Tatsu Signing Server - Revision history

Vanished user 20210509: It was fun while it lasted.

2020-03-28T19:40:54Z

It was fun while it lasted.

Vanished user 20210509: The IP is unreachable because it is private. Likely meant for Apple’s VPN

2020-02-18T05:13:39Z

The IP is unreachable because it is private. Likely meant for Apple’s VPN

Vanished user 20210509: Nevermind, looks like this may be possible

2020-02-17T23:04:20Z

Nevermind, looks like this may be possible

Vanished user 20210509: Don't think I can get much farther without seeing the WSDL itself.

2020-02-17T22:07:20Z

Don't think I can get much farther without seeing the WSDL itself.

Vanished user 20210509: More research. Still can't access the WSDL, though :(

2020-02-16T23:04:49Z

More research. Still can't access the WSDL, though :(

Vanished user 20210509: TSS research

2020-02-16T00:20:49Z

TSS research

Vanished user 20210509 at 22:32, 15 February 2020

2020-02-15T22:32:44Z

Justin: Apple Employee Edit

2019-12-30T22:56:23Z

Apple Employee Edit

Iemit737: Updates to make TSS more informative

2013-07-20T12:53:48Z

Updates to make TSS more informative

Iemit737: internal tatsu link

2013-07-20T12:50:15Z

internal tatsu link

@@ Line 4: / Line 4: @@
 There is an Apple internal equivalent, known as SpiderCab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] and [http://tss-int.apple.com:80 tss-int.apple.com], which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.
-Reliable communication to the TSS server requires the appropriate HTTP header, as described in [[SHSH Protocol#Communication]]. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a <code>SOAPAction:</code> header containing the URL of the service you are accessing. Also note that '''not all TSS servers accept SOAP requests.''' Because http://gs.apple.com automatically resolves to one of the half-a-dozen TSS servers, some of which indiscriminately returning "403 Forbidden" to SOAP, it is recommended to communicate directly with a known-working TSS IP address.
+'''Note: As of 2/18/2020, access to TSS SOAP services is forbidden, likely to all outside of Apple's internal network.''' Reliable communication to the TSS server requires the appropriate HTTP header, as described in [[SHSH Protocol#Communication]]. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a <code>SOAPAction:</code> header containing the URL of the service you are accessing. Also note that '''not all TSS servers accept SOAP requests.'''
 == Services ==
@@ Line 32: / Line 32: @@
  			xsi:type="ns2:ReceiptDataPacketStatusRequest"
  			xmlns:ns2="http://receiptsstatus.web.tss.apple.com">
- 			<ns2:status><code>1</code></ns2:status>
+ 			<ns2:status><nowiki><code>1</code></nowiki></ns2:status>
  		</ns1:param0>
  	</ns1:getReceiptPacketStatus>
@@ Line 110: / Line 110: @@
 ===tatsuReceiptsStatusPort===
 ====getReceiptPacketStatus====
-Returns two unknown numbers, a [https://en.m.wikipedia.org/wiki/Reserved_IP_addresses private IP address] (likely meant to be accessed within Apple’s internal VPN), and some <code>multiRef</code> tags (how are these supposed to be parsed?).
+Returns an unknown number, a status type, and a [https://en.m.wikipedia.org/wiki/Reserved_IP_addresses private IP address] (likely meant to be accessed within Apple’s internal VPN).
 * '''Input Message''' (<code>getReceiptPacketStatusRequest</code>)
-** <code>param0</code>: (type=<code>ReceiptDataPacketStatusRequest</code>)
+** <code>param0</code> (type=<code>ReceiptDataPacketStatusRequest</code>)
 * '''Output Message''' (<code>getReceiptPacketStatusResponse</code>)
-** <code>param1</code>: (type=<code>ReceiptDataPacketStatusResponse</code>)
+** <code>param1</code> (type=<code>ReceiptDataPacketStatusResponse</code>)
 ====queryTASExpireTSA====
 * '''Input Message''' (<code>queryTASExpireTSARequest</code>)
-** <code>param2</code>: (type=<code>ExpireTSAQueryRequest</code>)
+** <code>param2</code> (type=<code>ExpireTSAQueryRequest</code>)
 * '''Output Message''' (<code>queryTASExpireTSAResponse</code>)
-** <code>param3</code>: (type=<code>ExpireTSAQueryResponse</code>)
+** <code>param3</code> (type=<code>ExpireTSAQueryResponse</code>)
 ====updateTSSStatus====
 * '''Input Message''' (<code>updateTSSStatusRequest</code>)
-** <code>param4</code>: (type=<code>status</code>)
+** <code>param4</code> (type=<code>status</code>)
 * '''Output Message''' (<code>updateTSSStatusResponse</code>)
-** <code>param5</code>: (type=<code>status</code>)
+** <code>param5</code> (type=<code>status</code>)
 == Notes ==

@@ Line 113: / Line 113: @@
 ====getReceiptPacketStatus====
-Returns two unknown numbers, an IP address with an unreachable destination (not in the common 17.x.x.x Apple IP range, either), and some <code>multiRef</code> tags (how are these supposed to be parsed?).
+Returns two unknown numbers, a [https://en.m.wikipedia.org/wiki/Reserved_IP_addresses private IP address] (likely meant to be accessed within Apple’s internal VPN), and some <code>multiRef</code> tags (how are these supposed to be parsed?).
 * '''Input Message''' (<code>getReceiptPacketStatusRequest</code>)
@@ Line 140: / Line 140: @@
 == Notes ==
-[https://www.soapui.org SoapUI], an automation framework for the SOAP protocol, lists Apple among their largest users [https://www.soapui.org/downloads/download-soapui-pro-trial.html].
+[https://www.soapui.org SoapUI], a test automation framework for the SOAP protocol, lists Apple among their largest users [https://www.soapui.org/downloads/download-soapui-pro-trial.html].
 ===Server Details===

@@ Line 32: / Line 32: @@
  			xsi:type="ns2:ReceiptDataPacketStatusRequest"
  			xmlns:ns2="http://receiptsstatus.web.tss.apple.com">
  		</ns1:param0>
  	</ns1:getReceiptPacketStatus>
@@ Line 49: / Line 50: @@
  		soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
  		xmlns:ns1="http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort">
  	</ns1:getReceiptPacketStatusResponse>
  </soapenv:Body>
@@ Line 74: / Line 112: @@
 ====getReceiptPacketStatus====
 * '''Input Message''' (<code>getReceiptPacketStatusRequest</code>)
 ** <code>param0</code>: (type=<code>ReceiptDataPacketStatusRequest</code>)
 * '''Output Message''' (<code>getReceiptPacketStatusResponse</code>)
 ** <code>param1</code>: (type=<code>ReceiptDataPacketStatusResponse</code>)
 ====queryTASExpireTSA====
@@ Line 84: / Line 126: @@
 * '''Input Message''' (<code>queryTASExpireTSARequest</code>)
 ** <code>param2</code>: (type=<code>ExpireTSAQueryRequest</code>)
 * '''Output Message''' (<code>queryTASExpireTSAResponse</code>)
 ** <code>param3</code>: (type=<code>ExpireTSAQueryResponse</code>)
@@ Line 91: / Line 134: @@
 * '''Input Message''' (<code>updateTSSStatusRequest</code>)
 ** <code>param4</code>: (type=<code>status</code>)
 * '''Output Message''' (<code>updateTSSStatusResponse</code>)
 ** <code>param5</code>: (type=<code>status</code>)

@@ Line 4: / Line 4: @@
 There is an Apple internal equivalent, known as SpiderCab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] and [http://tss-int.apple.com:80 tss-int.apple.com], which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.
-Reliable communication to the TSS server requires the appropriate HTTP header, as described in [[SHSH Protocol#Communication]]. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a <code>SOAPAction:</code> header containing the URL of the service you are accessing.
+Reliable communication to the TSS server requires the appropriate HTTP header, as described in [[SHSH Protocol#Communication]]. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a <code>SOAPAction:</code> header containing the URL of the service you are accessing. Also note that '''not all TSS servers accept SOAP requests.''' Because http://gs.apple.com automatically resolves to one of the half-a-dozen TSS servers, some of which indiscriminately returning "403 Forbidden" to SOAP, it is recommended to communicate directly with a known-working TSS IP address.
 == Services ==
@@ Line 14: / Line 14: @@
  > User-Agent: InetURL/1.0
  > Accept: */*
- > Content-Length: 458
+ > Content-Length: 588
  > Content-Type: text/xml;charset=utf-8
  > SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort
@@ Line 29: / Line 29: @@
  		soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
  		xmlns:ns1="http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort">
  	</ns1:getReceiptPacketStatus>
  </soapenv:Body>
@@ Line 57: / Line 61: @@
  curl -i -m 1.0 -H "Content-Type: text/xml;charset=utf-8" -A InetURL/1.0 -H "SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort" -H "Host: gs.apple.com" -d @soap.xml http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort
 ===PacketPort===
-====Operations====
+====pushDataPacket====
-** Return type: <code>pushDataPacketResponse</code>
+* '''Input Message''' (<code>pushDataPacketRequest</code>)
 ===tatsuReceiptsStatusPort===
-====Operations====
+====getReceiptPacketStatus====
-** Return type: <code>getReceiptPacketStatusResponse</code>
+** <code>param0</code>: (type=<code>ReceiptDataPacketStatusRequest</code>)
-** Parameters: <code>ReceiptDataPacketStatusResponse</code>
+* '''Input Message''' (<code>getReceiptPacketStatusRequest</code>)
-** Parameters: <code>ExpireTSAQueryResponse</code>
+** <code>param1</code>: (type=<code>ReceiptDataPacketStatusResponse</code>)
-** Return type: <code>updateTSSStatusResponse</code>
+* '''Input Message''' (<code>queryTASExpireTSARequest</code>)
 == Notes ==

@@ Line 1: / Line 1: @@
-The '''Tatsu Signing Server''' ('''TSS''') is a collection of services provided by Apple. In late 2012, the list of available services was briefly made public at [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ gs.apple.com]. This index page has since been removed, although at least one archived capture of this page exists.
+The '''Tatsu Signing Server''' ('''TSS''') is a collection of services provided by Apple. In late 2012, the list of available services was briefly made public at [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ gs.apple.com]. This index page has since been removed, although at least one archived capture exists.
-TSS is accessed chiefly for use of the [[SHSH Protocol]] to receive signed blobs for a given iOS build. This is accessed with the SHSH controller at http://gs.apple.com/TSS/controller.
+TSS is accessed chiefly for use of the [[SHSH Protocol]] to receive signed blobs for a given iOS build. This is achieved with the SHSH controller at http://gs.apple.com/TSS/controller.
-There is an Apple internal equivalent, known as Spidercab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] and [http://tss-int.apple.com:80 tss-int.apple.com], which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.
+There is an Apple internal equivalent, known as SpiderCab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] and [http://tss-int.apple.com:80 tss-int.apple.com], which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.
-Reliable communication to the TSS server requires the appropriate HTTP header, as described in [[SHSH Protocol#Communication]]. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a <code>SOAPAction:</code> header.
+Reliable communication to the TSS server requires the appropriate HTTP header, as described in [[SHSH Protocol#Communication]]. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a <code>SOAPAction:</code> header containing the URL of the service you are accessing.
 == Services ==
-There are two services provided, both accessible via [https://en.wikipedia.org/wiki/SOAP SOAP] requests. They are located in http://gs.apple.com/TSS/services/ under their respective names.
+There are two services provided, both accessible via [https://en.wikipedia.org/wiki/SOAP SOAP] requests. They are located in http://gs.apple.com/TSS/services/ under their respective names. A sample request concerning "getReceiptPacketStatus" from the "tatsuReceiptsStatusPort" service is demonstrated below:
 ===PacketPort===
 * pushDataPacket
 ===tatsuReceiptsStatusPort===
 * getReceiptPacketStatus
 * queryTASExpireTSA
 * updateTSSStatus
 == Notes ==
@@ Line 25: / Line 82: @@
 ===Server Details===
-It is of moderate security concern to know that the TSS server runs [http://tomcat.apache.org/ Apache Tomcat], exposed, alongside version number, in the default 404 page. The SOAP implementation used is [http://axis.apache.org/axis/ Apache Axis] (Java).
+It is of moderate security concern to know that the TSS server runs [http://tomcat.apache.org/ Apache Tomcat], which is exposed, alongside version number, in the default 404 page. The SOAP implementation used is [http://axis.apache.org/axis/ Apache Axis] (Java).
 == References ==

@@ Line 1: / Line 1: @@
-The '''Tatsu Signing Server''' ('''TSS''') is a service provided by Apple. Apple provides a list of available services at [http://gs.apple.com/TSS/ gs.apple.com].
+The '''Tatsu Signing Server''' ('''TSS''') is a collection of services provided by Apple. In late 2012, the list of available services was briefly made public at [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ gs.apple.com]. This index page has since been removed, although at least one archived capture of this page exists.
-There is an Apple internal equivalent, known as Spidercab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] and [http://tss-int.apple.com:80 tss-int.apple.com] which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.
+There is an Apple internal equivalent, known as Spidercab, running at [http://tatsu-tss-internal.apple.com:80 tatsu-tss-internal.apple.com] and [http://tss-int.apple.com:80 tss-int.apple.com], which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.
 == References ==
@@ Line 6: / Line 11: @@
 == External Links ==
-* [http://gs.apple.com/TSS/ List of available services]
+* [https://web.archive.org/web/20121128012112/http://gs.apple.com/TSS/ List of available services (archive.org)]
 {{stub|Apple Inc.}}