Validate topic info in push certificate (#373) (#373)

Added mock push certificates and example script for cert generation
Check that push cert has required UID com.apple.mgmt prefix
Closes #367

pkg/crypto/helpers.go

@@ -12,6 +12,7 @@ import (
 	"math/big"
 	"os"
 	"time"
+	"strings"
 )
 
 func GenerateRandomCertificateSerialNumber() (*big.Int, error) {
@@ -121,7 +122,11 @@ func TopicFromCert(cert *x509.Certificate) (string, error) {
 	var oidASN1UserID = asn1.ObjectIdentifier{0, 9, 2342, 19200300, 100, 1, 1}
 	for _, v := range cert.Subject.Names {
 		if v.Type.Equal(oidASN1UserID) {
-			return v.Value.(string), nil
+			uid, ok := v.Value.(string)
+			if ok && strings.HasPrefix(uid, "com.apple.mgmt") {
+				return uid, nil
+			}
+			return "", errors.New("invalid Push Topic (UserID OID) in certificate. Must start with 'com.apple.mgmt', was: " + uid)
 		}
 	}
 

pkg/crypto/helpers_test.go

@@ -0,0 +1,29 @@
+package crypto
+
+import (
+	"testing"
+)
+
+func TestTopicFromValidCert(t *testing.T) {
+	certificate, _ := ReadPEMCertificateFile("testdata/mock_push_cert.pem")
+	pushTopic, err := TopicFromCert(certificate)
+	if err != nil {
+		t.Fatalf("fail %s", err)
+	}
+
+	if have, want := pushTopic, "com.apple.mgmt.External.18a16429-886b-41f1-9c30-2bd04ae4fc37"; have != want {
+		t.Errorf("have %s, want %s", have, want)
+	}
+}
+
+func TestTopicFromInvalidCert(t *testing.T) {
+	certFileNames := []string{"mock_push_cert_wrong_uid_prefix.pem", "mock_push_cert_wrong_uid_prefix.pem"}
+	for _, certFileName := range certFileNames {
+		certificate, _ := ReadPEMCertificateFile("testdata/" + certFileName)
+		_, err := TopicFromCert(certificate)
+
+		if err == nil {
+			t.Errorf("expected error for invalid push certificate")
+		}
+	}
+}

pkg/crypto/testdata/create_mock_push_cert.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 18262 -out certificate.pem -subj "/UID=com.apple.mgmt.External.18a16429-886b-41f1-9c30-2bd04ae4fc37/CN=APSP:17a16429-886b-41f1-8c90-3bd02ae9fc57/C=US"

pkg/crypto/testdata/mock_push_cert.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDnjCCAoYCCQDH9mV3O1n7SzANBgkqhkiG9w0BAQsFADCBjzFMMEoGCgmSJomT
+8ixkAQEMPGNvbS5hcHBsZS5tZ210LkV4dGVybmFsLjE4YTE2NDI5LTg4NmItNDFm
+MS05YzMwLTJiZDA0YWU0ZmMzNzEyMDAGA1UEAwwpQVBTUDoxN2ExNjQyOS04ODZi
+LTQxZjEtOGM5MC0zYmQwMmFlOWZjNTcxCzAJBgNVBAYTAlVTMCAXDTE4MDEyNTA4
+MzMyNVoYDzIwNjgwMTI1MDgzMzI1WjCBjzFMMEoGCgmSJomT8ixkAQEMPGNvbS5h
+cHBsZS5tZ210LkV4dGVybmFsLjE4YTE2NDI5LTg4NmItNDFmMS05YzMwLTJiZDA0
+YWU0ZmMzNzEyMDAGA1UEAwwpQVBTUDoxN2ExNjQyOS04ODZiLTQxZjEtOGM5MC0z
+YmQwMmFlOWZjNTcxCzAJBgNVBAYTAlVTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEA5KOum54Ck9myiqS1bE4aVzO1fCV7jNOTRRXkLaG3+02hjFhrFdAa
+SXzd5GDBIFzW309M4vcXFAftllrcopIuU8NblFv6/ckE6/E19kHGQqzNz6OcB+gW
+XuuA4KxuczYGM8rWfLXDPUzN1lhuaidtjKBx6qVjwjnbLLnrjAGfBg5BMV+yLOiu
+9zl7aKgYuKsYF6/rBxRFWvDSztWmnhNCR/ihyfKNGUI8DYGgShA5Lrz6zGExmcra
+JVcAyKeTtE/QNLl/pzjhgbZOOyc+tZ2lek5JAZPYfOFMqVWLVF9YGEzX5fMUyskC
+XHR39cMZE5vge7eUTkavaSXxNgcxWxlIywIDAQABMA0GCSqGSIb3DQEBCwUAA4IB
+AQBNY2IL4rrc3C9g9JCSqtmlXhPsXSnW/kLuM+/8NYPxxprGDIUQ1jN4xppKuqZp
+zLsudS46riabkaPzl01eyThjp/kW8It7cu3t9LVZx4RTp4wAl98Z9DdvmfFgTbcp
+7bgLVSao0cZo/VCEbukaiVLEI1iesn092tpKVJa/7hfusYjRsgBentldu0nHgtqF
+s2vCLlpQ8WoXiRuzhzUMnocJC6d/5xfMYDoMVuR44u2podrQ+NNqJHfYCBnMQqAM
+ZjZAUOEZE9HpWzwasHq/AXnlIJQ5C+c+DfCNaSWF3RkDf/HUH6TerFZdvZfrLLgB
+NTSFWl0lMlVtiVNb+W9zTsIe
+-----END CERTIFICATE-----

pkg/crypto/testdata/mock_push_cert_no_uid.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIjCCAgoCCQCKvtUmOiEMjTANBgkqhkiG9w0BAQsFADBSMQ8wDQYDVQQDDAZu
+by51aWQxMjAwBgNVBAMMKUFQU1A6MTdhMTY0MjktODg2Yi00MWYxLThjOTAtM2Jk
+MDJhZTlmYzU3MQswCQYDVQQGEwJVUzAgFw0xODAxMjUwODQzNDhaGA8yMDY4MDEy
+NTA4NDM0OFowUjEPMA0GA1UEAwwGbm8udWlkMTIwMAYDVQQDDClBUFNQOjE3YTE2
+NDI5LTg4NmItNDFmMS04YzkwLTNiZDAyYWU5ZmM1NzELMAkGA1UEBhMCVVMwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCwWYI1/95LnpUXmO8Z17WkobUL
+/PpNW4m0bXwp6BPIorOpjUSBonx7UHkNpBuwypT0hfSYej47yGuL5uPaWB9gR1RZ
+a1j8MFoxj6p3Le7HJlYkRF4iFBpTy5yxlsycS7FO52+B51g45b4v6LDkY7ym7uOr
+zZwyee6ssQ+JcfqaT4Tp0fo2iSugWoJ0hxpaIZPhBgtCw+WEiIkeowh+kqiCyI5r
+gh2vOfDy+9Vb6sjbAo8BvQ4Cx7JHuoNinVbJ5iv+p1/CUyX9dz5u8wdGHgzCxSS0
+zSPxIBAIewvo/UdHb7XGBQXzsP+7cy7ZbodICklUIiTqjnwGO2G0752MiyChAgMB
+AAEwDQYJKoZIhvcNAQELBQADggEBAIrBQDrWbC24FTuhxDXFwCJFU0ihZ4gHcVYW
+jpqeSLPIo8hHM+rZhj2GHqDInt7pnnhndr0P60vTsBhMcxujyjZrYvxXZriLRwKk
+2cyA8aZTjxb2mlE6P/pAyYK+i6AekHMCslEU6jtc5ghnxbCvT2bnF3Lp/M/oB6EM
+DMREUBd0mefVArskB+PS1bWa41XeLUtJWaqpZkgo2S+Y1VhXzkV1CBiSHMApGdek
+OcR+wt+HhWC7JcmZ40kZYTO6q+FciX6SjZkvrF0Bk8sipXiTjf9yaX1sKEbE/+GT
+PoVVmCFv8TLzwfdIqFEywZ7DUAW8delJe3GI2/1BN4TOtH4R1us=
+-----END CERTIFICATE-----

pkg/crypto/testdata/mock_push_cert_wrong_uid_prefix.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDiDCCAnACCQCUcbmeNX3CoDANBgkqhkiG9w0BAQsFADCBhDFBMD8GCgmSJomT
+8ixkAQEMMXdyb25nLnByZWZpeC4xOGExNjQyOS04ODZiLTQxZjEtOWMzMC0yYmQw
+NGFlNGZjMzcxMjAwBgNVBAMMKUFQU1A6MTdhMTY0MjktODg2Yi00MWYxLThjOTAt
+M2JkMDJhZTlmYzU3MQswCQYDVQQGEwJVUzAgFw0xODAxMjUwODQyMzlaGA8yMDY4
+MDEyNTA4NDIzOVowgYQxQTA/BgoJkiaJk/IsZAEBDDF3cm9uZy5wcmVmaXguMThh
+MTY0MjktODg2Yi00MWYxLTljMzAtMmJkMDRhZTRmYzM3MTIwMAYDVQQDDClBUFNQ
+OjE3YTE2NDI5LTg4NmItNDFmMS04YzkwLTNiZDAyYWU5ZmM1NzELMAkGA1UEBhMC
+VVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQChKxRTPfjlB9RDaNOd
+wlzljXx5Sj83iFqa2dLVmn6v3cC9fJZ2x4g1ANixpkUiYBjymNQ8zJ0z4q8g3bht
+8Kky5vzoah4H6c1dCb+P6F5ihj9StUv0Dqzcl8sYt3G1qcNLlDmIrizsCuxbvznU
+FxFTKcqa4LZdV1DcOjQZvdtuxibWesMMfB5prziu1AJKCEDvrGT6BCuqYLRpDkrK
+CbHLfvEHpDcSr31wQvLgyk8w47ZchceCqMmJto4/5DHmAdnXjfRooUaERWdA0q+p
+wsld/lviSjUuoXIKZ8nIJH0rfoRyT8OI2SPEnk9eLlwgQffrJzLCYk93WE/ejhnx
+u2fJAgMBAAEwDQYJKoZIhvcNAQELBQADggEBADDU8360OHApqgQg7QxRCj8xvKDL
+2BcX4oOnx/lsHDfdzT9pNmTSwTEXF5Qum/OzWQik1YJkpcYFzFHh5+eA9e/KWwXw
+tvFZlQuS743xL+DGN4Ukd+cfhRJIjfjUgYFueDNDP95ABwsSxkETY760rMoxM2Gh
+uvxZZ3Zo3qckxgOMy6R3jOudaVWtDHojTxyk+cv50vBhlu/I29RhIsAD7N+3sZEU
+wvhQ23LRWPRa3fo7hf7V3MZIJ1sD48W9AWlgM+jDM7eWNdZ5vjp/avVZcCNrnDr1
+Hh6ki6KQTEy4Y3cYc9KgpZL1wro5a8b/ubXsxtw0X7xU0BiqDwjIsxeVxok=
+-----END CERTIFICATE-----