ogb912/micromdm
1
0
Fork 0
mirror of https://github.com/micromdm/micromdm/ synced 2026-08-08 02:25:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

scep v2, Mozilla PKCS7 fork, cleanup (#737)

Browse Source 
- Upgrade to micromdm/scep v2 & updated API usage
  - Use interfaces rather than concrete types in a few places
- Switch to Mozilla's PKCS7 fork (actually @omorsi's fork of that fork)
- Import order: stdlib, project/self, 3rd party
This commit is contained in:
Jesse Peterson
2021-06-09 15:44:58 -07:00
committed by GitHub
parent 0b2caa5b77
commit 4d5fbf5fd1
15 changed files with 90 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -2,6 +2,7 @@
- Fix SetFirmwarePassword and VerifyFirmwarePassword parameters (#743)
- Command UUID can now be passed in as as a request parameter (#754)
- Update to SCEP v2, switch to Mozilla PKCS7 fork, interface cleanup (#737)
## [v1.8.0](https://github.com/micromdm/micromdm/compare/v1.7.1...v1.8.0) February, 2021

5
cmd/mdmctl/mdmcert.download.go
View File

@@ -14,11 +14,12 @@ import (
"net/http"
"os"
"github.com/fullsailor/pkcs7"
"github.com/go-kit/kit/log"
"github.com/micromdm/micromdm/pkg/crypto"
"github.com/micromdm/micromdm/pkg/crypto/mdmcertutil"
"github.com/go-kit/kit/log"
"github.com/pkg/errors"
"go.mozilla.org/pkcs7"
)
const (

24
cmd/micromdm/serve.go
View File

@@ -14,18 +14,6 @@ import (
"strings"
"time"
"github.com/boltdb/bolt"
"github.com/go-kit/kit/auth/basic"
"github.com/go-kit/kit/log"
httptransport "github.com/go-kit/kit/transport/http"
"github.com/groob/finalizer/logutil"
"github.com/micromdm/go4/env"
"github.com/micromdm/go4/httputil"
"github.com/micromdm/go4/version"
scep "github.com/micromdm/scep/server"
"github.com/pkg/errors"
"golang.org/x/crypto/acme/autocert"
"github.com/micromdm/micromdm/mdm"
"github.com/micromdm/micromdm/mdm/enroll"
httputil2 "github.com/micromdm/micromdm/pkg/httputil"
@@ -46,6 +34,18 @@ import (
"github.com/micromdm/micromdm/platform/user"
userbuiltin "github.com/micromdm/micromdm/platform/user/builtin"
"github.com/micromdm/micromdm/server"
"github.com/boltdb/bolt"
"github.com/go-kit/kit/auth/basic"
"github.com/go-kit/kit/log"
httptransport "github.com/go-kit/kit/transport/http"
"github.com/groob/finalizer/logutil"
"github.com/micromdm/go4/env"
"github.com/micromdm/go4/httputil"
"github.com/micromdm/go4/version"
scep "github.com/micromdm/scep/v2/server"
"github.com/pkg/errors"
"golang.org/x/crypto/acme/autocert"
)
const homePage = `<!doctype html>

6
go.mod
View File

@@ -4,7 +4,6 @@ require (
github.com/RobotsAndPencils/buford v0.12.0
github.com/boltdb/bolt v1.3.1
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/fullsailor/pkcs7 v0.0.0-20180824154052-36585635cb64
github.com/garyburd/go-oauth v0.0.0-20180319155456-bca2e7f09a17
github.com/go-kit/kit v0.7.0
github.com/go-sql-driver/mysql v1.4.0 // indirect
@@ -23,18 +22,19 @@ require (
github.com/lib/pq v1.0.0
github.com/mattn/go-sqlite3 v1.9.0 // indirect
github.com/micromdm/go4 v0.0.0-20210104222236-8a0936d9e451
github.com/micromdm/scep v1.0.1-0.20181014170139-9be65e185499
github.com/micromdm/scep/v2 v2.0.0 // indirect
github.com/pkg/errors v0.8.0
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/pressly/goose v2.3.0+incompatible
github.com/stretchr/testify v1.2.2 // indirect
github.com/ziutek/mymysql v1.5.4 // indirect
go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3
google.golang.org/appengine v1.2.0 // indirect
gopkg.in/Masterminds/squirrel.v1 v1.0.0-20170825200431-a6b93000bd21
)
replace github.com/fullsailor/pkcs7 => github.com/groob/pkcs7 v0.0.0-20180824154052-36585635cb64
replace go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 => github.com/omorsi/pkcs7 v0.0.0-20210217142924-a7b80a2a8568
go 1.13

21
go.sum
View File

@@ -19,10 +19,7 @@ github.com/go-stack/stack v1.7.0 h1:S04+lLfST9FvL8dl4R31wVUC/paZp/WQZbLmUgWboGw=
github.com/go-stack/stack v1.7.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
@@ -32,6 +29,7 @@ github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0
github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -43,8 +41,6 @@ github.com/gorilla/mux v1.6.2 h1:Pgr17XVTNXAk3q/r4CpKzC5xBM/qW1uVLV+IhRZpIIk=
github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
github.com/groob/finalizer v0.0.0-20170707115354-4c2ed49aabda h1:5ikpG9mYCMFiZX0nkxoV6aU2IpCHPdws3gCNgdZeEV0=
github.com/groob/finalizer v0.0.0-20170707115354-4c2ed49aabda/go.mod h1:MyndkAZd5rUMdNogn35MWXBX1UiBigrU8eTj8DoAC2c=
github.com/groob/pkcs7 v0.0.0-20180824154052-36585635cb64 h1:1ALD84dEnUxPKZENhUAeQ0tuJ+s3PuL85pV95B0Ekfk=
github.com/groob/pkcs7 v0.0.0-20180824154052-36585635cb64/go.mod h1:mEOMQ8C7oeXY3LnE2jy4UkLAqrW9rrpwiP5U4hVV+MY=
github.com/groob/plist v0.0.0-20180203051248-dd56909aee38 h1:afbUddvIjPRC7XHHgeSTRfzZtIxEsSl4VCxumLBGDJU=
github.com/groob/plist v0.0.0-20180203051248-dd56909aee38/go.mod h1:qg2Nek0ND/hIr+nY8H1oVqEW2cLzVVNaAQ0QexOyjyc=
github.com/jmoiron/sqlx v0.0.0-20180614180643-0dae4fefe7c0 h1:5B0uxl2lzNRVkJVg+uGHxWtRt4C0Wjc6kJKo5XYx8xE=
@@ -63,12 +59,12 @@ github.com/lib/pq v1.0.0 h1:X5PMW56eZitiTeO7tKzZxFCSpbFZJtkMMooicw2us9A=
github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
github.com/mattn/go-sqlite3 v1.9.0 h1:pDRiWfl+++eC2FEFRy6jXmQlvp4Yh3z1MJKg4UeYM/4=
github.com/mattn/go-sqlite3 v1.9.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
github.com/micromdm/go4 v0.0.0-20191221011012-654e10aaab18 h1:0XJmYdtM8IWZPsFWwaOYOQuPLbaj1kaSYixLN8JB62g=
github.com/micromdm/go4 v0.0.0-20191221011012-654e10aaab18/go.mod h1:8EzTEgA3q2ZdZotWXs1bWnFCXuaFHU0+jDNZbHlwduM=
github.com/micromdm/go4 v0.0.0-20210104222236-8a0936d9e451 h1:xHy+uslAu/WFXOQHqyx9//qNcpwtd6dHo/Avi2CCfhU=
github.com/micromdm/go4 v0.0.0-20210104222236-8a0936d9e451/go.mod h1:uZTekMktf1ayaNK9onByUXwKleUvJNQw/cpZaNkvvRo=
github.com/micromdm/scep v1.0.1-0.20181014170139-9be65e185499 h1:tAPbBGVDrfo7Tv4rvmzVQPfbQTrR/XSLbl4JuGfJbPI=
github.com/micromdm/scep v1.0.1-0.20181014170139-9be65e185499/go.mod h1:a4hGfYA9e51888COzEduLGsstH9NPxJPndn/Ke5/Tw8=
github.com/micromdm/scep/v2 v2.0.0 h1:cRzcY0S5QX+0+J+7YC4P2uZSnfMup8S8zJu/bLFgOkA=
github.com/micromdm/scep/v2 v2.0.0/go.mod h1:ouaDs5tcjOjdHD/h8BGaQsWE87MUnQ/wMTMgfMMIpPc=
github.com/omorsi/pkcs7 v0.0.0-20210217142924-a7b80a2a8568 h1:+MPqEswjYiS0S1FCTg8MIhMBMzxiVQ94rooFwvPPiWk=
github.com/omorsi/pkcs7 v0.0.0-20210217142924-a7b80a2a8568/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -79,24 +75,21 @@ github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
github.com/ziutek/mymysql v1.5.4 h1:GB0qdRGsTwQSBVYuVShFBKaXSnSnYYC2d9knnE1LHFs=
github.com/ziutek/mymysql v1.5.4/go.mod h1:LMSpPZ6DbqWFxNCHW77HeMg9I646SAhApZ/wKdgO/C0=
golang.org/x/crypto v0.0.0-20180614174826-fd5f17ee7299 h1:zxP+xTjjk4kD+M5IFPweL7/4851FUhYkzbDqbzkN1JE=
golang.org/x/crypto v0.0.0-20180614174826-fd5f17ee7299/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/net v0.0.0-20170726083632-f5079bd7f6f7/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20180724234803-3673e40ba225 h1:kNX+jCowfMYzvlSvJu5pQWEmyWFrBXJ3PBy10xKMXK8=
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/sys v0.0.0-20170728174421-0f826bdd13b5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20180614134839-8883426083c0 h1:5mOaSPjCt3RW5w1KpSFOVg8VdqQQ/FjfM5/m50f/8wM=
golang.org/x/sys v0.0.0-20180614134839-8883426083c0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
google.golang.org/appengine v1.2.0 h1:S0iUepdCWODXRvtE+gcRDd15L+k+k1AiHlMiMjefH24=
google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=

12
mdm/enroll/endpoint.go
View File

@@ -5,12 +5,12 @@ import (
"errors"
"fmt"
"github.com/fullsailor/pkcs7"
"github.com/go-kit/kit/endpoint"
boltdepot "github.com/micromdm/scep/depot/bolt"
"github.com/micromdm/micromdm/pkg/crypto"
"github.com/micromdm/micromdm/platform/profile"
"github.com/go-kit/kit/endpoint"
"github.com/micromdm/scep/v2/depot"
"go.mozilla.org/pkcs7"
)
type Endpoints struct {
@@ -59,7 +59,7 @@ type mdmOTAPhase2Phase3Request struct {
p7 *pkcs7.PKCS7
}
func MakeServerEndpoints(s Service, scepDepot *boltdepot.Depot) Endpoints {
func MakeServerEndpoints(s Service, scepDepot depot.Depot) Endpoints {
return Endpoints{
GetEnrollEndpoint: MakeGetEnrollEndpoint(s),
OTAEnrollEndpoint: MakeOTAEnrollEndpoint(s),
@@ -90,7 +90,7 @@ func MakeOTAEnrollEndpoint(s Service) endpoint.Endpoint {
}
}
func MakeOTAPhase2Phase3Endpoint(s Service, scepDepot *boltdepot.Depot) endpoint.Endpoint {
func MakeOTAPhase2Phase3Endpoint(s Service, scepDepot depot.Depot) endpoint.Endpoint {
return func(ctx context.Context, request interface{}) (interface{}, error) {
req := request.(mdmOTAPhase2Phase3Request)

16
mdm/enroll/service.go
View File

@@ -8,14 +8,14 @@ import (
"strings"
"sync"
"github.com/groob/plist"
"github.com/pkg/errors"
"golang.org/x/net/context"
"github.com/micromdm/micromdm/platform/config"
"github.com/micromdm/micromdm/platform/profile"
"github.com/micromdm/micromdm/platform/pubsub"
challengestore "github.com/micromdm/scep/challenge/bolt"
"github.com/micromdm/scep/v2/challenge"
"github.com/groob/plist"
"github.com/pkg/errors"
"golang.org/x/net/context"
)
const (
@@ -30,7 +30,7 @@ type Service interface {
OTAPhase3(ctx context.Context) (profile.Mobileconfig, error)
}
func NewService(topic TopicProvider, sub pubsub.Subscriber, scepURL, scepChallenge, url, tlsCertPath, scepSubject string, profileDB profile.Store, cs *challengestore.Depot) (Service, error) {
func NewService(topic TopicProvider, sub pubsub.Subscriber, scepURL, scepChallenge, url, tlsCertPath, scepSubject string, profileDB profile.Store, challengeStore challenge.Store) (Service, error) {
var tlsCert []byte
var err error
@@ -65,7 +65,7 @@ func NewService(topic TopicProvider, sub pubsub.Subscriber, scepURL, scepChallen
SCEPURL: scepURL,
SCEPSubject: subject,
SCEPChallenge: scepChallenge,
SCEPChallengeStore: cs,
SCEPChallengeStore: challengeStore,
TLSCert: tlsCert,
ProfileDB: profileDB,
Topic: pushTopic,
@@ -110,7 +110,7 @@ type service struct {
URL string
SCEPURL string
SCEPChallenge string
SCEPChallengeStore *challengestore.Depot
SCEPChallengeStore challenge.Store
SCEPSubject [][][]string
TLSCert []byte
ProfileDB profile.Store

6
mdm/enroll/transport_http.go
View File

@@ -6,11 +6,11 @@ import (
"io/ioutil"
"net/http"
"github.com/fullsailor/pkcs7"
"github.com/micromdm/micromdm/pkg/crypto"
httptransport "github.com/go-kit/kit/transport/http"
"github.com/groob/plist"
"github.com/micromdm/micromdm/pkg/crypto"
"go.mozilla.org/pkcs7"
)
type HTTPHandlers struct {

2
mdm/server.go
View File

@@ -8,13 +8,13 @@ import (
"io/ioutil"
"net/http"
"github.com/fullsailor/pkcs7"
"github.com/go-kit/kit/endpoint"
"github.com/go-kit/kit/log"
httptransport "github.com/go-kit/kit/transport/http"
"github.com/gorilla/mux"
"github.com/groob/plist"
"github.com/pkg/errors"
"go.mozilla.org/pkcs7"
)
type Endpoints struct {

3
mdm/server_test.go
View File

@@ -8,8 +8,9 @@ import (
"net/http/httptest"
"testing"
"github.com/fullsailor/pkcs7"
"github.com/micromdm/micromdm/pkg/crypto"
"go.mozilla.org/pkcs7"
)
// imitate a Mdm-Signature header

2
pkg/crypto/profileutil/sign.go
View File

@@ -5,8 +5,8 @@ import (
"crypto"
"crypto/x509"
"github.com/fullsailor/pkcs7"
"github.com/pkg/errors"
"go.mozilla.org/pkcs7"
)
// Sign takes an unsigned payload and signs it with the provided private key and certificate.

14
platform/challenge/service.go
View File

@@ -4,7 +4,7 @@ import (
"context"
"errors"
challengestore "github.com/micromdm/scep/challenge/bolt"
"github.com/micromdm/scep/v2/challenge"
)
type Service interface {
@@ -12,18 +12,18 @@ type Service interface {
}
type ChallengeService struct {
scepChallengeStore *challengestore.Depot
challenge.Store
}
func (c *ChallengeService) SCEPChallenge(ctx context.Context) (string, error) {
if c.scepChallengeStore == nil {
func (c *ChallengeService) SCEPChallenge(_ context.Context) (string, error) {
if c.Store == nil {
return "", errors.New("SCEP challenge store missing")
}
return c.scepChallengeStore.SCEPChallenge()
return c.Store.SCEPChallenge()
}
func NewService(cs *challengestore.Depot) *ChallengeService {
func NewService(challengeStore challenge.Store) *ChallengeService {
return &ChallengeService{
scepChallengeStore: cs,
Store: challengeStore,
}
}

5
platform/config/apply_deptoken.go
View File

@@ -11,9 +11,10 @@ import (
"net/http"
"net/textproto"
"github.com/fullsailor/pkcs7"
"github.com/go-kit/kit/endpoint"
"github.com/micromdm/micromdm/pkg/httputil"
"github.com/go-kit/kit/endpoint"
"go.mozilla.org/pkcs7"
)
func (svc *ConfigService) ApplyDEPToken(ctx context.Context, P7MContent []byte) error {

7
platform/profile/profile.go
View File

@@ -1,13 +1,12 @@
package profile
import (
"github.com/pkg/errors"
"github.com/micromdm/micromdm/platform/profile/internal/profileproto"
"github.com/fullsailor/pkcs7"
"github.com/gogo/protobuf/proto"
"github.com/groob/plist"
"github.com/micromdm/micromdm/platform/profile/internal/profileproto"
"github.com/pkg/errors"
"go.mozilla.org/pkcs7"
)
type Mobileconfig []byte

57
server/server.go
View File

@@ -8,14 +8,6 @@ import (
"path/filepath"
"time"
"github.com/boltdb/bolt"
"github.com/go-kit/kit/log"
"github.com/go-kit/kit/log/level"
challengestore "github.com/micromdm/scep/challenge/bolt"
boltdepot "github.com/micromdm/scep/depot/bolt"
scep "github.com/micromdm/scep/server"
"github.com/pkg/errors"
"github.com/micromdm/micromdm/dep"
"github.com/micromdm/micromdm/mdm"
"github.com/micromdm/micromdm/mdm/enroll"
@@ -36,6 +28,16 @@ import (
block "github.com/micromdm/micromdm/platform/remove"
blockbuiltin "github.com/micromdm/micromdm/platform/remove/builtin"
"github.com/micromdm/micromdm/workflow/webhook"
"github.com/boltdb/bolt"
"github.com/go-kit/kit/log"
"github.com/go-kit/kit/log/level"
"github.com/micromdm/scep/v2/challenge"
boltchallenge "github.com/micromdm/scep/v2/challenge/bolt"
"github.com/micromdm/scep/v2/depot"
boltdepot "github.com/micromdm/scep/v2/depot/bolt"
scep "github.com/micromdm/scep/v2/server"
"github.com/pkg/errors"
)
type Server struct {
@@ -47,10 +49,10 @@ type Server struct {
SCEPChallenge string
SCEPClientValidity int
TLSCertPath string
SCEPDepot *boltdepot.Depot
SCEPDepot depot.Depot
UseDynSCEPChallenge bool
GenDynSCEPChallenge bool
SCEPChallengeDepot *challengestore.Depot
SCEPChallengeDepot challenge.Store
ProfileDB profile.Store
ConfigDB config.Store
RemoveDB block.Store
@@ -340,37 +342,38 @@ func (c *Server) CreateDEPSyncer(logger log.Logger) (sync.Syncer, error) {
}
func (c *Server) setupSCEP(logger log.Logger) error {
depot, err := boltdepot.NewBoltDepot(c.DB)
svcBoltDepot, err := boltdepot.NewBoltDepot(c.DB)
if err != nil {
return err
}
c.SCEPDepot = svcBoltDepot
key, err := svcBoltDepot.CreateOrLoadKey(2048)
if err != nil {
return err
}
key, err := depot.CreateOrLoadKey(2048)
crt, err := svcBoltDepot.CreateOrLoadCA(key, 5, "MicroMDM", "US")
if err != nil {
return err
}
_, err = depot.CreateOrLoadCA(key, 5, "MicroMDM", "US")
if err != nil {
return err
}
opts := []scep.ServiceOption{
scep.ClientValidity(c.SCEPClientValidity),
}
var scepChalOpt scep.ServiceOption
var signer scep.CSRSigner = depot.NewSigner(
c.SCEPDepot,
depot.WithAllowRenewalDays(0),
depot.WithValidityDays(c.SCEPClientValidity),
)
if c.UseDynSCEPChallenge {
c.SCEPChallengeDepot, err = challengestore.NewBoltDepot(c.DB)
c.SCEPChallengeDepot, err = boltchallenge.NewBoltDepot(c.DB)
if err != nil {
return err
}
scepChalOpt = scep.WithDynamicChallenges(c.SCEPChallengeDepot)
signer = challenge.Middleware(c.SCEPChallengeDepot, signer)
} else {
scepChalOpt = scep.ChallengePassword(c.SCEPChallenge)
signer = scep.ChallengeMiddleware(c.SCEPChallenge, signer)
}
opts = append(opts, scepChalOpt)
c.SCEPDepot = depot
c.SCEPService, err = scep.NewService(depot, opts...)
c.SCEPService, err = scep.NewService(crt, key, signer)
if err != nil {
return err
}