SecurityTool/sharedTool/sos.m

   1 /*
   2  * Copyright (c) 2015 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * This is to fool os services to not provide the Keychain manager
  26  * interface that doesn't work since we don't have unified headers
  27  * between iOS and OS X. rdar://23405418/
  28  */
  29 #define __KEYCHAINCORE__ 1
  30
  31 #import <Foundation/Foundation.h>
  32 #import <Foundation/NSXPCConnection_Private.h>
  33 #import <Security/Security.h>
  34 #import <Security/SecItemPriv.h>
  35 #import <Security/SecureObjectSync/SOSTypes.h>
  36 #include "keychain/SecureObjectSync/SOSControlHelper.h"
  37 #import <ipc/securityd_client.h>
  38 #import <err.h>
  39 #import <getopt.h>
  40
  41 #include "builtin_commands.h"
  42
  43
  44 @interface SOSStatus : NSObject
  45 @property NSXPCConnection *connection;
  46
  47 - (void)printPerformanceCounters:(bool)asPList;
  48 @end
  49
  50 @implementation SOSStatus
  51
  52 - (instancetype) init
  53 {
  54     if ((self = [super init]) == NULL)
  55         return NULL;
  56
  57     NSXPCInterface *interface = [NSXPCInterface interfaceWithProtocol:@protocol(SOSControlProtocol)];
  58     _SOSControlSetupInterface(interface);
  59
  60     self.connection = [[NSXPCConnection alloc] initWithMachServiceName:@(kSecuritydSOSServiceName) options:0];
  61     if (self.connection == NULL){
  62         return NULL;
  63     }
  64     self.connection.remoteObjectInterface = interface;
  65
  66     [self.connection resume];
  67
  68
  69     return self;
  70 }
  71
  72 - (void)printPerformanceCounters:(bool)asPList
  73 {
  74     dispatch_semaphore_t sema1 = dispatch_semaphore_create(0);
  75     dispatch_semaphore_t sema2 = dispatch_semaphore_create(0);
  76     dispatch_semaphore_t sema3 = dispatch_semaphore_create(0);
  77
  78     NSMutableDictionary<NSString *, NSNumber *> *merged = [NSMutableDictionary dictionary];
  79     __block NSMutableDictionary<NSString *, NSString *> *diagnostics = [NSMutableDictionary dictionary];
  80
  81     [[self.connection remoteObjectProxy] kvsPerformanceCounters:^(NSDictionary <NSString *, NSNumber *> *counters){
  82         if (counters == NULL){
  83             printf("no KVS counters!");
  84             return;
  85         }
  86
  87         [merged addEntriesFromDictionary:counters];
  88         dispatch_semaphore_signal(sema1);
  89     }];
  90
  91     [[self.connection remoteObjectProxy] rateLimitingPerformanceCounters:^(NSDictionary <NSString *, NSString *> *returnedDiagnostics){
  92         if (returnedDiagnostics == NULL){
  93             printf("no rate limiting counters!");
  94             return;
  95         }
  96         diagnostics = [[NSMutableDictionary alloc]initWithDictionary:returnedDiagnostics];
  97         dispatch_semaphore_signal(sema3);
  98     }];
  99     dispatch_semaphore_wait(sema1, DISPATCH_TIME_FOREVER);
 100     dispatch_semaphore_wait(sema2, DISPATCH_TIME_FOREVER);
 101     dispatch_semaphore_wait(sema3, DISPATCH_TIME_FOREVER);
 102
 103     if (asPList) {
 104         NSData *data = [NSPropertyListSerialization dataWithPropertyList:merged format:NSPropertyListXMLFormat_v1_0 options:0 error:NULL];
 105
 106         printf("%.*s\n", (int)[data length], [data bytes]);
 107     } else {
 108         [merged enumerateKeysAndObjectsUsingBlock:^(NSString * key, NSNumber * obj, BOOL *stop) {
 109             printf("%s - %lld\n", [key UTF8String], [obj longLongValue]);
 110         }];
 111     }
 112     if(diagnostics){
 113         [diagnostics enumerateKeysAndObjectsUsingBlock:^(NSString * key, NSString * obj, BOOL * stop) {
 114             printf("%s - %s\n", [key UTF8String], [obj UTF8String]);
 115         }];
 116     }
 117 }
 118
 119 @end
 120
 121 static void
 122 usage(const char *command, struct option *options)
 123 {
 124     printf("%s %s [...options]\n", getprogname(), command);
 125     for (unsigned n = 0; options[n].name; n++) {
 126         printf("\t [-%c|--%s\n", options[n].val, options[n].name);
 127     }
 128
 129 }
 130
 131 int
 132 command_sos_stats(__unused int argc, __unused char * const * argv)
 133 {
 134     @autoreleasepool {
 135         int option_index = 0, ch;
 136
 137         SOSStatus *control = [[SOSStatus alloc] init];
 138
 139         bool asPlist = false;
 140         struct option long_options[] =
 141         {
 142             /* These options set a flag. */
 143             {"plist",    no_argument, NULL, 'p'},
 144             {0, 0, 0, 0}
 145         };
 146
 147         while ((ch = getopt_long(argc, argv, "p", long_options, &option_index)) != -1) {
 148             switch  (ch) {
 149                 case 'p': {
 150                     asPlist = true;
 151                     break;
 152                 }
 153                 case '?':
 154                 default:
 155                 {
 156                     usage("sos-stats", long_options);
 157                     return SHOW_USAGE_MESSAGE;
 158                 }
 159             }
 160         }
 161
 162         [control printPerformanceCounters:asPlist];
 163     }
 164
 165     return 0;
 166 }
 167
 168 static void printControlFailureMessage(NSError *error) {
 169     printf("%s", [[NSString stringWithFormat:@"Failed to send messages to soscontrol object: %@\n", error] UTF8String]);
 170 }
 171
 172 int
 173 command_sos_control(__unused int argc, __unused char * const * argv)
 174 {
 175     @autoreleasepool {
 176         int option_index = 0, ch;
 177
 178         bool assertStashAccountKey = false;
 179         bool triggerSync = false;
 180         NSMutableArray<NSString *>* syncingPeers = NULL;
 181         bool triggerBackup = false;
 182         NSMutableArray<NSString*>* backupPeers = NULL;
 183         SOSAccountGhostBustingOptions gboptions = 0;
 184         bool gbinfo = false;
 185         bool gbtriggered = false;
 186         bool circleHash = false;
 187         bool triggerRingUpdate = false;
 188
 189         static struct option long_options[] =
 190         {
 191             /* These options set a flag. */
 192             {"assertStashAccountKey",   no_argument, NULL, 'a'},
 193             {"trigger-backup",   optional_argument, NULL, 'B'},
 194             {"trigger-ring-update",   no_argument, NULL, 'R'},
 195             {"trigger-sync",   optional_argument, NULL, 's'},
 196             {"circle-hash", optional_argument, NULL, 'H'},
 197             {"ghostbustByMID",   optional_argument, NULL, 'M'},
 198             {"ghostbustBySerial",   optional_argument, NULL, 'S'},
 199             {"ghostbustiCloudIdentities",   optional_argument, NULL, 'I'},
 200             {"ghostbustByAge",   optional_argument, NULL, 'A'},
 201             {"ghostbustInfo",   optional_argument, NULL, 'G'},
 202             {"ghostbustTriggered",   optional_argument, NULL, 'T'},
 203             {0, 0, 0, 0}
 204         };
 205
 206         while ((ch = getopt_long(argc, argv, "as:AB:GHIMRST", long_options, &option_index)) != -1) {
 207             switch  (ch) {
 208                 case 'a': {
 209                     assertStashAccountKey = true;
 210                     break;
 211                 }
 212                 case 's': {
 213                     triggerSync = true;
 214                     if (optarg) {
 215                         if (syncingPeers == NULL) {
 216                             syncingPeers = [NSMutableArray array];
 217                         }
 218                         [syncingPeers addObject:[NSString stringWithUTF8String:optarg]];
 219                     }
 220                     break;
 221                 }
 222                 case 'A': {
 223                     gboptions |= SOSGhostBustSerialByAge;
 224                     break;
 225                 }
 226                 case 'B': {
 227                     triggerBackup = true;
 228                     if (optarg) {
 229                         if (backupPeers == NULL) {
 230                             backupPeers = [NSMutableArray array];
 231                         }
 232                         [backupPeers addObject:[NSString stringWithUTF8String:optarg]];
 233                     }
 234                     break;
 235                 }
 236                 case 'G': {
 237                     gbinfo = true;
 238                     break;
 239                 }
 240                 case 'M': {
 241                     gboptions |= SOSGhostBustByMID;
 242                     break;
 243                 }
 244                 case 'R':
 245                     triggerRingUpdate = true;
 246                     break;
 247                 case 'S': {
 248                     gboptions |= SOSGhostBustBySerialNumber;
 249                     break;
 250                 }
 251                 case 'I': {
 252                     gboptions |= SOSGhostBustiCloudIdentities;
 253                     break;
 254                 }
 255                 case 'T': {
 256                     gbtriggered = true;
 257                     break;
 258                 }
 259                 case 'H':
 260                     circleHash = true;
 261                     break;
 262                 case '?':
 263                 default:
 264                 {
 265                     usage("sos-control", long_options);
 266                     return SHOW_USAGE_MESSAGE;
 267                 }
 268             }
 269         }
 270
 271         SOSStatus *control = [[SOSStatus alloc] init];
 272         if (control == NULL)
 273             errx(1, "no SOS control object");
 274
 275         if( gbtriggered) {
 276             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 277                 printControlFailureMessage(error);
 278             }] ghostBustTriggerTimed:gboptions complete:^(bool ghostBusted, NSError *error) {
 279                 if (ghostBusted) {
 280                     printf("ghostbusted devices\n");
 281                 } else if (error) {
 282                     printf("%s", [[NSString stringWithFormat:@"Failed ghostbusting: %@\n", error] UTF8String]);
 283                 } else {
 284                     printf("no ghosts found\n");
 285                 }
 286             }];
 287         } else if( gbinfo) {
 288             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 289                 printControlFailureMessage(error);
 290             }] ghostBustInfo: ^(NSData *json, NSError *error) {
 291                 printf("%s\n", [[[NSString alloc] initWithData:json encoding:NSUTF8StringEncoding] UTF8String]);
 292             }];
 293         } else if (gboptions != 0) {
 294             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 295                 printControlFailureMessage(error);
 296             }] ghostBust:gboptions complete:^(bool ghostBusted, NSError *error) {
 297                 if (ghostBusted) {
 298                     printf("ghostbusted devices\n");
 299                 } else if (error) {
 300                     printf("%s", [[NSString stringWithFormat:@"Failed ghostbusting: %@\n", error] UTF8String]);
 301                 } else {
 302                     printf("no ghosts found\n");
 303                 }
 304             }];
 305         } else if (triggerSync) {
 306             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 307                 printControlFailureMessage(error);
 308             }] rpcTriggerSync:syncingPeers complete:^(bool res, NSError *error) {
 309                 if (res) {
 310                     printf("starting to sync was successful\n");
 311                 } else {
 312                     printf("%s", [[NSString stringWithFormat:@"Failed to start sync: %@\n", error] UTF8String]);
 313                 }
 314             }];
 315         } else if (triggerBackup) {
 316             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 317                 printControlFailureMessage(error);
 318             }] rpcTriggerBackup:backupPeers complete:^(NSError *error) {
 319                 if (error == NULL) {
 320                     printf("trigger backup was successful\n");
 321                 } else {
 322                     printf("%s", [[NSString stringWithFormat:@"Failed to start backup: %@\n", error] UTF8String]);
 323                 }
 324             }];
 325         } else if (triggerRingUpdate) {
 326             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 327                 printControlFailureMessage(error);
 328             }] rpcTriggerRingUpdate:^(NSError *error) {
 329                 if (error == NULL) {
 330                     printf("trigger ring update was successful\n");
 331                 } else {
 332                     printf("%s", [[NSString stringWithFormat:@"Failed to start ring update: %@\n", error] UTF8String]);
 333                 }
 334             }];
 335
 336         } else if (assertStashAccountKey) {
 337             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 338                 printControlFailureMessage(error);
 339             }] assertStashedAccountCredential:^(BOOL res, NSError *error) {
 340                 if (res) {
 341                     printf("successfully asserted stashed credential\n");
 342                 } else {
 343                     printf("%s", [[NSString stringWithFormat:@"failed to assert stashed credential: %@\n", error] UTF8String]);
 344                 }
 345             }];
 346         } else if (circleHash) {
 347             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 348                 printControlFailureMessage(error);
 349             }] circleHash:^(NSString *hash, NSError *error) {
 350                 if (hash) {
 351                     printf("%s", [[NSString stringWithFormat:@"circle hash: %@\n", hash] UTF8String]);
 352                 } else {
 353                     printf("%s", [[NSString stringWithFormat:@"failed to get circle digest: %@\n", error] UTF8String]);
 354                 }
 355             }];
 356
 357         } else {
 358
 359             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 360                 printControlFailureMessage(error);
 361             }] userPublicKey:^(BOOL trusted, NSData *spki, NSError *error) {
 362                 printf("trusted: %s\n", trusted ? "yes" : "no");
 363                 printf("userPublicKey: %s\n", [[spki base64EncodedStringWithOptions:0] UTF8String]);
 364             }];
 365
 366             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 367                 printControlFailureMessage(error);
 368             }] stashedCredentialPublicKey:^(NSData *spki, NSError *error) {
 369                 NSString *pkey = [spki base64EncodedStringWithOptions:0];
 370                 if (pkey == NULL)
 371                     pkey = @"not available";
 372                 printf("cachedCredentialPublicKey: %s\n", [pkey UTF8String]);
 373             }];
 374         }
 375
 376     }
 377     return 0;
 378 }
 379
 380 int command_watchdog(int argc, char* const * argv)
 381 {
 382     SOSStatus* control = [[SOSStatus alloc] init];
 383     dispatch_semaphore_t semaphore = dispatch_semaphore_create(0);
 384
 385     if (argc < 3) {
 386         printf("getting watchdog parameters...\n");
 387         [[control.connection remoteObjectProxyWithErrorHandler:^(NSError* error) {
 388             printControlFailureMessage(error);
 389             dispatch_semaphore_signal(semaphore);
 390         }] getWatchdogParameters:^(NSDictionary* parameters, NSError* error) {
 391             if (error) {
 392                 printf("error getting watchdog parameters: %s", error.localizedDescription.UTF8String);
 393             }
 394             else {
 395                 printf("watchdog parameters:\n");
 396                 [parameters enumerateKeysAndObjectsUsingBlock:^(NSString* key, NSObject* value, BOOL* stop) {
 397                     printf("\t%s - %s\n", key.description.UTF8String, value.description.UTF8String);
 398                 }];
 399             }
 400
 401             dispatch_semaphore_signal(semaphore);
 402         }];
 403     }
 404     else {
 405         printf("attempting to set watchdog parameters...\n");
 406         NSString* parameter = [[NSString alloc] initWithUTF8String:argv[1]];
 407         NSInteger value = [[[NSString alloc] initWithUTF8String:argv[2]] integerValue];
 408         [[control.connection remoteObjectProxyWithErrorHandler:^(NSError* error) {
 409             printControlFailureMessage(error);
 410             dispatch_semaphore_signal(semaphore);
 411         }] setWatchdogParmeters:@{parameter : @(value)} complete:^(NSError* error) {
 412             if (error) {
 413                 printf("error attempting to set watchdog parameters: %s\n", error.localizedDescription.UTF8String);
 414             }
 415             else {
 416                 printf("successfully set watchdog parameter\n");
 417             }
 418
 419             dispatch_semaphore_signal(semaphore);
 420         }];
 421     }
 422
 423     dispatch_semaphore_wait(semaphore, DISPATCH_TIME_FOREVER);
 424
 425     return 0;
 426 }