SecurityTool/sharedTool/sos.m

   1 /*
   2  * Copyright (c) 2015 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * This is to fool os services to not provide the Keychain manager
  26  * interface that doesn't work since we don't have unified headers
  27  * between iOS and OS X. rdar://23405418/
  28  */
  29 #define __KEYCHAINCORE__ 1
  30
  31 #import <Foundation/Foundation.h>
  32 #import <Foundation/NSXPCConnection_Private.h>
  33 #import <Security/Security.h>
  34 #import <Security/SecItemPriv.h>
  35 #import <Security/SecureObjectSync/SOSTypes.h>
  36 #include "keychain/SecureObjectSync/SOSControlHelper.h"
  37 #import <ipc/securityd_client.h>
  38 #import <err.h>
  39 #import <getopt.h>
  40
  41 #include "builtin_commands.h"
  42
  43
  44 @interface SOSStatus : NSObject
  45 @property NSXPCConnection *connection;
  46
  47 - (void)printPerformanceCounters:(bool)asPList;
  48 @end
  49
  50 @implementation SOSStatus
  51
  52 - (instancetype) init
  53 {
  54     if ((self = [super init]) == NULL)
  55         return NULL;
  56
  57     NSXPCInterface *interface = [NSXPCInterface interfaceWithProtocol:@protocol(SOSControlProtocol)];
  58     _SOSControlSetupInterface(interface);
  59
  60     self.connection = [[NSXPCConnection alloc] initWithMachServiceName:@(kSecuritydSOSServiceName) options:0];
  61     if (self.connection == NULL){
  62         return NULL;
  63     }
  64     self.connection.remoteObjectInterface = interface;
  65
  66     [self.connection resume];
  67
  68
  69     return self;
  70 }
  71
  72 - (void)printPerformanceCounters:(bool)asPList
  73 {
  74     dispatch_semaphore_t sema1 = dispatch_semaphore_create(0);
  75     dispatch_semaphore_t sema2 = dispatch_semaphore_create(0);
  76     dispatch_semaphore_t sema3 = dispatch_semaphore_create(0);
  77
  78     NSMutableDictionary<NSString *, NSNumber *> *merged = [NSMutableDictionary dictionary];
  79     __block NSMutableDictionary<NSString *, NSString *> *diagnostics = [NSMutableDictionary dictionary];
  80
  81     [[self.connection remoteObjectProxy] kvsPerformanceCounters:^(NSDictionary <NSString *, NSNumber *> *counters){
  82         if (counters == NULL){
  83             printf("no KVS counters!");
  84             return;
  85         }
  86
  87         [merged addEntriesFromDictionary:counters];
  88         dispatch_semaphore_signal(sema1);
  89     }];
  90
  91     [[self.connection remoteObjectProxy] rateLimitingPerformanceCounters:^(NSDictionary <NSString *, NSString *> *returnedDiagnostics){
  92         if (returnedDiagnostics == NULL){
  93             printf("no rate limiting counters!");
  94             return;
  95         }
  96         diagnostics = [[NSMutableDictionary alloc]initWithDictionary:returnedDiagnostics];
  97         dispatch_semaphore_signal(sema3);
  98     }];
  99     dispatch_semaphore_wait(sema1, DISPATCH_TIME_FOREVER);
 100     dispatch_semaphore_wait(sema2, DISPATCH_TIME_FOREVER);
 101     dispatch_semaphore_wait(sema3, DISPATCH_TIME_FOREVER);
 102
 103     if (asPList) {
 104         NSData *data = [NSPropertyListSerialization dataWithPropertyList:merged format:NSPropertyListXMLFormat_v1_0 options:0 error:NULL];
 105
 106         printf("%.*s\n", (int)[data length], [data bytes]);
 107     } else {
 108         [merged enumerateKeysAndObjectsUsingBlock:^(NSString * key, NSNumber * obj, BOOL *stop) {
 109             printf("%s - %lld\n", [key UTF8String], [obj longLongValue]);
 110         }];
 111     }
 112     if(diagnostics){
 113         [diagnostics enumerateKeysAndObjectsUsingBlock:^(NSString * key, NSString * obj, BOOL * stop) {
 114             printf("%s - %s\n", [key UTF8String], [obj UTF8String]);
 115         }];
 116     }
 117 }
 118
 119 @end
 120
 121 static void
 122 usage(const char *command, struct option *options)
 123 {
 124     printf("%s %s [...options]\n", getprogname(), command);
 125     for (unsigned n = 0; options[n].name; n++) {
 126         printf("\t [-%c|--%s\n", options[n].val, options[n].name);
 127     }
 128
 129 }
 130
 131 int
 132 command_sos_stats(__unused int argc, __unused char * const * argv)
 133 {
 134     @autoreleasepool {
 135         int option_index = 0, ch;
 136
 137         SOSStatus *control = [[SOSStatus alloc] init];
 138
 139         bool asPlist = false;
 140         struct option long_options[] =
 141         {
 142             /* These options set a flag. */
 143             {"plist",    no_argument, NULL, 'p'},
 144             {0, 0, 0, 0}
 145         };
 146
 147         while ((ch = getopt_long(argc, argv, "p", long_options, &option_index)) != -1) {
 148             switch  (ch) {
 149                 case 'p': {
 150                     asPlist = true;
 151                     break;
 152                 }
 153                 case '?':
 154                 default:
 155                 {
 156                     usage("sos-stats", long_options);
 157                     return SHOW_USAGE_MESSAGE;
 158                 }
 159             }
 160         }
 161
 162         [control printPerformanceCounters:asPlist];
 163     }
 164
 165     return 0;
 166 }
 167
 168 static void printControlFailureMessage(NSError *error) {
 169     printf("%s", [[NSString stringWithFormat:@"Failed to send messages to soscontrol object: %@\n", error] UTF8String]);
 170 }
 171
 172 int
 173 command_sos_control(__unused int argc, __unused char * const * argv)
 174 {
 175     @autoreleasepool {
 176         int option_index = 0, ch;
 177
 178         bool assertStashAccountKey = false;
 179         bool triggerSync = false;
 180         NSMutableArray<NSString *>* syncingPeers = NULL;
 181         bool triggerBackup = false;
 182         NSMutableArray<NSString*>* backupPeers = NULL;
 183         SOSAccountGhostBustingOptions gboptions = 0;
 184         bool gbinfo = false;
 185         bool gbtriggered = false;
 186         bool circleHash = false;
 187
 188         static struct option long_options[] =
 189         {
 190             /* These options set a flag. */
 191             {"assertStashAccountKey",   no_argument, NULL, 'a'},
 192             {"trigger-backup",   optional_argument, NULL, 'B'},
 193             {"trigger-sync",   optional_argument, NULL, 's'},
 194             {"circle-hash", optional_argument, NULL, 'H'},
 195             {"ghostbustByMID",   optional_argument, NULL, 'M'},
 196             {"ghostbustBySerial",   optional_argument, NULL, 'S'},
 197             {"ghostbustiCloudIdentities",   optional_argument, NULL, 'I'},
 198             {"ghostbustByAge",   optional_argument, NULL, 'A'},
 199             {"ghostbustInfo",   optional_argument, NULL, 'G'},
 200             {"ghostbustTriggered",   optional_argument, NULL, 'T'},
 201             {0, 0, 0, 0}
 202         };
 203
 204         while ((ch = getopt_long(argc, argv, "as:AB:GHMSIT", long_options, &option_index)) != -1) {
 205             switch  (ch) {
 206                 case 'a': {
 207                     assertStashAccountKey = true;
 208                     break;
 209                 }
 210                 case 's': {
 211                     triggerSync = true;
 212                     if (optarg) {
 213                         if (syncingPeers == NULL) {
 214                             syncingPeers = [NSMutableArray array];
 215                         }
 216                         [syncingPeers addObject:[NSString stringWithUTF8String:optarg]];
 217                     }
 218                     break;
 219                 }
 220                 case 'A': {
 221                     gboptions |= SOSGhostBustSerialByAge;
 222                     break;
 223                 }
 224                 case 'B': {
 225                     triggerBackup = true;
 226                     if (optarg) {
 227                         if (backupPeers == NULL) {
 228                             backupPeers = [NSMutableArray array];
 229                         }
 230                         [backupPeers addObject:[NSString stringWithUTF8String:optarg]];
 231                     }
 232                     break;
 233                 }
 234                 case 'G': {
 235                     gbinfo = true;
 236                     break;
 237                 }
 238                 case 'M': {
 239                     gboptions |= SOSGhostBustByMID;
 240                     break;
 241                 }
 242                 case 'S': {
 243                     gboptions |= SOSGhostBustBySerialNumber;
 244                     break;
 245                 }
 246                 case 'I': {
 247                     gboptions |= SOSGhostBustiCloudIdentities;
 248                     break;
 249                 }
 250                 case 'T': {
 251                     gbtriggered = true;
 252                     break;
 253                 }
 254                 case 'H':
 255                     circleHash = true;
 256                     break;
 257                 case '?':
 258                 default:
 259                 {
 260                     usage("sos-control", long_options);
 261                     return SHOW_USAGE_MESSAGE;
 262                 }
 263             }
 264         }
 265
 266         SOSStatus *control = [[SOSStatus alloc] init];
 267         if (control == NULL)
 268             errx(1, "no SOS control object");
 269
 270         if( gbtriggered) {
 271             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 272                 printControlFailureMessage(error);
 273             }] ghostBustTriggerTimed:gboptions complete:^(bool ghostBusted, NSError *error) {
 274                 if (ghostBusted) {
 275                     printf("ghostbusted devices\n");
 276                 } else if (error) {
 277                     printf("%s", [[NSString stringWithFormat:@"Failed ghostbusting: %@\n", error] UTF8String]);
 278                 } else {
 279                     printf("no ghosts found\n");
 280                 }
 281             }];
 282         } else if( gbinfo) {
 283             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 284                 printControlFailureMessage(error);
 285             }] ghostBustInfo: ^(NSData *json, NSError *error) {
 286                 printf("%s\n", [[[NSString alloc] initWithData:json encoding:NSUTF8StringEncoding] UTF8String]);
 287             }];
 288         } else if (gboptions != 0) {
 289             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 290                 printControlFailureMessage(error);
 291             }] ghostBust:gboptions complete:^(bool ghostBusted, NSError *error) {
 292                 if (ghostBusted) {
 293                     printf("ghostbusted devices\n");
 294                 } else if (error) {
 295                     printf("%s", [[NSString stringWithFormat:@"Failed ghostbusting: %@\n", error] UTF8String]);
 296                 } else {
 297                     printf("no ghosts found\n");
 298                 }
 299             }];
 300         } else if (triggerSync) {
 301             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 302                 printControlFailureMessage(error);
 303             }] triggerSync:syncingPeers complete:^(bool res, NSError *error) {
 304                 if (res) {
 305                     printf("starting to sync was successful\n");
 306                 } else {
 307                     printf("%s", [[NSString stringWithFormat:@"Failed to start sync: %@\n", error] UTF8String]);
 308                 }
 309             }];
 310         } else if (triggerBackup) {
 311             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 312                 printControlFailureMessage(error);
 313             }] triggerBackup:backupPeers complete:^(NSError *error) {
 314                 if (error == NULL) {
 315                     printf("trigger backup was successful\n");
 316                 } else {
 317                     printf("%s", [[NSString stringWithFormat:@"Failed to start sync: %@\n", error] UTF8String]);
 318                 }
 319             }];
 320
 321         } else if (assertStashAccountKey) {
 322             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 323                 printControlFailureMessage(error);
 324             }] assertStashedAccountCredential:^(BOOL res, NSError *error) {
 325                 if (res) {
 326                     printf("successfully asserted stashed credential\n");
 327                 } else {
 328                     printf("%s", [[NSString stringWithFormat:@"failed to assert stashed credential: %@\n", error] UTF8String]);
 329                 }
 330             }];
 331         } else if (circleHash) {
 332             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 333                 printControlFailureMessage(error);
 334             }] circleHash:^(NSString *hash, NSError *error) {
 335                 if (hash) {
 336                     printf("%s", [[NSString stringWithFormat:@"circle hash: %@\n", hash] UTF8String]);
 337                 } else {
 338                     printf("%s", [[NSString stringWithFormat:@"failed to get circle digest: %@\n", error] UTF8String]);
 339                 }
 340             }];
 341
 342         } else {
 343
 344             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 345                 printControlFailureMessage(error);
 346             }] userPublicKey:^(BOOL trusted, NSData *spki, NSError *error) {
 347                 printf("trusted: %s\n", trusted ? "yes" : "no");
 348                 printf("userPublicKey: %s\n", [[spki base64EncodedStringWithOptions:0] UTF8String]);
 349             }];
 350
 351             [[control.connection synchronousRemoteObjectProxyWithErrorHandler:^(NSError *error) {
 352                 printControlFailureMessage(error);
 353             }] stashedCredentialPublicKey:^(NSData *spki, NSError *error) {
 354                 NSString *pkey = [spki base64EncodedStringWithOptions:0];
 355                 if (pkey == NULL)
 356                     pkey = @"not available";
 357                 printf("cachedCredentialPublicKey: %s\n", [pkey UTF8String]);
 358             }];
 359         }
 360
 361     }
 362     return 0;
 363 }
 364
 365 int command_watchdog(int argc, char* const * argv)
 366 {
 367     SOSStatus* control = [[SOSStatus alloc] init];
 368     dispatch_semaphore_t semaphore = dispatch_semaphore_create(0);
 369
 370     if (argc < 3) {
 371         printf("getting watchdog parameters...\n");
 372         [[control.connection remoteObjectProxyWithErrorHandler:^(NSError* error) {
 373             printControlFailureMessage(error);
 374             dispatch_semaphore_signal(semaphore);
 375         }] getWatchdogParameters:^(NSDictionary* parameters, NSError* error) {
 376             if (error) {
 377                 printf("error getting watchdog parameters: %s", error.localizedDescription.UTF8String);
 378             }
 379             else {
 380                 printf("watchdog parameters:\n");
 381                 [parameters enumerateKeysAndObjectsUsingBlock:^(NSString* key, NSObject* value, BOOL* stop) {
 382                     printf("\t%s - %s\n", key.description.UTF8String, value.description.UTF8String);
 383                 }];
 384             }
 385
 386             dispatch_semaphore_signal(semaphore);
 387         }];
 388     }
 389     else {
 390         printf("attempting to set watchdog parameters...\n");
 391         NSString* parameter = [[NSString alloc] initWithUTF8String:argv[1]];
 392         NSInteger value = [[[NSString alloc] initWithUTF8String:argv[2]] integerValue];
 393         [[control.connection remoteObjectProxyWithErrorHandler:^(NSError* error) {
 394             printControlFailureMessage(error);
 395             dispatch_semaphore_signal(semaphore);
 396         }] setWatchdogParmeters:@{parameter : @(value)} complete:^(NSError* error) {
 397             if (error) {
 398                 printf("error attempting to set watchdog parameters: %s\n", error.localizedDescription.UTF8String);
 399             }
 400             else {
 401                 printf("successfully set watchdog parameter\n");
 402             }
 403
 404             dispatch_semaphore_signal(semaphore);
 405         }];
 406     }
 407
 408     dispatch_semaphore_wait(semaphore, DISPATCH_TIME_FOREVER);
 409
 410     return 0;
 411 }