Fix iOS 4.2 GnuTLS issue by passing a certificate in the handshake

2 files changed, 54 insertions, 3 deletions

diff --git a/src/idevice.c b/src/idevice.c
index c86b806..39b95c1 100644
--- a/src/idevice.c
+++ b/src/idevice.c
@@ -27,6 +27,7 @@
 #include <usbmuxd.h>
 #include <gnutls/gnutls.h>
 #include "idevice.h"
+#include "userpref.h"
 #include "debug.h"
 
 static idevice_event_cb_t event_cb = NULL;
@@ -523,6 +524,40 @@ static void internal_ssl_cleanup(ssl_data_t ssl_data)
 	if (ssl_data->certificate) {
 		gnutls_certificate_free_credentials(ssl_data->certificate);
 	}
+	if (ssl_data->root_cert) {
+		gnutls_x509_crt_deinit(ssl_data->root_cert);
+	}
+	if (ssl_data->host_cert) {
+		gnutls_x509_crt_deinit(ssl_data->host_cert);
+	}
+	if (ssl_data->root_privkey) {
+		gnutls_x509_privkey_deinit(ssl_data->root_privkey);
+	}
+	if (ssl_data->host_privkey) {
+		gnutls_x509_privkey_deinit(ssl_data->host_privkey);
+	}
+}
+
+/**
+ * Internally used gnutls callback function that gets called during handshake.
+ */
+static int internal_cert_callback (gnutls_session_t session, const gnutls_datum_t * req_ca_rdn, int nreqs, const gnutls_pk_algorithm_t * sign_algos, int sign_algos_length, gnutls_retr_st * st)
+{
+	int res = -1;
+	gnutls_certificate_type_t type = gnutls_certificate_type_get (session);
+	if (type == GNUTLS_CRT_X509) {
+		ssl_data_t ssl_data = (ssl_data_t)gnutls_session_get_ptr (session);
+		if (ssl_data && ssl_data->host_privkey && ssl_data->host_cert) {
+			debug_info("Passing certificate");
+			st->type = type;
+			st->ncerts = 1;
+			st->cert.x509 = &ssl_data->host_cert;
+			st->key.x509 = ssl_data->host_privkey;
+			st->deinit_all = 0;
+			res = 0;
+		}
+	}
+	return res;
 }
 
 /**
@@ -549,7 +584,7 @@ idevice_error_t idevice_connection_enable_ssl(idevice_connection_t connection)
 	errno = 0;
 	gnutls_global_init();
 	gnutls_certificate_allocate_credentials(&ssl_data_loc->certificate);
-	gnutls_certificate_set_x509_trust_file(ssl_data_loc->certificate, "hostcert.pem", GNUTLS_X509_FMT_PEM);
+	gnutls_certificate_client_set_retrieve_function (ssl_data_loc->certificate, internal_cert_callback);
 	gnutls_init(&ssl_data_loc->session, GNUTLS_CLIENT);
 	{
 		int protocol_priority[16] = { GNUTLS_SSL3, 0 };
@@ -564,7 +599,18 @@ idevice_error_t idevice_connection_enable_ssl(idevice_connection_t connection)
 		gnutls_protocol_set_priority(ssl_data_loc->session, protocol_priority);
 		gnutls_mac_set_priority(ssl_data_loc->session, mac_priority);
 	}
-	gnutls_credentials_set(ssl_data_loc->session, GNUTLS_CRD_CERTIFICATE, ssl_data_loc->certificate); /* this part is killing me. */
+	gnutls_credentials_set(ssl_data_loc->session, GNUTLS_CRD_CERTIFICATE, ssl_data_loc->certificate);
+	gnutls_session_set_ptr(ssl_data_loc->session, ssl_data_loc);
+
+	gnutls_x509_crt_init(&ssl_data_loc->root_cert);
+	gnutls_x509_crt_init(&ssl_data_loc->host_cert);
+	gnutls_x509_privkey_init(&ssl_data_loc->root_privkey);
+	gnutls_x509_privkey_init(&ssl_data_loc->host_privkey);
+
+	userpref_error_t uerr = userpref_get_keys_and_certs(ssl_data_loc->root_privkey, ssl_data_loc->root_cert, ssl_data_loc->host_privkey, ssl_data_loc->host_cert);
+	if (uerr != USERPREF_E_SUCCESS) {
+		debug_info("Error %d when loading keys and certificates! %d", uerr);
+	}
 
 	debug_info("GnuTLS step 1...");
 	gnutls_transport_set_ptr(ssl_data_loc->session, (gnutls_transport_ptr_t)connection);
diff --git a/src/idevice.h b/src/idevice.h
index a4ce251..231b3ab 100644
--- a/src/idevice.h
+++ b/src/idevice.h
@@ -22,6 +22,7 @@
 #define IDEVICE_H
 
 #include <gnutls/gnutls.h>
+#include <gnutls/x509.h>
 
 #include "libimobiledevice/libimobiledevice.h"
 
@@ -30,8 +31,12 @@ enum connection_type {
 };
 
 struct ssl_data_private {
-        gnutls_certificate_credentials_t certificate;
+	gnutls_certificate_credentials_t certificate;
 	gnutls_session_t session;
+	gnutls_x509_privkey_t root_privkey;
+	gnutls_x509_crt_t root_cert;
+	gnutls_x509_privkey_t host_privkey;
+	gnutls_x509_crt_t host_cert;
 };
 typedef struct ssl_data_private *ssl_data_t;