diff options
Diffstat (limited to 'common/userpref.c')
| -rw-r--r-- | common/userpref.c | 1171 |
1 files changed, 1171 insertions, 0 deletions
diff --git a/common/userpref.c b/common/userpref.c new file mode 100644 index 0000000..48bcfcb --- /dev/null +++ b/common/userpref.c @@ -0,0 +1,1171 @@ +/* + * userpref.c + * contains methods to access user specific certificates IDs and more. + * + * Copyright (c) 2013-2021 Nikias Bassen, All Rights Reserved. + * Copyright (c) 2013-2014 Martin Szulecki All Rights Reserved. + * Copyright (c) 2008 Jonathan Beck All Rights Reserved. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + */ + +#ifdef HAVE_CONFIG_H +#include <config.h> +#endif + +#include <stdio.h> +#include <stdint.h> +#include <stdlib.h> +#include <string.h> +#ifdef HAVE_SYS_TYPES_H +#include <sys/types.h> +#endif +#ifndef WIN32 +#include <pwd.h> +#endif +#include <unistd.h> +#include <usbmuxd.h> +#if defined(HAVE_OPENSSL) +#include <openssl/bn.h> +#include <openssl/pem.h> +#include <openssl/rsa.h> +#include <openssl/x509.h> +#include <openssl/x509v3.h> +#if OPENSSL_VERSION_NUMBER < 0x1010000fL || \ + (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x20700000L)) +#define X509_set1_notBefore X509_set_notBefore +#define X509_set1_notAfter X509_set_notAfter +#endif +#elif defined(HAVE_GNUTLS) +#include <gnutls/gnutls.h> +#include <gnutls/crypto.h> +#include <gnutls/x509.h> +#include <gcrypt.h> +#include <libtasn1.h> +#elif defined(HAVE_MBEDTLS) +#include <mbedtls/ssl.h> +#include <mbedtls/entropy.h> +#include <mbedtls/ctr_drbg.h> +#include <mbedtls/asn1write.h> +#include <mbedtls/oid.h> +#else +#error No supported TLS/SSL library enabled +#endif + +#include <dirent.h> +#include <libgen.h> +#include <sys/stat.h> +#include <errno.h> + +#ifdef WIN32 +#include <shlobj.h> +#endif + +#ifndef ETIMEDOUT +#define ETIMEDOUT 138 +#endif + +#include <libimobiledevice-glue/utils.h> + +#include "userpref.h" +#include "debug.h" + +#if defined(HAVE_GNUTLS) +const ASN1_ARRAY_TYPE pkcs1_asn1_tab[] = { + {"PKCS1", 536872976, 0}, + {0, 1073741836, 0}, + {"RSAPublicKey", 536870917, 0}, + {"modulus", 1073741827, 0}, + {"publicExponent", 3, 0}, + {0, 0, 0} +}; +#endif + +#ifdef WIN32 +#define DIR_SEP '\\' +#define DIR_SEP_S "\\" +#else +#define DIR_SEP '/' +#define DIR_SEP_S "/" +#endif + +#define USERPREF_CONFIG_EXTENSION ".plist" + +#ifdef WIN32 +#define USERPREF_CONFIG_DIR "Apple"DIR_SEP_S"Lockdown" +#else +#define USERPREF_CONFIG_DIR "lockdown" +#endif + +#define USERPREF_CONFIG_FILE "SystemConfiguration"USERPREF_CONFIG_EXTENSION + +static char *__config_dir = NULL; + +#ifdef WIN32 +static char *userpref_utf16_to_utf8(wchar_t *unistr, long len, long *items_read, long *items_written) +{ + if (!unistr || (len <= 0)) return NULL; + char *outbuf = (char*)malloc(3*(len+1)); + int p = 0; + int i = 0; + + wchar_t wc; + + while (i < len) { + wc = unistr[i++]; + if (wc >= 0x800) { + outbuf[p++] = (char)(0xE0 + ((wc >> 12) & 0xF)); + outbuf[p++] = (char)(0x80 + ((wc >> 6) & 0x3F)); + outbuf[p++] = (char)(0x80 + (wc & 0x3F)); + } else if (wc >= 0x80) { + outbuf[p++] = (char)(0xC0 + ((wc >> 6) & 0x1F)); + outbuf[p++] = (char)(0x80 + (wc & 0x3F)); + } else { + outbuf[p++] = (char)(wc & 0x7F); + } + } + if (items_read) { + *items_read = i; + } + if (items_written) { + *items_written = p; + } + outbuf[p] = 0; + + return outbuf; +} +#endif + +const char *userpref_get_config_dir() +{ + char *base_config_dir = NULL; + + if (__config_dir) + return __config_dir; + +#ifdef WIN32 + wchar_t path[MAX_PATH+1]; + HRESULT hr; + LPITEMIDLIST pidl = NULL; + BOOL b = FALSE; + + hr = SHGetSpecialFolderLocation (NULL, CSIDL_COMMON_APPDATA, &pidl); + if (hr == S_OK) { + b = SHGetPathFromIDListW (pidl, path); + if (b) { + base_config_dir = userpref_utf16_to_utf8 (path, wcslen(path), NULL, NULL); + CoTaskMemFree (pidl); + } + } +#else +#ifdef __APPLE__ + base_config_dir = strdup("/var/db"); +#else + base_config_dir = strdup("/var/lib"); +#endif +#endif + __config_dir = string_concat(base_config_dir, DIR_SEP_S, USERPREF_CONFIG_DIR, NULL); + + if (__config_dir) { + int i = strlen(__config_dir)-1; + while ((i > 0) && (__config_dir[i] == DIR_SEP)) { + __config_dir[i--] = '\0'; + } + } + + free(base_config_dir); + + debug_info("initialized config_dir to %s", __config_dir); + + return __config_dir; +} + +/** + * Reads the SystemBUID from a previously generated configuration file. + * + * @note It is the responsibility of the calling function to free the returned system_buid. + * @param system_buid A pointer that will be set to a newly allocated string containing the + * SystemBUID upon successful return. + * @return 0 if the SystemBUID has been successfully retrieved or < 0 otherwise. + */ +int userpref_read_system_buid(char **system_buid) +{ + int res = usbmuxd_read_buid(system_buid); + if (res == 0) { + debug_info("using %s as %s", *system_buid, USERPREF_SYSTEM_BUID_KEY); + } else { + debug_info("could not read system buid, error %d", res); + } + return res; +} + +/** + * Fills a list with UDIDs of devices that have been connected to this + * system before, i.e. for which a public key file exists. + * + * @param list A pointer to a char** initially pointing to NULL that will + * hold a newly allocated list of UDIDs upon successful return. + * The caller is responsible for freeing the memory. Note that if + * no public key file was found the list has to be freed too as it + * points to a terminating NULL element. + * @param count The number of UDIDs found. This parameter can be NULL if it + * is not required. + * + * @return USERPREF_E_SUCCESS on success, or USERPREF_E_INVALID_ARG if the + * list parameter is not pointing to NULL. + */ +userpref_error_t userpref_get_paired_udids(char ***list, unsigned int *count) +{ + DIR *config_dir; + const char *config_path = NULL; + unsigned int found = 0; + + if (!list || (list && *list)) { + debug_info("ERROR: The list parameter needs to point to NULL!"); + return USERPREF_E_INVALID_ARG; + } + + if (count) { + *count = 0; + } + *list = (char**)malloc(sizeof(char*)); + + config_path = userpref_get_config_dir(); + config_dir = opendir(config_path); + if (config_dir) { + struct dirent *entry; + while ((entry = readdir(config_dir))) { + if (strcmp(entry->d_name, USERPREF_CONFIG_FILE) == 0) { + /* ignore SystemConfiguration.plist */ + continue; + } + char *ext = strrchr(entry->d_name, '.'); + if (ext && (strcmp(ext, USERPREF_CONFIG_EXTENSION) == 0)) { + size_t len = strlen(entry->d_name) - strlen(USERPREF_CONFIG_EXTENSION); + char **newlist = (char**)realloc(*list, sizeof(char*) * (found+2)); + if (!newlist) { + fprintf(stderr, "ERROR: Out of memory\n"); + break; + } + *list = newlist; + char *tmp = (char*)malloc(len+1); + if (tmp) { + strncpy(tmp, entry->d_name, len); + tmp[len] = '\0'; + } + (*list)[found] = tmp; + if (!tmp) { + fprintf(stderr, "ERROR: Out of memory\n"); + break; + } + found++; + } + } + closedir(config_dir); + } + (*list)[found] = NULL; + + if (count) { + *count = found; + } + + return USERPREF_E_SUCCESS; +} + +/** + * Save a pair record for a device. + * + * @param udid The device UDID as given by the device + * @param device_id The usbmux device id (handle) of the connected device, or 0 + * @param pair_record The pair record to save + * + * @return 1 on success and 0 if no device record is given or if it has already + * been saved previously. + */ +userpref_error_t userpref_save_pair_record(const char *udid, uint32_t device_id, plist_t pair_record) +{ + char* record_data = NULL; + uint32_t record_size = 0; + + plist_to_bin(pair_record, &record_data, &record_size); + + int res = usbmuxd_save_pair_record_with_device_id(udid, device_id, record_data, record_size); + + free(record_data); + + return res == 0 ? USERPREF_E_SUCCESS: USERPREF_E_UNKNOWN_ERROR; +} + +/** + * Read a pair record for a device. + * + * @param udid The device UDID as given by the device + * @param pair_record The pair record to read + * + * @return USERPREF_E_SUCCESS on success, + * USERPREF_E_NOENT if no pairing record was found, + * USERPREF_E_READ_ERROR if retrieving the pairing record from usbmuxd failed, + * or USERPREF_E_INVALID_CONF otherwise. + */ +userpref_error_t userpref_read_pair_record(const char *udid, plist_t *pair_record) +{ + char* record_data = NULL; + uint32_t record_size = 0; + + int res = usbmuxd_read_pair_record(udid, &record_data, &record_size); + if (res < 0) { + free(record_data); + switch (-res) { + case ENOENT: + return USERPREF_E_NOENT; + case ETIMEDOUT: + return USERPREF_E_READ_ERROR; + default: + return USERPREF_E_INVALID_CONF; + } + } + + *pair_record = NULL; + plist_from_memory(record_data, record_size, pair_record, NULL); + free(record_data); + + if (!*pair_record) { + debug_info("Failed to parse pairing record"); + return USERPREF_E_INVALID_CONF; + } + return USERPREF_E_SUCCESS; +} + +/** + * Remove the pairing record stored for a device from this host. + * + * @param udid The udid of the device + * + * @return USERPREF_E_SUCCESS on success. + */ +userpref_error_t userpref_delete_pair_record(const char *udid) +{ + int res = usbmuxd_delete_pair_record(udid); + + return res == 0 ? USERPREF_E_SUCCESS: USERPREF_E_UNKNOWN_ERROR; +} + +#if defined(HAVE_OPENSSL) +static int X509_add_ext_helper(X509 *cert, int nid, char *value) +{ + X509_EXTENSION *ex; + X509V3_CTX ctx; + + /* No configuration database */ + X509V3_set_ctx_nodb(&ctx); + + X509V3_set_ctx(&ctx, NULL, cert, NULL, NULL, 0); + ex = X509V3_EXT_conf_nid(NULL, &ctx, nid, value); + if (!ex) { + debug_info("ERROR: X509V3_EXT_conf_nid(%d, %s) failed", nid, value); + return 0; + } + + X509_add_ext(cert, ex, -1); + X509_EXTENSION_free(ex); + + return 1; +} +#elif defined(HAVE_MBEDTLS) +static int _mbedtls_x509write_crt_set_basic_constraints_critical(mbedtls_x509write_cert *ctx, int is_ca, int max_pathlen) +{ + int ret; + unsigned char buf[9]; + unsigned char *c = buf + sizeof(buf); + size_t len = 0; + + memset( buf, 0, sizeof(buf) ); + + if (is_ca && max_pathlen > 127) + return( MBEDTLS_ERR_X509_BAD_INPUT_DATA ); + + if (is_ca) { + if (max_pathlen >= 0) { + MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_int( &c, buf, max_pathlen ) ); + } + MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_bool( &c, buf, 1 ) ); + } + + MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) ); + MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, buf, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ); + + return mbedtls_x509write_crt_set_extension( ctx, MBEDTLS_OID_BASIC_CONSTRAINTS, MBEDTLS_OID_SIZE( MBEDTLS_OID_BASIC_CONSTRAINTS ), 1, buf + sizeof(buf) - len, len ); +} +#endif + +/** + * Private function to generate required private keys and certificates. + * + * @param pair_record a #PLIST_DICT that will be filled with the keys + * and certificates + * @param public_key the public key to use (device public key) + * + * @return 1 if keys were successfully generated, 0 otherwise + */ +userpref_error_t pair_record_generate_keys_and_certs(plist_t pair_record, key_data_t public_key) +{ + userpref_error_t ret = USERPREF_E_SSL_ERROR; + + key_data_t dev_cert_pem = { NULL, 0 }; + key_data_t root_key_pem = { NULL, 0 }; + key_data_t root_cert_pem = { NULL, 0 }; + key_data_t host_key_pem = { NULL, 0 }; + key_data_t host_cert_pem = { NULL, 0 }; + + if (!pair_record || !public_key.data) + return USERPREF_E_INVALID_ARG; + + debug_info("Generating keys and certificates..."); + +#if defined(HAVE_OPENSSL) +#if OPENSSL_VERSION_NUMBER >= 0x30000000L + EVP_PKEY* root_pkey = EVP_RSA_gen(2048); + EVP_PKEY* host_pkey = EVP_RSA_gen(2048); +#else + BIGNUM *e = BN_new(); + RSA* root_keypair = RSA_new(); + RSA* host_keypair = RSA_new(); + + BN_set_word(e, 65537); + + RSA_generate_key_ex(root_keypair, 2048, e, NULL); + RSA_generate_key_ex(host_keypair, 2048, e, NULL); + + BN_free(e); + + EVP_PKEY* root_pkey = EVP_PKEY_new(); + EVP_PKEY_assign_RSA(root_pkey, root_keypair); + + EVP_PKEY* host_pkey = EVP_PKEY_new(); + EVP_PKEY_assign_RSA(host_pkey, host_keypair); +#endif + + /* generate root certificate */ + X509* root_cert = X509_new(); + { + /* set serial number */ + ASN1_INTEGER* sn = ASN1_INTEGER_new(); + ASN1_INTEGER_set(sn, 0); + X509_set_serialNumber(root_cert, sn); + ASN1_INTEGER_free(sn); + + /* set version */ + X509_set_version(root_cert, 2); + + /* set x509v3 basic constraints */ + X509_add_ext_helper(root_cert, NID_basic_constraints, (char*)"critical,CA:TRUE"); + + /* set key validity */ + ASN1_TIME* asn1time = ASN1_TIME_new(); + ASN1_TIME_set(asn1time, time(NULL)); + X509_set1_notBefore(root_cert, asn1time); + ASN1_TIME_set(asn1time, time(NULL) + (60 * 60 * 24 * 365 * 10)); + X509_set1_notAfter(root_cert, asn1time); + ASN1_TIME_free(asn1time); + + /* use root public key for root cert */ + X509_set_pubkey(root_cert, root_pkey); + + /* sign root cert with root private key */ + X509_sign(root_cert, root_pkey, EVP_sha1()); + } + + /* create host certificate */ + X509* host_cert = X509_new(); + { + /* set serial number */ + ASN1_INTEGER* sn = ASN1_INTEGER_new(); + ASN1_INTEGER_set(sn, 0); + X509_set_serialNumber(host_cert, sn); + ASN1_INTEGER_free(sn); + + /* set version */ + X509_set_version(host_cert, 2); + + /* set x509v3 basic constraints */ + X509_add_ext_helper(host_cert, NID_basic_constraints, (char*)"critical,CA:FALSE"); + + /* set x509v3 key usage */ + X509_add_ext_helper(host_cert, NID_key_usage, (char*)"critical,digitalSignature,keyEncipherment"); + + /* set key validity */ + ASN1_TIME* asn1time = ASN1_TIME_new(); + ASN1_TIME_set(asn1time, time(NULL)); + X509_set1_notBefore(host_cert, asn1time); + ASN1_TIME_set(asn1time, time(NULL) + (60 * 60 * 24 * 365 * 10)); + X509_set1_notAfter(host_cert, asn1time); + ASN1_TIME_free(asn1time); + + /* use host public key for host cert */ + X509_set_pubkey(host_cert, host_pkey); + + /* sign host cert with root private key */ + X509_sign(host_cert, root_pkey, EVP_sha1()); + } + + if (root_cert && root_pkey && host_cert && host_pkey) { + BIO* membp; + char *bdata; + + membp = BIO_new(BIO_s_mem()); + if (PEM_write_bio_X509(membp, root_cert) > 0) { + root_cert_pem.size = BIO_get_mem_data(membp, &bdata); + root_cert_pem.data = (unsigned char*)malloc(root_cert_pem.size); + if (root_cert_pem.data) { + memcpy(root_cert_pem.data, bdata, root_cert_pem.size); + } + BIO_free(membp); + membp = NULL; + } + membp = BIO_new(BIO_s_mem()); + if (PEM_write_bio_PrivateKey(membp, root_pkey, NULL, NULL, 0, 0, NULL) > 0) { + root_key_pem.size = BIO_get_mem_data(membp, &bdata); + root_key_pem.data = (unsigned char*)malloc(root_key_pem.size); + if (root_key_pem.data) { + memcpy(root_key_pem.data, bdata, root_key_pem.size); + } + BIO_free(membp); + membp = NULL; + } + membp = BIO_new(BIO_s_mem()); + if (PEM_write_bio_X509(membp, host_cert) > 0) { + host_cert_pem.size = BIO_get_mem_data(membp, &bdata); + host_cert_pem.data = (unsigned char*)malloc(host_cert_pem.size); + if (host_cert_pem.data) { + memcpy(host_cert_pem.data, bdata, host_cert_pem.size); + } + BIO_free(membp); + membp = NULL; + } + membp = BIO_new(BIO_s_mem()); + if (PEM_write_bio_PrivateKey(membp, host_pkey, NULL, NULL, 0, 0, NULL) > 0) { + host_key_pem.size = BIO_get_mem_data(membp, &bdata); + host_key_pem.data = (unsigned char*)malloc(host_key_pem.size); + if (host_key_pem.data) { + memcpy(host_key_pem.data, bdata, host_key_pem.size); + } + BIO_free(membp); + membp = NULL; + } + } + + EVP_PKEY *pubkey = NULL; + { + BIO *membp = BIO_new_mem_buf(public_key.data, public_key.size); +#if OPENSSL_VERSION_NUMBER >= 0x30000000L + if (!PEM_read_bio_PUBKEY(membp, &pubkey, NULL, NULL)) { + debug_info("WARNING: Could not read public key"); + } +#else + RSA *rsa_pubkey = NULL; + if (!PEM_read_bio_RSAPublicKey(membp, &rsa_pubkey, NULL, NULL)) { + debug_info("WARNING: Could not read public key"); + } else { + pubkey = EVP_PKEY_new(); + EVP_PKEY_assign_RSA(pubkey, rsa_pubkey); + } +#endif + BIO_free(membp); + } + + X509* dev_cert = X509_new(); + if (pubkey && dev_cert) { + /* generate device certificate */ + ASN1_INTEGER* sn = ASN1_INTEGER_new(); + ASN1_INTEGER_set(sn, 0); + X509_set_serialNumber(dev_cert, sn); + ASN1_INTEGER_free(sn); + X509_set_version(dev_cert, 2); + + X509_add_ext_helper(dev_cert, NID_basic_constraints, (char*)"critical,CA:FALSE"); + + ASN1_TIME* asn1time = ASN1_TIME_new(); + ASN1_TIME_set(asn1time, time(NULL)); + X509_set1_notBefore(dev_cert, asn1time); + ASN1_TIME_set(asn1time, time(NULL) + (60 * 60 * 24 * 365 * 10)); + X509_set1_notAfter(dev_cert, asn1time); + ASN1_TIME_free(asn1time); + + X509_set_pubkey(dev_cert, pubkey); + + X509_add_ext_helper(dev_cert, NID_subject_key_identifier, (char*)"hash"); + X509_add_ext_helper(dev_cert, NID_key_usage, (char*)"critical,digitalSignature,keyEncipherment"); + + /* sign device certificate with root private key */ + if (X509_sign(dev_cert, root_pkey, EVP_sha1())) { + /* if signing succeeded, export in PEM format */ + BIO* membp = BIO_new(BIO_s_mem()); + if (PEM_write_bio_X509(membp, dev_cert) > 0) { + char *bdata = NULL; + dev_cert_pem.size = BIO_get_mem_data(membp, &bdata); + dev_cert_pem.data = (unsigned char*)malloc(dev_cert_pem.size); + if (dev_cert_pem.data) { + memcpy(dev_cert_pem.data, bdata, dev_cert_pem.size); + } + BIO_free(membp); + membp = NULL; + } + } else { + debug_info("ERROR: Signing device certificate with root private key failed!"); + } + } + + X509_free(dev_cert); + + EVP_PKEY_free(pubkey); + EVP_PKEY_free(root_pkey); + EVP_PKEY_free(host_pkey); + + X509_free(host_cert); + X509_free(root_cert); +#elif defined(HAVE_GNUTLS) + gnutls_x509_privkey_t root_privkey; + gnutls_x509_crt_t root_cert; + gnutls_x509_privkey_t host_privkey; + gnutls_x509_crt_t host_cert; + + /* use less secure random to speed up key generation */ + gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM); + + gnutls_x509_privkey_init(&root_privkey); + gnutls_x509_privkey_init(&host_privkey); + + gnutls_x509_crt_init(&root_cert); + gnutls_x509_crt_init(&host_cert); + + /* generate root key */ + gnutls_x509_privkey_generate(root_privkey, GNUTLS_PK_RSA, 2048, 0); + gnutls_x509_privkey_generate(host_privkey, GNUTLS_PK_RSA, 2048, 0); + + /* generate certificates */ + gnutls_x509_crt_set_key(root_cert, root_privkey); + gnutls_x509_crt_set_serial(root_cert, "\x01", 1); + gnutls_x509_crt_set_version(root_cert, 3); + gnutls_x509_crt_set_ca_status(root_cert, 1); + gnutls_x509_crt_set_activation_time(root_cert, time(NULL)); + gnutls_x509_crt_set_expiration_time(root_cert, time(NULL) + (60 * 60 * 24 * 365 * 10)); + gnutls_x509_crt_sign2(root_cert, root_cert, root_privkey, GNUTLS_DIG_SHA1, 0); + + gnutls_x509_crt_set_key(host_cert, host_privkey); + gnutls_x509_crt_set_serial(host_cert, "\x01", 1); + gnutls_x509_crt_set_version(host_cert, 3); + gnutls_x509_crt_set_ca_status(host_cert, 0); + gnutls_x509_crt_set_key_usage(host_cert, GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_DIGITAL_SIGNATURE); + gnutls_x509_crt_set_activation_time(host_cert, time(NULL)); + gnutls_x509_crt_set_expiration_time(host_cert, time(NULL) + (60 * 60 * 24 * 365 * 10)); + gnutls_x509_crt_sign2(host_cert, root_cert, root_privkey, GNUTLS_DIG_SHA1, 0); + + /* export to PEM format */ + size_t root_key_export_size = 0; + size_t host_key_export_size = 0; + + gnutls_x509_privkey_export(root_privkey, GNUTLS_X509_FMT_PEM, NULL, &root_key_export_size); + gnutls_x509_privkey_export(host_privkey, GNUTLS_X509_FMT_PEM, NULL, &host_key_export_size); + + root_key_pem.data = gnutls_malloc(root_key_export_size); + host_key_pem.data = gnutls_malloc(host_key_export_size); + + gnutls_x509_privkey_export(root_privkey, GNUTLS_X509_FMT_PEM, root_key_pem.data, &root_key_export_size); + root_key_pem.size = root_key_export_size; + gnutls_x509_privkey_export(host_privkey, GNUTLS_X509_FMT_PEM, host_key_pem.data, &host_key_export_size); + host_key_pem.size = host_key_export_size; + + size_t root_cert_export_size = 0; + size_t host_cert_export_size = 0; + + gnutls_x509_crt_export(root_cert, GNUTLS_X509_FMT_PEM, NULL, &root_cert_export_size); + gnutls_x509_crt_export(host_cert, GNUTLS_X509_FMT_PEM, NULL, &host_cert_export_size); + + root_cert_pem.data = gnutls_malloc(root_cert_export_size); + host_cert_pem.data = gnutls_malloc(host_cert_export_size); + + gnutls_x509_crt_export(root_cert, GNUTLS_X509_FMT_PEM, root_cert_pem.data, &root_cert_export_size); + root_cert_pem.size = root_cert_export_size; + gnutls_x509_crt_export(host_cert, GNUTLS_X509_FMT_PEM, host_cert_pem.data, &host_cert_export_size); + host_cert_pem.size = host_cert_export_size; + + gnutls_datum_t modulus = { NULL, 0 }; + gnutls_datum_t exponent = { NULL, 0 }; + + /* now decode the PEM encoded key */ + gnutls_datum_t der_pub_key = { NULL, 0 }; + int gnutls_error = gnutls_pem_base64_decode_alloc("RSA PUBLIC KEY", &public_key, &der_pub_key); + if (GNUTLS_E_SUCCESS == gnutls_error) { + /* initalize asn.1 parser */ + ASN1_TYPE pkcs1 = ASN1_TYPE_EMPTY; + if (ASN1_SUCCESS == asn1_array2tree(pkcs1_asn1_tab, &pkcs1, NULL)) { + + ASN1_TYPE asn1_pub_key = ASN1_TYPE_EMPTY; + asn1_create_element(pkcs1, "PKCS1.RSAPublicKey", &asn1_pub_key); + + if (ASN1_SUCCESS == asn1_der_decoding(&asn1_pub_key, der_pub_key.data, der_pub_key.size, NULL)) { + + /* get size to read */ + int ret1 = asn1_read_value(asn1_pub_key, "modulus", NULL, (int*)&modulus.size); + int ret2 = asn1_read_value(asn1_pub_key, "publicExponent", NULL, (int*)&exponent.size); + + modulus.data = gnutls_malloc(modulus.size); + exponent.data = gnutls_malloc(exponent.size); + + ret1 = asn1_read_value(asn1_pub_key, "modulus", modulus.data, (int*)&modulus.size); + ret2 = asn1_read_value(asn1_pub_key, "publicExponent", exponent.data, (int*)&exponent.size); + if (ret1 != ASN1_SUCCESS || ret2 != ASN1_SUCCESS) { + gnutls_free(modulus.data); + modulus.data = NULL; + modulus.size = 0; + gnutls_free(exponent.data); + exponent.data = NULL; + exponent.size = 0; + } + } + if (asn1_pub_key) + asn1_delete_structure(&asn1_pub_key); + } + if (pkcs1) + asn1_delete_structure(&pkcs1); + } else { + debug_info("ERROR: Could not parse public key: %s", gnutls_strerror(gnutls_error)); + } + + /* generate device certificate */ + if (modulus.data && 0 != modulus.size && exponent.data && 0 != exponent.size) { + + gnutls_datum_t prime_p = { (unsigned char*)"\x00\xca\x4a\x03\x13\xdf\x9d\x7a\xfd", 9 }; + gnutls_datum_t prime_q = { (unsigned char*)"\x00\xf2\xff\xe0\x15\xd1\x60\x37\x63", 9 }; + gnutls_datum_t coeff = { (unsigned char*)"\x32\x07\xf1\x68\x57\xdf\x9a\xf4", 8 }; + + gnutls_x509_privkey_t fake_privkey; + gnutls_x509_crt_t dev_cert; + + gnutls_x509_privkey_init(&fake_privkey); + gnutls_x509_crt_init(&dev_cert); + + gnutls_error = gnutls_x509_privkey_import_rsa_raw(fake_privkey, &modulus, &exponent, &exponent, &prime_p, &prime_q, &coeff); + if (GNUTLS_E_SUCCESS == gnutls_error) { + /* now generate device certificate */ + gnutls_x509_crt_set_key(dev_cert, fake_privkey); + gnutls_x509_crt_set_serial(dev_cert, "\x01", 1); + gnutls_x509_crt_set_version(dev_cert, 3); + gnutls_x509_crt_set_ca_status(dev_cert, 0); + gnutls_x509_crt_set_activation_time(dev_cert, time(NULL)); + gnutls_x509_crt_set_expiration_time(dev_cert, time(NULL) + (60 * 60 * 24 * 365 * 10)); + + /* use custom hash generation for compatibility with the "Apple ecosystem" */ + const gnutls_digest_algorithm_t dig_sha1 = GNUTLS_DIG_SHA1; + size_t hash_size = gnutls_hash_get_len(dig_sha1); + unsigned char hash[hash_size]; + if (gnutls_hash_fast(dig_sha1, der_pub_key.data, der_pub_key.size, (unsigned char*)&hash) < 0) { + debug_info("ERROR: Failed to generate SHA1 for public key"); + } else { + gnutls_x509_crt_set_subject_key_id(dev_cert, hash, hash_size); + } + + gnutls_x509_crt_set_key_usage(dev_cert, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT); + gnutls_error = gnutls_x509_crt_sign2(dev_cert, root_cert, root_privkey, GNUTLS_DIG_SHA1, 0); + if (GNUTLS_E_SUCCESS == gnutls_error) { + /* if everything went well, export in PEM format */ + size_t export_size = 0; + gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, NULL, &export_size); + dev_cert_pem.data = gnutls_malloc(export_size); + gnutls_x509_crt_export(dev_cert, GNUTLS_X509_FMT_PEM, dev_cert_pem.data, &export_size); + dev_cert_pem.size = export_size; + } else { + debug_info("ERROR: Signing device certificate with root private key failed: %s", gnutls_strerror(gnutls_error)); + } + } else { + debug_info("ERROR: Failed to import RSA key data: %s", gnutls_strerror(gnutls_error)); + } + gnutls_x509_crt_deinit(dev_cert); + gnutls_x509_privkey_deinit(fake_privkey); + } + + gnutls_x509_crt_deinit(root_cert); + gnutls_x509_crt_deinit(host_cert); + gnutls_x509_privkey_deinit(root_privkey); + gnutls_x509_privkey_deinit(host_privkey); + + gnutls_free(modulus.data); + gnutls_free(exponent.data); + + gnutls_free(der_pub_key.data); +#elif defined(HAVE_MBEDTLS) + time_t now = time(NULL); + struct tm* timestamp = gmtime(&now); + char notbefore[16]; + strftime(notbefore, sizeof(notbefore), "%Y%m%d%H%M%S", timestamp); + time_t then = now + 60 * 60 * 24 * 365 * 10; + char notafter[16]; + timestamp = gmtime(&then); + strftime(notafter, sizeof(notafter), "%Y%m%d%H%M%S", timestamp); + + mbedtls_mpi sn; + mbedtls_mpi_init(&sn); + mbedtls_mpi_lset(&sn, 1); /* 0 doesn't work, so we have to use 1 (like GnuTLS) */ + + mbedtls_ctr_drbg_context ctr_drbg; + mbedtls_ctr_drbg_init(&ctr_drbg); + + mbedtls_pk_context root_pkey; + mbedtls_pk_init(&root_pkey); + + mbedtls_pk_context host_pkey; + mbedtls_pk_init(&host_pkey); + + mbedtls_pk_context dev_public_key; + mbedtls_pk_init(&dev_public_key); + + mbedtls_entropy_context entropy; + mbedtls_entropy_init(&entropy); + + mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char *)"limd", 4); + + /* ----- root key & cert ----- */ + ret = mbedtls_pk_setup(&root_pkey, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)); + if (ret != 0) { + debug_info("mbedtls_pk_setup returned -0x%04x", -ret); + goto cleanup; + } + + ret = mbedtls_rsa_gen_key(mbedtls_pk_rsa(root_pkey), mbedtls_ctr_drbg_random, &ctr_drbg, 2048, 65537); + if (ret != 0) { + debug_info("mbedtls_rsa_gen_key returned -0x%04x", -ret); + goto cleanup; + } + + mbedtls_x509write_cert cert; + mbedtls_x509write_crt_init(&cert); + + /* set serial number */ + mbedtls_x509write_crt_set_serial(&cert, &sn); + + /* set version */ + mbedtls_x509write_crt_set_version(&cert, 2); + + /* set x509v3 basic constraints */ + _mbedtls_x509write_crt_set_basic_constraints_critical(&cert, 1, -1); + + /* use root public key for root cert */ + mbedtls_x509write_crt_set_subject_key(&cert, &root_pkey); + + /* set x509v3 subject key identifier */ + mbedtls_x509write_crt_set_subject_key_identifier(&cert); + + /* set key validity */ + mbedtls_x509write_crt_set_validity(&cert, notbefore, notafter); + + /* sign root cert with root private key */ + mbedtls_x509write_crt_set_issuer_key(&cert, &root_pkey); + mbedtls_x509write_crt_set_md_alg(&cert, MBEDTLS_MD_SHA1); + + unsigned char outbuf[16384]; + + /* write root private key */ + mbedtls_pk_write_key_pem(&root_pkey, outbuf, sizeof(outbuf)); + root_key_pem.size = strlen((const char*)outbuf); + root_key_pem.data = malloc(root_key_pem.size+1); + memcpy(root_key_pem.data, outbuf, root_key_pem.size); + root_key_pem.data[root_key_pem.size] = '\0'; + + /* write root certificate */ + mbedtls_x509write_crt_pem(&cert, outbuf, sizeof(outbuf), mbedtls_ctr_drbg_random, &ctr_drbg); + root_cert_pem.size = strlen((const char*)outbuf); + root_cert_pem.data = malloc(root_cert_pem.size+1); + memcpy(root_cert_pem.data, outbuf, root_cert_pem.size); + root_cert_pem.data[root_cert_pem.size] = '\0'; + + mbedtls_x509write_crt_free(&cert); + + + /* ----- host key & cert ----- */ + ret = mbedtls_pk_setup(&host_pkey, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA)); + if (ret != 0) { + debug_info("mbedtls_pk_setup returned -0x%04x", -ret); + goto cleanup; + } + + ret = mbedtls_rsa_gen_key(mbedtls_pk_rsa(host_pkey), mbedtls_ctr_drbg_random, &ctr_drbg, 2048, 65537); + if (ret != 0) { + debug_info("mbedtls_rsa_gen_key returned -0x%04x", -ret); + goto cleanup; + } + + mbedtls_x509write_crt_init(&cert); + + /* set serial number */ + mbedtls_x509write_crt_set_serial(&cert, &sn); + + /* set version */ + mbedtls_x509write_crt_set_version(&cert, 2); + + /* set x509v3 basic constraints */ + _mbedtls_x509write_crt_set_basic_constraints_critical(&cert, 0, -1); + + /* use host public key for host cert */ + mbedtls_x509write_crt_set_subject_key(&cert, &host_pkey); + + /* set x509v3 subject key identifier */ + mbedtls_x509write_crt_set_subject_key_identifier(&cert); + + /* set x509v3 key usage */ + mbedtls_x509write_crt_set_key_usage(&cert, MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_ENCIPHERMENT); + + /* set key validity */ + mbedtls_x509write_crt_set_validity(&cert, notbefore, notafter); + + /* sign host cert with root private key */ + mbedtls_x509write_crt_set_issuer_key(&cert, &root_pkey); + mbedtls_x509write_crt_set_md_alg(&cert, MBEDTLS_MD_SHA1); + + /* write host private key */ + mbedtls_pk_write_key_pem(&host_pkey, outbuf, sizeof(outbuf)); + host_key_pem.size = strlen((const char*)outbuf); + host_key_pem.data = malloc(host_key_pem.size+1); + memcpy(host_key_pem.data, outbuf, host_key_pem.size); + host_key_pem.data[host_key_pem.size] = '\0'; + + /* write host certificate */ + mbedtls_x509write_crt_pem(&cert, outbuf, sizeof(outbuf), mbedtls_ctr_drbg_random, &ctr_drbg); + host_cert_pem.size = strlen((const char*)outbuf); + host_cert_pem.data = malloc(host_cert_pem.size+1); + memcpy(host_cert_pem.data, outbuf, host_cert_pem.size); + host_cert_pem.data[host_cert_pem.size] = '\0'; + + mbedtls_x509write_crt_free(&cert); + + + /* ----- device certificate ----- */ + unsigned char* pubkey_data = malloc(public_key.size+1); + if (!pubkey_data) { + debug_info("malloc() failed\n"); + goto cleanup; + } + memcpy(pubkey_data, public_key.data, public_key.size); + pubkey_data[public_key.size] = '\0'; + + int pr = mbedtls_pk_parse_public_key(&dev_public_key, pubkey_data, public_key.size+1); + free(pubkey_data); + if (pr != 0) { + debug_info("Failed to read device public key: -0x%x\n", -pr); + goto cleanup; + } + + mbedtls_x509write_crt_init(&cert); + + /* set serial number */ + mbedtls_x509write_crt_set_serial(&cert, &sn); + + /* set version */ + mbedtls_x509write_crt_set_version(&cert, 2); + + /* set x509v3 basic constraints */ + _mbedtls_x509write_crt_set_basic_constraints_critical(&cert, 0, -1); + + /* use root public key for dev cert subject key */ + mbedtls_x509write_crt_set_subject_key(&cert, &dev_public_key); + + /* set x509v3 subject key identifier */ + mbedtls_x509write_crt_set_subject_key_identifier(&cert); + + /* set x509v3 key usage */ + mbedtls_x509write_crt_set_key_usage(&cert, MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_ENCIPHERMENT); + + /* set key validity */ + mbedtls_x509write_crt_set_validity(&cert, notbefore, notafter); + + /* sign device certificate with root private key */ + mbedtls_x509write_crt_set_issuer_key(&cert, &root_pkey); + mbedtls_x509write_crt_set_md_alg(&cert, MBEDTLS_MD_SHA1); + + /* write device certificate */ + mbedtls_x509write_crt_pem(&cert, outbuf, sizeof(outbuf), mbedtls_ctr_drbg_random, &ctr_drbg); + dev_cert_pem.size = strlen((const char*)outbuf); + dev_cert_pem.data = malloc(dev_cert_pem.size+1); + memcpy(dev_cert_pem.data, outbuf, dev_cert_pem.size); + dev_cert_pem.data[dev_cert_pem.size] = '\0'; + + mbedtls_x509write_crt_free(&cert); + + /* cleanup */ +cleanup: + mbedtls_mpi_free(&sn); + mbedtls_pk_free(&dev_public_key); + mbedtls_entropy_free(&entropy); + mbedtls_pk_free(&host_pkey); + mbedtls_pk_free(&root_pkey); + mbedtls_ctr_drbg_free(&ctr_drbg); +#endif + + /* make sure that we have all we need */ + if (root_cert_pem.data && 0 != root_cert_pem.size + && root_key_pem.data && 0 != root_key_pem.size + && host_cert_pem.data && 0 != host_cert_pem.size + && host_key_pem.data && 0 != host_key_pem.size + && dev_cert_pem.data && 0 != dev_cert_pem.size) { + /* now set keys and certificates */ + pair_record_set_item_from_key_data(pair_record, USERPREF_DEVICE_CERTIFICATE_KEY, &dev_cert_pem); + pair_record_set_item_from_key_data(pair_record, USERPREF_HOST_PRIVATE_KEY_KEY, &host_key_pem); + pair_record_set_item_from_key_data(pair_record, USERPREF_HOST_CERTIFICATE_KEY, &host_cert_pem); + pair_record_set_item_from_key_data(pair_record, USERPREF_ROOT_PRIVATE_KEY_KEY, &root_key_pem); + pair_record_set_item_from_key_data(pair_record, USERPREF_ROOT_CERTIFICATE_KEY, &root_cert_pem); + ret = USERPREF_E_SUCCESS; + } + + free(dev_cert_pem.data); + free(root_key_pem.data); + free(root_cert_pem.data); + free(host_key_pem.data); + free(host_cert_pem.data); + + return ret; +} + +/** + * Private function which import the given key into a gnutls structure. + * + * @param name The name of the private key to import. + * @param key the gnutls key structure. + * + * @return 1 if the key was successfully imported. + */ +#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS) +userpref_error_t pair_record_import_key_with_name(plist_t pair_record, const char* name, key_data_t* key) +#elif defined(HAVE_GNUTLS) +userpref_error_t pair_record_import_key_with_name(plist_t pair_record, const char* name, gnutls_x509_privkey_t key) +#endif +{ +#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS) + if (!key) + return USERPREF_E_SUCCESS; +#endif + userpref_error_t ret = USERPREF_E_INVALID_CONF; + +#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS) + ret = pair_record_get_item_as_key_data(pair_record, name, key); +#elif defined(HAVE_GNUTLS) + key_data_t pem = { NULL, 0 }; + ret = pair_record_get_item_as_key_data(pair_record, name, &pem); + if (ret == USERPREF_E_SUCCESS && GNUTLS_E_SUCCESS == gnutls_x509_privkey_import(key, &pem, GNUTLS_X509_FMT_PEM)) + ret = USERPREF_E_SUCCESS; + else + ret = USERPREF_E_SSL_ERROR; + + if (pem.data) + free(pem.data); +#endif + return ret; +} + +/** + * Private function which import the given certificate into a gnutls structure. + * + * @param name The name of the certificate to import. + * @param cert the gnutls certificate structure. + * + * @return IDEVICE_E_SUCCESS if the certificate was successfully imported. + */ +#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS) +userpref_error_t pair_record_import_crt_with_name(plist_t pair_record, const char* name, key_data_t* cert) +#else +userpref_error_t pair_record_import_crt_with_name(plist_t pair_record, const char* name, gnutls_x509_crt_t cert) +#endif +{ +#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS) + if (!cert) + return USERPREF_E_SUCCESS; +#endif + userpref_error_t ret = USERPREF_E_INVALID_CONF; + +#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS) + ret = pair_record_get_item_as_key_data(pair_record, name, cert); +#elif defined(HAVE_GNUTLS) + key_data_t pem = { NULL, 0 }; + ret = pair_record_get_item_as_key_data(pair_record, name, &pem); + if (ret == USERPREF_E_SUCCESS && GNUTLS_E_SUCCESS == gnutls_x509_crt_import(cert, &pem, GNUTLS_X509_FMT_PEM)) + ret = USERPREF_E_SUCCESS; + else + ret = USERPREF_E_SSL_ERROR; + + if (pem.data) + free(pem.data); +#endif + return ret; +} + +userpref_error_t pair_record_get_host_id(plist_t pair_record, char** host_id) +{ + plist_t node = plist_dict_get_item(pair_record, USERPREF_HOST_ID_KEY); + + if (node && plist_get_node_type(node) == PLIST_STRING) { + plist_get_string_val(node, host_id); + } + + return USERPREF_E_SUCCESS; +} + +userpref_error_t pair_record_set_host_id(plist_t pair_record, const char* host_id) +{ + plist_dict_set_item(pair_record, USERPREF_HOST_ID_KEY, plist_new_string(host_id)); + + return USERPREF_E_SUCCESS; +} + +userpref_error_t pair_record_get_item_as_key_data(plist_t pair_record, const char* name, key_data_t *value) +{ + if (!pair_record || !value) + return USERPREF_E_INVALID_ARG; + + userpref_error_t ret = USERPREF_E_SUCCESS; + char* buffer = NULL; + uint64_t length = 0; + + plist_t node = plist_dict_get_item(pair_record, name); + + if (node && plist_get_node_type(node) == PLIST_DATA) { + plist_get_data_val(node, &buffer, &length); + value->data = (unsigned char*)malloc(length+1); + memcpy(value->data, buffer, length); + value->data[length] = '\0'; + value->size = length+1; + free(buffer); + buffer = NULL; + } else { + ret = USERPREF_E_INVALID_CONF; + } + + if (buffer) + free(buffer); + + return ret; +} + +userpref_error_t pair_record_set_item_from_key_data(plist_t pair_record, const char* name, key_data_t *value) +{ + userpref_error_t ret = USERPREF_E_SUCCESS; + + if (!pair_record || !value) { + return USERPREF_E_INVALID_ARG; + } + + /* set new item */ + plist_dict_set_item(pair_record, name, plist_new_data((char*)value->data, value->size)); + + return ret; +} + |