From 9f3e04982e7c6da70333649f773ad42e87ead7e6 Mon Sep 17 00:00:00 2001 From: Jesse Peterson Date: Sat, 2 Dec 2023 14:41:37 -0800 Subject: [PATCH] switch to smallstep/pkcs7 (#944) --- cmd/mdmctl/mdmcert.download.go | 2 +- go.mod | 8 ++++---- go.sum | 14 +++++--------- mdm/enroll/endpoint.go | 2 +- mdm/enroll/transport_http.go | 2 +- mdm/server.go | 2 +- mdm/server_test.go | 2 +- pkg/crypto/helpers.go | 2 +- pkg/crypto/profileutil/sign.go | 2 +- platform/config/apply_deptoken.go | 2 +- platform/profile/profile.go | 2 +- server/server.go | 6 +++--- 12 files changed, 21 insertions(+), 25 deletions(-) diff --git a/cmd/mdmctl/mdmcert.download.go b/cmd/mdmctl/mdmcert.download.go index 6b860cc2..d7c10afc 100644 --- a/cmd/mdmctl/mdmcert.download.go +++ b/cmd/mdmctl/mdmcert.download.go @@ -19,7 +19,7 @@ import ( "github.com/go-kit/kit/log" "github.com/pkg/errors" - "go.mozilla.org/pkcs7" + "github.com/smallstep/pkcs7" ) const ( diff --git a/go.mod b/go.mod index c2dafe06..da1d6e9a 100644 --- a/go.mod +++ b/go.mod @@ -16,9 +16,9 @@ require ( github.com/korylprince/go-macos-pkg v1.3.6 github.com/lib/pq v1.10.9 github.com/micromdm/go4 v0.0.0-20230719210527-7c4a9b165b09 - github.com/micromdm/scep/v2 v2.1.0 + github.com/micromdm/scep/v2 v2.2.0 github.com/pkg/errors v0.9.1 - go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 + github.com/smallstep/pkcs7 v0.0.0-20231107075624-be1870d87d13 golang.org/x/crypto v0.14.0 golang.org/x/net v0.17.0 google.golang.org/protobuf v1.31.0 @@ -30,12 +30,12 @@ require ( github.com/felixge/httpsnoop v1.0.2 // indirect github.com/go-kit/log v0.2.0 // indirect github.com/go-logfmt/logfmt v0.5.1 // indirect + github.com/google/go-cmp v0.5.7 // indirect github.com/korylprince/go-cpio-odc v0.9.4 // indirect github.com/korylprince/goxar v0.0.0-20211111233330-e9f257bcdf25 // indirect github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect - github.com/pmezard/go-difflib v1.0.0 // indirect - github.com/stretchr/testify v1.2.2 // indirect + github.com/stretchr/testify v1.7.2 // indirect golang.org/x/sys v0.13.0 // indirect golang.org/x/text v0.13.0 // indirect golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect diff --git a/go.sum b/go.sum index 07be0127..b508d786 100644 --- a/go.sum +++ b/go.sum @@ -185,7 +185,6 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o= @@ -325,8 +324,8 @@ github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0= github.com/micromdm/go4 v0.0.0-20230719210527-7c4a9b165b09 h1:COW3H2j8Xcx1va6z8FwbwaegIviz33rWuAiyp4MVL8A= github.com/micromdm/go4 v0.0.0-20230719210527-7c4a9b165b09/go.mod h1:uZTekMktf1ayaNK9onByUXwKleUvJNQw/cpZaNkvvRo= -github.com/micromdm/scep/v2 v2.1.0 h1:2fS9Rla7qRR266hvUoEauBJ7J6FhgssEiq2OkSKXmaU= -github.com/micromdm/scep/v2 v2.1.0/go.mod h1:BkF7TkPPhmgJAMtHfP+sFTKXmgzNJgLQlvvGoOExBcc= +github.com/micromdm/scep/v2 v2.2.0 h1:MO2vZl5dSyojC2KpN4ik3671ZjdZvM8lpxS/YukhIMs= +github.com/micromdm/scep/v2 v2.2.0/go.mod h1:mEmykFaZklQfGZ1Dl9oRJOx/3fxvF2D1l+cDJokzDwk= github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso= github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI= github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4= @@ -409,6 +408,8 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE= github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88= github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= +github.com/smallstep/pkcs7 v0.0.0-20231107075624-be1870d87d13 h1:qRxEt9ESQhAg1kjmgJ8oyyzlc9zkAjOooe7bcKjKORQ= +github.com/smallstep/pkcs7 v0.0.0-20231107075624-be1870d87d13/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y= github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc= github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA= github.com/sony/gobreaker v0.4.1/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY= @@ -417,7 +418,6 @@ github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3 github.com/streadway/handy v0.0.0-20200128134331-0f66f006fb2e/go.mod h1:qNTQ5P5JnDBl6z3cMAg/SywNDC5ABu5ApDIw6lUbRmI= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= @@ -437,9 +437,6 @@ go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQc go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g= go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ= go.etcd.io/etcd/client/v3 v3.5.0/go.mod h1:AIKXXVX/DQXtfTEqBryiLTUXwON+GuvO6Z7lLS/oTh0= -go.mozilla.org/pkcs7 v0.0.0-20210730143726-725912489c62/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk= -go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 h1:CCriYyAfq1Br1aIYettdHZTy8mBTIPo7We18TuO/bak= -go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk= go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU= go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8= go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= @@ -505,7 +502,6 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/net v0.0.0-20170726083632-f5079bd7f6f7/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -572,7 +568,6 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sys v0.0.0-20170728174421-0f826bdd13b5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -830,6 +825,7 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= diff --git a/mdm/enroll/endpoint.go b/mdm/enroll/endpoint.go index a5f77046..adc1c7ba 100644 --- a/mdm/enroll/endpoint.go +++ b/mdm/enroll/endpoint.go @@ -10,7 +10,7 @@ import ( "github.com/go-kit/kit/endpoint" "github.com/micromdm/scep/v2/depot" - "go.mozilla.org/pkcs7" + "github.com/smallstep/pkcs7" ) type Endpoints struct { diff --git a/mdm/enroll/transport_http.go b/mdm/enroll/transport_http.go index 2bbc2d22..043a3e67 100644 --- a/mdm/enroll/transport_http.go +++ b/mdm/enroll/transport_http.go @@ -10,7 +10,7 @@ import ( httptransport "github.com/go-kit/kit/transport/http" "github.com/groob/plist" - "go.mozilla.org/pkcs7" + "github.com/smallstep/pkcs7" ) type HTTPHandlers struct { diff --git a/mdm/server.go b/mdm/server.go index fc571b7f..6bdf0174 100644 --- a/mdm/server.go +++ b/mdm/server.go @@ -15,7 +15,7 @@ import ( "github.com/groob/plist" "github.com/micromdm/micromdm/pkg/crypto" "github.com/pkg/errors" - "go.mozilla.org/pkcs7" + "github.com/smallstep/pkcs7" ) type Endpoints struct { diff --git a/mdm/server_test.go b/mdm/server_test.go index a637bd32..5f69613d 100644 --- a/mdm/server_test.go +++ b/mdm/server_test.go @@ -10,7 +10,7 @@ import ( "github.com/micromdm/micromdm/pkg/crypto" - "go.mozilla.org/pkcs7" + "github.com/smallstep/pkcs7" ) // imitate a Mdm-Signature header diff --git a/pkg/crypto/helpers.go b/pkg/crypto/helpers.go index 28ea321a..6a749a85 100644 --- a/pkg/crypto/helpers.go +++ b/pkg/crypto/helpers.go @@ -15,7 +15,7 @@ import ( "strings" "time" - "go.mozilla.org/pkcs7" + "github.com/smallstep/pkcs7" ) func GenerateRandomCertificateSerialNumber() (*big.Int, error) { diff --git a/pkg/crypto/profileutil/sign.go b/pkg/crypto/profileutil/sign.go index 0edc07ca..ed9aa199 100644 --- a/pkg/crypto/profileutil/sign.go +++ b/pkg/crypto/profileutil/sign.go @@ -6,7 +6,7 @@ import ( "crypto/x509" "github.com/pkg/errors" - "go.mozilla.org/pkcs7" + "github.com/smallstep/pkcs7" ) // Sign takes an unsigned payload and signs it with the provided private key and certificate. diff --git a/platform/config/apply_deptoken.go b/platform/config/apply_deptoken.go index cfc8ea9b..95b84ae9 100644 --- a/platform/config/apply_deptoken.go +++ b/platform/config/apply_deptoken.go @@ -14,7 +14,7 @@ import ( "github.com/micromdm/micromdm/pkg/httputil" "github.com/go-kit/kit/endpoint" - "go.mozilla.org/pkcs7" + "github.com/smallstep/pkcs7" ) func (svc *ConfigService) ApplyDEPToken(ctx context.Context, P7MContent []byte) error { diff --git a/platform/profile/profile.go b/platform/profile/profile.go index 9525ba0a..63efc2c4 100644 --- a/platform/profile/profile.go +++ b/platform/profile/profile.go @@ -5,7 +5,7 @@ import ( "github.com/groob/plist" "github.com/pkg/errors" - "go.mozilla.org/pkcs7" + "github.com/smallstep/pkcs7" "google.golang.org/protobuf/proto" ) diff --git a/server/server.go b/server/server.go index e65b3ebc..4fd2b8f0 100644 --- a/server/server.go +++ b/server/server.go @@ -386,11 +386,11 @@ func (c *Server) setupSCEP(logger log.Logger) error { return err } - var signer scep.CSRSigner = depot.NewSigner( + var signer scep.CSRSignerContext = scep.SignCSRAdapter(depot.NewSigner( c.SCEPDepot, depot.WithAllowRenewalDays(0), depot.WithValidityDays(c.SCEPClientValidity), - ) + )) if c.UseDynSCEPChallenge { c.SCEPChallengeDepot, err = boltchallenge.NewBoltDepot(c.DB) if err != nil { @@ -398,7 +398,7 @@ func (c *Server) setupSCEP(logger log.Logger) error { } signer = challenge.Middleware(c.SCEPChallengeDepot, signer) } else { - signer = scep.ChallengeMiddleware(c.SCEPChallenge, signer) + signer = scep.StaticChallengeMiddleware(c.SCEPChallenge, signer) } c.SCEPService, err = scep.NewService(crt, key, signer)