diff options
| -rw-r--r-- | README | 22 | ||||
| -rw-r--r-- | configure.ac | 4 | ||||
| -rw-r--r-- | src/Makefile.am | 8 | ||||
| -rw-r--r-- | src/initconf.c | 213 | ||||
| -rw-r--r-- | src/lockdown.c | 160 | ||||
| -rw-r--r-- | src/lockdown.h | 8 | ||||
| -rw-r--r-- | src/userpref.c | 324 | ||||
| -rw-r--r-- | src/userpref.h | 50 |
8 files changed, 373 insertions, 416 deletions
@@ -7,10 +7,11 @@ For: You must have: libgnutls-dev + libgcrypt-dev libusb-dev libfuse-dev (and the associated kernel modules) libglib2.0-dev - libxml2-dev + libplist-dev make autoheader automake @@ -22,31 +23,12 @@ To compile run: ./configure make sudo make install # (if you want to install it into your system directories) - libiphone-initconf # (as the user you intend to user the library) On Ubuntu/Debian, you can do: sudo apt-get install build-essential automake autoconf \ libgnutls-dev libusb-dev libfuse-dev libglib2.0-dev libxml2-dev \ libreadline5-dev -USAGE -================================================================================ - -Now comes the fun bit! - -== Generating keys == - -IMPORTANT: Before using the library you must run "libiphone-initconf" -as your own user (not root). It will generate keys and a host id for your -system to be able to communicate with 'lockdownd' on the iPhone. - -It will probably take 5-10 minutes, but thankfully only needs to be -run _once_. It MUST be run otherwise communication will not work: - - libiphone-initconf - -The generated keys are saved in '~/.config/libiphone/' in your home directory. - == Who/what/where? == wiki: diff --git a/configure.ac b/configure.ac index 29f9be3..e2f98c7 100644 --- a/configure.ac +++ b/configure.ac @@ -25,11 +25,11 @@ PKG_CHECK_MODULES(libglib2, glib-2.0 >= 2.14.1) PKG_CHECK_MODULES(libgthread2, gthread-2.0 >= 2.14.1) PKG_CHECK_MODULES(libgnutls, gnutls >= 1.6.3 gnutls <= 2.5.0 ) PKG_CHECK_MODULES(libtasn1, libtasn1 >= 1.1) -PKG_CHECK_MODULES(libplist, libplist >= 0.1.0) +PKG_CHECK_MODULES(libplist, libplist >= 0.10) # Checks for header files. AC_HEADER_STDC -AC_CHECK_HEADERS([arpa/inet.h stdint.h stdlib.h string.h]) +AC_CHECK_HEADERS([arpa/inet.h stdint.h stdlib.h string.h gcrypt.h]) # Checks for typedefs, structures, and compiler characteristics. AC_C_CONST diff --git a/src/Makefile.am b/src/Makefile.am index 71667ae..a10254c 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -3,13 +3,5 @@ INCLUDES = -I$(top_srcdir)/include AM_CFLAGS = $(GLOBAL_CFLAGS) $(libusb_CFLAGS) $(libglib2_CFLAGS) $(libgnutls_CFLAGS) $(libtasn1_CFLAGS) $(libgthread2_CFLAGS) $(libplist_CFLAGS) $(LFS_CFLAGS) AM_LDFLAGS = $(libusb_LIBS) $(libglib2_LIBS) $(libgnutls_LIBS) $(libtasn1_LIBS) $(libgthread2_LIBS) $(libplist_LIBS) -bin_PROGRAMS = libiphone-initconf - - -libiphone_initconf_SOURCES = initconf.c userpref.c utils.c -libiphone_initconf_CFLAGS = $(libgthread2_CFLAGS) $(AM_CFLAGS) -libiphone_initconf_LDFLAGS = $(libgthread2_LIBS) $(AM_LDFLAGS) - - lib_LTLIBRARIES = libiphone.la libiphone_la_SOURCES = usbmux.c iphone.c lockdown.c AFC.c NotificationProxy.c userpref.c utils.c MobileSync.c diff --git a/src/initconf.c b/src/initconf.c deleted file mode 100644 index 538f344..0000000 --- a/src/initconf.c +++ /dev/null @@ -1,213 +0,0 @@ -/* - * userpref.c - * contains methods to access user specific certificates IDs and more. - * - * Copyright (c) 2008 Jonathan Beck All Rights Reserved. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA - */ - -#include <stdio.h> -#include <stdlib.h> -#include <string.h> -#include <gnutls/gnutls.h> -#include <gnutls/x509.h> -#include <glib.h> - -#include "libiphone/libiphone.h" -#include "userpref.h" -#include "utils.h" - -/** Generates a 2048 byte key, split into a function so that it can be run in a - * thread. - * - * @param key The pointer to the desired location of the new key. - */ -static void generate_key(gpointer key) -{ - gnutls_x509_privkey_generate(*((gnutls_x509_privkey_t *) key), GNUTLS_PK_RSA, 2048, 0); - g_thread_exit(0); -} - -/** Simple function that generates a spinner until the mutex is released. - */ -static void progress_bar(gpointer mutex) -{ - const char *spinner = "|/-\\|/-\\"; - int i = 0; - - while (!g_static_mutex_trylock((GStaticMutex *) mutex)) { - usleep(500000); - printf("Generating key... %c\r", spinner[i++]); - fflush(stdout); - if (i > 8) - i = 0; - } - printf("Generating key... done\n"); - g_thread_exit(0); -} - -int get_rand(int min, int max) -{ - int retval = (rand() % (max - min)) + min; - return retval; -} - -/** Generates a valid HostID (which is actually a UUID). - * - * @param A null terminated string containing a valid HostID. - */ -char *lockdownd_generate_hostid() -{ - char *hostid = (char *) malloc(sizeof(char) * 37); // HostID's are just UUID's, and UUID's are 36 characters long - const char *chars = "ABCDEF0123456789"; - srand(time(NULL)); - int i = 0; - - for (i = 0; i < 36; i++) { - if (i == 8 || i == 13 || i == 18 || i == 23) { - hostid[i] = '-'; - continue; - } else { - hostid[i] = chars[get_rand(0, 16)]; - } - } - hostid[36] = '\0'; // make it a real string - return hostid; -} - -int main(int argc, char *argv[]) -{ - GThread *progress_thread, *key_thread; - GError *err; - static GStaticMutex mutex = G_STATIC_MUTEX_INIT; - char *host_id = NULL; - gnutls_x509_privkey_t root_privkey; - gnutls_x509_privkey_t host_privkey; - gnutls_x509_crt_t root_cert; - gnutls_x509_crt_t host_cert; - - iphone_set_debug(1); - - // Create the thread - if (!g_thread_supported()) { - g_thread_init(NULL); - } - gnutls_global_init(); - - printf("This program generates keys required to connect with the iPhone\n"); - printf("It only needs to be run ONCE.\n\n"); - printf("Additionally it may take several minutes to run, please be patient.\n\n"); - - - gnutls_x509_privkey_init(&root_privkey); - gnutls_x509_privkey_init(&host_privkey); - - gnutls_x509_crt_init(&root_cert); - gnutls_x509_crt_init(&host_cert); - - /* generate HostID */ - host_id = lockdownd_generate_hostid(); - - /* generate root key */ - g_static_mutex_lock(&mutex); - if ((key_thread = g_thread_create((GThreadFunc) generate_key, &root_privkey, TRUE, &err)) == NULL) { - printf("Thread create failed: %s!!\n", err->message); - g_error_free(err); - } - if ((progress_thread = g_thread_create((GThreadFunc) progress_bar, &mutex, TRUE, &err)) == NULL) { - printf("Thread create failed: %s!!\n", err->message); - g_error_free(err); - } - g_thread_join(key_thread); - g_static_mutex_unlock(&mutex); - g_thread_join(progress_thread); - - /* generate host key */ - g_static_mutex_init(&mutex); - g_static_mutex_lock(&mutex); - if ((key_thread = g_thread_create((GThreadFunc) generate_key, &host_privkey, TRUE, &err)) == NULL) { - printf("Thread create failed: %s!!\n", err->message); - g_error_free(err); - } - if ((progress_thread = g_thread_create((GThreadFunc) progress_bar, &mutex, TRUE, &err)) == NULL) { - printf("Thread create failed: %s!!\n", err->message); - g_error_free(err); - } - g_thread_join(key_thread); - g_static_mutex_unlock(&mutex); - g_thread_join(progress_thread); - - /* generate certificates */ - gnutls_x509_crt_set_key(root_cert, root_privkey); - gnutls_x509_crt_set_serial(root_cert, "\x00", 1); - gnutls_x509_crt_set_version(root_cert, 3); - gnutls_x509_crt_set_ca_status(root_cert, 1); - gnutls_x509_crt_set_activation_time(root_cert, time(NULL)); - gnutls_x509_crt_set_expiration_time(root_cert, time(NULL) + (60 * 60 * 24 * 365 * 10)); - gnutls_x509_crt_sign(root_cert, root_cert, root_privkey); - - - gnutls_x509_crt_set_key(host_cert, host_privkey); - gnutls_x509_crt_set_serial(host_cert, "\x00", 1); - gnutls_x509_crt_set_version(host_cert, 3); - gnutls_x509_crt_set_ca_status(host_cert, 0); - gnutls_x509_crt_set_key_usage(host_cert, GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_DIGITAL_SIGNATURE); - gnutls_x509_crt_set_activation_time(host_cert, time(NULL)); - gnutls_x509_crt_set_expiration_time(host_cert, time(NULL) + (60 * 60 * 24 * 365 * 10)); - gnutls_x509_crt_sign(host_cert, root_cert, root_privkey); - - - /* export to PEM format */ - gnutls_datum_t root_key_pem = { NULL, 0 }; - gnutls_datum_t host_key_pem = { NULL, 0 }; - - gnutls_x509_privkey_export(root_privkey, GNUTLS_X509_FMT_PEM, NULL, &root_key_pem.size); - gnutls_x509_privkey_export(host_privkey, GNUTLS_X509_FMT_PEM, NULL, &host_key_pem.size); - - root_key_pem.data = gnutls_malloc(root_key_pem.size); - host_key_pem.data = gnutls_malloc(host_key_pem.size); - - gnutls_x509_privkey_export(root_privkey, GNUTLS_X509_FMT_PEM, root_key_pem.data, &root_key_pem.size); - gnutls_x509_privkey_export(host_privkey, GNUTLS_X509_FMT_PEM, host_key_pem.data, &host_key_pem.size); - - gnutls_datum_t root_cert_pem = { NULL, 0 }; - gnutls_datum_t host_cert_pem = { NULL, 0 }; - - gnutls_x509_crt_export(root_cert, GNUTLS_X509_FMT_PEM, NULL, &root_cert_pem.size); - gnutls_x509_crt_export(host_cert, GNUTLS_X509_FMT_PEM, NULL, &host_cert_pem.size); - - root_cert_pem.data = gnutls_malloc(root_cert_pem.size); - host_cert_pem.data = gnutls_malloc(host_cert_pem.size); - - printf("Generating root certificate..."); - gnutls_x509_crt_export(root_cert, GNUTLS_X509_FMT_PEM, root_cert_pem.data, &root_cert_pem.size); - printf("done\n"); - - printf("Generating host certificate..."); - gnutls_x509_crt_export(host_cert, GNUTLS_X509_FMT_PEM, host_cert_pem.data, &host_cert_pem.size); - printf("done\n"); - - - /* store values in config file */ - init_config_file(host_id, &root_key_pem, &host_key_pem, &root_cert_pem, &host_cert_pem); - - gnutls_free(root_key_pem.data); - gnutls_free(host_key_pem.data); - gnutls_free(root_cert_pem.data); - gnutls_free(host_cert_pem.data); - - return 0; -} diff --git a/src/lockdown.c b/src/lockdown.c index 63f9090..e720b29 100644 --- a/src/lockdown.c +++ b/src/lockdown.c @@ -1,22 +1,22 @@ /* * lockdown.c * libiphone built-in lockdownd client - * + * * Copyright (c) 2008 Zach C. All Rights Reserved. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. - * + * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. - * + * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ #include "usbmux.h" @@ -67,7 +67,7 @@ iphone_lckd_client_t new_lockdownd_client(iphone_device_t phone) /** * Closes the lockdownd communication session, by sending - * the StopSession Request to the device. + * the StopSession Request to the device. * * @param control The lockdown client */ @@ -128,7 +128,7 @@ static void iphone_lckd_stop_session(iphone_lckd_client_t control) /** * Shuts down the SSL session by first calling iphone_lckd_stop_session - * to cleanly close the lockdownd communication session, and then + * to cleanly close the lockdownd communication session, and then * performing a close notify, which is done by "gnutls_bye". * * @param client The lockdown client @@ -219,6 +219,7 @@ iphone_error_t iphone_lckd_recv(iphone_lckd_client_t client, plist_t * plist) return IPHONE_E_NOT_ENOUGH_DATA; } + log_dbg_msg(DBGMASK_LOCKDOWND, "Recv msg :\nsize : %i\nbuffer :\n%s\n", bytes, receive); plist_from_xml(receive, bytes, plist); free(receive); @@ -229,7 +230,7 @@ iphone_error_t iphone_lckd_recv(iphone_lckd_client_t client, plist_t * plist) } /** Sends lockdownd data to the iPhone - * + * * @note This function is low-level and should only be used if you need to send * a new type of message. * @@ -272,7 +273,7 @@ iphone_error_t iphone_lckd_send(iphone_lckd_client_t client, plist_t plist) } /** Initiates the handshake for the lockdown session. Part of the lockdownd handshake. - * + * * @note You most likely want lockdownd_init unless you are doing something special. * * @param control The lockdownd client @@ -338,7 +339,7 @@ iphone_error_t lockdownd_hello(iphone_lckd_client_t control) * * @return IPHONE_E_SUCCESS on success. */ -iphone_error_t lockdownd_generic_get_value(iphone_lckd_client_t control, const char *req_key, char *req_string, +iphone_error_t lockdownd_generic_get_value(iphone_lckd_client_t control, const char *req_key, const char *req_string, gnutls_datum_t * value) { if (!control || !req_key || !value || value->data) @@ -396,7 +397,7 @@ iphone_error_t lockdownd_generic_get_value(iphone_lckd_client_t control, const c return ret; } - plist_t value_key_node = plist_get_next_sibling(result_key_node); + plist_t value_key_node = plist_find_node_by_key(dict, "Value");//plist_get_next_sibling(result_value_node); plist_t value_value_node = plist_get_next_sibling(value_key_node); plist_type value_key_type = plist_get_node_type(value_key_node); @@ -418,6 +419,16 @@ iphone_error_t lockdownd_generic_get_value(iphone_lckd_client_t control, const c value->size = strlen(value_value); ret = IPHONE_E_SUCCESS; } + + if (PLIST_DATA == value_value_type) { + char *value_value = NULL; + uint64_t size = 0; + plist_get_data_val(value_value_node, &value_value, &size); + + value->data = value_value; + value->size = size; + ret = IPHONE_E_SUCCESS; + } } free(result_key); } @@ -435,8 +446,9 @@ iphone_error_t lockdownd_generic_get_value(iphone_lckd_client_t control, const c iphone_error_t lockdownd_get_device_uid(iphone_lckd_client_t control, char **uid) { gnutls_datum_t temp = { NULL, 0 }; - return lockdownd_generic_get_value(control, "Key", "UniqueDeviceID", &temp); + iphone_error_t ret = lockdownd_generic_get_value(control, "Key", "UniqueDeviceID", &temp); *uid = temp.data; + return ret; } /** Askes for the device's public key. Part of the lockdownd handshake. @@ -480,6 +492,7 @@ iphone_error_t iphone_lckd_new_client(iphone_device_t device, iphone_lckd_client if (IPHONE_E_SUCCESS != ret) { log_debug_msg("Device refused to send uid.\n"); } + log_debug_msg("Device uid: %s\n", uid); host_id = get_host_id(); if (IPHONE_E_SUCCESS == ret && !host_id) { @@ -495,19 +508,22 @@ iphone_error_t iphone_lckd_new_client(iphone_device_t device, iphone_lckd_client uid = NULL; } - ret = lockdownd_start_SSL_session(client_loc, host_id); - if (IPHONE_E_SUCCESS != ret) { - ret = IPHONE_E_SSL_ERROR; - log_debug_msg("SSL Session opening failed.\n"); - } + if (IPHONE_E_SUCCESS == ret) { + ret = lockdownd_start_SSL_session(client_loc, host_id); + if (IPHONE_E_SUCCESS != ret) { + ret = IPHONE_E_SSL_ERROR; + log_debug_msg("SSL Session opening failed.\n"); + } - if (host_id) { - free(host_id); - host_id = NULL; + if (host_id) { + free(host_id); + host_id = NULL; + } + + if (IPHONE_E_SUCCESS == ret) + *client = client_loc; } - if (IPHONE_E_SUCCESS == ret) - *client = client_loc; return ret; } @@ -534,6 +550,7 @@ iphone_error_t lockdownd_pair_device(iphone_lckd_client_t control, char *uid, ch log_debug_msg("Device refused to send public key.\n"); return ret; } + log_debug_msg("device public key :\n %s.\n", public_key.data); ret = lockdownd_gen_pair_cert(public_key, &device_cert, &host_cert, &root_cert); if (ret != IPHONE_E_SUCCESS) { @@ -547,15 +564,15 @@ iphone_error_t lockdownd_pair_device(iphone_lckd_client_t control, char *uid, ch dict_record = plist_new_dict(); plist_add_sub_node(dict, dict_record); plist_add_sub_key_el(dict_record, "DeviceCertificate"); - plist_add_sub_data_el(dict_record, device_cert.data, device_cert.size); + plist_add_sub_data_el(dict_record, (const char*)device_cert.data, device_cert.size); plist_add_sub_key_el(dict_record, "HostCertificate"); - plist_add_sub_data_el(dict_record, host_cert.data, host_cert.size); + plist_add_sub_data_el(dict_record, (const char*)host_cert.data, host_cert.size); plist_add_sub_key_el(dict_record, "HostID"); plist_add_sub_string_el(dict_record, host_id); plist_add_sub_key_el(dict_record, "RootCertificate"); - plist_add_sub_data_el(dict_record, root_cert.data, root_cert.size); - plist_add_sub_key_el(dict_record, "Request"); - plist_add_sub_string_el(dict_record, "Pair"); + plist_add_sub_data_el(dict_record, (const char*)root_cert.data, root_cert.size); + plist_add_sub_key_el(dict, "Request"); + plist_add_sub_string_el(dict, "Pair"); /* send to iPhone */ ret = iphone_lckd_send(control, dict); @@ -667,7 +684,7 @@ void lockdownd_close(iphone_lckd_client_t control) /** Generates the device certificate from the public key as well as the host * and root certificates. - * + * * @return IPHONE_E_SUCCESS on success. */ iphone_error_t lockdownd_gen_pair_cert(gnutls_datum_t public_key, gnutls_datum_t * odevice_cert, @@ -718,7 +735,7 @@ iphone_error_t lockdownd_gen_pair_cert(gnutls_datum_t public_key, gnutls_datum_t gnutls_global_init(); gnutls_datum_t essentially_null = { strdup("abababababababab"), strlen("abababababababab") }; - gnutls_x509_privkey_t fake_privkey, root_privkey; + gnutls_x509_privkey_t fake_privkey, root_privkey, host_privkey; gnutls_x509_crt_t dev_cert, root_cert, host_cert; gnutls_x509_privkey_init(&fake_privkey); @@ -731,57 +748,50 @@ iphone_error_t lockdownd_gen_pair_cert(gnutls_datum_t public_key, gnutls_datum_t &essentially_null, &essentially_null)) { gnutls_x509_privkey_init(&root_privkey); + gnutls_x509_privkey_init(&host_privkey); - /* get root cert */ - gnutls_datum_t pem_root_cert = { NULL, 0 }; - get_root_certificate(&pem_root_cert); - if (GNUTLS_E_SUCCESS != gnutls_x509_crt_import(root_cert, &pem_root_cert, GNUTLS_X509_FMT_PEM)) - ret = IPHONE_E_SSL_ERROR; - - /* get host cert */ - gnutls_datum_t pem_host_cert = { NULL, 0 }; - get_host_certificate(&pem_host_cert); - if (GNUTLS_E_SUCCESS != gnutls_x509_crt_import(host_cert, &pem_host_cert, GNUTLS_X509_FMT_PEM)) - ret = IPHONE_E_SSL_ERROR; - - /* get root private key */ - gnutls_datum_t pem_root_priv = { NULL, 0 }; - get_root_private_key(&pem_root_priv); - if (GNUTLS_E_SUCCESS != gnutls_x509_privkey_import(root_privkey, &pem_root_priv, GNUTLS_X509_FMT_PEM)) - ret = IPHONE_E_SSL_ERROR; - - /* generate device certificate */ - gnutls_x509_crt_set_key(dev_cert, fake_privkey); - gnutls_x509_crt_set_serial(dev_cert, "\x00", 1); - gnutls_x509_crt_set_version(dev_cert, 3); - gnutls_x509_crt_set_ca_status(dev_cert, 0); - gnutls_x509_crt_set_activation_time(dev_cert, time(NULL)); - gnutls_x509_crt_set_expiration_time(dev_cert, time(NULL) + (60 * 60 * 24 * 365 * 10)); - gnutls_x509_crt_sign(dev_cert, root_cert, root_privkey); + ret = get_keys_and_certs( root_privkey, root_cert, host_privkey, host_cert); if (IPHONE_E_SUCCESS == ret) { - /* if everything went well, export in PEM format */ - gnutls_datum_t dev_pem = { NULL, 0 }; - gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, NULL, &dev_pem.size); - dev_pem.data = gnutls_malloc(dev_pem.size); - gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, dev_pem.data, &dev_pem.size); - - /* copy buffer for output */ - odevice_cert->data = malloc(dev_pem.size); - memcpy(odevice_cert->data, dev_pem.data, dev_pem.size); - odevice_cert->size = dev_pem.size; - - ohost_cert->data = malloc(pem_host_cert.size); - memcpy(ohost_cert->data, pem_host_cert.data, pem_host_cert.size); - ohost_cert->size = pem_host_cert.size; - - oroot_cert->data = malloc(pem_root_cert.size); - memcpy(oroot_cert->data, pem_root_cert.data, pem_root_cert.size); - oroot_cert->size = pem_root_cert.size; + + /* generate device certificate */ + gnutls_x509_crt_set_key(dev_cert, fake_privkey); + gnutls_x509_crt_set_serial(dev_cert, "\x00", 1); + gnutls_x509_crt_set_version(dev_cert, 3); + gnutls_x509_crt_set_ca_status(dev_cert, 0); + gnutls_x509_crt_set_activation_time(dev_cert, time(NULL)); + gnutls_x509_crt_set_expiration_time(dev_cert, time(NULL) + (60 * 60 * 24 * 365 * 10)); + gnutls_x509_crt_sign(dev_cert, root_cert, root_privkey); + + if (IPHONE_E_SUCCESS == ret) { + /* if everything went well, export in PEM format */ + gnutls_datum_t dev_pem = { NULL, 0 }; + gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, NULL, &dev_pem.size); + dev_pem.data = gnutls_malloc(dev_pem.size); + gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, dev_pem.data, &dev_pem.size); + + gnutls_datum_t pem_root_cert = { NULL, 0 }; + gnutls_datum_t pem_host_cert = { NULL, 0 }; + + if ( IPHONE_E_SUCCESS == get_certs_as_pem(&pem_root_cert, &pem_host_cert) ) { + /* copy buffer for output */ + odevice_cert->data = malloc(dev_pem.size); + memcpy(odevice_cert->data, dev_pem.data, dev_pem.size); + odevice_cert->size = dev_pem.size; + + ohost_cert->data = malloc(pem_host_cert.size); + memcpy(ohost_cert->data, pem_host_cert.data, pem_host_cert.size); + ohost_cert->size = pem_host_cert.size; + + oroot_cert->data = malloc(pem_root_cert.size); + memcpy(oroot_cert->data, pem_root_cert.data, pem_root_cert.size); + oroot_cert->size = pem_root_cert.size; + + g_free(pem_root_cert.data); + g_free(pem_host_cert.data); + } + } } - gnutls_free(pem_root_priv.data); - gnutls_free(pem_root_cert.data); - gnutls_free(pem_host_cert.data); } } diff --git a/src/lockdown.h b/src/lockdown.h index cad06a3..7485006 100644 --- a/src/lockdown.h +++ b/src/lockdown.h @@ -8,15 +8,15 @@ * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. - * + * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. - * + * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ #ifndef LOCKDOWND_H @@ -41,7 +41,7 @@ struct iphone_lckd_client_int { iphone_lckd_client_t new_lockdownd_client(iphone_device_t phone); iphone_error_t lockdownd_hello(iphone_lckd_client_t control); -iphone_error_t lockdownd_generic_get_value(iphone_lckd_client_t control, const char *req_key, char *req_string, +iphone_error_t lockdownd_generic_get_value(iphone_lckd_client_t control, const char *req_key, const char *req_string, gnutls_datum_t * value); iphone_error_t lockdownd_get_device_public_key(iphone_lckd_client_t control, gnutls_datum_t * public_key); diff --git a/src/userpref.c b/src/userpref.c index 3e5eb06..0e83133 100644 --- a/src/userpref.c +++ b/src/userpref.c @@ -8,25 +8,28 @@ * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. - * + * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. - * + * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ #include <glib.h> #include <glib/gprintf.h> #include <stdio.h> +#include <stdlib.h> #include <string.h> +#include <gnutls/gnutls.h> +#include <gnutls/x509.h> +#include <gcrypt.h> + #include "userpref.h" #include "utils.h" -#include <string.h> -#include <stdlib.h> #define LIBIPHONE_CONF_DIR "libiphone" #define LIBIPHONE_CONF_FILE "libiphonerc" @@ -49,9 +52,75 @@ static void create_config_dir(void) g_free(config_dir); } +static int get_rand(int min, int max) +{ + int retval = (rand() % (max - min)) + min; + return retval; +} + +/** Generates a valid HostID (which is actually a UUID). + * + * @return A null terminated string containing a valid HostID. + */ +static char *lockdownd_generate_hostid() +{ + char *hostid = (char *) malloc(sizeof(char) * 37); // HostID's are just UUID's, and UUID's are 36 characters long + const char *chars = "ABCDEF0123456789"; + srand(time(NULL)); + int i = 0; + + for (i = 0; i < 36; i++) { + if (i == 8 || i == 13 || i == 18 || i == 23) { + hostid[i] = '-'; + continue; + } else { + hostid[i] = chars[get_rand(0, 16)]; + } + } + hostid[36] = '\0'; // make it a real string + return hostid; +} + +/** Store HostID in config file. + * + * @param host_id A null terminated string containing a valid HostID. + */ +static int write_host_id(char *host_id) +{ + GKeyFile *key_file; + gsize length; + gchar *buf, *config_file; + GIOChannel *file; + + if (!host_id) + return 0; + + /* Make sure config directory exists */ + create_config_dir(); + + /* Now parse file to get the HostID */ + key_file = g_key_file_new(); -/** Reads the HostID from a previously generated configuration file. - * + /* Store in config file */ + log_debug_msg("init_config_file(): setting hostID to %s\n", host_id); + g_key_file_set_value(key_file, "Global", "HostID", host_id); + + /* Write config file on disk */ + buf = g_key_file_to_data(key_file, &length, NULL); + config_file = + g_build_path(G_DIR_SEPARATOR_S, g_get_user_config_dir(), LIBIPHONE_CONF_DIR, LIBIPHONE_CONF_FILE, NULL); + file = g_io_channel_new_file(config_file, "w", NULL); + g_free(config_file); + g_io_channel_write_chars(file, buf, length, NULL, NULL); + g_io_channel_shutdown(file, TRUE, NULL); + g_io_channel_unref(file); + + g_key_file_free(key_file); + return 1; +} + +/** Reads the HostID from a previously generated configuration file. + * * @note It is the responsibility of the calling function to free the returned host_id * * @return The string containing the HostID or NULL @@ -77,6 +146,12 @@ char *get_host_id(void) g_key_file_free(key_file); g_free(config_file); + if (!host_id) { + //no config, generate host_id + host_id = lockdownd_generate_hostid(); + write_host_id(host_id); + } + log_debug_msg("get_host_id(): Using %s as HostID\n", host_id); return host_id; } @@ -156,56 +231,220 @@ static int read_file_in_confdir(const char *file, gnutls_datum_t * data) g_free(filepath); /* Add it to the gnutls_datnum_t structure */ - data->data = content; + data->data = (uint8_t*) content; data->size = size; return success; } -/** Read the root private key - * - * @param root_privkey A pointer to the appropriate gnutls structure + +/** Private function which generate private keys and certificates. * - * @return 1 if the file was successfully read and 0 otherwise. + * @return IPHONE_E_SUCCESS if keys were successfully generated. */ -int get_root_private_key(gnutls_datum_t * root_privkey) +static iphone_error_t gen_keys_and_cert(void) { - return read_file_in_confdir(LIBIPHONE_ROOT_PRIVKEY, root_privkey); + iphone_error_t ret = IPHONE_E_UNKNOWN_ERROR; + gnutls_x509_privkey_t root_privkey; + gnutls_x509_privkey_t host_privkey; + gnutls_x509_crt_t root_cert; + gnutls_x509_crt_t host_cert; + + gnutls_global_deinit(); + gnutls_global_init(); + + //use less secure random to speed up key generation + gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM); + + gnutls_x509_privkey_init(&root_privkey); + gnutls_x509_privkey_init(&host_privkey); + + gnutls_x509_crt_init(&root_cert); + gnutls_x509_crt_init(&host_cert); + + /* generate root key */ + gnutls_x509_privkey_generate(root_privkey, GNUTLS_PK_RSA, 2048, 0); + gnutls_x509_privkey_generate(host_privkey, GNUTLS_PK_RSA, 2048, 0); + + /* generate certificates */ + gnutls_x509_crt_set_key(root_cert, root_privkey); + gnutls_x509_crt_set_serial(root_cert, "\x00", 1); + gnutls_x509_crt_set_version(root_cert, 3); + gnutls_x509_crt_set_ca_status(root_cert, 1); + gnutls_x509_crt_set_activation_time(root_cert, time(NULL)); + gnutls_x509_crt_set_expiration_time(root_cert, time(NULL) + (60 * 60 * 24 * 365 * 10)); + gnutls_x509_crt_sign(root_cert, root_cert, root_privkey); + + + gnutls_x509_crt_set_key(host_cert, host_privkey); + gnutls_x509_crt_set_serial(host_cert, "\x00", 1); + gnutls_x509_crt_set_version(host_cert, 3); + gnutls_x509_crt_set_ca_status(host_cert, 0); + gnutls_x509_crt_set_key_usage(host_cert, GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_DIGITAL_SIGNATURE); + gnutls_x509_crt_set_activation_time(host_cert, time(NULL)); + gnutls_x509_crt_set_expiration_time(host_cert, time(NULL) + (60 * 60 * 24 * 365 * 10)); + gnutls_x509_crt_sign(host_cert, root_cert, root_privkey); + + /* export to PEM format */ + gnutls_datum_t root_key_pem = { NULL, 0 }; + gnutls_datum_t host_key_pem = { NULL, 0 }; + + gnutls_x509_privkey_export(root_privkey, GNUTLS_X509_FMT_PEM, NULL, &root_key_pem.size); + gnutls_x509_privkey_export(host_privkey, GNUTLS_X509_FMT_PEM, NULL, &host_key_pem.size); + + root_key_pem.data = gnutls_malloc(root_key_pem.size); + host_key_pem.data = gnutls_malloc(host_key_pem.size); + + gnutls_x509_privkey_export(root_privkey, GNUTLS_X509_FMT_PEM, root_key_pem.data, &root_key_pem.size); + gnutls_x509_privkey_export(host_privkey, GNUTLS_X509_FMT_PEM, host_key_pem.data, &host_key_pem.size); + + gnutls_datum_t root_cert_pem = { NULL, 0 }; + gnutls_datum_t host_cert_pem = { NULL, 0 }; + + gnutls_x509_crt_export(root_cert, GNUTLS_X509_FMT_PEM, NULL, &root_cert_pem.size); + gnutls_x509_crt_export(host_cert, GNUTLS_X509_FMT_PEM, NULL, &host_cert_pem.size); + + root_cert_pem.data = gnutls_malloc(root_cert_pem.size); + host_cert_pem.data = gnutls_malloc(host_cert_pem.size); + + gnutls_x509_crt_export(root_cert, GNUTLS_X509_FMT_PEM, root_cert_pem.data, &root_cert_pem.size); + gnutls_x509_crt_export(host_cert, GNUTLS_X509_FMT_PEM, host_cert_pem.data, &host_cert_pem.size); + + if (NULL != root_cert_pem.data && 0 != root_cert_pem.size && + NULL != host_cert_pem.data && 0 != host_cert_pem.size) + ret = IPHONE_E_SUCCESS; + + /* store values in config file */ + init_config_file( &root_key_pem, &host_key_pem, &root_cert_pem, &host_cert_pem); + + gnutls_free(root_key_pem.data); + gnutls_free(host_key_pem.data); + gnutls_free(root_cert_pem.data); + gnutls_free(host_cert_pem.data); + + //restore gnutls env + gnutls_global_deinit(); + gnutls_global_init(); + + return ret; } -/** Read the host private key +/** Private function which import the given key into a gnutls structure. * - * @param host_privkey A pointer to the appropriate gnutls structure + * @param key_name The filename of the private key to import. + * @param key the gnutls key structure. * - * @return 1 if the file was successfully read and 0 otherwise. + * @return IPHONE_E_SUCCESS if the key was successfully imported. */ -int get_host_private_key(gnutls_datum_t * host_privkey) +static iphone_error_t import_key(const char* key_name, gnutls_x509_privkey_t key) { - return read_file_in_confdir(LIBIPHONE_HOST_PRIVKEY, host_privkey); + iphone_error_t ret = IPHONE_E_INVALID_CONF; + gnutls_datum_t pem_key = { NULL, 0 }; + + if ( read_file_in_confdir(key_name, &pem_key) ) { + if (GNUTLS_E_SUCCESS == gnutls_x509_privkey_import(key, &pem_key, GNUTLS_X509_FMT_PEM)) + ret = IPHONE_E_SUCCESS; + else + ret = IPHONE_E_SSL_ERROR; + } + gnutls_free(pem_key.data); + return ret; } -/** Read the root certificate +/** Private function which import the given certificate into a gnutls structure. * - * @param root_privkey A pointer to the appropriate gnutls structure + * @param crt_name The filename of the certificate to import. + * @param cert the gnutls certificate structure. * - * @return 1 if the file was successfully read and 0 otherwise. + * @return IPHONE_E_SUCCESS if the certificate was successfully imported. */ -int get_root_certificate(gnutls_datum_t * root_cert) +static iphone_error_t import_crt(const char* crt_name, gnutls_x509_crt_t cert) { - return read_file_in_confdir(LIBIPHONE_ROOT_CERTIF, root_cert); + iphone_error_t ret = IPHONE_E_INVALID_CONF; + gnutls_datum_t pem_cert = { NULL, 0 }; + + if ( read_file_in_confdir(crt_name, &pem_cert) ) { + if (GNUTLS_E_SUCCESS == gnutls_x509_crt_import(cert, &pem_cert, GNUTLS_X509_FMT_PEM)) + ret = IPHONE_E_SUCCESS; + else + ret = IPHONE_E_SSL_ERROR; + } + gnutls_free(pem_cert.data); + return ret; } -/** Read the host certificate +/** Function to retrieve host keys and certificates. + * This function trigger key generation if they do not exists yet or are invalid. * - * @param root_privkey A pointer to the appropriate gnutls structure + * @note This function can take few seconds to complete (typically 5 seconds) * - * @return 1 if the file was successfully read and 0 otherwise. + * @param root_privkey The root private key. + * @param root_crt The root certificate. + * @param host_privkey The host private key. + * @param host_crt The host certificate. + * + * @return IPHONE_E_SUCCESS if the keys and certificates were successfully retrieved. */ -int get_host_certificate(gnutls_datum_t * host_cert) +iphone_error_t get_keys_and_certs(gnutls_x509_privkey_t root_privkey, gnutls_x509_crt_t root_crt, gnutls_x509_privkey_t host_privkey, gnutls_x509_crt_t host_crt) { - return read_file_in_confdir(LIBIPHONE_HOST_CERTIF, host_cert); + iphone_error_t ret = IPHONE_E_SUCCESS; + + if (ret == IPHONE_E_SUCCESS) + ret = import_key(LIBIPHONE_ROOT_PRIVKEY, root_privkey); + + if (ret == IPHONE_E_SUCCESS) + ret = import_key(LIBIPHONE_HOST_PRIVKEY, host_privkey); + + if (ret == IPHONE_E_SUCCESS) + ret = import_crt(LIBIPHONE_ROOT_CERTIF, root_crt); + + if (ret == IPHONE_E_SUCCESS) + ret = import_crt(LIBIPHONE_HOST_CERTIF, host_crt); + + + if (IPHONE_E_SUCCESS != ret) { + //we had problem reading or importing root cert + //try with a new ones. + ret = gen_keys_and_cert(); + + if (ret == IPHONE_E_SUCCESS) + ret = import_key(LIBIPHONE_ROOT_PRIVKEY, root_privkey); + + if (ret == IPHONE_E_SUCCESS) + ret = import_key(LIBIPHONE_HOST_PRIVKEY, host_privkey); + + if (ret == IPHONE_E_SUCCESS) + ret = import_crt(LIBIPHONE_ROOT_CERTIF, root_crt); + + if (ret == IPHONE_E_SUCCESS) + ret = import_crt(LIBIPHONE_HOST_CERTIF, host_crt); + } + + return ret; } +/** Function to retrieve certificates encoded in PEM format. + * + * @param pem_root_cert The root certificate. + * @param pem_host_cert The host certificate. + * + * @return IPHONE_E_SUCCESS if the certificates were successfully retrieved. + */ +iphone_error_t get_certs_as_pem(gnutls_datum_t *pem_root_cert, gnutls_datum_t *pem_host_cert) +{ + iphone_error_t ret = IPHONE_E_INVALID_CONF; + + if ( !pem_root_cert || !pem_host_cert) + return IPHONE_E_INVALID_ARG; + + if ( read_file_in_confdir(LIBIPHONE_ROOT_CERTIF, pem_root_cert) && read_file_in_confdir(LIBIPHONE_HOST_CERTIF, pem_host_cert)) + ret = IPHONE_E_SUCCESS; + else { + g_free(pem_root_cert->data); + g_free(pem_host_cert->data); + } + return ret; +} /** Create and save a configuration file containing the given data. * * @note: All fields must specified and be non-null @@ -218,41 +457,18 @@ int get_host_certificate(gnutls_datum_t * host_cert) * * @return 1 on success and 0 otherwise. */ -int init_config_file(char *host_id, gnutls_datum_t * root_key, gnutls_datum_t * host_key, gnutls_datum_t * root_cert, +int init_config_file( gnutls_datum_t * root_key, gnutls_datum_t * host_key, gnutls_datum_t * root_cert, gnutls_datum_t * host_cert) { FILE *pFile; gchar *pem; - GKeyFile *key_file; - gsize length; - gchar *buf, *config_file; - GIOChannel *file; - if (!host_id || !root_key || !host_key || !root_cert || !host_cert) + if (!root_key || !host_key || !root_cert || !host_cert) return 0; /* Make sure config directory exists */ create_config_dir(); - /* Now parse file to get the HostID */ - key_file = g_key_file_new(); - - /* Store in config file */ - log_debug_msg("init_config_file(): setting hostID to %s\n", host_id); - g_key_file_set_value(key_file, "Global", "HostID", host_id); - - /* Write config file on disk */ - buf = g_key_file_to_data(key_file, &length, NULL); - config_file = - g_build_path(G_DIR_SEPARATOR_S, g_get_user_config_dir(), LIBIPHONE_CONF_DIR, LIBIPHONE_CONF_FILE, NULL); - file = g_io_channel_new_file(config_file, "w", NULL); - g_free(config_file); - g_io_channel_write_chars(file, buf, length, NULL, NULL); - g_io_channel_shutdown(file, TRUE, NULL); - g_io_channel_unref(file); - - g_key_file_free(key_file); - /* Now write keys and certificates to disk */ pem = g_build_path(G_DIR_SEPARATOR_S, g_get_user_config_dir(), LIBIPHONE_CONF_DIR, LIBIPHONE_ROOT_PRIVKEY, NULL); pFile = fopen(pem, "wb"); diff --git a/src/userpref.h b/src/userpref.h index 7e606eb..deced04 100644 --- a/src/userpref.h +++ b/src/userpref.h @@ -8,64 +8,34 @@ * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. - * + * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. - * + * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ #ifndef USERPREF_H #define USERPREF_H #include <gnutls/gnutls.h> -/** - * Method to get user's HostID. Caller must free returned buffer. - * - * @return the HostID if exist in config file. Returns NULL otherwise. - */ -char *get_host_id(void); +#include "libiphone/libiphone.h" -/** - * Determine if we already paired this device. - * - * @return 1 if device is already paired. Returns 0 otherwise. - */ -int is_device_known(char *uid); -/** - * @return 1 if everything went well. Returns 0 otherwise. - */ -int store_device_public_key(char *uid, gnutls_datum_t public_key); +iphone_error_t get_keys_and_certs(gnutls_x509_privkey_t root_privkey, gnutls_x509_crt_t root_crt, gnutls_x509_privkey_t host_privkey, gnutls_x509_crt_t host_crt); -/** - * @return 1 if everything went well. Returns 0 otherwise. - */ -int get_root_private_key(gnutls_datum_t * root_privkey); +iphone_error_t get_certs_as_pem(gnutls_datum_t *pem_root_cert, gnutls_datum_t *pem_host_cert); -/** - * @return 1 if everything went well. Returns 0 otherwise. - */ -int get_host_private_key(gnutls_datum_t * host_privkey); +char *get_host_id(void); -/** - * @return 1 if everything went well. Returns 0 otherwise. - */ -int get_root_certificate(gnutls_datum_t * root_cert); +int is_device_known(char *uid); -/** - * @return 1 if everything went well. Returns 0 otherwise. - */ -int get_host_certificate(gnutls_datum_t * host_cert); +int store_device_public_key(char *uid, gnutls_datum_t public_key); -/** - * Setup a brand new config file. - * @return 1 if everything went well. Returns 0 otherwise. - */ -int init_config_file(char *host_id, gnutls_datum_t * root_key, gnutls_datum_t * host_key, gnutls_datum_t * root_cert, +int init_config_file( gnutls_datum_t * root_key, gnutls_datum_t * host_key, gnutls_datum_t * root_cert, gnutls_datum_t * host_cert); #endif |