From a45d79f37a010fcaed252b6f3aa873bdc1ffdbbc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lars=20Preben=20S=C3=B8rsdahl?= Date: Fri, 26 Jan 2018 14:41:30 +0100 Subject: [PATCH] Validate topic info in push certificate (#373) (#373) Added mock push certificates and example script for cert generation Check that push cert has required UID com.apple.mgmt prefix Closes #367 --- pkg/crypto/helpers.go | 7 ++++- pkg/crypto/helpers_test.go | 29 +++++++++++++++++++ pkg/crypto/testdata/create_mock_push_cert.sh | 3 ++ pkg/crypto/testdata/mock_push_cert.pem | 22 ++++++++++++++ pkg/crypto/testdata/mock_push_cert_no_uid.pem | 19 ++++++++++++ .../mock_push_cert_wrong_uid_prefix.pem | 21 ++++++++++++++ 6 files changed, 100 insertions(+), 1 deletion(-) create mode 100644 pkg/crypto/helpers_test.go create mode 100755 pkg/crypto/testdata/create_mock_push_cert.sh create mode 100644 pkg/crypto/testdata/mock_push_cert.pem create mode 100644 pkg/crypto/testdata/mock_push_cert_no_uid.pem create mode 100644 pkg/crypto/testdata/mock_push_cert_wrong_uid_prefix.pem diff --git a/pkg/crypto/helpers.go b/pkg/crypto/helpers.go index bb5fd4b7..768c1d0a 100644 --- a/pkg/crypto/helpers.go +++ b/pkg/crypto/helpers.go @@ -12,6 +12,7 @@ import ( "math/big" "os" "time" + "strings" ) func GenerateRandomCertificateSerialNumber() (*big.Int, error) { @@ -121,7 +122,11 @@ func TopicFromCert(cert *x509.Certificate) (string, error) { var oidASN1UserID = asn1.ObjectIdentifier{0, 9, 2342, 19200300, 100, 1, 1} for _, v := range cert.Subject.Names { if v.Type.Equal(oidASN1UserID) { - return v.Value.(string), nil + uid, ok := v.Value.(string) + if ok && strings.HasPrefix(uid, "com.apple.mgmt") { + return uid, nil + } + return "", errors.New("invalid Push Topic (UserID OID) in certificate. Must start with 'com.apple.mgmt', was: " + uid) } } diff --git a/pkg/crypto/helpers_test.go b/pkg/crypto/helpers_test.go new file mode 100644 index 00000000..f6f1348e --- /dev/null +++ b/pkg/crypto/helpers_test.go @@ -0,0 +1,29 @@ +package crypto + +import ( + "testing" +) + +func TestTopicFromValidCert(t *testing.T) { + certificate, _ := ReadPEMCertificateFile("testdata/mock_push_cert.pem") + pushTopic, err := TopicFromCert(certificate) + if err != nil { + t.Fatalf("fail %s", err) + } + + if have, want := pushTopic, "com.apple.mgmt.External.18a16429-886b-41f1-9c30-2bd04ae4fc37"; have != want { + t.Errorf("have %s, want %s", have, want) + } +} + +func TestTopicFromInvalidCert(t *testing.T) { + certFileNames := []string{"mock_push_cert_wrong_uid_prefix.pem", "mock_push_cert_wrong_uid_prefix.pem"} + for _, certFileName := range certFileNames { + certificate, _ := ReadPEMCertificateFile("testdata/" + certFileName) + _, err := TopicFromCert(certificate) + + if err == nil { + t.Errorf("expected error for invalid push certificate") + } + } +} diff --git a/pkg/crypto/testdata/create_mock_push_cert.sh b/pkg/crypto/testdata/create_mock_push_cert.sh new file mode 100755 index 00000000..934e17a4 --- /dev/null +++ b/pkg/crypto/testdata/create_mock_push_cert.sh @@ -0,0 +1,3 @@ +#!/usr/bin/env bash + +openssl req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 18262 -out certificate.pem -subj "/UID=com.apple.mgmt.External.18a16429-886b-41f1-9c30-2bd04ae4fc37/CN=APSP:17a16429-886b-41f1-8c90-3bd02ae9fc57/C=US" diff --git a/pkg/crypto/testdata/mock_push_cert.pem b/pkg/crypto/testdata/mock_push_cert.pem new file mode 100644 index 00000000..54e9fe16 --- /dev/null +++ b/pkg/crypto/testdata/mock_push_cert.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDnjCCAoYCCQDH9mV3O1n7SzANBgkqhkiG9w0BAQsFADCBjzFMMEoGCgmSJomT +8ixkAQEMPGNvbS5hcHBsZS5tZ210LkV4dGVybmFsLjE4YTE2NDI5LTg4NmItNDFm +MS05YzMwLTJiZDA0YWU0ZmMzNzEyMDAGA1UEAwwpQVBTUDoxN2ExNjQyOS04ODZi +LTQxZjEtOGM5MC0zYmQwMmFlOWZjNTcxCzAJBgNVBAYTAlVTMCAXDTE4MDEyNTA4 +MzMyNVoYDzIwNjgwMTI1MDgzMzI1WjCBjzFMMEoGCgmSJomT8ixkAQEMPGNvbS5h +cHBsZS5tZ210LkV4dGVybmFsLjE4YTE2NDI5LTg4NmItNDFmMS05YzMwLTJiZDA0 +YWU0ZmMzNzEyMDAGA1UEAwwpQVBTUDoxN2ExNjQyOS04ODZiLTQxZjEtOGM5MC0z +YmQwMmFlOWZjNTcxCzAJBgNVBAYTAlVTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A +MIIBCgKCAQEA5KOum54Ck9myiqS1bE4aVzO1fCV7jNOTRRXkLaG3+02hjFhrFdAa +SXzd5GDBIFzW309M4vcXFAftllrcopIuU8NblFv6/ckE6/E19kHGQqzNz6OcB+gW +XuuA4KxuczYGM8rWfLXDPUzN1lhuaidtjKBx6qVjwjnbLLnrjAGfBg5BMV+yLOiu +9zl7aKgYuKsYF6/rBxRFWvDSztWmnhNCR/ihyfKNGUI8DYGgShA5Lrz6zGExmcra +JVcAyKeTtE/QNLl/pzjhgbZOOyc+tZ2lek5JAZPYfOFMqVWLVF9YGEzX5fMUyskC +XHR39cMZE5vge7eUTkavaSXxNgcxWxlIywIDAQABMA0GCSqGSIb3DQEBCwUAA4IB +AQBNY2IL4rrc3C9g9JCSqtmlXhPsXSnW/kLuM+/8NYPxxprGDIUQ1jN4xppKuqZp +zLsudS46riabkaPzl01eyThjp/kW8It7cu3t9LVZx4RTp4wAl98Z9DdvmfFgTbcp +7bgLVSao0cZo/VCEbukaiVLEI1iesn092tpKVJa/7hfusYjRsgBentldu0nHgtqF +s2vCLlpQ8WoXiRuzhzUMnocJC6d/5xfMYDoMVuR44u2podrQ+NNqJHfYCBnMQqAM +ZjZAUOEZE9HpWzwasHq/AXnlIJQ5C+c+DfCNaSWF3RkDf/HUH6TerFZdvZfrLLgB +NTSFWl0lMlVtiVNb+W9zTsIe +-----END CERTIFICATE----- diff --git a/pkg/crypto/testdata/mock_push_cert_no_uid.pem b/pkg/crypto/testdata/mock_push_cert_no_uid.pem new file mode 100644 index 00000000..c75a3667 --- /dev/null +++ b/pkg/crypto/testdata/mock_push_cert_no_uid.pem @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDIjCCAgoCCQCKvtUmOiEMjTANBgkqhkiG9w0BAQsFADBSMQ8wDQYDVQQDDAZu +by51aWQxMjAwBgNVBAMMKUFQU1A6MTdhMTY0MjktODg2Yi00MWYxLThjOTAtM2Jk +MDJhZTlmYzU3MQswCQYDVQQGEwJVUzAgFw0xODAxMjUwODQzNDhaGA8yMDY4MDEy +NTA4NDM0OFowUjEPMA0GA1UEAwwGbm8udWlkMTIwMAYDVQQDDClBUFNQOjE3YTE2 +NDI5LTg4NmItNDFmMS04YzkwLTNiZDAyYWU5ZmM1NzELMAkGA1UEBhMCVVMwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCwWYI1/95LnpUXmO8Z17WkobUL +/PpNW4m0bXwp6BPIorOpjUSBonx7UHkNpBuwypT0hfSYej47yGuL5uPaWB9gR1RZ +a1j8MFoxj6p3Le7HJlYkRF4iFBpTy5yxlsycS7FO52+B51g45b4v6LDkY7ym7uOr +zZwyee6ssQ+JcfqaT4Tp0fo2iSugWoJ0hxpaIZPhBgtCw+WEiIkeowh+kqiCyI5r +gh2vOfDy+9Vb6sjbAo8BvQ4Cx7JHuoNinVbJ5iv+p1/CUyX9dz5u8wdGHgzCxSS0 +zSPxIBAIewvo/UdHb7XGBQXzsP+7cy7ZbodICklUIiTqjnwGO2G0752MiyChAgMB +AAEwDQYJKoZIhvcNAQELBQADggEBAIrBQDrWbC24FTuhxDXFwCJFU0ihZ4gHcVYW +jpqeSLPIo8hHM+rZhj2GHqDInt7pnnhndr0P60vTsBhMcxujyjZrYvxXZriLRwKk +2cyA8aZTjxb2mlE6P/pAyYK+i6AekHMCslEU6jtc5ghnxbCvT2bnF3Lp/M/oB6EM +DMREUBd0mefVArskB+PS1bWa41XeLUtJWaqpZkgo2S+Y1VhXzkV1CBiSHMApGdek +OcR+wt+HhWC7JcmZ40kZYTO6q+FciX6SjZkvrF0Bk8sipXiTjf9yaX1sKEbE/+GT +PoVVmCFv8TLzwfdIqFEywZ7DUAW8delJe3GI2/1BN4TOtH4R1us= +-----END CERTIFICATE----- diff --git a/pkg/crypto/testdata/mock_push_cert_wrong_uid_prefix.pem b/pkg/crypto/testdata/mock_push_cert_wrong_uid_prefix.pem new file mode 100644 index 00000000..e134cb7a --- /dev/null +++ b/pkg/crypto/testdata/mock_push_cert_wrong_uid_prefix.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDiDCCAnACCQCUcbmeNX3CoDANBgkqhkiG9w0BAQsFADCBhDFBMD8GCgmSJomT +8ixkAQEMMXdyb25nLnByZWZpeC4xOGExNjQyOS04ODZiLTQxZjEtOWMzMC0yYmQw +NGFlNGZjMzcxMjAwBgNVBAMMKUFQU1A6MTdhMTY0MjktODg2Yi00MWYxLThjOTAt +M2JkMDJhZTlmYzU3MQswCQYDVQQGEwJVUzAgFw0xODAxMjUwODQyMzlaGA8yMDY4 +MDEyNTA4NDIzOVowgYQxQTA/BgoJkiaJk/IsZAEBDDF3cm9uZy5wcmVmaXguMThh +MTY0MjktODg2Yi00MWYxLTljMzAtMmJkMDRhZTRmYzM3MTIwMAYDVQQDDClBUFNQ +OjE3YTE2NDI5LTg4NmItNDFmMS04YzkwLTNiZDAyYWU5ZmM1NzELMAkGA1UEBhMC +VVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQChKxRTPfjlB9RDaNOd +wlzljXx5Sj83iFqa2dLVmn6v3cC9fJZ2x4g1ANixpkUiYBjymNQ8zJ0z4q8g3bht +8Kky5vzoah4H6c1dCb+P6F5ihj9StUv0Dqzcl8sYt3G1qcNLlDmIrizsCuxbvznU +FxFTKcqa4LZdV1DcOjQZvdtuxibWesMMfB5prziu1AJKCEDvrGT6BCuqYLRpDkrK +CbHLfvEHpDcSr31wQvLgyk8w47ZchceCqMmJto4/5DHmAdnXjfRooUaERWdA0q+p +wsld/lviSjUuoXIKZ8nIJH0rfoRyT8OI2SPEnk9eLlwgQffrJzLCYk93WE/ejhnx +u2fJAgMBAAEwDQYJKoZIhvcNAQELBQADggEBADDU8360OHApqgQg7QxRCj8xvKDL +2BcX4oOnx/lsHDfdzT9pNmTSwTEXF5Qum/OzWQik1YJkpcYFzFHh5+eA9e/KWwXw +tvFZlQuS743xL+DGN4Ukd+cfhRJIjfjUgYFueDNDP95ABwsSxkETY760rMoxM2Gh +uvxZZ3Zo3qckxgOMy6R3jOudaVWtDHojTxyk+cv50vBhlu/I29RhIsAD7N+3sZEU +wvhQ23LRWPRa3fo7hf7V3MZIJ1sD48W9AWlgM+jDM7eWNdZ5vjp/avVZcCNrnDr1 +Hh6ki6KQTEy4Y3cYc9KgpZL1wro5a8b/ubXsxtw0X7xU0BiqDwjIsxeVxok= +-----END CERTIFICATE-----