Victor Lyuboslavsky
62186cb6bd
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #40540 go-kit/log is no longer a direct dependency; moved kitlog adapter required for some 3rd party libraries into its own package # Checklist for submitter - [ ] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - Present in previous PR ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Modernized logging across the codebase: switched from legacy logging wrappers to Go's standard slog, updated adapters, tests, tools, and server components. * Threaded the new slog logger through test utilities and tooling; adjusted a small number of logging-related function/constructor signatures to accept the new logger type (minor compatibility updates). <!-- end of auto-generated comment: release notes by coderabbit.ai -->
93 lines
2.6 KiB
Go
93 lines
2.6 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rsa"
|
|
"errors"
|
|
"log/slog"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/fleetdm/fleet/v4/server/mdm/assets"
|
|
"github.com/fleetdm/fleet/v4/server/mdm/scep/kitlogadapter"
|
|
scepserver "github.com/fleetdm/fleet/v4/server/mdm/scep/server"
|
|
"github.com/smallstep/scep"
|
|
)
|
|
|
|
var _ scepserver.Service = (*service)(nil)
|
|
|
|
type service struct {
|
|
// The (chainable) CSR signing function. Intended to handle all
|
|
// SCEP request functionality such as CSR & challenge checking, CA
|
|
// issuance, RA proxying, etc.
|
|
signer scepserver.CSRSignerContext
|
|
|
|
/// info logging is implemented in the service middleware layer.
|
|
debugLogger *slog.Logger
|
|
|
|
ds fleet.MDMAssetRetriever
|
|
}
|
|
|
|
func (svc *service) GetCACaps(ctx context.Context) ([]byte, error) {
|
|
defaultCaps := []byte("Renewal\nSHA-1\nSHA-256\nAES\nDES3\nSCEPStandard\nPOSTPKIOperation")
|
|
return defaultCaps, nil
|
|
}
|
|
|
|
func (svc *service) GetCACert(ctx context.Context, _ string) ([]byte, int, error) {
|
|
cert, err := assets.CAKeyPair(ctx, svc.ds)
|
|
if err != nil {
|
|
return nil, 0, ctxerr.Wrap(ctx, err, "parsing SCEP certificate")
|
|
}
|
|
return cert.Leaf.Raw, 1, nil
|
|
}
|
|
|
|
func (svc *service) PKIOperation(ctx context.Context, data []byte) ([]byte, error) {
|
|
if len(data) == 0 {
|
|
return nil, &fleet.BadRequestError{Message: "missing data for PKIOperation"}
|
|
}
|
|
msg, err := scep.ParsePKIMessage(data, scep.WithLogger(kitlogadapter.NewLogger(svc.debugLogger)))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
cert, err := assets.CAKeyPair(ctx, svc.ds)
|
|
if err != nil {
|
|
return nil, ctxerr.Wrap(ctx, err, "parsing SCEP certificate")
|
|
}
|
|
|
|
pk, ok := cert.PrivateKey.(*rsa.PrivateKey)
|
|
if !ok {
|
|
return nil, errors.New("private key not in RSA format")
|
|
}
|
|
|
|
if err := msg.DecryptPKIEnvelope(cert.Leaf, pk); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
crt, err := svc.signer.SignCSRContext(ctx, msg.CSRReqMessage)
|
|
if err == nil && crt == nil {
|
|
err = errors.New("no signed certificate")
|
|
}
|
|
if err != nil {
|
|
svc.debugLogger.ErrorContext(ctx, "failed to sign CSR", "err", err)
|
|
certRep, err := msg.Fail(cert.Leaf, pk, scep.BadRequest)
|
|
return certRep.Raw, err
|
|
}
|
|
|
|
certRep, err := msg.Success(cert.Leaf, pk, crt)
|
|
return certRep.Raw, err
|
|
}
|
|
|
|
func (svc *service) GetNextCACert(ctx context.Context) ([]byte, error) {
|
|
return nil, errors.New("not implemented")
|
|
}
|
|
|
|
// NewService creates a new scep service
|
|
func NewSCEPService(ds fleet.MDMAssetRetriever, signer scepserver.CSRSignerContext, logger *slog.Logger) scepserver.Service {
|
|
return &service{
|
|
signer: signer,
|
|
debugLogger: slog.New(slog.DiscardHandler),
|
|
ds: ds,
|
|
}
|
|
}
|