From 5f7a06044e8667bf0f3e1a2e2a8ebb2d6602a93e Mon Sep 17 00:00:00 2001 From: Ian Littman Date: Thu, 21 Nov 2024 10:49:39 -0600 Subject: [PATCH] Populate disk encryption status when pulling a host by device auth token (#24014) No performance impact since we're already querying that table. @mostlikelee found this bug when trying to end-to-end test Linux disk encryption escrow triggering (#23583). The added tests panic without the extra line in the query. # Checklist for submitter - [x] Added/updated tests ~~- [ ] Manual QA for all new/changed functionality~~ Handled as part of E2E LUKS testing --- server/datastore/mysql/hosts.go | 1 + server/datastore/mysql/hosts_test.go | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/server/datastore/mysql/hosts.go b/server/datastore/mysql/hosts.go index 542ffac282..b2f7f3a650 100644 --- a/server/datastore/mysql/hosts.go +++ b/server/datastore/mysql/hosts.go @@ -2440,6 +2440,7 @@ func (ds *Datastore) LoadHostByDeviceAuthToken(ctx context.Context, authToken st COALESCE(hd.gigs_disk_space_available, 0) as gigs_disk_space_available, COALESCE(hd.percent_disk_space_available, 0) as percent_disk_space_available, COALESCE(hd.gigs_total_disk_space, 0) as gigs_total_disk_space, + hd.encrypted as disk_encryption_enabled, IF(hdep.host_id AND ISNULL(hdep.deleted_at), true, false) AS dep_assigned_to_fleet FROM host_device_auth hda diff --git a/server/datastore/mysql/hosts_test.go b/server/datastore/mysql/hosts_test.go index 6fe89b4768..de3fe566e7 100644 --- a/server/datastore/mysql/hosts_test.go +++ b/server/datastore/mysql/hosts_test.go @@ -6194,6 +6194,17 @@ func testHostsLoadHostByDeviceAuthToken(t *testing.T, ds *Datastore) { require.Equal(t, hSimple.ID, loadSimple.ID) require.True(t, loadSimple.IsOsqueryEnrolled()) + // make sure disk encryption state is reflected + require.Nil(t, loadSimple.DiskEncryptionEnabled) + require.NoError(t, ds.SetOrUpdateHostDisksEncryption(ctx, hSimple.ID, false)) + loadSimple, err = ds.LoadHostByDeviceAuthToken(ctx, "simple", time.Second*3) + require.NoError(t, err) + require.False(t, *loadSimple.DiskEncryptionEnabled) + require.NoError(t, ds.SetOrUpdateHostDisksEncryption(ctx, hSimple.ID, true)) + loadSimple, err = ds.LoadHostByDeviceAuthToken(ctx, "simple", time.Second*3) + require.NoError(t, err) + require.True(t, *loadSimple.DiskEncryptionEnabled) + // create a host that will be pending enrollment in Fleet MDM hFleet := createHostWithDeviceToken("fleet") err = ds.SetOrUpdateMDMData(ctx, hFleet.ID, false, false, "https://fleetdm.com", true, fleet.WellKnownMDMFleet, "")