From 4d5fbf5fd172c3e0aab230d5d83a40d72061a19d Mon Sep 17 00:00:00 2001 From: Jesse Peterson Date: Wed, 9 Jun 2021 15:44:58 -0700 Subject: [PATCH] scep v2, Mozilla PKCS7 fork, cleanup (#737) - Upgrade to micromdm/scep v2 & updated API usage - Use interfaces rather than concrete types in a few places - Switch to Mozilla's PKCS7 fork (actually @omorsi's fork of that fork) - Import order: stdlib, project/self, 3rd party --- CHANGELOG.md | 1 + cmd/mdmctl/mdmcert.download.go | 5 +-- cmd/micromdm/serve.go | 24 ++++++------- go.mod | 6 ++-- go.sum | 21 ++++-------- mdm/enroll/endpoint.go | 12 +++---- mdm/enroll/service.go | 16 ++++----- mdm/enroll/transport_http.go | 6 ++-- mdm/server.go | 2 +- mdm/server_test.go | 3 +- pkg/crypto/profileutil/sign.go | 2 +- platform/challenge/service.go | 14 ++++---- platform/config/apply_deptoken.go | 5 +-- platform/profile/profile.go | 7 ++-- server/server.go | 57 ++++++++++++++++--------------- 15 files changed, 90 insertions(+), 91 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b3756d95..ba1faa04 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ - Fix SetFirmwarePassword and VerifyFirmwarePassword parameters (#743) - Command UUID can now be passed in as as a request parameter (#754) +- Update to SCEP v2, switch to Mozilla PKCS7 fork, interface cleanup (#737) ## [v1.8.0](https://github.com/micromdm/micromdm/compare/v1.7.1...v1.8.0) February, 2021 diff --git a/cmd/mdmctl/mdmcert.download.go b/cmd/mdmctl/mdmcert.download.go index 6e71129d..f6c14798 100644 --- a/cmd/mdmctl/mdmcert.download.go +++ b/cmd/mdmctl/mdmcert.download.go @@ -14,11 +14,12 @@ import ( "net/http" "os" - "github.com/fullsailor/pkcs7" - "github.com/go-kit/kit/log" "github.com/micromdm/micromdm/pkg/crypto" "github.com/micromdm/micromdm/pkg/crypto/mdmcertutil" + + "github.com/go-kit/kit/log" "github.com/pkg/errors" + "go.mozilla.org/pkcs7" ) const ( diff --git a/cmd/micromdm/serve.go b/cmd/micromdm/serve.go index e2d0ec02..b2a3193b 100644 --- a/cmd/micromdm/serve.go +++ b/cmd/micromdm/serve.go @@ -14,18 +14,6 @@ import ( "strings" "time" - "github.com/boltdb/bolt" - "github.com/go-kit/kit/auth/basic" - "github.com/go-kit/kit/log" - httptransport "github.com/go-kit/kit/transport/http" - "github.com/groob/finalizer/logutil" - "github.com/micromdm/go4/env" - "github.com/micromdm/go4/httputil" - "github.com/micromdm/go4/version" - scep "github.com/micromdm/scep/server" - "github.com/pkg/errors" - "golang.org/x/crypto/acme/autocert" - "github.com/micromdm/micromdm/mdm" "github.com/micromdm/micromdm/mdm/enroll" httputil2 "github.com/micromdm/micromdm/pkg/httputil" @@ -46,6 +34,18 @@ import ( "github.com/micromdm/micromdm/platform/user" userbuiltin "github.com/micromdm/micromdm/platform/user/builtin" "github.com/micromdm/micromdm/server" + + "github.com/boltdb/bolt" + "github.com/go-kit/kit/auth/basic" + "github.com/go-kit/kit/log" + httptransport "github.com/go-kit/kit/transport/http" + "github.com/groob/finalizer/logutil" + "github.com/micromdm/go4/env" + "github.com/micromdm/go4/httputil" + "github.com/micromdm/go4/version" + scep "github.com/micromdm/scep/v2/server" + "github.com/pkg/errors" + "golang.org/x/crypto/acme/autocert" ) const homePage = ` diff --git a/go.mod b/go.mod index cee92b35..18701d67 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,6 @@ require ( github.com/RobotsAndPencils/buford v0.12.0 github.com/boltdb/bolt v1.3.1 github.com/davecgh/go-spew v1.1.1 // indirect - github.com/fullsailor/pkcs7 v0.0.0-20180824154052-36585635cb64 github.com/garyburd/go-oauth v0.0.0-20180319155456-bca2e7f09a17 github.com/go-kit/kit v0.7.0 github.com/go-sql-driver/mysql v1.4.0 // indirect @@ -23,18 +22,19 @@ require ( github.com/lib/pq v1.0.0 github.com/mattn/go-sqlite3 v1.9.0 // indirect github.com/micromdm/go4 v0.0.0-20210104222236-8a0936d9e451 - github.com/micromdm/scep v1.0.1-0.20181014170139-9be65e185499 + github.com/micromdm/scep/v2 v2.0.0 // indirect github.com/pkg/errors v0.8.0 github.com/pmezard/go-difflib v1.0.0 // indirect github.com/pressly/goose v2.3.0+incompatible github.com/stretchr/testify v1.2.2 // indirect github.com/ziutek/mymysql v1.5.4 // indirect + go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 google.golang.org/appengine v1.2.0 // indirect gopkg.in/Masterminds/squirrel.v1 v1.0.0-20170825200431-a6b93000bd21 ) -replace github.com/fullsailor/pkcs7 => github.com/groob/pkcs7 v0.0.0-20180824154052-36585635cb64 +replace go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 => github.com/omorsi/pkcs7 v0.0.0-20210217142924-a7b80a2a8568 go 1.13 diff --git a/go.sum b/go.sum index d0d9aa91..3deb0597 100644 --- a/go.sum +++ b/go.sum @@ -19,10 +19,7 @@ github.com/go-stack/stack v1.7.0 h1:S04+lLfST9FvL8dl4R31wVUC/paZp/WQZbLmUgWboGw= github.com/go-stack/stack v1.7.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls= github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o= -github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= -github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs= -github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= @@ -32,6 +29,7 @@ github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= +github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4= github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= @@ -43,8 +41,6 @@ github.com/gorilla/mux v1.6.2 h1:Pgr17XVTNXAk3q/r4CpKzC5xBM/qW1uVLV+IhRZpIIk= github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs= github.com/groob/finalizer v0.0.0-20170707115354-4c2ed49aabda h1:5ikpG9mYCMFiZX0nkxoV6aU2IpCHPdws3gCNgdZeEV0= github.com/groob/finalizer v0.0.0-20170707115354-4c2ed49aabda/go.mod h1:MyndkAZd5rUMdNogn35MWXBX1UiBigrU8eTj8DoAC2c= -github.com/groob/pkcs7 v0.0.0-20180824154052-36585635cb64 h1:1ALD84dEnUxPKZENhUAeQ0tuJ+s3PuL85pV95B0Ekfk= -github.com/groob/pkcs7 v0.0.0-20180824154052-36585635cb64/go.mod h1:mEOMQ8C7oeXY3LnE2jy4UkLAqrW9rrpwiP5U4hVV+MY= github.com/groob/plist v0.0.0-20180203051248-dd56909aee38 h1:afbUddvIjPRC7XHHgeSTRfzZtIxEsSl4VCxumLBGDJU= github.com/groob/plist v0.0.0-20180203051248-dd56909aee38/go.mod h1:qg2Nek0ND/hIr+nY8H1oVqEW2cLzVVNaAQ0QexOyjyc= github.com/jmoiron/sqlx v0.0.0-20180614180643-0dae4fefe7c0 h1:5B0uxl2lzNRVkJVg+uGHxWtRt4C0Wjc6kJKo5XYx8xE= @@ -63,12 +59,12 @@ github.com/lib/pq v1.0.0 h1:X5PMW56eZitiTeO7tKzZxFCSpbFZJtkMMooicw2us9A= github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo= github.com/mattn/go-sqlite3 v1.9.0 h1:pDRiWfl+++eC2FEFRy6jXmQlvp4Yh3z1MJKg4UeYM/4= github.com/mattn/go-sqlite3 v1.9.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc= -github.com/micromdm/go4 v0.0.0-20191221011012-654e10aaab18 h1:0XJmYdtM8IWZPsFWwaOYOQuPLbaj1kaSYixLN8JB62g= -github.com/micromdm/go4 v0.0.0-20191221011012-654e10aaab18/go.mod h1:8EzTEgA3q2ZdZotWXs1bWnFCXuaFHU0+jDNZbHlwduM= github.com/micromdm/go4 v0.0.0-20210104222236-8a0936d9e451 h1:xHy+uslAu/WFXOQHqyx9//qNcpwtd6dHo/Avi2CCfhU= github.com/micromdm/go4 v0.0.0-20210104222236-8a0936d9e451/go.mod h1:uZTekMktf1ayaNK9onByUXwKleUvJNQw/cpZaNkvvRo= -github.com/micromdm/scep v1.0.1-0.20181014170139-9be65e185499 h1:tAPbBGVDrfo7Tv4rvmzVQPfbQTrR/XSLbl4JuGfJbPI= -github.com/micromdm/scep v1.0.1-0.20181014170139-9be65e185499/go.mod h1:a4hGfYA9e51888COzEduLGsstH9NPxJPndn/Ke5/Tw8= +github.com/micromdm/scep/v2 v2.0.0 h1:cRzcY0S5QX+0+J+7YC4P2uZSnfMup8S8zJu/bLFgOkA= +github.com/micromdm/scep/v2 v2.0.0/go.mod h1:ouaDs5tcjOjdHD/h8BGaQsWE87MUnQ/wMTMgfMMIpPc= +github.com/omorsi/pkcs7 v0.0.0-20210217142924-a7b80a2a8568 h1:+MPqEswjYiS0S1FCTg8MIhMBMzxiVQ94rooFwvPPiWk= +github.com/omorsi/pkcs7 v0.0.0-20210217142924-a7b80a2a8568/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk= github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw= github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -79,24 +75,21 @@ github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/ziutek/mymysql v1.5.4 h1:GB0qdRGsTwQSBVYuVShFBKaXSnSnYYC2d9knnE1LHFs= github.com/ziutek/mymysql v1.5.4/go.mod h1:LMSpPZ6DbqWFxNCHW77HeMg9I646SAhApZ/wKdgO/C0= -golang.org/x/crypto v0.0.0-20180614174826-fd5f17ee7299 h1:zxP+xTjjk4kD+M5IFPweL7/4851FUhYkzbDqbzkN1JE= -golang.org/x/crypto v0.0.0-20180614174826-fd5f17ee7299/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/net v0.0.0-20170726083632-f5079bd7f6f7/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= -golang.org/x/net v0.0.0-20180724234803-3673e40ba225 h1:kNX+jCowfMYzvlSvJu5pQWEmyWFrBXJ3PBy10xKMXK8= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/sys v0.0.0-20170728174421-0f826bdd13b5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20180614134839-8883426083c0 h1:5mOaSPjCt3RW5w1KpSFOVg8VdqQQ/FjfM5/m50f/8wM= -golang.org/x/sys v0.0.0-20180614134839-8883426083c0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/appengine v1.2.0 h1:S0iUepdCWODXRvtE+gcRDd15L+k+k1AiHlMiMjefH24= google.golang.org/appengine v1.2.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= diff --git a/mdm/enroll/endpoint.go b/mdm/enroll/endpoint.go index 3ac227f0..a5f77046 100644 --- a/mdm/enroll/endpoint.go +++ b/mdm/enroll/endpoint.go @@ -5,12 +5,12 @@ import ( "errors" "fmt" - "github.com/fullsailor/pkcs7" - "github.com/go-kit/kit/endpoint" - boltdepot "github.com/micromdm/scep/depot/bolt" - "github.com/micromdm/micromdm/pkg/crypto" "github.com/micromdm/micromdm/platform/profile" + + "github.com/go-kit/kit/endpoint" + "github.com/micromdm/scep/v2/depot" + "go.mozilla.org/pkcs7" ) type Endpoints struct { @@ -59,7 +59,7 @@ type mdmOTAPhase2Phase3Request struct { p7 *pkcs7.PKCS7 } -func MakeServerEndpoints(s Service, scepDepot *boltdepot.Depot) Endpoints { +func MakeServerEndpoints(s Service, scepDepot depot.Depot) Endpoints { return Endpoints{ GetEnrollEndpoint: MakeGetEnrollEndpoint(s), OTAEnrollEndpoint: MakeOTAEnrollEndpoint(s), @@ -90,7 +90,7 @@ func MakeOTAEnrollEndpoint(s Service) endpoint.Endpoint { } } -func MakeOTAPhase2Phase3Endpoint(s Service, scepDepot *boltdepot.Depot) endpoint.Endpoint { +func MakeOTAPhase2Phase3Endpoint(s Service, scepDepot depot.Depot) endpoint.Endpoint { return func(ctx context.Context, request interface{}) (interface{}, error) { req := request.(mdmOTAPhase2Phase3Request) diff --git a/mdm/enroll/service.go b/mdm/enroll/service.go index d50127d4..7706d48b 100644 --- a/mdm/enroll/service.go +++ b/mdm/enroll/service.go @@ -8,14 +8,14 @@ import ( "strings" "sync" - "github.com/groob/plist" - "github.com/pkg/errors" - "golang.org/x/net/context" - "github.com/micromdm/micromdm/platform/config" "github.com/micromdm/micromdm/platform/profile" "github.com/micromdm/micromdm/platform/pubsub" - challengestore "github.com/micromdm/scep/challenge/bolt" + "github.com/micromdm/scep/v2/challenge" + + "github.com/groob/plist" + "github.com/pkg/errors" + "golang.org/x/net/context" ) const ( @@ -30,7 +30,7 @@ type Service interface { OTAPhase3(ctx context.Context) (profile.Mobileconfig, error) } -func NewService(topic TopicProvider, sub pubsub.Subscriber, scepURL, scepChallenge, url, tlsCertPath, scepSubject string, profileDB profile.Store, cs *challengestore.Depot) (Service, error) { +func NewService(topic TopicProvider, sub pubsub.Subscriber, scepURL, scepChallenge, url, tlsCertPath, scepSubject string, profileDB profile.Store, challengeStore challenge.Store) (Service, error) { var tlsCert []byte var err error @@ -65,7 +65,7 @@ func NewService(topic TopicProvider, sub pubsub.Subscriber, scepURL, scepChallen SCEPURL: scepURL, SCEPSubject: subject, SCEPChallenge: scepChallenge, - SCEPChallengeStore: cs, + SCEPChallengeStore: challengeStore, TLSCert: tlsCert, ProfileDB: profileDB, Topic: pushTopic, @@ -110,7 +110,7 @@ type service struct { URL string SCEPURL string SCEPChallenge string - SCEPChallengeStore *challengestore.Depot + SCEPChallengeStore challenge.Store SCEPSubject [][][]string TLSCert []byte ProfileDB profile.Store diff --git a/mdm/enroll/transport_http.go b/mdm/enroll/transport_http.go index f5490b19..5a7a0263 100644 --- a/mdm/enroll/transport_http.go +++ b/mdm/enroll/transport_http.go @@ -6,11 +6,11 @@ import ( "io/ioutil" "net/http" - "github.com/fullsailor/pkcs7" + "github.com/micromdm/micromdm/pkg/crypto" + httptransport "github.com/go-kit/kit/transport/http" "github.com/groob/plist" - - "github.com/micromdm/micromdm/pkg/crypto" + "go.mozilla.org/pkcs7" ) type HTTPHandlers struct { diff --git a/mdm/server.go b/mdm/server.go index f19c75e0..dd17216c 100644 --- a/mdm/server.go +++ b/mdm/server.go @@ -8,13 +8,13 @@ import ( "io/ioutil" "net/http" - "github.com/fullsailor/pkcs7" "github.com/go-kit/kit/endpoint" "github.com/go-kit/kit/log" httptransport "github.com/go-kit/kit/transport/http" "github.com/gorilla/mux" "github.com/groob/plist" "github.com/pkg/errors" + "go.mozilla.org/pkcs7" ) type Endpoints struct { diff --git a/mdm/server_test.go b/mdm/server_test.go index 47e2c7d5..36ab8a12 100644 --- a/mdm/server_test.go +++ b/mdm/server_test.go @@ -8,8 +8,9 @@ import ( "net/http/httptest" "testing" - "github.com/fullsailor/pkcs7" "github.com/micromdm/micromdm/pkg/crypto" + + "go.mozilla.org/pkcs7" ) // imitate a Mdm-Signature header diff --git a/pkg/crypto/profileutil/sign.go b/pkg/crypto/profileutil/sign.go index d98467af..0edc07ca 100644 --- a/pkg/crypto/profileutil/sign.go +++ b/pkg/crypto/profileutil/sign.go @@ -5,8 +5,8 @@ import ( "crypto" "crypto/x509" - "github.com/fullsailor/pkcs7" "github.com/pkg/errors" + "go.mozilla.org/pkcs7" ) // Sign takes an unsigned payload and signs it with the provided private key and certificate. diff --git a/platform/challenge/service.go b/platform/challenge/service.go index 50098af8..5a0e672d 100644 --- a/platform/challenge/service.go +++ b/platform/challenge/service.go @@ -4,7 +4,7 @@ import ( "context" "errors" - challengestore "github.com/micromdm/scep/challenge/bolt" + "github.com/micromdm/scep/v2/challenge" ) type Service interface { @@ -12,18 +12,18 @@ type Service interface { } type ChallengeService struct { - scepChallengeStore *challengestore.Depot + challenge.Store } -func (c *ChallengeService) SCEPChallenge(ctx context.Context) (string, error) { - if c.scepChallengeStore == nil { +func (c *ChallengeService) SCEPChallenge(_ context.Context) (string, error) { + if c.Store == nil { return "", errors.New("SCEP challenge store missing") } - return c.scepChallengeStore.SCEPChallenge() + return c.Store.SCEPChallenge() } -func NewService(cs *challengestore.Depot) *ChallengeService { +func NewService(challengeStore challenge.Store) *ChallengeService { return &ChallengeService{ - scepChallengeStore: cs, + Store: challengeStore, } } diff --git a/platform/config/apply_deptoken.go b/platform/config/apply_deptoken.go index 92c7e65d..cfc8ea9b 100644 --- a/platform/config/apply_deptoken.go +++ b/platform/config/apply_deptoken.go @@ -11,9 +11,10 @@ import ( "net/http" "net/textproto" - "github.com/fullsailor/pkcs7" - "github.com/go-kit/kit/endpoint" "github.com/micromdm/micromdm/pkg/httputil" + + "github.com/go-kit/kit/endpoint" + "go.mozilla.org/pkcs7" ) func (svc *ConfigService) ApplyDEPToken(ctx context.Context, P7MContent []byte) error { diff --git a/platform/profile/profile.go b/platform/profile/profile.go index 1ebd1883..81e37019 100644 --- a/platform/profile/profile.go +++ b/platform/profile/profile.go @@ -1,13 +1,12 @@ package profile import ( - "github.com/pkg/errors" + "github.com/micromdm/micromdm/platform/profile/internal/profileproto" - "github.com/fullsailor/pkcs7" "github.com/gogo/protobuf/proto" "github.com/groob/plist" - - "github.com/micromdm/micromdm/platform/profile/internal/profileproto" + "github.com/pkg/errors" + "go.mozilla.org/pkcs7" ) type Mobileconfig []byte diff --git a/server/server.go b/server/server.go index 1a5dcc1f..f6623fe9 100644 --- a/server/server.go +++ b/server/server.go @@ -8,14 +8,6 @@ import ( "path/filepath" "time" - "github.com/boltdb/bolt" - "github.com/go-kit/kit/log" - "github.com/go-kit/kit/log/level" - challengestore "github.com/micromdm/scep/challenge/bolt" - boltdepot "github.com/micromdm/scep/depot/bolt" - scep "github.com/micromdm/scep/server" - "github.com/pkg/errors" - "github.com/micromdm/micromdm/dep" "github.com/micromdm/micromdm/mdm" "github.com/micromdm/micromdm/mdm/enroll" @@ -36,6 +28,16 @@ import ( block "github.com/micromdm/micromdm/platform/remove" blockbuiltin "github.com/micromdm/micromdm/platform/remove/builtin" "github.com/micromdm/micromdm/workflow/webhook" + + "github.com/boltdb/bolt" + "github.com/go-kit/kit/log" + "github.com/go-kit/kit/log/level" + "github.com/micromdm/scep/v2/challenge" + boltchallenge "github.com/micromdm/scep/v2/challenge/bolt" + "github.com/micromdm/scep/v2/depot" + boltdepot "github.com/micromdm/scep/v2/depot/bolt" + scep "github.com/micromdm/scep/v2/server" + "github.com/pkg/errors" ) type Server struct { @@ -47,10 +49,10 @@ type Server struct { SCEPChallenge string SCEPClientValidity int TLSCertPath string - SCEPDepot *boltdepot.Depot + SCEPDepot depot.Depot UseDynSCEPChallenge bool GenDynSCEPChallenge bool - SCEPChallengeDepot *challengestore.Depot + SCEPChallengeDepot challenge.Store ProfileDB profile.Store ConfigDB config.Store RemoveDB block.Store @@ -340,37 +342,38 @@ func (c *Server) CreateDEPSyncer(logger log.Logger) (sync.Syncer, error) { } func (c *Server) setupSCEP(logger log.Logger) error { - depot, err := boltdepot.NewBoltDepot(c.DB) + svcBoltDepot, err := boltdepot.NewBoltDepot(c.DB) + if err != nil { + return err + } + c.SCEPDepot = svcBoltDepot + + key, err := svcBoltDepot.CreateOrLoadKey(2048) if err != nil { return err } - key, err := depot.CreateOrLoadKey(2048) + crt, err := svcBoltDepot.CreateOrLoadCA(key, 5, "MicroMDM", "US") if err != nil { return err } - _, err = depot.CreateOrLoadCA(key, 5, "MicroMDM", "US") - if err != nil { - return err - } - - opts := []scep.ServiceOption{ - scep.ClientValidity(c.SCEPClientValidity), - } - var scepChalOpt scep.ServiceOption + var signer scep.CSRSigner = depot.NewSigner( + c.SCEPDepot, + depot.WithAllowRenewalDays(0), + depot.WithValidityDays(c.SCEPClientValidity), + ) if c.UseDynSCEPChallenge { - c.SCEPChallengeDepot, err = challengestore.NewBoltDepot(c.DB) + c.SCEPChallengeDepot, err = boltchallenge.NewBoltDepot(c.DB) if err != nil { return err } - scepChalOpt = scep.WithDynamicChallenges(c.SCEPChallengeDepot) + signer = challenge.Middleware(c.SCEPChallengeDepot, signer) } else { - scepChalOpt = scep.ChallengePassword(c.SCEPChallenge) + signer = scep.ChallengeMiddleware(c.SCEPChallenge, signer) } - opts = append(opts, scepChalOpt) - c.SCEPDepot = depot - c.SCEPService, err = scep.NewService(depot, opts...) + + c.SCEPService, err = scep.NewService(crt, key, signer) if err != nil { return err }