ckcdiagnose/ckcdiagnose.sh

   1 #!/bin/sh
   2
   3 # Poor man's option parsing.
   4 # Replace with shift/case once more options come along.
   5 SHORT=0
   6 if [ "$1" == "-s" ]; then
   7     SHORT=1
   8 fi
   9
  10 PRODUCT_NAME=$(sw_vers -productName)
  11 PRODUCT_VERSION=$(sw_vers -buildVersion)
  12 HOSTNAME=$(hostname -s)
  13 NOW=$(date "+%Y%m%d%H%M%S")
  14
  15 case $PRODUCT_NAME in
  16     *"OS X")
  17         PROD=OSX
  18         secd=secd
  19         secexec=security2
  20         OUTPUTPARENT=/var/tmp
  21         CRASHDIR=/Library/Logs/DiagnosticReports
  22         CSDIR=$HOME/Library/Logs/CloudServices
  23         SECLOGPATH=/var/log/module/com.apple.securityd
  24         syd=/System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd
  25         kvsutil=/AppleInternal/Applications/kvsutil
  26         ;;
  27     *)
  28         PROD=IOS
  29         secd=securityd
  30         secexec=security
  31         OUTPUTPARENT=/Library/Logs/CrashReporter
  32         CRASHDIR=/var/mobile/Library/Logs/CrashReporter
  33         CSDIR=$CRASHDIR/DiagnosticLogs/CloudServices
  34         SECLOGPATH=/var/mobile/Library/Logs/CrashReporter/DiagnosticLogs
  35         syd=/System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd
  36         kvsutil=/usr/local/bin/kvsutil
  37         ;;
  38 esac
  39
  40 if (( ! $SHORT )); then
  41     OUTPUTBASE=ckcdiagnose_${HOSTNAME}_${PRODUCT_VERSION}_${NOW}
  42 else
  43     OUTPUTBASE=ckcdiagnose_snapshot_${HOSTNAME}_${PRODUCT_VERSION}_${NOW}
  44 fi
  45 OUTPUT=$OUTPUTPARENT/$OUTPUTBASE
  46
  47 mkdir $OUTPUT
  48
  49 if [ "$PROD" = "IOS" ]; then
  50     while !(/usr/local/bin/profilectl cpstate | grep -Eq 'Unlocked|Disabled'); do
  51         echo Please ensure that your device is unlocked and press Enter. >&2
  52         read enter
  53     done
  54 fi
  55
  56 (
  57 echo Outputting to $OUTPUT
  58 set -x
  59
  60 sw_vers > $OUTPUT/sw_vers.log
  61
  62 $secexec sync -D > $OUTPUT/syncD.log
  63 $secexec sync -i > $OUTPUT/synci.log
  64 $secexec sync -L > $OUTPUT/syncL.log
  65
  66 (( $SHORT )) || ([ -x $kvsutil ] && $kvsutil show com.apple.security.cloudkeychainproxy3 > $OUTPUT/kvsutil_show.txt 2>&1)
  67
  68 if [ "$PROD" == "OSX" ]; then
  69     $secexec item -g class=genp,nleg=1,svce="iCloud Keychain Account Meta-data" > $OUTPUT/ickcmetadata.log
  70     $secexec item -g class=genp,nleg=1,acct=engine-state > $OUTPUT/engine-state.log
  71 elif [ "$PROD" == "IOS" ]; then
  72     $secexec item -g class=genp,svce="iCloud Keychain Account Meta-data" > $OUTPUT/ickcmetadata.log
  73     $secexec item -g class=genp,acct=engine-state > $OUTPUT/engine-state.log
  74 fi
  75
  76 # In preparation, before getting any of the logs, query all classes,
  77 # just in order to excercise the decryption and corruption
  78 # verification for all items. This will log errors and simulated crashes
  79 # if any of the items should turn out corrupted.
  80 # The items are NOT saved in the diagnostic log, because they potentially
  81 # contain very private items.
  82 for class in genp inet cert keys; do
  83     for sync in 0 1; do
  84         for tomb in 0 1; do
  85
  86             echo class=${class},sync=${sync},tomb=${tomb},u_AuthUI=u_AuthUIS: >> $OUTPUT/keychain-state.log
  87             ${secexec} item -q class=${class},sync=${sync},tomb=${tomb},u_AuthUI=u_AuthUIS | grep '^acct'|wc -l 2>&1 >> $OUTPUT/keychain-state.log
  88         done
  89     done
  90 done
  91
  92 if (( ! $SHORT )); then
  93     syslog -k Sender Seq syncdefaults > $OUTPUT/syslog_syncdefaults.log
  94     syslog -k Sender Seq $secd > $OUTPUT/syslog_secd.log
  95     syslog -k Sender Seq CloudKeychain > $OUTPUT/syslog_cloudkeychain.log
  96 fi
  97
  98 (( $SHORT )) || (sbdtool status > $OUTPUT/sbdtool_status.log 2>&1)
  99
 100 if [ "$PROD" == "OSX" ]; then
 101 (( $SHORT )) || plutil -p $HOME/Library/SyncedPreferences/com.apple.sbd.plist > $OUTPUT/sbd_kvs.txt
 102 elif [ "$PROD" == "IOS" ]; then
 103 (( $SHORT )) || plutil -p /var/mobile/Library/SyncedPreferences/com.apple.sbd.plist > $OUTPUT/sbd_kvs.txt
 104 fi
 105
 106 $syd status > $OUTPUT/syd_status.txt 2>&1
 107 $syd lastrequest > $OUTPUT/syd_lastrequest.txt 2>&1
 108 $syd serverlimits > $OUTPUT/syd_serverlimits.txt 2>&1
 109
 110 # Compare kvsutil and sync -D state, shows if store diverged from on-device state.
 111 if (( ! $SHORT )); then
 112     if [ -f $OUTPUT/kvsutil_show.txt ]; then
 113         cat $OUTPUT/kvsutil_show.txt | grep -E '^    "?[o-]?ak.* = ' | sed -E 's/^    "?([^"]*)"? = \<.* (.*) (.*)\>.*$/\1 \2\3/g;s/^(.*) [0-9a-f]*([0-9a-f]{8})/\1 \2/g' | sort > $OUTPUT/kvs_keys.txt
 114         cat $OUTPUT/syncD.log | grep -E 'contents = "?[o-]?ak' | sed -E 's/^.*contents = "?([^"]*)"?\} = .*bytes = .* ... [0-9a-f]+([0-9a-f]{8})\}/\1 \2/g' | sort > $OUTPUT/syncD_keys.txt
 115         diff -u $OUTPUT/kvs_keys.txt $OUTPUT/syncD_keys.txt > $OUTPUT/kvs_syncD_diff.txt
 116     fi
 117 fi
 118
 119 if [ "$PROD" = "IOS" ]; then
 120     cp /private/var/preferences/com.apple.security.cloudkeychainproxy3.keysToRegister.plist $OUTPUT/
 121     cp /var/mobile/Library/SyncedPreferences/com.apple.security.cloudkeychainproxy3.plist $OUTPUT/
 122 else
 123     cp ~/Library/Preferences/com.apple.security.cloudkeychainproxy3.keysToRegister.plist $OUTPUT/
 124     cp ~/Library/SyncedPreferences/com.apple.security.cloudkeychainproxy3.plist $OUTPUT/
 125 fi
 126
 127 if (( ! $SHORT )); then
 128     cp $SECLOGPATH/security.log* $OUTPUT/
 129
 130     cp $CRASHDIR/*${secd}* $OUTPUT/
 131     cp $CRASHDIR/*syncdefaults* $OUTPUT/
 132     cp $CRASHDIR/*CloudKeychain* $OUTPUT/
 133
 134     (cd $CSDIR && for x in *_*.asl; do syslog -f "$x" > "$OUTPUT/${x%%.asl}.log"; done)
 135
 136     (cd  $SECLOGPATH; gzcat -c -f security.log*) > $OUTPUT/security-complete.log
 137
 138     # potential problems
 139     (cd  $SECLOGPATH; gzcat -c security.log.*.gz; cat security.log.*Z) | grep -E -- 'Invalid date.|-26275|[cC]orrupt|[cC]rash|Public Key not available' > $OUTPUT/problems.log
 140     (cd  $SECLOGPATH; gzcat -c security.log.*.gz; cat security.log.*Z) | cut -d ' ' -f 6- | sort |uniq -c | sort -n > $OUTPUT/security-sorted.log
 141 fi
 142
 143 ) > $OUTPUT/ckcdiagnose.log 2>&1
 144
 145 tar czf $OUTPUT.tgz -C $OUTPUTPARENT $OUTPUTBASE
 146
 147 rm -r $OUTPUT
 148
 149 if (( ! $SHORT )); then
 150     echo
 151     echo "The file containing the diagnostic information is "
 152     echo "        $OUTPUT.tgz"
 153     echo 'Please attach it to a Radar in "Security / iCloud Keychain"'
 154     echo
 155
 156     [ "$PROD" = "OSX" ] && open $OUTPUTPARENT
 157 else
 158     echo $OUTPUT.tgz
 159 fi
 160
 161