Tatsu Signing Server

The Tatsu Signing Server (TSS) is a collection of services provided by Apple. In late 2012, the list of available services was briefly made public at gs.apple.com. This index page has since been removed, although at least one archived capture exists. TSS is accessed chiefly for use of the SHSH Protocol to receive signed blobs for a given iOS build. This is achieved with the SHSH controller at http://gs.apple.com/TSS/controller.

There is an Apple internal equivalent, known as SpiderCab, running at tatsu-tss-internal.apple.com and tss-int.apple.com, which are only accessible within Apple's VPN. SpiderCab is used to sign internal/debug and test builds of iOS, including old versions that are no longer signed on production.

Reliable communication to the TSS server requires the appropriate HTTP header, as described in SHSH Protocol. If you are communicating with a TSS service and not the SHSH controller itself, you must additionally provide a  header containing the URL of the service you are accessing. Also note that not all TSS servers accept SOAP requests. Because http://gs.apple.com automatically resolves to one of the half-a-dozen TSS servers, some of which indiscriminately returning "403 Forbidden" to SOAP, it is recommended to communicate directly with a known-working TSS IP address.

Services
There are two services provided, both accessible via SOAP requests. They are located in http://gs.apple.com/TSS/services/ under their respective names. A sample request concerning "getReceiptPacketStatus" from the "tatsuReceiptsStatusPort" service is demonstrated below:

> POST /TSS/services/tatsuReceiptsStatusPort HTTP/1.1 > Host: gs.apple.com > User-Agent: InetURL/1.0 > Accept: */* > Content-Length: 588 > Content-Type: text/xml;charset=utf-8 > SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort

SOAP XML:           

Response:      </ns1:getReceiptPacketStatusResponse> <multiRef id="id0" soapenc:root="0" soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xsi:type="ns2:ReceiptDataPacketStatusResponse" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:ns2="http://receiptsstatus.web.tss.apple.com"> <batchIdhref="#id1"/> <status href="#id2"/> <ip xsi:type="xsd:string">10.108.105.161</ip> </multiRef> <multiRef id="id1" soapenc:root="0" soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xsi:type="xsd:long" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> 0 	</multiRef> <multiRef id="id2" soapenc:root="0" soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xsi:type="ns3:status" xmlns:ns3="http://receiptsstatus.web.tss.apple.com" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> is the location of the aforementioned SOAP XML):

curl -i -m 1.0 -H "Content-Type: text/xml;charset=utf-8" -A InetURL/1.0 -H "SOAPAction: http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort" -H "Host: gs.apple.com" -d @soap.xml http://gs.apple.com/TSS/services/tatsuReceiptsStatusPort

Note:  The server may occasionally return  despite a valid response. Retrying the request will likely remedy this. Is this a race condition bug on the server side?

pushDataPacket

 * Input Message
 * Output Message

getReceiptPacketStatus
Returns two unknown numbers, a private IP address (likely meant to be accessed within Apple’s internal VPN), and some  tags (how are these supposed to be parsed?).


 * Input Message
 * : (type= )
 * Elements:  (Number)
 * Output Message
 * : (type= )
 * Elements:,   (String),  ,   (String)

queryTASExpireTSA

 * Input Message
 * : (type= )
 * Elements:  (Number)
 * Output Message
 * : (type= )

updateTSSStatus

 * Input Message
 * : (type= )
 * Output Message
 * : (type= )
 * Elements:  (Number)

Server Details
It is of moderate security concern to know that the TSS server runs Apache Tomcat, which is exposed, alongside version number, in the default 404 page. The SOAP implementation used is Apache Axis (Java).