ogb912/micromdm
1
0
Fork 0
mirror of https://github.com/micromdm/micromdm/ synced 2026-08-12 13:25:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

Verify device certificate on DEP enrollment (#143)

Browse Source
This commit is contained in:
Jesse Peterson
2017-04-14 15:22:15 -07:00
committed by GitHub
parent 4d4c2253a9
commit a40582af11
1 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
enroll/transport_http.go
View File

@@ -9,6 +9,7 @@ import (
"github.com/fullsailor/pkcs7"
httptransport "github.com/go-kit/kit/transport/http"
"github.com/groob/plist"
"github.com/micromdm/micromdm/crypto"
)
type HTTPHandlers struct {
@@ -52,7 +53,7 @@ func decodeMDMEnrollRequest(_ context.Context, r *http.Request) (interface{}, er
switch r.Method {
case "GET":
return mdmEnrollRequest{}, nil
case "POST":
case "POST": // DEP request
data, err := ioutil.ReadAll(r.Body)
if err != nil {
return nil, err
@@ -61,8 +62,19 @@ func decodeMDMEnrollRequest(_ context.Context, r *http.Request) (interface{}, er
if err != nil {
return nil, err
}
// TODO: We should verify but not currently possible. Apple
// does no provide a cert for the CA.
err = p7.Verify()
if err != nil {
return nil, err
}
// TODO: for thse errors provide better feedback as 4xx HTTP status
signer := p7.GetOnlySigner()
if signer == nil {
return nil, errors.New("invalid CMS signer during enrollment")
}
err = crypto.VerifyFromAppleDeviceCA(signer)
if err != nil {
return nil, errors.New("unauthorized enrollment client: not signed by Apple Device CA")
}
var request depEnrollmentRequest
if err := plist.Unmarshal(p7.Content, &request); err != nil {
return nil, err