From a40582af11c182b60ffdebe9eaab9e3b28c4025c Mon Sep 17 00:00:00 2001 From: Jesse Peterson Date: Fri, 14 Apr 2017 15:22:15 -0700 Subject: [PATCH] Verify device certificate on DEP enrollment (#143) --- enroll/transport_http.go | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/enroll/transport_http.go b/enroll/transport_http.go index 79d42ad1..c2492a63 100644 --- a/enroll/transport_http.go +++ b/enroll/transport_http.go @@ -9,6 +9,7 @@ import ( "github.com/fullsailor/pkcs7" httptransport "github.com/go-kit/kit/transport/http" "github.com/groob/plist" + "github.com/micromdm/micromdm/crypto" ) type HTTPHandlers struct { @@ -52,7 +53,7 @@ func decodeMDMEnrollRequest(_ context.Context, r *http.Request) (interface{}, er switch r.Method { case "GET": return mdmEnrollRequest{}, nil - case "POST": + case "POST": // DEP request data, err := ioutil.ReadAll(r.Body) if err != nil { return nil, err @@ -61,8 +62,19 @@ func decodeMDMEnrollRequest(_ context.Context, r *http.Request) (interface{}, er if err != nil { return nil, err } - // TODO: We should verify but not currently possible. Apple - // does no provide a cert for the CA. + err = p7.Verify() + if err != nil { + return nil, err + } + // TODO: for thse errors provide better feedback as 4xx HTTP status + signer := p7.GetOnlySigner() + if signer == nil { + return nil, errors.New("invalid CMS signer during enrollment") + } + err = crypto.VerifyFromAppleDeviceCA(signer) + if err != nil { + return nil, errors.New("unauthorized enrollment client: not signed by Apple Device CA") + } var request depEnrollmentRequest if err := plist.Unmarshal(p7.Content, &request); err != nil { return nil, err