return result;
1276 }
1277 }
1278#endif // !NEW_LOCATION
1279
1280
1281 // Now that all of the files have been copied to the temp directory make a single call
1282 // to rename (move) the temp directory to be the correct version directory. This rename
1283 // allow for reducing a race conditions between this asset code and securityd.
1284 NSInteger new_version_value = [self.next_asset_version integerValue];
1285 NSString* new_version_dir_name = [NSString stringWithFormat:@"%@%ld", kVersionDirectoryNamePrefix, (long)new_version_value];
1286 NSString* new_version_dir_path = [self.assets_directory stringByAppendingPathComponent:new_version_dir_name];
1287 if (![self.fileManager moveItemAtPath:tempDir toPath:new_version_dir_path error:&error])
1288 {
1289 OTAPKI_LOG("installAssetFiles: could not move path %s\n", [tempDir UTF8String]);
1290 [self.fileManager removeItemAtPath:tempDir error:nil];
1291 return result;
1292 }
1293
1294 result = YES;
1295 return result;
1296}
1297
1298/* --------------------------------------------------------------------------
1299 OTAServiceApp getCurrentAssetDirectory:
1300
1301 Looks through the /var/Keychains/Assets directory to find latest asset
1302 version directory. If no assets have been downloaded then nil is returned
1303 and the current asset version is set to 0
1304 -------------------------------------------------------------------------- */
1305- (NSString*)getCurrentAssetDirectory
1306{
1307 NSString* result = nil;
1308 BOOL isDir = NO;
1309
1310 OTAPKI_LOG("In getCurrentAssetDirectory\n");
1311 OTAPKI_LOG("getCurrentAssetDirectory: checking to see if %s exists\n", [kBaseAssetDirectoryPath UTF8String]);
1312
1313 // Check to see if the base directory is there
1314 if (![self.fileManager fileExistsAtPath:(NSString *)kBaseAssetDirectoryPath isDirectory:&isDir] || !isDir)
1315 {
1316 OTAPKI_LOG("getCurrentAssetDirectory: %s does not exists\n", [kBaseAssetDirectoryPath UTF8String]);
1317 // This might be fatal
1318 return result;
1319 }
1320
1321 NSError* error = nil;
1322 NSInteger version_number = 0;
1323 NSInteger current_version_number = 0;
1324 int aVerNum = 0;
1325 OSStatus err = noErr;
1326
1327 _assets_directory = [kBaseAssetDirectoryPath stringByAppendingPathComponent:(NSString *)kAssetDirectoryName];
1328
1329 OTAPKI_LOG("getCurrentAssetDirectory: %s does exists\n", [self.assets_directory UTF8String]);
1330
1331 if ([self.fileManager fileExistsAtPath:self.assets_directory isDirectory:&isDir] && isDir)
1332 {
1333 OTAPKI_LOG("getCurrentAssetDirectory: %s does exists\n", [self.assets_directory UTF8String]);
1334 NSDirectoryEnumerator* dirEnum = [self.fileManager enumeratorAtPath:self.assets_directory];
1335 [dirEnum skipDescendents];
1336
1337 for (NSString* file in dirEnum)
1338 {
1339 if ([file hasPrefix:(NSString *)kVersionDirectoryNamePrefix])
1340 {
1341 NSString* version_str = [file substringFromIndex:[kVersionDirectoryNamePrefix length]];
1342 NSInteger aVersion_number = [version_str integerValue];
1343 if (aVersion_number > version_number)
1344 {
1345 version_number = aVersion_number;
1346 }
1347 }
1348 }
1349 }
1350 else
1351 {
1352#if NEW_LOCATION
1353 id values[] = {[NSNumber numberWithUnsignedLong: kAssetDirectoryPermission]};
1354 id keys[] = {NSFilePosixPermissions};
1355
1356 NSDictionary* attributes = [NSDictionary dictionaryWithObjects:values forKeys:keys count:1];
1357#else
1358
1359 struct passwd *user_info = getpwnam([kAssetDirectoryUser UTF8String]);
1360 struct group *group_info = getgrnam([kAssetDirectoryGroup UTF8String]);
1361 NSNumber* uid_num = [NSNumber numberWithUnsignedInt: user_info->pw_uid];
1362 NSNumber* gid_num = [NSNumber numberWithUnsignedInt: group_info->gr_gid];
1363
1364 id values[] = {uid_num, gid_num, [NSNumber numberWithUnsignedLong: kAssetDirectoryPermission]};
1365 id keys[] = {NSFileOwnerAccountID, NSFileGroupOwnerAccountID, NSFilePosixPermissions};
1366 NSDictionary* attributes = [NSDictionary dictionaryWithObjects:values forKeys:keys count:3];
1367#endif
1368 OTAPKI_LOG("getCurrentAssetDirectory: %s does NOT exists\n", [self.assets_directory UTF8String]);
1369 OTAPKI_LOG("getCurrentAssetDirectory: creating %s\n", [self.assets_directory UTF8String]);
1370
1371 if (![self.fileManager createDirectoryAtPath:self.assets_directory withIntermediateDirectories:YES
1372 attributes:attributes error:&error])
1373 {
1374 OTAPKI_LOG("getCurrentAssetDirectory: failed to create %s\n", [self.assets_directory UTF8String]);
1375 return result;
1376 }
1377
1378 }
1379
1380 err = SecTrustGetOTAPKIAssetVersionNumber(&aVerNum);
1381 if (errSecSuccess == err && aVerNum > 0)
1382 {
1383 current_version_number = aVerNum;
1384 }
1385
1386 if (version_number < current_version_number)
1387 {
1388 OTAPKI_LOG("The largest OTA version number is smaller than the current version number. This means the system has a newer asset\n");
1389 version_number = current_version_number;
1390 }
1391 else
1392 {
1393 OTAPKI_LOG("The largest OTA version number is equal to the current version number. The OTA asset is newer than the system asset\n");
1394 NSString* version_dir_name = [NSString stringWithFormat:@"%@%ld", kVersionDirectoryNamePrefix, (long)version_number];
1395 result = [self.assets_directory stringByAppendingPathComponent:version_dir_name];
1396 }
1397
1398 OTAPKI_LOG("getCurrentAssetDirectory: setting version number to %d\n", version_number);
1399 _current_asset_version = [NSNumber numberWithInteger:version_number];
1400 return result;
1401}
1402
1403@end
mirror of Security