Responding to the eMudhra CA compromise with Zentral and Turbo

3043fa4ff257dca0c380ee2e58ea78b23fe6bbc1  emSign ECC Root CA - G3
d1eb23a46d17d68fd92564c2f1f1601764d8e349  AAA Certificate Services
39d3236e4a609ab6190cbfa1ad02b3cc61dfc2c3  emSign Root TLS CA - G3
1f74b6010a219fd9ca058d07aa053d15efd9300d  emSign Root CS CA - G3

#!/bin/zsh
# Exit 0 = protected. Otherwise a sum of: 1 Apple's block missing from trustd, 2 root in /etc/ssl/cert.pem,
# 4 root in a Homebrew, certifi or pip bundle, 8 compromised intermediate in the System keychain.

# Turbo stops a script after 3 seconds, too short to run openssl on each certificate of each bundle.
# So a single awk reads each bundle and compares the base64 text of each certificate with these two.
emsign_ecc_root_ca_g3=(  # SHA-1 3043fa4ff257dca0c380ee2e58ea78b23fe6bbc1
  MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG
  EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo
  bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g
  RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ
  TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s
  b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw
  djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0
  WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS
  fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB
  zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq
  hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB
  CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD
  +JbNR6iC8hZVdyR+EhCVBCyj
)
aaa_certificate_services=(  # SHA-1 d1eb23a46d17d68fd92564c2f1f1601764d8e349
  MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
  MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
  GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
  YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
  MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
  BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM
  GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP
  ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua
  BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe
  3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4
  YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR
  rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm
  ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU
  oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
  MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v
  QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t
  b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF
  AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q
  GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
  Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2
  G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi
  l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
  smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
)
roots="${(j::)emsign_ecc_root_ca_g3} ${(j::)aaa_certificate_services}"
intermediates=(
  a99b289464f3b44343270a7a1e910f02370483fe 1396be1372bc93dfa2a433ca964dba91548a6e57
  5f014e0db3bb8f950e0598ab280846d383fc57be 5dfa19197d1c1cf629af7c0cd865543c5050227c
  f33acd1f5d31aa81ac18c72c928446226d3d5914 19069bd6533bff93fb67c71fb3376b4ea7402c3b
  8ad23bc78845d6faae1d534bac89f0e36ba55a11 4b0944c14f8c2ccba4e4f32104ad920fa15ee331
  7fcc31aab874ce6c8ee8584f54cfd08646b54117 305fc1e253dcab71b95d4995dae3cb09d562f22a
  c988f3d0cc1629ffc43165d6464c9b6ef73d6e48 8588708e875a1f8aa83524f3559080f7e17068c7
  d33195a244046a3263fb5e0e83c6803a5b2e7bc3 ee26d7ae3cc71718f6e07d7d0095076f0c158f63
  1f4a5d178f8b6a8ef0f6784155bd5fea91158b12 7fde64753a957b98f172fd2ab0d922551909c7ba
)

typeset -U other_bundles
other_bundles=(
  /opt/homebrew/etc/ca-certificates/cert.pem(N:A)
  /usr/local/etc/ca-certificates/cert.pem(N:A)
  /opt/homebrew/etc/openssl@3/cert.pem(N:A)
  /usr/local/etc/openssl@3/cert.pem(N:A)
  /Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/*/lib/python3*/site-packages/pip/_vendor/certifi/cacert.pem(N:A)
  /Library/Frameworks/Python.framework/Versions/*/lib/python*/site-packages/certifi/cacert.pem(N:A)
  /opt/homebrew/lib/python3*/site-packages/certifi/cacert.pem(N:A)
  /usr/local/lib/python3*/site-packages/certifi/cacert.pem(N:A)
  /Users/*/Library/Python/*/lib/python/site-packages/certifi/cacert.pem(N:A)
)

# trustd lists the 12 TLS intermediates by serial once Apple's block has reached the machine
apple_block_present() {
  local n=$(sqlite3 -readonly /private/var/protected/trustd/valid.sqlite3 "
    SELECT COUNT(DISTINCT serial) FROM serials WHERE serial IN (
      x'A4AEE678F23362B4C0E460B772F214', x'A024FDF4BA665C785CE4A020483858B7',
      x'6CADA367FB1C100088120EA202D568', x'E94223BDE92F914E5AB9ACABFDAC3710',
      x'C7C41EFE92D825F05EAE841A4A82C1', x'D8F8685E4F2BD9D82402A85A1C1EB731',
      x'588B2E3C2BB8CDA13E1A1209254321', x'91F347F1A5B7D39962B95E0EE4E299D1',
      x'296926C227A3A1526392B19482A504', x'8D5A4811939EF447D77111CDD9849AE9',
      x'8009928A64107601AF05FA2F19F109', x'05F078752DECE7A1BB8595D303167171')" 2>/dev/null)
  (( ${n:-0} >= 12 ))
}

has_root() {
  awk -v roots="$roots" '
    BEGIN { split(roots, r, " "); for (i in r) root[r[i]] = 1 }
    /-----BEGIN CERTIFICATE-----/ { b = ""; p = 1; next }
    /-----END CERTIFICATE-----/ { p = 0; if (b in root) { found = 1; exit } next }
    p { gsub(/[ \t\r]/, ""); b = b $0 }
    END { exit !found }' "$1"
}

exposure=0

apple_block_present || (( exposure |= 1 ))

[[ -f /etc/ssl/cert.pem ]] && has_root /etc/ssl/cert.pem && (( exposure |= 2 ))

for b in $other_bundles; do
  if has_root "$b"; then (( exposure |= 4 )); break; fi
done

sys_hashes=(${(f)"$(security find-certificate -a -Z /Library/Keychains/System.keychain 2>/dev/null \
                    | awk '/^SHA-1 hash:/{print tolower($3)}')"})
for h in $intermediates; do
  if (( ${sys_hashes[(Ie)$h]} )); then (( exposure |= 8 )); break; fi
done

exit $exposure

SELECT CASE WHEN COUNT(*) > 0 THEN 'FAILED' ELSE 'OK' END AS ztl_status,
       COUNT(*) AS compromised_certificates
FROM certificates
WHERE sha1 IN (
  'a99b289464f3b44343270a7a1e910f02370483fe', '1396be1372bc93dfa2a433ca964dba91548a6e57',
  '5f014e0db3bb8f950e0598ab280846d383fc57be', '5dfa19197d1c1cf629af7c0cd865543c5050227c',
  'f33acd1f5d31aa81ac18c72c928446226d3d5914', '19069bd6533bff93fb67c71fb3376b4ea7402c3b',
  '8ad23bc78845d6faae1d534bac89f0e36ba55a11', '4b0944c14f8c2ccba4e4f32104ad920fa15ee331',
  '7fcc31aab874ce6c8ee8584f54cfd08646b54117', '305fc1e253dcab71b95d4995dae3cb09d562f22a',
  'c988f3d0cc1629ffc43165d6464c9b6ef73d6e48', '8588708e875a1f8aa83524f3559080f7e17068c7',
  'd33195a244046a3263fb5e0e83c6803a5b2e7bc3', 'ee26d7ae3cc71718f6e07d7d0095076f0c158f63',
  '1f4a5d178f8b6a8ef0f6784155bd5fea91158b12', '7fde64753a957b98f172fd2ab0d922551909c7ba'
);

#!/bin/zsh
# Exit 0 = protected, 1 = a bundle or the System keychain could not be cleaned,
# 2 = cleaned, but trustd has not received Apple's block yet.

# Turbo stops a script after 3 seconds, too short to run openssl on each certificate of each bundle.
# So a single awk reads each bundle and compares the base64 text of each certificate with these two.
emsign_ecc_root_ca_g3=(  # SHA-1 3043fa4ff257dca0c380ee2e58ea78b23fe6bbc1
  MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG
  EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo
  bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g
  RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ
  TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s
  b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw
  djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0
  WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS
  fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB
  zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq
  hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB
  CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD
  +JbNR6iC8hZVdyR+EhCVBCyj
)
aaa_certificate_services=(  # SHA-1 d1eb23a46d17d68fd92564c2f1f1601764d8e349
  MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
  MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
  GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
  YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
  MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
  BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM
  GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP
  ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua
  BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe
  3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4
  YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR
  rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm
  ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU
  oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
  MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v
  QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t
  b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF
  AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q
  GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
  Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2
  G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi
  l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
  smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
)
roots="${(j::)emsign_ecc_root_ca_g3} ${(j::)aaa_certificate_services}"
intermediates=(
  a99b289464f3b44343270a7a1e910f02370483fe 1396be1372bc93dfa2a433ca964dba91548a6e57
  5f014e0db3bb8f950e0598ab280846d383fc57be 5dfa19197d1c1cf629af7c0cd865543c5050227c
  f33acd1f5d31aa81ac18c72c928446226d3d5914 19069bd6533bff93fb67c71fb3376b4ea7402c3b
  8ad23bc78845d6faae1d534bac89f0e36ba55a11 4b0944c14f8c2ccba4e4f32104ad920fa15ee331
  7fcc31aab874ce6c8ee8584f54cfd08646b54117 305fc1e253dcab71b95d4995dae3cb09d562f22a
  c988f3d0cc1629ffc43165d6464c9b6ef73d6e48 8588708e875a1f8aa83524f3559080f7e17068c7
  d33195a244046a3263fb5e0e83c6803a5b2e7bc3 ee26d7ae3cc71718f6e07d7d0095076f0c158f63
  1f4a5d178f8b6a8ef0f6784155bd5fea91158b12 7fde64753a957b98f172fd2ab0d922551909c7ba
)
clt_python=/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions

# :A resolves symlinks, so Homebrew's openssl@3 link and its target are cleaned once
typeset -U bundles clt_stdlibs
bundles=(
  /etc/ssl/cert.pem(N:A)
  /opt/homebrew/etc/ca-certificates/cert.pem(N:A)
  /usr/local/etc/ca-certificates/cert.pem(N:A)
  /opt/homebrew/etc/openssl@3/cert.pem(N:A)
  /usr/local/etc/openssl@3/cert.pem(N:A)
  $clt_python/*/lib/python3*/site-packages/pip/_vendor/certifi/cacert.pem(N:A)
  /Library/Frameworks/Python.framework/Versions/*/lib/python*/site-packages/certifi/cacert.pem(N:A)
  /opt/homebrew/lib/python3*/site-packages/certifi/cacert.pem(N:A)
  /usr/local/lib/python3*/site-packages/certifi/cacert.pem(N:A)
  /Users/*/Library/Python/*/lib/python/site-packages/certifi/cacert.pem(N:A)
)
clt_stdlibs=($clt_python/*/lib/python3.<->(N/:A))

apple_block_present() {
  local n=$(sqlite3 -readonly /private/var/protected/trustd/valid.sqlite3 "
    SELECT COUNT(DISTINCT serial) FROM serials WHERE serial IN (
      x'A4AEE678F23362B4C0E460B772F214', x'A024FDF4BA665C785CE4A020483858B7',
      x'6CADA367FB1C100088120EA202D568', x'E94223BDE92F914E5AB9ACABFDAC3710',
      x'C7C41EFE92D825F05EAE841A4A82C1', x'D8F8685E4F2BD9D82402A85A1C1EB731',
      x'588B2E3C2BB8CDA13E1A1209254321', x'91F347F1A5B7D39962B95E0EE4E299D1',
      x'296926C227A3A1526392B19482A504', x'8D5A4811939EF447D77111CDD9849AE9',
      x'8009928A64107601AF05FA2F19F109', x'05F078752DECE7A1BB8595D303167171')" 2>/dev/null)
  (( ${n:-0} >= 12 ))
}

has_root() {
  awk -v roots="$roots" '
    BEGIN { split(roots, r, " "); for (i in r) root[r[i]] = 1 }
    /-----BEGIN CERTIFICATE-----/ { b = ""; p = 1; next }
    /-----END CERTIFICATE-----/ { p = 0; if (b in root) { found = 1; exit } next }
    p { gsub(/[ \t\r]/, ""); b = b $0 }
    END { exit !found }' "$1"
}

# rewrites the file in place, so its owner, mode and any symlink pointing at it are kept
strip_roots() {
  local src=$1 tmp=$(mktemp) rc
  if ! awk -v roots="$roots" '
    BEGIN { split(roots, r, " "); for (i in r) root[r[i]] = 1 }
    /-----BEGIN CERTIFICATE-----/ { pem = $0 "\n"; b = ""; p = 1; next }
    !p { next }
    { pem = pem $0 "\n" }
    /-----END CERTIFICATE-----/ { p = 0; if (!(b in root)) { printf "%s", pem; kept++ } next }
    { gsub(/[ \t\r]/, ""); b = b $0 }
    END { exit !kept }' "$src" > "$tmp"; then
    rm -f "$tmp"
    return 1
  fi
  [[ -e "$src.pre-emudhra" ]] || cp -p "$src" "$src.pre-emudhra" || { rm -f "$tmp"; return 1; }
  cat "$tmp" > "$src"
  rc=$?
  rm -f "$tmp"
  return $rc
}

rc=0

for b in $bundles; do
  has_root "$b" || continue
  if strip_roots "$b" && ! has_root "$b"; then
    print "removed the roots from $b"
  else
    print -u2 "could not clean $b"
    rc=1
  fi
done

# the virtual environments created from the built-in python3 bring their own pip, and its own copy of the roots
for d in $clt_stdlibs; do
  grep -qs PIP_CERT "$d/sitecustomize.py" && continue
  print 'import os; os.environ.setdefault("PIP_CERT", "/etc/ssl/cert.pem")' >> "$d/sitecustomize.py" \
    && chmod 644 "$d/sitecustomize.py" || rc=1
done

sys_hashes=(${(f)"$(security find-certificate -a -Z /Library/Keychains/System.keychain 2>/dev/null \
                    | awk '/^SHA-1 hash:/{print tolower($3)}')"})
for h in $intermediates; do
  (( ${sys_hashes[(Ie)$h]} )) || continue
  security delete-certificate -t -Z ${(U)h} /Library/Keychains/System.keychain || rc=1
done

(( rc )) && exit 1
apple_block_present || exit 2
exit 0

#!/bin/zsh
# Exit 0 = both forged chains refused, 1 = a forged chain was trusted, 2 = a host could not be reached.
rc=0
for host in dv-g3b-emudhra.we-have-a-problem.com dv-g3b-aaa-emudhra.we-have-a-problem.com; do
  /usr/bin/curl -s -o /dev/null --max-time 15 "https://$host/"
  case $? in
    0) rc=1 ;;            # TLS handshake accepted
    35|51|60) ;;          # certificate refused
    *) (( rc == 1 )) || rc=2 ;;
  esac
done
exit $rc

emudhra/
├── main.tf
└── scripts/
    ├── emudhra_ca_exposure.zsh
    ├── emudhra_ca_remediation.zsh
    ├── emudhra_ca_probe.zsh
    └── emudhra_ca_keychains.sql

terraform {
  required_providers {
    zentral = {
      source  = "zentralopensource/zentral"
      version = "~> 0.1.84"
    }
  }
}

# base_url and token come from the ZTL_API_BASE_URL and ZTL_API_TOKEN environment variables
provider "zentral" {}

variable "turbo_configuration_ids" {
  description = "IDs of the Turbo configurations the eMudhra jobs are scheduled in."
  type        = set(string)
}

variable "osquery_configuration_name" {
  description = "Name of the osquery configuration the keychain query is added to."
  type        = string
}

variable "canary_serial_numbers" {
  description = "Serial numbers of the test Macs the remediation is tried on first."
  type        = set(string)
}

variable "rollout_stage" {
  description = "1: detect everywhere, remediate the canaries. 2: probe the canaries. 3: remediate the fleet."
  type        = number
  default     = 1

  validation {
    condition     = contains([1, 2, 3], var.rollout_stage)
    error_message = "The rollout stage is 1, 2 or 3."
  }
}

# Detection

resource "zentral_tag" "emudhra_protected" {
  name = "emudhra-protected"
}

resource "zentral_turbo_script" "emudhra_exposure" {
  name        = "eMudhra CA exposure"
  description = "Exit bits: 1 Apple block missing, 2 root in /etc/ssl/cert.pem, 4 root in another bundle, 8 intermediate in the System keychain"
  # trimspace: the API strips the surrounding whitespace, the file's trailing newline included
  source = trimspace(file("${path.module}/scripts/emudhra_ca_exposure.zsh"))

  compliance_check_enabled = true
  tag_id                   = zentral_tag.emudhra_protected.id
}

resource "zentral_turbo_recurring_job" "emudhra_exposure" {
  for_each = var.turbo_configuration_ids

  configuration_id = each.value
  job_id           = zentral_turbo_script.emudhra_exposure.job_id
  interval         = 3600
}

data "zentral_osquery_configuration" "default" {
  name = var.osquery_configuration_name
}

resource "zentral_osquery_pack" "emudhra" {
  name        = "eMudhra CA"
  description = "Compromised eMudhra intermediates in the keychains"
}

resource "zentral_osquery_query" "emudhra_keychains" {
  name                     = "eMudhra CA intermediates in keychains"
  sql                      = trimspace(file("${path.module}/scripts/emudhra_ca_keychains.sql"))
  platforms                = ["darwin"]
  compliance_check_enabled = true

  scheduling = {
    pack_id  = zentral_osquery_pack.emudhra.id
    interval = 3600
    # Zentral only scores a compliance check query scheduled in snapshot mode,
    # and snapshot mode has no removed actions to log
    snapshot_mode       = true
    log_removed_actions = false
  }
}

resource "zentral_osquery_configuration_pack" "emudhra" {
  configuration_id = data.zentral_osquery_configuration.default.id
  pack_id          = zentral_osquery_pack.emudhra.id
}

# Remediation

resource "zentral_turbo_script" "emudhra_remediation" {
  name        = "eMudhra CA remediation"
  description = "Exit 0 protected, 1 a bundle or the System keychain could not be cleaned, 2 Apple block still missing"
  source      = trimspace(file("${path.module}/scripts/emudhra_ca_remediation.zsh"))
}

resource "zentral_turbo_one_time_job" "emudhra_remediation_canaries" {
  for_each = var.turbo_configuration_ids

  configuration_id = each.value
  job_id           = zentral_turbo_script.emudhra_remediation.job_id
  serial_numbers   = var.canary_serial_numbers
}

resource "zentral_turbo_script" "emudhra_probe" {
  name        = "eMudhra CA probe"
  description = "Exit 0 both forged chains refused, 1 a forged chain trusted, 2 a test host unreachable"
  source      = trimspace(file("${path.module}/scripts/emudhra_ca_probe.zsh"))
}

resource "zentral_turbo_one_time_job" "emudhra_probe_canaries" {
  for_each = var.rollout_stage >= 2 ? var.turbo_configuration_ids : toset([])

  configuration_id = each.value
  job_id           = zentral_turbo_script.emudhra_probe.job_id
  serial_numbers   = var.canary_serial_numbers
}

resource "zentral_turbo_recurring_job" "emudhra_remediation" {
  for_each = var.rollout_stage >= 3 ? var.turbo_configuration_ids : toset([])

  configuration_id = each.value
  job_id           = zentral_turbo_script.emudhra_remediation.job_id
  interval         = 3600
  # a machine leaves the job as soon as the exposure check tags it, and comes back if a later check fails
  excluded_tag_ids = [zentral_tag.emudhra_protected.id]
}

turbo_configuration_ids    = ["e2b5e1f0-3c39-4c1e-9d6a-0b5d7d6f2a11"]
osquery_configuration_name = "Default"
canary_serial_numbers      = ["C02ZX0AAAA01", "C02ZX0AAAA02"]
rollout_stage              = 1