Victor Lyuboslavsky
e4df954b0f
#23905 - Update with upstream nanomdm changes up to https://github.com/micromdm/nanomdm/tree/825f2979a2dc28c6cc57bb62aff16737978bd90e - Removed PostgeSQL folder from our nanomdm - Added nanomdm MySQL test job to our CI # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files) for more information. - [x] Added/updated tests - [x] Manual QA for all new/changed functionality
38 lines
862 B
Go
38 lines
862 B
Go
package certverify
|
|
|
|
import (
|
|
"context"
|
|
"crypto/x509"
|
|
"errors"
|
|
)
|
|
|
|
// PoolVerifier is a simple certificate verifier
|
|
type PoolVerifier struct {
|
|
verifyOpts x509.VerifyOptions
|
|
}
|
|
|
|
// NewPoolVerifier creates a new Verifier
|
|
func NewPoolVerifier(rootsPEM []byte, keyUsages ...x509.ExtKeyUsage) (*PoolVerifier, error) {
|
|
opts := x509.VerifyOptions{
|
|
KeyUsages: keyUsages,
|
|
Roots: x509.NewCertPool(),
|
|
}
|
|
if len(rootsPEM) == 0 || !opts.Roots.AppendCertsFromPEM(rootsPEM) {
|
|
return nil, errors.New("could not append root CA(s)")
|
|
}
|
|
return &PoolVerifier{
|
|
verifyOpts: opts,
|
|
}, nil
|
|
}
|
|
|
|
// Verify performs certificate verification
|
|
func (v *PoolVerifier) Verify(_ context.Context, cert *x509.Certificate) error {
|
|
if cert == nil {
|
|
return errors.New("missing MDM certificate")
|
|
}
|
|
if _, err := cert.Verify(v.verifyOpts); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|