OSX/sec/SecurityTool/sos.m

   1 /*
   2  * Copyright (c) 2015 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * This is to fool os services to not provide the Keychain manager
  26  * interface that doesn't work since we don't have unified headers
  27  * between iOS and OS X. rdar://23405418/
  28  */
  29 #define __KEYCHAINCORE__ 1
  30
  31 #import <Foundation/Foundation.h>
  32 #import <Foundation/NSXPCConnection_Private.h>
  33 #import <Security/Security.h>
  34 #import <Security/SecItemPriv.h>
  35 #import <Security/SecureObjectSync/SOSTypes.h>
  36 #import <Security/SecureObjectSync/SOSControlHelper.h>
  37 #import <ipc/securityd_client.h>
  38 #import <err.h>
  39 #import <getopt.h>
  40
  41 #include "builtin_commands.h"
  42
  43
  44 @interface SOSStatus : NSObject
  45 @property NSXPCConnection *connection;
  46
  47 - (void)printPerformanceCounters:(bool)asPList;
  48 @end
  49
  50 @implementation SOSStatus
  51
  52 - (instancetype) init
  53 {
  54     if ((self = [super init]) == NULL)
  55         return NULL;
  56
  57     NSXPCInterface *interface = [NSXPCInterface interfaceWithProtocol:@protocol(SOSControlProtocol)];
  58     _SOSControlSetupInterface(interface);
  59
  60     self.connection = [[NSXPCConnection alloc] initWithMachServiceName:@(kSecuritydSOSServiceName) options:0];
  61     if (self.connection == NULL)
  62         return NULL;
  63
  64     self.connection.remoteObjectInterface = interface;
  65
  66     [self.connection resume];
  67
  68
  69     return self;
  70 }
  71
  72 - (void)printPerformanceCounters:(bool)asPList
  73 {
  74     dispatch_semaphore_t sema1 = dispatch_semaphore_create(0);
  75     dispatch_semaphore_t sema2 = dispatch_semaphore_create(0);
  76     dispatch_semaphore_t sema3 = dispatch_semaphore_create(0);
  77
  78     NSMutableDictionary<NSString *, NSNumber *> *merged = [NSMutableDictionary dictionary];
  79     __block NSMutableDictionary<NSString *, NSString *> *diagnostics = [NSMutableDictionary dictionary];
  80
  81     [[self.connection remoteObjectProxy] kvsPerformanceCounters:^(NSDictionary <NSString *, NSNumber *> *counters){
  82         if (counters == NULL){
  83             printf("no KVS counters!");
  84             return;
  85         }
  86
  87         [merged addEntriesFromDictionary:counters];
  88         dispatch_semaphore_signal(sema1);
  89     }];
  90
  91     [[self.connection remoteObjectProxy] rateLimitingPerformanceCounters:^(NSDictionary <NSString *, NSString *> *returnedDiagnostics){
  92         if (returnedDiagnostics == NULL){
  93             printf("no rate limiting counters!");
  94             return;
  95         }
  96         diagnostics = [[NSMutableDictionary alloc]initWithDictionary:returnedDiagnostics];
  97         dispatch_semaphore_signal(sema3);
  98     }];
  99     dispatch_semaphore_wait(sema1, DISPATCH_TIME_FOREVER);
 100     dispatch_semaphore_wait(sema2, DISPATCH_TIME_FOREVER);
 101     dispatch_semaphore_wait(sema3, DISPATCH_TIME_FOREVER);
 102
 103     if (asPList) {
 104         NSData *data = [NSPropertyListSerialization dataWithPropertyList:merged format:NSPropertyListXMLFormat_v1_0 options:0 error:NULL];
 105
 106         printf("%.*s\n", (int)[data length], [data bytes]);
 107     } else {
 108         [merged enumerateKeysAndObjectsUsingBlock:^(NSString * key, NSNumber * obj, BOOL *stop) {
 109             printf("%s - %lld\n", [key UTF8String], [obj longLongValue]);
 110         }];
 111     }
 112     if(diagnostics){
 113         [diagnostics enumerateKeysAndObjectsUsingBlock:^(NSString * key, NSString * obj, BOOL * stop) {
 114             printf("%s - %s\n", [key UTF8String], [obj UTF8String]);
 115         }];
 116     }
 117 }
 118
 119 @end
 120
 121 static void
 122 usage(const char *command, struct option *options)
 123 {
 124     printf("%s %s [...options]\n", getprogname(), command);
 125     for (unsigned n = 0; options[n].name; n++) {
 126         printf("\t [-%c|--%s\n", options[n].val, options[n].name);
 127     }
 128
 129 }
 130
 131 int
 132 command_sos_stats(__unused int argc, __unused char * const * argv)
 133 {
 134     @autoreleasepool {
 135         int option_index = 0, ch;
 136
 137         SOSStatus *control = [[SOSStatus alloc] init];
 138
 139         bool asPlist = false;
 140         struct option long_options[] =
 141         {
 142             /* These options set a flag. */
 143             {"plist",    no_argument, NULL, 'p'},
 144             {0, 0, 0, 0}
 145         };
 146
 147         while ((ch = getopt_long(argc, argv, "p", long_options, &option_index)) != -1) {
 148             switch  (ch) {
 149                 case 'p': {
 150                     asPlist = true;
 151                     break;
 152                 }
 153                 case '?':
 154                 default:
 155                 {
 156                     usage("sos-stats", long_options);
 157                     return SHOW_USAGE_MESSAGE;
 158                 }
 159             }
 160         }
 161
 162         [control printPerformanceCounters:asPlist];
 163     }
 164
 165     return 0;
 166 }
 167
 168 int
 169 command_sos_control(__unused int argc, __unused char * const * argv)
 170 {
 171     @autoreleasepool {
 172         int option_index = 0, ch;
 173
 174         bool assertStashAccountKey = false;
 175         bool triggerSync = false;
 176         NSString *syncingPeer = NULL;
 177
 178         static struct option long_options[] =
 179         {
 180             /* These options set a flag. */
 181             {"assertStashAccountKey",   no_argument, NULL, 'A'},
 182             {"trigger-sync",   optional_argument, NULL, 's'},
 183             {0, 0, 0, 0}
 184         };
 185
 186         while ((ch = getopt_long(argc, argv, "A", long_options, &option_index)) != -1) {
 187             switch  (ch) {
 188                 case 'A': {
 189                     assertStashAccountKey = true;
 190                     break;
 191                 }
 192                 case 's': {
 193                     triggerSync = true;
 194                     if (optarg) {
 195                         syncingPeer = [NSString stringWithUTF8String:optarg];
 196                     }
 197                     break;
 198                 }
 199                 case '?':
 200                 default:
 201                 {
 202                     usage("sos-control", long_options);
 203                     return SHOW_USAGE_MESSAGE;
 204                 }
 205             }
 206         }
 207
 208         SOSStatus *control = [[SOSStatus alloc] init];
 209         if (control == NULL)
 210             errx(1, "no SOS control object");
 211
 212         dispatch_semaphore_t sema = dispatch_semaphore_create(0);
 213
 214         if (triggerSync) {
 215             NSMutableArray<NSString *> *peers = [NSMutableArray array];
 216             if (syncingPeer) {
 217                 [peers addObject:syncingPeer];
 218             }
 219
 220             [[control.connection remoteObjectProxyWithErrorHandler:^(NSError *error) {
 221                 printf("%s", [[NSString stringWithFormat:@"Failed to sending messages to soscontrol object: %@\n", error] UTF8String]);
 222                 dispatch_semaphore_signal(sema);
 223             }] triggerSync:peers complete:^(bool res, NSError *error) {
 224                 if (res) {
 225                     printf("starting to sync was successful\n");
 226                 } else {
 227                     printf("%s", [[NSString stringWithFormat:@"Failed to start sync: %@\n", error] UTF8String]);
 228                 }
 229                 dispatch_semaphore_signal(sema);
 230             }];
 231             dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
 232         } else if (assertStashAccountKey) {
 233             [[control.connection remoteObjectProxyWithErrorHandler:^(NSError *error) {
 234                 printf("%s", [[NSString stringWithFormat:@"Failed to sending messages to soscontrol object: %@\n", error] UTF8String]);
 235                 dispatch_semaphore_signal(sema);
 236             }] assertStashedAccountCredential:^(BOOL res, NSError *error) {
 237                 if (res) {
 238                     printf("successfully asserted stashed credential\n");
 239                 } else {
 240                     printf("%s", [[NSString stringWithFormat:@"failed to assert stashed credential: %@\n", error] UTF8String]);
 241                 }
 242                 dispatch_semaphore_signal(sema);
 243             }];
 244             dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
 245
 246         } else {
 247
 248             [[control.connection remoteObjectProxyWithErrorHandler:^(NSError *error) {
 249                 printf("%s", [[NSString stringWithFormat:@"Failed to sending messages to soscontrol object: %@\n", error] UTF8String]);
 250                 dispatch_semaphore_signal(sema);
 251             }] userPublicKey:^(BOOL trusted, NSData *spki, NSError *error) {
 252                 printf("trusted: %s\n", trusted ? "yes" : "no");
 253                 printf("userPublicKey: %s\n", [[spki base64EncodedStringWithOptions:0] UTF8String]);
 254                 dispatch_semaphore_signal(sema);
 255             }];
 256             dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
 257
 258             [[control.connection remoteObjectProxyWithErrorHandler:^(NSError *error) {
 259                 printf("%s", [[NSString stringWithFormat:@"Failed to sending messages to soscontrol object: %@\n", error] UTF8String]);
 260                 dispatch_semaphore_signal(sema);
 261             }] stashedCredentialPublicKey:^(NSData *spki, NSError *error) {
 262                 NSString *pkey = [spki base64EncodedStringWithOptions:0];
 263                 if (pkey == NULL)
 264                     pkey = @"no available";
 265                 printf("cachedCredentialPublicKey: %s\n", [pkey UTF8String]);
 266                 dispatch_semaphore_signal(sema);
 267             }];
 268             dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER);
 269         }
 270
 271     }
 272     return 0;
 273 }
 274
 275 int command_watchdog(int argc, char* const * argv)
 276 {
 277     SOSStatus* control = [[SOSStatus alloc] init];
 278     dispatch_semaphore_t semaphore = dispatch_semaphore_create(0);
 279
 280     if (argc < 3) {
 281         printf("getting watchdog parameters...\n");
 282         [[control.connection remoteObjectProxyWithErrorHandler:^(NSError* error) {
 283             printf("%s", [[NSString stringWithFormat:@"Failed to sending messages to soscontrol object: %@\n", error] UTF8String]);
 284             dispatch_semaphore_signal(semaphore);
 285         }] getWatchdogParameters:^(NSDictionary* parameters, NSError* error) {
 286             if (error) {
 287                 printf("error getting watchdog parameters: %s", error.localizedDescription.UTF8String);
 288             }
 289             else {
 290                 printf("watchdog parameters:\n");
 291                 [parameters enumerateKeysAndObjectsUsingBlock:^(NSString* key, NSObject* value, BOOL* stop) {
 292                     printf("\t%s - %s\n", key.description.UTF8String, value.description.UTF8String);
 293                 }];
 294             }
 295
 296             dispatch_semaphore_signal(semaphore);
 297         }];
 298     }
 299     else {
 300         printf("attempting to set watchdog parameters...\n");
 301         NSString* parameter = [[NSString alloc] initWithUTF8String:argv[1]];
 302         NSInteger value = [[[NSString alloc] initWithUTF8String:argv[2]] integerValue];
 303         [[control.connection remoteObjectProxyWithErrorHandler:^(NSError* error) {
 304             printf("%s", [[NSString stringWithFormat:@"Failed to sending messages to soscontrol object: %@\n", error] UTF8String]);
 305             dispatch_semaphore_signal(semaphore);
 306         }] setWatchdogParmeters:@{parameter : @(value)} complete:^(NSError* error) {
 307             if (error) {
 308                 printf("error attempting to set watchdog parameters: %s\n", error.localizedDescription.UTF8String);
 309             }
 310             else {
 311                 printf("successfully set watchdog parameter\n");
 312             }
 313
 314             dispatch_semaphore_signal(semaphore);
 315         }];
 316     }
 317
 318     dispatch_semaphore_wait(semaphore, DISPATCH_TIME_FOREVER);
 319
 320     return 0;
 321 }