Documentation
¶
Index ¶
- func CertExtractMdmSignatureMiddleware(next http.Handler, verifier MdmSignatureVerifier, opts ...SigLogOption) http.HandlerFunc
- func CertExtractPEMHeaderMiddleware(next http.Handler, header string, logger log.Logger) http.HandlerFunc
- func CertExtractTLSMiddleware(next http.Handler, logger log.Logger) http.HandlerFunc
- func CertVerifyMiddleware(next http.Handler, verifier CertVerifier, logger log.Logger) http.HandlerFunc
- func CertWithEnrollmentIDMiddleware(next http.Handler, hasher HashFn, store storage.CertAuthRetriever, ...) http.HandlerFunc
- func CheckinAndCommandHandler(service service.CheckinAndCommandService, logger log.Logger) http.HandlerFunc
- func CheckinHandler(svc service.Checkin, logger log.Logger) http.HandlerFunc
- func CommandAndReportResultsHandler(svc service.CommandAndReportResults, logger log.Logger) http.HandlerFunc
- func ExtractQueryEscapedPEM(headerValue string) (*x509.Certificate, error)
- func ExtractRFC9440(headerValue string) (*x509.Certificate, error)
- func GetCert(ctx context.Context) *x509.Certificate
- func GetEnrollmentID(ctx context.Context) string
- func RequestFromHTTP(r *http.Request) *mdm.Request
- type CertVerifier
- type HashFn
- type MdmSignatureVerifier
- type MdmSignatureVerifierFunc
- type SigLogOption
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CertExtractMdmSignatureMiddleware ¶
func CertExtractMdmSignatureMiddleware(next http.Handler, verifier MdmSignatureVerifier, opts ...SigLogOption) http.HandlerFunc
CertExtractMdmSignatureMiddleware extracts the MDM enrollment identity certificate from the request into the HTTP request context. It tries to verify the Mdm-Signature header on the request.
This middleware does not error if a certificate is not found. It will, however, error with an HTTP 400 status if the signature verification fails.
func CertExtractPEMHeaderMiddleware ¶
func CertExtractPEMHeaderMiddleware(next http.Handler, header string, logger log.Logger) http.HandlerFunc
CertExtractPEMHeaderMiddleware extracts the MDM enrollment identity certificate from an HTTP header of the request and places the parsed certificate onto the HTTP request context. See GetCert.
The format of the header is parsed as RFC 9440 if it begins with a colon, otherwise a URL query-escaped PEM certificate is assumed.
func CertExtractTLSMiddleware ¶
CertExtractTLSMiddleware extracts the MDM enrollment identity certificate from the request into the HTTP request context. It looks at the TLS peer certificate in the request.
func CertVerifyMiddleware ¶
func CertVerifyMiddleware(next http.Handler, verifier CertVerifier, logger log.Logger) http.HandlerFunc
CertVerifyMiddleware checks the MDM certificate against verifier and returns an error if it fails.
We deliberately do not reply with 401 as this may cause unintentional MDM unenrollments in the case of bugs or something going wrong.
func CertWithEnrollmentIDMiddleware ¶ added in v0.6.0
func CertWithEnrollmentIDMiddleware(next http.Handler, hasher HashFn, store storage.CertAuthRetriever, enforce bool, logger log.Logger) http.HandlerFunc
CertWithEnrollmentIDMiddleware tries to associate the enrollment ID to the request context. It does this by looking up the certificate on the context, hashing it with hasher, looking up the hash in storage, and setting the ID on the context.
The next handler will be called even if cert or ID is not found unless enforce is true. This way next is able to use the existence of the ID on the context to make its own decisions.
func CheckinAndCommandHandler ¶
func CheckinAndCommandHandler(service service.CheckinAndCommandService, logger log.Logger) http.HandlerFunc
CheckinAndCommandHandler handles both check-in and command requests.
func CheckinHandler ¶
CheckinHandler decodes an MDM check-in request and adapts it to service.
func CommandAndReportResultsHandler ¶
func CommandAndReportResultsHandler(svc service.CommandAndReportResults, logger log.Logger) http.HandlerFunc
CommandAndReportResultsHandler decodes an MDM command request and adapts it to service.
func ExtractQueryEscapedPEM ¶ added in v0.8.0
func ExtractQueryEscapedPEM(headerValue string) (*x509.Certificate, error)
ExtractQueryEscapedPEM parses a PEM certificate from a URL query-escaped header value. This is ostensibly to support Nginx' $ssl_client_escaped_cert in a `proxy_set_header` directive.
func ExtractRFC9440 ¶ added in v0.8.0
func ExtractRFC9440(headerValue string) (*x509.Certificate, error)
ExtractRFC9440 attempts to parse a certificate out of an RFC 9440-style header value. RFC 9440 is, basically, the base64-encoded DER certificate surrounded by colons.
func GetCert ¶
func GetCert(ctx context.Context) *x509.Certificate
GetCert retrieves the MDM enrollment identity certificate from the HTTP request context.
func GetEnrollmentID ¶ added in v0.6.0
GetEnrollmentID retrieves the MDM enrollment ID from ctx.
Types ¶
type CertVerifier ¶
type CertVerifier interface {
Verify(context.Context, *x509.Certificate) error
}
CertVerifier is a simple interface for verifying a certificate.
type HashFn ¶ added in v0.6.0
type HashFn func(*x509.Certificate) string
type MdmSignatureVerifier ¶ added in v0.7.0
type MdmSignatureVerifier interface {
// VerifyMdmSignature verifies an Apple MDM "Mdm-Signature" header and returns the signing certificate.
// See https://developer.apple.com/documentation/devicemanagement/implementing_device_management/managing_certificates_for_mdm_servers_and_devices
// section "Pass an Identity Certificate Through a Proxy."
VerifyMdmSignature(header string, body []byte) (*x509.Certificate, error)
}
MdmSignatureVerifier verifies Apple Mdm-Signature headers and extracts certificates.
type MdmSignatureVerifierFunc ¶ added in v0.7.0
type MdmSignatureVerifierFunc func(header string, body []byte) (*x509.Certificate, error)
MdmSignatureVerifierFunc is an adapter for verifying Apple MDM "Mdm-Signature" headers.
func (MdmSignatureVerifierFunc) VerifyMdmSignature ¶ added in v0.7.0
func (v MdmSignatureVerifierFunc) VerifyMdmSignature(header string, body []byte) (*x509.Certificate, error)
VerifyMdmSignature calls v with header and body.
type SigLogOption ¶ added in v0.6.0
type SigLogOption func(*sigLogConfig)
SigLogOption sets configurations.
func SigLogWithLogAlways ¶ added in v0.6.0
func SigLogWithLogAlways(always bool) SigLogOption
SigLogWithLogAlways always logs the raw Mdm-Signature header.
func SigLogWithLogErrors ¶ added in v0.6.0
func SigLogWithLogErrors(errors bool) SigLogOption
SigLogWithLogErrors logs the raw Mdm-Signature header when errors occur.
func SigLogWithLogger ¶ added in v0.6.0
func SigLogWithLogger(logger log.Logger) SigLogOption
SigLogWithLogger sets the logger to use when logging with the MDM signature header.
Source Files