Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

maintenance merge of main into feature branch (#14393)

Browse Source 
maintenance merge of `main` into feature branch
This commit is contained in:
Jacob Shandling
2023-10-09 14:28:35 -07:00
committed by GitHub
parent a85f399cac
commit eb327faabf
245 changed files with 6874 additions and 2031 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/fleet/cron.go
+2 -1
View File
@@ -18,6 +18,7 @@ import (
"github.com/fleetdm/fleet/v4/server/contexts/license"
"github.com/fleetdm/fleet/v4/server/datastore/mysql"
"github.com/fleetdm/fleet/v4/server/fleet"
"github.com/fleetdm/fleet/v4/server/mdm"
apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
"github.com/fleetdm/fleet/v4/server/policies"
"github.com/fleetdm/fleet/v4/server/ptr"
@@ -838,7 +839,7 @@ func verifyDiskEncryptionKeys(
if key.UpdatedAt.After(latest) {
latest = key.UpdatedAt
}
if _, err := apple_mdm.DecryptBase64CMS(key.Base64Encrypted, cert.Leaf, cert.PrivateKey); err != nil {
if _, err := mdm.DecryptBase64CMS(key.Base64Encrypted, cert.Leaf, cert.PrivateKey); err != nil {
undecryptable = append(undecryptable, key.HostID)
continue
}
cmd/fleetctl/apply_test.go
+8 -8
View File
@@ -1044,13 +1044,13 @@ spec:
foo: qux
name: Team1
mdm:
enable_disk_encryption: false
macos_updates:
minimum_version: 10.10.10
deadline: 1992-03-01
macos_settings:
custom_settings:
- %s
enable_disk_encryption: false
secrets:
- secret: BBB
`, mobileConfigPath))
@@ -1062,9 +1062,9 @@ spec:
require.Equal(t, "[+] applied 1 teams\n", runAppForTest(t, []string{"apply", "-f", name}))
assert.JSONEq(t, string(json.RawMessage(`{"config":{"views":{"foo":"qux"}}}`)), string(*savedTeam.Config.AgentOptions))
assert.Equal(t, fleet.TeamMDM{
EnableDiskEncryption: false,
MacOSSettings: fleet.MacOSSettings{
CustomSettings: []string{mobileConfigPath},
EnableDiskEncryption: false,
CustomSettings: []string{mobileConfigPath},
},
MacOSUpdates: fleet.MacOSUpdates{
MinimumVersion: optjson.SetString("10.10.10"),
@@ -1097,9 +1097,9 @@ spec:
require.True(t, ds.NewJobFuncInvoked)
// all left untouched, only setup assistant added
assert.Equal(t, fleet.TeamMDM{
EnableDiskEncryption: false,
MacOSSettings: fleet.MacOSSettings{
CustomSettings: []string{mobileConfigPath},
EnableDiskEncryption: false,
CustomSettings: []string{mobileConfigPath},
},
MacOSUpdates: fleet.MacOSUpdates{
MinimumVersion: optjson.SetString("10.10.10"),
@@ -1129,9 +1129,9 @@ spec:
require.Equal(t, "[+] applied 1 teams\n", runAppForTest(t, []string{"apply", "-f", name}))
// all left untouched, only bootstrap package added
assert.Equal(t, fleet.TeamMDM{
EnableDiskEncryption: false,
MacOSSettings: fleet.MacOSSettings{
CustomSettings: []string{mobileConfigPath},
EnableDiskEncryption: false,
CustomSettings: []string{mobileConfigPath},
},
MacOSUpdates: fleet.MacOSUpdates{
MinimumVersion: optjson.SetString("10.10.10"),
@@ -2886,7 +2886,7 @@ spec:
macos_settings:
enable_disk_encryption: true
`,
wantErr: `Couldn't update macos_settings because MDM features aren't turned on in Fleet.`,
wantErr: `Couldn't edit enable_disk_encryption. Neither macOS MDM nor Windows is turned on`,
},
{
desc: "app config macos_settings.enable_disk_encryption false",
cmd/fleetctl/get.go
+14 -3
View File
@@ -13,6 +13,7 @@ import (
"time"
"github.com/fatih/color"
"github.com/fleetdm/fleet/v4/pkg/rawjson"
"github.com/fleetdm/fleet/v4/pkg/secure"
kithttp "github.com/go-kit/kit/transport/http"
"gopkg.in/guregu/null.v3"
@@ -167,12 +168,15 @@ func (eacp enrichedAppConfigPresenter) MarshalJSON() ([]byte, error) {
*fleet.VulnerabilitiesConfig
}
return json.Marshal(&struct {
fleet.EnrichedAppConfig
enrichedJSON, err := json.Marshal(fleet.EnrichedAppConfig(eacp))
if err != nil {
return nil, err
}
extraFieldsJSON, err := json.Marshal(&struct {
UpdateInterval UpdateIntervalConfigPresenter `json:"update_interval,omitempty"`
Vulnerabilities VulnerabilitiesConfigPresenter `json:"vulnerabilities,omitempty"`
}{
EnrichedAppConfig: fleet.EnrichedAppConfig(eacp),
UpdateInterval: UpdateIntervalConfigPresenter{
eacp.UpdateInterval.OSQueryDetail.String(),
eacp.UpdateInterval.OSQueryPolicy.String(),
@@ -184,6 +188,13 @@ func (eacp enrichedAppConfigPresenter) MarshalJSON() ([]byte, error) {
eacp.Vulnerabilities,
},
})
if err != nil {
return nil, err
}
// we need to marshal and combine both groups separately because
// enrichedAppConfig has a custom marshaler.
return rawjson.CombineRoots(enrichedJSON, extraFieldsJSON)
}
func printConfig(c *cli.Context, config interface{}) error {
cmd/fleetctl/get_test.go
+6 -7
View File
@@ -7,7 +7,6 @@ import (
"errors"
"fmt"
"io"
"io/ioutil"
"os"
"path/filepath"
"strings"
@@ -168,15 +167,15 @@ func TestGetTeams(t *testing.T) {
}, nil
}
b, err := ioutil.ReadFile(filepath.Join("testdata", "expectedGetTeamsText.txt"))
b, err := os.ReadFile(filepath.Join("testdata", "expectedGetTeamsText.txt"))
require.NoError(t, err)
expectedText := string(b)
b, err = ioutil.ReadFile(filepath.Join("testdata", "expectedGetTeamsYaml.yml"))
b, err = os.ReadFile(filepath.Join("testdata", "expectedGetTeamsYaml.yml"))
require.NoError(t, err)
expectedYaml := string(b)
b, err = ioutil.ReadFile(filepath.Join("testdata", "expectedGetTeamsJson.json"))
b, err = os.ReadFile(filepath.Join("testdata", "expectedGetTeamsJson.json"))
require.NoError(t, err)
// must read each JSON value separately and compact it
var buf bytes.Buffer
@@ -206,8 +205,8 @@ func TestGetTeams(t *testing.T) {
errBuffer.Reset()
actualJSON, err := runWithErrWriter([]string{"get", "teams", "--json"}, &errBuffer)
require.NoError(t, err)
require.Equal(t, expectedJson, actualJSON.String())
require.Equal(t, errBuffer.String() == expiredBanner.String(), tt.shouldHaveExpiredBanner)
require.Equal(t, expectedJson, actualJSON.String())
errBuffer.Reset()
actualYaml, err := runWithErrWriter([]string{"get", "teams", "--yaml"}, &errBuffer)
@@ -433,7 +432,7 @@ func TestGetHosts(t *testing.T) {
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
expected, err := ioutil.ReadFile(filepath.Join("testdata", tt.goldenFile))
expected, err := os.ReadFile(filepath.Join("testdata", tt.goldenFile))
require.NoError(t, err)
expectedResults := tt.scanner(string(expected))
actualResult := tt.scanner(runAppForTest(t, tt.args))
@@ -536,7 +535,7 @@ func TestGetHostsMDM(t *testing.T) {
}
if tt.goldenFile != "" {
expected, err := ioutil.ReadFile(filepath.Join("testdata", tt.goldenFile))
expected, err := os.ReadFile(filepath.Join("testdata", tt.goldenFile))
require.NoError(t, err)
if ext := filepath.Ext(tt.goldenFile); ext == ".json" {
// the output of --json is not a json array, but a list of
cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json
Vendored
+2 -2
View File
@@ -85,6 +85,7 @@
"enabled_and_configured": false,
"apple_bm_default_team": "",
"windows_enabled_and_configured": false,
"enable_disk_encryption": false,
"macos_updates": {
"minimum_version": null,
"deadline": null
@@ -95,8 +96,7 @@
"webhook_url": ""
},
"macos_settings": {
"custom_settings": null,
"enable_disk_encryption": false
"custom_settings": null
},
"macos_setup": {
"bootstrap_package": null,
cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
Vendored
+1 -1
View File
@@ -19,6 +19,7 @@ spec:
enabled_and_configured: false
apple_bm_default_team: ""
windows_enabled_and_configured: false
enable_disk_encryption: false
macos_migration:
enable: false
mode: ""
@@ -28,7 +29,6 @@ spec:
deadline: null
macos_settings:
custom_settings:
enable_disk_encryption: false
macos_setup:
bootstrap_package:
enable_end_user_authentication: false
cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
Vendored
+2 -2
View File
@@ -43,6 +43,7 @@
"apple_bm_enabled_and_configured": false,
"enabled_and_configured": false,
"windows_enabled_and_configured": false,
"enable_disk_encryption": false,
"macos_updates": {
"minimum_version": null,
"deadline": null
@@ -53,8 +54,7 @@
"webhook_url": ""
},
"macos_settings": {
"custom_settings": null,
"enable_disk_encryption": false
"custom_settings": null
},
"macos_setup": {
"bootstrap_package": null,
cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
Vendored
+1 -1
View File
@@ -19,6 +19,7 @@ spec:
apple_bm_terms_expired: false
enabled_and_configured: false
windows_enabled_and_configured: false
enable_disk_encryption: false
macos_migration:
enable: false
mode: ""
@@ -28,7 +29,6 @@ spec:
deadline: null
macos_settings:
custom_settings:
enable_disk_encryption: false
macos_setup:
bootstrap_package:
enable_end_user_authentication: false
cmd/fleetctl/testdata/expectedGetTeamsJson.json
Vendored
+4 -4
View File
@@ -24,13 +24,13 @@
"enable_software_inventory": true
},
"mdm": {
"enable_disk_encryption": false,
"macos_updates": {
"minimum_version": null,
"deadline": null
},
"macos_settings": {
"custom_settings": null,
"enable_disk_encryption": false
"custom_settings": null
},
"macos_setup": {
"bootstrap_package": null,
@@ -84,13 +84,13 @@
}
},
"mdm": {
"enable_disk_encryption": false,
"macos_updates": {
"minimum_version": "12.3.1",
"deadline": "2021-12-14"
},
"macos_settings": {
"custom_settings": null,
"enable_disk_encryption": false
"custom_settings": null
},
"macos_setup": {
"bootstrap_package": null,
cmd/fleetctl/testdata/expectedGetTeamsYaml.yml
Vendored
+2 -2
View File
@@ -7,12 +7,12 @@ spec:
enable_host_users: true
enable_software_inventory: true
mdm:
enable_disk_encryption: false
macos_updates:
minimum_version: null
deadline: null
macos_settings:
custom_settings:
enable_disk_encryption: false
macos_setup:
bootstrap_package:
enable_end_user_authentication: false
@@ -36,12 +36,12 @@ spec:
enable_host_users: false
enable_software_inventory: false
mdm:
enable_disk_encryption: false
macos_updates:
minimum_version: "12.3.1"
deadline: "2021-12-14"
macos_settings:
custom_settings:
enable_disk_encryption: false
macos_setup:
bootstrap_package:
enable_end_user_authentication: false
cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
Vendored
+1 -1
View File
@@ -19,13 +19,13 @@ spec:
apple_bm_terms_expired: false
enabled_and_configured: true
windows_enabled_and_configured: false
enable_disk_encryption: false
macos_migration:
enable: false
mode: ""
webhook_url: ""
macos_settings:
custom_settings: null
enable_disk_encryption: false
macos_setup:
bootstrap_package: null
enable_end_user_authentication: false
cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
Vendored
+1 -1
View File
@@ -19,13 +19,13 @@ spec:
apple_bm_terms_expired: false
enabled_and_configured: true
windows_enabled_and_configured: false
enable_disk_encryption: false
macos_migration:
enable: false
mode: ""
webhook_url: ""
macos_settings:
custom_settings: null
enable_disk_encryption: false
macos_setup:
bootstrap_package: %s
enable_end_user_authentication: false
cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml
Vendored
+2 -2
View File
@@ -7,9 +7,9 @@ spec:
enable_host_users: true
enable_software_inventory: true
mdm:
enable_disk_encryption: false
macos_settings:
custom_settings: null
enable_disk_encryption: false
macos_setup:
bootstrap_package: null
enable_end_user_authentication: false
@@ -27,9 +27,9 @@ spec:
enable_host_users: true
enable_software_inventory: true
mdm:
enable_disk_encryption: false
macos_settings:
custom_settings: null
enable_disk_encryption: false
macos_setup:
bootstrap_package: null
macos_setup_assistant: null
cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml
Vendored
+2 -2
View File
@@ -7,9 +7,9 @@ spec:
enable_host_users: true
enable_software_inventory: true
mdm:
enable_disk_encryption: false
macos_settings:
custom_settings: null
enable_disk_encryption: false
macos_setup:
bootstrap_package: %s
enable_end_user_authentication: false
@@ -27,9 +27,9 @@ spec:
enable_host_users: false
enable_software_inventory: false
mdm:
enable_disk_encryption: false
macos_settings:
custom_settings: null
enable_disk_encryption: false
macos_setup:
bootstrap_package: %s
macos_setup_assistant: %s
cmd/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml
Vendored
+1 -1
View File
@@ -7,9 +7,9 @@ spec:
enable_host_users: false
enable_software_inventory: false
mdm:
enable_disk_encryption: false
macos_settings:
custom_settings: null
enable_disk_encryption: false
macos_setup:
bootstrap_package: null
enable_end_user_authentication: false