mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 05:27:24 +08:00
Alan Parra
d218fd2625
Implement native macOS methods required by device enrollment, namely methods to Create/Get the device key, Sign challenges with it, and to collect device data (aka serial number). The implementation is rather similar to lib/auth/touchid, but simpler in a few aspects: 1. Device keys don't require user interaction (as in they don't cause a touch ID prompt); and 2. There exists, at most, a single device key at all times. I've added a tiny refactor to reuse Apple public key parsing from touchid, plus some changes so touchid doesn't break in the face of unexpected keys (which the device key didn't cause, per se, but my experiments getting to it did). gravitational/teleport.e#514
55 lines
1.9 KiB
C
55 lines
1.9 KiB
C
#ifndef DEVICE_DARWIN_H_
|
|
#define DEVICE_DARWIN_H_
|
|
|
|
#include <stddef.h>
|
|
#include <stdint.h>
|
|
|
|
// PublicKey represents a device public key, containing its credential ID and
|
|
// binary representation (as returned by SecKeyCopyExternalRepresentation).
|
|
// A device key is guaranteed to be stored in the Secure Enclave, and thus is an
|
|
// ECDSA P-256 key.
|
|
typedef struct PublicKey {
|
|
const char *id;
|
|
uint8_t *pub_key;
|
|
size_t pub_key_len;
|
|
} PublicKey;
|
|
|
|
struct _Bytes {
|
|
uint8_t *data;
|
|
size_t data_len;
|
|
};
|
|
|
|
// Digest is a hash digest to be signed.
|
|
typedef struct _Bytes Digest;
|
|
|
|
// Signature is a signature over a Digest.
|
|
typedef struct _Bytes Signature;
|
|
|
|
// DeviceKeyGetOrCreate creates a new Secure Enclave key for the device, or
|
|
// returns the existing key if one is already present.
|
|
// Callers are responsible for allocating and freeing all "out" parameters.
|
|
// Returns zero for success, non-zero for failures (likely an OSStatus value).
|
|
int32_t DeviceKeyGetOrCreate(const char *newID, PublicKey *pubKeyOut);
|
|
|
|
// DeviceKeyGet returns the current device key or fails.
|
|
// Callers are responsible for allocating and freeing all "out" parameters.
|
|
// Returns zero for success, non-zero for failures (likely an OSStatus value).
|
|
int32_t DeviceKeyGet(PublicKey *pubKeyOut);
|
|
|
|
// DeviceKeySign signs digest using the device key.
|
|
// Callers are responsible for allocating and freeing all "out" parameters.
|
|
// Returns zero for success, non-zero for failures (likely an OSStatus value).
|
|
int32_t DeviceKeySign(Digest digest, Signature *sigOut);
|
|
|
|
// DeviceData contains collected data for the device in use.
|
|
typedef struct _DeviceData {
|
|
const char *serial_number;
|
|
} DeviceData;
|
|
|
|
// DeviceCollectData collects data for the device in use.
|
|
// Callers are responsible for allocating and freeing all "out" parameters.
|
|
// Returns zero for success, non-zero for failures.
|
|
int32_t DeviceCollectData(DeviceData *out);
|
|
|
|
#endif // DEVICE_DARWIN_H_
|