Add ACMECertificate payload handling with Device Attestation

cmd/mdmb/main.go

@@ -14,8 +14,10 @@ import (
 	"text/tabwriter"
 	"time"
 
-	"github.com/jessepeterson/mdmb/internal/device"
 	bolt "go.etcd.io/bbolt"
+
+	"github.com/jessepeterson/mdmb/internal/attest"
+	"github.com/jessepeterson/mdmb/internal/device"
 )
 
 var version = "unknown"
@@ -39,8 +41,10 @@ type DeviceBag interface {
 
 // RunContext contains "global" runtime environment settings
 type RunContext struct {
-	Context context.Context
-	DB      *bolt.DB
+	Context       context.Context
+	DB            *bolt.DB
+	AttestationCA *attest.CA
+
 	// device UUIDs (UDIDs)
 	UUIDs []string
 	Bag   DeviceBag
@@ -157,7 +161,10 @@ func checkDeviceUUIDs(rctx RunContext, requireEmpty bool, subCmdName string) err
 func devicesProfilesInstall(name string, args []string, rctx RunContext, usage func()) {
 	f := flag.NewFlagSet(name, flag.ExitOnError)
 	var (
-		file = f.String("f", "", "profile to install")
+		file                     = f.String("f", "", "profile to install")
+		attestationCACertFile    = f.String("cert", "", "Path to the fake attestation CA certificate in PEM format")
+		attestationCAKeyFile     = f.String("key", "", "Path to the fake attestation CA private key")
+		attestationCAKeyPassword = f.String("pass", "", "Password for the fake attestation CA private key")
 	)
 	setSubCommandFlagSetUsage(f, usage)
 	f.Parse(args)
@@ -168,6 +175,13 @@ func devicesProfilesInstall(name string, args []string, rctx RunContext, usage f
 		os.Exit(2)
 	}
 
+	attestationCA, err := attest.New(*attestationCACertFile, *attestationCAKeyFile, *attestationCAKeyPassword)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	rctx.AttestationCA = attestationCA
+
 	ep, err := ioutil.ReadFile(*file)
 	if err != nil {
 		log.Fatal(err)
@@ -180,7 +194,7 @@ func devicesProfilesInstall(name string, args []string, rctx RunContext, usage f
 
 	for _, u := range rctx.UUIDs {
 		fmt.Println(u)
-		dev, err := device.Load(u, rctx.DB)
+		dev, err := device.Load(u, rctx.DB, rctx.AttestationCA)
 		if err != nil {
 			log.Println(err)
 			continue
@@ -253,7 +267,7 @@ func devicesTokenUpdate(name string, args []string, rctx RunContext, usage func(
 	for _, u := range rctx.UUIDs {
 		fmt.Println(u)
 
-		dev, err := device.Load(u, rctx.DB)
+		dev, err := device.Load(u, rctx.DB, nil)
 		if err != nil {
 			log.Println(err)
 			continue
@@ -289,7 +303,7 @@ func devicesConnect(name string, args []string, rctx RunContext, usage func()) {
 	workerData := []*ConnectWorkerData{}
 
 	for _, u := range rctx.UUIDs {
-		dev, err := device.Load(u, rctx.DB)
+		dev, err := device.Load(u, rctx.DB, nil)
 		if err != nil {
 			log.Println(err)
 			continue
@@ -318,7 +332,7 @@ func devicesProfilesList(name string, args []string, rctx RunContext, usage func
 
 	for _, u := range rctx.UUIDs {
 		fmt.Printf("profiles for UUID: %s\n", u)
-		dev, err := device.Load(u, rctx.DB)
+		dev, err := device.Load(u, rctx.DB, nil)
 		if err != nil {
 			log.Println(err)
 			continue
@@ -360,7 +374,7 @@ func devicesMdmSignature(name string, args []string, rctx RunContext, usage func
 	}
 
 	for _, u := range rctx.UUIDs {
-		dev, err := device.Load(u, rctx.DB)
+		dev, err := device.Load(u, rctx.DB, nil)
 		if err != nil {
 			log.Println(err)
 			continue
@@ -407,7 +421,7 @@ func devicesProfilesRemove(name string, args []string, rctx RunContext, usage fu
 
 	for _, u := range rctx.UUIDs {
 		fmt.Println(u)
-		dev, err := device.Load(u, rctx.DB)
+		dev, err := device.Load(u, rctx.DB, nil)
 		if err != nil {
 			log.Println(err)
 			continue

go.mod

@@ -3,10 +3,14 @@ module github.com/jessepeterson/mdmb
 go 1.13
 
 require (
+	github.com/fxamacker/cbor/v2 v2.4.0
 	github.com/google/uuid v1.3.0
 	github.com/groob/plist v0.0.0-20220217120414-63fa881b19a5
 	github.com/jessepeterson/cfgprofiles v0.4.0
+	github.com/mholt/acmez v1.1.1
+	github.com/smallstep/certinfo v1.11.0
 	github.com/smallstep/pkcs7 v0.0.0-20240911091500-b1cae6277023
 	github.com/smallstep/scep v0.0.0-20240925131050-18439bca3e8e
-	go.etcd.io/bbolt v1.3.3
+	go.etcd.io/bbolt v1.3.6
+	go.step.sm/crypto v0.30.0
 )

internal/attest/attest.go

@@ -0,0 +1,55 @@
+package attest
+
+import (
+	"crypto"
+	"crypto/x509"
+	"fmt"
+
+	"go.step.sm/crypto/minica"
+	"go.step.sm/crypto/pemutil"
+)
+
+type CA struct {
+	m *minica.CA
+}
+
+func New(caCertFile, caKeyFile, caKeyPassword string) (*CA, error) {
+	// (fake) attestation CA configuration is optional. If no signing certificate or
+	// key is provided, assume no attestation CA is required and return early.
+	if caCertFile == "" || caKeyFile == "" {
+		return nil, nil
+	}
+
+	caCert, err := pemutil.ReadCertificate(caCertFile)
+	if err != nil {
+		return nil, fmt.Errorf("failed reading ca certificate: %w", err)
+	}
+
+	anySigner, err := pemutil.Read(caKeyFile, pemutil.WithPassword([]byte(caKeyPassword)))
+	if err != nil {
+		return nil, fmt.Errorf("failed reading ca key: %w", err)
+	}
+
+	caSigner, ok := anySigner.(crypto.Signer)
+	if !ok {
+		return nil, fmt.Errorf("key read from %q is not a signer", caKeyFile)
+	}
+
+	ca := &CA{
+		m: &minica.CA{
+			Intermediate: caCert,
+			Signer:       caSigner,
+		},
+	}
+
+	return ca, nil
+}
+
+func (ca *CA) Sign(template *x509.Certificate) ([]*x509.Certificate, error) {
+	cert, err := ca.m.Sign(template)
+	if err != nil {
+		return nil, fmt.Errorf("failed to sign certificate: %w", err)
+	}
+
+	return []*x509.Certificate{cert, ca.m.Intermediate}, nil
+}