Commit graph

204 commits

Author SHA1 Message Date
Martin Angers
0242c870ab
Bugfix: improve performance of updating nano_enrollments.last_seen_at under load (#23957) 2024-11-20 14:08:27 -05:00
Victor Lyuboslavsky
e4df954b0f
Update nanomdm dependency with latest bug fixes and improvements. (#23906)
#23905 

- Update with upstream nanomdm changes up to
825f2979a2
- Removed PostgeSQL folder from our nanomdm
- Added nanomdm MySQL test job to our CI

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-11-20 11:47:11 -06:00
Ian Littman
9900b73b74
Add LUKS escrow trigger and orbit config endpoints, persist/retrieve LUKS passphrase (#23763)
#23583, #23584
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [ ] Manual QA for all new/changed functionality -- should be tested
end-to-end

---------

Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
2024-11-18 16:44:25 -06:00
Dante Catalfamo
00f0e2e5eb
Update cloudflare warp uninstall script again (#23874)
#22773

Missed calling this shell script mentioned on the cloudflare website
https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/remove-warp/
2024-11-18 10:15:08 -05:00
Jahziel Villasana-Espinoza
e27e916f74
fix: re-enroll devices that are removed from ABM and then added back (#23757)
> Related issue: #23200

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-11-14 18:31:12 -05:00
Martin Angers
c3ebce9293
Improve memory usage of software installers parsing (#23596) 2024-11-12 09:28:08 -05:00
Dante Catalfamo
17c3a1e552
Update golden scripts for warp and box fix (#23696)
#22773

Added/updated tests
2024-11-11 17:00:03 -05:00
Victor Lyuboslavsky
cab2426bf4
Added better handling of timeout and insufficient permissions errors in NDES SCEP proxy. (#23654)
#23525

# Demo
<div>
<a href="https://www.loom.com/share/e252ac2038b34941a9043867f79228f3">
<p>[Demo] Handling timeout and insufficient permission errors in NDES
#23525 - Watch Video</p>
    </a>
<a href="https://www.loom.com/share/e252ac2038b34941a9043867f79228f3">
<img style="max-width:300px;"
src="https://cdn.loom.com/sessions/thumbnails/e252ac2038b34941a9043867f79228f3-2ff60eb9e0f54dd5-full-play.gif">
    </a>
  </div>

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-11-11 14:57:28 -06:00
Dante Catalfamo
915213a0a3
Fix uninstall for Warp and Box (#23652)
#22773
2024-11-11 14:20:31 -05:00
Victor Lyuboslavsky
3cf99f8039
Enable staticcheck Go linter. (#23487)
#23486 

Linter: https://staticcheck.dev/
2024-11-05 11:16:24 -06:00
Victor Lyuboslavsky
e2d9a9016c
Add gosimple linter (#23250)
#23249

Add gosimple linter to golangci-lint CI job.
2024-10-29 14:17:51 -05:00
Jahziel Villasana-Espinoza
0bf331786e chore: dump sql schema 2024-10-25 18:01:19 -04:00
Victor Lyuboslavsky
0a612a06b4
Remove pending MDM device from Fleet (#23067)
#22331

# Demo of fix
<div>
<a href="https://www.loom.com/share/6bc958c626d04f2b84c0eedba59db78b">
<p>[Demo] Remove pending device from Fleet when removed from ABM #22331
- Watch Video</p>
    </a>
<a href="https://www.loom.com/share/6bc958c626d04f2b84c0eedba59db78b">
<img style="max-width:300px;"
src="https://cdn.loom.com/sessions/thumbnails/6bc958c626d04f2b84c0eedba59db78b-8109a9f07d46ad52-full-play.gif">
    </a>
  </div>

# Checklist for submitter

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Manual QA for all new/changed functionality

---------

Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
2024-10-24 16:42:30 -05:00
Gabriel Hernandez
8838630b2f Merge branch 'main' into feat-setup-experience 2024-10-23 12:20:41 +01:00
Tim Lee
d69100940e
Add config for custom MDM URL (#22878) 2024-10-22 11:05:35 -06:00
Gabriel Hernandez
d5689dd0fe Merge branch 'main' into feat-setup-experience 2024-10-21 12:36:50 +01:00
Sarah Gillespie
65e374c85c
Fix bug in ABM token renewal flow (#22988) 2024-10-18 13:16:04 -05:00
Victor Lyuboslavsky
f85b6f776f
Updating golangci-lint to 1.61.0 (#22973) 2024-10-18 12:38:26 -05:00
Dante Catalfamo
2861f79941
Update apps.json bundle identifiers (#22967)
I installed each of the apps and checked the bundle identifiers
2024-10-16 15:07:55 -04:00
Dante Catalfamo
6af7c23a5b
Start/Enqueue setup experience (#22664)
#22379
2024-10-10 11:46:23 -04:00
Roberto Dip
c02af491c2
fix typos and ensure installers with choices work (#22800)
for #22774

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-10-09 18:24:25 -03:00
Victor Lyuboslavsky
567803955e
NDES SCEP proxy backend (#22542)
#21955

<div>
<a href="https://www.loom.com/share/ba40b440502845d2861fd3ec7611bade">
<p>[Demo] Deploy SCEP certificates from Network Device Enrollment
Service (NDES) #21955 - Watch Video</p>
    </a>
<a href="https://www.loom.com/share/ba40b440502845d2861fd3ec7611bade">
<img style="max-width:300px;"
src="https://cdn.loom.com/sessions/thumbnails/ba40b440502845d2861fd3ec7611bade-84f2d88c9f5106c2-full-play.gif">
    </a>
  </div>

Note: A few remaining subtasks will be done in a follow-up PR. See
#22123 for a detailed list.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-10-09 13:47:27 -05:00
Roberto Dip
c4c8efb5b1
Back-end fixes for FMA (#22742)
for https://github.com/fleetdm/fleet/issues/22733,
https://github.com/fleetdm/fleet/issues/22734 and
https://github.com/fleetdm/fleet/issues/22735

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-10-08 12:49:11 -03:00
Roberto Dip
ad99cbd499
FMA: missing pieces (#22593)
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
- [ ] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [ ] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit
feature/bugfix should only apply to one platform (`runtime.GOOS`).
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
2024-10-03 14:49:27 -03:00
Gabriel Hernandez
65668bed61 Merge branch 'main' into feat-fleet-app-library 2024-09-27 13:25:21 +01:00
Victor Lyuboslavsky
e0faa14025
Updating scep package with latest fixes (#22372)
Updating scep package with changes up to
github.com/micromdm/scep@781f8042a79cabcf61a5e6c01affdbadcb785932
Fixes needed for NDES client for #21955 

Manually pulled in the recent changes. You can view the changes in the
remote like:
https://github.com/getvictor/scep/compare/fleet...micromdm%3Ascep%3Amain
2024-09-27 07:04:11 -05:00
Jahziel Villasana-Espinoza
7f39281937
feat: use a 15 minute timeout for adding a maintained app (#22247)
> Related issue: #22239

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-09-19 15:42:17 -04:00
Dante Catalfamo
b45c8b02c9
List Available Fleet Managed Apps (#22059)
#21777
2024-09-19 10:43:40 -04:00
Jahziel Villasana-Espinoza
92e0da0c7b
feat: add fleet-maintained software (#22031)
> Related issue: #21776 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-09-18 12:21:53 -04:00
Gabriel Hernandez
ba5a9ec99e Merge branch 'main' into feat-fleet-app-library 2024-09-18 16:10:12 +01:00
Roberto Dip
2bfbf2fe3f
Allow CA certificates with extendedKeyUsage attributes. (#22160) 2024-09-17 18:07:34 -03:00
Gabriel Hernandez
c4127e0ae9 Merge branch 'main' into feat-fleet-app-library 2024-09-16 11:55:31 +01:00
Roberto Dip
519ee09117
add new changes for BYOD and fix issues (#22079)
for #21019 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-09-13 14:53:05 -03:00
Gabriel Hernandez
08ca8c3b3d Merge branch 'main' into feat-fleet-app-library 2024-09-12 10:59:24 +01:00
Martin Angers
58f348a274
Maintained Apps: Add postman to the list of maintained apps (#21974) 2024-09-11 10:07:55 -04:00
Jahziel Villasana-Espinoza
385da248cb
feat: validate profile with apple (#21862)
> Related issue: #17558

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-09-10 18:44:58 -04:00
Martin Angers
b30e765554
Maintained Apps: add cron job, fix ingestion following latest specs (#21959) 2024-09-10 16:27:18 -04:00
Roberto Dip
05818902cd
implement OTA enrollment (#21942)
for #21019

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-09-10 16:52:17 -03:00
Martin Angers
9abd5a59d0
Maintained Apps: define app list, implement ingestion (#21946) 2024-09-10 13:55:13 -04:00
Roberto Dip
4eb9cf72ad
MABM: fixes and re-enable integration tests (#21834)
for #21309, this also fixes a few bugs found along the way

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-09-05 14:10:35 -03:00
Roberto Dip
c0373cbe51
add end user BYOD enrollment into Fleet MDM (#21836)
relates to #19448

Adds the ability for a user to enroll a their device into fleet MDM.

> NOTE: this is the PR for the feature branch to go into main so all
code has already been approved.
2024-09-05 11:24:06 -03:00
Roberto Dip
a8b7dba58f
fixes for getting an OTA profile (#21837)
minor unreleased fixes for #21557 

# Checklist for submitter

- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-09-05 10:54:54 -03:00
Martin Angers
a16733e02f
MABM: fix/update non-integration MABM-related skipped tests (#21799) 2024-09-04 10:08:22 -04:00
Gabriel Hernandez
910b5a7b2b Merge branch 'main' into feat-byod-enrollment 2024-09-04 14:21:21 +01:00
Roberto Dip
f6165a220a
fix: properly catch and log APNs errors (#21753)
found reproducing other issues:

1. In the APNs cron, the logger wasn't good enough to print an slice and
the log message was "unsupported type"
2. `APNSDeliveryError` _always_ had `Err` set to nil, while we were
catching those errors, it was impossible to see the cause in the logs
(always printed err=nil)

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Manual QA for all new/changed functionality
2024-09-03 11:40:17 -03:00
Jahziel Villasana-Espinoza
4430cd5883
feat: add endpoint for getting an ota profile (#21655)
> Related issue: #21557

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-08-30 09:04:10 -04:00
Jahziel Villasana-Espinoza
a00559e732
feat: enable multiple ABM and VPP tokens (#21693)
> Related issue: #9956 

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [x] Added/updated tests
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Manual QA for all new/changed functionality

---------

Co-authored-by: Martin Angers <martin.n.angers@gmail.com>
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
Co-authored-by: Roberto Dip <rroperzh@gmail.com>
Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
Co-authored-by: Dante Catalfamo <43040593+dantecatalfamo@users.noreply.github.com>
Co-authored-by: Roberto Dip <dip.jesusr@gmail.com>
2024-08-29 18:51:46 -04:00
Roberto Dip
63a46343b8
allow special characters in enrollment profile org name (#21630)
for #19808

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2024-08-28 15:00:11 -03:00
Sarah Gillespie
27d22d29e5
Enforce latest OS when macOS, iOS, and iPadOS hosts automatically enroll (#21291) 2024-08-21 13:21:11 -05:00
Victor Lyuboslavsky
734357af14
Deleting an ABM iOS/iPadOS host keeps it in Fleet. (#21433)
#21073 
- Deleted iOS/iPadOS host will continue to report to Fleet as long as
host is in Apple Business Manager (ABM).
- Refetching an offline iOS/iPadOS host will not add new MDM commands to
the queue if previous refetch has not completed yet.

Video demo:
https://www.loom.com/share/2f7ecb22e1924d4cbbbdd7dd297439ef?sid=dbfe1939-cb46-47ca-a7a8-84965ed68a7e

I considered `nano_command_results` but could not think of an efficient
way to use `nano_command_results` to determine if refetch was already
done. The problem is that we're overloading `command_uuid` to include
the `REFETCH` identifier. So we can't simply add an index on `(uuid,
command_uuid, updated_at)`. We need to do a partial text match on
`command_uuid` which then requires a full scan of the matching
`updated_at` timestamps. It feels like a search like this could blow up
for a large `nano_enrollment_queue` and `nano_command_results` table.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated tests
- [x] If database migrations are included, checked table schema to
confirm autoupdate
- For database migrations:
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Manual QA for all new/changed functionality
2024-08-21 08:51:04 -05:00