Add OpenSSL support

7 files changed, 547 insertions, 54 deletions

diff --git a/src/Makefile.am b/src/Makefile.am
index 5531f8d..c7ab0cf 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -1,7 +1,7 @@
 AM_CPPFLAGS = -I$(top_srcdir)/include
 
-AM_CFLAGS = $(GLOBAL_CFLAGS) $(libusbmuxd_CFLAGS) $(libgnutls_CFLAGS) $(libtasn1_CFLAGS) $(libplist_CFLAGS) $(LFS_CFLAGS)
-AM_LDFLAGS = $(libgnutls_LIBS) $(libtasn1_LIBS) $(libplist_LIBS) $(libusbmuxd_LIBS) $(libgcrypt_LIBS) ${libpthread_LIBS}
+AM_CFLAGS = $(GLOBAL_CFLAGS) $(libusbmuxd_CFLAGS) $(libgnutls_CFLAGS) $(libtasn1_CFLAGS) $(libplist_CFLAGS) $(LFS_CFLAGS) $(openssl_CFLAGS)
+AM_LDFLAGS = $(libgnutls_LIBS) $(libtasn1_LIBS) $(libplist_LIBS) $(libusbmuxd_LIBS) $(libgcrypt_LIBS) ${libpthread_LIBS} $(openssl_LIBS)
 
 lib_LTLIBRARIES = libimobiledevice.la
 libimobiledevice_la_LDFLAGS = $(AM_LDFLAGS) -version-info $(LIBIMOBILEDEVICE_SO_VERSION) -no-undefined
diff --git a/src/idevice.c b/src/idevice.c
index af87e61..d2769de 100644
--- a/src/idevice.c
+++ b/src/idevice.c
@@ -20,16 +20,28 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA 
  */
 
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 
 #include <usbmuxd.h>
+#ifdef HAVE_OPENSSL
+#include <openssl/ssl.h>
+#else
 #include <gnutls/gnutls.h>
+#endif
 #include "idevice.h"
 #include "userpref.h"
 #include "debug.h"
 
+#ifdef HAVE_OPENSSL
+static int openssl_init_done = 0;
+#endif
+
 static idevice_event_cb_t event_cb = NULL;
 
 static void usbmux_event_cb(const usbmuxd_event_t *event, void *user_data)
@@ -303,7 +315,12 @@ idevice_error_t idevice_connection_send(idevice_connection_t connection, const c
 	}
 
 	if (connection->ssl_data) {
+#ifdef HAVE_OPENSSL
+		int sent = SSL_write(connection->ssl_data->session, (const void*)data, (int)len);
+		debug_info("SSL_write %d, sent %d", len, sent);
+#else
 		ssize_t sent = gnutls_record_send(connection->ssl_data->session, (void*)data, (size_t)len);
+#endif
 		if ((uint32_t)sent == (uint32_t)len) {
 			*sent_bytes = sent;
 			return IDEVICE_E_SUCCESS;
@@ -359,7 +376,12 @@ idevice_error_t idevice_connection_receive_timeout(idevice_connection_t connecti
 	}
 
 	if (connection->ssl_data) {
+#ifdef HAVE_OPENSSL
+		int received = SSL_read(connection->ssl_data->session, (void*)data, (int)len);
+		debug_info("SSL_read %d, received %d", len, received);
+#else
 		ssize_t received = gnutls_record_recv(connection->ssl_data->session, (void*)data, (size_t)len);
+#endif
 		if (received > 0) {
 			*recv_bytes = received;
 			return IDEVICE_E_SUCCESS;
@@ -413,7 +435,12 @@ idevice_error_t idevice_connection_receive(idevice_connection_t connection, char
 	}
 
 	if (connection->ssl_data) {
+#ifdef HAVE_OPENSSL
+		int received = SSL_read(connection->ssl_data->session, (void*)data, (int)len);
+		debug_info("SSL_read %d, received %d", len, received);
+#else
 		ssize_t received = gnutls_record_recv(connection->ssl_data->session, (void*)data, (size_t)len);
+#endif
 		if (received > 0) {
 			*recv_bytes = received;
 			return IDEVICE_E_SUCCESS;
@@ -453,6 +480,7 @@ idevice_error_t idevice_get_uuid(idevice_t device, char **uuid)
 	return IDEVICE_E_SUCCESS;
 }
 
+#ifndef HAVE_OPENSSL
 /**
  * Internally used gnutls callback function for receiving encrypted data.
  */
@@ -514,6 +542,7 @@ static ssize_t internal_ssl_write(gnutls_transport_ptr_t transport, char *buffer
 	debug_info("post-send sent %i bytes", bytes);
 	return bytes;
 }
+#endif
 
 /**
  * Internally used function for cleaning up SSL stuff.
@@ -523,6 +552,14 @@ static void internal_ssl_cleanup(ssl_data_t ssl_data)
 	if (!ssl_data)
 		return;
 
+#ifdef HAVE_OPENSSL
+	if (ssl_data->session) {
+		SSL_free(ssl_data->session);
+	}
+	if (ssl_data->ctx) {
+		SSL_CTX_free(ssl_data->ctx);
+	}
+#else
 	if (ssl_data->session) {
 		gnutls_deinit(ssl_data->session);
 	}
@@ -541,8 +578,45 @@ static void internal_ssl_cleanup(ssl_data_t ssl_data)
 	if (ssl_data->host_privkey) {
 		gnutls_x509_privkey_deinit(ssl_data->host_privkey);
 	}
+#endif
+}
+
+#ifdef HAVE_OPENSSL
+static int ssl_verify_callback(int ok, X509_STORE_CTX *ctx)
+{
+	return 1;
+}
+
+#ifndef STRIP_DEBUG_CODE
+static const char *errorstring(int e)
+{
+    switch(e) {
+	case SSL_ERROR_NONE:
+	    return "SSL_ERROR_NONE";
+	case SSL_ERROR_SSL:
+	    return "SSL_ERROR_SSL";
+	case SSL_ERROR_WANT_READ:
+	    return "SSL_ERROR_WANT_READ";
+	case SSL_ERROR_WANT_WRITE:
+	    return "SSL_ERROR_WANT_WRITE";
+	case SSL_ERROR_WANT_X509_LOOKUP:
+	    return "SSL_ERROR_WANT_X509_LOOKUP";
+	case SSL_ERROR_SYSCALL:
+	    return "SSL_ERROR_SYSCALL";
+	case SSL_ERROR_ZERO_RETURN:
+	    return "SSL_ERROR_ZERO_RETURN";
+        case SSL_ERROR_WANT_CONNECT:
+	    return "SSL_ERROR_WANT_CONNECT";
+	case SSL_ERROR_WANT_ACCEPT:
+	    return "SSL_ERROR_WANT_ACCEPT";
+	default:
+	    return "UNKOWN_ERROR_VALUE";
+    }
 }
+#endif
+#endif
 
+#ifndef HAVE_OPENSSL
 /**
  * Internally used gnutls callback function that gets called during handshake.
  */
@@ -564,6 +638,7 @@ static int internal_cert_callback (gnutls_session_t session, const gnutls_datum_
 	}
 	return res;
 }
+#endif
 
 /**
  * Enables SSL for the given connection.
@@ -582,6 +657,76 @@ idevice_error_t idevice_connection_enable_ssl(idevice_connection_t connection)
 	idevice_error_t ret = IDEVICE_E_SSL_ERROR;
 	uint32_t return_me = 0;
 
+#ifdef HAVE_OPENSSL
+	key_data_t root_cert = { NULL, 0 };
+	key_data_t root_privkey = { NULL, 0 };
+
+	userpref_error_t uerr = userpref_get_keys_and_certs(&root_privkey, &root_cert, NULL, NULL);
+	if (uerr != USERPREF_E_SUCCESS) {
+		debug_info("Error %d when loading keys and certificates! %d", uerr);
+	}
+
+	/* Set up OpenSSL */
+	BIO *ssl_bio = BIO_new(BIO_s_socket());
+	if (!ssl_bio) {
+		debug_info("ERROR: Could not create SSL bio.");
+		return ret;
+	}
+	BIO_set_fd(ssl_bio, (int)(long)connection->data, BIO_NOCLOSE);
+
+	if (openssl_init_done == 0) {
+		SSL_library_init();
+		openssl_init_done = 1;
+	}
+	SSL_CTX *ssl_ctx = SSL_CTX_new(SSLv3_method());
+
+	BIO* membp;
+	X509* rootCert = NULL;
+	membp = BIO_new_mem_buf(root_cert.data, root_cert.size);
+	PEM_read_bio_X509(membp, &rootCert, NULL, NULL);
+	BIO_free(membp);
+	if (SSL_CTX_use_certificate(ssl_ctx, rootCert) != 1) {
+		debug_info("WARNING: Could not load RootCertificate");
+	}
+	X509_free(rootCert);
+	free(root_cert.data);
+
+	RSA* rootPrivKey = NULL;
+	membp = BIO_new_mem_buf(root_privkey.data, root_privkey.size);
+	PEM_read_bio_RSAPrivateKey(membp, &rootPrivKey, NULL, NULL);
+	BIO_free(membp);
+	if (SSL_CTX_use_RSAPrivateKey(ssl_ctx, rootPrivKey) != 1) {
+		debug_info("WARNING: Could not load RootPrivateKey");
+	}
+	RSA_free(rootPrivKey);
+	free(root_privkey.data);
+
+	SSL *ssl = SSL_new(ssl_ctx);
+	if (!ssl) {
+		debug_info("ERROR: Could not create SSL object");
+		BIO_free(ssl_bio);
+		SSL_CTX_free(ssl_ctx);
+		return ret;
+	}
+	SSL_set_connect_state(ssl);
+	SSL_set_verify(ssl, 0, ssl_verify_callback);
+	SSL_set_bio(ssl, ssl_bio, ssl_bio);
+
+	return_me = SSL_do_handshake(ssl);
+        if (return_me != 1) {
+		debug_info("ERROR in SSL_do_handshake: %s", errorstring(SSL_get_error(ssl, return_me)));
+		BIO_free(ssl_bio);
+		SSL_CTX_free(ssl_ctx);
+	} else {
+		ssl_data_t ssl_data_loc = (ssl_data_t)malloc(sizeof(struct ssl_data_private));
+		ssl_data_loc->session = ssl;
+		ssl_data_loc->ctx = ssl_ctx;
+		ssl_data_loc->bio = ssl_bio;
+		connection->ssl_data = ssl_data_loc;
+		ret = IDEVICE_E_SUCCESS;
+		debug_info("SSL mode enabled, cipher: %s", SSL_get_cipher(ssl));
+	}
+#else
 	ssl_data_t ssl_data_loc = (ssl_data_t)malloc(sizeof(struct ssl_data_private));
 
 	/* Set up GnuTLS... */
@@ -612,8 +757,9 @@ idevice_error_t idevice_connection_enable_ssl(idevice_connection_t connection)
 	debug_info("GnuTLS step 3...");
 	gnutls_transport_set_pull_function(ssl_data_loc->session, (gnutls_pull_func) & internal_ssl_read);
 	debug_info("GnuTLS step 4 -- now handshaking...");
-	if (errno)
+	if (errno) {
 		debug_info("WARN: errno says %s before handshake!", strerror(errno));
+	}
 	return_me = gnutls_handshake(ssl_data_loc->session);
 	debug_info("GnuTLS handshake done...");
 
@@ -628,6 +774,7 @@ idevice_error_t idevice_connection_enable_ssl(idevice_connection_t connection)
 		ret = IDEVICE_E_SUCCESS;
 		debug_info("SSL mode enabled");
 	}
+#endif
 	return ret;
 }
 
@@ -649,9 +796,15 @@ idevice_error_t idevice_connection_disable_ssl(idevice_connection_t connection)
 		return IDEVICE_E_SUCCESS;
 	}
 
+#ifdef HAVE_OPENSSL
+	if (connection->ssl_data->session) {
+		SSL_shutdown(connection->ssl_data->session);
+	}
+#else
 	if (connection->ssl_data->session) {
 		gnutls_bye(connection->ssl_data->session, GNUTLS_SHUT_RDWR);
 	}
+#endif
 	internal_ssl_cleanup(connection->ssl_data);
 	free(connection->ssl_data);
 	connection->ssl_data = NULL;
diff --git a/src/idevice.h b/src/idevice.h
index 231b3ab..65fdae0 100644
--- a/src/idevice.h
+++ b/src/idevice.h
@@ -21,8 +21,18 @@
 #ifndef IDEVICE_H
 #define IDEVICE_H
 
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#ifdef HAVE_OPENSSL
+#include <openssl/ssl.h>
+#else
 #include <gnutls/gnutls.h>
 #include <gnutls/x509.h>
+#endif
+
+#include "userpref.h"
 
 #include "libimobiledevice/libimobiledevice.h"
 
@@ -31,12 +41,18 @@ enum connection_type {
 };
 
 struct ssl_data_private {
+#ifdef HAVE_OPENSSL
+	SSL *session;
+	SSL_CTX *ctx;
+	BIO *bio;
+#else
 	gnutls_certificate_credentials_t certificate;
 	gnutls_session_t session;
 	gnutls_x509_privkey_t root_privkey;
 	gnutls_x509_crt_t root_cert;
 	gnutls_x509_privkey_t host_privkey;
 	gnutls_x509_crt_t host_cert;
+#endif
 };
 typedef struct ssl_data_private *ssl_data_t;
 
diff --git a/src/lockdown.c b/src/lockdown.c
index 0f1e1b2..f22fb08 100644
--- a/src/lockdown.c
+++ b/src/lockdown.c
@@ -20,14 +20,24 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
 #include <string.h>
 #include <stdlib.h>
 #define _GNU_SOURCE 1
 #define __USE_GNU 1
 #include <stdio.h>
 #include <ctype.h>
+#ifdef HAVE_OPENSSL
+#include <openssl/pem.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+#else
 #include <libtasn1.h>
 #include <gnutls/x509.h>
+#endif
 #include <plist/plist.h>
 
 #include "property_list_service.h"
@@ -40,6 +50,7 @@
 #define RESULT_SUCCESS 0
 #define RESULT_FAILURE 1
 
+#ifndef HAVE_OPENSSL
 const ASN1_ARRAY_TYPE pkcs1_asn1_tab[] = {
 	{"PKCS1", 536872976, 0},
 	{0, 1073741836, 0},
@@ -48,6 +59,7 @@ const ASN1_ARRAY_TYPE pkcs1_asn1_tab[] = {
 	{"publicExponent", 3, 0},
 	{0, 0, 0}
 };
+#endif
 
 /**
  * Internally used function for checking the result from lockdown's answer
@@ -567,7 +579,7 @@ lockdownd_error_t lockdownd_get_device_uuid(lockdownd_client_t client, char **uu
  *
  * @return LOCKDOWN_E_SUCCESS on success
  */
-lockdownd_error_t lockdownd_get_device_public_key(lockdownd_client_t client, gnutls_datum_t * public_key)
+lockdownd_error_t lockdownd_get_device_public_key(lockdownd_client_t client, key_data_t * public_key)
 {
 	lockdownd_error_t ret = LOCKDOWN_E_UNKNOWN_ERROR;
 	plist_t value = NULL;
@@ -783,13 +795,13 @@ static plist_t lockdownd_pair_record_to_plist(lockdownd_pair_record_t pair_recor
  *
  * @return LOCKDOWN_E_SUCCESS on success
  */
-static lockdownd_error_t generate_pair_record_plist(gnutls_datum_t public_key, char *host_id, plist_t *pair_record_plist)
+static lockdownd_error_t generate_pair_record_plist(key_data_t public_key, char *host_id, plist_t *pair_record_plist)
 {
 	lockdownd_error_t ret = LOCKDOWN_E_UNKNOWN_ERROR;
 
-	gnutls_datum_t device_cert = { NULL, 0 };
-	gnutls_datum_t host_cert = { NULL, 0 };
-	gnutls_datum_t root_cert = { NULL, 0 };
+	key_data_t device_cert = { NULL, 0 };
+	key_data_t host_cert = { NULL, 0 };
+	key_data_t root_cert = { NULL, 0 };
 
 	ret = lockdownd_gen_pair_cert(public_key, &device_cert, &host_cert, &root_cert);
 	if (ret != LOCKDOWN_E_SUCCESS) {
@@ -844,7 +856,7 @@ static lockdownd_error_t lockdownd_do_pair(lockdownd_client_t client, lockdownd_
 	lockdownd_error_t ret = LOCKDOWN_E_UNKNOWN_ERROR;
 	plist_t dict = NULL;
 	plist_t dict_record = NULL;
-	gnutls_datum_t public_key = { NULL, 0 };
+	key_data_t public_key = { NULL, 0 };
 	int pairing_mode = 0; /* 0 = libimobiledevice, 1 = external */
 
 	if (pair_record && pair_record->host_id) {
@@ -1096,14 +1108,145 @@ lockdownd_error_t lockdownd_goodbye(lockdownd_client_t client)
  *  LOCKDOWN_E_INVALID_CONF if the internal configuration system failed,
  *  LOCKDOWN_E_SSL_ERROR if the certificates could not be generated
  */
-lockdownd_error_t lockdownd_gen_pair_cert(gnutls_datum_t public_key, gnutls_datum_t * odevice_cert,
-									   gnutls_datum_t * ohost_cert, gnutls_datum_t * oroot_cert)
+lockdownd_error_t lockdownd_gen_pair_cert(key_data_t public_key, key_data_t * odevice_cert,
+									   key_data_t * ohost_cert, key_data_t * oroot_cert)
 {
 	if (!public_key.data || !odevice_cert || !ohost_cert || !oroot_cert)
 		return LOCKDOWN_E_INVALID_ARG;
 	lockdownd_error_t ret = LOCKDOWN_E_UNKNOWN_ERROR;
 	userpref_error_t uret = USERPREF_E_UNKNOWN_ERROR;
 
+#ifdef HAVE_OPENSSL
+	BIO *membio = BIO_new_mem_buf(public_key.data, public_key.size);
+	RSA *pubkey = NULL;
+	if (!PEM_read_bio_RSAPublicKey(membio, &pubkey, NULL, NULL)) {
+		debug_info("%s: Could not read public key", __func__);	
+	}
+	BIO_free(membio);
+
+	/* now generate certificates */
+	key_data_t root_privkey, host_privkey;
+	key_data_t root_cert, host_cert;
+	X509* dev_cert;
+
+	root_cert.data = NULL;
+	root_cert.size = 0;
+	host_cert.data = NULL;
+	host_cert.size = 0;
+
+	dev_cert = X509_new();
+
+	root_privkey.data = NULL;
+	root_privkey.size = 0;
+	host_privkey.data = NULL;
+	host_privkey.size = 0;
+
+	uret = userpref_get_keys_and_certs(&root_privkey, &root_cert, &host_privkey, &host_cert);
+	if (USERPREF_E_SUCCESS == uret) {
+		/* generate device certificate */
+		ASN1_INTEGER* sn = ASN1_INTEGER_new();
+		ASN1_INTEGER_set(sn, 0);
+		X509_set_serialNumber(dev_cert, sn);
+		ASN1_INTEGER_free(sn);
+		X509_set_version(dev_cert, 2);
+
+		X509_EXTENSION* ext;
+		if (!(ext = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints, (char*)"critical,CA:FALSE"))) {
+			debug_info("ERROR: X509V3_EXT_conf_nid failed");
+		}
+		X509_add_ext(dev_cert, ext, -1);
+
+		ASN1_TIME* asn1time = ASN1_TIME_new();
+		ASN1_TIME_set(asn1time, time(NULL));
+		X509_set_notBefore(dev_cert, asn1time);
+		ASN1_TIME_set(asn1time, time(NULL) + (60 * 60 * 24 * 365 * 10));
+		X509_set_notAfter(dev_cert, asn1time);
+		ASN1_TIME_free(asn1time);
+	
+		BIO* membp;
+
+		X509* rootCert = NULL;
+		membp = BIO_new_mem_buf(root_cert.data, root_cert.size);
+		PEM_read_bio_X509(membp, &rootCert, NULL, NULL);
+		BIO_free(membp);
+		if (!rootCert) {
+			debug_info("Could not read RootCertificate%*s");
+		} else {
+			debug_info("RootCertificate loaded");
+			EVP_PKEY* pkey = EVP_PKEY_new();
+			EVP_PKEY_assign_RSA(pkey, pubkey);
+			X509_set_pubkey(dev_cert, pkey);
+			EVP_PKEY_free(pkey);
+			X509_free(rootCert);
+		}
+
+		EVP_PKEY* rootPriv = NULL;
+		membp = BIO_new_mem_buf(root_privkey.data, root_privkey.size);
+		PEM_read_bio_PrivateKey(membp, &rootPriv, NULL, NULL);
+		BIO_free(membp);
+		if (!rootPriv) {
+			debug_info("Could not read RootPrivateKey");
+		} else {
+			debug_info("RootPrivateKey loaded");
+			if (X509_sign(dev_cert, rootPriv, EVP_sha1())) {
+				ret = LOCKDOWN_E_SUCCESS;
+			} else {
+				debug_info("signing failed");
+			}
+			EVP_PKEY_free(rootPriv);
+		}
+
+		if (LOCKDOWN_E_SUCCESS == ret) {
+			/* if everything went well, export in PEM format */
+			key_data_t pem_root_cert = { NULL, 0 };
+			key_data_t pem_host_cert = { NULL, 0 };
+
+			uret = userpref_get_certs_as_pem(&pem_root_cert, &pem_host_cert);
+			if (USERPREF_E_SUCCESS == uret) {
+				/* copy buffer for output */
+				membp = BIO_new(BIO_s_mem());
+				if (PEM_write_bio_X509(membp, dev_cert) > 0) {
+					odevice_cert->size = BIO_get_mem_data(membp, &odevice_cert->data);
+				}
+
+				ohost_cert->data = malloc(pem_host_cert.size);
+				memcpy(ohost_cert->data, pem_host_cert.data, pem_host_cert.size);
+				ohost_cert->size = pem_host_cert.size;
+
+				oroot_cert->data = malloc(pem_root_cert.size);
+				memcpy(oroot_cert->data, pem_root_cert.data, pem_root_cert.size);
+				oroot_cert->size = pem_root_cert.size;
+
+				free(pem_root_cert.data);
+				free(pem_host_cert.data);
+			}
+		}
+	}
+	X509V3_EXT_cleanup();
+	X509_free(dev_cert);
+
+	switch(uret) {
+	case USERPREF_E_INVALID_ARG:
+		ret = LOCKDOWN_E_INVALID_ARG;
+		break;
+	case USERPREF_E_INVALID_CONF:
+		ret = LOCKDOWN_E_INVALID_CONF;
+		break;
+	case USERPREF_E_SSL_ERROR:
+		ret = LOCKDOWN_E_SSL_ERROR;
+	default:
+		break;
+	}
+
+	if (root_cert.data)
+		free(root_cert.data);
+	if (host_cert.data)
+		free(host_cert.data);
+	if (root_privkey.data)
+		free(root_privkey.data);
+	if (host_privkey.data)
+		free(host_privkey.data);
+#else
 	gnutls_datum_t modulus = { NULL, 0 };
 	gnutls_datum_t exponent = { NULL, 0 };
 
@@ -1200,8 +1343,8 @@ lockdownd_error_t lockdownd_gen_pair_cert(gnutls_datum_t public_key, gnutls_datu
 						memcpy(oroot_cert->data, pem_root_cert.data, pem_root_cert.size);
 						oroot_cert->size = pem_root_cert.size;
 
-						free(pem_root_cert.data);
-						free(pem_host_cert.data);
+						gnutls_free(pem_root_cert.data);
+						gnutls_free(pem_host_cert.data);
 
 						if (dev_pem.data)
 							gnutls_free(dev_pem.data);
@@ -1238,6 +1381,7 @@ lockdownd_error_t lockdownd_gen_pair_cert(gnutls_datum_t public_key, gnutls_datu
 	gnutls_free(exponent.data);
 
 	gnutls_free(der_pub_key.data);
+#endif
 
 	return ret;
 }
diff --git a/src/lockdown.h b/src/lockdown.h
index a25e59d..a08b040 100644
--- a/src/lockdown.h
+++ b/src/lockdown.h
@@ -22,7 +22,7 @@
 #ifndef LOCKDOWND_H
 #define LOCKDOWND_H
 
-#include <gnutls/gnutls.h>
+#include "userpref.h"
 
 #include "libimobiledevice/lockdown.h"
 #include "property_list_service.h"
@@ -35,8 +35,7 @@ struct lockdownd_client_private {
 	char *label;
 };
 
-lockdownd_error_t lockdownd_get_device_public_key(lockdownd_client_t client, gnutls_datum_t * public_key);
-lockdownd_error_t lockdownd_gen_pair_cert(gnutls_datum_t public_key, gnutls_datum_t * device_cert,
-									   gnutls_datum_t * host_cert, gnutls_datum_t * root_cert);
+lockdownd_error_t lockdownd_get_device_public_key(lockdownd_client_t client, key_data_t * public_key);
+lockdownd_error_t lockdownd_gen_pair_cert(key_data_t public_key, key_data_t * device_cert, key_data_t * host_cert, key_data_t * root_cert);
 
 #endif
diff --git a/src/userpref.c b/src/userpref.c
index f4e9fe6..409eb27 100644
--- a/src/userpref.c
+++ b/src/userpref.c
@@ -19,13 +19,23 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
 #include <stdio.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
+#ifdef HAVE_OPENSSL
+#include <openssl/pem.h>
+#include <openssl/rsa.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+#else
 #include <gnutls/gnutls.h>
 #include <gnutls/x509.h>
 #include <gcrypt.h>
+#endif
 
 #include <dirent.h>
 #include <libgen.h>
@@ -526,7 +536,7 @@ userpref_error_t userpref_get_paired_uuids(char ***list, unsigned int *count)
  * @return 1 on success and 0 if no public key is given or if it has already
  *         been marked as connected previously.
  */
-userpref_error_t userpref_set_device_public_key(const char *uuid, gnutls_datum_t public_key)
+userpref_error_t userpref_set_device_public_key(const char *uuid, key_data_t public_key)
 {
 	if (NULL == public_key.data)
 		return USERPREF_E_INVALID_ARG;
@@ -583,14 +593,14 @@ userpref_error_t userpref_remove_device_public_key(const char *uuid)
 }
 
 /**
- * Private function which reads the given file into a gnutls structure.
+ * Private function which reads the given file into a key_data_t structure.
  *
  * @param file The filename of the file to read
  * @param data The pointer at which to store the data.
  *
  * @return 1 if the file contents where read successfully and 0 otherwise.
  */
-static int userpref_get_file_contents(const char *file, gnutls_datum_t * data)
+static int userpref_get_file_contents(const char *file, key_data_t * data)
 {
 	int success;
 	unsigned long int size = 0;
@@ -637,7 +647,7 @@ static int userpref_get_file_contents(const char *file, gnutls_datum_t * data)
 
 	free(filepath);
 
-	/* Add it to the gnutls_datnum_t structure */
+	/* Add it to the key_data_t structure */
 	if (success) {
 		data->data = (uint8_t*) content;
 		data->size = size;
@@ -655,6 +665,121 @@ static userpref_error_t userpref_gen_keys_and_cert(void)
 {
 	userpref_error_t ret = USERPREF_E_SSL_ERROR;
 
+	key_data_t root_key_pem = { NULL, 0 };
+	key_data_t root_cert_pem = { NULL, 0 };
+	key_data_t host_key_pem = { NULL, 0 };
+	key_data_t host_cert_pem = { NULL, 0 };
+
+#ifdef HAVE_OPENSSL
+	RSA* root_keypair = RSA_generate_key(2048, 65537, NULL, NULL);
+	RSA* host_keypair = RSA_generate_key(2048, 65537, NULL, NULL);
+
+	EVP_PKEY* root_pkey = EVP_PKEY_new();
+	EVP_PKEY_assign_RSA(root_pkey, root_keypair);
+
+	EVP_PKEY* host_pkey = EVP_PKEY_new();
+	EVP_PKEY_assign_RSA(host_pkey, host_keypair);
+
+	/* generate root certificate */
+	X509* root_cert = X509_new();
+	{
+		/* set serial number */
+		ASN1_INTEGER* sn = ASN1_INTEGER_new();
+		ASN1_INTEGER_set(sn, 0);
+		X509_set_serialNumber(root_cert, sn);
+		ASN1_INTEGER_free(sn);
+
+		/* set version */
+		X509_set_version(root_cert, 2);
+
+		/* set x509v3 basic constraints */
+		X509_EXTENSION* ext;
+		if (!(ext = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints, (char*)"critical,CA:TRUE"))) {
+			debug_info("ERROR: X509V3_EXT_conf_nid failed");
+		}
+		X509_add_ext(root_cert, ext, -1);
+
+		/* set key validity */
+		ASN1_TIME* asn1time = ASN1_TIME_new();
+		ASN1_TIME_set(asn1time, time(NULL));
+		X509_set_notBefore(root_cert, asn1time);
+		ASN1_TIME_set(asn1time, time(NULL) + (60 * 60 * 24 * 365 * 10));
+		X509_set_notAfter(root_cert, asn1time);
+		ASN1_TIME_free(asn1time);
+
+		/* use root public key for root cert */
+		X509_set_pubkey(root_cert, root_pkey);
+		/* sign root cert with root private key */
+		X509_sign(root_cert, root_pkey, EVP_sha1());
+	}
+
+	/* create host certificate */
+	X509* host_cert = X509_new();
+	{
+		/* set serial number */
+		ASN1_INTEGER* sn = ASN1_INTEGER_new();
+		ASN1_INTEGER_set(sn, 0);
+		X509_set_serialNumber(host_cert, sn);
+		ASN1_INTEGER_free(sn);
+
+		/* set version */
+		X509_set_version(host_cert, 2);
+
+		/* set x509v3 basic constraints */
+		X509_EXTENSION* ext;
+		if (!(ext = X509V3_EXT_conf_nid(NULL, NULL, NID_basic_constraints, (char*)"critical,CA:FALSE"))) {
+			debug_info("ERROR: X509V3_EXT_conf_nid failed");
+		}
+		X509_add_ext(host_cert, ext, -1);
+
+		/* set x509v3 key usage */
+		if (!(ext = X509V3_EXT_conf_nid(NULL, NULL, NID_key_usage, (char*)"digitalSignature,keyEncipherment"))) {
+			debug_info("ERROR: X509V3_EXT_conf_nid failed");
+		}
+		X509_add_ext(host_cert, ext, -1);
+
+		/* set key validity */
+		ASN1_TIME* asn1time = ASN1_TIME_new();
+		ASN1_TIME_set(asn1time, time(NULL));
+		X509_set_notBefore(host_cert, asn1time);
+		ASN1_TIME_set(asn1time, time(NULL) + (60 * 60 * 24 * 365 * 10));
+		X509_set_notAfter(host_cert, asn1time);
+		ASN1_TIME_free(asn1time);
+
+		/* use host public key for host cert */	
+		X509_set_pubkey(host_cert, host_pkey);
+
+		/* sign host cert with root private key */
+		X509_sign(host_cert, root_pkey, EVP_sha1());
+	}
+
+	if (root_cert && root_pkey && host_cert && host_pkey) {
+		BIO* membp;
+
+		membp = BIO_new(BIO_s_mem());
+		if (PEM_write_bio_X509(membp, root_cert) > 0) {
+			root_cert_pem.size = BIO_get_mem_data(membp, &root_cert_pem.data);
+		}
+		membp = BIO_new(BIO_s_mem());
+		if (PEM_write_bio_PrivateKey(membp, root_pkey, NULL, NULL, 0, 0, NULL) > 0) {
+			root_key_pem.size = BIO_get_mem_data(membp, &root_key_pem.data);
+		}
+		membp = BIO_new(BIO_s_mem());
+		if (PEM_write_bio_X509(membp, host_cert) > 0) {
+			host_cert_pem.size = BIO_get_mem_data(membp, &host_cert_pem.data);
+		}
+		membp = BIO_new(BIO_s_mem());
+		if (PEM_write_bio_PrivateKey(membp, host_pkey, NULL, NULL, 0, 0, NULL) > 0) {
+			host_key_pem.size = BIO_get_mem_data(membp, &host_key_pem.data);
+		}
+	}
+
+	EVP_PKEY_free(root_pkey);
+	EVP_PKEY_free(host_pkey);
+
+	X509_free(host_cert);
+	X509_free(root_cert);
+#else
 	gnutls_x509_privkey_t root_privkey;
 	gnutls_x509_crt_t root_cert;
 	gnutls_x509_privkey_t host_privkey;
@@ -697,8 +822,6 @@ static userpref_error_t userpref_gen_keys_and_cert(void)
 	/* export to PEM format */
 	size_t root_key_export_size = 0;
 	size_t host_key_export_size = 0;
-	gnutls_datum_t root_key_pem = { NULL, 0 };
-	gnutls_datum_t host_key_pem = { NULL, 0 };
 
 	gnutls_x509_privkey_export(root_privkey, GNUTLS_X509_FMT_PEM, NULL, &root_key_export_size);
 	gnutls_x509_privkey_export(host_privkey, GNUTLS_X509_FMT_PEM, NULL, &host_key_export_size);
@@ -713,8 +836,6 @@ static userpref_error_t userpref_gen_keys_and_cert(void)
 
 	size_t root_cert_export_size = 0;
 	size_t host_cert_export_size = 0;
-	gnutls_datum_t root_cert_pem = { NULL, 0 };
-	gnutls_datum_t host_cert_pem = { NULL, 0 };
 
 	gnutls_x509_crt_export(root_cert, GNUTLS_X509_FMT_PEM, NULL, &root_cert_export_size);
 	gnutls_x509_crt_export(host_cert, GNUTLS_X509_FMT_PEM, NULL, &host_cert_export_size);
@@ -727,6 +848,10 @@ static userpref_error_t userpref_gen_keys_and_cert(void)
 	gnutls_x509_crt_export(host_cert, GNUTLS_X509_FMT_PEM, host_cert_pem.data, &host_cert_export_size);
 	host_cert_pem.size = host_cert_export_size;
 
+	//restore gnutls env
+	gnutls_global_deinit();
+	gnutls_global_init();
+#endif
 	if (NULL != root_cert_pem.data && 0 != root_cert_pem.size &&
 		NULL != host_cert_pem.data && 0 != host_cert_pem.size)
 		ret = USERPREF_E_SUCCESS;
@@ -734,14 +859,14 @@ static userpref_error_t userpref_gen_keys_and_cert(void)
 	/* store values in config file */
 	userpref_set_keys_and_certs( &root_key_pem, &root_cert_pem, &host_key_pem, &host_cert_pem);
 
-	gnutls_free(root_key_pem.data);
-	gnutls_free(root_cert_pem.data);
-	gnutls_free(host_key_pem.data);
-	gnutls_free(host_cert_pem.data);
-
-	//restore gnutls env
-	gnutls_global_deinit();
-	gnutls_global_init();
+	if (root_key_pem.data)
+		free(root_key_pem.data);
+	if (root_cert_pem.data)
+		free(root_cert_pem.data);
+	if (host_key_pem.data)
+		free(host_key_pem.data);
+	if (host_cert_pem.data)
+		free(host_cert_pem.data);
 
 	return ret;
 }
@@ -754,18 +879,33 @@ static userpref_error_t userpref_gen_keys_and_cert(void)
  *
  * @return 1 if the key was successfully imported.
  */
+#ifdef HAVE_OPENSSL
+static userpref_error_t userpref_import_key(const char* key_name, key_data_t* key)
+#else
 static userpref_error_t userpref_import_key(const char* key_name, gnutls_x509_privkey_t key)
+#endif
 {
+#ifdef HAVE_OPENSSL
+	if (!key)
+		return USERPREF_E_SUCCESS;
+#endif
 	userpref_error_t ret = USERPREF_E_INVALID_CONF;
-	gnutls_datum_t pem_key = { NULL, 0 };
-
+	key_data_t pem_key = { NULL, 0 };
 	if (userpref_get_file_contents(key_name, &pem_key)) {
-			if (GNUTLS_E_SUCCESS == gnutls_x509_privkey_import(key, &pem_key, GNUTLS_X509_FMT_PEM))
-				ret = USERPREF_E_SUCCESS;
-			else
-				ret = USERPREF_E_SSL_ERROR;
+#ifdef HAVE_OPENSSL
+		key->data = (unsigned char*)malloc(pem_key.size);
+		memcpy(key->data, pem_key.data, pem_key.size);
+		key->size = pem_key.size;
+		ret = USERPREF_E_SUCCESS;
+#else
+		if (GNUTLS_E_SUCCESS == gnutls_x509_privkey_import(key, &pem_key, GNUTLS_X509_FMT_PEM))
+			ret = USERPREF_E_SUCCESS;
+		else
+			ret = USERPREF_E_SSL_ERROR;
+#endif
 	}
-	gnutls_free(pem_key.data);
+	if (pem_key.data)
+		free(pem_key.data);
 	return ret;
 }
 
@@ -777,18 +917,34 @@ static userpref_error_t userpref_import_key(const char* key_name, gnutls_x509_pr
  *
  * @return IDEVICE_E_SUCCESS if the certificate was successfully imported.
  */
+#ifdef HAVE_OPENSSL
+static userpref_error_t userpref_import_crt(const char* crt_name, key_data_t* cert)
+#else
 static userpref_error_t userpref_import_crt(const char* crt_name, gnutls_x509_crt_t cert)
+#endif
 {
+#ifdef HAVE_OPENSSL
+	if (!cert)
+		return USERPREF_E_SUCCESS;
+#endif
 	userpref_error_t ret = USERPREF_E_INVALID_CONF;
-	gnutls_datum_t pem_cert = { NULL, 0 };
+	key_data_t pem_cert = { NULL, 0 };
 
 	if (userpref_get_file_contents(crt_name, &pem_cert)) {
-			if (GNUTLS_E_SUCCESS == gnutls_x509_crt_import(cert, &pem_cert, GNUTLS_X509_FMT_PEM))
-				ret = USERPREF_E_SUCCESS;
-			else
-				ret = USERPREF_E_SSL_ERROR;
+#ifdef HAVE_OPENSSL
+		cert->data = (unsigned char*)malloc(pem_cert.size);
+		memcpy(cert->data, pem_cert.data, pem_cert.size);
+		cert->size = pem_cert.size;
+		ret = USERPREF_E_SUCCESS;
+#else
+		if (GNUTLS_E_SUCCESS == gnutls_x509_crt_import(cert, &pem_cert, GNUTLS_X509_FMT_PEM))
+			ret = USERPREF_E_SUCCESS;
+		else
+			ret = USERPREF_E_SSL_ERROR;
+#endif
 	}
-	gnutls_free(pem_cert.data);
+	if (pem_cert.data)
+		free(pem_cert.data);
 	return ret;
 }
 
@@ -805,7 +961,11 @@ static userpref_error_t userpref_import_crt(const char* crt_name, gnutls_x509_cr
  *
  * @return 1 if the keys and certificates were successfully retrieved, 0 otherwise
  */
+#ifdef HAVE_OPENSSL
+userpref_error_t userpref_get_keys_and_certs(key_data_t* root_privkey, key_data_t* root_crt, key_data_t* host_privkey, key_data_t* host_crt)
+#else
 userpref_error_t userpref_get_keys_and_certs(gnutls_x509_privkey_t root_privkey, gnutls_x509_crt_t root_crt, gnutls_x509_privkey_t host_privkey, gnutls_x509_crt_t host_crt)
+#endif
 {
 	userpref_error_t ret = USERPREF_E_SUCCESS;
 
@@ -821,7 +981,6 @@ userpref_error_t userpref_get_keys_and_certs(gnutls_x509_privkey_t root_privkey,
 	if (ret == USERPREF_E_SUCCESS)
 		ret = userpref_import_crt(LIBIMOBILEDEVICE_HOST_CERTIF, host_crt);
 
-
 	if (USERPREF_E_SUCCESS != ret) {
 		//we had problem reading or importing root cert
 		//try with a new ones.
@@ -851,7 +1010,7 @@ userpref_error_t userpref_get_keys_and_certs(gnutls_x509_privkey_t root_privkey,
  *
  * @return 1 if the certificates were successfully retrieved, 0 otherwise
  */
-userpref_error_t userpref_get_certs_as_pem(gnutls_datum_t *pem_root_cert, gnutls_datum_t *pem_host_cert)
+userpref_error_t userpref_get_certs_as_pem(key_data_t *pem_root_cert, key_data_t *pem_host_cert)
 {
 	if (!pem_root_cert || !pem_host_cert)
 		return USERPREF_E_INVALID_ARG;
@@ -859,8 +1018,14 @@ userpref_error_t userpref_get_certs_as_pem(gnutls_datum_t *pem_root_cert, gnutls
 	if (userpref_get_file_contents(LIBIMOBILEDEVICE_ROOT_CERTIF, pem_root_cert) && userpref_get_file_contents(LIBIMOBILEDEVICE_HOST_CERTIF, pem_host_cert))
 		return USERPREF_E_SUCCESS;
 	else {
-		gnutls_free(pem_root_cert->data);
-		gnutls_free(pem_host_cert->data);
+		if (pem_root_cert->data) {
+			free(pem_root_cert->data);
+			pem_root_cert->size = 0;
+		}
+		if (pem_host_cert->data) {
+			free(pem_host_cert->data);
+			pem_host_cert->size = 0;
+		}
 	}
 	return USERPREF_E_INVALID_CONF;
 }
@@ -877,7 +1042,7 @@ userpref_error_t userpref_get_certs_as_pem(gnutls_datum_t *pem_root_cert, gnutls
  *
  * @return 1 on success and 0 otherwise.
  */
-userpref_error_t userpref_set_keys_and_certs(gnutls_datum_t * root_key, gnutls_datum_t * root_cert, gnutls_datum_t * host_key, gnutls_datum_t * host_cert)
+userpref_error_t userpref_set_keys_and_certs(key_data_t * root_key, key_data_t * root_cert, key_data_t * host_key, key_data_t * host_cert)
 {
 	FILE *pFile;
 	char *pem;
diff --git a/src/userpref.h b/src/userpref.h
index e16fd65..0e959ba 100644
--- a/src/userpref.h
+++ b/src/userpref.h
@@ -22,7 +22,19 @@
 #ifndef USERPREF_H
 #define USERPREF_H
 
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#ifdef HAVE_OPENSSL
+typedef struct {
+	unsigned char *data;
+	unsigned int size;
+} key_data_t;
+#else
 #include <gnutls/gnutls.h>
+typedef gnutls_datum_t key_data_t;
+#endif
 
 #ifndef LIBIMOBILEDEVICE_INTERNAL
 #ifdef WIN32
@@ -41,10 +53,14 @@
 
 typedef int16_t userpref_error_t;
 
+#ifdef HAVE_OPENSSL
+LIBIMOBILEDEVICE_INTERNAL userpref_error_t userpref_get_keys_and_certs(key_data_t* root_privkey, key_data_t* root_crt, key_data_t* host_privkey, key_data_t* host_crt);
+#else
 LIBIMOBILEDEVICE_INTERNAL userpref_error_t userpref_get_keys_and_certs(gnutls_x509_privkey_t root_privkey, gnutls_x509_crt_t root_crt, gnutls_x509_privkey_t host_privkey, gnutls_x509_crt_t host_crt);
-LIBIMOBILEDEVICE_INTERNAL userpref_error_t userpref_set_keys_and_certs(gnutls_datum_t * root_key, gnutls_datum_t * root_cert, gnutls_datum_t * host_key, gnutls_datum_t * host_cert);
-LIBIMOBILEDEVICE_INTERNAL userpref_error_t userpref_get_certs_as_pem(gnutls_datum_t *pem_root_cert, gnutls_datum_t *pem_host_cert);
-LIBIMOBILEDEVICE_INTERNAL userpref_error_t userpref_set_device_public_key(const char *uuid, gnutls_datum_t public_key);
+#endif
+LIBIMOBILEDEVICE_INTERNAL userpref_error_t userpref_set_keys_and_certs(key_data_t * root_key, key_data_t * root_cert, key_data_t * host_key, key_data_t * host_cert);
+LIBIMOBILEDEVICE_INTERNAL userpref_error_t userpref_get_certs_as_pem(key_data_t *pem_root_cert, key_data_t *pem_host_cert);
+LIBIMOBILEDEVICE_INTERNAL userpref_error_t userpref_set_device_public_key(const char *uuid, key_data_t public_key);
 userpref_error_t userpref_remove_device_public_key(const char *uuid);
 LIBIMOBILEDEVICE_INTERNAL int userpref_has_device_public_key(const char *uuid);
 userpref_error_t userpref_get_paired_uuids(char ***list, unsigned int *count);