1  /*
  2   * Copyright (c) 2003-2007,2009-2010,2013-2014 Apple Inc. All Rights Reserved.
  3   *
  4   * @APPLE_LICENSE_HEADER_START@
  5   * 
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   * 
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   * 
 21   * @APPLE_LICENSE_HEADER_END@
 22   *
 23   * keychain_add.c
 24   */
 25  
 26  
 27  #include <stdio.h>
 28  #include <stdlib.h>
 29  #include <string.h>
 30  #include <unistd.h>
 31  #include <sys/utsname.h>
 32  #include <sys/stat.h>
 33  #include <time.h>
 34  #include <getopt.h>
 35  #include <readpassphrase.h>
 36  
 37  #include <Security/SecItem.h>
 38  
 39  #include <CoreFoundation/CFNumber.h>
 40  #include <CoreFoundation/CFString.h>
 41  
 42  #include <Security/SecureObjectSync/SOSCloudCircle.h>
 43  #include <Security/SecureObjectSync/SOSCloudCircleInternal.h>
 44  #include <Security/SecureObjectSync/SOSPeerInfo.h>
 45  #include "keychain/SecureObjectSync/SOSPeerInfoPriv.h"
 46  #include "keychain/SecureObjectSync/SOSPeerInfoV2.h"
 47  #include "keychain/SecureObjectSync/SOSUserKeygen.h"
 48  #include "keychain/SecureObjectSync/SOSKVSKeys.h"
 49  #include "keychain/securityd/SOSCloudCircleServer.h"
 50  #include <Security/SecureObjectSync/SOSBackupSliceKeyBag.h>
 51  #include <Security/SecOTRSession.h>
 52  #include "keychain/SecureObjectSync/CKBridge/SOSCloudKeychainClient.h"
 53  
 54  #include <utilities/SecCFWrappers.h>
 55  #include <utilities/debugging.h>
 56  
 57  #include "SecurityTool/sharedTool/readline.h"
 58  #include <notify.h>
 59  
 60  #include "keychain_sync.h"
 61  #include "keychain_log.h"
 62  
 63  #include "secToolFileIO.h"
 64  #include "secViewDisplay.h"
 65  #include "accountCirclesViewsPrint.h"
 66  
 67  #include <Security/SecPasswordGenerate.h>
 68  
 69  #define MAXKVSKEYTYPE kUnknownKey
 70  #define DATE_LENGTH 18
 71  
 72  
 73  static bool clearAllKVS(CFErrorRef *error)
 74  {
 75      __block bool result = false;
 76      const uint64_t maxTimeToWaitInSeconds = 30ull * NSEC_PER_SEC;
 77      dispatch_queue_t processQueue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0);
 78      dispatch_semaphore_t waitSemaphore = dispatch_semaphore_create(0);
 79      dispatch_time_t finishTime = dispatch_time(DISPATCH_TIME_NOW, maxTimeToWaitInSeconds);
 80  
 81      secnotice("circleOps", "security tool called SOSCloudKeychainClearAll to clear KVS");
 82      SOSCloudKeychainClearAll(processQueue, ^(CFDictionaryRef returnedValues, CFErrorRef cerror)
 83      {
 84          result = (cerror != NULL);
 85          dispatch_semaphore_signal(waitSemaphore);
 86      });
 87      
 88  	dispatch_semaphore_wait(waitSemaphore, finishTime);
 89  
 90      return result;
 91  }
 92  
 93  static bool enableDefaultViews()
 94  {
 95      bool result = false;
 96      CFMutableSetRef viewsToEnable = SOSViewCopyViewSet(kViewSetV0);
 97      CFMutableSetRef viewsToDisable = CFSetCreateMutable(NULL, 0, NULL);
 98      
 99      result = SOSCCViewSet(viewsToEnable, viewsToDisable);
100      CFRelease(viewsToEnable);
101      CFRelease(viewsToDisable);
102      return result;
103  }
104  
105  static bool requestToJoinCircle(CFErrorRef *error)
106  {
107      // Set the visual state of switch based on membership in circle
108      bool hadError = false;
109      SOSCCStatus ccstatus = SOSCCThisDeviceIsInCircle(error);
110      
111      switch (ccstatus)
112      {
113      case kSOSCCCircleAbsent:
114          hadError = !SOSCCResetToOffering(error);
115          hadError &= enableDefaultViews();
116          break;
117      case kSOSCCNotInCircle:
118          hadError = !SOSCCRequestToJoinCircle(error);
119          hadError &= enableDefaultViews();
120          break;
121      default:
122          printerr(CFSTR("Request to join circle with bad status:  %@ (%d)\n"), SOSCCGetStatusDescription(ccstatus), ccstatus);
123          break;
124      }
125      return hadError;
126  }
127  
128  static bool setPassword(char *labelAndPassword, CFErrorRef *err)
129  {
130      char *last = NULL;
131      char *token0 = strtok_r(labelAndPassword, ":", &last);
132      char *token1 = strtok_r(NULL, "", &last);
133      CFStringRef label = token1 ? CFStringCreateWithCString(NULL, token0, kCFStringEncodingUTF8) : CFSTR("security command line tool");
134      char *password_token = token1 ? token1 : token0;
135      password_token = password_token ? password_token : "";
136      CFDataRef password = CFDataCreate(NULL, (const UInt8*) password_token, strlen(password_token));
137      bool returned = !SOSCCSetUserCredentials(label, password, err);
138      CFRelease(label);
139      CFRelease(password);
140      return returned;
141  }
142  
143  static bool tryPassword(char *labelAndPassword, CFErrorRef *err)
144  {
145      char *last = NULL;
146      char *token0 = strtok_r(labelAndPassword, ":", &last);
147      char *token1 = strtok_r(NULL, "", &last);
148      CFStringRef label = token1 ? CFStringCreateWithCString(NULL, token0, kCFStringEncodingUTF8) : CFSTR("security command line tool");
149      char *password_token = token1 ? token1 : token0;
150      password_token = password_token ? password_token : "";
151      CFDataRef password = CFDataCreate(NULL, (const UInt8*) password_token, strlen(password_token));
152      bool returned = !SOSCCTryUserCredentials(label, password, err);
153      CFRelease(label);
154      CFRelease(password);
155      return returned;
156  }
157  
158  /*
159   * Prompt user, call SOSCCTryUserCredentials.
160   * Does not support optional label syntax like -T/-P.
161   * Returns true on success.
162   */
163  static bool
164  promptAndTryPassword(CFErrorRef *error)
165  {
166      bool success = false;
167      char passbuf[1024];
168      CFDataRef password;
169  
170      if (readpassphrase("iCloud password: ", passbuf, sizeof(passbuf), RPP_REQUIRE_TTY) != NULL) {
171          password = CFDataCreate(NULL, (const UInt8 *)passbuf, strlen(passbuf));
172          if (password != NULL) {
173              success = SOSCCTryUserCredentials(CFSTR("security command line tool"), password, error);
174              CFReleaseNull(password);
175          }
176      }
177  
178      return success;
179  }
180  
181  static bool syncAndWait(CFErrorRef *err)
182  {
183      __block CFTypeRef objects = NULL;
184  
185      dispatch_queue_t generalq = dispatch_queue_create("general", DISPATCH_QUEUE_SERIAL);
186  
187      const uint64_t maxTimeToWaitInSeconds = 30ull * NSEC_PER_SEC;
188      dispatch_semaphore_t waitSemaphore = dispatch_semaphore_create(0);
189      dispatch_time_t finishTime = dispatch_time(DISPATCH_TIME_NOW, maxTimeToWaitInSeconds);
190  
191      CloudKeychainReplyBlock replyBlock = ^ (CFDictionaryRef returnedValues, CFErrorRef error)
192      {
193          secinfo("sync", "SOSCloudKeychainSynchronizeAndWait returned: %@", returnedValues);
194          if (error)
195              secerror("SOSCloudKeychainSynchronizeAndWait returned error: %@", error);
196          objects = CFRetainSafe(returnedValues);
197  
198          secinfo("sync", "SOSCloudKeychainGetObjectsFromCloud block exit: %@", objects);
199          dispatch_semaphore_signal(waitSemaphore);
200      };
201  
202      SOSCloudKeychainSynchronizeAndWait(generalq, replyBlock);
203  
204  	dispatch_semaphore_wait(waitSemaphore, finishTime);
205  
206      (void)SOSCCDumpCircleKVSInformation(NULL);
207      fprintf(outFile, "\n");
208      return false;
209  }
210  
211  static void dumpStringSet(CFStringRef label, CFSetRef s) {
212      if(!s || !label) return;
213      
214      printmsg(CFSTR("%@: { "), label);
215      __block bool first = true;
216      CFSetForEach(s, ^(const void *p) {
217          CFStringRef fmt = CFSTR(", %@");
218          if(first) {
219              fmt = CFSTR("%@");
220          }
221          CFStringRef string = (CFStringRef) p;
222          printmsg(fmt, string);
223          first=false;
224      });
225      printmsg(CFSTR(" }\n"), NULL);
226  }
227  
228  static bool dumpMyPeer(CFErrorRef *error) {
229      SOSPeerInfoRef myPeer = SOSCCCopyMyPeerInfo(error);
230  
231      if (!myPeer) return false;
232      
233      CFStringRef peerID = SOSPeerInfoGetPeerID(myPeer);
234      CFStringRef peerName = SOSPeerInfoGetPeerName(myPeer);
235      CFIndex peerVersion = SOSPeerInfoGetVersion(myPeer);
236      bool retirement = SOSPeerInfoIsRetirementTicket(myPeer);
237      
238      printmsg(CFSTR("Peer Name: %@    PeerID: %@   Version: %d\n"), peerName, peerID, peerVersion);
239      if(retirement) {
240          CFDateRef retdate = SOSPeerInfoGetRetirementDate(myPeer);
241          printmsg(CFSTR("Retired: %@\n"), retdate);
242  
243      }
244      
245      if(peerVersion >= 2) {
246          CFMutableSetRef views = SOSPeerInfoV2DictionaryCopySet(myPeer, sViewsKey);
247          CFStringRef serialNumber = SOSPeerInfoV2DictionaryCopyString(myPeer, sSerialNumberKey);
248          CFBooleanRef preferIDS = SOSPeerInfoV2DictionaryCopyBoolean(myPeer, sPreferIDS);
249          CFBooleanRef preferIDSFragmentation = SOSPeerInfoV2DictionaryCopyBoolean(myPeer, sPreferIDSFragmentation);
250          CFBooleanRef preferIDSACKModel = SOSPeerInfoV2DictionaryCopyBoolean(myPeer, sPreferIDSACKModel);
251          CFStringRef transportType = SOSPeerInfoV2DictionaryCopyString(myPeer, sTransportType);
252          CFStringRef idsDeviceID = SOSPeerInfoV2DictionaryCopyString(myPeer, sDeviceID);
253  
254          printmsg(CFSTR("Serial#: %@   PrefIDS#: %@   PrefFragmentation#: %@   PrefACK#: %@   transportType#: %@   idsDeviceID#: %@\n"),
255                   serialNumber, preferIDS, preferIDSFragmentation, preferIDSACKModel, transportType, idsDeviceID);
256  
257          printmsg(CFSTR("Serial#: %@\n"),
258                   serialNumber);
259          dumpStringSet(CFSTR("             Views: "), views);
260  
261  
262          CFReleaseSafe(serialNumber);
263          CFReleaseSafe(preferIDS);
264          CFReleaseSafe(preferIDSFragmentation);
265          CFReleaseSafe(views);
266          CFReleaseSafe(transportType);
267          CFReleaseSafe(idsDeviceID);
268      }
269  
270      bool ret = myPeer != NULL;
271      CFReleaseNull(myPeer);
272      return ret;
273  }
274  
275  static bool setBag(char *itemName, CFErrorRef *err)
276  {
277      __block bool success = false;
278      __block CFErrorRef error = NULL;
279  
280      CFStringRef random = SecPasswordCreateWithRandomDigits(10, NULL);
281  
282      CFStringPerformWithUTF8CFData(random, ^(CFDataRef stringAsData) {
283          if (0 == strncasecmp(optarg, "single", 6) || 0 == strncasecmp(optarg, "all", 3)) {
284              bool includeV0 = (0 == strncasecmp(optarg, "all", 3));
285              printmsg(CFSTR("Setting iCSC single using entropy from string: %@\n"), random);
286              CFDataRef aks_bag = SecAKSCopyBackupBagWithSecret(CFDataGetLength(stringAsData), (uint8_t*)CFDataGetBytePtr(stringAsData), &error);
287  
288              if (aks_bag) {
289                  success = SOSCCRegisterSingleRecoverySecret(aks_bag, includeV0, &error);
290                  if (!success) {
291                      printmsg(CFSTR("Failed registering single secret %@"), error);
292                      CFReleaseNull(aks_bag);
293                  }
294              } else {
295                  printmsg(CFSTR("Failed to create aks_bag: %@"), error);
296              }
297              CFReleaseNull(aks_bag);
298          } else if (0 == strncasecmp(optarg, "device", 6)) {
299              printmsg(CFSTR("Setting Device Secret using entropy from string: %@\n"), random);
300  
301              SOSPeerInfoRef me = SOSCCCopyMyPeerWithNewDeviceRecoverySecret(stringAsData, &error);
302  
303              success = me != NULL;
304  
305              if (!success)
306                  printmsg(CFSTR("Failed: %@\n"), err);
307              CFReleaseNull(me);
308          } else {
309              printmsg(CFSTR("Unrecognized argument to -b %s\n"), optarg);
310          }
311      });
312  
313  
314      return success;
315  }
316  
317  static void prClientViewState(char *label, bool result) {
318      fprintf(outFile, "Sync Status for %s: %s\n", label, (result) ? "enabled": "not enabled");
319  }
320  
321  static bool clientViewStatus(CFErrorRef *error) {
322      prClientViewState("KeychainV0", SOSCCIsIcloudKeychainSyncing());
323      prClientViewState("Safari", SOSCCIsSafariSyncing());
324      prClientViewState("AppleTV", SOSCCIsAppleTVSyncing());
325      prClientViewState("HomeKit", SOSCCIsHomeKitSyncing());
326      prClientViewState("Wifi", SOSCCIsWiFiSyncing());
327      prClientViewState("AlwaysOnNoInitialSync", SOSCCIsContinuityUnlockSyncing());
328      return false;
329  }
330  
331  #pragma mark -
332  #pragma mark --remove-peer
333  
334  static void
335  add_matching_peerinfos(CFMutableArrayRef list, CFArrayRef spids, CFArrayRef (*copy_peer_func)(CFErrorRef *))
336  {
337      CFErrorRef error;
338      CFArrayRef peers;
339      SOSPeerInfoRef pi;
340      CFStringRef spid;
341      CFIndex i, j;
342  
343      peers = copy_peer_func(&error);
344      if (peers != NULL) {
345          for (i = 0; i < CFArrayGetCount(peers); i++) {
346              pi = (SOSPeerInfoRef)CFArrayGetValueAtIndex(peers, i);
347              for (j = 0; j < CFArrayGetCount(spids); j++) {
348                  spid = (CFStringRef)CFArrayGetValueAtIndex(spids, j);
349                  if (CFStringGetLength(spid) < 8) {
350                      continue;
351                  }
352                  if (CFStringHasPrefix(SOSPeerInfoGetPeerID(pi), spid)) {
353                      CFArrayAppendValue(list, pi);
354                  }
355              }
356          }
357          CFRelease(peers);
358      } else {
359          // unlikely
360          CFShow(error);
361          CFRelease(error);
362      }
363  }
364  
365  static CFArrayRef
366  copy_peerinfos(CFArrayRef spids)
367  {
368      CFMutableArrayRef matches;
369  
370      matches = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
371      add_matching_peerinfos(matches, spids, SOSCCCopyValidPeerPeerInfo);
372      add_matching_peerinfos(matches, spids, SOSCCCopyNotValidPeerPeerInfo);
373      add_matching_peerinfos(matches, spids, SOSCCCopyRetirementPeerInfo);
374  
375      return matches;
376  }
377  
378  static bool
379  doRemovePeers(CFArrayRef peerids, CFErrorRef *error)
380  {
381      bool success = false;
382      CFArrayRef peers = NULL;
383      CFErrorRef localError = NULL;
384      CFIndex i;
385      char buf[16];
386  
387      peers = copy_peerinfos(peerids);
388      if (peers == NULL || CFArrayGetCount(peers) == 0) {
389          fprintf(stdout, "No matching peers to remove.\n");
390          success = true;
391          goto done;
392      }
393  
394      fprintf(stdout, "Matched the following devices:\n");
395      for (i = 0; i < CFArrayGetCount(peers); i++) {
396          // Ugly.
397          CFShow(CFArrayGetValueAtIndex(peers, i));
398      }
399  
400      if (readpassphrase("Confirm removal (y/N): ", buf, sizeof(buf), RPP_ECHO_ON | RPP_FORCEUPPER) == NULL) {
401          goto done;
402      }
403  
404      if (buf[0] != 'Y') {
405          success = true;
406          goto done;
407      }
408  
409      success = SOSCCRemovePeersFromCircle(peers, &localError);
410      if (!success && isSOSErrorCoded(localError, kSOSErrorPrivateKeyAbsent)) {
411          CFReleaseNull(localError);
412  
413          success = promptAndTryPassword(&localError);
414          if (success) {
415              success = SOSCCRemovePeersFromCircle(peers, &localError);
416          }
417      }
418  
419  done:
420      CFReleaseNull(peers);
421  
422      if (!success && error != NULL) {
423          *error = localError;
424      } else {
425          CFReleaseNull(localError);
426      }
427  
428      return success;
429  }
430  
431  #pragma mark -
432  
433  // enable, disable, accept, reject, status, Reset, Clear
434  int
435  keychain_sync(int argc, char * const *argv)
436  {
437      /*
438  	 "Keychain Syncing"
439  	 "    -d     disable"
440  	 "    -e     enable (join/create circle)"
441  	 "    -i     info (current status)"
442  	 "    -m     dump my peer"
443  	 "
444  	 "Account/Circle Management"
445  	 "    -a     accept all applicants"
446  	 "    -r     reject all applicants"
447       "    -b     device|all|single Register a backup bag - THIS RESETS BACKUPS!\n"
448  
449  	 "    -N     (re-)set to new account (USE WITH CARE: device will not leave circle before resetting account!)"
450  	 "    -O     reset to offering"
451  	 "    -R     reset circle"
452       "    -o     list view unaware peers in circle"
453       "    -0     boot view unaware peers from circle"
454       "    -5     cleanup old KVS keys in KVS"
455  	 "
456       "Circle Tools\n"
457       "    --remove-peer SPID     Remove a peer identified by the first 8 or more\n"
458       "                           characters of its spid. Specify multiple times to\n"
459       "                           remove more than one peer.\n"
460  	 "Password"
461  	 "    -P     [label:]password  set password (optionally for a given label) for sync"
462  	 "    -T     [label:]password  try password (optionally for a given label) for sync"
463  	 "
464  	 "KVS"
465  	 "    -k     pend all registered kvs keys"
466  	 "    -C     clear all values from KVS"
467  	 "    -D     [itemName]  dump contents of KVS"
468       "    -W     sync and dump"
469  	 "
470  	 "Misc"
471  	 "    -v     [enable|disable|query:viewname] enable, disable, or query my PeerInfo's view set"
472  	 "             viewnames are: keychain|masterkey|iclouddrive|photos|cloudkit|escrow|fde|maildrop|icloudbackup|notes|imessage|appletv|homekit|"
473       "                            wifi|passwords|creditcards|icloudidentity|othersyncable"
474       "    -L     list all known view and their status"
475  	 "    -U     purge private key material cache\n"
476       "    -V     Report View Sync Status on all known clients.\n"
477       */
478      enum {
479          SYNC_REMOVE_PEER,
480      };
481      int action = -1;
482      const struct option longopts[] = {
483          { "remove-peer",    required_argument,  &action,    SYNC_REMOVE_PEER, },
484          { NULL,             0,                  NULL,       0, },
485      };
486      int ch, result = 0;
487      CFErrorRef error = NULL;
488      bool hadError = false;
489      CFMutableArrayRef peers2remove = NULL;
490      SOSLogSetOutputTo(NULL, NULL);
491  
492      while ((ch = getopt_long(argc, argv, "ab:deikmorv:NCDLOP:RT:UWV05", longopts, NULL)) != -1) {
493          switch  (ch) {
494              case 'a':
495              {
496                  CFArrayRef applicants = SOSCCCopyApplicantPeerInfo(NULL);
497                  if (applicants) {
498                      hadError = !SOSCCAcceptApplicants(applicants, &error);
499                      CFRelease(applicants);
500                  } else {
501                      fprintf(errFile, "No applicants to accept\n");
502                  }
503                  break;
504              }
505              case 'b':
506              {
507                  hadError = setBag(optarg, &error);
508                  break;
509              }
510              case 'd':
511              {
512                  fprintf(outFile, "Turning OFF keychain syncing\n");
513                  hadError = !SOSCCRemoveThisDeviceFromCircle(&error);
514                  break;
515              }
516              case 'e':
517              {
518                  fprintf(outFile, "Turning ON keychain syncing\n");
519                  hadError = requestToJoinCircle(&error);
520                  break;
521              }
522              case 'i':
523              {
524                  SOSCCDumpCircleInformation();
525                  SOSCCDumpEngineInformation();
526                  break;
527              }
528              case 'k':
529              {
530                  notify_post("com.apple.security.cloudkeychain.forceupdate");
531                  break;
532              }
533              case 'm':
534              {
535                  hadError = !dumpMyPeer(&error);
536                  break;
537              }
538              case 'o':
539              {
540                  SOSCCDumpViewUnwarePeers();
541                  break;
542              }
543              case 'r':
544              {
545                  CFArrayRef applicants = SOSCCCopyApplicantPeerInfo(NULL);
546                  if (applicants)	{
547                      hadError = !SOSCCRejectApplicants(applicants, &error);
548                      CFRelease(applicants);
549                  } else {
550                      fprintf(errFile, "No applicants to reject\n");
551                  }
552                  break;
553              }
554              case 'v':
555              {
556                  hadError = !viewcmd(optarg, &error);
557                  break;
558              }
559              case 'C':
560              {
561                  hadError = clearAllKVS(&error);
562                  break;
563              }
564              case 'D':
565              {
566                  (void)SOSCCDumpCircleKVSInformation(optarg);
567                  break;
568              }
569              case 'L':
570              {
571                  hadError = !listviewcmd(&error);
572                  break;
573              }
574              case 'N':
575              {
576                  hadError = !SOSCCAccountSetToNew(&error);
577                  if (!hadError)
578                      notify_post(kSOSCCCircleChangedNotification);
579                  break;
580              }
581              case 'O':
582              {
583                  hadError = !SOSCCResetToOffering(&error);
584                  break;
585              }
586              case 'P':
587              {
588                  hadError = setPassword(optarg, &error);
589                  break;
590              }
591              case 'R':
592              {
593                  hadError = !SOSCCResetToEmpty(&error);
594                  break;
595              }
596              case 'T':
597              {
598                  hadError = tryPassword(optarg, &error);
599                  break;
600              }
601              case 'U':
602              {
603                  hadError = !SOSCCPurgeUserCredentials(&error);
604                  break;
605              }
606              case 'V':
607              {
608                  hadError = clientViewStatus(&error);
609                  break;
610              }
611              case 'W':
612              {
613                  hadError = syncAndWait(&error);
614                  break;
615              }
616              case '0':
617              {
618                  CFArrayRef unawares = SOSCCCopyViewUnawarePeerInfo(&error);
619                  if (unawares) {
620                      hadError = !SOSCCRemovePeersFromCircle(unawares, &error);
621                  } else {
622                      hadError = true;
623                  }
624                  CFReleaseNull(unawares);
625                  break;
626              }
627              case '5' :
628              {
629                  bool result = SOSCCCleanupKVSKeys(&error);
630                  if(result)
631                  {
632                      printmsg(CFSTR("Got all the keys from KVS %d\n"), result);
633                  }else {
634                      hadError = true;
635                  }
636                  break;
637              }
638              case 0:
639              {
640                  if (action == SYNC_REMOVE_PEER) {
641                      CFStringRef optstr = CFStringCreateWithCString(NULL, optarg, kCFStringEncodingUTF8);
642                      if (peers2remove == NULL) {
643                          peers2remove = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
644                      }
645                      CFArrayAppendValue(peers2remove, optstr);
646                      CFReleaseNull(optstr);
647                  } else {
648                      return SHOW_USAGE_MESSAGE;
649                  }
650                  break;
651              }
652              case '?':
653              default:
654                  return SHOW_USAGE_MESSAGE;
655          }
656      }
657  
658      if (peers2remove != NULL) {
659          hadError = !doRemovePeers(peers2remove, &error);
660          CFRelease(peers2remove);
661      }
662  
663      if (hadError) {
664          printerr(CFSTR("Error: %@\n"), error);
665      }
666  
667      return result;
668  }